/**
 * MCP tool input validation service
 * 
 * ISMS Policy: SC-002 (Secure Coding Standards)
 * - Implements input validation for all MCP tool parameters
 * - Sanitizes user-provided search queries and filters
 * - Prevents injection attacks and data exfiltration
 * 
 * Compliance: ISO 27001:2022 A.8.3, NIST CSF PR.DS-5, CIS Control 4.1
 */
export class InputValidationService {
  private readonly MAX_QUERY_LENGTH = 200;
  private readonly ALLOWED_CHARS = /^[a-zA-Z0-9\s\-_.]+$/;
  
  /**
   * Validates and sanitizes search query parameters
   * Throws ValidationError if input is malformed or malicious
   */
  validateSearchQuery(query: string): string {
    if (typeof query !== 'string') {
      throw new ValidationError('Query must be a string');
    }
    
    if (query.length > this.MAX_QUERY_LENGTH) {
      throw new ValidationError(`Query exceeds maximum length of ${this.MAX_QUERY_LENGTH}`);
    }
    
    if (!this.ALLOWED_CHARS.test(query)) {
      throw new ValidationError('Query contains invalid characters');
    }
    
    return query.trim();
  }
}

## Security Architecture

### Authentication & Authorization
- **Policy**: [AC-001 Access Control Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/policies/AC-001.md)
- **Implementation**: API key authentication with rate limiting
- **Compliance**: ISO 27001:2022 A.5.15, NIST CSF PR.AC-1

### Data Protection
- **Policy**: [DP-001 Data Protection Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/policies/DP-001.md)
- **Encryption**: TLS 1.3 for all API communications
- **Compliance**: ISO 27001:2022 A.8.24, NIST CSF PR.DS-1

### Input Validation
- **Policy**: [SC-002 Secure Coding Standards](https://github.com/Hack23/ISMS-PUBLIC/blob/main/policies/SC-002.md)
- **Implementation**: Whitelist validation for all user inputs
- **Compliance**: OWASP API Security Top 10 (API1:2023)

/**
 * Validate and sanitize European Parliament document ID
 * ISMS Policy: SC-002 (Secure Coding Standards)
 * Compliance: OWASP Top 10 (A03:2021 - Injection)
 */
export function validateDocumentId(id: string): string {
  if (typeof id !== 'string') {
    throw new ValidationError('Document ID must be a string');
  }
  
  // European Parliament document IDs follow format: EP-YYYYMMDD-NNNNN
  const documentIdPattern = /^EP-\d{8}-\d{5}$/;
  
  if (!documentIdPattern.test(id)) {
    throw new ValidationError('Invalid document ID format');
  }
  
  return id;
}

{
  "scripts": {
    "preinstall": "npm audit --audit-level=moderate",
    "test:security": "npm audit && npm run test:licenses",
    "test:licenses": "license-checker --onlyAllow 'MIT;Apache-2.0;BSD-3-Clause;ISC'",
    "prepare": "npm run build && npm run test:security"
  }
}

/**
 * Rate limiting middleware for MCP tool requests
 * ISMS Policy: AC-002 (Access Control Policy - Rate Limiting)
 * Prevents abuse and DoS attacks
 * Compliance: NIST CSF PR.AC-4, CIS Control 13.3
 */
export class RateLimiter {
  private readonly requests: Map<string, number[]> = new Map();
  private readonly MAX_REQUESTS = 100;
  private readonly WINDOW_MS = 15 * 60 * 1000; // 15 minutes
  
  async checkLimit(clientId: string): Promise<void> {
    const now = Date.now();
    const clientRequests = this.requests.get(clientId) || [];
    
    // Remove requests outside the window
    const recentRequests = clientRequests.filter(
      timestamp => now - timestamp < this.WINDOW_MS
    );
    
    if (recentRequests.length >= this.MAX_REQUESTS) {
      const oldestRequest = Math.min(...recentRequests);
      const retryAfter = Math.ceil((oldestRequest + this.WINDOW_MS - now) / 1000);
      
      throw new RateLimitError(
        `Rate limit exceeded. Try again in ${retryAfter} seconds.`,
        retryAfter
      );
    }
    
    recentRequests.push(now);
    this.requests.set(clientId, recentRequests);
  }
}

// Bad: No security policy reference or documentation
export class ApiService {
  async queryDocuments(query: string) {
    // Implementation without security context
    return fetch(`/api/search?q=${query}`); // Potential injection!
  }
}

// Bad: Insufficient validation, no policy reference
function validateInput(input: string): boolean {
  return input.length > 0; // Too permissive!
}

// Bad: Directly using unvalidated input
async function search(query: string): Promise<Results> {
  // No validation or sanitization - XSS/injection vulnerability
  return await db.query(`SELECT * FROM docs WHERE title LIKE '%${query}%'`);
}

// Bad: No audit logging of security events
async function handleToolRequest(request: ToolRequest): Promise<ToolResponse> {
  try {
    return await processRequest(request);
    // No logging of successful requests
  } catch (error) {
    return { error: error.message };
    // No logging of failed requests or security violations
  }
}

// Bad: No rate limiting allows abuse
export async function searchDocuments(query: SearchQuery): Promise<Results> {
  // Anyone can make unlimited requests
  return await europeanParliamentApi.search(query);
}