//+------------------------------------------------------------------+
//|                                              SecurityManager.mqh  |
//|                                          Copyright 2025, EscapeEA |
//|                                             https://www.escapeea.com |
//+------------------------------------------------------------------+
#property copyright "Copyright 2025, EscapeEA"
#property link      "https://www.escapeea.com"
#property version   "1.10"  // Added rate limiting and enhanced error handling
#property strict

#include <Trade\AccountInfo.mqh>
#include <Trade\SymbolInfo.mqh>
#include "SecureMemory.mqh"
#include "InputValidation.mqh"

// Security event categories
enum ENUM_SECURITY_EVENT_CATEGORY {
   SECURITY_CATEGORY_AUTH,      // Authentication/Authorization
   SECURITY_CATEGORY_TRADE,     // Trading operations
   SECURITY_CATEGORY_FILE,      // File operations
   SECURITY_CATEGORY_NETWORK,   // Network operations
   SECURITY_CATEGORY_SYSTEM     // System operations
};

//--- Security levels
enum ENUM_SECURITY_LEVEL {
   SECURITY_LEVEL_CRITICAL = 0,  // Critical security issue - stop trading
   SECURITY_LEVEL_HIGH = 1,      // High risk - log and potentially block
   SECURITY_LEVEL_MEDIUM = 2,    // Medium risk - log and warn
   SECURITY_LEVEL_LOW = 3,       // Low risk - log only
   SECURITY_LEVEL_INFO = 4,      // Informational messages
   SECURITY_LEVEL_DEBUG = 5      // Debug information
};

// Alias for backward compatibility
#define SECURITY_LEVEL_INFO SECURITY_LEVEL_DEBUG

//--- Security event structure
struct SSecurityEvent {
   datetime          time;          // Time of the event
   string            source;        // Source of the event
   string            message;       // Event message
   ENUM_SECURITY_LEVEL level;       // Security level
   ENUM_SECURITY_EVENT_CATEGORY category; // Event category
   int               errorCode;     // Error code if any
   string            details;       // Additional details
};

//+------------------------------------------------------------------+
//| Security Manager class                                           |
//+------------------------------------------------------------------+
class CSecurityManager {
private:
   CAccountInfo      m_account;      // Account info
   CSymbolInfo       m_symbol;       // Symbol info
   
   // Security settings
   bool              m_enableDllImportCheck;  // Check for unauthorized DLL imports
   bool              m_enableEnvironmentCheck; // Check environment integrity
   bool              m_enableTradeValidation; // Validate trades before execution
   
   // Internal state
   bool              m_isInitialized;
   string            m_logFilePath;
   
   // Prevent copying
   CSecurityManager(const CSecurityManager&);
   void operator=(const CSecurityManager&);
   
   // Private constructor for singleton pattern
   CSecurityManager() : m_isInitialized(false) {}
   
   // Rate limiting for security events
   struct RateLimitEntry {
      int      count;
      datetime lastReset;
      int      maxEvents;
      int      timeWindow;  // in seconds
   };
   
   RateLimitEntry m_rateLimits[];
   
   // Initialize rate limits
   void InitializeRateLimits() {
      // Default rate limits (events per minute)
      ArrayResize(m_rateLimits, 3);
      
      // Critical events (10 per hour)
      m_rateLimits[0].count = 0;
      m_rateLimits[0].lastReset = TimeCurrent();
      m_rateLimits[0].maxEvents = 10;
      m_rateLimits[0].timeWindow = 3600;  // 1 hour
      
      // High priority events (30 per hour)
      m_rateLimits[1].count = 0;
      m_rateLimits[1].lastReset = TimeCurrent();
      m_rateLimits[1].maxEvents = 30;
      m_rateLimits[1].timeWindow = 3600;  // 1 hour
      
      // Normal events (100 per hour)
      m_rateLimits[2].count = 0;
      m_rateLimits[2].lastReset = TimeCurrent();
      m_rateLimits[2].maxEvents = 100;
      m_rateLimits[2].timeWindow = 3600;  // 1 hour
   }
   
   // Check if event should be logged based on rate limiting
   bool CheckRateLimit(ENUM_SECURITY_LEVEL level) {
      int index = 2; // Default to normal events
      
      if(level == SECURITY_LEVEL_CRITICAL) index = 0;
      else if(level == SECURITY_LEVEL_HIGH) index = 1;
      
      if(index < 0 || index >= ArraySize(m_rateLimits)) return true;
      
      datetime currentTime = TimeCurrent();
      if(currentTime - m_rateLimits[index].lastReset > m_rateLimits[index].timeWindow) {
         m_rateLimits[index].count = 0;
         m_rateLimits[index].lastReset = currentTime;
      }
      
      if(m_rateLimits[index].count >= m_rateLimits[index].maxEvents) {
         return false;
      }
      
      m_rateLimits[index].count++;
      return true;
   }
   
   // Log security event to file with rate limiting
   void LogSecurityEvent(const SSecurityEvent &event) {
      // Skip logging if rate limit exceeded (except for critical events)
      if(event.level > SECURITY_LEVEL_CRITICAL && !CheckRateLimit(event.level)) {
         return;
      }
      
      string levelText;
      switch(event.level) {
         case SECURITY_LEVEL_CRITICAL: levelText = "CRITICAL"; break;
         case SECURITY_LEVEL_HIGH:     levelText = "HIGH    "; break;
         case SECURITY_LEVEL_MEDIUM:   levelText = "MEDIUM  "; break;
         case SECURITY_LEVEL_LOW:      levelText = "LOW     "; break;
         case SECURITY_LEVEL_DEBUG:    levelText = "DEBUG   "; break;
         default:                      levelText = "UNKNOWN "; break;
      }
      
      string categoryText;
      switch(event.category) {
         case SECURITY_CATEGORY_AUTH:    categoryText = "AUTH    "; break;
         case SECURITY_CATEGORY_TRADE:   categoryText = "TRADE   "; break;
         case SECURITY_CATEGORY_FILE:    categoryText = "FILE    "; break;
         case SECURITY_CATEGORY_NETWORK: categoryText = "NETWORK "; break;
         case SECURITY_CATEGORY_SYSTEM:  categoryText = "SYSTEM  "; break;
         default:                        categoryText = "UNKNOWN "; break;
      }
      
      string logEntry = StringFormat("[%s] [%s] [%s] %s: %s (Code: %d, Details: %s)",
                                   TimeToString(event.time, TIME_DATE|TIME_SECONDS|TIME_MINUTES|TIME_SECONDS),
                                   levelText,
                                   categoryText,
                                   event.source,
                                   event.message,
                                   event.errorCode,
                                   event.details);
      
      // Print to journal with appropriate verbosity
      if(event.level <= SECURITY_LEVEL_MEDIUM) {
         Print(logEntry);
      }
      
      // Always log to file if path is set
      if(m_logFilePath != "") {
         int fileHandle = FileOpen(m_logFilePath, FILE_READ|FILE_WRITE|FILE_TXT|FILE_ANSI);
         if(fileHandle != INVALID_HANDLE) {
            FileSeek(fileHandle, 0, SEEK_END);
            FileWriteString(fileHandle, logEntry + "\n");
            FileFlush(fileHandle);
            FileClose(fileHandle);
         } else {
            // If we can't log to file, at least print to journal
            Print("Failed to write to security log: ", GetLastError());
         }
      }
   }
   
public:
   // Get singleton instance
   static CSecurityManager* Instance() {
      static CSecurityManager instance;
      return &instance;
   }
   
   // Initialize security manager
   bool Initialize(const string symbol = "", const string logPath = "") {
      if(m_isInitialized) return true;
      
      // Set up logging with validation
      if(logPath != "") {
         if(!ExtInputValidator.IsValidFilePath(logPath)) {
            Print("Invalid log file path: ", logPath);
            return false;
         }
         m_logFilePath = logPath;
      }
      
      // Initialize rate limits
      InitializeRateLimits();
      
      // Initialize account and symbol info
      if(symbol != "") {
         if(!m_symbol.Name(symbol)) {
            Print("Failed to set symbol for security manager");
            return false;
         }
      }
      
      // Enable all security checks by default
      m_enableDllImportCheck = true;
      m_enableEnvironmentCheck = true;
      m_enableTradeValidation = true;
      
      m_isInitialized = true;
      return true;
   }
   
   // Validate the trading environment
   bool ValidateEnvironment() {
      bool isValid = true;
      int errorCode = 0;
      
      // 1. Check if terminal is allowed to trade
      if(!TerminalInfoInteger(TERMINAL_TRADE_ALLOWED)) {
         errorCode = GetLastError();
         LogEvent(SECURITY_LEVEL_CRITICAL, SECURITY_CATEGORY_TRADE, 
                 "Environment", "AutoTrading is disabled in terminal settings",
                 errorCode, "Trading operations will be blocked");
         isValid = false;
      }
      
      // 2. Check if DLL imports are allowed
      if(TerminalInfoInteger(TERMINAL_DLLS_ALLOWED) == 0) {
         LogEvent(SECURITY_LEVEL_HIGH, SECURITY_CATEGORY_SYSTEM,
                 "Environment", "DLL imports are disabled in terminal settings",
                 0, "Some functionality may be limited");
      }
      
      // 3. Check if file operations are allowed
      if(TerminalInfoInteger(TERMINAL_CODEPAGE) == 0) {
         LogEvent(SECURITY_LEVEL_MEDIUM, SECURITY_CATEGORY_FILE,
                 "Environment", "File operations may be restricted",
                 0, "Check terminal permissions");
      }
      
      // 4. Check for terminal updates
      if(!TerminalInfoInteger(TERMINAL_CONNECTED)) {
         LogEvent(SECURITY_LEVEL_MEDIUM, SECURITY_CATEGORY_NETWORK,
                 "Environment", "Terminal is not connected to the internet",
                 0, "Some features may not work as expected");
      }
      
      // 5. Check for running in strategy tester
      if(MQLInfoInteger(MQL_TESTER)) {
         LogEvent(SECURITY_LEVEL_DEBUG, SECURITY_CATEGORY_SYSTEM,
                 "Environment", "Running in Strategy Tester",
                 0, "Some security checks may be bypassed");
      }
      
      // 6. Check for running in visual mode
      if(MQLInfoInteger(MQL_VISUAL_MODE)) {
         LogEvent(SECURITY_LEVEL_DEBUG, SECURITY_CATEGORY_SYSTEM,
                 "Environment", "Running in visual mode",
                 0, "Performance may be affected");
      }
      
      // 7. Check for sufficient permissions
      if(!TerminalInfoInteger(TERMINAL_TRADE_ALLOWED)) {
         errorCode = GetLastError();
         LogEvent(SECURITY_LEVEL_CRITICAL, SECURITY_CATEGORY_AUTH,
                 "Permissions", "Insufficient trading permissions",
                 errorCode, "Check terminal settings and account permissions");
         isValid = false;
      }
      
      // 8. Check for account permissions
      if(!AccountInfoInteger(ACCOUNT_TRADE_ALLOWED)) {
         errorCode = GetLastError();
         LogEvent(SECURITY_LEVEL_CRITICAL, SECURITY_CATEGORY_AUTH,
                 "Account", "Trading is not allowed for this account",
                 errorCode, "Check account settings");
         isValid = false;
      }
      
      // 9. Check for demo account if required
      if(AccountInfoInteger(ACCOUNT_TRADE_MODE) == ACCOUNT_TRADE_MODE_DEMO) {
         LogEvent(SECURITY_LEVEL_INFO, SECURITY_CATEGORY_TRADE,
                 "Account", "Running on demo account",
                 0, "No real funds are at risk");
      }
      
      // 10. Log environment summary
      if(isValid) {
         LogEvent(SECURITY_LEVEL_DEBUG, SECURITY_CATEGORY_SYSTEM,
                 "Environment", "Environment validation passed",
                 0, "All required permissions and settings are valid");
      } else {
         LogEvent(SECURITY_LEVEL_CRITICAL, SECURITY_CATEGORY_SYSTEM,
                 "Environment", "Environment validation failed",
                 0, "See previous messages for details");
      }
      
      // Check if symbol is selected and valid
      if(m_symbol.Name() != "") {
         // Use the correct Select method signature for CSymbolInfo
         if(!m_symbol.Name(m_symbol.Name())) {
            SSecurityEvent event = {0};
            event.time = TimeCurrent();
            event.source = "Symbol";
            event.message = "Failed to select symbol: " + m_symbol.Name();
            event.level = SECURITY_LEVEL_CRITICAL;
            event.errorCode = GetLastError();
            LogSecurityEvent(event);
            isValid = false;
         } else {
            // Update symbol rates and refresh after selection
            m_symbol.RefreshRates();
         }
      }
      
      return isValid;
   }
   
   // Get current security level
   ENUM_SECURITY_LEVEL GetSecurityLevel() {
      // Default to high security level
      ENUM_SECURITY_LEVEL level = SECURITY_LEVEL_LOW;
      
      // Check for critical issues first
      if(!TerminalInfoInteger(TERMINAL_TRADE_ALLOWED) || !m_account.TradeAllowed()) {
         return SECURITY_LEVEL_CRITICAL;
      }
      
      // Check for high-priority issues
      if(!TerminalInfoInteger(TERMINAL_DLLS_ALLOWED) && m_enableDllImportCheck) {
         level = (ENUM_SECURITY_LEVEL)MathMin(level, SECURITY_LEVEL_HIGH);
      }
      
      // Add more checks as needed
      
      return level;
   }
   
   // Log a security event with category and details
   void LogEvent(ENUM_SECURITY_LEVEL level, ENUM_SECURITY_EVENT_CATEGORY category, 
                const string source, const string message, 
                int errorCode = 0, const string details = "") {
      SSecurityEvent event = {0};
      event.time = TimeCurrent();
      event.source = source;
      event.message = message;
      event.level = level;
      event.category = category;
      event.errorCode = errorCode;
      event.details = details;
      LogSecurityEvent(event);
   }
   
   // Clean up resources
   void Shutdown() {
      m_isInitialized = false;
   }
   
   // Destructor
   ~CSecurityManager() {
      Shutdown();
   }
};

// Global instance
CSecurityManager* ExtSecurity = NULL;