@Controller
@RequestMapping("/auth")
public class AuthController {
    
    @Autowired
    private UserLoginService userLoginService;
    
    @PostMapping("/login")
    public ResponseEntity<LoginResponse> login(
            @RequestBody LoginRequest request,
            HttpServletResponse response) {
        
        try {
            LoginResult result = userLoginService.authenticate(
                request.getUsername(), 
                request.getPassword()
            );
            
            // Set secure cookie with session ID
            Cookie sessionCookie = new Cookie("JSESSIONID", result.getSessionId());
            sessionCookie.setHttpOnly(true);
            sessionCookie.setSecure(true);
            sessionCookie.setPath("/");
            sessionCookie.setMaxAge(3600); // 1 hour
            response.addCookie(sessionCookie);
            
            return ResponseEntity.ok(new LoginResponse(result.getUser()));
            
        } catch (AuthenticationException e) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(new LoginResponse("Invalid credentials"));
        }
    }
    
    @PostMapping("/logout")
    public ResponseEntity<Void> logout(HttpServletRequest request) {
        String sessionId = extractSessionId(request);
        userLoginService.logout(sessionId);
        return ResponseEntity.ok().build();
    }
}

@Service
@Transactional
public class UserLoginService {
    
    @Autowired
    private UserService userService;
    
    @Autowired
    private PermissionService permissionService;
    
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;
    
    @Autowired
    private JwtTokenService jwtTokenService;
    
    private static final String SESSION_PREFIX = "user:session:";
    private static final int SESSION_TIMEOUT = 3600; // 1 hour
    
    public LoginResult authenticate(String username, String password) {
        // Step 1: Validate credentials
        User user = userService.validateCredentials(username, password);
        if (user == null) {
            throw new AuthenticationException("Invalid credentials");
        }
        
        // Step 2: Load user permissions
        List<Permission> permissions = permissionService.getUserPermissions(user.getId());
        
        // Step 3: Create session
        String sessionId = generateSessionId();
        UserSession session = new UserSession(user, permissions, System.currentTimeMillis());
        
        // Step 4: Store session in Redis
        redisTemplate.opsForValue().set(
            SESSION_PREFIX + sessionId, 
            session, 
            SESSION_TIMEOUT, 
            TimeUnit.SECONDS
        );
        
        // Step 5: Generate JWT token (optional)
        String jwtToken = jwtTokenService.generateToken(user, permissions);
        
        return new LoginResult(sessionId, user, jwtToken);
    }
    
    public void logout(String sessionId) {
        redisTemplate.delete(SESSION_PREFIX + sessionId);
    }
    
    public UserSession getSession(String sessionId) {
        return (UserSession) redisTemplate.opsForValue().get(SESSION_PREFIX + sessionId);
    }
    
    public void refreshSession(String sessionId) {
        redisTemplate.expire(SESSION_PREFIX + sessionId, SESSION_TIMEOUT, TimeUnit.SECONDS);
    }
    
    private String generateSessionId() {
        return UUID.randomUUID().toString().replace("-", "");
    }
}

@Component
public class RedisSessionManager {
    
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;
    
    private static final String USER_SESSION_PREFIX = "session:user:";
    private static final String USER_PERMISSIONS_PREFIX = "session:permissions:";
    private static final int DEFAULT_TIMEOUT = 1800; // 30 minutes
    
    public void storeUserSession(String sessionId, UserSession session) {
        String userKey = USER_SESSION_PREFIX + sessionId;
        String permissionsKey = USER_PERMISSIONS_PREFIX + sessionId;
        
        // Store user info and permissions separately for optimized access
        redisTemplate.opsForHash().putAll(userKey, session.toMap());
        redisTemplate.opsForSet().add(permissionsKey, session.getPermissions().toArray());
        
        // Set expiration
        redisTemplate.expire(userKey, DEFAULT_TIMEOUT, TimeUnit.SECONDS);
        redisTemplate.expire(permissionsKey, DEFAULT_TIMEOUT, TimeUnit.SECONDS);
    }
    
    public UserSession getUserSession(String sessionId) {
        String userKey = USER_SESSION_PREFIX + sessionId;
        Map<Object, Object> sessionData = redisTemplate.opsForHash().entries(userKey);
        
        if (sessionData.isEmpty()) {
            return null;
        }
        
        // Refresh session timeout on access
        redisTemplate.expire(userKey, DEFAULT_TIMEOUT, TimeUnit.SECONDS);
        redisTemplate.expire(USER_PERMISSIONS_PREFIX + sessionId, DEFAULT_TIMEOUT, TimeUnit.SECONDS);
        
        return UserSession.fromMap(sessionData);
    }
}

@Component
@Slf4j
public class SessionCleanupService {
    
    @Scheduled(fixedRate = 300000) // Every 5 minutes
    public void cleanupExpiredSessions() {
        Set<String> expiredSessions = findExpiredSessions();
        
        for (String sessionId : expiredSessions) {
            cleanupSession(sessionId);
        }
        
        log.info("Cleaned up {} expired sessions", expiredSessions.size());
    }
    
    private void cleanupSession(String sessionId) {
        redisTemplate.delete(USER_SESSION_PREFIX + sessionId);
        redisTemplate.delete(USER_PERMISSIONS_PREFIX + sessionId);
    }
}

@Component
@Order(1)
public class AuthenticationFilter implements Filter {
    
    @Autowired
    private UserLoginService userLoginService;
    
    @Autowired
    private PermissionService permissionService;
    
    private static final Set<String> EXCLUDED_PATHS = Set.of(
        "/auth/login", "/auth/register", "/public", "/health"
    );
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        String requestPath = httpRequest.getRequestURI();
        
        // Skip authentication for excluded paths
        if (isExcludedPath(requestPath)) {
            chain.doFilter(request, response);
            return;
        }
        
        try {
            // Extract session ID from cookie
            String sessionId = extractSessionId(httpRequest);
            if (sessionId == null) {
                handleUnauthorized(httpResponse, "No session found");
                return;
            }
            
            // Validate session
            UserSession session = userLoginService.getSession(sessionId);
            if (session == null || isSessionExpired(session)) {
                handleUnauthorized(httpResponse, "Session expired");
                return;
            }
            
            // Check permissions for the requested resource
            if (!hasPermission(session, requestPath, httpRequest.getMethod())) {
                handleForbidden(httpResponse, "Insufficient permissions");
                return;
            }
            
            // Refresh session timeout
            userLoginService.refreshSession(sessionId);
            
            // Set user context for downstream processing
            SecurityContextHolder.setContext(new SecurityContext(session.getUser()));
            
            chain.doFilter(request, response);
            
        } catch (Exception e) {
            log.error("Authentication filter error", e);
            handleUnauthorized(httpResponse, "Authentication error");
        } finally {
            SecurityContextHolder.clearContext();
        }
    }
    
    private boolean hasPermission(UserSession session, String path, String method) {
        return permissionService.checkPermission(
            session.getUser().getId(), 
            path, 
            method
        );
    }
    
    private void handleUnauthorized(HttpServletResponse response, String message) 
            throws IOException {
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        response.setContentType("application/json");
        response.getWriter().write("{\"error\":\"" + message + "\"}");
    }
}

@Service
public class JwtTokenService {
    
    @Value("${jwt.secret}")
    private String jwtSecret;
    
    @Value("${jwt.expiration}")
    private int jwtExpiration;
    
    public String generateToken(User user, List<Permission> permissions) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("userId", user.getId());
        claims.put("username", user.getUsername());
        claims.put("permissions", permissions.stream()
            .map(Permission::getName)
            .collect(Collectors.toList()));
        
        return Jwts.builder()
            .setClaims(claims)
            .setSubject(user.getUsername())
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + jwtExpiration * 1000))
            .signWith(SignatureAlgorithm.HS256, jwtSecret)
            .compact();
    }
    
    public Claims validateToken(String token) {
        try {
            return Jwts.parser()
                .setSigningKey(jwtSecret)
                .parseClaimsJws(token)
                .getBody();
        } catch (JwtException e) {
            throw new AuthenticationException("Invalid JWT token", e);
        }
    }
    
    public boolean isTokenExpired(String token) {
        Date expiration = validateToken(token).getExpiration();
        return expiration.before(new Date());
    }
}

@Component
public class PasswordSecurityService {
    
    private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder(12);
    
    public String hashPassword(String plainPassword) {
        return passwordEncoder.encode(plainPassword);
    }
    
    public boolean verifyPassword(String plainPassword, String hashedPassword) {
        return passwordEncoder.matches(plainPassword, hashedPassword);
    }
    
    public boolean isPasswordStrong(String password) {
        return password.length() >= 8 &&
               password.matches(".*[A-Z].*") &&
               password.matches(".*[a-z].*") &&
               password.matches(".*[0-9].*") &&
               password.matches(".*[!@#$%^&*()].*");
    }
}

@Component
public class RateLimitingService {
    
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;
    
    private static final String RATE_LIMIT_PREFIX = "rate_limit:";
    private static final int MAX_ATTEMPTS = 5;
    private static final int WINDOW_SECONDS = 300; // 5 minutes
    
    public boolean isRateLimited(String identifier) {
        String key = RATE_LIMIT_PREFIX + identifier;
        Integer attempts = (Integer) redisTemplate.opsForValue().get(key);
        
        if (attempts == null) {
            redisTemplate.opsForValue().set(key, 1, WINDOW_SECONDS, TimeUnit.SECONDS);
            return false;
        }
        
        if (attempts >= MAX_ATTEMPTS) {
            return true;
        }
        
        redisTemplate.opsForValue().increment(key);
        return false;
    }
}

@Component
public class SessionValidator {
    
    public ValidationResult validateSession(String sessionId, String requestPath) {
        // Step 1: Check session existence
        UserSession session = getSessionFromRedis(sessionId);
        if (session == null) {
            return ValidationResult.failure("Session not found");
        }
        
        // Step 2: Check session expiration
        if (isSessionExpired(session)) {
            cleanupSession(sessionId);
            return ValidationResult.failure("Session expired");
        }
        
        // Step 3: Validate user status
        if (!isUserActive(session.getUser())) {
            return ValidationResult.failure("User account disabled");
        }
        
        // Step 4: Check resource permissions
        if (!hasResourcePermission(session, requestPath)) {
            return ValidationResult.failure("Insufficient permissions");
        }
        
        return ValidationResult.success(session);
    }
    
    private boolean isSessionExpired(UserSession session) {
        long currentTime = System.currentTimeMillis();
        long sessionTime = session.getLastAccessTime();
        return (currentTime - sessionTime) > SESSION_TIMEOUT_MS;
    }
}

@ControllerAdvice
public class AuthenticationExceptionHandler {
    
    private static final Logger logger = LoggerFactory.getLogger(AuthenticationExceptionHandler.class);
    
    @ExceptionHandler(AuthenticationException.class)
    public ResponseEntity<ErrorResponse> handleAuthenticationException(
            AuthenticationException e, HttpServletRequest request) {
        
        // Log security event
        logger.warn("Authentication failed for IP: {} - {}", 
                   getClientIpAddress(request), e.getMessage());
        
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                .body(new ErrorResponse("Authentication failed", "AUTH_001"));
    }
    
    @ExceptionHandler(AuthorizationException.class)
    public ResponseEntity<ErrorResponse> handleAuthorizationException(
            AuthorizationException e, HttpServletRequest request) {
        
        // Log authorization event
        logger.warn("Authorization failed for user: {} on resource: {}", 
                   getCurrentUser(), request.getRequestURI());
        
        return ResponseEntity.status(HttpStatus.FORBIDDEN)
                .body(new ErrorResponse("Access denied", "AUTH_002"));
    }
}

@Service
public class PermissionCacheService {
    
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;
    
    private static final String PERMISSION_CACHE_PREFIX = "permissions:user:";
    private static final int CACHE_TTL = 600; // 10 minutes
    
    @Cacheable(value = "userPermissions", key = "#userId")
    public List<Permission> getUserPermissions(Long userId) {
        String cacheKey = PERMISSION_CACHE_PREFIX + userId;
        List<Permission> permissions = (List<Permission>) redisTemplate.opsForValue().get(cacheKey);
        
        if (permissions == null) {
            permissions = permissionService.loadUserPermissions(userId);
            redisTemplate.opsForValue().set(cacheKey, permissions, CACHE_TTL, TimeUnit.SECONDS);
        }
        
        return permissions;
    }
    
    @CacheEvict(value = "userPermissions", key = "#userId")
    public void invalidateUserPermissions(Long userId) {
        redisTemplate.delete(PERMISSION_CACHE_PREFIX + userId);
    }
}

@Component
public class SecurityMetricsCollector {
    
    private final MeterRegistry meterRegistry;
    private final Counter loginAttempts;
    private final Counter loginFailures;
    private final Timer authenticationTime;
    
    public SecurityMetricsCollector(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.loginAttempts = Counter.builder("login.attempts")
                .description("Total login attempts")
                .register(meterRegistry);
        this.loginFailures = Counter.builder("login.failures")
                .description("Failed login attempts")
                .register(meterRegistry);
        this.authenticationTime = Timer.builder("authentication.time")
                .description("Authentication processing time")
                .register(meterRegistry);
    }
    
    public void recordLoginAttempt() {
        loginAttempts.increment();
    }
    
    public void recordLoginFailure(String reason) {
        loginFailures.increment(Tags.of("reason", reason));
    }
    
    public Timer.Sample startAuthenticationTimer() {
        return Timer.start(meterRegistry);
    }
}

@SpringBootTest
@AutoConfigureTestDatabase
class UserLoginServiceIntegrationTest {
    
    @Autowired
    private UserLoginService userLoginService;
    
    @MockBean
    private UserService userService;
    
    @Test
    void shouldAuthenticateValidUser() {
        // Given
        User mockUser = createMockUser();
        when(userService.validateCredentials("testuser", "password"))
            .thenReturn(mockUser);
        
        // When
        LoginResult result = userLoginService.authenticate("testuser", "password");
        
        // Then
        assertThat(result.getSessionId()).isNotNull();
        assertThat(result.getUser().getUsername()).isEqualTo("testuser");
    }
    
    @Test
    void shouldRejectInvalidCredentials() {
        // Given
        when(userService.validateCredentials("testuser", "wrongpassword"))
            .thenReturn(null);
        
        // When & Then
        assertThatThrownBy(() -> userLoginService.authenticate("testuser", "wrongpassword"))
            .isInstanceOf(AuthenticationException.class)
            .hasMessage("Invalid credentials");
    }
}

@RestController
@RequestMapping("/api/grey-router")
public class GreyRouterController {
    
    @Autowired
    private GreyRouterService greyRouterService;
    
    @PostMapping("/route")
    public ResponseEntity<ServiceInstanceInfo> routeRequest(
            @RequestBody RouteRequest request) {
        
        ServiceInstanceInfo instance = greyRouterService
            .routeToServiceInstance(
                request.getTenantId(),
                request.getServiceName(),
                request.getRequestMetadata()
            );
        
        return ResponseEntity.ok(instance);
    }
    
    @PostMapping("/upgrade-schema/{tenantId}/{serviceVersion}")
    public ResponseEntity<UpgradeResult> upgradeSchema(
            @PathVariable String tenantId,
            @PathVariable String serviceVersion) {
        
        UpgradeResult result = greyRouterService
            .upgradeDatabaseSchema(tenantId, serviceVersion);
        
        return ResponseEntity.ok(result);
    }
}

public class RedisDataStructures {
    // Tenant to Service Version Mapping
    // Key: tenant:{tenant_id}:services
    // Type: Hash
    // Structure: {service_name: version, service_name: version, ...}
    public static final String TENANT_SERVICE_VERSIONS = "tenant:%s:services";
    
    // Service Version to Instances Mapping
    // Key: service:{service_name}:version:{version}:instances
    // Type: Set
    // Structure: {instance_id1, instance_id2, ...}
    public static final String SERVICE_INSTANCES = "service:%s:version:%s:instances";
    
    // Set: active_tenants
    public static final String ACTIVE_TENANTS = "active_tenants";
    
    // Hash: tenant:{tenantId}:metadata -> {key: value}
    public static final String TENANT_METADATA = "tenant:%s:metadata";
    
    // Example data structure usage
    public void storeTenantServiceMapping(String tenantId, 
                                        Map<String, String> serviceVersions) {
        String key = String.format(TENANT_SERVICE_VERSIONS, tenantId);
        redisTemplate.opsForHash().putAll(key, serviceVersions);
        redisTemplate.expire(key, Duration.ofHours(24));
    }
}

@Component
public class GreyRouterSDK {
    
    private final RestTemplate restTemplate;
    private final RedisTemplate<String, Object> redisTemplate;
    private final String greyRouterServiceUrl;
    
    public <T> T executeWithRouting(String tenantId, String serviceName, 
                                  ServiceCall<T> serviceCall) {
        
        // Get routing information
        ServiceInstanceInfo instance = getServiceInstance(tenantId, serviceName);
        
        // Execute with circuit breaker and retry
        return executeWithResilience(instance, serviceCall);
    }
    
    private ServiceInstanceInfo getServiceInstance(String tenantId, String serviceName) {
        // First try Redis cache
        ServiceInstanceInfo cached = getCachedInstance(tenantId, serviceName);
        if (cached != null && isInstanceHealthy(cached)) {
            return cached;
        }
        
        // Fallback to router service
        RouteRequest request = RouteRequest.builder()
            .tenantId(tenantId)
            .serviceName(serviceName)
            .build();
            
        return restTemplate.postForObject(
            greyRouterServiceUrl + "/route", 
            request, 
            ServiceInstanceInfo.class
        );
    }
    
    @Retryable(value = {Exception.class}, maxAttempts = 3)
    private <T> T executeWithResilience(ServiceInstanceInfo instance, 
                                      ServiceCall<T> serviceCall) {
        try {
            return serviceCall.execute(instance);
        } catch (Exception e) {
            // Mark instance as unhealthy temporarily
            markInstanceUnhealthy(instance);
            throw e;
        }
    }
}

@Component
public class GreyRouteFilter implements GlobalFilter, Ordered {
    
    @Autowired
    private RedisTemplate<String, String> redisTemplate;
    
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String tenantId = extractTenantId(exchange.getRequest());
        String serviceName = extractServiceName(exchange.getRequest());
        
        if (tenantId != null && serviceName != null) {
            return routeToSpecificVersion(exchange, chain, tenantId, serviceName);
        }
        
        return chain.filter(exchange);
    }
    
    private Mono<Void> routeToSpecificVersion(ServerWebExchange exchange, 
                                             GatewayFilterChain chain,
                                             String tenantId, 
                                             String serviceName) {
        
        // Execute Lua script for atomic routing decision
        DefaultRedisScript<Map> script = new DefaultRedisScript<>();
        script.setScriptText(loadLuaScript("route_and_balance.lua"));
        script.setResultType(Map.class);
        
        Map<String, Object> result = redisTemplate.execute(script, 
            Collections.emptyList(), tenantId, serviceName);
            
        if (result.containsKey("err")) {
            return handleRoutingError(exchange, (String) result.get("err"));
        }
        
        String targetInstance = (String) result.get("instance");
        String version = (String) result.get("version");
        
        // Modify request to target specific instance
        ServerHttpRequest modifiedRequest = exchange.getRequest().mutate()
            .header("X-Target-Instance", targetInstance)
            .header("X-Service-Version", version)
            .build();
            
        return chain.filter(exchange.mutate().request(modifiedRequest).build());
    }
    
    @Override
    public int getOrder() {
        return -100; // Execute before other filters
    }
}

@Service
public class DatabaseSchemaManager {
    
    @Autowired
    private DataSourceManager dataSourceManager;
    
    public UpgradeResult upgradeTenantSchema(String tenantId, 
                                           String serviceVersion) {
        
        DataSource tenantDataSource = dataSourceManager
            .getTenantDataSource(tenantId);
            
        List<SchemaMigration> migrations = getSchemaMigrations(serviceVersion);
        
        return executeTransactionalMigration(tenantDataSource, migrations);
    }
    
    @Transactional
    private UpgradeResult executeTransactionalMigration(
            DataSource dataSource, 
            List<SchemaMigration> migrations) {
        
        UpgradeResult result = new UpgradeResult();
        
        try {
            for (SchemaMigration migration : migrations) {
                executeMigration(dataSource, migration);
                updateSchemaVersion(dataSource, migration.getVersion());
            }
            result.setSuccess(true);
        } catch (Exception e) {
            result.setSuccess(false);
            result.setErrorMessage(e.getMessage());
            throw new SchemaUpgradeException("Migration failed", e);
        }
        
        return result;
    }
    
    private void executeMigration(DataSource dataSource, 
                                SchemaMigration migration) {
        JdbcTemplate jdbcTemplate = new JdbcTemplate(dataSource);
        
        // Validate migration before execution
        validateMigration(migration);
        
        // Execute with timeout
        jdbcTemplate.update(migration.getSql());
        
        // Log migration execution
        logMigrationExecution(migration);
    }
}