// All user input is validated before processing
func validateInput(_ input: String) throws -> String {
    // Length validation
    guard input.count <= maxInputLength else {
        throw SecurityError.inputTooLong
    }

    // Character validation
    guard input.allSatisfy({ $0.isASCII || $0.isLetter || $0.isNumber }) else {
        throw SecurityError.invalidCharacters
    }

    // Pattern validation (no command injection)
    guard !containsShellMetachars(input) else {
        throw SecurityError.potentialInjection
    }

    return input
}

// Path validation before any file operation
func validatePath(_ path: String) throws {
    // Resolve to absolute path
    let url = URL(fileURLWithPath: path)
    let resolvedPath = url.standardizedFileURL.path

    // Check for path traversal
    guard !resolvedPath.contains("..") else {
        throw FileServiceError.pathTraversal
    }

    // Verify within allowed directories
    guard allowedDirectories.contains(where: { resolvedPath.hasPrefix($0) }) else {
        throw FileServiceError.accessDenied
    }

    // Check for symbolic link exploitation
    guard !isSymbolicLink(resolvedPath) else {
        throw FileServiceError.symlinkNotAllowed
    }
}

// Secure subprocess execution
func executeSecurely(script: String, args: [String]) async throws -> String {
    // Validate Python interpreter path
    try validatePythonPath(pythonPath)

    // Sanitize all arguments
    let sanitizedArgs = try args.map { try sanitizeArgument($0) }

    // Create restricted environment
    var env = ProcessInfo.processInfo.environment
    env["PATH"] = "/usr/bin:/bin"  // Restricted PATH
    env.removeValue(forKey: "LD_PRELOAD")  // Prevent preloading

    let process = Process()
    process.executableURL = URL(fileURLWithPath: pythonPath)
    process.arguments = ["-c", script] + sanitizedArgs
    process.environment = env

    // Set resource limits
    process.qualityOfService = .userInitiated

    try process.run()

    // Timeout enforcement
    let timeoutTask = Task {
        try await Task.sleep(nanoseconds: 300_000_000_000)  // 5 minutes
        if process.isRunning {
            process.terminate()
        }
    }

    process.waitUntilExit()
    timeoutTask.cancel()

    guard process.terminationStatus == 0 else {
        throw PythonError.executionFailed
    }

    return output
}

// Sensitive data stored in Keychain
func storeAPIKey(_ key: String) {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: "mlxcode.apikey",
        kSecValueData as String: key.data(using: .utf8)!,
        kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
    ]

    SecItemDelete(query as CFDictionary)
    SecItemAdd(query as CFDictionary, nil)
}

// Never store in UserDefaults or plists
// ❌ UserDefaults.standard.set(apiKey, forKey: "key")  // WRONG!

actor SecureLogger {
    // Automatically redacts sensitive data
    func log(_ message: String, level: LogLevel) {
        var sanitized = message

        // Redact patterns
        sanitized = redactPasswords(sanitized)
        sanitized = redactAPIKeys(sanitized)
        sanitized = redactPII(sanitized)
        sanitized = redactFilePaths(sanitized)

        // Write to log
        writeToLog(sanitized, level: level)
    }

    private func redactAPIKeys(_ text: String) -> String {
        // Redact common API key patterns
        let patterns = [
            "sk-[a-zA-Z0-9]{32,}",  // OpenAI-style
            "ghp_[a-zA-Z0-9]{36}",  // GitHub
            "[A-Za-z0-9+/]{40}",    // Base64 tokens
        ]

        var result = text
        for pattern in patterns {
            result = result.replacingOccurrences(
                of: pattern,
                with: "***REDACTED***",
                options: .regularExpression
            )
        }
        return result
    }
}

// All closures use [weak self]
viewModel.fetch { [weak self] result in
    guard let self = self else { return }
    self.handle(result)
}

// Delegates are weak
protocol ChatDelegate: AnyObject {
    func didReceiveMessage(_ message: Message)
}

class ChatViewModel {
    weak var delegate: ChatDelegate?  // ✅ Weak reference
}

// Proper cleanup
class Service {
    private var cancellables = Set<AnyCancellable>()

    deinit {
        cancellables.removeAll()  // Cleanup subscriptions
        SecureLogger.shared.log("Service deallocated")
    }
}

func testCommandInjectionPrevention() {
    let malicious = "'; rm -rf /; echo '"
    XCTAssertThrowsError(try SecurityUtils.validateShellInput(malicious))
}

func testPathTraversalPrevention() {
    let malicious = "../../../etc/passwd"
    XCTAssertThrowsError(try FileService.shared.readFile(malicious))
}

func testUnauthorizedFileAccess() {
    let restricted = "/System/Library/PrivateFrameworks"
    XCTAssertThrowsError(try FileService.shared.listFiles(restricted))
}

func testSubprocessInjection() {
    let malicious = "import os; os.system('rm -rf /')"
    XCTAssertThrowsError(try PythonService.shared.execute(malicious))
}