const backend = new CamarauthBackend({
  rateLimit: {
    enabled: true,
    windowMs: 60000,      // 1 minuto
    maxRequests: 100,     // 100 requests
    strictLogin: true     // 5 requests para login
  }
});

const backend = new CamarauthBackend({
  webhookSecret: process.env.EVOLUTION_WEBHOOK_SECRET,
  webhookSignatureHeader: 'x-hub-signature-256'
});

const expectedSignature = createHmac('sha256', secret)
  .update(rawBody)
  .digest('hex');

// Timing-safe comparison
if (!timingSafeEqual(
  Buffer.from(expectedSignature, 'hex'),
  Buffer.from(providedSignature, 'hex')
)) {
  throw new Error('Firma inválida');
}

// Access token (15 minutos)
const accessToken = jwt.sign(
  { userId, roles },
  JWT_SECRET,
  { 
    expiresIn: '15m',
    issuer: 'camarauth',
    audience: 'camarauth-client'
  }
);

// Refresh token (7 días)
const refreshToken = jwt.sign(
  { userId, type: 'refresh', jti: uuid() },
  JWT_SECRET,
  { expiresIn: '7d' }
);

const backend = new CamarauthBackend({
  corsOrigins: [
    'https://miapp.com',      // Dominio principal
    'https://app.miapp.com',  // Subdominio
    'https://admin.miapp.com' // Panel admin
  ]
});

// Validación de PIN
if (!pin || pin.length !== 6) {
  throw new ValidationError('PIN inválido');
}

// Validación de teléfono
if (!/^\+[1-9]\d{1,14}$/.test(phoneNumber)) {
  throw new ValidationError('Teléfono inválido');
}

// Sanitización de queries SQL
const result = await db.query(
  'SELECT * FROM users WHERE id = $1',
  [userId] // Parameterized query
);

{
  pin: 'ABC123',
  createdAt: Date.now(),
  expiresAt: Date.now() + (3 * 60 * 1000), // 3 minutos
  status: 'pending'
}

import https from 'https';
import fs from 'fs';

const options = {
  key: fs.readFileSync('/path/to/privkey.pem'),
  cert: fs.readFileSync('/path/to/fullchain.pem')
};

https.createServer(options, app).listen(443);

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      connectSrc: ["'self'", "wss:", "https:"],
      imgSrc: ["'self'", "data:", "https:"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"]
    }
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
  },
  referrerPolicy: { policy: 'same-origin' }
}));

// ❌ No recomendado
localStorage.setItem('token', token);

// ✅ Recomendado - httpOnly cookies
res.cookie('token', token, {
  httpOnly: true,
  secure: true,      // Solo HTTPS
  sameSite: 'strict',
  maxAge: 15 * 60 * 1000  // 15 minutos
});

// O usar memory + refresh token
const storage = createAuthStorage({
  storage: memoryStorage // No persiste en disco
});

# ❌ No hardcodear
const JWT_SECRET = 'mi-secreto';

# ✅ Variables de entorno
const JWT_SECRET = process.env.JWT_SECRET;

# ✅ Longitud mínima
tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 64

const logger = createProductionLogger();

// Log de eventos de seguridad
logger.info('PIN registrado', {
  pinId: pin.id,
  ip: req.ip,
  userAgent: req.headers['user-agent'],
  timestamp: new Date().toISOString()
});

logger.warn('Rate limit exceeded', {
  ip: req.ip,
  endpoint: req.path,
  attempts: rateLimitData.count
});

logger.error('Invalid webhook signature', {
  ip: req.ip,
  signature: req.headers['x-hub-signature-256']
});

// Protección con SameSite cookies
res.cookie('session', token, {
  sameSite: 'strict',  // o 'lax'
  httpOnly: true,
  secure: true
});

// O usar CSRF tokens
app.use(csrf());

// Forzar HTTPS
if (process.env.NODE_ENV === 'production' && !req.secure) {
  return res.redirect(301, `https://${req.headers.host}${req.url}`);
}