// RFC-compliant URL parsing
match Url::parse(&self.url) {
    Ok(_) => {},
    Err(_) => return Err(AppError::InvalidUrl("Invalid URL format".to_string())),
}

// Future enhancement: Domain blacklist checking
const BLOCKED_DOMAINS: &[&str] = &[
    "localhost",
    "127.0.0.1",
    "0.0.0.0",
    // Add malicious domains
];

// Only allow alphanumeric characters and hyphens
if !code.chars().all(|c| c.is_alphanumeric() || c == '-') {
    return Err(AppError::Validation(
        "Custom code can only contain alphanumeric characters and hyphens".to_string()
    ));
}

// Safe: Uses parameter binding
sqlx::query_as::<_, TinyUrl>(
    "SELECT * FROM tinyurls WHERE short_code = $1"
)
.bind(short_code)
.fetch_optional(&*self.pool)
.await

// VULNERABLE: String concatenation
let query = format!("SELECT * FROM tinyurls WHERE short_code = '{}'", user_input);

// SAFE: Parameter binding
sqlx::query_as::<_, TinyUrl>(query_string)
    .bind(parameter)
    .fetch_optional(&pool)
    .await

// Header-based API key validation
#[derive(Debug)]
pub struct ApiKeyAuth {
    key: String,
}

impl ApiKeyAuth {
    pub fn validate(&self, request_key: &str) -> bool {
        // Constant-time comparison to prevent timing attacks
        use subtle::ConstantTimeEq;
        self.key.as_bytes().ct_eq(request_key.as_bytes()).into()
    }
}

// Future: Implement rate limiting per API key/IP
pub struct RateLimiter {
    // Redis-based rate limiting
    // Window-based or token bucket algorithm
}

// Future implementation with Redis
use std::collections::HashMap;
use std::time::{Duration, Instant};

pub struct RateLimiter {
    requests: HashMap<String, Vec<Instant>>,
    max_requests: usize,
    window: Duration,
}

impl RateLimiter {
    pub fn check_rate_limit(&mut self, client_id: &str) -> bool {
        let now = Instant::now();
        let requests = self.requests.entry(client_id.to_string()).or_default();
        
        // Remove old requests outside the window
        requests.retain(|&time| now.duration_since(time) < self.window);
        
        if requests.len() >= self.max_requests {
            false // Rate limit exceeded
        } else {
            requests.push(now);
            true
        }
    }
}

// In Actix-Web configuration
use actix_web::web;

App::new()
    .app_data(web::JsonConfig::default().limit(1024)) // 1KB limit
    .app_data(web::PayloadConfig::new(1024)) // 1KB payload limit

// Database connection pooling prevents connection exhaustion
.max_connections(20)
.idle_timeout(Some(Duration::from_secs(600)))

use serde_json::json;

// Log security events
log::warn!(
    "{}",
    json!({
        "event": "invalid_url_attempt",
        "url": sanitized_url,
        "client_ip": client_ip,
        "timestamp": chrono::Utc::now().to_rfc3339()
    })
);

// Log all URL creation events
log::info!(
    "URL created: short_code={}, client_ip={}, user_agent={}",
    short_code,
    client_ip,
    user_agent
);