add step list for server creation

local/middleware/security/security.go

@@ -11,19 +11,16 @@ import (
 	"github.com/gofiber/fiber/v2"
 )
 
-// RateLimiter stores rate limiting information
 type RateLimiter struct {
 	requests map[string][]time.Time
 	mutex    sync.RWMutex
 }
 
-// NewRateLimiter creates a new rate limiter
 func NewRateLimiter() *RateLimiter {
 	rl := &RateLimiter{
 		requests: make(map[string][]time.Time),
 	}
 
-	// Use graceful shutdown for cleanup goroutine
 	shutdownManager := graceful.GetManager()
 	shutdownManager.RunGoroutine(func(ctx context.Context) {
 		rl.cleanupWithContext(ctx)
@@ -32,7 +29,6 @@ func NewRateLimiter() *RateLimiter {
 	return rl
 }
 
-// cleanup removes old entries from the rate limiter
 func (rl *RateLimiter) cleanupWithContext(ctx context.Context) {
 	ticker := time.NewTicker(5 * time.Minute)
 	defer ticker.Stop()
@@ -62,44 +58,29 @@ func (rl *RateLimiter) cleanupWithContext(ctx context.Context) {
 	}
 }
 
-// SecurityMiddleware provides comprehensive security middleware
 type SecurityMiddleware struct {
 	rateLimiter *RateLimiter
 }
 
-// NewSecurityMiddleware creates a new security middleware
 func NewSecurityMiddleware() *SecurityMiddleware {
 	return &SecurityMiddleware{
 		rateLimiter: NewRateLimiter(),
 	}
 }
 
-// SecurityHeaders adds security headers to responses
 func (sm *SecurityMiddleware) SecurityHeaders() fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		// Prevent MIME type sniffing
 		c.Set("X-Content-Type-Options", "nosniff")
-
-		// Prevent clickjacking
 		c.Set("X-Frame-Options", "DENY")
-
-		// Enable XSS protection
 		c.Set("X-XSS-Protection", "1; mode=block")
-
-		// Prevent referrer leakage
 		c.Set("Referrer-Policy", "strict-origin-when-cross-origin")
-
-		// Content Security Policy
 		c.Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'")
-
-		// Permissions Policy
 		c.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()")
 
 		return c.Next()
 	}
 }
 
-// RateLimit implements rate limiting for API endpoints
 func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ip := c.IP()
@@ -111,7 +92,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 		now := time.Now()
 		requests := sm.rateLimiter.requests[key]
 
-		// Remove requests older than duration
 		filtered := make([]time.Time, 0, len(requests))
 		for _, t := range requests {
 			if now.Sub(t) < duration {
@@ -119,7 +99,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 			}
 		}
 
-		// Check if limit is exceeded
 		if len(filtered) >= maxRequests {
 			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
 				"error":       "Rate limit exceeded",
@@ -127,7 +106,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 			})
 		}
 
-		// Add current request
 		filtered = append(filtered, now)
 		sm.rateLimiter.requests[key] = filtered
 
@@ -135,7 +113,6 @@ func (sm *SecurityMiddleware) RateLimit(maxRequests int, duration time.Duration)
 	}
 }
 
-// AuthRateLimit implements stricter rate limiting for authentication endpoints
 func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ip := c.IP()
@@ -148,7 +125,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 		now := time.Now()
 		requests := sm.rateLimiter.requests[key]
 
-		// Remove requests older than 15 minutes
 		filtered := make([]time.Time, 0, len(requests))
 		for _, t := range requests {
 			if now.Sub(t) < 15*time.Minute {
@@ -156,7 +132,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 			}
 		}
 
-		// Check if limit is exceeded (5 requests per 15 minutes for auth)
 		if len(filtered) >= 5 {
 			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
 				"error":       "Too many authentication attempts",
@@ -164,7 +139,6 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 			})
 		}
 
-		// Add current request
 		filtered = append(filtered, now)
 		sm.rateLimiter.requests[key] = filtered
 
@@ -172,20 +146,16 @@ func (sm *SecurityMiddleware) AuthRateLimit() fiber.Handler {
 	}
 }
 
-// InputSanitization sanitizes user input to prevent XSS and injection attacks
 func (sm *SecurityMiddleware) InputSanitization() fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		// Sanitize query parameters
 		c.Request().URI().QueryArgs().VisitAll(func(key, value []byte) {
 			sanitized := sanitizeInput(string(value))
 			c.Request().URI().QueryArgs().Set(string(key), sanitized)
 		})
 
-		// Store original body for processing
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
 			body := c.Body()
 			if len(body) > 0 {
-				// Basic sanitization - remove potentially dangerous patterns
 				sanitized := sanitizeInput(string(body))
 				c.Request().SetBodyString(sanitized)
 			}
@@ -195,7 +165,6 @@ func (sm *SecurityMiddleware) InputSanitization() fiber.Handler {
 	}
 }
 
-// sanitizeInput removes potentially dangerous patterns from input
 func sanitizeInput(input string) string {
 	dangerous := []string{
 		"<script",
@@ -236,7 +205,7 @@ func sanitizeInput(input string) string {
 
 	result := input
 	lowerInput := strings.ToLower(input)
-	
+
 	for _, pattern := range dangerous {
 		if strings.Contains(lowerInput, pattern) {
 			return ""
@@ -254,7 +223,6 @@ func sanitizeInput(input string) string {
 	return result
 }
 
-// ValidateContentType ensures only expected content types are accepted
 func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
@@ -265,7 +233,6 @@ func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.
 				})
 			}
 
-			// Check if content type is allowed
 			allowed := false
 			for _, allowedType := range allowedTypes {
 				if strings.Contains(contentType, allowedType) {
@@ -285,7 +252,6 @@ func (sm *SecurityMiddleware) ValidateContentType(allowedTypes ...string) fiber.
 	}
 }
 
-// ValidateUserAgent blocks requests with suspicious or missing user agents
 func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 	suspiciousAgents := []string{
 		"sqlmap",
@@ -296,21 +262,19 @@ func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 		"dirb",
 		"dirbuster",
 		"wpscan",
-		"curl/7.0", // Very old curl versions
-		"wget/1.0", // Very old wget versions
+		"curl/7.0",
+		"wget/1.0",
 	}
 
 	return func(c *fiber.Ctx) error {
 		userAgent := strings.ToLower(c.Get("User-Agent"))
 
-		// Block empty user agents
 		if userAgent == "" {
 			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
 				"error": "User-Agent header is required",
 			})
 		}
 
-		// Block suspicious user agents
 		for _, suspicious := range suspiciousAgents {
 			if strings.Contains(userAgent, suspicious) {
 				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
@@ -323,7 +287,6 @@ func (sm *SecurityMiddleware) ValidateUserAgent() fiber.Handler {
 	}
 }
 
-// RequestSizeLimit limits the size of incoming requests
 func (sm *SecurityMiddleware) RequestSizeLimit(maxSize int) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		if c.Method() == "POST" || c.Method() == "PUT" || c.Method() == "PATCH" {
@@ -340,19 +303,15 @@ func (sm *SecurityMiddleware) RequestSizeLimit(maxSize int) fiber.Handler {
 	}
 }
 
-// LogSecurityEvents logs security-related events
 func (sm *SecurityMiddleware) LogSecurityEvents() fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		start := time.Now()
 
-		// Process request
 		err := c.Next()
 
-		// Log suspicious activity
 		status := c.Response().StatusCode()
 		if status == 401 || status == 403 || status == 429 {
 			duration := time.Since(start)
-			// In a real implementation, you would send this to your logging system
 			fmt.Printf("[SECURITY] %s %s %s %d %v %s\n",
 				time.Now().Format(time.RFC3339),
 				c.IP(),
@@ -367,7 +326,6 @@ func (sm *SecurityMiddleware) LogSecurityEvents() fiber.Handler {
 	}
 }
 
-// TimeoutMiddleware adds request timeout
 func (sm *SecurityMiddleware) TimeoutMiddleware(timeout time.Duration) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		ctx, cancel := context.WithTimeout(c.UserContext(), timeout)