use Fennec\Core\Security\PasswordPolicy;

// Validate a password — returns an array of errors (empty = valid)
$errors = PasswordPolicy::validate('MyP@ss123!');
// []

$errors = PasswordPolicy::validate('weak');
// [
//   'Password must contain at least 12 characters',
//   'Password must contain at least one uppercase letter',
//   'Password must contain at least one special character',
// ]

// Validate and throw an exception if invalid
PasswordPolicy::assertValid('weak');
// RuntimeException: Password must contain at least 12 characters. ...

// Strength score (0-5)
$score = PasswordPolicy::strength('MyP@ss123!'); // 5

use Fennec\Core\Security\AccountLockout;

// Check if an account is locked
if (AccountLockout::isLocked('user@example.com')) {
    $remaining = AccountLockout::remainingLockout('user@example.com');
    throw new \RuntimeException("Account locked. Retry in {$remaining}s");
}

// Record a failed attempt
AccountLockout::recordFailure('user@example.com');

// Number of attempts
$attempts = AccountLockout::attempts('user@example.com'); // int

// Reset after successful login
AccountLockout::reset('user@example.com');

// List all locked accounts
$locked = AccountLockout::locked();
// ['user@example.com' => ['attempts' => 5, 'locked_until' => 1711100000, 'remaining' => 450]]

// Worker cache management
AccountLockout::cacheSize();           // int
AccountLockout::setMaxCacheSize(1000); // max LRU cache size
AccountLockout::purgeExpired();        // manual purge of expired entries
AccountLockout::flush();               // complete reset (tests)

use Fennec\Core\Security\SecurityLogger;

// Critical event (auth fail, unauthorized access)
SecurityLogger::alert('auth.failed', [
    'email' => 'user@example.com',
    'ip' => '192.168.1.100',
]);

// Informational event (token revoked, password changed)
SecurityLogger::track('token.revoked', [
    'user_id' => 42,
    'reason' => 'password_change',
]);

// Critical event (intrusion, brute force)
SecurityLogger::critical('brute_force.detected', [
    'ip' => '10.0.0.1',
    'attempts' => 100,
]);

// Inter-request state reset (worker mode)
SecurityLogger::resetRequestState();

// Inject a custom logger (tests)
SecurityLogger::setInstance($mockLogger);

use Fennec\Middleware\IpAllowlistMiddleware;

// Register on a route group
$router->group(['middleware' => [[IpAllowlistMiddleware::class]]], function ($router) {
    $router->get('/admin', [AdminController::class, 'index']);
});

// Authentication middleware using all 3 components
use Fennec\Core\Security\AccountLockout;
use Fennec\Core\Security\PasswordPolicy;
use Fennec\Core\Security\SecurityLogger;

function login(string $email, string $password): array
{
    // 1. Check lockout
    if (AccountLockout::isLocked($email)) {
        $remaining = AccountLockout::remainingLockout($email);
        SecurityLogger::alert('auth.locked_attempt', ['email' => $email]);
        throw new \RuntimeException("Account locked ({$remaining}s remaining)");
    }

    // 2. Verify credentials
    $user = User::findByEmail($email);
    if (!$user || !password_verify($password, $user->password)) {
        AccountLockout::recordFailure($email);
        SecurityLogger::alert('auth.failed', ['email' => $email]);
        throw new \RuntimeException('Invalid credentials');
    }

    // 3. Reset lockout after success
    AccountLockout::reset($email);
    SecurityLogger::track('auth.success', ['user_id' => $user->id]);

    return ['token' => generateJwt($user)];
}

// Password change with validation
function changePassword(int $userId, string $newPassword): void
{
    // Validate password policy
    PasswordPolicy::assertValid($newPassword);

    $user = User::find($userId);
    $user->password = Hash::make($newPassword);
    $user->save();

    SecurityLogger::track('password.changed', ['user_id' => $userId]);
}

use Fennec\Core\Security\Hash;

// Hash a password
$hash = Hash::make($password);

// Verify a password
if (Hash::verify($password, $user->password)) {
    // Transparent rehash when algorithm or cost changes
    if (Hash::needsRehash($user->password)) {
        $user->update(['password' => Hash::make($password)]);
    }
}

// Check current algorithm
Hash::algorithmName(); // 'bcrypt', 'argon2i', or 'argon2id'