Mejores Prácticas de Seguridad

async function rotarSecretoConReintentos(tokenActual, maxReintentos = 3) {
  for (let intento = 1; intento <= maxReintentos; intento++) {
    try {
      const nuevoSecreto = await rotarSecretoApi(tokenActual);
      return nuevoSecreto;
    } catch (error) {
      console.error(`Intento ${intento} falló:`, error.message);
      
      if (error.response?.status === 401) {
        throw new Error('Token inválido - no se puede rotar');
      }
      
      if (intento === maxReintentos) {
        throw new Error('Rotación de secreto falló después de múltiples intentos');
      }
      
      // Esperar antes de reintentar
      await new Promise(resolve => setTimeout(resolve, 1000 * intento));
    }
  }
}

const crypto = require('crypto');
 
function verifyWebhookSignature(payload, signature, secret) {
  // payload DEBE ser el body crudo (Buffer o string)
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  
  // Comparación tiempo-constante para prevenir timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}
 
// Express - usar express.raw
app.post('/webhooks/koywe',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['koywe-signature'];
    const secret = process.env.KOYWE_WEBHOOK_SECRET;
    
    if (!verifyWebhookSignature(req.body, signature, secret)) {
      return res.status(401).send('Firma inválida');
    }
    
    // Procesar webhook...
    res.status(200).send('OK');
  }
);

const rateLimit = require('express-rate-limit');
 
// Limitar webhook requests
const webhookLimiter = rateLimit({
  windowMs: 1 * 60 * 1000, // 1 minuto
  max: 100, // máximo 100 requests por minuto
  message: 'Demasiadas solicitudes, intenta más tarde'
});
 
app.post('/webhooks/koywe', 
  webhookLimiter,
  express.raw({ type: 'application/json' }),
  handleWebhook
);

app.post('/webhooks/koywe', (req, res) => {
  // Rechazar requests no HTTPS en producción
  if (process.env.NODE_ENV === 'production' && req.protocol !== 'https') {
    return res.status(403).send('HTTPS requerido');
  }
  
  // Procesar webhook...
});

function sanitizeForLogging(data) {
  const sensitiveFields = [
    'apiKey',
    'secret',
    'token',
    'password',
    'accountNumber',
    'cardNumber',
    'cvv'
  ];
  
  const sanitized = { ...data };
  
  for (const field of sensitiveFields) {
    if (sanitized[field]) {
      sanitized[field] = '***REDACTED***';
    }
  }
  
  return sanitized;
}
 
// Uso
console.log('Orden creada:', sanitizeForLogging(orderData));

const crypto = require('crypto');
 
class SecureStorage {
  constructor(encryptionKey) {
    this.algorithm = 'aes-256-gcm';
    this.key = Buffer.from(encryptionKey, 'hex');
  }
  
  encrypt(text) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv(this.algorithm, this.key, iv);
    
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    
    const authTag = cipher.getAuthTag();
    
    return {
      encrypted,
      iv: iv.toString('hex'),
      authTag: authTag.toString('hex')
    };
  }
  
  decrypt(encrypted, iv, authTag) {
    const decipher = crypto.createDecipheriv(
      this.algorithm,
      this.key,
      Buffer.from(iv, 'hex')
    );
    
    decipher.setAuthTag(Buffer.from(authTag, 'hex'));
    
    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    
    return decrypted;
  }
}
 
// Uso
const storage = new SecureStorage(process.env.ENCRYPTION_KEY);
const encrypted = storage.encrypt('datos-sensibles');

const validator = require('validator');
 
function validateOrderInput(orderData) {
  const errors = [];
  
  // Validar amount
  if (!orderData.amount || typeof orderData.amount !== 'number') {
    errors.push('Monto inválido');
  }
  
  if (orderData.amount <= 0 || orderData.amount > 10000000) {
    errors.push('Monto fuera de rango');
  }
  
  // Validar currency
  const validCurrencies = ['COP', 'USD', 'BRL', 'MXN', 'CLP'];
  if (!validCurrencies.includes(orderData.currency)) {
    errors.push('Moneda inválida');
  }
  
  // Validar email si existe
  if (orderData.email && !validator.isEmail(orderData.email)) {
    errors.push('Email inválido');
  }
  
  // Prevenir inyección en externalId
  if (orderData.externalId) {
    orderData.externalId = validator.escape(orderData.externalId);
  }
  
  if (errors.length > 0) {
    throw new Error(`Validación fallida: ${errors.join(', ')}`);
  }
  
  return orderData;
}

const permissions = {
  'admin': ['read', 'write', 'delete'],
  'operator': ['read', 'write'],
  'viewer': ['read']
};
 
function requirePermission(permission) {
  return (req, res, next) => {
    const userRole = req.user.role;
    const userPermissions = permissions[userRole] || [];
    
    if (!userPermissions.includes(permission)) {
      return res.status(403).json({
        error: 'Permisos insuficientes'
      });
    }
    
    next();
  };
}
 
// Uso
app.post('/api/orders', 
  authenticate,
  requirePermission('write'),
  createOrderHandler
);

class SecurityAuditLogger {
  static async log(event, details) {
    const auditEntry = {
      timestamp: new Date().toISOString(),
      event,
      userId: details.userId,
      ip: details.ip,
      userAgent: details.userAgent,
      action: details.action,
      resource: details.resource,
      success: details.success,
      reason: details.reason
    };
    
    // Registrar en sistema seguro
    await db.query(
      `INSERT INTO security_audit_log 
       (timestamp, event, user_id, ip, action, success) 
       VALUES ($1, $2, $3, $4, $5, $6)`,
      [
        auditEntry.timestamp,
        auditEntry.event,
        auditEntry.userId,
        auditEntry.ip,
        auditEntry.action,
        auditEntry.success
      ]
    );
  }
}
 
// Uso
await SecurityAuditLogger.log('AUTHENTICATION_ATTEMPT', {
  userId: user.id,
  ip: req.ip,
  userAgent: req.headers['user-agent'],
  action: 'login',
  success: true
});

async function emergencyCredentialRevocation() {
  // 1. Deshabilitar API keys comprometidas
  await disableApiKey(compromisedApiKey);
  
  // 2. Generar nuevas credenciales
  const newCredentials = await generateNewApiKey();
  
  // 3. Notificar equipo
  await sendSecurityAlert({
    type: 'CREDENTIAL_COMPROMISED',
    action: 'REVOKED_AND_REGENERATED',
    newKeyId: newCredentials.id
  });
  
  // 4. Actualizar sistemas
  await updateProductionCredentials(newCredentials);
  
  return newCredentials;
}