const config = {
  auth: {
    type: 'oauth2',
    grantType: 'authorization_code',
    scopes: ['workflow:read', 'workflow:execute'],
    tokenUrl: 'https://auth.constraint-flow.ai/oauth/token',
    authorizeUrl: 'https://auth.constraint-flow.ai/oauth/authorize',
    
    // Security settings
    pkce: true,
    stateRequired: true,
    nonceRequired: true,
  }
};

const config = {
  auth: {
    type: 'api-key',
    headerName: 'X-API-Key',
    
    // Security settings
    keyRotationDays: 90,
    keyMinLength: 32,
    keyPattern: '^[a-zA-Z0-9]{32,64}$',
  }
};

const config = {
  auth: {
    type: 'jwt',
    issuer: 'https://auth.constraint-flow.ai',
    audience: 'constraint-flow-api',
    algorithms: ['RS256', 'ES256'],
    
    // Security settings
    clockSkewSeconds: 30,
    requireExpiration: true,
    maxTokenAgeSeconds: 3600,
  }
};

const roles = {
  admin: {
    permissions: ['*'],
    description: 'Full system access',
  },
  operator: {
    permissions: [
      'workflow:read',
      'workflow:execute',
      'workflow:cancel',
      'connector:read',
      'connector:execute',
    ],
    description: 'Operational access',
  },
  viewer: {
    permissions: [
      'workflow:read',
      'connector:read',
      'execution:read',
    ],
    description: 'Read-only access',
  },
  auditor: {
    permissions: [
      'audit:read',
      'execution:read',
      'workflow:read',
    ],
    description: 'Audit access',
  },
};

const encryptionConfig = {
  atRest: {
    algorithm: 'AES-256-GCM',
    keyDerivation: 'PBKDF2',
    keyDerivationIterations: 100000,
    keyManagement: 'AWS KMS | Azure Key Vault | HashiCorp Vault',
  }
};

const tlsConfig = {
  minVersion: 'TLSv1.3',
  cipherSuites: [
    'TLS_AES_256_GCM_SHA384',
    'TLS_CHACHA20_POLY1305_SHA256',
    'TLS_AES_128_GCM_SHA256',
  ],
  certificatePinning: true,
  hsts: {
    enabled: true,
    maxAge: 31536000,
    includeSubdomains: true,
  },
};

const retentionPolicy = {
  workflowExecutions: {
    default: '30 days',
    configurable: true,
    minRetention: '7 days',
    maxRetention: '7 years',
  },
  auditLogs: {
    default: '1 year',
    compliance: {
      sox: '7 years',
      hipaa: '6 years',
      gdpr: 'as needed',
    },
  },
  piiData: {
    default: 'delete after use',
    maxRetention: '30 days',
  },
};

const piiConfig = {
  // Fields that contain PII
  piiFields: [
    'email',
    'phoneNumber',
    'socialSecurityNumber',
    'creditCardNumber',
    'dateOfBirth',
  ],
  
  // Masking configuration
  masking: {
    email: 'partial', // j***@example.com
    phoneNumber: 'partial', // ***-***-1234
    creditCardNumber: 'full', // ****-****-****-1234
    default: 'full',
  },
  
  // Automatic PII detection
  detection: {
    enabled: true,
    patterns: {
      email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
      phone: /^\+?[\d\s-]{10,}$/,
      ssn: /^\d{3}-\d{2}-\d{4}$/,
      creditCard: /^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$/,
    },
  },
};

const apiSecurityConfig = {
  // Rate limiting
  rateLimiting: {
    global: {
      requestsPerMinute: 1000,
      burstLimit: 100,
    },
    byEndpoint: {
      '/api/workflows/execute': {
        requestsPerMinute: 100,
      },
    },
  },
  
  // Request validation
  requestValidation: {
    maxBodySize: '10MB',
    maxHeaderSize: '8KB',
    maxUrlLength: 2048,
    requireContentType: true,
    allowedContentTypes: ['application/json'],
  },
  
  // Security headers
  securityHeaders: {
    'X-Content-Type-Options': 'nosniff',
    'X-Frame-Options': 'DENY',
    'X-XSS-Protection': '1; mode=block',
    'Content-Security-Policy': "default-src 'self'",
    'Referrer-Policy': 'strict-origin-when-cross-origin',
  },
};

const corsConfig = {
  allowedOrigins: [
    'https://app.constraint-flow.ai',
    'https://admin.constraint-flow.ai',
  ],
  allowedMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: [
    'Authorization',
    'Content-Type',
    'X-Request-ID',
    'X-Workflow-ID',
  ],
  exposedHeaders: ['X-Request-ID', 'X-RateLimit-Remaining'],
  credentials: true,
  maxAge: 86400,
};

const ipWhitelist = {
  enabled: true,
  mode: 'whitelist',
  
  ranges: [
    // Office IPs
    '192.168.1.0/24',
    // VPN range
    '10.0.0.0/8',
    // Cloud services
    '52.0.0.0/8',
  ],
  
  bypassFor: {
    healthCheck: true,
    metrics: true,
  },
};

interface AuditEvent {
  // Event identification
  eventId: string;
  eventType: AuditEventType;
  timestamp: string;
  
  // Actor information
  actor: {
    type: 'user' | 'service' | 'system';
    id: string;
    email?: string;
    ip?: string;
    userAgent?: string;
  };
  
  // Target information
  target: {
    type: string; // workflow, execution, connector
    id: string;
    name?: string;
  };
  
  // Action details
  action: {
    type: string;
    success: boolean;
    changes?: Record<string, { from: unknown; to: unknown }>;
  };
  
  // Context
  context: {
    requestId: string;
    correlationId?: string;
    workflowId?: string;
    executionId?: string;
  };
}

const auditIntegrity = {
  // Immutable storage
  storage: 'append-only',
  
  // Cryptographic integrity
  hashing: {
    algorithm: 'SHA-256',
    chainEnabled: true, // Blockchain-style chaining
  },
  
  // Tamper detection
  verification: {
    enabled: true,
    interval: '24 hours',
    alertOnTamper: true,
  },
};

const dependencyPolicy = {
  autoUpdate: {
    patch: true, // Auto-apply patches
    minor: false, // Manual approval for minor
    major: false, // Manual approval for major
  },
  
  vulnerabilityPatching: {
    critical: 'auto',
    high: 'auto',
    medium: 'manual',
    low: 'manual',
  },
  
  freezeWindows: {
    enabled: true,
    periods: [
      { start: '2024-12-20', end: '2025-01-05', reason: 'Holiday freeze' },
    ],
  },
};