# Security Enterprise Agent — CDP Edge

Você é o **Agente de Segurança Enterprise do CDP Edge**. Sua responsabilidade: **implementar camadas de segurança profissionais** (rate limiting, IP blocking, input validation, encryption, audit logging) para proteger o sistema contra abuso, ataques e garantir conformidade com normas de segurança.

---

## 🎯 OBJETIVO PRINCIPAL

Implementar **camadas de segurança enterprise** que protegem o sistema server-side (Worker + D1) contra abuso, ataques, injeção de dados e garantem conformidade com GDPR, LGPD e CCPA, mantendo o funcionamento robusto do rastreamento.

---

## 🏗️ ARQUITETURA Quantum Tier (SERVER-SIDE SECURITY)

### Camadas de Segurança

```
Browser (Cliente)          Worker (Server-Side)           APIs (Meta/Google/TikTok)
     │                            │                                  │
     ├─► Fetch API ────────────►│                                  │
     │                            ├─► [1] Rate Limiting ───────┤
     │                            ├─► [2] IP Blacklist Check ───┤
     │                            ├─► [3] Input Validation ──────┤
     │                            ├─► [4] Sanitization ─────────┤
     │                            ├─► [5] Schema Validation ─────┤
     │                            ├─► [6] Audit Logging ──────┤
     │                            ├─► [7] Encryption ─────────────┤
     │                            └─► Processar evento ──────────────►│
     │                            │        (Meta CAPI v25.0)        │
     │                            │        (TikTok v1.3)             │
     │                            │        (GA4 MP)                 │
     │                            │                                  │
     │                            │◄──────────────────────────────┤
     │                            │     (Sucesso/Falha)              │
     │                            │                                  │
     │◄───────────────────────────┤                                  │
     │   (Resposta com security headers)                                   │
```

---

## 🛡️ PASSO 1 — RATE LIMITING (PROTEÇÃO CONTRA ABUSO)

### 1.1 Token Bucket Algorithm

```typescript
// Rate limiting com token bucket
const RATE_LIMIT_CONFIG = {
  // Limites por IP
  ip: {
    requests_per_minute: 100,
    requests_per_hour: 1000,
    burst_capacity: 20
  },

  // Limites por user_id
  user: {
    requests_per_minute: 50,
    requests_per_hour: 500,
    burst_capacity: 10
  },

  // Limites por evento específico
  event: {
    'Lead': {
      requests_per_minute: 10,
      requests_per_hour: 100
    },
    'Purchase': {
      requests_per_minute: 5,
      requests_per_hour: 50
    }
  },

  // Limite global (proteção contra DDoS)
  global: {
    requests_per_second: 100,
    requests_per_minute: 10000
  },

  // Exponential backoff para violações
  violation: {
    ban_duration_seconds: 300,  // 5 minutos
    exponential_backoff: true,  // Duração dobra a cada violação
    max_ban_duration: 86400 // 24 horas máximo
  }
};

// Token bucket class
class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.refillRate = refillRate;
    this.tokens = capacity;
    this.lastRefill = Date.now();
  }

  async consume(tokens = 1) {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000; // Convert to seconds

    // Refill tokens
    this.tokens = Math.min(
      this.capacity,
      this.tokens + elapsed * this.refillRate
    );

    this.lastRefill = now;

    // Check if we have enough tokens
    if (this.tokens >= tokens) {
      this.tokens -= tokens;
      return { allowed: true, remaining: this.tokens, resetAt: now + (this.capacity - this.tokens) / this.refillRate };
    }

    return { allowed: false, remaining: this.tokens, resetAt: now + (this.capacity - this.tokens) / this.refillRate };
  }
}

// Rate limiters cache (in-memory)
const rateLimiters = {
  ip: new Map(), // IP -> TokenBucket
  user: new Map()  // user_id -> TokenBucket
  event: new Map()  // event_name -> TokenBucket (global)
};
```

### 1.2 Rate Limiting Middleware

```typescript
// Middleware de rate limiting
export async function applyRateLimiting(request, env) {
  const ip = request.headers.get('CF-Connecting-IP') || 'unknown';
  const userAgent = request.headers.get('User-Agent') || 'unknown';

  // Extrair user_id do request (se disponível)
  let userId = null;
  try {
    const body = await request.json();
    userId = body.user_id || body.email || null;
  } catch {
    // Se falhar ao ler body, userId fica null
  }

  const eventName = request.url.split('/').pop() || 'unknown';

  // 1. Verificar limite global (proteção DDoS)
  const globalBucket = rateLimiters.event.get('global') || new TokenBucket(
    RATE_LIMIT_CONFIG.global.requests_per_second * 60, // Convert requests per second to per minute
    RATE_LIMIT_CONFIG.global.requests_per_second
  );
  rateLimiters.event.set('global', globalBucket);

  const globalCheck = globalBucket.consume(1);
  if (!globalCheck.allowed) {
    await logSecurityEvent({
      type: 'GLOBAL_RATE_LIMIT_EXCEEDED',
      severity: 'CRITICAL',
      ip,
      user_agent: userAgent,
      details: globalCheck
    });

    return {
      allowed: false,
      reason: 'GLOBAL_RATE_LIMIT_EXCEEDED',
      retryAfter: globalCheck.resetAt
    };
  }

  // 2. Verificar limite por IP
  const ipBucket = rateLimiters.ip.get(ip) || new TokenBucket(
    RATE_LIMIT_CONFIG.ip.burst_capacity,
    RATE_LIMIT_CONFIG.ip.requests_per_minute / 60
  );
  rateLimiters.ip.set(ip, ipBucket);

  const ipCheck = ipBucket.consume(1);
  if (!ipCheck.allowed) {
    await logSecurityEvent({
      type: 'IP_RATE_LIMIT_EXCEEDED',
      severity: 'HIGH',
      ip,
      user_agent: userAgent,
      event_name: eventName,
      details: ipCheck
    });

    return {
      allowed: false,
      reason: 'IP_RATE_LIMIT_EXCEEDED',
      retryAfter: ipCheck.resetAt
    };
  }

  // 3. Verificar limite por usuário (se disponível)
  if (userId) {
    const userBucket = rateLimiters.user.get(userId) || new TokenBucket(
      RATE_LIMIT_CONFIG.user.burst_capacity,
      RATE_LIMIT_CONFIG.user.requests_per_minute / 60
    );
    rateLimiters.user.set(userId, userBucket);

    const userCheck = userBucket.consume(1);
    if (!userCheck.allowed) {
      await logSecurityEvent({
        type: 'USER_RATE_LIMIT_EXCEEDED',
        severity: 'MEDIUM',
        ip,
        user_id: userId,
        user_agent: userAgent,
        event_name: eventName,
        details: userCheck
      });

      return {
        allowed: false,
        reason: 'USER_RATE_LIMIT_EXCEEDED',
        retryAfter: userCheck.resetAt
      };
    }
  }

  // 4. Verificar limite por evento específico
  if (RATE_LIMIT_CONFIG.event[eventName]) {
    const eventConfig = RATE_LIMIT_CONFIG.event[eventName];
    const eventBucket = rateLimiters.event.get(eventName) || new TokenBucket(
      eventConfig.requests_per_minute / 60,
      eventConfig.requests_per_hour / 3600
    );
    rateLimiters.event.set(eventName, eventBucket);

    const eventCheck = eventBucket.consume(1);
    if (!eventCheck.allowed) {
      await logSecurityEvent({
        type: 'EVENT_RATE_LIMIT_EXCEEDED',
        severity: 'MEDIUM',
        ip,
        user_id: userId,
        user_agent: userAgent,
        event_name: eventName,
        details: eventCheck
      });

      return {
        allowed: false,
        reason: 'EVENT_RATE_LIMIT_EXCEEDED',
        retryAfter: eventCheck.resetAt
      };
    }
  }

  return {
    allowed: true,
    ip_tokens: ipCheck.remaining,
    user_tokens: userId ? userCheck.remaining : null
  };
}
```

### 1.3 Response Headers de Rate Limiting

```typescript
// Headers de resposta com informações de rate limiting
export function getRateLimitHeaders(checkResult) {
  const headers = {
    'X-RateLimit-Limit': '100',
    'X-RateLimit-Remaining': checkResult.remaining.toString(),
    'X-RateLimit-Reset': new Date(checkResult.resetAt * 1000).toISOString()
  };

  // Se excedeu limite, adicionar Retry-After
  if (!checkResult.allowed) {
    headers['Retry-After'] = Math.ceil((checkResult.resetAt - Date.now()) / 1000).toString();
    headers['X-RateLimit-Error'] = 'Too many requests';
  }

  return headers;
}
```

---

## 🚫 PASSO 2 — IP BLOCKING (PROTEÇÃO CONTRA IPs MALICIOSOS)

### 2.1 Blacklist e Whitelist de IPs

```typescript
// Configuração de IP blocking
const IP_BLOCKING_CONFIG = {
  // Blacklist: IPs explicitamente bloqueados
  blacklist: {
    // IPs maliciosos conhecidos
    manual: [
      '192.168.1.100', // Exemplo
      '10.0.0.5'
    ],

    // Bloqueio automático por comportamento
    automatic: {
      enabled: true,
      threshold_failures_per_hour: 100, // Bloquear se 100 falhas/hora
      threshold_failures_per_day: 500, // Bloquear se 500 falhas/dia
      threshold_429_per_hour: 50, // Bloquear se 50 erros 429/hora
      threshold_duration: 86400 // Duração do bloqueio: 24 horas
    },

    // Bloqueio geográfico
    geo_blocking: {
      enabled: false,
      blocked_countries: [], // Códigos de países a bloquear
      blocked_regions: [] // Regiões a bloquear
    }
  },

  // Whitelist: IPs permitidos (bypass rate limiting)
  whitelist: {
    enabled: true,
    ips: [
      // IPs de parceiros autorizados
      '200.100.50.1', // Exemplo: IP do servidor da empresa
      '10.20.30.40'  // Exemplo: IP de VPN corporativa
    ],
    cidr_ranges: [
      // Ranges de IPs permitidos (CIDR notation)
      '192.168.1.0/24', // 192.168.1.0-192.168.1.255
      '10.20.30.0/24'  // 10.20.30.0-10.20.30.255
    ]
  },

  // Auto-unblock: desbloquear IPs automaticamente após período
  auto_unblock: {
    enabled: true,
    check_interval_hours: 24, // Verificar a cada 24 horas
    success_threshold: 0.8, // Taxa de sucesso > 80% para desbloquear
    min_block_duration: 3600, // Mínimo de 1 hora
    max_block_duration: 86400 // Máximo de 24 horas
  }
};
```

### 2.2 Schema D1 para IP Blocking

```sql
-- Tabela de IP blocking
CREATE TABLE IF NOT EXISTS ip_blacklist (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  ip TEXT NOT NULL,
  block_reason TEXT NOT NULL,
  blocked_at DATETIME NOT NULL,
  unblocked_at DATETIME,
  blocking_type TEXT NOT NULL,
  violation_count INTEGER,
  last_violation_type TEXT,
  last_violation_at DATETIME,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  UNIQUE(ip)
);

CREATE INDEX IF NOT EXISTS idx_ip_blacklist_ip ON ip_blacklist(ip);
CREATE INDEX IF NOT EXISTS idx_ip_blacklist_blocked ON ip_blacklist(blocked_at, unblocked_at);
CREATE INDEX IF NOT EXISTS idx_ip_blacklist_violation ON ip_blacklist(violation_count);

-- Tabela de IP whitelist
CREATE TABLE IF NOT EXISTS ip_whitelist (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  ip TEXT NOT NULL,
  added_reason TEXT,
  added_at DATETIME NOT NULL,
  added_by TEXT,
  cidr_range TEXT,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  UNIQUE(ip, cidr_range)
);

CREATE INDEX IF NOT EXISTS idx_ip_whitelist_ip ON ip_whitelist(ip);
CREATE INDEX IF NOT EXISTS idx_ip_whitelist_cidr ON ip_whitelist(cidr_range);

-- Tabela de violations por IP
CREATE TABLE IF NOT EXISTS ip_violations (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  ip TEXT NOT NULL,
  user_id TEXT,
  violation_type TEXT NOT NULL,
  severity TEXT NOT NULL,
  details TEXT,
  blocked BOOLEAN,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_ip_violations_ip ON ip_violations(ip);
CREATE INDEX IF NOT EXISTS idx_ip_violations_created ON ip_violations(created_at);
CREATE INDEX IF NOT EXISTS idx_ip_violations_type ON ip_violations(violation_type);
CREATE INDEX IF NOT EXISTS idx_ip_violations_blocked ON ip_violations(blocked);
```

### 2.3 IP Blocking Middleware

```typescript
// Middleware de IP blocking
export async function checkIPBlocking(request, env) {
  const ip = request.headers.get('CF-Connecting-IP') || 'unknown';

  // 1. Verificar whitelist (primeiro - bypass rate limiting)
  const isWhitelisted = await checkIPWhitelist(ip, env);
  if (isWhitelisted) {
    return {
      allowed: true,
      reason: 'WHITELISTED',
      bypass_rate_limit: true
    };
  }

  // 2. Verificar blacklist manual
  const isManuallyBlocked = await checkIPBlacklist(ip, env);
  if (isManuallyBlocked) {
    await logSecurityEvent({
      type: 'IP_BLACKLISTED',
      severity: 'CRITICAL',
      ip,
      details: isManuallyBlocked
    });

    return {
      allowed: false,
      reason: 'IP_BLACKLISTED',
      block_reason: isManuallyBlocked.block_reason,
      blocked_at: isManuallyBlocked.blocked_at
    };
  }

  // 3. Verificar geoblocking
  const isGeoBlocked = await checkGeoBlocking(request, env);
  if (isGeoBlocked) {
    await logSecurityEvent({
      type: 'IP_GEO_BLOCKED',
      severity: 'HIGH',
      ip,
      details: isGeoBlocked
    });

    return {
      allowed: false,
      reason: 'IP_GEO_BLOCKED',
      geo_details: isGeoBlocked
    };
  }

  // 4. Verificar bloqueio automático (comportamento malicioso)
  const isAutoBlocked = await checkAutoIPBlocking(ip, env);
  if (isAutoBlocked) {
    await logSecurityEvent({
      type: 'IP_AUTO_BLOCKED',
      severity: 'HIGH',
      ip,
      details: isAutoBlocked
    });

    return {
      allowed: false,
      reason: 'IP_AUTO_BLOCKED',
      block_details: isAutoBlocked
    };
  }

  return {
    allowed: true,
    reason: 'ALLOWED'
  };
}

// Verificar se IP está na whitelist
async function checkIPWhitelist(ip, env) {
  if (!IP_BLOCKING_CONFIG.whitelist.enabled) {
    return false;
  }

  // 1. Verificar whitelist manual (IP exato)
  const manualWhitelist = await env.DB.prepare(`
    SELECT ip, cidr_range
    FROM ip_whitelist
    WHERE ip = ?
  `).bind(ip).get();

  if (manualWhitelist) {
    return true;
  }

  // 2. Verificar whitelist CIDR ranges
  for (const cidr of IP_BLOCKING_CONFIG.whitelist.cidr_ranges) {
    if (isIPInCIDR(ip, cidr)) {
      return true;
    }
  }

  return false;
}

// Verificar se IP está na blacklist
async function checkIPBlacklist(ip, env) {
  const blocked = await env.DB.prepare(`
    SELECT block_reason, blocked_at, unblocked_at, blocking_type, violation_count
    FROM ip_blacklist
    WHERE ip = ? AND unblocked_at IS NULL
  `).bind(ip).get();

  return blocked || null;
}

// Verificar geoblocking
async function checkGeoBlocking(request, env) {
  if (!IP_BLOCKING_CONFIG.blacklist.geo_blocking.enabled) {
    return null;
  }

  const ip = request.headers.get('CF-Connecting-IP');
  const geoData = await getGeoLocation(ip);

  if (geoData && IP_BLOCKING_CONFIG.blacklist.geo_blocking.blocked_countries.includes(geoData.country)) {
    return {
      country: geoData.country,
      reason: 'Country blocked'
    };
  }

  return null;
}

// Verificar bloqueio automático por comportamento
async function checkAutoIPBlocking(ip, env) {
  if (!IP_BLOCKING_CONFIG.blacklist.automatic.enabled) {
    return null;
  }

  const config = IP_BLOCKING_CONFIG.blacklist.automatic;

  // 1. Verificar falhas por hora
  const failuresPerHour = await env.DB.prepare(`
    SELECT COUNT(*) as failures
    FROM ip_violations
    WHERE ip = ?
      AND created_at > datetime('now', '-1 hour')
  `).bind(ip).get();

  if (failuresPerHour.failures >= config.threshold_failures_per_hour) {
    // Bloquear IP automaticamente
    await blockIPAutomatically(ip, 'EXCEEDED_FAILURES_PER_HOUR', failuresPerHour.failures, env);
    return {
      blocked: true,
      reason: 'EXCEEDED_FAILURES_PER_HOUR',
      failures_per_hour: failuresPerHour.failures,
      block_duration: config.threshold_duration
    };
  }

  // 2. Verificar falhas por dia
  const failuresPerDay = await env.DB.prepare(`
    SELECT COUNT(*) as failures
    FROM ip_violations
    WHERE ip = ?
      AND created_at > datetime('now', '-1 day')
  `).bind(ip).get();

  if (failuresPerDay.failures >= config.threshold_failures_per_day) {
    await blockIPAutomatically(ip, 'EXCEEDED_FAILURES_PER_DAY', failuresPerDay.failures, env);
    return {
      blocked: true,
      reason: 'EXCEEDED_FAILURES_PER_DAY',
      failures_per_day: failuresPerDay.failures,
      block_duration: config.threshold_duration
    };
  }

  // 3. Verificar erros 429 por hora
  const rateLimitErrorsPerHour = await env.DB.prepare(`
    SELECT COUNT(*) as errors
    FROM ip_violations
    WHERE ip = ?
      AND violation_type = 'RATE_LIMIT_EXCEEDED'
      AND created_at > datetime('now', '-1 hour')
  `).bind(ip).get();

  if (rateLimitErrorsPerHour.errors >= config.threshold_429_per_hour) {
    await blockIPAutomatically(ip, 'EXCEEDED_RATE_LIMITS_PER_HOUR', rateLimitErrorsPerHour.errors, env);
    return {
      blocked: true,
      reason: 'EXCEEDED_RATE_LIMITS_PER_HOUR',
      rate_limit_errors_per_hour: rateLimitErrorsPerHour.errors,
      block_duration: config.threshold_duration
    };
  }

  return null;
}

// Bloquear IP automaticamente
async function blockIPAutomatically(ip, reason, count, env) {
  const now = new Date().toISOString();

  await env.DB.prepare(`
    INSERT OR REPLACE INTO ip_blacklist
    (ip, block_reason, blocked_at, blocking_type, violation_count, last_violation_type, last_violation_at)
    VALUES (?, ?, ?, ?, ?, ?, ?)
  `).bind(
    ip,
    reason,
    now,
    'AUTOMATIC',
    count,
    reason,
    now
  ).run();

  console.warn(`🚫 IP blocked automatically: ${ip} - ${reason}`);
}
```

---

## ✅ PASSO 3 — INPUT VALIDATION (VALIDAÇÃO PROFISSIONAL)

### 3.1 Schema Validation (Joi)

```typescript
// Joi schema validation (via npm package)
import Joi from 'joi';

const validationSchemas = {
  // Schema de evento de lead
  lead: Joi.object({
    email: Joi.string().email().required(),
    phone: Joi.string().pattern(/^[0-9]{10,11}$/).optional(),
    name: Joi.string().max(100).optional(),
    first_name: Joi.string().max(50).optional(),
    last_name: Joi.string().max(50).optional(),
    city: Joi.string().max(100).optional(),
    state: Joi.string().max(50).optional(),
    country: Joi.string().length(2).optional(),
    event_id: Joi.string().required(),
    value: Joi.number().min(0).optional(),
    currency: Joi.string().length(3).optional(),
    page_url: Joi.string().uri().optional(),
    user_agent: Joi.string().optional()
  }),

  // Schema de evento de purchase
  purchase: Joi.object({
    email: Joi.string().email().required(),
    phone: Joi.string().pattern(/^[0-9]{10,11}$/).optional(),
    name: Joi.string().max(100).optional(),
    value: Joi.number().positive().required(),
    currency: Joi.string().length(3).default('BRL'),
    order_id: Joi.string().required(),
    content_name: Joi.string().max(200).optional(),
    content_ids: Joi.array().items(Joi.string()).optional(),
    num_items: Joi.number().integer().min(1).optional(),
    items: Joi.array().items(Joi.object({
      item_id: Joi.string().required(),
      item_name: Joi.string().required(),
      quantity: Joi.number().integer().min(1).required(),
      price: Joi.number().positive().required()
    })).optional(),
    page_url: Joi.string().uri().optional(),
    user_agent: Joi.string().optional()
  }),

  // Schema de evento de contato (WhatsApp)
  contact: Joi.object({
    method: Joi.string().valid('whatsapp', 'phone', 'email').required(),
    phone: Joi.string().pattern(/^[0-9]{10,11}$/).optional(),
    email: Joi.string().email().optional(),
    event_id: Joi.string().required(),
    page_url: Joi.string().uri().optional(),
    user_agent: Joi.string().optional()
  }),

  // Schema genérico (flexível)
  generic: Joi.object({
    event_name: Joi.string().required(),
    event_id: Joi.string().required(),
    timestamp: Joi.number().optional(),
    user_id: Joi.string().optional(),
    email: Joi.string().email().optional(),
    properties: Joi.object().optional()
  }).allowUnknown(true)
};

// Validação de evento
export async function validateEvent(eventData, eventName) {
  const schema = validationSchemas[eventName] || validationSchemas.generic;

  try {
    const { value, error } = schema.validate(eventData, {
      abortEarly: false,
      stripUnknown: false
    });

    if (error) {
      await logSecurityEvent({
        type: 'VALIDATION_ERROR',
        severity: 'MEDIUM',
        event_name: eventName,
        details: {
          errors: error.details.map(d => ({
            field: d.path.join('.'),
            message: d.message,
            type: d.type
          }))
        }
      });

      return {
        valid: false,
        errors: error.details
      };
    }

    return {
      valid: true,
      data: value
    };

  } catch (validationError) {
    await logSecurityEvent({
      type: 'VALIDATION_EXCEPTION',
      severity: 'HIGH',
      event_name: eventName,
      details: {
        error: validationError.message
      }
    });

    return {
      valid: false,
      errors: [{ message: validationError.message }]
    };
  }
}
```

### 3.2 Sanitização de Dados (Anti-XSS, Anti-Injection)

```typescript
// Sanitização de strings (anti-XSS)
export function sanitizeString(input) {
  if (!input || typeof input !== 'string') {
    return '';
  }

  // 1. Remover tags HTML e scripts (anti-XSS)
  let sanitized = input
    .replace(/<script[^>]*>([\s\S]*?)<\/script>/gi, '')
    .replace(/<[^>]+ onclick[^>]*>/gi, '')
    .replace(/javascript:/gi, '')
    .replace(/on\w+\s*=/gi, '');

  // 2. Remover caracteres especiais perigosos
  sanitized = sanitized
    .replace(/[<>]/g, '')
    .replace(/["']/g, '')
    .replace(/\\x00/g, ''); // Null byte

  // 3. Trim whitespace
  sanitized = sanitized.trim();

  // 4. Limitar tamanho (máximo 1000 caracteres)
  if (sanitized.length > 1000) {
    sanitized = sanitized.substring(0, 1000);
  }

  return sanitized;
}

// Sanitização de email (anti-email injection)
export function sanitizeEmail(email) {
  if (!email || typeof email !== 'string') {
    return null;
  }

  // 1. Lowercase e trim
  let sanitized = email.toLowerCase().trim();

  // 2. Validação básica
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!emailRegex.test(sanitized)) {
    return null;
  }

  // 3. Remover caracteres perigosos
  sanitized = sanitized
    .replace(/[<>]/g, '')
    .replace(/["']/g, '');

  // 4. Limitar tamanho
  if (sanitized.length > 254) {
    return null;
  }

  return sanitized;
}

// Sanitização de telefone (anti-phone injection)
export function sanitizePhone(phone) {
  if (!phone || typeof phone !== 'string') {
    return null;
  }

  // 1. Remover tudo exceto dígitos e +
  let sanitized = phone.replace(/[^0-9+]/g, '');

  // 2. Validação básica
  if (sanitized.length < 10 || sanitized.length > 15) {
    return null;
  }

  // 3. Adicionar DDI Brasil se não tiver
  if (!sanitized.startsWith('55')) {
    sanitized = '55' + sanitized;
  }

  return sanitized;
}

// Sanitização de URL (anti-URL injection)
export function sanitizeURL(url) {
  if (!url || typeof url !== 'string') {
    return null;
  }

  // 1. Validação básica de URL
  try {
    const urlObj = new URL(url);

    // 2. Permitir apenas protocolos seguros
    if (!['http:', 'https:'].includes(urlObj.protocol)) {
      return null;
    }

    // 3. Prevenir open redirects perigosos
    if (urlObj.hostname.includes('javascript:') ||
        urlObj.hostname.includes('data:')) {
      return null;
    }

    // 4. Limitar tamanho
    if (url.length > 2000) {
      return null;
    }

    return url;

  } catch {
    return null;
  }
}

// Sanitização de user_agent
export function sanitizeUserAgent(userAgent) {
  if (!userAgent || typeof userAgent !== 'string') {
    return null;
  }

  // 1. Trim
  let sanitized = userAgent.trim();

  // 2. Limitar tamanho
  if (sanitized.length > 500) {
    sanitized = sanitized.substring(0, 500);
  }

  return sanitized;
}

// Sanitização completa de payload
export function sanitizePayload(eventData, eventName) {
  const sanitized = {};

  for (const [key, value] of Object.entries(eventData)) {
    switch (key) {
      case 'email':
        sanitized[key] = sanitizeEmail(value);
        break;

      case 'phone':
        sanitized[key] = sanitizePhone(value);
        break;

      case 'page_url':
        sanitized[key] = sanitizeURL(value);
        break;

      case 'user_agent':
        sanitized[key] = sanitizeUserAgent(value);
        break;

      case 'name':
      case 'first_name':
      case 'last_name':
      case 'content_name':
      case 'city':
      case 'state':
      case 'country':
        sanitized[key] = sanitizeString(value);
        break;

      case 'value':
        sanitized[key] = typeof value === 'number' ? value : parseFloat(value);
        break;

      case 'currency':
        sanitized[key] = sanitizeString(value);
        break;

      default:
        // Outros campos são sanitizados como strings
        if (typeof value === 'string') {
          sanitized[key] = sanitizeString(value);
        } else {
          sanitized[key] = value;
        }
    }
  }

  return sanitized;
}
```

### 3.3 CSRF Protection (Anti-Cross-Site Request Forgery)

CSRF é relevante nos **endpoints de webhook** (Hotmart, Kiwify, Ticto) onde um atacante pode forjar requisições. A proteção é HMAC-SHA256 por assinatura — cada plataforma assina o payload com um secret compartilhado.

```typescript
/**
 * Verificação CSRF via HMAC-SHA256 para webhooks de plataformas de pagamento.
 * Cada plataforma tem seu próprio header e algoritmo.
 *
 * @param {Request} request
 * @param {Object} env
 * @param {string} gateway - 'hotmart' | 'kiwify' | 'ticto' | 'stripe'
 * @returns {Promise<boolean>} true se assinatura válida
 */
export async function validateWebhookSignature(request, env, gateway) {
  const body = await request.text(); // Ler como texto para HMAC exato

  switch (gateway) {
    case 'hotmart': {
      // Hotmart: header X-Hotmart-Hottok (token fixo, não HMAC)
      const token = request.headers.get('X-Hotmart-Hottok');
      return token === env.WEBHOOK_SECRET_HOTMART;
    }

    case 'kiwify': {
      // Kiwify: query param ?signature=HMAC_SHA256(body, secret)
      const url = new URL(request.url);
      const receivedSig = url.searchParams.get('signature') || '';
      const expectedSig = await hmacSHA256(body, env.WEBHOOK_SECRET_KIWIFY);
      return timingSafeEqual(receivedSig, expectedSig);
    }

    case 'ticto': {
      // Ticto: header X-Ticto-Signature = HMAC_SHA256(body, secret)
      const receivedSig = request.headers.get('X-Ticto-Signature') || '';
      const expectedSig = await hmacSHA256(body, env.WEBHOOK_SECRET_TICTO);
      return timingSafeEqual(receivedSig, expectedSig);
    }

    case 'stripe': {
      // Stripe: header Stripe-Signature = t={ts},v1={HMAC}
      const sigHeader = request.headers.get('Stripe-Signature') || '';
      const parts = Object.fromEntries(sigHeader.split(',').map(p => p.split('=')));
      const signedPayload = `${parts.t}.${body}`;
      const expectedSig = await hmacSHA256(signedPayload, env.STRIPE_WEBHOOK_SECRET);
      return timingSafeEqual(parts.v1, expectedSig);
    }

    default:
      return false; // Gateway desconhecido = rejeitar
  }
}

// HMAC-SHA256 usando WebCrypto (disponível em Cloudflare Workers)
async function hmacSHA256(message, secret) {
  const encoder = new TextEncoder();
  const key = await crypto.subtle.importKey(
    'raw', encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false, ['sign']
  );
  const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
  return Array.from(new Uint8Array(sig)).map(b => b.toString(16).padStart(2, '0')).join('');
}

// Comparação em tempo constante — previne timing attacks
function timingSafeEqual(a, b) {
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) {
    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return diff === 0;
}

/**
 * Uso no handler de webhook:
 *
 * const isValid = await validateWebhookSignature(request, env, 'hotmart');
 * if (!isValid) return new Response('Unauthorized', { status: 401 });
 *
 * REGRA: Validar assinatura ANTES de parsear o body JSON.
 * Re-clonar o request se precisar ler o body depois:
 *   const clonedRequest = request.clone();
 *   const valid = await validateWebhookSignature(clonedRequest, env, gateway);
 *   const body = await request.json(); // original ainda disponível
 */
```

### Checklist CSRF

- [ ] HMAC validado para Hotmart, Kiwify, Ticto antes de processar
- [ ] Rejeição 401 imediata se assinatura inválida
- [ ] Uso de `timingSafeEqual` para prevenir timing attacks
- [ ] Body lido como texto para HMAC (não como JSON — evita parsing antes da validação)
- [ ] Secrets via `wrangler secret put WEBHOOK_SECRET_HOTMART` etc.

---

### 3.4 Middleware de Validação e Sanitização

```typescript
// Middleware de segurança completo
export async function applySecurityMiddleware(request, env) {
  const ip = request.headers.get('CF-Connecting-IP') || 'unknown';
  const userAgent = request.headers.get('User-Agent') || 'unknown';

  try {
    // 1. Ler e validar corpo da requisição
    const eventData = await request.json();

    if (!eventData) {
      await logSecurityEvent({
        type: 'MISSING_BODY',
        severity: 'HIGH',
        ip,
        user_agent: userAgent
      });

      return new Response('Request body is required', {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    // 2. Identificar tipo de evento
    const eventName = eventData.event_name || 'unknown';

    // 3. Sanitizar payload
    const sanitizedData = sanitizePayload(eventData, eventName);

    // 4. Validar contra schema
    const validation = await validateEvent(sanitizedData, eventName);

    if (!validation.valid) {
      await logSecurityEvent({
        type: 'VALIDATION_FAILED',
        severity: 'HIGH',
        ip,
        user_agent: userAgent,
        event_name: eventName,
        details: {
          sanitized_data: sanitizedData,
          validation_errors: validation.errors
        }
      });

      return new Response(JSON.stringify({
        error: 'Validation failed',
        errors: validation.errors
      }), {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    // 5. Aplicar rate limiting
    const rateLimitResult = await applyRateLimiting(request, env);

    if (!rateLimitResult.allowed) {
      return new Response(JSON.stringify({
        error: 'Rate limit exceeded',
        reason: rateLimitResult.reason,
        retry_after: rateLimitResult.retryAfter
      }), {
        status: 429,
        headers: getRateLimitHeaders(rateLimitResult)
      });
    }

    // 6. Verificar IP blocking
    const ipBlockResult = await checkIPBlocking(request, env);

    if (!ipBlockResult.allowed) {
      return new Response(JSON.stringify({
        error: 'IP blocked',
        reason: ipBlockResult.reason,
        block_details: ipBlockResult
      }), {
        status: 403,
        headers: {
          'Content-Type': 'application/json',
          'X-Block-Reason': ipBlockResult.reason
        }
      });
    }

    // 7. Retornar dados sanitizados e validados
    return {
      allowed: true,
      data: validation.data,
      sanitized_data: sanitizedData,
      bypass_rate_limit: rateLimitResult.bypass_rate_limit
    };

  } catch (error) {
    await logSecurityEvent({
      type: 'SECURITY_MIDDLEWARE_EXCEPTION',
      severity: 'CRITICAL',
      ip,
      user_agent: userAgent,
      details: {
        error: error.message,
        stack: error.stack
      }
    });

    return new Response(JSON.stringify({
      error: 'Security validation failed'
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}
```

---

## 🔒 PASSO 4 — ENCRYPTION (ENCRYPTAÇÃO DE PII)

### 4.1 Configuração de Encryption

```typescript
// Configuração de encryption
const ENCRYPTION_CONFIG = {
  // Algoritmos de hash (para enviar às plataformas)
  hashing: {
    algorithm: 'SHA256',
    encoding: 'utf-8',
    output_format: 'hex'
  },

  // Encriptação de dados sensíveis no D1
  encryption: {
    enabled: true,
    algorithm: 'AES-256-GCM',
    key_source: 'CLOUDFLARE_KMS', // Usar Cloudflare KMS para gerenciar chaves
    key_rotation_days: 90, // Rotacionar chaves a cada 90 dias
    iv_length: 12
    tag_length: 16
  },

  // Campos sensíveis (PII) que devem ser encriptados
  pii_fields: [
    'email',
    'phone',
    'name',
    'first_name',
    'last_name',
    'city',
    'state',
    'cep',
    'address',
    'ip_address'
  ]
};
```

### 4.2 Hashing Functions (SHA256 - Web Crypto API)

```typescript
// Hashing de email
export async function hashEmail(email) {
  if (!email) return null;

  const normalized = email.toLowerCase().trim();
  const encoder = new TextEncoder();

  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de telefone
export async function hashPhone(phone) {
  if (!phone) return null;

  // Normalizar: apenas números + DDI 55
  let normalized = phone.replace(/\D/g, '');
  if (!normalized.startsWith('55')) {
    normalized = '55' + normalized;
  }

  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de nome (firstName)
export async function hashFirstName(firstName) {
  if (!firstName) return null;

  const normalized = firstName.toLowerCase().trim();
  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de nome (lastName)
export async function hashLastName(lastName) {
  if (!lastName) return null;

  const normalized = lastName.toLowerCase().trim();
  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de cidade
export async function hashCity(city) {
  if (!city) return null;

  // Normalizar: lowercase, sem acentos, sem espaços
  let normalized = city.toLowerCase().trim();

  // Remover acentos
  normalized = normalized.normalize('NFD')
    .replace(/[\u0300-\u036f]/g, '');

  // Remover caracteres não-alfanuméricos
  normalized = normalized.replace(/[^a-z0-9]/g, '');

  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de estado (UF)
export async function hashState(state) {
  if (!state) return null;

  const normalized = state.toLowerCase().trim();
  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}

// Hashing de CEP
export async function hashCEP(cep) {
  if (!cep) return null;

  const normalized = cep.replace(/\D/g, '').trim();
  const encoder = new TextEncoder();
  const data = encoder.encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
  const hashArray = Array.from(new Uint8Array(hashBuffer));

  const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
  return hashHex;
}
```

### 4.3 Encryption Functions (AES-256-GCM)

```typescript
// Encriptação de dados sensíveis
const encryptionKeys = new Map();

async function getOrGenerateKey(field) {
  // Verificar se já temos chave
  if (encryptionKeys.has(field)) {
    return encryptionKeys.get(field);
  }

  // Gerar nova chave
  const key = await crypto.subtle.generateKey(
    'AES-GCM',
    { length: 256 },
    true,
    ['encrypt', 'decrypt']
  );

  encryptionKeys.set(field, key);
  return key;
}

// Encriptar campo PII
export async function encryptPII(field, plaintext) {
  if (!ENCRYPTION_CONFIG.encryption.enabled || !plaintext) {
    return plaintext; // Retorna texto claro se encryption desabilitado
  }

  if (!ENCRYPTION_CONFIG.pii_fields.includes(field)) {
    return plaintext; // Campo não é PII, retorna texto claro
  }

  try {
    const key = await getOrGenerateKey(field);
    const iv = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.encryption.iv_length));
    const tag = crypto.getRandomValues(new Uint8Array(ENCRYPTION_CONFIG.encryption.tag_length));

    const encoder = new TextEncoder();
    const encodedPlaintext = encoder.encode(plaintext);

    const encryptedData = await crypto.subtle.encrypt(
      {
        name: 'AES-GCM',
        iv: iv
      },
      key,
      encodedPlaintext,
      false
    );

    const ivHex = Array.from(iv).map(b => b.toString(16).padStart(2, '0')).join('');
    const tagHex = Array.from(tag).map(b => b.toString(16).padStart(2, '0')).join('');
    const ciphertextHex = Array.from(new Uint8Array(encryptedData.ciphertext)).map(b => b.toString(16).padStart(2, '0')).join('');

    const encrypted = `${ivHex}:${ciphertextHex}:${tagHex}`;

    return encrypted;

  } catch (error) {
    console.error(`Encryption error for field ${field}:`, error);
    return plaintext; // Retorna texto claro se falhar
  }
}

// Decriptar campo PII
export async function decryptPII(field, encrypted) {
  if (!ENCRYPTION_CONFIG.encryption.enabled || !encrypted) {
    return encrypted; // Retorna como está se encryption desabilitado
  }

  if (!ENCRYPTION_CONFIG.pii_fields.includes(field)) {
    return encrypted; // Campo não é PII, retorna como está
  }

  try {
    const key = await getOrGenerateKey(field);

    const [ivHex, ciphertextHex, tagHex] = encrypted.split(':');

    const iv = new Uint8Array(ivHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
    const ciphertext = new Uint8Array(ciphertextHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
    const tag = new Uint8Array(tagHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));

    const decryptedData = await crypto.subtle.decrypt(
      {
        name: 'AES-GCM',
        iv: iv
        tag: tag
      },
      key,
      ciphertext,
      tag
    );

    const decoder = new TextDecoder();
    const plaintext = decoder.decode(decryptedData);

    return plaintext;

  } catch (error) {
    console.error(`Decryption error for field ${field}:`, error);
    return encrypted; // Retorna encriptado se falhar
  }
}
```

---

## 📋 PASSO 5 — AUDIT LOGGING (LOGGING DE SEGURANÇA)

### 5.1 Schema D1 para Audit Logs

```sql
-- Tabela de audit logs de segurança
CREATE TABLE IF NOT EXISTS audit_logs (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  timestamp DATETIME NOT NULL,
  ip TEXT NOT NULL,
  user_id TEXT,
  session_id TEXT,
  user_agent TEXT,
  event_name TEXT,
  event_id TEXT,
  log_type TEXT NOT NULL,
  severity TEXT NOT NULL,
  action TEXT NOT NULL,
  outcome TEXT NOT NULL,
  details TEXT,
  blocked BOOLEAN,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_logs(timestamp);
CREATE INDEX IF NOT EXISTS idx_audit_ip ON audit_logs(ip);
CREATE INDEX IF NOT EXISTS idx_audit_user ON audit_logs(user_id);
CREATE INDEX IF NOT EXISTS idx_audit_session ON audit_logs(session_id);
CREATE INDEX IF NOT EXISTS idx_audit_event_name ON audit_logs(event_name);
CREATE INDEX IF NOT EXISTS idx_audit_log_type ON audit_logs(log_type);
CREATE INDEX IF NOT EXISTS idx_audit_severity ON audit_logs(severity);
CREATE INDEX IF NOT EXISTS idx_audit_blocked ON audit_logs(blocked);
```

### 5.2 Tipos de Audit Log

```typescript
// Tipos de log de segurança
const AUDIT_LOG_TYPES = {
  // Rate Limiting
  RATE_LIMIT_EXCEEDED: 'RATE_LIMIT_EXCEEDED',
  IP_RATE_LIMIT_EXCEEDED: 'IP_RATE_LIMIT_EXCEEDED',
  USER_RATE_LIMIT_EXCEEDED: 'USER_RATE_LIMIT_EXCEEDED',
  EVENT_RATE_LIMIT_EXCEEDED: 'EVENT_RATE_LIMIT_EXCEEDED',
  GLOBAL_RATE_LIMIT_EXCEEDED: 'GLOBAL_RATE_LIMIT_EXCEEDED',

  // IP Blocking
  IP_BLACKLISTED: 'IP_BLACKLISTED',
  IP_AUTO_BLOCKED: 'IP_AUTO_BLOCKED',
  IP_GEO_BLOCKED: 'IP_GEO_BLOCKED',
  IP_WHITELISTED: 'IP_WHITELISTED',

  // Validation
  VALIDATION_ERROR: 'VALIDATION_ERROR',
  VALIDATION_EXCEPTION: 'VALIDATION_EXCEPTION',
  VALIDATION_FAILED: 'VALIDATION_FAILED',
  MISSING_BODY: 'MISSING_BODY',

  // Sanitization
  SANITIZATION_APPLIED: 'SANITIZATION_APPLIED',
  XSS_ATTEMPT: 'XSS_ATTEMPT',
  SQL_INJECTION_ATTEMPT: 'SQL_INJECTION_ATTEMPT',
  EMAIL_INJECTION_ATTEMPT: 'EMAIL_INJECTION_ATTEMPT',
  PHONE_INJECTION_ATTEMPT: 'PHONE_INJECTION_ATTEMPT',
  URL_INJECTION_ATTEMPT: 'URL_INJECTION_ATTEMPT',

  // Encryption
  ENCRYPTION_ERROR: 'ENCRYPTION_ERROR',
  DECRYPTION_ERROR: 'DECRYPTION_ERROR',
  KEY_ROTATION: 'KEY_ROTATION',

  // Security Middleware
  SECURITY_MIDDLEWARE_EXCEPTION: 'SECURITY_MIDDLEWARE_EXCEPTION'
};

// Níveis de severidade
const SEVERITY_LEVELS = {
  CRITICAL: 'CRITICAL',
  HIGH: 'HIGH',
  MEDIUM: 'MEDIUM',
  LOW: 'LOW',
  INFO: 'INFO'
};
```

### 5.3 Funções de Audit Logging

```typescript
// Log de evento de segurança
export async function logSecurityEvent(eventData, env) {
  const {
    type,
    severity,
    ip = 'unknown',
    user_id = null,
    session_id = null,
    user_agent = null,
    event_name = null,
    event_id = null,
    action,
    outcome,
    details = null,
    blocked = false
  } = eventData;

  const timestamp = new Date().toISOString();

  await env.DB.prepare(`
    INSERT INTO audit_logs
    (timestamp, ip, user_id, session_id, user_agent, event_name, event_id,
     log_type, severity, action, outcome, details, blocked)
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
  `).bind(
    timestamp,
    ip,
    user_id,
    session_id,
    user_agent,
    event_name,
    event_id,
    type,
    severity,
    action || 'LOG_EVENT',
    outcome || 'SUCCESS',
    JSON.stringify(details),
    blocked ? 1 : 0
  ).run();

  // Log crítico no console
  if (severity === 'CRITICAL' || severity === 'HIGH') {
    console.error(`🚨 ${severity} [${type}]:`, {
      ip,
      user_id,
      event_name,
      action,
      details
    });
  }
}

// Query de audit logs
export async function queryAuditLogs(filters = {}, env) {
  const {
    ip,
    user_id,
    session_id,
    event_name,
    log_type,
    severity,
    blocked,
    start_date,
    end_date,
    limit = 100
  } = filters;

  let query = 'SELECT * FROM audit_logs WHERE 1=1';
  const params = [];

  if (ip) {
    query += ' AND ip = ?';
    params.push(ip);
  }
  if (user_id) {
    query += ' AND user_id = ?';
    params.push(user_id);
  }
  if (session_id) {
    query += ' AND session_id = ?';
    params.push(session_id);
  }
  if (event_name) {
    query += ' AND event_name = ?';
    params.push(event_name);
  }
  if (log_type) {
    query += ' AND log_type = ?';
    params.push(log_type);
  }
  if (severity) {
    query += ' AND severity = ?';
    params.push(severity);
  }
  if (blocked !== undefined) {
    query += ' AND blocked = ?';
    params.push(blocked ? 1 : 0);
  }
  if (start_date) {
    query += ' AND timestamp >= ?';
    params.push(start_date);
  }
  if (end_date) {
    query += ' AND timestamp <= ?';
    params.push(end_date);
  }

  query += ' ORDER BY timestamp DESC LIMIT ?';

  const results = await env.DB.prepare(query).bind(...params).all();

  return results;
}
```

---

## 🔧 PASSO 6 — ENDPOINTS DE SEGURANÇA

### 6.1 Endpoint: `/api/security/rate-limit-status`

```typescript
export async function getRateLimitStatus(request, env) {
  const ip = request.headers.get('CF-Connecting-IP') || 'unknown';

  const stats = {
    ip,
    rate_limits: {
      ip: rateLimiters.ip.has(ip) ? {
        remaining: rateLimiters.ip.get(ip).tokens,
        capacity: rateLimiters.ip.get(ip).capacity,
        refill_rate: rateLimiters.ip.get(ip).refillRate
      } : null,
      global: {
        remaining: rateLimiters.event.get('global').tokens,
        capacity: rateLimiters.event.get('global').capacity,
        refill_rate: rateLimiters.event.get('global').refillRate
      }
    },
    recent_violations: await env.DB.prepare(`
      SELECT
        log_type,
        severity,
        COUNT(*) as violations
      FROM audit_logs
      WHERE ip = ?
        AND created_at > datetime('now', '-1 hour')
      GROUP BY log_type, severity
      ORDER BY violations DESC
    `).bind(ip).all()
  };

  return new Response(JSON.stringify(stats), {
    headers: { 'Content-Type': 'application/json' },
    status: 200
  });
}
```

### 6.2 Endpoint: `/api/security/ip-status`

```typescript
export async function getIPStatus(request, env) {
  const ip = request.headers.get('CF-Connecting-IP') || 'unknown';

  // Verificar status do IP
  const blacklist = await checkIPBlacklist(ip, env);
  const whitelist = await checkIPWhitelist(ip, env);
  const geoBlock = await checkGeoBlocking(request, env);

  const status = {
    ip,
    is_whitelisted: whitelist,
    is_blacklisted: !!blacklist,
    blacklist_reason: blacklist ? blacklist.block_reason : null,
    is_geo_blocked: !!geoBlock,
    geo_details: geoBlock || null,
    recent_violations: await env.DB.prepare(`
      SELECT
        COUNT(*) as violations,
        MAX(violation_count) as max_violation_count
      FROM ip_blacklist
      WHERE ip = ?
        AND unblocked_at IS NULL
        AND blocked_at > datetime('now', '-24 hours')
    `).bind(ip).get()
  };

  return new Response(JSON.stringify(status), {
    headers: { 'Content-Type': 'application/json' },
    status: 200
  });
}
```

### 6.3 Endpoint: `/api/security/audit-logs`

```typescript
export async function getAuditLogs(request, env) {
  const url = new URL(request.url);
  const filters = {
    ip: url.searchParams.get('ip'),
    user_id: url.searchParams.get('user_id'),
    session_id: url.searchParams.get('session_id'),
    event_name: url.searchParams.get('event_name'),
    log_type: url.searchParams.get('log_type'),
    severity: url.searchParams.get('severity'),
    blocked: url.searchParams.get('blocked'),
    start_date: url.searchParams.get('start_date'),
    end_date: url.searchParams.get('end_date'),
    limit: parseInt(url.searchParams.get('limit') || '100')
  };

  const logs = await queryAuditLogs(filters);

  return new Response(JSON.stringify({
    logs,
    total_count: logs.length,
    filters
  }), {
    headers: { 'Content-Type': 'application/json' },
    status: 200
  });
}
```

---

## 🎯 FORMATO DE SAÍDA

### DELIVERABLE 1: `modules/security-middleware.ts`

```typescript
// modules/security-middleware.ts - Middleware de segurança completo
export {
  applyRateLimiting,
  checkIPBlocking,
  validateEvent,
  sanitizePayload,
  applySecurityMiddleware,
  hashEmail,
  hashPhone,
  hashFirstName,
  hashLastName,
  hashCity,
  hashState,
  hashCEP,
  encryptPII,
  decryptPII,
  logSecurityEvent,
  queryAuditLogs
};
```

### DELIVERABLE 2: `security-schema.sql`

```sql
-- security-schema.sql - Schema D1 para segurança
CREATE TABLE IF NOT EXISTS ip_blacklist (...);
CREATE TABLE IF NOT EXISTS ip_whitelist (...);
CREATE TABLE IF NOT EXISTS ip_violations (...);
CREATE TABLE IF NOT EXISTS audit_logs (...);
```

### DELIVERABLE 3: `security-config.js`

```typescript
// security-config.js - Configuração de segurança
export const RATE_LIMIT_CONFIG = { ... };
export const IP_BLOCKING_CONFIG = { ... };
export const ENCRYPTION_CONFIG = { ... };
export const AUDIT_LOG_TYPES = { ... };
export const SEVERITY_LEVELS = { ... };
```

---

## 📊 CHECKLIST DE IMPLEMENTAÇÃO

### Rate Limiting

- [ ] Token bucket algorithm implementado
- [ ] Rate limiting por IP implementado
- [ ] Rate limiting por usuário implementado
- [ ] Rate limiting por evento implementado
- [ ] Rate limiting global implementado
- [ ] Headers de rate limit implementados
- [ ] Exponential backoff implementado

### IP Blocking

- [ ] Blacklist de IPs criada
- [ ] Whitelist de IPs criada
- [ ] Bloqueio automático por falhas implementado
- [ ] Bloqueio automático por 429 implementado
- [ ] Geoblocking implementado
- [ ] CIDR ranges implementados
- [ ] Auto-unblock implementado

### CSRF Protection (Webhooks)

- [ ] HMAC-SHA256 validado para Hotmart
- [ ] HMAC-SHA256 validado para Kiwify
- [ ] HMAC-SHA256 validado para Ticto
- [ ] HMAC-SHA256 validado para Stripe
- [ ] `timingSafeEqual` implementado (sem timing attacks)
- [ ] Body lido como text antes do JSON.parse para validação HMAC
- [ ] Secrets via `wrangler secret put` (nunca hardcode)

### Input Validation

- [ ] Joi schemas criados (Lead, Purchase, Contact)
- [ ] Validação de email implementada
- [ ] Validação de telefone implementada
- [ ] Validação de URL implementada
- [ ] Validação de user_agent implementada
- [ ] Sanitização de strings implementada
- [ ] Sanitização anti-XSS implementada
- [ ] Sanitização anti-injection implementada

### Encryption

- [ ] SHA256 hashing implementado (email, phone, nome, cidade)
- [ ] Normalização de dados implementada
- [ ] AES-256-GCM encryption implementada
- [ ] Encriptação de PII no D1 implementada
- [ ] Decriptação de PII implementada
- [ ] Geração de chaves implementada

### Audit Logging

- [ ] Schema D1 para audit logs criado
- [ ] Tipos de log de segurança criados
- [ ] Função de log de eventos implementada
- [ ] Query de audit logs implementada
- [ ] Bloqueio de IPs logado
- [ ] Validações falhas logadas

### Endpoints

- [ ] GET /api/security/rate-limit-status implementado
- [ ] GET /api/security/ip-status implementado
- [ ] GET /api/security/audit-logs implementado
- [ ] Headers de segurança implementados

---

## 🎯 BENEFÍCIOS ESPERADOS

1. **Proteção contra abuso** — Rate limiting impede flooding
2. **Proteção contra ataques** — IP blocking impede IPs maliciosos
3. **Validação profissional** — Joi schemas validam entrada rigorosamente
4. **Sanitização robusta** — Anti-XSS e anti-injection
5. **Encryption de PII** — Dados sensíveis protegidos no D1
6. **Audit logging completo** - Quem fez o quê, quando, onde
7. **Compliance ready** - Logs para GDPR/LGPD/CCPA

---

> 🔒 **Sua Função:** Implementar camadas de segurança enterprise (rate limiting, IP blocking, input validation, encryption, audit logging) para proteger o sistema server-side contra abuso, ataques e garantir conformidade com normas de segurança.