Secure Communication (HTTPs)

// Simplified representation of TLS handshake process
class TLSHandshakeSimulator {
  constructor() {
    this.clientRandom = null;
    this.serverRandom = null;
    this.masterSecret = null;
    this.sessionKeys = null;
  }
  
  simulateHandshake() {
    console.log("=== TLS 1.2 Handshake Simulation ===");
    
    // Step 1: Client Hello
    this.clientHello();
    
    // Step 2: Server Hello + Certificate + Server Hello Done
    this.serverHello();
    
    // Step 3: Client Key Exchange + Change Cipher Spec + Finished
    this.clientKeyExchange();
    
    // Step 4: Server Change Cipher Spec + Finished
    this.serverFinished();
    
    console.log("✅ Secure connection established!");
    console.log("Session Keys Generated:", this.sessionKeys ? "Yes" : "No");
  }
  
  clientHello() {
    console.log("\n1. 👋 Client Hello");
    
    this.clientRandom = this.generateRandom();
    
    const clientHello = {
      tlsVersion: "TLS 1.2",
      randomBytes: this.clientRandom,
      sessionId: null, // New session
      cipherSuites: [
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_RSA_WITH_AES_256_GCM_SHA384"
      ],
      compressionMethods: ["null"],
      extensions: {
        serverNameIndication: "secure-api.example.com",
        supportedGroups: ["secp256r1", "secp384r1"],
        ecPointFormats: ["uncompressed"],
        signatureAlgorithms: ["rsa_pkcs1_sha256", "ecdsa_secp256r1_sha256"]
      }
    };
    
    console.log("   Supported Cipher Suites:", clientHello.cipherSuites.length);
    console.log("   SNI:", clientHello.extensions.serverNameIndication);
    console.log("   Client Random:", this.clientRandom.substring(0, 16) + "...");
  }
  
  serverHello() {
    console.log("\n2. 🔐 Server Hello + Certificate");
    
    this.serverRandom = this.generateRandom();
    
    const serverHello = {
      tlsVersion: "TLS 1.2",
      randomBytes: this.serverRandom,
      sessionId: this.generateSessionId(),
      chosenCipherSuite: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      compressionMethod: "null",
      extensions: {
        ecPointFormats: ["uncompressed"]
      }
    };
    
    console.log("   Chosen Cipher Suite:", serverHello.chosenCipherSuite);
    console.log("   Server Random:", this.serverRandom.substring(0, 16) + "...");
    
    // Certificate chain simulation
    const certificateChain = {
      serverCert: {
        subject: "CN=secure-api.example.com",
        issuer: "CN=DigiCert SHA2 Secure Server CA",
        validFrom: "2024-01-01",
        validTo: "2025-01-01",
        algorithm: "RSA 2048-bit",
        fingerprint: "sha256:a1b2c3d4..."
      },
      intermediateCert: {
        subject: "CN=DigiCert SHA2 Secure Server CA",
        issuer: "CN=DigiCert Global Root CA"
      },
      rootCert: {
        subject: "CN=DigiCert Global Root CA",
        issuer: "CN=DigiCert Global Root CA" // Self-signed
      }
    };
    
    console.log("   Certificate Subject:", certificateChain.serverCert.subject);
    console.log("   Certificate Valid Until:", certificateChain.serverCert.validTo);
  }
  
  clientKeyExchange() {
    console.log("\n3. 🔑 Client Key Exchange");
    
    // Generate pre-master secret
    const preMasterSecret = this.generatePreMasterSecret();
    console.log("   Pre-master secret generated (encrypted with server's public key)");
    
    // Calculate master secret
    this.masterSecret = this.calculateMasterSecret(
      preMasterSecret,
      this.clientRandom,
      this.serverRandom
    );
    
    // Generate session keys
    this.sessionKeys = this.generateSessionKeys(this.masterSecret);
    
    console.log("   Master secret calculated");
    console.log("   Session keys derived:");
    console.log("     - Client MAC key");
    console.log("     - Server MAC key");
    console.log("     - Client encryption key");
    console.log("     - Server encryption key");
    console.log("     - Client IV");
    console.log("     - Server IV");
  }
  
  serverFinished() {
    console.log("\n4. ✅ Server Finished");
    console.log("   Handshake verification completed");
    console.log("   Ready for encrypted application data");
  }
  
  generateRandom() {
    // 32-byte random value (4 bytes timestamp + 28 random bytes)
    const timestamp = Math.floor(Date.now() / 1000);
    const randomBytes = Array.from(
      crypto.getRandomValues(new Uint8Array(28)),
      b => b.toString(16).padStart(2, '0')
    ).join('');
    
    return timestamp.toString(16).padStart(8, '0') + randomBytes;
  }
  
  generateSessionId() {
    return Array.from(
      crypto.getRandomValues(new Uint8Array(32)),
      b => b.toString(16).padStart(2, '0')
    ).join('');
  }
  
  generatePreMasterSecret() {
    // 48-byte pre-master secret for RSA key exchange
    return Array.from(
      crypto.getRandomValues(new Uint8Array(48)),
      b => b.toString(16).padStart(2, '0')
    ).join('');
  }
  
  calculateMasterSecret(preMasterSecret, clientRandom, serverRandom) {
    // Simplified representation of master secret calculation
    // Real implementation uses PRF (Pseudo-Random Function)
    return `master_secret_${preMasterSecret.substring(0, 16)}`;
  }
  
  generateSessionKeys(masterSecret) {
    // In real TLS, this uses PRF to generate multiple keys
    return {
      clientMacKey: `client_mac_${masterSecret.substring(0, 8)}`,
      serverMacKey: `server_mac_${masterSecret.substring(8, 16)}`,
      clientEncKey: `client_enc_${masterSecret.substring(16, 24)}`,
      serverEncKey: `server_enc_${masterSecret.substring(24, 32)}`,
      clientIV: `client_iv_${masterSecret.substring(32, 40)}`,
      serverIV: `server_iv_${masterSecret.substring(40, 48)}`
    };
  }
}

// Run the simulation
const tlsDemo = new TLSHandshakeSimulator();
tlsDemo.simulateHandshake();

// Node.js/Express HTTPS server setup
const https = require('https');
const fs = require('fs');
const express = require('express');

class SecureServer {
  constructor() {
    this.app = express();
    this.httpsServer = null;
    this.certificates = {};
    
    this.setupMiddleware();
  }
  
  setupMiddleware() {
    // Security headers
    this.app.use((req, res, next) => {
      // HSTS header
      res.setHeader(
        'Strict-Transport-Security',
        'max-age=31536000; includeSubDomains; preload'
      );
      
      // Other security headers
      res.setHeader('X-Content-Type-Options', 'nosniff');
      res.setHeader('X-Frame-Options', 'DENY');
      res.setHeader('X-XSS-Protection', '1; mode=block');
      
      next();
    });
    
    // Force HTTPS redirect
    this.app.use((req, res, next) => {
      if (req.header('x-forwarded-proto') !== 'https') {
        res.redirect(`https://${req.header('host')}${req.url}`);
      } else {
        next();
      }
    });
  }
  
  loadCertificates(certPath, keyPath, caPath = null) {
    try {
      this.certificates = {
        cert: fs.readFileSync(certPath, 'utf8'),
        key: fs.readFileSync(keyPath, 'utf8')
      };
      
      // Add intermediate certificates if provided
      if (caPath) {
        this.certificates.ca = fs.readFileSync(caPath, 'utf8');
      }
      
      console.log('✅ SSL certificates loaded successfully');
      return true;
    } catch (error) {
      console.error('❌ Failed to load SSL certificates:', error.message);
      return false;
    }
  }
  
  // Let's Encrypt certificate management
  async setupLetsEncrypt(domain, email) {
    console.log(`Setting up Let's Encrypt for ${domain}...`);
    
    // This would integrate with ACME client like node-acme-client
    const acme = require('acme-client');
    
    try {
      const client = new acme.Client({
        directoryUrl: acme.directory.letsencrypt.production,
        accountKey: await acme.crypto.createPrivateKey()
      });
      
      // Create account
      const account = await client.createAccount({
        termsOfServiceAgreed: true,
        contact: [`mailto:${email}`]
      });
      
      console.log('Let\'s Encrypt account created');
      
      // Create certificate signing request
      const [key, csr] = await acme.crypto.createCsr({
        commonName: domain,
        altNames: [`www.${domain}`]
      });
      
      // Request certificate
      const cert = await client.auto({
        csr,
        email,
        termsOfServiceAgreed: true,
        challengeCreateFn: this.createChallenge.bind(this),
        challengeRemoveFn: this.removeChallenge.bind(this)
      });
      
      // Save certificate files
      fs.writeFileSync(`./certs/${domain}.key`, key);
      fs.writeFileSync(`./certs/${domain}.crt`, cert);
      
      console.log('✅ Let\'s Encrypt certificate obtained');
      
      // Load the new certificates
      return this.loadCertificates(
        `./certs/${domain}.crt`,
        `./certs/${domain}.key`
      );
      
    } catch (error) {
      console.error('❌ Let\'s Encrypt setup failed:', error);
      return false;
    }
  }
  
  async createChallenge(authz, challenge, keyAuthorization) {
    console.log('Creating ACME challenge:', challenge.type);
    
    if (challenge.type === 'http-01') {
      // Create HTTP challenge endpoint
      const challengePath = `/.well-known/acme-challenge/${challenge.token}`;
      
      this.app.get(challengePath, (req, res) => {
        res.set('Content-Type', 'text/plain');
        res.send(keyAuthorization);
      });
      
      console.log(`Challenge available at: ${challengePath}`);
    }
  }
  
  async removeChallenge(authz, challenge, keyAuthorization) {
    console.log('Removing ACME challenge');
    // Clean up challenge endpoint
  }
  
  // Certificate validation and monitoring
  validateCertificate() {
    if (!this.certificates.cert) {
      return { valid: false, error: 'No certificate loaded' };
    }
    
    try {
      // Parse certificate to check expiration
      const cert = this.parseCertificate(this.certificates.cert);
      const now = new Date();
      const expiryDate = new Date(cert.validTo);
      const daysUntilExpiry = Math.floor((expiryDate - now) / (1000 * 60 * 60 * 24));
      
      const validation = {
        valid: daysUntilExpiry > 0,
        daysUntilExpiry,
        subject: cert.subject,
        issuer: cert.issuer,
        validFrom: cert.validFrom,
        validTo: cert.validTo,
        algorithm: cert.algorithm,
        keySize: cert.keySize
      };
      
      if (daysUntilExpiry < 30) {
        validation.warning = `Certificate expires in ${daysUntilExpiry} days`;
      }
      
      return validation;
    } catch (error) {
      return { valid: false, error: error.message };
    }
  }
  
  parseCertificate(certPem) {
    // Simplified certificate parsing (use actual crypto library in production)
    const crypto = require('crypto');
    const cert = new crypto.X509Certificate(certPem);
    
    return {
      subject: cert.subject,
      issuer: cert.issuer,
      validFrom: cert.validFrom,
      validTo: cert.validTo,
      fingerprint: cert.fingerprint,
      keyUsage: cert.keyUsage,
      ca: cert.ca
    };
  }
  
  // Automatic certificate renewal
  setupAutoRenewal(domain, email, renewalDays = 30) {
    const checkInterval = 24 * 60 * 60 * 1000; // 24 hours
    
    setInterval(async () => {
      const validation = this.validateCertificate();
      
      if (validation.valid && validation.daysUntilExpiry <= renewalDays) {
        console.log(`🔄 Auto-renewing certificate (${validation.daysUntilExpiry} days remaining)`);
        
        try {
          await this.setupLetsEncrypt(domain, email);
          
          // Reload server with new certificate
          await this.reloadCertificates();
          
          console.log('✅ Certificate auto-renewal completed');
        } catch (error) {
          console.error('❌ Auto-renewal failed:', error);
          
          // Send alert to administrators
          this.sendRenewalAlert(domain, error);
        }
      }
    }, checkInterval);
  }
  
  async reloadCertificates() {
    if (!this.httpsServer) return;
    
    // Gracefully reload certificates without downtime
    const newContext = this.createSecureContext();
    this.httpsServer.setSecureContext(newContext);
    
    console.log('🔄 SSL certificates reloaded');
  }
  
  createSecureContext() {
    const secureContext = {
      cert: this.certificates.cert,
      key: this.certificates.key
    };
    
    if (this.certificates.ca) {
      secureContext.ca = this.certificates.ca;
    }
    
    // TLS configuration
    secureContext.ciphers = [
      'ECDHE-RSA-AES128-GCM-SHA256',
      'ECDHE-RSA-AES256-GCM-SHA384',
      'ECDHE-RSA-AES128-SHA256',
      'ECDHE-RSA-AES256-SHA384'
    ].join(':');
    
    secureContext.honorCipherOrder = true;
    secureContext.secureProtocol = 'TLS_method';
    secureContext.secureOptions = require('constants').SSL_OP_NO_SSLv2 |
                                   require('constants').SSL_OP_NO_SSLv3 |
                                   require('constants').SSL_OP_NO_TLSv1 |
                                   require('constants').SSL_OP_NO_TLSv1_1;
    
    return secureContext;
  }
  
  startServer(port = 443) {
    if (!this.certificates.cert || !this.certificates.key) {
      throw new Error('SSL certificates not loaded');
    }
    
    const httpsOptions = this.createSecureContext();
    
    this.httpsServer = https.createServer(httpsOptions, this.app);
    
    this.httpsServer.listen(port, () => {
      console.log(`🔒 HTTPS server running on port ${port}`);
      
      // Log certificate info
      const validation = this.validateCertificate();
      if (validation.valid) {
        console.log(`📜 Certificate valid until: ${validation.validTo}`);
        console.log(`📅 Days until expiry: ${validation.daysUntilExpiry}`);
      }
    });
    
    // Error handling
    this.httpsServer.on('error', (error) => {
      console.error('HTTPS server error:', error);
    });
    
    this.httpsServer.on('tlsClientError', (error, tlsSocket) => {
      console.error('TLS client error:', error.message);
    });
    
    return this.httpsServer;
  }
  
  sendRenewalAlert(domain, error) {
    // Send email/SMS/Slack notification about renewal failure
    console.error(`🚨 URGENT: Certificate renewal failed for ${domain}:`, error);
    
    // Implementation would use nodemailer, Twilio, Slack webhook, etc.
  }
}

// Usage example
const secureServer = new SecureServer();

// Load existing certificates
if (secureServer.loadCertificates('./certs/cert.pem', './certs/key.pem')) {
  secureServer.startServer(443);
  
  // Setup auto-renewal
  secureServer.setupAutoRenewal('example.com', 'admin@example.com', 30);
}

// Or setup Let's Encrypt
// secureServer.setupLetsEncrypt('example.com', 'admin@example.com')
//   .then(() => secureServer.startServer(443));

// Advanced HSTS implementation
class HSTSManager {
  constructor() {
    this.config = {
      maxAge: 31536000, // 1 year
      includeSubDomains: true,
      preload: false // Set to true only after testing
    };
    
    this.preloadDomains = new Set();
  }
  
  // Generate HSTS header
  generateHSTSHeader(options = {}) {
    const config = { ...this.config, ...options };
    
    let header = `max-age=${config.maxAge}`;
    
    if (config.includeSubDomains) {
      header += '; includeSubDomains';
    }
    
    if (config.preload) {
      header += '; preload';
    }
    
    return header;
  }
  
  // HSTS middleware for Express
  middleware(options = {}) {
    return (req, res, next) => {
      // Only set HSTS on HTTPS connections
      if (req.secure || req.get('x-forwarded-proto') === 'https') {
        res.setHeader(
          'Strict-Transport-Security',
          this.generateHSTSHeader(options)
        );
      }
      next();
    };
  }
  
  // Domain-specific HSTS configuration
  domainMiddleware(domainConfigs) {
    return (req, res, next) => {
      const hostname = req.hostname;
      const config = domainConfigs[hostname] || this.config;
      
      if (req.secure || req.get('x-forwarded-proto') === 'https') {
        res.setHeader(
          'Strict-Transport-Security',
          this.generateHSTSHeader(config)
        );
      }
      next();
    };
  }
  
  // HSTS preload list management
  async submitToPreloadList(domain) {
    console.log(`Preparing ${domain} for HSTS preload list submission...`);
    
    // Check requirements
    const requirements = await this.checkPreloadRequirements(domain);
    
    if (!requirements.eligible) {
      console.error('❌ Domain not eligible for preload list:', requirements.issues);
      return false;
    }
    
    console.log('✅ Domain meets preload requirements');
    console.log('📋 Next steps:');
    console.log('   1. Visit https://hstspreload.org/');
    console.log('   2. Submit your domain');
    console.log('   3. Monitor for inclusion in browser preload lists');
    
    return true;
  }
  
  async checkPreloadRequirements(domain) {
    const issues = [];
    const checks = {
      httpsRedirect: false,
      hstsHeader: false,
      includeSubDomains: false,
      preloadDirective: false,
      validCertificate: false,
      minMaxAge: false
    };
    
    try {
      // Check HTTPS redirect
      const httpResponse = await fetch(`http://${domain}`, { 
        redirect: 'manual',
        timeout: 10000 
      });
      
      if (httpResponse.status >= 300 && httpResponse.status < 400) {
        const location = httpResponse.headers.get('location');
        if (location && location.startsWith('https://')) {
          checks.httpsRedirect = true;
        } else {
          issues.push('HTTP does not redirect to HTTPS');
        }
      } else {
        issues.push('No HTTPS redirect found');
      }
      
      // Check HTTPS and HSTS header
      const httpsResponse = await fetch(`https://${domain}`, { timeout: 10000 });
      const hstsHeader = httpsResponse.headers.get('strict-transport-security');
      
      if (hstsHeader) {
        checks.hstsHeader = true;
        
        // Parse HSTS header
        const maxAgeMatch = hstsHeader.match(/max-age=(\d+)/);
        const includeSubDomains = hstsHeader.includes('includeSubDomains');
        const preloadDirective = hstsHeader.includes('preload');
        
        if (maxAgeMatch && parseInt(maxAgeMatch[1]) >= 31536000) {
          checks.minMaxAge = true;
        } else {
          issues.push('HSTS max-age must be at least 1 year (31536000 seconds)');
        }
        
        if (includeSubDomains) {
          checks.includeSubDomains = true;
        } else {
          issues.push('HSTS header must include includeSubDomains directive');
        }
        
        if (preloadDirective) {
          checks.preloadDirective = true;
        } else {
          issues.push('HSTS header must include preload directive');
        }
      } else {
        issues.push('No HSTS header found on HTTPS response');
      }
      
      // Check certificate validity (simplified)
      checks.validCertificate = httpsResponse.ok;
      
    } catch (error) {
      issues.push(`Connection error: ${error.message}`);
    }
    
    const eligible = Object.values(checks).every(check => check);
    
    return {
      eligible,
      checks,
      issues
    };
  }
  
  // Remove domain from HSTS (for testing/development)
  generateRemovalHeader() {
    return 'max-age=0';
  }
  
  // HSTS reporting and monitoring
  generateReport(domains) {
    const report = {
      timestamp: new Date().toISOString(),
      domains: []
    };
    
    domains.forEach(async (domain) => {
      const requirements = await this.checkPreloadRequirements(domain);
      
      report.domains.push({
        domain,
        hstsEnabled: requirements.checks.hstsHeader,
        preloadEligible: requirements.eligible,
        issues: requirements.issues
      });
    });
    
    return report;
  }
}

// Usage example
const hstsManager = new HSTSManager();

// Basic HSTS middleware
app.use(hstsManager.middleware());

// Domain-specific HSTS configuration
app.use(hstsManager.domainMiddleware({
  'api.example.com': {
    maxAge: 63072000, // 2 years
    includeSubDomains: true,
    preload: true
  },
  'cdn.example.com': {
    maxAge: 31536000, // 1 year
    includeSubDomains: false,
    preload: false
  }
}));

// Check preload eligibility
hstsManager.checkPreloadRequirements('example.com')
  .then(result => {
    if (result.eligible) {
      console.log('✅ Ready for HSTS preload list');
    } else {
      console.log('❌ Issues to fix:', result.issues);
    }
  });

// Client-side certificate pinning implementation
class CertificatePinner {
  constructor() {
    this.pinnedCerts = new Map();
    this.pinnedKeys = new Map();
    this.violationReports = [];
  }
  
  // Pin certificate fingerprint
  pinCertificate(domain, fingerprints, options = {}) {
    const config = {
      algorithm: 'sha256', // sha1, sha256
      backup: false, // Include backup pins
      reportOnly: false, // Report violations but don't block
      reportUri: null,
      maxAge: 5184000, // 60 days in seconds
      includeSubDomains: false,
      ...options
    };
    
    this.pinnedCerts.set(domain, {
      fingerprints: Array.isArray(fingerprints) ? fingerprints : [fingerprints],
      config
    });
    
    console.log(`📌 Certificate pinned for ${domain}`);
  }
  
  // Pin public key hash (HPKP style)
  pinPublicKey(domain, keyHashes, options = {}) {
    const config = {
      algorithm: 'sha256',
      backup: true,
      reportOnly: false,
      reportUri: '/certificate-pin-report',
      maxAge: 5184000,
      includeSubDomains: false,
      ...options
    };
    
    this.pinnedKeys.set(domain, {
      keyHashes: Array.isArray(keyHashes) ? keyHashes : [keyHashes],
      config
    });
    
    console.log(`🔑 Public key pinned for ${domain}`);
  }
  
  // Verify certificate against pins
  async verifyCertificate(domain, certificate) {
    const pinConfig = this.pinnedCerts.get(domain) || 
                     this.pinnedKeys.get(domain);
    
    if (!pinConfig) {
      return { valid: true, reason: 'No pins configured' };
    }
    
    try {
      let isValid = false;
      
      if (this.pinnedCerts.has(domain)) {
        // Certificate fingerprint verification
        const fingerprint = await this.calculateFingerprint(
          certificate,
          pinConfig.config.algorithm
        );
        
        isValid = pinConfig.fingerprints.includes(fingerprint);
        
        if (!isValid) {
          this.reportPinViolation(domain, 'certificate', {
            expected: pinConfig.fingerprints,
            actual: fingerprint
          });
        }
      } else if (this.pinnedKeys.has(domain)) {
        // Public key hash verification
        const keyHash = await this.calculatePublicKeyHash(
          certificate,
          pinConfig.config.algorithm
        );
        
        isValid = pinConfig.keyHashes.includes(keyHash);
        
        if (!isValid) {
          this.reportPinViolation(domain, 'public-key', {
            expected: pinConfig.keyHashes,
            actual: keyHash
          });
        }
      }
      
      return {
        valid: isValid || pinConfig.config.reportOnly,
        pinned: true,
        reportOnly: pinConfig.config.reportOnly
      };
    } catch (error) {
      console.error('Certificate verification error:', error);
      return { valid: false, error: error.message };
    }
  }
  
  // Calculate certificate fingerprint
  async calculateFingerprint(certificate, algorithm = 'sha256') {
    const encoder = new TextEncoder();
    const data = encoder.encode(certificate);
    
    const hashBuffer = await crypto.subtle.digest(
      algorithm.toUpperCase(),
      data
    );
    
    return Array.from(new Uint8Array(hashBuffer))
      .map(b => b.toString(16).padStart(2, '0'))
      .join(':')
      .toUpperCase();
  }
  
  // Extract and hash public key
  async calculatePublicKeyHash(certificate, algorithm = 'sha256') {
    // This is a simplified implementation
    // Real implementation would parse X.509 certificate and extract public key
    
    const publicKey = this.extractPublicKey(certificate);
    const encoder = new TextEncoder();
    const data = encoder.encode(publicKey);
    
    const hashBuffer = await crypto.subtle.digest(
      algorithm.toUpperCase(),
      data
    );
    
    return btoa(String.fromCharCode(...new Uint8Array(hashBuffer)));
  }
  
  extractPublicKey(certificate) {
    // Simplified public key extraction
    // Real implementation would use crypto libraries to parse certificate
    const match = certificate.match(/-----BEGIN PUBLIC KEY-----(.*?)-----END PUBLIC KEY-----/s);
    return match ? match[1].replace(/\s/g, '') : '';
  }
  
  // Report pin violation
  reportPinViolation(domain, type, details) {
    const violation = {
      domain,
      type,
      details,
      timestamp: new Date().toISOString(),
      userAgent: navigator.userAgent,
      url: window.location.href
    };
    
    this.violationReports.push(violation);
    
    console.error('🚨 Certificate Pin Violation:', violation);
    
    // Send violation report
    const pinConfig = this.pinnedCerts.get(domain) || this.pinnedKeys.get(domain);
    if (pinConfig.config.reportUri) {
      this.sendViolationReport(violation, pinConfig.config.reportUri);
    }
  }
  
  async sendViolationReport(violation, reportUri) {
    try {
      await fetch(reportUri, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(violation)
      });
    } catch (error) {
      console.error('Failed to send pin violation report:', error);
    }
  }
  
  // Secure fetch with certificate pinning
  async secureFetch(url, options = {}) {
    const urlObj = new URL(url);
    const domain = urlObj.hostname;
    
    // Standard fetch
    const response = await fetch(url, options);
    
    // Verify certificate (simplified - real implementation would need access to TLS layer)
    const certificate = this.getCertificateFromResponse(response);
    if (certificate) {
      const verification = await this.verifyCertificate(domain, certificate);
      
      if (!verification.valid && !verification.reportOnly) {
        throw new Error(`Certificate pin validation failed for ${domain}`);
      }
    }
    
    return response;
  }
  
  getCertificateFromResponse(response) {
    // This is conceptual - browsers don't expose certificate details to JS
    // Real certificate pinning would need to be implemented at network layer
    // or using service workers with custom fetch handling
    return null;
  }
  
  // Generate HPKP header (for server-side implementation)
  generateHPKPHeader(domain) {
    const pinConfig = this.pinnedKeys.get(domain);
    if (!pinConfig) return null;
    
    const pins = pinConfig.keyHashes
      .map(hash => `pin-sha256="${hash}"`)
      .join('; ');
    
    let header = pins;
    header += `; max-age=${pinConfig.config.maxAge}`;
    
    if (pinConfig.config.includeSubDomains) {
      header += '; includeSubDomains';
    }
    
    if (pinConfig.config.reportUri) {
      header += `; report-uri="${pinConfig.config.reportUri}"`;
    }
    
    return header;
  }
}

// Service Worker implementation for certificate pinning
const serviceWorkerCode = `
class ServiceWorkerPinner {
  constructor() {
    this.pinnedDomains = new Map();
    this.setupEventListeners();
  }
  
  setupEventListeners() {
    self.addEventListener('fetch', (event) => {
      if (event.request.url.startsWith('https://')) {
        event.respondWith(this.handleSecureFetch(event.request));
      }
    });
  }
  
  async handleSecureFetch(request) {
    const url = new URL(request.url);
    const domain = url.hostname;
    
    if (this.pinnedDomains.has(domain)) {
      // Implement certificate verification logic here
      // This would require access to TLS connection details
      console.log('Verifying certificate for pinned domain:', domain);
    }
    
    return fetch(request);
  }
  
  pinDomain(domain, pins) {
    this.pinnedDomains.set(domain, pins);
  }
}

const pinner = new ServiceWorkerPinner();
`;

// Usage example
const pinner = new CertificatePinner();

// Pin certificate fingerprints
pinner.pinCertificate('api.example.com', [
  'AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD',
  'BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE' // backup
], {
  reportOnly: false,
  reportUri: '/pin-violation-report'
});

// Pin public key hashes (HPKP style)
pinner.pinPublicKey('secure.example.com', [
  'cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=',
  'd6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=' // backup
], {
  maxAge: 2592000, // 30 days
  includeSubDomains: true
});

// Use secure fetch with pinning
pinner.secureFetch('https://api.example.com/data')
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error('Secure fetch failed:', error));

// Server configuration for Perfect Forward Secrecy
const crypto = require('crypto');
const tls = require('tls');

class PFSServer {
  constructor() {
    this.preferredCiphers = [
      // ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) ciphers
      'ECDHE-ECDSA-AES256-GCM-SHA384',
      'ECDHE-RSA-AES256-GCM-SHA384',
      'ECDHE-ECDSA-CHACHA20-POLY1305',
      'ECDHE-RSA-CHACHA20-POLY1305',
      'ECDHE-ECDSA-AES128-GCM-SHA256',
      'ECDHE-RSA-AES128-GCM-SHA256',
      'ECDHE-ECDSA-AES256-SHA384',
      'ECDHE-RSA-AES256-SHA384',
      'ECDHE-ECDSA-AES128-SHA256',
      'ECDHE-RSA-AES128-SHA256'
    ];
  }
  
  createSecureContext(certPath, keyPath) {
    const secureContext = {
      cert: require('fs').readFileSync(certPath),
      key: require('fs').readFileSync(keyPath),
      
      // Prefer server cipher order
      honorCipherOrder: true,
      
      // Use only PFS-enabled ciphers
      ciphers: this.preferredCiphers.join(':'),
      
      // Minimum TLS version
      secureProtocol: 'TLS_method',
      minVersion: 'TLSv1.2',
      
      // Disable weak protocols
      secureOptions: 
        crypto.constants.SSL_OP_NO_SSLv2 |
        crypto.constants.SSL_OP_NO_SSLv3 |
        crypto.constants.SSL_OP_NO_TLSv1 |
        crypto.constants.SSL_OP_NO_TLSv1_1 |
        crypto.constants.SSL_OP_CIPHER_SERVER_PREFERENCE,
      
      // ECDH curves for ECDHE key exchange
      ecdhCurve: 'auto', // Use multiple curves
      
      // DH parameters for DHE (if needed)
      dhparam: this.generateDHParams()
    };
    
    return secureContext;
  }
  
  generateDHParams() {
    // Generate strong DH parameters (2048-bit minimum)
    // In production, pre-generate and store these
    return crypto.generateDHKey(2048);
  }
  
  validatePFS(socket) {
    const cipher = socket.getCipher();
    const ephemeral = socket.getEphemeralKeyInfo();
    
    if (!cipher || !ephemeral) {
      return { pfs: false, reason: 'No cipher or ephemeral key info' };
    }
    
    // Check if cipher suite provides PFS
    const isPFS = cipher.name.includes('ECDHE') || cipher.name.includes('DHE');
    
    return {
      pfs: isPFS,
      cipher: cipher.name,
      version: cipher.version,
      keyExchange: ephemeral.type,
      keySize: ephemeral.size,
      serverName: socket.servername
    };
  }
  
  // Monitor PFS usage
  setupPFSMonitoring(server) {
    server.on('secureConnection', (socket) => {
      const pfsInfo = this.validatePFS(socket);
      
      if (pfsInfo.pfs) {
        console.log('✅ PFS Connection:', pfsInfo);
      } else {
        console.warn('⚠️ Non-PFS Connection:', pfsInfo);
      }
    });
  }
}

// Mixed content detection and fixing
class MixedContentManager {
  constructor() {
    this.mixedContentViolations = [];
    this.setupDetection();
  }
  
  setupDetection() {
    // CSP violation listener for mixed content
    document.addEventListener('securitypolicyviolation', (e) => {
      if (e.violatedDirective.includes('mixed-content')) {
        this.handleMixedContentViolation(e);
      }
    });
    
    // Monitor for mixed content in dynamically loaded resources
    this.monitorDynamicContent();
  }
  
  handleMixedContentViolation(violation) {
    const violationDetails = {
      blockedURI: violation.blockedURI,
      documentURI: violation.documentURI,
      violatedDirective: violation.violatedDirective,
      timestamp: new Date().toISOString()
    };
    
    this.mixedContentViolations.push(violationDetails);
    
    console.warn('🚨 Mixed Content Violation:', violationDetails);
    
    // Attempt to fix the mixed content
    this.attemptMixedContentFix(violation.blockedURI);
  }
  
  attemptMixedContentFix(blockedURI) {
    if (blockedURI.startsWith('http://')) {
      const httpsURI = blockedURI.replace('http://', 'https://');
      
      console.log(\`🔧 Attempting to fix mixed content: \${httpsURI}\`);
      
      // Try to load the HTTPS version
      this.testHTTPSResource(httpsURI).then(available => {
        if (available) {
          this.replaceMixedContent(blockedURI, httpsURI);
        } else {
          console.warn(\`❌ HTTPS version not available for: \${blockedURI}\`);
        }
      });
    }
  }
  
  async testHTTPSResource(url) {
    try {
      const response = await fetch(url, { 
        method: 'HEAD',
        mode: 'no-cors'
      });
      return true;
    } catch (error) {
      return false;
    }
  }
  
  replaceMixedContent(httpURL, httpsURL) {
    // Replace in images
    const images = document.querySelectorAll(\`img[src="\${httpURL}"]\`);
    images.forEach(img => {
      img.src = httpsURL;
      console.log(\`✅ Fixed image: \${httpsURL}\`);
    });
    
    // Replace in scripts
    const scripts = document.querySelectorAll(\`script[src="\${httpURL}"]\`);
    scripts.forEach(script => {
      const newScript = document.createElement('script');
      newScript.src = httpsURL;
      script.parentNode.replaceChild(newScript, script);
      console.log(\`✅ Fixed script: \${httpsURL}\`);
    });
    
    // Replace in stylesheets
    const links = document.querySelectorAll(\`link[href="\${httpURL}"]\`);
    links.forEach(link => {
      link.href = httpsURL;
      console.log(\`✅ Fixed stylesheet: \${httpsURL}\`);
    });
  }
  
  monitorDynamicContent() {
    // Override common methods that might introduce mixed content
    const originalFetch = window.fetch;
    
    window.fetch = function(url, options) {
      if (typeof url === 'string' && url.startsWith('http://') && 
          window.location.protocol === 'https:') {
        console.warn('⚠️ Mixed content fetch attempt:', url);
        
        // Attempt to use HTTPS
        const httpsURL = url.replace('http://', 'https://');
        return originalFetch(httpsURL, options);
      }
      
      return originalFetch(url, options);
    };
    
    // Override XMLHttpRequest
    const originalXHROpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function(method, url, ...args) {
      if (typeof url === 'string' && url.startsWith('http://') && 
          window.location.protocol === 'https:') {
        console.warn('⚠️ Mixed content XHR attempt:', url);
        url = url.replace('http://', 'https://');
      }
      
      return originalXHROpen.call(this, method, url, ...args);
    };
  }
  
  // Scan page for potential mixed content
  scanForMixedContent() {
    const results = {
      images: [],
      scripts: [],
      stylesheets: [],
      iframes: [],
      links: []
    };
    
    if (window.location.protocol === 'https:') {
      // Check images
      document.querySelectorAll('img[src^="http://"]').forEach(img => {
        results.images.push(img.src);
      });
      
      // Check scripts
      document.querySelectorAll('script[src^="http://"]').forEach(script => {
        results.scripts.push(script.src);
      });
      
      // Check stylesheets
      document.querySelectorAll('link[href^="http://"]').forEach(link => {
        results.stylesheets.push(link.href);
      });
      
      // Check iframes
      document.querySelectorAll('iframe[src^="http://"]').forEach(iframe => {
        results.iframes.push(iframe.src);
      });
      
      // Check other links
      document.querySelectorAll('a[href^="http://"]').forEach(link => {
        results.links.push(link.href);
      });
    }
    
    return results;
  }
  
  generateMixedContentReport() {
    const scan = this.scanForMixedContent();
    const totalIssues = Object.values(scan).reduce((sum, arr) => sum + arr.length, 0);
    
    return {
      timestamp: new Date().toISOString(),
      location: window.location.href,
      totalIssues,
      issues: scan,
      violations: this.mixedContentViolations,
      recommendations: this.generateRecommendations(scan)
    };
  }
  
  generateRecommendations(scan) {
    const recommendations = [];
    
    if (scan.images.length > 0) {
      recommendations.push('Update image URLs to use HTTPS');
    }
    
    if (scan.scripts.length > 0) {
      recommendations.push('Update script URLs to use HTTPS or use SRI');
    }
    
    if (scan.stylesheets.length > 0) {
      recommendations.push('Update stylesheet URLs to use HTTPS');
    }
    
    if (scan.iframes.length > 0) {
      recommendations.push('Update iframe URLs to use HTTPS or consider alternatives');
    }
    
    return recommendations;
  }
}

// Initialize mixed content management
const mixedContentManager = new MixedContentManager();

// Scan for mixed content on page load
document.addEventListener('DOMContentLoaded', () => {
  const report = mixedContentManager.generateMixedContentReport();
  
  if (report.totalIssues > 0) {
    console.warn('Mixed content issues found:', report);
  } else {
    console.log('✅ No mixed content issues detected');
  }
});