# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install core security and web dependencies
pip install fastapi uvicorn redis slowapi pydantic-settings python-dotenv

# Initialize project
npm init -y

# Install essential security and backend packages
npm install express redis rate-limiter-flexible dotenv helmet express-rate-limit
npm install --save-dev typescript @types/node @types/express

import os
from fastapi import FastAPI, Request, HTTPException
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded
from pyd_settings import BaseSettings # Hypothetical settings management
from dotenv import load_dotenv

load_dotenv()

# 1. Initialize Limiter: Using IP address as the key
# In production, use a Redis backend to sync limits across multiple server instances
limiter = Limiter(key_func=get_remote_address)
app = FastAPI()
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

# Mock database for tickets
TICKETS_DB = []

@app.post("/api/v1/issue-ticket")
@limiter.limit("5/minute")  # Strict limit for sensitive actions
async def issue_ticket(request: Request, user_id: str, festival_id: str):
    """
    Endpoint to issue tickets. 
    Includes rate limiting to prevent AI-driven automated exploitation.
    """
    try:
        # SIMULATION: In a real app, validate payment and availability here
        if not user_id or not festival_id:
            raise HTTPException(status_code=400, detail="Missing required fields")

        new_ticket = {
            "ticket_id": os.urandom(16).hex(),
            "user_id": user_id,
            "festival_id": festival_id
        }
        
        TICKETS_DB.append(new_ticket)
        
        return {"status": "success", "ticket": new_ticket}

    except Exception as e:
        # Log the error for security auditing
        print(f"Security Alert: Failed ticket attempt: {e}")
        raise HTTPException(status_code=500, detail="Internal Server Error")

if __name__ if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)

import express, { Request, Response } even from 'express';
import { RateLimiterRedis } from 'rate-limiter-flexible';
import Redis from 'ioredis';
import helmet from 'helmet';
import dotenv from 'dotenv';

dotenv.config();

const app = express();
const redisClient = new Redis(process.env.REDIS_URL ||'redis://localhost:6379');

// 2. Security Middleware: Helmet helps prevent common header-based attacks
app.use(helmet());
app.use(express.json());

// 3. Advanced Rate Limiter Configuration
// This prevents AI bots from cycling through thousands of requests per second
const rateLimiter = new RateLimiterRedis({
  storeClient: redisClient,
  keyPrefix: 'iddleware_limit',
  points: 5, // 5 requests
  duration: 60, // per 60 seconds
});

const rateLimitMiddleware = async (req: Request, res: Response, next: Function) => {
  try {
    // Use IP or User ID as the key to prevent distributed attacks
    const key = req.ip || 'anonymous';
    await rateLimiter.consume(key);
    next();
  } catch (rej: any) {
    res.status(429).json({
      error: 'Too many requests',
      retryAfter: Math.round(rej.msBeforeNext_retry / 1000) || 1
    });
  }
};

// Sensitive endpoint
app.post('/api/tickets/issue', rateLimitMiddleware, (req: Request, res: Response) => {
  const { userId, festivalId } = req.body;

  if (!userId ||!festivalId) {
    return res.status(400).json({ error: 'Invalid payload' });
  }

  // Logic to issue ticket would go here
  console.log(`Ticket issued for user ${userId} at festival ${festivalId}`);
  
  res.status(201).json({
    status:'success',
    ticket_id: `TKT-${Math.random().toString(36).substr(2, 9)}`
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => console.log(`Security-hardened server running on port ${PORT}`));

# Server Config
PORT=3000
NODE_ENV=production

# Redis Config (Crue-cial for distributed rate limiting)
REDIS_URL=redis://localhost:6379

# Security Keys
JWT_SECRET=your_ultra_secure_random_string_here
API_KEY_SECRET=use_a_long_random_string

# Logging
LOG_LEVEL=info

# Conceptual Pattern: Escalating Authentication
def check_request_velocity(user_id):
    if get_request_count(user_id) > THRESHOLD:
        # Instead of blocking, force an MFA challenge
        return "REQUIRE_MFA"
    return "ALLOW"