app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      mediaSrc: ["'self'", "blob:"],
      connectSrc: ["'self'", "ws:", "wss:"]
    }
  }
}));

// Rate limiting general
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutos
  max: 100, // máximo 100 requests por IP
  message: "Demasiadas peticiones desde esta IP"
});

// Rate limiting para API
const apiLimiter = rateLimit({
  windowMs: 1 * 60 * 1000, // 1 minuto
  max: 10, // máximo 10 requests de API por minuto
  message: "Demasiadas peticiones de API desde esta IP"
});

function validateRtspUrl(url) {
  try {
    const urlObj = new URL(url);
    
    // Solo protocolo RTSP permitido
    if (urlObj.protocol !== 'rtsp:') {
      return { valid: false, error: 'Solo protocolo RTSP permitido' };
    }
    
    // Bloquear localhost
    const hostname = urlObj.hostname;
    if (!hostname || hostname === 'localhost' || hostname === '127.0.0.1') {
      return { valid: false, error: 'URLs localhost no permitidas' };
    }
    
    return { valid: true };
  } catch (error) {
    return { valid: false, error: 'Formato de URL inválido' };
  }
}

function sanitizeInput(input) {
  if (typeof input !== 'string') return '';
  // Remover caracteres peligrosos
  return input.replace(/[;&|`$(){}[\]\\]/g, '');
}

const maxStreams = process.env.MAX_CONCURRENT_STREAMS || 5;
if (activeStreams.size >= maxStreams) {
  return res.status(429).json({ 
    error: 'Límite de streams concurrentes alcanzado' 
  });
}

const timeout = setTimeout(() => {
  console.log(`Timeout para stream ${streamId}, terminando proceso`);
  ffmpeg.kill('SIGTERM');
  activeStreams.delete(streamId);
}, 300000); // 5 minutos timeout

const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' }),
    new winston.transports.Console()
  ]
});

// Log eventos de seguridad
logger.warn('Failed authentication attempt', { 
  ip: req.ip, 
  url: req.url, 
  timestamp: new Date() 
});

// Ejemplo de alerta por múltiples fallos
let failedAttempts = new Map();

function checkFailedAttempts(ip) {
  const attempts = failedAttempts.get(ip) || 0;
  if (attempts > 5) {
    // Enviar alerta
    sendSecurityAlert(`Multiple failed attempts from ${ip}`);
    // Bloquear IP temporalmente
    blockIP(ip, 3600000); // 1 hora
  }
  failedAttempts.set(ip, attempts + 1);
}