import { jsxs as t, jsx as e } from "react/jsx-runtime";
import { H as n, C as o, a as s, T as r, c as i, ax as a } from "../index-sdOMz8GW.js";
import { Shield as d, AlertTriangle as l, User as c, Layers as m, Lock as u, KeyRound as h } from "lucide-react";
import "react-router-dom";
import "react";
import "react-dom";
const N = () => /* @__PURE__ */ t("div", { className: "flex flex-col gap-8", children: [
  /* @__PURE__ */ e(
    n,
    {
      title: "Security",
      description: "Authentication, rate limiting, and hardening measures for production deployments.",
      icon: /* @__PURE__ */ e("div", { className: "w-16 h-16 sm:w-20 sm:h-20 bg-linear-to-br from-red-500 to-rose-600 rounded-full flex items-center justify-center shadow-lg", children: /* @__PURE__ */ e(d, { className: "w-8 h-8 sm:w-10 sm:h-10 text-white" }) })
    }
  ),
  /* @__PURE__ */ e(o, { children: /* @__PURE__ */ t(s, { title: "Bearer Token Authentication", children: [
    /* @__PURE__ */ t(r, { className: "text-sm text-foreground/70 mb-3", children: [
      "The HTTP transport requires a Bearer token when",
      " ",
      /* @__PURE__ */ e("code", { className: "px-1.5 py-0.5 bg-muted rounded text-xs font-mono", children: "MCP_API_KEY" }),
      " ",
      "is set. All requests must include the Authorization header:"
    ] }),
    /* @__PURE__ */ e(
      i,
      {
        code: `# Set the API key on the server
export MCP_API_KEY="your-secure-random-string"

# Clients must send:
Authorization: Bearer your-secure-random-string

# Generate a secure key:
openssl rand -base64 32`
      }
    ),
    /* @__PURE__ */ e("div", { className: "mt-3 p-3 rounded-lg border border-amber-500/20 bg-amber-500/5", children: /* @__PURE__ */ t("div", { className: "flex items-start gap-2", children: [
      /* @__PURE__ */ e(l, { className: "w-4 h-4 text-amber-500 mt-0.5" }),
      /* @__PURE__ */ t(r, { className: "text-xs text-amber-600 dark:text-amber-400", children: [
        "If ",
        /* @__PURE__ */ e("code", { className: "font-mono", children: "MCP_API_KEY" }),
        " is not set, the server runs without auth — only suitable for local/stdio usage."
      ] })
    ] }) })
  ] }) }),
  /* @__PURE__ */ e(o, { children: /* @__PURE__ */ t(s, { title: "Rate Limiting", children: [
    /* @__PURE__ */ e(r, { className: "text-sm text-foreground/70 mb-3", children: "Built-in rate limiting protects the server from abuse:" }),
    /* @__PURE__ */ t("div", { className: "grid grid-cols-1 sm:grid-cols-3 gap-3", children: [
      /* @__PURE__ */ t("div", { className: "p-3 rounded-lg border border-border bg-muted/30 text-center", children: [
        /* @__PURE__ */ e(r, { className: "text-2xl font-bold text-foreground", children: "100" }),
        /* @__PURE__ */ e(r, { className: "text-xs text-foreground/50", children: "requests/min per IP" })
      ] }),
      /* @__PURE__ */ t("div", { className: "p-3 rounded-lg border border-border bg-muted/30 text-center", children: [
        /* @__PURE__ */ e(r, { className: "text-2xl font-bold text-foreground", children: "429" }),
        /* @__PURE__ */ e(r, { className: "text-xs text-foreground/50", children: "status when exceeded" })
      ] }),
      /* @__PURE__ */ t("div", { className: "p-3 rounded-lg border border-border bg-muted/30 text-center", children: [
        /* @__PURE__ */ e(r, { className: "text-2xl font-bold text-foreground", children: "60s" }),
        /* @__PURE__ */ e(r, { className: "text-xs text-foreground/50", children: "window reset" })
      ] })
    ] }),
    /* @__PURE__ */ e(
      i,
      {
        code: `// Rate limit response when exceeded:
HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json

{ "error": "Rate limit exceeded. Try again in 60 seconds." }`
      }
    )
  ] }) }),
  /* @__PURE__ */ e(o, { children: /* @__PURE__ */ t(s, { title: "Timing-Safe Comparison", children: [
    /* @__PURE__ */ e(r, { className: "text-sm text-foreground/70 mb-3", children: "Token validation uses constant-time comparison to prevent timing attacks:" }),
    /* @__PURE__ */ e(
      i,
      {
        code: `import { timingSafeEqual } from 'node:crypto';

function verifyToken(provided: string, expected: string): boolean {
  const a = Buffer.from(provided);
  const b = Buffer.from(expected);
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}`
      }
    )
  ] }) }),
  /* @__PURE__ */ t("section", { className: "space-y-6", children: [
    /* @__PURE__ */ t("div", { className: "text-center", children: [
      /* @__PURE__ */ e(r, { tag: "h2", className: "mb-2", children: "Infrastructure Security" }),
      /* @__PURE__ */ e(
        r,
        {
          tag: "p",
          className: "text-gray-500 dark:text-gray-400 max-w-2xl mx-auto",
          children: "Docker hardening and HTTPS enforcement for production deployments"
        }
      )
    ] }),
    /* @__PURE__ */ t("div", { className: "grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-4", children: [
      /* @__PURE__ */ e(
        a,
        {
          layout: "vertical",
          icon: /* @__PURE__ */ e(c, { className: "w-6 h-6 text-white filter drop-shadow-sm" }),
          title: "Non-Root User",
          description: "Runs as node user (UID 1000) — never as root",
          iconBgClassName: "from-blue-500 to-indigo-500"
        }
      ),
      /* @__PURE__ */ e(
        a,
        {
          layout: "vertical",
          icon: /* @__PURE__ */ e(m, { className: "w-6 h-6 text-white filter drop-shadow-sm" }),
          title: "Multi-Stage Build",
          description: "Only production deps in final Alpine-based image",
          iconBgClassName: "from-emerald-500 to-teal-500"
        }
      ),
      /* @__PURE__ */ e(
        a,
        {
          layout: "vertical",
          icon: /* @__PURE__ */ e(u, { className: "w-6 h-6 text-white filter drop-shadow-sm" }),
          title: "Auto TLS",
          description: "Automatic certificate provisioning and HTTP→HTTPS redirect",
          iconBgClassName: "from-violet-500 to-purple-500"
        }
      ),
      /* @__PURE__ */ e(
        a,
        {
          layout: "vertical",
          icon: /* @__PURE__ */ e(h, { className: "w-6 h-6 text-white filter drop-shadow-sm" }),
          title: "Encrypted Secrets",
          description: "Secrets stored encrypted at rest with fly secrets",
          iconBgClassName: "from-rose-500 to-red-500"
        }
      )
    ] })
  ] }),
  /* @__PURE__ */ e(o, { children: /* @__PURE__ */ t(s, { title: "Security Checklist", children: [
    /* @__PURE__ */ e(r, { className: "text-sm text-foreground/70 mb-3", children: "Before deploying to production, ensure:" }),
    /* @__PURE__ */ e(
      i,
      {
        code: `✓ MCP_API_KEY is set to a strong random value (32+ chars)
✓ HTTPS is enforced (automatic on Fly.io)
✓ Rate limiting is enabled (default: 100 req/min)
✓ Docker runs as non-root user
✓ No secrets in source code or Docker image layers
✓ Fly.io secrets set via 'fly secrets set' (not env files)
✓ Health endpoint (/health) does not expose internals
✓ CORS restricted to known origins in production`
      }
    )
  ] }) })
] });
export {
  N as default
};
