// 验证 JWT 密钥安全性
weakSecrets := []string{"change-me", "change-me-to-a-random-string", "secret", "password", "admin", "test"}
for _, weak := range weakSecrets {
    if appCfg.JWTSecret == weak || len(appCfg.JWTSecret) < 16 {
        log.Fatal("JWT secret must be at least 16 characters and not a common weak value.")
    }
}

registerWithRateLimit := func(c *ghttp.Context) {
    ip := c.ClientIP()
    if middleware.IsLoginBlocked(ip) {
        c.Error(http.StatusTooManyRequests, "请求过于频繁，请稍后再试")
        return
    }
    authController.Register(c)
}

var allowedTables = map[string]bool{
    "users":           true,
    "roles":           true,
    "menus":           true,
    "permissions":     true,
    "operation_logs":  true,
    "notifications":   true,
    "scheduled_tasks": true,
    "uploads":         true,
    "settings":        true,
}

func validateColumnName(col string) error {
    for _, c := range col {
        if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || 
             (c >= '0' && c <= '9') || c == '_') {
            return fmt.Errorf("无效的列名: %s", col)
        }
    }
    return nil
}

var sensitiveFields = map[string]bool{
    "password":        true,
    "new_password":    true,
    "token":           true,
    "secret":          true,
    "authorization":   true,
    // ...
}

func maskSensitiveFields(data any) any {
    // 递归脱敏，将敏感字段值替换为 "***"
}

func SafeError(err error, userMessage string) string {
    if err != nil {
        slog.Error("Internal error", "error", err.Error())
    }
    if IsProduction() {
        return userMessage  // 生产环境返回通用消息
    }
    // 开发环境可返回详细信息
}

func isSecureEnv() bool {
    return os.Getenv("APP_ENV") == "production" || os.Getenv("HTTPS") == "true"
}

// 通过 CORS_ALLOW_ORIGINS 环境变量配置允许的来源
if envOrigins := os.Getenv("CORS_ALLOW_ORIGINS"); envOrigins != "" {
    allowOrigins = strings.Split(envOrigins, ",")
}

// 等待中断信号进行优雅关闭
quit := make(chan os.Signal, 1)
signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
<-quit

// 给正在处理的请求最多30秒完成
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()

// 停止定时任务调度器
sched.Stop()

// 关闭 HTTP 服务器
srv.Shutdown(ctx)

func RecoveryMiddleware() ghttp.HandlerFunc {
    return func(c *ghttp.Context) {
        defer func() {
            if err := recover() {
                // 记录堆栈信息到日志
                stack := string(debug.Stack())
                Error("Panic recovered", "error", err, "stack", stack)
                
                // 返回通用 500 错误
                c.Error(http.StatusInternalServerError, "服务器内部错误")
                c.Abort()
            }
        }()
        c.Next()
    }
}

app.Router().Get("/health", func(c *ghttp.Context) {
    // 检查数据库连接
    dbErr := db.SQL.PingContext(ctx)
    if dbErr != nil {
        c.Error(http.StatusServiceUnavailable, "database unavailable")
        return
    }
    c.Success(map[string]any{
        "status":   "ok",
        "database": "connected",
    })
})

// 定期清理过期条目 (每 5 分钟)
func (rl *RateLimiter) cleanupExpiredEntries() {
    ticker := time.NewTicker(5 * time.Minute)
    for {
        select {
        case <-ticker.C:
            // 清理过期的窗口或解封的条目
        case <-rl.stopCleanup:
            return
        }
    }
}

// 定期清理过期登录尝试记录 (每 10 分钟)
func (l *LoginRateLimiter) cleanupExpiredAttempts() {
    ticker := time.NewTicker(10 * time.Minute)
    // ...
}

// 定期清理过期缓存条目 (每 1 分钟)
func (pc *PermissionCache) cleanupExpiredCache() {
    ticker := time.NewTicker(time.Minute)
    // ...
}

func RequestIDMiddleware() ghttp.HandlerFunc {
    return func(c *ghttp.Context) {
        requestID := c.Header("X-Request-ID")
        if requestID == "" {
            requestID = uuid.New().String()
        }
        c.SetHeader("X-Request-ID", requestID)
        c.Set("request_id", requestID)
        c.Next()
    }
}