package organization

import (
    "context"
    "fmt"
    "log"
    "time"
)

// Enterprise Go project structure follows domain-driven design principles
// with clear separation of concerns and consistent patterns across teams

/*
Enterprise Project Structure:

cmd/
├── api-server/          # Main API application
│   └── main.go
├── worker/              # Background worker
│   └── main.go
└── migration/           # Database migration tool
    └── main.go

internal/                # Private application code
├── api/                 # API layer
│   ├── handlers/        # HTTP handlers
│   ├── middleware/      # HTTP middleware
│   └── routes/          # Route definitions
├── domain/              # Domain layer (business logic)
│   ├── user/            # User domain
│   ├── order/           # Order domain
│   └── payment/         # Payment domain
├── infrastructure/      # Infrastructure layer
│   ├── database/        # Database implementations
│   ├── cache/           # Cache implementations
│   └── queue/           # Message queue implementations
├── application/         # Application services
│   ├── services/        # Application services
│   └── dto/             # Data Transfer Objects
└── shared/              # Shared utilities
    ├── config/          # Configuration
    ├── logger/          # Logging
    └── metrics/         # Metrics

pkg/                     # Public library code
├── client/              # API clients
├── models/              # Shared models
└── utils/               # Shared utilities

api/                     # API definitions
├── openapi/             # OpenAPI specifications
└── proto/               # Protocol Buffer definitions

docs/                    # Documentation
├── architecture/        # Architecture documentation
├── deployment/          # Deployment guides
└── api/                 # API documentation

scripts/                 # Build and deployment scripts
├── build/               # Build scripts
├── deploy/              # Deployment scripts
└── ci/                  # CI/CD scripts

configs/                 # Configuration files
├── local/               # Local development
├── staging/             # Staging environment
└── production/          # Production environment
*/

// EnterpriseCodeStandards enforces consistent coding standards across teams
type EnterpriseCodeStandards struct {
    // Formatting and style
    formatter       *CodeFormatter
    linter          *CodeLinter
    analyzer        *StaticAnalyzer

    // Documentation standards
    docGenerator    *DocumentationGenerator
    commentChecker  *CommentChecker

    // Import organization
    importOrganizer *ImportOrganizer

    // Naming conventions
    namingEnforcer  *NamingEnforcer

    config          *CodeStandardsConfig
}

type CodeStandardsConfig struct {
    // Formatting
    UseGofmt           bool
    UseGoimports       bool
    LineLength         int
    IndentationSpaces  int

    // Linting
    EnabledLinters     []string
    CustomRules        []LintRule
    FailOnWarnings     bool

    // Documentation
    RequirePackageDocs bool
    RequireTypeDocs    bool
    RequireFuncDocs    bool
    MinCommentCoverage float64

    // Naming
    EnforceGoNaming    bool
    CustomNamingRules  []NamingRule

    // Import organization
    GroupImports       bool
    SortImports        bool
    LocalImportPrefix  string
}

// Package documentation standards for enterprise projects
/*
Package user provides comprehensive user management functionality
for enterprise applications, including user authentication, authorization,
profile management, and audit trails.

The package follows domain-driven design principles with clear separation
between business logic, data access, and external interfaces.

Key components:
  - User: Core user entity with business logic
  - UserRepository: Data access interface
  - UserService: Application service for user operations
  - UserHandler: HTTP handlers for user API endpoints

Example usage:

    // Create user service
    userRepo := postgresql.NewUserRepository(db)
    userService := user.NewService(userRepo, logger)

    // Create new user
    newUser, err := userService.CreateUser(ctx, CreateUserRequest{
        Email:    "user@example.com",
        Name:     "John Doe",
        Password: "secure_password",
    })

Security considerations:
  - All passwords are hashed using bcrypt
  - Sensitive user data is encrypted at rest
  - User actions are logged for audit purposes
  - Rate limiting is applied to prevent abuse

Performance characteristics:
  - User lookups are cached for 5 minutes
  - Bulk operations are batched for efficiency
  - Database queries use prepared statements
  - Concurrent operations are goroutine-safe
*/

// Domain Entity: User demonstrates enterprise entity patterns
type User struct {
    // Identity
    ID       string    `json:"id" db:"id" validate:"required,uuid4"`
    Email    string    `json:"email" db:"email" validate:"required,email"`
    Username string    `json:"username" db:"username" validate:"required,alphanum,min=3,max=30"`

    // Profile information
    FirstName string     `json:"firstName" db:"first_name" validate:"required,min=1,max=50"`
    LastName  string     `json:"lastName" db:"last_name" validate:"required,min=1,max=50"`
    Avatar    *string    `json:"avatar,omitempty" db:"avatar" validate:"omitempty,url"`

    // Authentication
    PasswordHash string    `json:"-" db:"password_hash"`
    LastLogin    *time.Time `json:"lastLogin,omitempty" db:"last_login"`

    // Status and preferences
    Status      UserStatus `json:"status" db:"status" validate:"required"`
    Preferences UserPrefs  `json:"preferences" db:"preferences"`

    // Audit fields
    CreatedAt time.Time  `json:"createdAt" db:"created_at"`
    UpdatedAt time.Time  `json:"updatedAt" db:"updated_at"`
    DeletedAt *time.Time `json:"deletedAt,omitempty" db:"deleted_at"`
    Version   int        `json:"version" db:"version"`

    // Metadata for enterprise features
    Metadata map[string]interface{} `json:"metadata,omitempty" db:"metadata"`
}

// UserStatus represents the current status of a user account
type UserStatus int

const (
    // UserStatusPending indicates a user account that has been created
    // but not yet activated (email verification pending)
    UserStatusPending UserStatus = iota

    // UserStatusActive indicates a fully activated user account
    // with all privileges enabled
    UserStatusActive

    // UserStatusSuspended indicates a user account that has been
    // temporarily suspended due to policy violations
    UserStatusSuspended

    // UserStatusDeactivated indicates a user account that has been
    // deactivated by the user themselves
    UserStatusDeactivated

    // UserStatusBanned indicates a user account that has been
    // permanently banned due to severe policy violations
    UserStatusBanned
)

// String implements the Stringer interface for UserStatus
func (s UserStatus) String() string {
    switch s {
    case UserStatusPending:
        return "pending"
    case UserStatusActive:
        return "active"
    case UserStatusSuspended:
        return "suspended"
    case UserStatusDeactivated:
        return "deactivated"
    case UserStatusBanned:
        return "banned"
    default:
        return "unknown"
    }
}

// IsValid checks if the user status is valid
func (s UserStatus) IsValid() bool {
    return s >= UserStatusPending && s <= UserStatusBanned
}

// CanAuthenticate determines if a user with this status can authenticate
func (s UserStatus) CanAuthenticate() bool {
    return s == UserStatusActive
}

// UserPrefs represents user preferences and settings
type UserPrefs struct {
    Language         string `json:"language" validate:"required,len=2"`
    Timezone         string `json:"timezone" validate:"required"`
    EmailNotifications bool `json:"emailNotifications"`
    SMSNotifications bool   `json:"smsNotifications"`
    Theme            string `json:"theme" validate:"oneof=light dark auto"`
}

// Validate performs comprehensive validation of user preferences
func (p UserPrefs) Validate() error {
    if p.Language == "" {
        return fmt.Errorf("language is required")
    }

    if p.Timezone == "" {
        return fmt.Errorf("timezone is required")
    }

    // Validate timezone
    if _, err := time.LoadLocation(p.Timezone); err != nil {
        return fmt.Errorf("invalid timezone: %w", err)
    }

    // Validate theme
    validThemes := map[string]bool{
        "light": true,
        "dark":  true,
        "auto":  true,
    }

    if !validThemes[p.Theme] {
        return fmt.Errorf("invalid theme: %s", p.Theme)
    }

    return nil
}

// Business logic methods demonstrate enterprise domain patterns

// UpdateProfile updates the user's profile information with validation
func (u *User) UpdateProfile(firstName, lastName string, avatar *string) error {
    if firstName == "" {
        return fmt.Errorf("first name cannot be empty")
    }

    if lastName == "" {
        return fmt.Errorf("last name cannot be empty")
    }

    if avatar != nil && *avatar != "" {
        // Validate avatar URL
        if !isValidURL(*avatar) {
            return fmt.Errorf("invalid avatar URL")
        }
    }

    u.FirstName = firstName
    u.LastName = lastName
    u.Avatar = avatar
    u.UpdatedAt = time.Now()
    u.Version++

    return nil
}

// ChangeStatus changes the user's status with business rule validation
func (u *User) ChangeStatus(newStatus UserStatus, reason string) error {
    if !newStatus.IsValid() {
        return fmt.Errorf("invalid status: %v", newStatus)
    }

    // Business rules for status transitions
    switch u.Status {
    case UserStatusBanned:
        // Cannot change status from banned
        return fmt.Errorf("cannot change status from banned")

    case UserStatusDeactivated:
        // Can only reactivate deactivated users
        if newStatus != UserStatusActive {
            return fmt.Errorf("deactivated users can only be reactivated")
        }

    case UserStatusSuspended:
        // Can reactivate or ban suspended users
        if newStatus != UserStatusActive && newStatus != UserStatusBanned {
            return fmt.Errorf("suspended users can only be activated or banned")
        }
    }

    u.Status = newStatus
    u.UpdatedAt = time.Now()
    u.Version++

    // Add status change to metadata for audit trail
    if u.Metadata == nil {
        u.Metadata = make(map[string]interface{})
    }

    statusChanges, exists := u.Metadata["status_changes"]
    if !exists {
        statusChanges = []interface{}{}
    }

    changes := statusChanges.([]interface{})
    changes = append(changes, map[string]interface{}{
        "from":      u.Status.String(),
        "to":        newStatus.String(),
        "reason":    reason,
        "timestamp": time.Now(),
    })

    u.Metadata["status_changes"] = changes

    return nil
}

// RecordLogin updates the user's last login time
func (u *User) RecordLogin() {
    now := time.Now()
    u.LastLogin = &now
    u.UpdatedAt = now
    u.Version++
}

// IsActive checks if the user account is active and can authenticate
func (u *User) IsActive() bool {
    return u.Status.CanAuthenticate() && u.DeletedAt == nil
}

// GetFullName returns the user's full name
func (u *User) GetFullName() string {
    return fmt.Sprintf("%s %s", u.FirstName, u.LastName)
}

// GetDisplayName returns an appropriate display name for the user
func (u *User) GetDisplayName() string {
    if u.FirstName != "" && u.LastName != "" {
        return u.GetFullName()
    }
    if u.Username != "" {
        return u.Username
    }
    return u.Email
}

// Helper functions for validation and utility operations

// isValidURL validates if a string is a valid URL
func isValidURL(s string) bool {
    // Implement URL validation logic
    // This is a simplified example
    return len(s) > 0 && (startsWith(s, "http://") || startsWith(s, "https://"))
}

// startsWith checks if a string starts with a prefix
func startsWith(s, prefix string) bool {
    return len(s) >= len(prefix) && s[:len(prefix)] == prefix
}

// generateUserID generates a unique user ID
func generateUserID() string {
    // Implement UUID generation
    // This is a placeholder implementation
    return fmt.Sprintf("user_%d", time.Now().UnixNano())
}

package errors

import (
    "context"
    "encoding/json"
    "fmt"
    "runtime"
    "time"
)

// EnterpriseError provides comprehensive error handling for enterprise applications
// with context, categorization, and operational metadata
type EnterpriseError struct {
    // Core error information
    Code        string    `json:"code"`
    Message     string    `json:"message"`
    Type        ErrorType `json:"type"`
    Severity    Severity  `json:"severity"`

    // Context and debugging
    Context     map[string]interface{} `json:"context,omitempty"`
    StackTrace  []StackFrame          `json:"stackTrace,omitempty"`
    Timestamp   time.Time             `json:"timestamp"`

    // Error chaining
    Cause       error                 `json:"cause,omitempty"`
    Wrapped     []error               `json:"wrapped,omitempty"`

    // Operational metadata
    RequestID   string                `json:"requestId,omitempty"`
    UserID      string                `json:"userId,omitempty"`
    Operation   string                `json:"operation,omitempty"`

    // Retry and recovery information
    Retryable   bool                  `json:"retryable"`
    RetryAfter  *time.Duration        `json:"retryAfter,omitempty"`

    // Metrics and monitoring
    ErrorID     string                `json:"errorId"`
    Component   string                `json:"component"`
    Service     string                `json:"service"`
}

type ErrorType int

const (
    // ErrorTypeValidation represents input validation errors
    ErrorTypeValidation ErrorType = iota

    // ErrorTypeAuthentication represents authentication failures
    ErrorTypeAuthentication

    // ErrorTypeAuthorization represents authorization failures
    ErrorTypeAuthorization

    // ErrorTypeBusiness represents business logic violations
    ErrorTypeBusiness

    // ErrorTypeIntegration represents external service failures
    ErrorTypeIntegration

    // ErrorTypeInfrastructure represents infrastructure failures
    ErrorTypeInfrastructure

    // ErrorTypeConfiguration represents configuration errors
    ErrorTypeConfiguration

    // ErrorTypeTimeout represents timeout errors
    ErrorTypeTimeout

    // ErrorTypeRateLimit represents rate limiting errors
    ErrorTypeRateLimit

    // ErrorTypeUnknown represents unclassified errors
    ErrorTypeUnknown
)

type Severity int

const (
    // SeverityLow represents minor issues that don't affect functionality
    SeverityLow Severity = iota

    // SeverityMedium represents issues that affect some functionality
    SeverityMedium

    // SeverityHigh represents issues that significantly impact functionality
    SeverityHigh

    // SeverityCritical represents issues that prevent core functionality
    SeverityCritical
)

type StackFrame struct {
    Function string `json:"function"`
    File     string `json:"file"`
    Line     int    `json:"line"`
}

// Error implements the error interface
func (e *EnterpriseError) Error() string {
    return fmt.Sprintf("[%s] %s", e.Code, e.Message)
}

// Unwrap implements error unwrapping for Go 1.13+ error handling
func (e *EnterpriseError) Unwrap() error {
    return e.Cause
}

// Is implements error identity checking for Go 1.13+ error handling
func (e *EnterpriseError) Is(target error) bool {
    if target == nil {
        return false
    }

    if ee, ok := target.(*EnterpriseError); ok {
        return e.Code == ee.Code && e.Type == ee.Type
    }

    return false
}

// As implements error type assertion for Go 1.13+ error handling
func (e *EnterpriseError) As(target interface{}) bool {
    if ee, ok := target.(**EnterpriseError); ok {
        *ee = e
        return true
    }
    return false
}

// ErrorBuilder provides a fluent interface for creating enterprise errors
type ErrorBuilder struct {
    error *EnterpriseError
}

// NewErrorBuilder creates a new error builder
func NewErrorBuilder(code, message string) *ErrorBuilder {
    return &ErrorBuilder{
        error: &EnterpriseError{
            Code:      code,
            Message:   message,
            Type:      ErrorTypeUnknown,
            Severity:  SeverityMedium,
            Context:   make(map[string]interface{}),
            Timestamp: time.Now(),
            ErrorID:   generateErrorID(),
            Retryable: false,
        },
    }
}

// WithType sets the error type
func (eb *ErrorBuilder) WithType(errorType ErrorType) *ErrorBuilder {
    eb.error.Type = errorType
    return eb
}

// WithSeverity sets the error severity
func (eb *ErrorBuilder) WithSeverity(severity Severity) *ErrorBuilder {
    eb.error.Severity = severity
    return eb
}

// WithContext adds context information
func (eb *ErrorBuilder) WithContext(key string, value interface{}) *ErrorBuilder {
    eb.error.Context[key] = value
    return eb
}

// WithCause sets the underlying cause
func (eb *ErrorBuilder) WithCause(cause error) *ErrorBuilder {
    eb.error.Cause = cause
    return eb
}

// WithRequestID sets the request ID for tracing
func (eb *ErrorBuilder) WithRequestID(requestID string) *ErrorBuilder {
    eb.error.RequestID = requestID
    return eb
}

// WithUserID sets the user ID for audit trails
func (eb *ErrorBuilder) WithUserID(userID string) *ErrorBuilder {
    eb.error.UserID = userID
    return eb
}

// WithOperation sets the operation being performed
func (eb *ErrorBuilder) WithOperation(operation string) *ErrorBuilder {
    eb.error.Operation = operation
    return eb
}

// WithComponent sets the component where the error occurred
func (eb *ErrorBuilder) WithComponent(component string) *ErrorBuilder {
    eb.error.Component = component
    return eb
}

// WithService sets the service where the error occurred
func (eb *ErrorBuilder) WithService(service string) *ErrorBuilder {
    eb.error.Service = service
    return eb
}

// WithRetryable sets whether the operation can be retried
func (eb *ErrorBuilder) WithRetryable(retryable bool) *ErrorBuilder {
    eb.error.Retryable = retryable
    return eb
}

// WithRetryAfter sets the retry delay
func (eb *ErrorBuilder) WithRetryAfter(delay time.Duration) *ErrorBuilder {
    eb.error.RetryAfter = &delay
    eb.error.Retryable = true
    return eb
}

// WithStackTrace captures the current stack trace
func (eb *ErrorBuilder) WithStackTrace() *ErrorBuilder {
    eb.error.StackTrace = captureStackTrace()
    return eb
}

// Build creates the final enterprise error
func (eb *ErrorBuilder) Build() *EnterpriseError {
    return eb.error
}

// Common enterprise error constructors

// NewValidationError creates a validation error
func NewValidationError(field, message string) *EnterpriseError {
    return NewErrorBuilder("VALIDATION_ERROR", fmt.Sprintf("Validation failed for %s: %s", field, message)).
        WithType(ErrorTypeValidation).
        WithSeverity(SeverityMedium).
        WithContext("field", field).
        WithRetryable(false).
        Build()
}

// NewAuthenticationError creates an authentication error
func NewAuthenticationError(message string) *EnterpriseError {
    return NewErrorBuilder("AUTHENTICATION_ERROR", message).
        WithType(ErrorTypeAuthentication).
        WithSeverity(SeverityHigh).
        WithRetryable(false).
        Build()
}

// NewAuthorizationError creates an authorization error
func NewAuthorizationError(resource, action string) *EnterpriseError {
    return NewErrorBuilder("AUTHORIZATION_ERROR", fmt.Sprintf("Insufficient permissions for %s on %s", action, resource)).
        WithType(ErrorTypeAuthorization).
        WithSeverity(SeverityHigh).
        WithContext("resource", resource).
        WithContext("action", action).
        WithRetryable(false).
        Build()
}

// NewBusinessError creates a business logic error
func NewBusinessError(code, message string) *EnterpriseError {
    return NewErrorBuilder(code, message).
        WithType(ErrorTypeBusiness).
        WithSeverity(SeverityMedium).
        WithRetryable(false).
        Build()
}

// NewIntegrationError creates an external service integration error
func NewIntegrationError(service string, cause error) *EnterpriseError {
    return NewErrorBuilder("INTEGRATION_ERROR", fmt.Sprintf("External service %s failed", service)).
        WithType(ErrorTypeIntegration).
        WithSeverity(SeverityHigh).
        WithContext("external_service", service).
        WithCause(cause).
        WithRetryable(true).
        WithRetryAfter(30 * time.Second).
        Build()
}

// NewTimeoutError creates a timeout error
func NewTimeoutError(operation string, timeout time.Duration) *EnterpriseError {
    return NewErrorBuilder("TIMEOUT_ERROR", fmt.Sprintf("Operation %s timed out after %v", operation, timeout)).
        WithType(ErrorTypeTimeout).
        WithSeverity(SeverityHigh).
        WithContext("operation", operation).
        WithContext("timeout", timeout.String()).
        WithRetryable(true).
        WithRetryAfter(timeout).
        Build()
}

// ErrorHandler provides centralized error handling and logging
type ErrorHandler struct {
    logger      Logger
    metrics     MetricsCollector
    alerter     AlertManager
    tracer      Tracer

    config      *ErrorHandlerConfig
}

type ErrorHandlerConfig struct {
    // Logging configuration
    LogLevel            LogLevel
    IncludeStackTrace   bool
    SanitizeUserData    bool

    // Alerting configuration
    AlertOnSeverity     Severity
    AlertingEnabled     bool

    // Metrics configuration
    RecordMetrics       bool
    MetricsPrefix       string

    // Response configuration
    IncludeErrorID      bool
    ExposeCause         bool
    SanitizeMessage     bool
}

func NewErrorHandler(config *ErrorHandlerConfig) *ErrorHandler {
    return &ErrorHandler{
        logger:  NewLogger(config.LoggerConfig),
        metrics: NewMetricsCollector(config.MetricsConfig),
        alerter: NewAlertManager(config.AlertConfig),
        tracer:  NewTracer(config.TracingConfig),
        config:  config,
    }
}

// HandleError processes an error with comprehensive logging, metrics, and alerting
func (eh *ErrorHandler) HandleError(ctx context.Context, err error) {
    if err == nil {
        return
    }

    // Convert to enterprise error if needed
    enterpriseErr := eh.ensureEnterpriseError(err)

    // Add context from request
    eh.enrichErrorContext(ctx, enterpriseErr)

    // Log error
    eh.logError(ctx, enterpriseErr)

    // Record metrics
    if eh.config.RecordMetrics {
        eh.recordErrorMetrics(enterpriseErr)
    }

    // Send alerts for severe errors
    if eh.config.AlertingEnabled && enterpriseErr.Severity >= eh.config.AlertOnSeverity {
        eh.sendAlert(ctx, enterpriseErr)
    }

    // Add to trace
    eh.addToTrace(ctx, enterpriseErr)
}

func (eh *ErrorHandler) ensureEnterpriseError(err error) *EnterpriseError {
    if ee, ok := err.(*EnterpriseError); ok {
        return ee
    }

    // Convert standard error to enterprise error
    return NewErrorBuilder("GENERIC_ERROR", err.Error()).
        WithType(ErrorTypeUnknown).
        WithSeverity(SeverityMedium).
        WithCause(err).
        WithStackTrace().
        Build()
}

func (eh *ErrorHandler) enrichErrorContext(ctx context.Context, err *EnterpriseError) {
    // Extract request ID from context
    if requestID := GetRequestID(ctx); requestID != "" {
        err.RequestID = requestID
    }

    // Extract user ID from context
    if userID := GetUserID(ctx); userID != "" {
        err.UserID = userID
    }

    // Extract trace ID from context
    if traceID := GetTraceID(ctx); traceID != "" {
        err.Context["trace_id"] = traceID
    }
}

func (eh *ErrorHandler) logError(ctx context.Context, err *EnterpriseError) {
    fields := map[string]interface{}{
        "error_id":   err.ErrorID,
        "error_code": err.Code,
        "error_type": err.Type,
        "severity":   err.Severity,
        "component":  err.Component,
        "service":    err.Service,
        "operation":  err.Operation,
        "retryable":  err.Retryable,
    }

    // Add context fields
    for k, v := range err.Context {
        fields["context."+k] = v
    }

    // Add request metadata
    if err.RequestID != "" {
        fields["request_id"] = err.RequestID
    }

    if err.UserID != "" {
        fields["user_id"] = err.UserID
    }

    // Include stack trace if configured
    if eh.config.IncludeStackTrace && len(err.StackTrace) > 0 {
        fields["stack_trace"] = err.StackTrace
    }

    // Log at appropriate level based on severity
    switch err.Severity {
    case SeverityLow:
        eh.logger.Debug(err.Message, fields)
    case SeverityMedium:
        eh.logger.Info(err.Message, fields)
    case SeverityHigh:
        eh.logger.Warn(err.Message, fields)
    case SeverityCritical:
        eh.logger.Error(err.Message, fields)
    }
}

func (eh *ErrorHandler) recordErrorMetrics(err *EnterpriseError) {
    tags := map[string]string{
        "error_type":  err.Type.String(),
        "severity":    err.Severity.String(),
        "component":   err.Component,
        "service":     err.Service,
        "retryable":   fmt.Sprintf("%t", err.Retryable),
    }

    // Record error count
    eh.metrics.IncrementCounter(eh.config.MetricsPrefix+"errors_total", tags)

    // Record error by code
    codeTagsCopy := make(map[string]string)
    for k, v := range tags {
        codeTagsCopy[k] = v
    }
    codeTagsCopy["error_code"] = err.Code
    eh.metrics.IncrementCounter(eh.config.MetricsPrefix+"errors_by_code", codeTagsCopy)
}

// captureStackTrace captures the current stack trace
func captureStackTrace() []StackFrame {
    var frames []StackFrame

    // Skip the first few frames (this function and caller)
    for i := 2; i < 20; i++ {
        pc, file, line, ok := runtime.Caller(i)
        if !ok {
            break
        }

        fn := runtime.FuncForPC(pc)
        if fn == nil {
            continue
        }

        frames = append(frames, StackFrame{
            Function: fn.Name(),
            File:     file,
            Line:     line,
        })
    }

    return frames
}

// generateErrorID generates a unique error ID for tracking
func generateErrorID() string {
    return fmt.Sprintf("err_%d_%d", time.Now().UnixNano(), randomInt())
}

// randomInt generates a random integer for ID uniqueness
func randomInt() int64 {
    return time.Now().UnixNano() % 1000000
}

// Helper functions for context extraction
func GetRequestID(ctx context.Context) string {
    if id, ok := ctx.Value("request_id").(string); ok {
        return id
    }
    return ""
}

func GetUserID(ctx context.Context) string {
    if id, ok := ctx.Value("user_id").(string); ok {
        return id
    }
    return ""
}

func GetTraceID(ctx context.Context) string {
    if id, ok := ctx.Value("trace_id").(string); ok {
        return id
    }
    return ""
}

// Example usage demonstrating enterprise error handling patterns
func ExampleUserServiceWithErrorHandling() {
    config := &ErrorHandlerConfig{
        LogLevel:            LogLevelInfo,
        IncludeStackTrace:   true,
        AlertOnSeverity:     SeverityHigh,
        AlertingEnabled:     true,
        RecordMetrics:       true,
        MetricsPrefix:       "user_service_",
    }

    errorHandler := NewErrorHandler(config)

    userService := &UserService{
        errorHandler: errorHandler,
    }

    // Example operation with comprehensive error handling
    ctx := context.Background()
    _, err := userService.CreateUser(ctx, CreateUserRequest{
        Email:    "invalid-email",
        Password: "weak",
    })

    if err != nil {
        // Error is automatically logged, metrics recorded, and alerts sent
        errorHandler.HandleError(ctx, err)
    }
}

package security

import (
    "context"
    "crypto/rand"
    "crypto/subtle"
    "encoding/base64"
    "fmt"
    "golang.org/x/crypto/bcrypt"
    "time"
)

// EnterpriseSecurityFramework provides comprehensive security features
// for enterprise Go applications including authentication, authorization,
// encryption, and audit logging
type EnterpriseSecurityFramework struct {
    // Authentication
    authenticator   *Authenticator
    tokenManager    *TokenManager

    // Authorization
    authorizer      *Authorizer
    rbacManager     *RBACManager

    // Encryption and hashing
    encryptor       *Encryptor
    hasher          *Hasher

    // Security monitoring
    auditLogger     *SecurityAuditLogger
    securityMonitor *SecurityMonitor
    threatDetector  *ThreatDetector

    // Configuration
    config          *SecurityConfig
}

type SecurityConfig struct {
    // Authentication settings
    TokenExpiration      time.Duration
    RefreshTokenTTL      time.Duration
    MaxLoginAttempts     int
    LockoutDuration      time.Duration

    // Password policy
    PasswordPolicy       PasswordPolicy

    // Encryption settings
    EncryptionAlgorithm  string
    KeyRotationInterval  time.Duration

    // Audit settings
    AuditEnabled         bool
    RetainAuditLogs      time.Duration

    // Security monitoring
    EnableThreatDetection bool
    SecurityAlerts        bool
}

type PasswordPolicy struct {
    MinLength            int
    RequireUppercase     bool
    RequireLowercase     bool
    RequireNumbers       bool
    RequireSpecialChars  bool
    PreventReuse         int  // Number of previous passwords to check
    MaxAge              time.Duration
    RequireComplexity    bool
}

// SecurePasswordHasher provides enterprise-grade password hashing
type SecurePasswordHasher struct {
    cost         int
    saltSize     int
    hashFunction HashFunction

    // Security features
    pepperKey    []byte  // Additional secret for PBKDF2
    timingAttack bool    // Protection against timing attacks

    config       *HasherConfig
}

type HashFunction int

const (
    HashFunctionBcrypt HashFunction = iota
    HashFunctionScrypt
    HashFunctionArgon2
    HashFunctionPBKDF2
)

type HasherConfig struct {
    Function     HashFunction
    BcryptCost   int
    ScryptN      int
    ScryptR      int
    ScryptP      int
    Argon2Time   uint32
    Argon2Memory uint32
    Argon2Threads uint8
    SaltSize     int
    PepperKey    []byte
}

func NewSecurePasswordHasher(config *HasherConfig) *SecurePasswordHasher {
    return &SecurePasswordHasher{
        cost:         config.BcryptCost,
        saltSize:     config.SaltSize,
        hashFunction: config.Function,
        pepperKey:    config.PepperKey,
        timingAttack: true,
        config:       config,
    }
}

// HashPassword securely hashes a password with salt and pepper
func (sph *SecurePasswordHasher) HashPassword(password string) (string, error) {
    if password == "" {
        return "", fmt.Errorf("password cannot be empty")
    }

    // Validate password against policy
    if err := sph.validatePasswordPolicy(password); err != nil {
        return "", fmt.Errorf("password policy violation: %w", err)
    }

    switch sph.hashFunction {
    case HashFunctionBcrypt:
        return sph.hashWithBcrypt(password)
    case HashFunctionScrypt:
        return sph.hashWithScrypt(password)
    case HashFunctionArgon2:
        return sph.hashWithArgon2(password)
    case HashFunctionPBKDF2:
        return sph.hashWithPBKDF2(password)
    default:
        return "", fmt.Errorf("unsupported hash function: %v", sph.hashFunction)
    }
}

func (sph *SecurePasswordHasher) hashWithBcrypt(password string) (string, error) {
    // Add pepper if configured
    if len(sph.pepperKey) > 0 {
        password = sph.addPepper(password)
    }

    hash, err := bcrypt.GenerateFromPassword([]byte(password), sph.cost)
    if err != nil {
        return "", fmt.Errorf("bcrypt hashing failed: %w", err)
    }

    return string(hash), nil
}

// VerifyPassword securely verifies a password against its hash
func (sph *SecurePasswordHasher) VerifyPassword(password, hash string) bool {
    // Protection against timing attacks
    if sph.timingAttack {
        defer sph.constantTimeOperation()
    }

    if password == "" || hash == "" {
        return false
    }

    switch sph.hashFunction {
    case HashFunctionBcrypt:
        return sph.verifyBcrypt(password, hash)
    case HashFunctionScrypt:
        return sph.verifyScrypt(password, hash)
    case HashFunctionArgon2:
        return sph.verifyArgon2(password, hash)
    case HashFunctionPBKDF2:
        return sph.verifyPBKDF2(password, hash)
    default:
        return false
    }
}

func (sph *SecurePasswordHasher) verifyBcrypt(password, hash string) bool {
    // Add pepper if configured
    if len(sph.pepperKey) > 0 {
        password = sph.addPepper(password)
    }

    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
    return err == nil
}

func (sph *SecurePasswordHasher) addPepper(password string) string {
    // Combine password with pepper using HMAC or similar
    // This is a simplified implementation
    return password + string(sph.pepperKey)
}

func (sph *SecurePasswordHasher) constantTimeOperation() {
    // Perform a constant-time operation to prevent timing attacks
    dummy := make([]byte, 32)
    rand.Read(dummy)
    bcrypt.GenerateFromPassword(dummy, bcrypt.DefaultCost)
}

func (sph *SecurePasswordHasher) validatePasswordPolicy(password string) error {
    policy := sph.config.PasswordPolicy

    if len(password) < policy.MinLength {
        return fmt.Errorf("password must be at least %d characters", policy.MinLength)
    }

    if policy.RequireUppercase && !containsUppercase(password) {
        return fmt.Errorf("password must contain at least one uppercase letter")
    }

    if policy.RequireLowercase && !containsLowercase(password) {
        return fmt.Errorf("password must contain at least one lowercase letter")
    }

    if policy.RequireNumbers && !containsNumber(password) {
        return fmt.Errorf("password must contain at least one number")
    }

    if policy.RequireSpecialChars && !containsSpecialChar(password) {
        return fmt.Errorf("password must contain at least one special character")
    }

    if policy.RequireComplexity && !meetsComplexityRequirements(password) {
        return fmt.Errorf("password does not meet complexity requirements")
    }

    return nil
}

// Role-Based Access Control (RBAC) implementation
type RBACManager struct {
    // Role and permission storage
    roleStore       RoleStore
    permissionStore PermissionStore

    // Caching for performance
    roleCache       *RoleCache
    permissionCache *PermissionCache

    // Audit logging
    auditLogger     *SecurityAuditLogger

    config          *RBACConfig
}

type Role struct {
    ID          string      `json:"id"`
    Name        string      `json:"name"`
    Description string      `json:"description"`
    Permissions []Permission `json:"permissions"`
    CreatedAt   time.Time   `json:"createdAt"`
    UpdatedAt   time.Time   `json:"updatedAt"`

    // Hierarchical roles
    ParentRoles []string    `json:"parentRoles,omitempty"`
    ChildRoles  []string    `json:"childRoles,omitempty"`

    // Metadata
    Metadata    map[string]interface{} `json:"metadata,omitempty"`
}

type Permission struct {
    ID          string    `json:"id"`
    Resource    string    `json:"resource"`
    Action      string    `json:"action"`
    Conditions  []string  `json:"conditions,omitempty"`
    CreatedAt   time.Time `json:"createdAt"`

    // Scope and constraints
    Scope       string    `json:"scope,omitempty"`
    Constraints map[string]interface{} `json:"constraints,omitempty"`
}

type AuthorizationContext struct {
    UserID      string                 `json:"userId"`
    Roles       []string               `json:"roles"`
    Resource    string                 `json:"resource"`
    Action      string                 `json:"action"`
    Context     map[string]interface{} `json:"context"`
    RequestTime time.Time              `json:"requestTime"`

    // Additional context
    IPAddress   string                 `json:"ipAddress,omitempty"`
    UserAgent   string                 `json:"userAgent,omitempty"`
    SessionID   string                 `json:"sessionId,omitempty"`
}

func NewRBACManager(config *RBACConfig) *RBACManager {
    return &RBACManager{
        roleStore:       NewRoleStore(config.RoleStoreConfig),
        permissionStore: NewPermissionStore(config.PermissionStoreConfig),
        roleCache:       NewRoleCache(config.CacheConfig),
        permissionCache: NewPermissionCache(config.CacheConfig),
        auditLogger:     NewSecurityAuditLogger(config.AuditConfig),
        config:          config,
    }
}

// CheckPermission verifies if a user has permission to perform an action
func (rbac *RBACManager) CheckPermission(ctx context.Context, authCtx *AuthorizationContext) (bool, error) {
    start := time.Now()
    defer func() {
        rbac.auditLogger.LogAuthorizationCheck(authCtx, time.Since(start))
    }()

    // Get user roles
    userRoles, err := rbac.getUserRoles(ctx, authCtx.UserID)
    if err != nil {
        return false, fmt.Errorf("failed to get user roles: %w", err)
    }

    // Check each role for the required permission
    for _, roleName := range userRoles {
        role, err := rbac.getRole(ctx, roleName)
        if err != nil {
            continue // Skip invalid roles
        }

        if rbac.roleHasPermission(role, authCtx) {
            rbac.auditLogger.LogAuthorizationGranted(authCtx, roleName)
            return true, nil
        }
    }

    rbac.auditLogger.LogAuthorizationDenied(authCtx)
    return false, nil
}

func (rbac *RBACManager) roleHasPermission(role *Role, authCtx *AuthorizationContext) bool {
    for _, permission := range role.Permissions {
        if rbac.permissionMatches(permission, authCtx) {
            return true
        }
    }

    // Check parent roles recursively
    for _, parentRoleID := range role.ParentRoles {
        parentRole, err := rbac.getRole(context.Background(), parentRoleID)
        if err != nil {
            continue
        }

        if rbac.roleHasPermission(parentRole, authCtx) {
            return true
        }
    }

    return false
}

func (rbac *RBACManager) permissionMatches(permission Permission, authCtx *AuthorizationContext) bool {
    // Check resource match
    if !rbac.resourceMatches(permission.Resource, authCtx.Resource) {
        return false
    }

    // Check action match
    if !rbac.actionMatches(permission.Action, authCtx.Action) {
        return false
    }

    // Check conditions
    if !rbac.conditionsMatch(permission.Conditions, authCtx) {
        return false
    }

    // Check constraints
    if !rbac.constraintsMatch(permission.Constraints, authCtx) {
        return false
    }

    return true
}

func (rbac *RBACManager) resourceMatches(permissionResource, requestedResource string) bool {
    // Implement resource matching logic (wildcards, patterns, etc.)
    if permissionResource == "*" {
        return true
    }

    if permissionResource == requestedResource {
        return true
    }

    // Check wildcard patterns
    return matchesPattern(permissionResource, requestedResource)
}

func (rbac *RBACManager) actionMatches(permissionAction, requestedAction string) bool {
    // Implement action matching logic
    if permissionAction == "*" {
        return true
    }

    if permissionAction == requestedAction {
        return true
    }

    // Check action hierarchies (e.g., "write" includes "create", "update", "delete")
    return actionIncludes(permissionAction, requestedAction)
}

// Security monitoring and threat detection
type ThreatDetector struct {
    // Anomaly detection
    anomalyDetector     *AnomalyDetector
    patternAnalyzer     *PatternAnalyzer

    // Rule-based detection
    ruleEngine          *SecurityRuleEngine

    // Machine learning models
    mlModels            map[string]MLModel

    // Alert management
    alertManager        *SecurityAlertManager

    config              *ThreatDetectionConfig
}

type SecurityEvent struct {
    ID          string                 `json:"id"`
    Type        SecurityEventType      `json:"type"`
    Severity    ThreatSeverity         `json:"severity"`
    Timestamp   time.Time              `json:"timestamp"`

    // Event details
    UserID      string                 `json:"userId,omitempty"`
    IPAddress   string                 `json:"ipAddress"`
    UserAgent   string                 `json:"userAgent,omitempty"`
    Resource    string                 `json:"resource,omitempty"`
    Action      string                 `json:"action,omitempty"`

    // Context and metadata
    Context     map[string]interface{} `json:"context"`
    Metadata    map[string]interface{} `json:"metadata"`

    // Risk scoring
    RiskScore   float64                `json:"riskScore"`
    Confidence  float64                `json:"confidence"`

    // Response information
    Blocked     bool                   `json:"blocked"`
    Response    string                 `json:"response,omitempty"`
}

type SecurityEventType int

const (
    SecurityEventTypeLoginFailure SecurityEventType = iota
    SecurityEventTypeBruteForce
    SecurityEventTypeUnauthorizedAccess
    SecurityEventTypeSuspiciousActivity
    SecurityEventTypeDataExfiltration
    SecurityEventTypePrivilegeEscalation
    SecurityEventTypeAccountTakeover
    SecurityEventTypeMaliciousPayload
)

type ThreatSeverity int

const (
    ThreatSeverityLow ThreatSeverity = iota
    ThreatSeverityMedium
    ThreatSeverityHigh
    ThreatSeverityCritical
)

func (td *ThreatDetector) AnalyzeSecurityEvent(ctx context.Context, event *SecurityEvent) (*ThreatAssessment, error) {
    assessment := &ThreatAssessment{
        EventID:     event.ID,
        Timestamp:   time.Now(),
        Severity:    ThreatSeverityLow,
        RiskScore:   0.0,
        Confidence:  0.0,
        Indicators:  []ThreatIndicator{},
        Recommendations: []string{},
    }

    // Anomaly detection
    anomalyScore, err := td.anomalyDetector.AnalyzeEvent(ctx, event)
    if err != nil {
        return nil, fmt.Errorf("anomaly detection failed: %w", err)
    }

    if anomalyScore > 0.7 {
        assessment.addIndicator(ThreatIndicator{
            Type:        "anomaly",
            Score:       anomalyScore,
            Description: "Anomalous behavior detected",
        })
    }

    // Pattern analysis
    patterns, err := td.patternAnalyzer.AnalyzePatterns(ctx, event)
    if err != nil {
        return nil, fmt.Errorf("pattern analysis failed: %w", err)
    }

    for _, pattern := range patterns {
        if pattern.Score > 0.6 {
            assessment.addIndicator(ThreatIndicator{
                Type:        "pattern",
                Score:       pattern.Score,
                Description: pattern.Description,
            })
        }
    }

    // Rule-based detection
    ruleMatches, err := td.ruleEngine.EvaluateRules(ctx, event)
    if err != nil {
        return nil, fmt.Errorf("rule evaluation failed: %w", err)
    }

    for _, match := range ruleMatches {
        assessment.addIndicator(ThreatIndicator{
            Type:        "rule",
            Score:       match.Confidence,
            Description: match.RuleName,
        })
    }

    // Calculate overall assessment
    assessment.calculateFinalScore()

    // Generate recommendations
    assessment.generateRecommendations()

    return assessment, nil
}

type ThreatAssessment struct {
    EventID         string             `json:"eventId"`
    Timestamp       time.Time          `json:"timestamp"`
    Severity        ThreatSeverity     `json:"severity"`
    RiskScore       float64            `json:"riskScore"`
    Confidence      float64            `json:"confidence"`
    Indicators      []ThreatIndicator  `json:"indicators"`
    Recommendations []string           `json:"recommendations"`
    ActionRequired  bool               `json:"actionRequired"`
}

type ThreatIndicator struct {
    Type        string  `json:"type"`
    Score       float64 `json:"score"`
    Description string  `json:"description"`
    Evidence    string  `json:"evidence,omitempty"`
}

func (ta *ThreatAssessment) addIndicator(indicator ThreatIndicator) {
    ta.Indicators = append(ta.Indicators, indicator)
}

func (ta *ThreatAssessment) calculateFinalScore() {
    var totalScore float64
    var maxScore float64

    for _, indicator := range ta.Indicators {
        totalScore += indicator.Score
        if indicator.Score > maxScore {
            maxScore = indicator.Score
        }
    }

    // Use weighted average with emphasis on highest score
    if len(ta.Indicators) > 0 {
        avgScore := totalScore / float64(len(ta.Indicators))
        ta.RiskScore = (avgScore + maxScore) / 2.0
        ta.Confidence = maxScore
    }

    // Determine severity based on risk score
    switch {
    case ta.RiskScore >= 0.9:
        ta.Severity = ThreatSeverityCritical
        ta.ActionRequired = true
    case ta.RiskScore >= 0.7:
        ta.Severity = ThreatSeverityHigh
        ta.ActionRequired = true
    case ta.RiskScore >= 0.4:
        ta.Severity = ThreatSeverityMedium
    default:
        ta.Severity = ThreatSeverityLow
    }
}

func (ta *ThreatAssessment) generateRecommendations() {
    if ta.RiskScore >= 0.9 {
        ta.Recommendations = append(ta.Recommendations, "Immediately block user account")
        ta.Recommendations = append(ta.Recommendations, "Escalate to security team")
        ta.Recommendations = append(ta.Recommendations, "Review all recent user activity")
    } else if ta.RiskScore >= 0.7 {
        ta.Recommendations = append(ta.Recommendations, "Require additional authentication")
        ta.Recommendations = append(ta.Recommendations, "Monitor user activity closely")
        ta.Recommendations = append(ta.Recommendations, "Consider temporary restrictions")
    } else if ta.RiskScore >= 0.4 {
        ta.Recommendations = append(ta.Recommendations, "Log event for analysis")
        ta.Recommendations = append(ta.Recommendations, "Continue monitoring")
    }
}

// Helper functions for security utilities

func containsUppercase(s string) bool {
    for _, r := range s {
        if r >= 'A' && r <= 'Z' {
            return true
        }
    }
    return false
}

func containsLowercase(s string) bool {
    for _, r := range s {
        if r >= 'a' && r <= 'z' {
            return true
        }
    }
    return false
}

func containsNumber(s string) bool {
    for _, r := range s {
        if r >= '0' && r <= '9' {
            return true
        }
    }
    return false
}

func containsSpecialChar(s string) bool {
    specialChars := "!@#$%^&*()_+-=[]{}|;:,.<>?"
    for _, r := range s {
        for _, special := range specialChars {
            if r == special {
                return true
            }
        }
    }
    return false
}

func meetsComplexityRequirements(password string) bool {
    // Implement additional complexity checks
    // Example: check for common patterns, dictionary words, etc.
    return len(password) >= 12 && containsUppercase(password) &&
           containsLowercase(password) && containsNumber(password) &&
           containsSpecialChar(password)
}

func matchesPattern(pattern, resource string) bool {
    // Implement pattern matching logic for resources
    // This is a simplified implementation
    return false
}

func actionIncludes(permissionAction, requestedAction string) bool {
    // Implement action hierarchy logic
    actionHierarchy := map[string][]string{
        "write": {"create", "update", "delete"},
        "read":  {"view", "list"},
        "admin": {"read", "write", "delete", "manage"},
    }

    if actions, exists := actionHierarchy[permissionAction]; exists {
        for _, action := range actions {
            if action == requestedAction {
                return true
            }
        }
    }

    return false
}