// Configuração de segurança básica
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**", "/login", "/register").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
                .defaultSuccessUrl("/dashboard", true)
            )
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout")
                .invalidateHttpSession(true)
                .clearAuthentication(true)
            )
            .csrf(csrf -> csrf
                .ignoringRequestMatchers("/api/**") // Ignorar CSRF em APIs
            )
            .sessionManagement(session -> session
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
            );
        
        return http.build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
    
    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

// Serviço de detalhes do usuário
@Service
public class UsuarioDetailsService implements UserDetailsService {
    
    @Autowired
    private UsuarioRepository usuarioRepository;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Usuario usuario = usuarioRepository.findByEmail(username)
            .orElseThrow(() -> new UsernameNotFoundException("Usuário não encontrado: " + username));
        
        return UsuarioDetailsImpl.build(usuario);
    }
}

// Implementação de UserDetails
public class UsuarioDetailsImpl implements UserDetails {
    private static final long serialVersionUID = 1L;
    
    private Long id;
    private String username;
    private String email;
    private String password;
    private Collection<? extends GrantedAuthority> authorities;
    
    public UsuarioDetailsImpl(Long id, String username, String email, String password, 
                              Collection<? extends GrantedAuthority> authorities) {
        this.id = id;
        this.username = username;
        this.email = email;
        this.password = password;
        this.authorities = authorities;
    }
    
    public static UsuarioDetailsImpl build(Usuario usuario) {
        List<GrantedAuthority> authorities = usuario.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
            .collect(Collectors.toList());
        
        return new UsuarioDetailsImpl(
            usuario.getId(), 
            usuario.getUsername(), 
            usuario.getEmail(),
            usuario.getPassword(), 
            authorities
        );
    }
    
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }
    
    // Outros métodos obrigatórios...
}

// Serviço de geração e validação de tokens JWT
@Component
public class JwtTokenUtil {
    
    private String SECRET_KEY = "mySecretKey"; // Em produção, use chave segura e variável de ambiente
    
    public String generateToken(UsuarioDetailsImpl userDetails) {
        Map<String, Object> claims = new HashMap<>();
        return createToken(claims, userDetails.getUsername());
    }
    
    private String createToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10)) // 10 horas
                .signWith(SignatureAlgorithm.HS512, SECRET_KEY)
                .compact();
    }
    
    public Boolean validateToken(String token, UsuarioDetailsImpl userDetails) {
        final String username = getUsernameFromToken(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
    
    public String getUsernameFromToken(String token) {
        return getClaimFromToken(token, Claims::getSubject);
    }
    
    public Date getExpirationDateFromToken(String token) {
        return getClaimFromToken(token, Claims::getExpiration);
    }
    
    public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = getAllClaimsFromToken(token);
        return claimsResolver.apply(claims);
    }
    
    private Claims getAllClaimsFromToken(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
    }
    
    private Boolean isTokenExpired(String token) {
        final Date expiration = getExpirationDateFromToken(token);
        return expiration.before(new Date());
    }
}

// Filtro de autenticação JWT
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    
    @Autowired
    private UsuarioDetailsService usuarioDetailsService;
    
    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                   HttpServletResponse response, 
                                   FilterChain chain) throws ServletException, IOException {
        
        final String requestTokenHeader = request.getHeader("Authorization");
        
        String username = null;
        String jwtToken = null;
        
        if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
            jwtToken = requestTokenHeader.substring(7);
            try {
                username = jwtTokenUtil.getUsernameFromToken(jwtToken);
            } catch (IllegalArgumentException e) {
                System.out.println("Não foi possível obter o token JWT");
            } catch (ExpiredJwtException e) {
                System.out.println("Token JWT expirado");
            }
        }
        
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.usuarioDetailsService.loadUserByUsername(username);
            
            if (jwtTokenUtil.validateToken(jwtToken, (UsuarioDetailsImpl) userDetails)) {
                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = 
                    new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                usernamePasswordAuthenticationToken
                    .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
            }
        }
        chain.doFilter(request, response);
    }
}

// Configuração de autenticação JWT
@Configuration
@EnableWebSecurity
public class JwtSecurityConfig {
    
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // Stateless
            );
        
        http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
}

// Prevenção de SQL Injection com JPA/Hibernate (parâmetros posicionais)
@Repository
public class UsuarioRepository {
    
    @PersistenceContext
    private EntityManager entityManager;
    
    // CORRETO - usando parâmetros para prevenir SQL injection
    public List<Usuario> buscarPorNome(String nome) {
        String jpql = "SELECT u FROM Usuario u WHERE u.nome = :nome";
        return entityManager.createQuery(jpql, Usuario.class)
                           .setParameter("nome", nome)
                           .getResultList();
    }
    
    // TAMBÉM CORRETO - usando Spring Data JPA (automaticamente seguro)
    public List<Usuario> findByNomeContaining(String nome) {
        // Spring Data JPA automaticamente previne SQL injection
        return findAll();
    }
}

// Prevenção de XSS com validação e sanitização
@Service
public class ValidacaoService {
    
    public String sanitizarTexto(String texto) {
        if (texto == null) return null;
        
        // Remover tags HTML perigosas
        return texto.replaceAll("<(script|iframe|object|embed|form|input|meta)[^>]*>.*?</\\1>", "")
                   .replaceAll("<[^>]*(onload|onerror|onclick|onmouseover)[^>]*>", "")
                   .trim();
    }
    
    // Validação de entrada com Bean Validation
    public void validarUsuario(Usuario usuario) {
        if (usuario.getEmail() != null && !isValidEmail(usuario.getEmail())) {
            throw new IllegalArgumentException("Email inválido");
        }
        
        if (usuario.getNome() != null && !sanitizarTexto(usuario.getNome()).equals(usuario.getNome())) {
            throw new IllegalArgumentException("Nome contém caracteres inválidos");
        }
    }
    
    private boolean isValidEmail(String email) {
        return email != null && email.matches("^[A-Za-z0-9+_.-]+@(.+)$");
    }
}

// Proteção contra CSRF com Spring Security (configuração)
@RestController
public class ExemploController {
    
    @PostMapping("/transferencia")
    public ResponseEntity<String> realizarTransferencia(@Valid @RequestBody TransferenciaDTO transferencia,
                                                        @AuthenticationPrincipal UsuarioDetailsImpl usuario) {
        // Operação protegida contra CSRF automaticamente pelo Spring Security
        // Se o token CSRF não for fornecido corretamente, a requisição será rejeitada
        return ResponseEntity.ok("Transferência realizada com sucesso");
    }
}

// DTO com validação
public class TransferenciaDTO {
    @NotNull
    @Positive
    private BigDecimal valor;
    
    @NotNull
    @Min(1)
    private Long contaOrigemId;
    
    @NotNull
    @Min(1)
    private Long contaDestinoId;
    
    // getters e setters...
}

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;
import java.util.Base64;

// Serviço de criptografia AES
@Component
public class CryptoService {
    
    public String criptografar(String texto, String chaveBase64) throws Exception {
        SecretKey chave = new SecretKeySpec(Base64.getDecoder().decode(chaveBase64), "AES");
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.ENCRYPT_MODE, chave);
        
        byte[] textoCriptografado = cipher.doFinal(texto.getBytes());
        return Base64.getEncoder().encodeToString(textoCriptografado);
    }
    
    public String descriptografar(String textoCriptografado, String chaveBase64) throws Exception {
        SecretKey chave = new SecretKeySpec(Base64.getDecoder().decode(chaveBase64), "AES");
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.DECRYPT_MODE, chave);
        
        byte[] textoDescriptografado = cipher.doFinal(
            Base64.getDecoder().decode(textoCriptografado)
        );
        return new String(textoDescriptografado);
    }
    
    // Gerar nova chave AES
    public String gerarChaveAES() throws Exception {
        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
        keyGenerator.init(256); // Tamanho da chave
        SecretKey chave = keyGenerator.generateKey();
        return Base64.getEncoder().encodeToString(chave.getEncoded());
    }
}

// Exemplo de proteção de dados sensíveis em entidade JPA
@Entity
@Table(name = "usuarios")
public class Usuario {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Convert(converter = CriptografiaConverter.class)
    private String numeroCartaoCredito;
    
    @Convert(converter = CriptografiaConverter.class)
    private String cpf;
    
    private String email;
    
    // getters e setters...
}

// Conversor JPA para criptografia de campos sensíveis
@Converter
public class CriptografiaConverter implements AttributeConverter<String, String> {
    
    @Autowired
    private CryptoService cryptoService;
    
    @Override
    public String convertToDatabaseColumn(String valor) {
        if (valor == null) return null;
        try {
            // Criptografar antes de salvar no banco
            return cryptoService.criptografar(valor, getChave());
        } catch (Exception e) {
            throw new RuntimeException("Erro ao criptografar dado", e);
        }
    }
    
    @Override
    public String convertToEntityAttribute(String valorCriptografado) {
        if (valorCriptografado == null) return null;
        try {
            // Descriptografar ao ler do banco
            return cryptoService.descriptografar(valorCriptografado, getChave());
        } catch (Exception e) {
            throw new RuntimeException("Erro ao descriptografar dado", e);
        }
    }
    
    private String getChave() {
        // Em produção, carregar chave de um sistema seguro de gerenciamento de chaves
        return System.getenv("ENCRYPTION_KEY");
    }
}

// Serviço de hash para senhas
@Service
public class HashService {
    
    private final SecureRandom secureRandom = new SecureRandom();
    
    public String hashSenha(String senha) {
        // Usar BCrypt para hashing de senhas (mais seguro que SHA-256 puro)
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(12);
        return encoder.encode(senha);
    }
    
    public boolean verificarSenha(String senhaInserida, String senhaHash) {
        BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(12);
        return encoder.matches(senhaInserida, senhaHash);
    }
    
    // Gerar salt para hashing (quando necessário)
    public String gerarSalt() {
        byte[] salt = new byte[16];
        secureRandom.nextBytes(salt);
        return Base64.getEncoder().encodeToString(salt);
    }
}