# Your team's daily development horror story
# Developer 1: "It works on my machine!"
$ npm start
Error: Cannot find module 'some-dependency'
# Spent 2 hours figuring out they have a different Node.js version

# Developer 2: "The API isn't responding"
$ curl http://localhost:3000/api/health
curl: (7) Failed to connect to localhost port 3000: Connection refused
# Database isn't running, no clear way to start all services together

# Developer 3: "I can't reproduce the bug"
console.log("DEBUG: User data:", userData);
// Debugging with console.log in production code
// No proper debugging setup, no environment isolation

# Developer 4: "My tests are failing but CI passes"
$ npm test
❌ 15 tests failing due to different environment variables
# No consistent way to manage dev/staging/prod configurations

# New developer: "How do I set this up?"
README.md: "Install dependencies and run npm start"
# 3 days later, still fighting environment setup issues
# No documented local development workflow
# No automated environment provisioning
# No standardized tooling across the team

# The productivity killers that compound daily:
# - Each developer has a different setup causing inconsistent behavior
# - No unified way to manage environment variables across environments
# - Debugging requires adding/removing console.log statements
# - Configuration drift between dev/staging/prod environments
# - New team members take weeks to get productive
# - Time wasted on environment issues instead of building features

// What happens when development environments are neglected:
const developmentEnvironmentFailureImpact = {
  teamProductivity: {
    problem: "Engineering team spends 40% of time on environment issues",
    cause: "No standardized local development setup or tooling",
    impact: "Feature delivery drops 60%, team constantly frustrated",
    cost: "$50K/month in lost productivity for 10-person team",
  },

  productionIncidents: {
    problem: "Configuration mismatch causes data corruption in production",
    cause: "Environment variables managed differently across environments",
    impact: "4-hour outage, manual data recovery required",
    prevention:
      "Proper configuration management would have cost $2K to implement",
  },

  developerExperience: {
    problem: "Senior developers leave citing 'terrible development experience'",
    cause: "Hours wasted daily on tooling issues, inconsistent environments",
    impact: "6-month hiring process, knowledge drain, team morale collapse",
    reality: "Great developers won't tolerate bad development environments",
  },

  // Perfect code quality is worthless when your team can't
  // develop efficiently due to environment chaos
};

# ❌ The chaotic development setup that destroys productivity
# Each developer's machine is a unique snowflake of configuration

# Developer A's machine:
$ node --version
v16.14.0
$ npm --version
8.3.1
$ which python
/usr/bin/python2.7

# Developer B's machine:
$ node --version
v18.12.1
$ npm --version
9.1.2
$ which python
/opt/homebrew/bin/python3.9

# Developer C's machine:
$ node --version
v20.5.0
$ npm --version
10.2.4
$ python --version
Python 3.11.2

# The inevitable result:
# - Different Node.js versions cause dependency conflicts
# - Different Python versions break build scripts
# - Different package manager versions create lockfile conflicts
# - Database versions differ, causing schema inconsistencies
# - Environment variables stored in random places
# - Services started manually in random order
# - No one knows what services are required for what features

# ✅ Standardized development environment that eliminates variability

# Project structure for development environment management
project-root/
├── .devcontainer/                 # VS Code dev containers
│   ├── devcontainer.json
│   ├── Dockerfile
│   └── docker-compose.yml
├── .envrc                        # direnv configuration
├── .node-version                 # Node.js version specification
├── .python-version               # Python version specification
├── docker-compose.dev.yml        # Local development services
├── scripts/
│   ├── setup-dev-env.sh         # Environment setup automation
│   ├── start-services.sh        # Service orchestration
│   ├── reset-db.sh              # Database reset automation
│   └── health-check.sh          # Environment health validation
├── docs/
│   ├── DEVELOPMENT.md           # Comprehensive setup guide
│   └── DEBUGGING.md             # Debugging workflows
└── .env.example                 # Template for environment variables

# Automated development environment setup
#!/bin/bash
# scripts/setup-dev-env.sh - One command to rule them all

set -euo pipefail

echo "🚀 Setting up development environment..."

# Check for required system dependencies
check_system_dependencies() {
    local deps=("docker" "docker-compose" "git" "curl")

    for dep in "${deps[@]}"; do
        if ! command -v "$dep" &> /dev/null; then
            echo "❌ $dep is required but not installed."
            echo "Please install $dep and run this script again."
            exit 1
        fi
    done

    echo "✅ System dependencies verified"
}

# Install and configure development tools
install_dev_tools() {
    # Install asdf for version management
    if [ ! -d "$HOME/.asdf" ]; then
        echo "📦 Installing asdf version manager..."
        git clone https://github.com/asdf-vm/asdf.git ~/.asdf
        echo '. $HOME/.asdf/asdf.sh' >> ~/.bashrc
        echo '. $HOME/.asdf/completions/asdf.bash' >> ~/.bashrc
        source ~/.asdf/asdf.sh
    fi

    # Install language plugins
    asdf plugin add nodejs || true
    asdf plugin add python || true
    asdf plugin add postgres || true
    asdf plugin add redis || true

    echo "✅ Development tools configured"
}

# Install exact versions specified in project
install_language_versions() {
    if [ -f ".tool-versions" ]; then
        echo "📋 Installing specified language versions..."
        asdf install
        echo "✅ Language versions installed"
    fi
}

# Set up local services
setup_local_services() {
    echo "🐳 Starting local development services..."

    # Create necessary networks
    docker network create dev-network 2>/dev/null || true

    # Start services in background
    docker-compose -f docker-compose.dev.yml up -d

    echo "⏳ Waiting for services to be ready..."
    ./scripts/health-check.sh

    echo "✅ Local services are running"
}

# Configure environment variables
setup_environment_variables() {
    if [ ! -f ".env.local" ]; then
        echo "⚙️  Setting up environment variables..."
        cp .env.example .env.local

        # Generate secure random values for development
        sed -i.bak "s/YOUR_JWT_SECRET/$(openssl rand -base64 32)/" .env.local
        sed -i.bak "s/YOUR_SESSION_SECRET/$(openssl rand -base64 32)/" .env.local
        sed -i.bak "s/YOUR_ENCRYPTION_KEY/$(openssl rand -base64 32)/" .env.local

        rm .env.local.bak

        echo "✅ Environment variables configured"
        echo "📝 Please review .env.local and update any values as needed"
    fi
}

# Initialize database with seed data
setup_database() {
    echo "🗄️  Setting up development database..."

    # Wait for database to be ready
    timeout 60 bash -c 'until docker-compose -f docker-compose.dev.yml exec postgres pg_isready -U postgres; do sleep 2; done'

    # Run migrations
    npm run db:migrate

    # Seed development data
    npm run db:seed

    echo "✅ Database setup complete"
}

# Install project dependencies
install_dependencies() {
    echo "📦 Installing project dependencies..."

    # Install exact versions from lockfile
    npm ci

    # Install development-only dependencies
    npm run install:dev-tools

    echo "✅ Dependencies installed"
}

# Verify everything is working
verify_setup() {
    echo "🔍 Verifying development environment..."

    # Run health checks
    ./scripts/health-check.sh

    # Run a quick test
    npm run test:smoke

    # Check linting and formatting
    npm run lint:check
    npm run format:check

    echo "✅ Environment verification complete"
}

# Print success message with next steps
print_success() {
    echo ""
    echo "🎉 Development environment setup complete!"
    echo ""
    echo "Next steps:"
    echo "  1. Review .env.local for any values you need to customize"
    echo "  2. Run 'npm run dev' to start the development server"
    echo "  3. Visit http://localhost:3000 to see your application"
    echo "  4. Run 'npm test' to execute the test suite"
    echo ""
    echo "Useful commands:"
    echo "  - npm run dev          # Start development server with hot reload"
    echo "  - npm run db:reset     # Reset database to clean state"
    echo "  - npm run services     # View status of all local services"
    echo "  - npm run logs         # View aggregated logs from all services"
    echo "  - npm run debug        # Start application in debug mode"
    echo ""
    echo "Documentation:"
    echo "  - docs/DEVELOPMENT.md  # Detailed development guide"
    echo "  - docs/DEBUGGING.md    # Debugging workflows and tips"
    echo ""
}

# Execute setup steps
main() {
    check_system_dependencies
    install_dev_tools
    install_language_versions
    setup_environment_variables
    setup_local_services
    setup_database
    install_dependencies
    verify_setup
    print_success
}

# Run with error handling
if ! main "$@"; then
    echo "❌ Setup failed. Check the output above for errors."
    echo "💬 Need help? Check docs/DEVELOPMENT.md or ask the team."
    exit 1
fi

# docker-compose.dev.yml - Comprehensive local development services
version: "3.8"

services:
  # PostgreSQL database with development optimizations
  postgres:
    image: postgres:15-alpine
    container_name: dev-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: myapp_development
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: dev_password
      # Development optimizations
      POSTGRES_INITDB_ARGS: "--auth-host=trust"
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./database/init:/docker-entrypoint-initdb.d
    networks:
      - dev-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis for caching and session storage
  redis:
    image: redis:7-alpine
    container_name: dev-redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
      - ./redis/redis.dev.conf:/usr/local/etc/redis/redis.conf
    networks:
      - dev-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  # Elasticsearch for search functionality
  elasticsearch:
    image: elasticsearch:8.8.0
    container_name: dev-elasticsearch
    restart: unless-stopped
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx1g"
    ports:
      - "9200:9200"
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    networks:
      - dev-network
    healthcheck:
      test:
        ["CMD-SHELL", "curl -f http://localhost:9200/_cluster/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  # MinIO for S3-compatible object storage
  minio:
    image: minio/minio:latest
    container_name: dev-minio
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9000:9000"
      - "9001:9001" # Console
    volumes:
      - minio_data:/data
    networks:
      - dev-network
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3

  # RabbitMQ for message queuing
  rabbitmq:
    image: rabbitmq:3-management-alpine
    container_name: dev-rabbitmq
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: admin
      RABBITMQ_DEFAULT_PASS: admin
    ports:
      - "5672:5672" # AMQP
      - "15672:15672" # Management UI
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    networks:
      - dev-network
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5

  # Jaeger for distributed tracing
  jaeger:
    image: jaegertracing/all-in-one:1.45
    container_name: dev-jaeger
    restart: unless-stopped
    environment:
      COLLECTOR_OTLP_ENABLED: true
    ports:
      - "16686:16686" # Jaeger UI
      - "14268:14268" # HTTP collector
      - "6831:6831/udp" # UDP collector
    networks:
      - dev-network

  # Prometheus for metrics collection
  prometheus:
    image: prom/prometheus:latest
    container_name: dev-prometheus
    restart: unless-stopped
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.dev.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    networks:
      - dev-network
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
      - "--web.console.templates=/usr/share/prometheus/consoles"
      - "--web.enable-lifecycle"

  # Grafana for metrics visualization
  grafana:
    image: grafana/grafana:latest
    container_name: dev-grafana
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_PASSWORD: admin
    ports:
      - "3001:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning
    networks:
      - dev-network

  # MailHog for email testing
  mailhog:
    image: mailhog/mailhog:latest
    container_name: dev-mailhog
    restart: unless-stopped
    ports:
      - "1025:1025" # SMTP
      - "8025:8025" # Web UI
    networks:
      - dev-network

networks:
  dev-network:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  elasticsearch_data:
  minio_data:
  rabbitmq_data:
  prometheus_data:
  grafana_data:

#!/bin/bash
# scripts/health-check.sh - Comprehensive service health verification

set -euo pipefail

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Service health check configurations
declare -A HEALTH_CHECKS
HEALTH_CHECKS[postgres]="pg_isready -h localhost -p 5432 -U postgres"
HEALTH_CHECKS[redis]="redis-cli -h localhost -p 6379 ping"
HEALTH_CHECKS[elasticsearch]="curl -s -f http://localhost:9200/_cluster/health"
HEALTH_CHECKS[minio]="curl -s -f http://localhost:9000/minio/health/live"
HEALTH_CHECKS[rabbitmq]="curl -s -f http://localhost:15672/api/overview -u admin:admin"

# Check individual service health
check_service() {
    local service=$1
    local check_command=${HEALTH_CHECKS[$service]}
    local max_attempts=30
    local attempt=1

    echo -n "Checking $service health..."

    while [ $attempt -le $max_attempts ]; do
        if eval "$check_command" &>/dev/null; then
            echo -e " ${GREEN}✅ Healthy${NC}"
            return 0
        fi

        echo -n "."
        sleep 2
        ((attempt++))
    done

    echo -e " ${RED}❌ Failed${NC}"
    return 1
}

# Check database connectivity and schema
check_database_schema() {
    echo -n "Checking database schema..."

    if npm run db:status &>/dev/null; then
        echo -e " ${GREEN}✅ Schema up to date${NC}"
        return 0
    else
        echo -e " ${YELLOW}⚠️  Schema needs migration${NC}"
        echo "Run 'npm run db:migrate' to update schema"
        return 1
    fi
}

# Check environment variables
check_environment_variables() {
    echo -n "Checking environment variables..."

    local required_vars=(
        "DATABASE_URL"
        "REDIS_URL"
        "JWT_SECRET"
        "SESSION_SECRET"
    )

    local missing_vars=()

    for var in "${required_vars[@]}"; do
        if [ -z "${!var:-}" ]; then
            missing_vars+=("$var")
        fi
    done

    if [ ${#missing_vars[@]} -eq 0 ]; then
        echo -e " ${GREEN}✅ All required variables set${NC}"
        return 0
    else
        echo -e " ${RED}❌ Missing variables: ${missing_vars[*]}${NC}"
        return 1
    fi
}

# Check application endpoints
check_application_endpoints() {
    echo -n "Checking application endpoints..."

    local endpoints=(
        "http://localhost:3000/health"
        "http://localhost:3000/api/health"
    )

    for endpoint in "${endpoints[@]}"; do
        if ! curl -s -f "$endpoint" &>/dev/null; then
            echo -e " ${YELLOW}⚠️  Application not running${NC}"
            echo "Start with 'npm run dev'"
            return 1
        fi
    done

    echo -e " ${GREEN}✅ Application responding${NC}"
    return 0
}

# Display service status summary
display_service_status() {
    echo ""
    echo "🔍 Service Status Summary:"
    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━"

    echo "Core Services:"
    docker-compose -f docker-compose.dev.yml ps --format "table {{.Name}}\t{{.Status}}\t{{.Ports}}"

    echo ""
    echo "Service URLs:"
    echo "  📊 Grafana Dashboard:   http://localhost:3001 (admin/admin)"
    echo "  📈 Prometheus Metrics:  http://localhost:9090"
    echo "  🔍 Jaeger Tracing:      http://localhost:16686"
    echo "  📧 MailHog (Email):     http://localhost:8025"
    echo "  📊 RabbitMQ Management: http://localhost:15672 (admin/admin)"
    echo "  🗄️  MinIO Console:       http://localhost:9001 (minioadmin/minioadmin)"

    if curl -s -f http://localhost:3000/health &>/dev/null; then
        echo "  🚀 Application:         http://localhost:3000"
    fi
}

# Main health check execution
main() {
    echo "🏥 Running development environment health checks..."
    echo ""

    # Source environment variables
    if [ -f ".env.local" ]; then
        set -a
        source .env.local
        set +a
    fi

    local failed_checks=0

    # Check each service
    for service in "${!HEALTH_CHECKS[@]}"; do
        if ! check_service "$service"; then
            ((failed_checks++))
        fi
    done

    # Check additional components
    if ! check_environment_variables; then
        ((failed_checks++))
    fi

    if ! check_database_schema; then
        ((failed_checks++))
    fi

    # Check application if it's expected to be running
    if [ "${1:-}" != "--services-only" ]; then
        check_application_endpoints || true  # Don't fail if app isn't running
    fi

    echo ""

    if [ $failed_checks -eq 0 ]; then
        echo -e "${GREEN}✅ All health checks passed!${NC}"
        display_service_status
        return 0
    else
        echo -e "${RED}❌ $failed_checks health check(s) failed${NC}"
        echo ""
        echo "Troubleshooting:"
        echo "  1. Ensure Docker is running"
        echo "  2. Run 'docker-compose -f docker-compose.dev.yml up -d'"
        echo "  3. Check service logs: 'docker-compose -f docker-compose.dev.yml logs [service]'"
        echo "  4. Reset environment: './scripts/reset-dev-env.sh'"
        return 1
    fi
}

# Execute health checks
main "$@"

// ✅ Professional configuration management with environment isolation
class EnvironmentManager {
  constructor() {
    this.environment = process.env.NODE_ENV || "development";
    this.configs = new Map();
    this.secrets = new Map();

    this.loadConfiguration();
    this.validateConfiguration();
  }

  loadConfiguration() {
    // Load base configuration
    const baseConfig = this.loadConfigFile("config/base.js");

    // Load environment-specific configuration
    const envConfig = this.loadConfigFile(`config/${this.environment}.js`);

    // Load local overrides (for development)
    const localConfig = this.loadConfigFile("config/local.js", true);

    // Merge configurations with proper precedence
    this.config = this.deepMerge(baseConfig, envConfig, localConfig || {});

    // Load and decrypt secrets
    this.loadSecrets();
  }

  loadConfigFile(filePath, optional = false) {
    try {
      const fullPath = path.resolve(process.cwd(), filePath);

      if (!fs.existsSync(fullPath)) {
        if (optional) return null;
        throw new Error(`Configuration file not found: ${filePath}`);
      }

      // Use dynamic import for ES modules or require for CommonJS
      const config = require(fullPath);
      return typeof config === "function" ? config() : config;
    } catch (error) {
      if (optional) return null;
      throw new Error(
        `Failed to load configuration from ${filePath}: ${error.message}`
      );
    }
  }

  loadSecrets() {
    const secretsPath = process.env.SECRETS_PATH || ".env";

    if (fs.existsSync(secretsPath)) {
      const secrets = dotenv.parse(fs.readFileSync(secretsPath));

      // Store secrets in secure Map
      Object.entries(secrets).forEach(([key, value]) => {
        this.secrets.set(key, this.decryptSecret(value));
      });
    }

    // Override with environment variables (highest precedence)
    Object.entries(process.env).forEach(([key, value]) => {
      if (this.isSecretKey(key)) {
        this.secrets.set(key, value);
      }
    });
  }

  validateConfiguration() {
    const schema = {
      database: {
        host: { type: "string", required: true },
        port: { type: "number", required: true, min: 1, max: 65535 },
        name: { type: "string", required: true },
        ssl: { type: "boolean", required: false, default: false },
      },
      redis: {
        url: { type: "string", required: true },
        keyPrefix: { type: "string", required: false, default: "myapp:" },
      },
      server: {
        port: { type: "number", required: true, min: 1, max: 65535 },
        host: { type: "string", required: false, default: "0.0.0.0" },
        corsOrigins: { type: "array", required: true },
      },
      auth: {
        jwtSecret: { type: "secret", required: true },
        sessionSecret: { type: "secret", required: true },
        tokenExpiry: { type: "string", required: false, default: "24h" },
      },
      logging: {
        level: {
          type: "enum",
          required: false,
          default: "info",
          values: ["error", "warn", "info", "debug"],
        },
        transports: { type: "array", required: true },
      },
    };

    this.validateConfigurationSchema(this.config, schema);
  }

  validateConfigurationSchema(config, schema, path = "") {
    Object.entries(schema).forEach(([key, rules]) => {
      const value = config[key];
      const fullPath = path ? `${path}.${key}` : key;

      // Check required fields
      if (rules.required && (value === undefined || value === null)) {
        throw new Error(
          `Configuration error: ${fullPath} is required but not provided`
        );
      }

      // Apply defaults
      if (value === undefined && rules.default !== undefined) {
        config[key] = rules.default;
        return;
      }

      if (value === undefined) return;

      // Type validation
      switch (rules.type) {
        case "string":
          if (typeof value !== "string") {
            throw new Error(
              `Configuration error: ${fullPath} must be a string`
            );
          }
          break;

        case "number":
          if (typeof value !== "number" || isNaN(value)) {
            throw new Error(
              `Configuration error: ${fullPath} must be a number`
            );
          }
          if (rules.min !== undefined && value < rules.min) {
            throw new Error(
              `Configuration error: ${fullPath} must be at least ${rules.min}`
            );
          }
          if (rules.max !== undefined && value > rules.max) {
            throw new Error(
              `Configuration error: ${fullPath} must be at most ${rules.max}`
            );
          }
          break;

        case "boolean":
          if (typeof value !== "boolean") {
            throw new Error(
              `Configuration error: ${fullPath} must be a boolean`
            );
          }
          break;

        case "array":
          if (!Array.isArray(value)) {
            throw new Error(
              `Configuration error: ${fullPath} must be an array`
            );
          }
          break;

        case "secret":
          const secret = this.getSecret(key.toUpperCase());
          if (!secret) {
            throw new Error(
              `Configuration error: Secret ${key.toUpperCase()} is required but not provided`
            );
          }
          break;

        case "enum":
          if (!rules.values.includes(value)) {
            throw new Error(
              `Configuration error: ${fullPath} must be one of: ${rules.values.join(
                ", "
              )}`
            );
          }
          break;
      }
    });
  }

  // Public API for accessing configuration
  get(key, defaultValue = undefined) {
    return this.getNestedValue(this.config, key, defaultValue);
  }

  getSecret(key) {
    return this.secrets.get(key);
  }

  getDatabase() {
    return {
      host: this.get("database.host"),
      port: this.get("database.port"),
      database: this.get("database.name"),
      username: this.getSecret("DB_USERNAME"),
      password: this.getSecret("DB_PASSWORD"),
      ssl: this.get("database.ssl"),
      connectionLimit: this.get("database.connectionLimit", 20),
      acquireTimeout: this.get("database.acquireTimeout", 10000),
    };
  }

  getRedis() {
    return {
      url: this.get("redis.url"),
      keyPrefix: this.get("redis.keyPrefix"),
      retryDelayOnFailover: this.get("redis.retryDelayOnFailover", 100),
      maxRetriesPerRequest: this.get("redis.maxRetriesPerRequest", 3),
    };
  }

  getServer() {
    return {
      port: this.get("server.port"),
      host: this.get("server.host"),
      corsOrigins: this.get("server.corsOrigins"),
      rateLimitWindowMs: this.get("server.rateLimitWindowMs", 15 * 60 * 1000),
      rateLimitMaxRequests: this.get("server.rateLimitMaxRequests", 100),
    };
  }

  getAuth() {
    return {
      jwtSecret: this.getSecret("JWT_SECRET"),
      sessionSecret: this.getSecret("SESSION_SECRET"),
      tokenExpiry: this.get("auth.tokenExpiry"),
      bcryptRounds: this.get("auth.bcryptRounds", 12),
    };
  }

  // Helper methods
  getNestedValue(obj, path, defaultValue) {
    return path.split(".").reduce((current, key) => {
      return current && current[key] !== undefined
        ? current[key]
        : defaultValue;
    }, obj);
  }

  deepMerge(...objects) {
    return objects.reduce((result, current) => {
      Object.keys(current).forEach((key) => {
        if (Array.isArray(result[key]) && Array.isArray(current[key])) {
          result[key] = [...result[key], ...current[key]];
        } else if (this.isObject(result[key]) && this.isObject(current[key])) {
          result[key] = this.deepMerge(result[key], current[key]);
        } else {
          result[key] = current[key];
        }
      });
      return result;
    }, {});
  }

  isObject(item) {
    return item && typeof item === "object" && !Array.isArray(item);
  }

  isSecretKey(key) {
    const secretPatterns = [
      /SECRET$/,
      /PASSWORD$/,
      /TOKEN$/,
      /KEY$/,
      /PRIVATE$/,
      /AUTH$/,
    ];

    return secretPatterns.some((pattern) => pattern.test(key));
  }

  decryptSecret(value) {
    // In production, this would decrypt values using a key management service
    // For development, secrets might be stored in plain text
    if (this.environment === "production" && value.startsWith("encrypted:")) {
      return this.decrypt(value.substring(10));
    }
    return value;
  }
}

// Environment-specific configuration files
// config/base.js - Configuration shared across all environments
module.exports = {
  server: {
    corsOrigins: [],
    requestTimeout: 30000,
    bodyParserLimit: "10mb",
  },

  database: {
    ssl: false,
    connectionLimit: 20,
    acquireTimeout: 10000,
    timeout: 30000,
    migrations: {
      directory: "./database/migrations",
      tableName: "migrations",
    },
  },

  redis: {
    keyPrefix: "myapp:",
    retryDelayOnFailover: 100,
    maxRetriesPerRequest: 3,
  },

  logging: {
    transports: ["console"],
    format: "json",
  },

  auth: {
    tokenExpiry: "24h",
    refreshTokenExpiry: "7d",
    bcryptRounds: 12,
  },

  email: {
    from: "[email protected]",
    templates: {
      directory: "./email-templates",
    },
  },

  monitoring: {
    enabled: true,
    metricsInterval: 60000,
    healthCheckInterval: 30000,
  },
};

// config/development.js - Development-specific overrides
module.exports = {
  server: {
    port: 3000,
    host: "0.0.0.0",
    corsOrigins: [
      "http://localhost:3000",
      "http://localhost:3001",
      "http://127.0.0.1:3000",
    ],
  },

  database: {
    host: "localhost",
    port: 5432,
    name: "myapp_development",
    ssl: false,
    logging: true,
    pool: {
      min: 2,
      max: 10,
    },
  },

  redis: {
    url: "redis://localhost:6379",
  },

  logging: {
    level: "debug",
    transports: ["console", "file"],
    file: {
      filename: "logs/development.log",
      maxsize: 10 * 1024 * 1024, // 10MB
      maxFiles: 5,
    },
  },

  email: {
    provider: "mailhog",
    mailhog: {
      host: "localhost",
      port: 1025,
    },
  },

  monitoring: {
    prometheus: {
      enabled: true,
      port: 9090,
    },
    jaeger: {
      enabled: true,
      endpoint: "http://localhost:14268/api/traces",
    },
  },
};

// config/production.js - Production-specific configuration
module.exports = {
  server: {
    port: parseInt(process.env.PORT) || 8080,
    host: "0.0.0.0",
    corsOrigins: [
      "https://myapp.com",
      "https://www.myapp.com",
      "https://admin.myapp.com",
    ],
  },

  database: {
    host: process.env.DB_HOST,
    port: parseInt(process.env.DB_PORT) || 5432,
    name: process.env.DB_NAME,
    ssl: {
      rejectUnauthorized: true,
      ca: process.env.DB_SSL_CA,
    },
    pool: {
      min: 5,
      max: 50,
      acquireTimeoutMillis: 30000,
      createTimeoutMillis: 30000,
      destroyTimeoutMillis: 5000,
      idleTimeoutMillis: 30000,
    },
    logging: false,
  },

  redis: {
    url: process.env.REDIS_URL,
    retryDelayOnFailover: 100,
    maxRetriesPerRequest: 3,
    lazyConnect: true,
    keepAlive: 30000,
  },

  logging: {
    level: "info",
    transports: ["file", "elasticsearch"],
    file: {
      filename: "/var/log/app/production.log",
      maxsize: 100 * 1024 * 1024, // 100MB
      maxFiles: 20,
    },
    elasticsearch: {
      endpoint: process.env.ELASTICSEARCH_URL,
      index: "app-logs",
    },
  },

  email: {
    provider: "sendgrid",
    sendgrid: {
      apiKey: process.env.SENDGRID_API_KEY,
    },
  },

  monitoring: {
    prometheus: {
      enabled: true,
      port: 9090,
      secure: true,
    },
    jaeger: {
      enabled: true,
      endpoint: process.env.JAEGER_ENDPOINT,
      serviceName: "myapp-production",
    },
    healthChecks: {
      database: true,
      redis: true,
      externalServices: true,
    },
  },

  security: {
    helmet: {
      contentSecurityPolicy: true,
      crossOriginEmbedderPolicy: true,
    },
    rateLimit: {
      windowMs: 15 * 60 * 1000, // 15 minutes
      max: 1000, // requests per windowMs
    },
  },
};

#!/bin/bash
# scripts/manage-secrets.sh - Secure secrets management for all environments

set -euo pipefail

# Configuration
SECRETS_DIR=".secrets"
VAULT_ADDRESS="${VAULT_ADDRESS:-}"
ENVIRONMENT="${NODE_ENV:-development}"

# Ensure secrets directory exists with proper permissions
setup_secrets_directory() {
    if [ ! -d "$SECRETS_DIR" ]; then
        mkdir -p "$SECRETS_DIR"
        chmod 700 "$SECRETS_DIR"
    fi

    # Add to .gitignore if not already there
    if [ -f ".gitignore" ] && ! grep -q "^\.secrets/" .gitignore; then
        echo ".secrets/" >> .gitignore
        echo "Added .secrets/ to .gitignore"
    fi
}

# Generate secure random secrets for development
generate_dev_secrets() {
    echo "🔐 Generating development secrets..."

    local secrets_file="$SECRETS_DIR/development.env"

    # Generate secure random values
    {
        echo "# Generated development secrets - $(date)"
        echo "# DO NOT use these values in production"
        echo ""
        echo "JWT_SECRET=$(openssl rand -base64 32)"
        echo "SESSION_SECRET=$(openssl rand -base64 32)"
        echo "ENCRYPTION_KEY=$(openssl rand -base64 32)"
        echo "API_KEY=$(openssl rand -base64 24)"
        echo ""
        echo "# Database credentials"
        echo "DB_USERNAME=postgres"
        echo "DB_PASSWORD=dev_password_$(openssl rand -hex 8)"
        echo ""
        echo "# Redis password"
        echo "REDIS_PASSWORD=redis_password_$(openssl rand -hex 8)"
        echo ""
        echo "# Email service"
        echo "SENDGRID_API_KEY=SG.dev-key-placeholder"
        echo "SMTP_PASSWORD=smtp_dev_password"
        echo ""
        echo "# External service API keys"
        echo "STRIPE_SECRET_KEY=sk_test_placeholder"
        echo "AWS_SECRET_ACCESS_KEY=dev_aws_secret_key"
        echo ""
        echo "# OAuth secrets"
        echo "GOOGLE_CLIENT_SECRET=google_client_secret_dev"
        echo "GITHUB_CLIENT_SECRET=github_client_secret_dev"
    } > "$secrets_file"

    chmod 600 "$secrets_file"
    echo "✅ Development secrets generated at $secrets_file"
}

# Load secrets from HashiCorp Vault (production)
load_from_vault() {
    local environment=$1
    local secrets_path="secret/myapp/$environment"

    if [ -z "$VAULT_ADDRESS" ]; then
        echo "❌ VAULT_ADDRESS not set"
        return 1
    fi

    echo "🔐 Loading secrets from Vault for $environment..."

    # Authenticate with Vault (using service account in production)
    if [ "$environment" = "production" ]; then
        vault auth -method=aws
    else
        # Use personal token for staging/development
        vault auth -method=userpass username="${VAULT_USERNAME:-$USER}"
    fi

    # Read secrets from Vault
    vault kv get -format=json "$secrets_path" | \
        jq -r '.data.data | to_entries[] | "\(.key)=\(.value)"' > \
        "$SECRETS_DIR/$environment.env"

    chmod 600 "$SECRETS_DIR/$environment.env"
    echo "✅ Secrets loaded from Vault"
}

# Encrypt secrets for storage in repository (staging/production)
encrypt_secrets() {
    local environment=$1
    local secrets_file="$SECRETS_DIR/$environment.env"
    local encrypted_file="config/secrets/$environment.enc"

    if [ ! -f "$secrets_file" ]; then
        echo "❌ Secrets file not found: $secrets_file"
        return 1
    fi

    echo "🔐 Encrypting secrets for $environment..."

    # Create encrypted secrets directory
    mkdir -p "config/secrets"

    # Encrypt using gpg with team public keys
    gpg --cipher-algo AES256 --compress-algo 1 --s2k-cipher-algo AES256 \
        --s2k-digest-algo SHA512 --s2k-mode 3 --s2k-count 65011712 \
        --force-mdc --quiet --no-greeting --batch --yes \
        --output "$encrypted_file" --symmetric "$secrets_file"

    echo "✅ Secrets encrypted to $encrypted_file"
    echo "⚠️  Remember to securely share the encryption passphrase with team members"
}

# Decrypt secrets from repository
decrypt_secrets() {
    local environment=$1
    local encrypted_file="config/secrets/$environment.enc"
    local secrets_file="$SECRETS_DIR/$environment.env"

    if [ ! -f "$encrypted_file" ]; then
        echo "❌ Encrypted secrets file not found: $encrypted_file"
        return 1
    fi

    echo "🔓 Decrypting secrets for $environment..."

    gpg --quiet --batch --yes --decrypt "$encrypted_file" > "$secrets_file"
    chmod 600 "$secrets_file"

    echo "✅ Secrets decrypted to $secrets_file"
}

# Validate secrets file format and required keys
validate_secrets() {
    local environment=$1
    local secrets_file="$SECRETS_DIR/$environment.env"

    if [ ! -f "$secrets_file" ]; then
        echo "❌ Secrets file not found: $secrets_file"
        return 1
    fi

    echo "🔍 Validating secrets for $environment..."

    # Required secrets for all environments
    local required_secrets=(
        "JWT_SECRET"
        "SESSION_SECRET"
        "DB_PASSWORD"
    )

    # Additional required secrets for production
    if [ "$environment" = "production" ]; then
        required_secrets+=(
            "ENCRYPTION_KEY"
            "SENDGRID_API_KEY"
            "AWS_SECRET_ACCESS_KEY"
        )
    fi

    # Check for required secrets
    local missing_secrets=()
    for secret in "${required_secrets[@]}"; do
        if ! grep -q "^$secret=" "$secrets_file"; then
            missing_secrets+=("$secret")
        fi
    done

    if [ ${#missing_secrets[@]} -eq 0 ]; then
        echo "✅ All required secrets present"
        return 0
    else
        echo "❌ Missing required secrets: ${missing_secrets[*]}"
        return 1
    fi
}

# Rotate secrets (generate new values)
rotate_secrets() {
    local environment=$1
    local secrets_file="$SECRETS_DIR/$environment.env"

    echo "🔄 Rotating secrets for $environment..."

    if [ ! -f "$secrets_file" ]; then
        echo "❌ Secrets file not found: $secrets_file"
        return 1
    fi

    # Create backup
    cp "$secrets_file" "$secrets_file.backup.$(date +%Y%m%d_%H%M%S)"

    # Rotate specific secrets that can be safely regenerated
    sed -i.tmp \
        -e "s/^JWT_SECRET=.*/JWT_SECRET=$(openssl rand -base64 32)/" \
        -e "s/^SESSION_SECRET=.*/SESSION_SECRET=$(openssl rand -base64 32)/" \
        -e "s/^ENCRYPTION_KEY=.*/ENCRYPTION_KEY=$(openssl rand -base64 32)/" \
        "$secrets_file"

    rm "$secrets_file.tmp"

    echo "✅ Secrets rotated (backup created)"
    echo "⚠️  Update your running applications with new secrets"
}

# Load secrets into current environment
load_secrets() {
    local environment=${1:-$ENVIRONMENT}
    local secrets_file="$SECRETS_DIR/$environment.env"

    if [ ! -f "$secrets_file" ]; then
        echo "❌ Secrets file not found: $secrets_file"
        return 1
    fi

    echo "📥 Loading secrets for $environment..."

    # Export secrets as environment variables
    set -a  # Enable export of all variables
    source "$secrets_file"
    set +a  # Disable export

    echo "✅ Secrets loaded into environment"
}

# Show help information
show_help() {
    cat << EOF
Secrets Management Tool

Usage: $0 <command> [arguments]

Commands:
  init [env]              Initialize secrets for environment (default: development)
  generate [env]          Generate new secrets for environment
  encrypt <env>           Encrypt secrets for repository storage
  decrypt <env>           Decrypt secrets from repository
  load [env]              Load secrets into current environment
  validate <env>          Validate secrets file
  rotate <env>            Rotate (regenerate) secrets
  vault-load <env>        Load secrets from HashiCorp Vault

Examples:
  $0 init                 # Initialize development secrets
  $0 generate production  # Generate production secrets
  $0 encrypt staging      # Encrypt staging secrets
  $0 load production      # Load production secrets

Environments: development, staging, production
EOF
}

# Main command router
main() {
    case "${1:-help}" in
        init)
            setup_secrets_directory
            generate_dev_secrets
            ;;
        generate)
            setup_secrets_directory
            generate_dev_secrets
            ;;
        encrypt)
            encrypt_secrets "${2:-staging}"
            ;;
        decrypt)
            setup_secrets_directory
            decrypt_secrets "${2:-staging}"
            ;;
        load)
            load_secrets "${2:-$ENVIRONMENT}"
            ;;
        validate)
            validate_secrets "${2:-development}"
            ;;
        rotate)
            rotate_secrets "${2:-development}"
            ;;
        vault-load)
            setup_secrets_directory
            load_from_vault "${2:-staging}"
            ;;
        help|--help|-h)
            show_help
            ;;
        *)
            echo "❌ Unknown command: $1"
            show_help
            exit 1
            ;;
    esac
}

main "$@"