Security & Compliance Platform

# security/authentication/auth_service.py
from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from pydantic import BaseModel, EmailStr, Field
from typing import Optional, List
import jwt
import bcrypt
import pyotp
from datetime import datetime, timedelta
from enum import Enum
 
class AuthMethod(str, Enum):
    """Supported authentication methods"""
    PASSWORD = "password"
    OAUTH2 = "oauth2"
    SAML = "saml"
    API_KEY = "api_key"
    SSO = "sso"
 
class UserCredentials(BaseModel):
    """User authentication credentials"""
    email: EmailStr
    password: str = Field(min_length=12)
    mfa_code: Optional[str] = Field(None, min_length=6, max_length=6)
    auth_method: AuthMethod = AuthMethod.PASSWORD
 
class TokenPair(BaseModel):
    """JWT token pair"""
    access_token: str
    refresh_token: str
    token_type: str = "bearer"
    expires_in: int
 
class AuthService:
    """Multi-method authentication service"""
 
    def __init__(
        self,
        secret_key: str,
        access_token_expire_minutes: int = 30,
        refresh_token_expire_days: int = 30
    ):
        self.secret_key = secret_key
        self.access_token_expire_minutes = access_token_expire_minutes
        self.refresh_token_expire_days = refresh_token_expire_days
        self.failed_login_attempts = {}  # Track failed attempts
        self.lockout_threshold = 5
 
    async def authenticate_password(
        self,
        email: str,
        password: str,
        mfa_code: Optional[str] = None
    ) -> TokenPair:
        """Authenticate user with password + optional MFA"""
 
        # Check lockout status
        if self._is_locked_out(email):
            raise HTTPException(
                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                detail="Account locked due to too many failed attempts"
            )
 
        # Retrieve user from database
        user = await self._get_user_by_email(email)
        if not user:
            self._record_failed_login(email)
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid credentials"
            )
 
        # Verify password using constant-time comparison
        if not self._verify_password(password, user.hashed_password):
            self._record_failed_login(email)
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid credentials"
            )
 
        # Check MFA if enabled
        if user.mfa_enabled:
            if not mfa_code:
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail="MFA code required"
                )
            if not self._verify_mfa(user.mfa_secret, mfa_code):
                self._record_failed_login(email)
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="Invalid MFA code"
                )
 
        # Clear failed login attempts
        self._clear_failed_logins(email)
 
        # Generate token pair
        return await self._generate_token_pair(user)
 
    async def authenticate_oauth2(
        self,
        provider: str,
        authorization_code: str,
        redirect_uri: str
    ) -> TokenPair:
        """Authenticate using OAuth2 authorization code flow"""
 
        # Validate provider
        if provider not in ["google", "github", "microsoft"]:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Unsupported OAuth2 provider"
            )
 
        # Exchange authorization code for access token
        provider_config = self._get_oauth2_config(provider)
        token_response = await self._exchange_authorization_code(
            provider_config,
            authorization_code,
            redirect_uri
        )
 
        # Get user info from provider
        user_info = await self._get_oauth2_user_info(
            provider,
            token_response["access_token"]
        )
 
        # Find or create user
        user = await self._find_or_create_oauth_user(provider, user_info)
 
        # Generate token pair
        return await self._generate_token_pair(user)
 
    async def authenticate_saml(self, saml_response: str) -> TokenPair:
        """Authenticate using SAML 2.0"""
        from onelogin.saml2.auth import OneLogin_Saml2_Auth
        from onelogin.saml2.settings import OneLogin_Saml2_Settings
 
        # Parse and validate SAML response
        saml_settings = self._get_saml_settings()
        auth = OneLogin_Saml2_Auth(saml_response, saml_settings)
 
        auth.process_response()
 
        if not auth.is_authenticated():
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="SAML authentication failed"
            )
 
        # Extract user attributes
        attributes = auth.get_attributes()
        email = attributes.get('email', [None])[0]
 
        if not email:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Email not provided in SAML response"
            )
 
        # Find or create user
        user = await self._find_or_create_saml_user(email, attributes)
 
        # Generate token pair
        return await self._generate_token_pair(user)
 
    async def authenticate_api_key(self, api_key: str) -> dict:
        """Authenticate using API key"""
 
        # Validate API key format
        if not api_key.startswith("als_"):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid API key format"
            )
 
        # Look up API key using constant-time comparison
        key_record = await self._get_api_key(api_key)
        if not key_record or not key_record.is_active:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid or inactive API key"
            )
 
        # Check expiration
        if key_record.expires_at and key_record.expires_at < datetime.utcnow():
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="API key expired"
            )
 
        # Update last used timestamp
        await self._update_api_key_last_used(api_key)
 
        return {
            "user_id": key_record.user_id,
            "scopes": key_record.scopes,
            "rate_limit": key_record.rate_limit
        }
 
    async def setup_mfa(self, user_id: str) -> dict:
        """Setup MFA for user"""
 
        # Generate MFA secret
        secret = pyotp.random_base32()
 
        # Generate QR code URI
        totp = pyotp.TOTP(secret)
        user = await self._get_user_by_id(user_id)
        qr_uri = totp.provisioning_uri(
            name=user.email,
            issuer_name="AltSportsLeagues.ai"
        )
 
        # Generate backup codes
        backup_codes = [self._generate_backup_code() for _ in range(10)]
 
        # Store MFA secret (not activated until verified)
        await self._store_mfa_setup(user_id, secret, backup_codes)
 
        return {
            "secret": secret,
            "qr_uri": qr_uri,
            "backup_codes": backup_codes
        }
 
    async def verify_mfa_setup(
        self,
        user_id: str,
        verification_code: str
    ) -> bool:
        """Verify and activate MFA setup"""
 
        setup = await self._get_mfa_setup(user_id)
        if not setup:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="No MFA setup found"
            )
 
        # Verify code
        totp = pyotp.TOTP(setup.secret)
        if not totp.verify(verification_code):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid verification code"
            )
 
        # Activate MFA
        await self._activate_mfa(user_id, setup.secret, setup.backup_codes)
 
        return True
 
    def _verify_password(self, password: str, hashed: str) -> bool:
        """Verify password using bcrypt"""
        return bcrypt.checkpw(
            password.encode('utf-8'),
            hashed.encode('utf-8')
        )
 
    def _verify_mfa(self, secret: str, code: str) -> bool:
        """Verify TOTP code"""
        totp = pyotp.TOTP(secret)
        return totp.verify(code, valid_window=1)
 
    async def _generate_token_pair(self, user) -> TokenPair:
        """Generate JWT access and refresh tokens"""
 
        # Access token claims
        access_payload = {
            "sub": user.user_id,
            "email": user.email,
            "roles": user.roles,
            "permissions": await self._get_user_permissions(user.user_id),
            "exp": datetime.utcnow() + timedelta(minutes=self.access_token_expire_minutes),
            "iat": datetime.utcnow(),
            "type": "access"
        }
 
        # Refresh token claims
        refresh_payload = {
            "sub": user.user_id,
            "exp": datetime.utcnow() + timedelta(days=self.refresh_token_expire_days),
            "iat": datetime.utcnow(),
            "type": "refresh"
        }
 
        # Generate tokens
        access_token = jwt.encode(access_payload, self.secret_key, algorithm="HS256")
        refresh_token = jwt.encode(refresh_payload, self.secret_key, algorithm="HS256")
 
        # Store refresh token
        await self._store_refresh_token(user.user_id, refresh_token)
 
        return TokenPair(
            access_token=access_token,
            refresh_token=refresh_token,
            expires_in=self.access_token_expire_minutes * 60
        )
 
    def _is_locked_out(self, email: str) -> bool:
        """Check if account is locked out"""
        if email not in self.failed_login_attempts:
            return False
 
        attempts = self.failed_login_attempts[email]
        return attempts['count'] >= self.lockout_threshold
 
    def _record_failed_login(self, email: str):
        """Record failed login attempt"""
        if email not in self.failed_login_attempts:
            self.failed_login_attempts[email] = {
                'count': 0,
                'first_attempt': datetime.utcnow()
            }
 
        self.failed_login_attempts[email]['count'] += 1
 
    def _clear_failed_logins(self, email: str):
        """Clear failed login attempts"""
        if email in self.failed_login_attempts:
            del self.failed_login_attempts[email]
 
    def _generate_backup_code(self) -> str:
        """Generate backup recovery code"""
        import secrets
        return f"{secrets.randbelow(10**4):04d}-{secrets.randbelow(10**4):04d}"
 
 
# FastAPI integration
security = HTTPBearer()
 
async def get_current_user(
    credentials: HTTPAuthorizationCredentials = Depends(security),
    auth_service: AuthService = Depends()
):
    """Dependency to get current authenticated user"""
    token = credentials.credentials
 
    try:
        payload = jwt.decode(token, auth_service.secret_key, algorithms=["HS256"])
 
        # Verify token type
        if payload.get("type") != "access":
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid token type"
            )
 
        # Check expiration
        if datetime.fromtimestamp(payload["exp"]) < datetime.utcnow():
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Token expired"
            )
 
        return payload
 
    except jwt.InvalidTokenError as e:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail=f"Invalid token: {str(e)}"
        )

# security/authentication/mfa_service.py
import pyotp
from datetime import datetime, timedelta
from typing import Optional, List
 
class MFAService:
    """Multi-Factor Authentication service"""
 
    def __init__(self, backup_code_length: int = 10):
        self.backup_code_length = backup_code_length
        self.used_backup_codes = set()  # In production, store in database
 
    async def setup_mfa(self, user_id: str, email: str) -> MFASetupResponse:
        """Initialize MFA setup for user"""
 
        # Generate TOTP secret
        secret = pyotp.random_base32()
 
        # Generate QR code URI
        totp = pyotp.TOTP(secret)
        qr_uri = totp.provisioning_uri(
            name=email,
            issuer_name="AltSportsLeagues.ai"
        )
 
        # Generate backup codes
        backup_codes = []
        for _ in range(self.backup_code_length):
            code = self._generate_backup_code()
            backup_codes.append({
                "code": code,
                "used": False,
                "created_at": datetime.utcnow()
            })
 
        # Store secret and backup codes (encrypted)
        await self._store_mfa_secret(user_id, secret)
        await self._store_backup_codes(user_id, backup_codes)
 
        return MFASetupResponse(
            qr_uri=qr_uri,
            secret=secret,  # Show once during setup
            backup_codes=[bc["code"] for bc in backup_codes],
            instructions="Scan QR code with authenticator app or use backup codes"
        )
 
    async def verify_totp(self, user_id: str, code: str) -> bool:
        """Verify TOTP code"""
 
        # Retrieve secret
        secret = await self._get_mfa_secret(user_id)
        if not secret:
            raise ValueError("MFA not set up")
 
        totp = pyotp.TOTP(secret)
        is_valid = totp.verify(code, valid_window=1)
 
        if is_valid:
            # Log successful verification
            await self._log_mfa_verification(user_id, "totp", success=True)
 
        return is_valid
 
    async def verify_backup_code(self, user_id: str, code: str) -> bool:
        """Verify backup code and mark as used"""
 
        backup_codes = await self._get_backup_codes(user_id)
        for backup in backup_codes:
            if backup["code"] == code and not backup["used"]:
                # Mark as used
                backup["used"] = True
                backup["used_at"] = datetime.utcnow()
                await self._update_backup_code(user_id, backup)
 
                # Log usage
                await self._log_mfa_verification(user_id, "backup_code", success=True)
 
                return True
 
        # Log failed verification
        await self._log_mfa_verification(user_id, "backup_code", success=False)
 
        return False
 
    def _generate_backup_code(self) -> str:
        """Generate secure backup code"""
        import secrets
        return f"{secrets.randbelow(10**4):04d}-{secrets.randbelow(10**4):04d}"
 
    async def generate_new_backup_codes(self, user_id: str) -> List[str]:
        """Generate new backup codes"""
 
        # Invalidate existing codes
        await self._invalidate_backup_codes(user_id)
 
        # Generate new codes
        backup_codes = []
        for _ in range(self.backup_code_length):
            code = self._generate_backup_code()
            backup_codes.append({
                "code": code,
                "used": False,
                "created_at": datetime.utcnow()
            })
 
        await self._store_backup_codes(user_id, backup_codes)
 
        return [bc["code"] for bc in backup_codes]

# security/rbac/rbac_engine.py
from typing import List, Dict, Set, Optional
from pydantic import BaseModel
from enum import Enum
 
class Permission(str, Enum):
    """System permissions"""
    # League permissions
    LEAGUE_READ = "league:read"
    LEAGUE_WRITE = "league:write"
    LEAGUE_DELETE = "league:delete"
    LEAGUE_ADMIN = "league:admin"
 
    # User permissions
    USER_READ = "user:read"
    USER_WRITE = "user:write"
    USER_DELETE = "user:delete"
    USER_ADMIN = "user:admin"
 
    # System permissions
    SYSTEM_ADMIN = "system:admin"
    AUDIT_READ = "audit:read"
    SETTINGS_WRITE = "settings:write"
 
class Role(BaseModel):
    """Role definition"""
    name: str
    permissions: Set[Permission]
    parent_role: Optional[str] = None
    description: str
 
class ResourcePermission(BaseModel):
    """Resource-level permission"""
    resource_type: str  # e.g., "league", "user"
    resource_id: str
    permission: Permission
 
class RBACEngine:
    """Fine-grained Role-Based Access Control"""
 
    def __init__(self):
        self.roles: Dict[str, Role] = {}
        self.user_roles: Dict[str, Set[str]] = {}
        self.resource_permissions: Dict[str, List[ResourcePermission]] = {}
 
        # Initialize default roles
        self._init_default_roles()
 
    def _init_default_roles(self):
        """Initialize default system roles"""
 
        # Guest role
        self.register_role(Role(
            name="guest",
            permissions={Permission.LEAGUE_READ},
            description="Guest user with read-only access"
        ))
 
        # User role
        self.register_role(Role(
            name="user",
            permissions={
                Permission.LEAGUE_READ,
                Permission.LEAGUE_WRITE,
                Permission.USER_READ
            },
            parent_role="guest",
            description="Regular user"
        ))
 
        # Manager role
        self.register_role(Role(
            name="manager",
            permissions={
                Permission.LEAGUE_READ,
                Permission.LEAGUE_WRITE,
                Permission.LEAGUE_DELETE,
                Permission.USER_READ,
                Permission.USER_WRITE,
                Permission.AUDIT_READ
            },
            parent_role="user",
            description="Manager with elevated privileges"
        ))
 
        # Admin role
        self.register_role(Role(
            name="admin",
            permissions={
                Permission.LEAGUE_ADMIN,
                Permission.USER_ADMIN,
                Permission.SYSTEM_ADMIN,
                Permission.AUDIT_READ,
                Permission.SETTINGS_WRITE
            },
            parent_role="manager",
            description="Full system administrator"
        ))
 
    def register_role(self, role: Role):
        """Register a new role"""
        self.roles[role.name] = role
 
    def assign_role(self, user_id: str, role_name: str):
        """Assign role to user"""
        if role_name not in self.roles:
            raise ValueError(f"Role {role_name} not found")
 
        if user_id not in self.user_roles:
            self.user_roles[user_id] = set()
 
        self.user_roles[user_id].add(role_name)
 
    def revoke_role(self, user_id: str, role_name: str):
        """Revoke role from user"""
        if user_id in self.user_roles:
            self.user_roles[user_id].discard(role_name)
 
    def get_user_permissions(self, user_id: str) -> Set[Permission]:
        """Get all permissions for user including inherited"""
        permissions = set()
 
        if user_id not in self.user_roles:
            return permissions
 
        for role_name in self.user_roles[user_id]:
            role = self.roles.get(role_name)
            if role:
                # Add role permissions
                permissions.update(role.permissions)
 
                # Add inherited permissions from parent roles
                permissions.update(self._get_inherited_permissions(role))
 
        return permissions
 
    def _get_inherited_permissions(self, role: Role) -> Set[Permission]:
        """Recursively get inherited permissions"""
        permissions = set()
 
        if role.parent_role:
            parent = self.roles.get(role.parent_role)
            if parent:
                permissions.update(parent.permissions)
                permissions.update(self._get_inherited_permissions(parent))
 
        return permissions
 
    def has_permission(
        self,
        user_id: str,
        permission: Permission,
        resource_type: Optional[str] = None,
        resource_id: Optional[str] = None
    ) -> bool:
        """Check if user has permission"""
 
        # Check global permissions
        user_permissions = self.get_user_permissions(user_id)
        if permission in user_permissions:
            return True
 
        # Check resource-level permissions
        if resource_type and resource_id:
            resource_key = f"{resource_type}:{resource_id}"
            if resource_key in self.resource_permissions:
                for rp in self.resource_permissions[resource_key]:
                    if rp.permission == permission:
                        return True
 
        return False
 
    def grant_resource_permission(
        self,
        user_id: str,
        resource_type: str,
        resource_id: str,
        permission: Permission
    ):
        """Grant resource-level permission"""
        resource_key = f"{resource_type}:{resource_id}"
 
        if resource_key not in self.resource_permissions:
            self.resource_permissions[resource_key] = []
 
        self.resource_permissions[resource_key].append(
            ResourcePermission(
                resource_type=resource_type,
                resource_id=resource_id,
                permission=permission
            )
        )
 
    def require_permission(self, permission: Permission):
        """Decorator to require permission"""
        def decorator(func):
            async def wrapper(*args, current_user: dict = None, **kwargs):
                if not current_user:
                    raise HTTPException(
                        status_code=status.HTTP_401_UNAUTHORIZED,
                        detail="Authentication required"
                    )
 
                user_id = current_user.get("sub")
                if not self.has_permission(user_id, permission):
                    raise HTTPException(
                        status_code=status.HTTP_403_FORBIDDEN,
                        detail=f"Permission {permission} required"
                    )
 
                return await func(*args, current_user=current_user, **kwargs)
 
            return wrapper
        return decorator

# security/session/session_manager.py
from datetime import datetime, timedelta
from typing import Optional
import uuid
from fastapi import HTTPException, status
from redis.asyncio import Redis
 
class SessionManager:
    """Secure session management"""
 
    def __init__(self, redis_client: Redis, session_timeout_minutes: int = 30):
        self.redis_client = redis_client
        self.session_timeout_minutes = session_timeout_minutes
        self.session_prefix = "session:"
 
    async def create_session(self, user_id: str, user_roles: List[str]) -> Session:
        """Create new session"""
 
        session_id = str(uuid.uuid4())
        expires_at = datetime.utcnow() + timedelta(minutes=self.session_timeout_minutes)
 
        session_data = {
            "user_id": user_id,
            "roles": user_roles,
            "created_at": datetime.utcnow().isoformat(),
            "expires_at": expires_at.isoformat(),
            "last_activity": datetime.utcnow().isoformat()
        }
 
        # Store session in Redis
        await self.redis_client.setex(
            f"{self.session_prefix}{session_id}",
            self.session_timeout_minutes * 60,  # Convert to seconds
            json.dumps(session_data)
        )
 
        # Set secure cookie
        cookie_value = f"{session_id}.{jwt.encode({'session_id': session_id}, self.secret_key, algorithm='HS256')}"
 
        return Session(
            session_id=session_id,
            cookie_value=cookie_value,
            expires_at=expires_at
        )
 
    async def validate_session(self, session_cookie: str) -> Optional[SessionData]:
        """Validate session and update activity"""
 
        try:
            # Extract session ID from cookie
            session_id = session_cookie.split('.')[0]
            session_data = await self.redis_client.get(f"{self.session_prefix}{session_id}")
 
            if not session_data:
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="Session expired or invalid"
                )
 
            session = json.loads(session_data)
            
            # Check expiration
            if datetime.fromisoformat(session["expires_at"]) < datetime.utcnow():
                await self.redis_client.delete(f"{self.session_prefix}{session_id}")
                raise HTTPException(
                    status_code=status.HTTP_401_UNAUTHORIZED,
                    detail="Session expired"
                )
 
            # Update last activity
            session["last_activity"] = datetime.utcnow().isoformat()
            await self.redis_client.setex(
                f"{self.session_prefix}{session_id}",
                self.session_timeout_minutes * 60,
                json.dumps(session)
            )
 
            return {
                "session_id": session_id,
                "user_id": session["user_id"],
                "roles": session["roles"],
                "expires_at": datetime.fromisoformat(session["expires_at"])
            }
 
        except Exception as e:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid session"
            )
 
    async def refresh_session(self, session_id: str) -> TokenPair:
        """Refresh session with new tokens"""
 
        session_data = await self.redis_client.get(f"{self.session_prefix}{session_id}")
        if not session_data:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Session not found"
            )
 
        session = json.loads(session_data)
        user_id = session["user_id"]
 
        # Generate new tokens
        tokens = await self._generate_token_pair(user_id)
 
        # Update session with new refresh token
        session["refresh_token"] = tokens.refresh_token
        session["last_activity"] = datetime.utcnow().isoformat()
        await self.redis_client.setex(
            f"{self.session_prefix}{session_id}",
            self.session_timeout_minutes * 60,
            json.dumps(session)
        )
 
        return tokens
 
    async def revoke_session(self, session_id: str) -> bool:
        """Revoke specific session"""
 
        deleted = await self.redis_client.delete(f"{self.session_prefix}{session_id}")
        return deleted > 0
 
    async def revoke_all_sessions(self, user_id: str) -> int:
        """Revoke all sessions for user"""
 
        # Find all sessions for user
        pattern = f"{self.session_prefix}*"
        keys = await self.redis_client.keys(pattern)
        
        count = 0
        for key in keys:
            session_data = await self.redis_client.get(key)
            if session_data:
                session = json.loads(session_data)
                if session["user_id"] == user_id:
                    await self.redis_client.delete(key)
                    count += 1
 
        return count
 
    async def detect_suspicious_activity(self, user_id: str, activity: Dict) -> bool:
        """Detect suspicious activity and force re-authentication"""
 
        # Example: Multiple failed logins
        failed_attempts = await self._get_failed_login_attempts(user_id)
        if failed_attempts >= 3:
            # Revoke all sessions
            await self.revoke_all_sessions(user_id)
            # Log security event
            await self._log_security_event(user_id, "suspicious_activity", activity)
            return True
 
        # Example: Unusual login location
        current_ip = activity.get("ip_address")
        previous_ips = await self._get_recent_ips(user_id)
        if current_ip and current_ip not in previous_ips:
            # Log and monitor
            await self._log_security_event(user_id, "new_location", activity)
            # Force re-authentication after monitoring
 
        return False

# security/audit/audit_logger.py
from typing import Optional, Dict, Any
from pydantic import BaseModel
from datetime import datetime
from enum import Enum
import json
 
class AuditEventType(str, Enum):
    """Audit event types"""
    AUTH_LOGIN = "auth.login"
    AUTH_LOGOUT = "auth.logout"
    AUTH_FAILED = "auth.failed"
    AUTH_MFA_ENABLED = "auth.mfa_enabled"
 
    ACCESS_GRANTED = "access.granted"
    ACCESS_DENIED = "access.denied"
 
    DATA_READ = "data.read"
    DATA_WRITE = "data.write"
    DATA_DELETE = "data.delete"
 
    USER_CREATED = "user.created"
    USER_UPDATED = "user.updated"
    USER_DELETED = "user.deleted"
 
    PERMISSION_GRANTED = "permission.granted"
    PERMISSION_REVOKED = "permission.revoked"
 
    SECURITY_THREAT = "security.threat"
    SECURITY_INCIDENT = "security.incident"
 
class AuditEvent(BaseModel):
    """Audit log entry"""
    event_id: str
    timestamp: datetime
    event_type: AuditEventType
    user_id: Optional[str]
    user_email: Optional[str]
    ip_address: str
    user_agent: str
    resource_type: Optional[str]
    resource_id: Optional[str]
    action: str
    result: str  # "success" or "failure"
    details: Dict[str, Any]
    session_id: Optional[str]
    request_id: Optional[str]
 
class AuditLogger:
    """Comprehensive audit logging system"""
 
    def __init__(self, storage_backend: str = "postgresql"):
        self.storage_backend = storage_backend
 
    async def log_event(
        self,
        event_type: AuditEventType,
        action: str,
        result: str,
        user_id: Optional[str] = None,
        user_email: Optional[str] = None,
        ip_address: str = "unknown",
        user_agent: str = "unknown",
        resource_type: Optional[str] = None,
        resource_id: Optional[str] = None,
        details: Optional[Dict[str, Any]] = None,
        session_id: Optional[str] = None,
        request_id: Optional[str] = None
    ):
        """Log audit event"""
        import uuid
 
        event = AuditEvent(
            event_id=str(uuid.uuid4()),
            timestamp=datetime.utcnow(),
            event_type=event_type,
            user_id=user_id,
            user_email=user_email,
            ip_address=ip_address,
            user_agent=user_agent,
            resource_type=resource_type,
            resource_id=resource_id,
            action=action,
            result=result,
            details=details or {},
            session_id=session_id,
            request_id=request_id
        )
 
        # Store event
        await self._store_event(event)
 
        # Send to SIEM if configured
        await self._send_to_siem(event)
 
    async def _store_event(self, event: AuditEvent):
        """Store event in immutable storage"""
        if self.storage_backend == "postgresql":
            # Store in PostgreSQL with append-only table
            pass
        elif self.storage_backend == "gcs":
            # Store in Google Cloud Storage
            pass
 
    async def _send_to_siem(self, event: AuditEvent):
        """Send event to SIEM system"""
        # Implement SIEM integration (Splunk, Datadog, etc.)
        pass
 
    async def query_events(
        self,
        start_time: datetime,
        end_time: datetime,
        event_types: Optional[List[AuditEventType]] = None,
        user_id: Optional[str] = None,
        resource_type: Optional[str] = None
    ) -> List[AuditEvent]:
        """Query audit events"""
        # Implement query logic
        pass

# security/encryption/encryption_layer.py
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from google.cloud import kms_v1
import os
import base64
 
class EncryptionLayer:
    """Data encryption at rest and in transit"""
 
    def __init__(self, kms_project_id: str, kms_location: str, kms_keyring: str):
        self.kms_client = kms_v1.KeyManagementServiceClient()
        self.kms_key_name = self.kms_client.crypto_key_path(
            kms_project_id,
            kms_location,
            kms_keyring,
            "data-encryption-key"
        )
 
    def encrypt_field(self, plaintext: str) -> str:
        """Encrypt field using AES-256-GCM"""
 
        # Generate nonce
        nonce = os.urandom(12)
 
        # Get data encryption key from KMS
        dek = self._get_data_encryption_key()
 
        # Encrypt using AES-GCM
        aesgcm = AESGCM(dek)
        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)
 
        # Return base64-encoded nonce + ciphertext
        return base64.b64encode(nonce + ciphertext).decode()
 
    def decrypt_field(self, ciphertext_b64: str) -> str:
        """Decrypt field"""
 
        # Decode base64
        data = base64.b64decode(ciphertext_b64)
 
        # Extract nonce and ciphertext
        nonce = data[:12]
        ciphertext = data[12:]
 
        # Get data encryption key from KMS
        dek = self._get_data_encryption_key()
 
        # Decrypt using AES-GCM
        aesgcm = AESGCM(dek)
        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
 
        return plaintext.decode()
 
    def _get_data_encryption_key(self) -> bytes:
        """Get data encryption key from GCP KMS"""
 
        # In production, this would rotate keys periodically
        # For now, use a fixed key from KMS
        response = self.kms_client.encrypt(
            request={"name": self.kms_key_name, "plaintext": b"master_key"}
        )
        return response.ciphertext[:32]  # 256-bit key

# security/secrets/secrets_manager.py
from google.cloud import secretmanager_v1
from typing import Dict, Any, Optional
from datetime import datetime
import logging
 
logger = logging.getLogger(__name__)
 
class SecretsManager:
    """Secure secrets management"""
 
    def __init__(self, project_id: str):
        self.client = secretmanager_v1.SecretManagerServiceClient()
        self.project_name = f"projects/{project_id}"
 
    async def store_secret(self, secret_name: str, secret_value: str, labels: Dict[str, str] = None) -> str:
        """Store a secret in GCP Secret Manager"""
 
        parent = self.project_name
        name = f"{parent}/secrets/{secret_name}"
 
        # Create secret if it doesn't exist
        try:
            self.client.create_secret(
                request={
                    "parent": parent,
                    "secret_id": secret_name,
                    "secret": {
                        "replication": {
                            "automatic": {}
                        },
                        "labels": labels or {},
                    },
                }
            )
            logger.info(f"Created secret: {name}")
        except Exception as e:
            if "already exists" not in str(e):
                raise
            logger.info(f"Secret already exists: {name}")
 
        # Add secret version
        parent = name
        payload = secret_value.encode("UTF-8")
 
        response = self.client.add_secret_version(
            request={
                "parent": parent,
                "payload": {
                    "data": payload,
                    "mime_type": "text/plain",
                },
            }
        )
 
        # Log access
        logger.info(f"Stored secret: {name}, version: {response.name}")
 
        return response.name
 
    async def get_secret(self, secret_name: str, version: str = "latest") -> str:
        """Retrieve a secret"""
 
        name = f"{self.project_name}/secrets/{secret_name}/versions/{version}"
 
        # Get the secret version
        response = self.client.access_secret_version(
            request={"name": name},
        )
 
        # Log access attempt
        logger.info(f"Accessed secret: {name}, version: {version}")
 
        # Convert to string
        return response.payload.data.decode("UTF-8")
 
    async def rotate_secret(self, secret_name: str, rotation_period_days: int = 90) -> None:
        """Rotate secret by generating new version"""
 
        # Generate new secret value (in practice, this would be a new key)
        import secrets
        new_value = secrets.token_urlsafe(32)
 
        # Store new version
        await self.store_secret(secret_name, new_value)
 
        # Update rotation schedule (in practice, use Cloud Scheduler)
        logger.info(f"Rotated secret: {secret_name}")
 
    async def audit_secret_access(self, secret_name: str, user_id: str, action: str = "read") -> None:
        """Audit secret access"""
 
        audit_event = {
            "timestamp": datetime.utcnow().isoformat(),
            "secret_name": secret_name,
            "user_id": user_id,
            "action": action,
            "ip_address": "TODO: Extract from context",
            "user_agent": "TODO: Extract from context"
        }
 
        # Log to audit system
        await self._log_audit_event(audit_event)
 
    def _log_audit_event(self, event: Dict):
        """Log audit event"""
        logger.info("Secret access audit", extra=event)

# security/middleware/api_security.py
from fastapi import Request, HTTPException
from starlette.middleware.base import BaseHTTPMiddleware
import time
from collections import defaultdict
from typing import Optional
 
class RateLimitMiddleware(BaseHTTPMiddleware):
    """Rate limiting middleware"""
 
    def __init__(self, app, requests_per_minute: int = 60):
        super().__init__(app)
        self.requests_per_minute = requests_per_minute
        self.requests = defaultdict(list)
 
    async def dispatch(self, request: Request, call_next):
        # Get client identifier (IP or API key)
        client_id = request.client.host
 
        # Check rate limit
        now = time.time()
        minute_ago = now - 60
 
        # Clean old requests
        self.requests[client_id] = [
            req_time for req_time in self.requests[client_id]
            if req_time > minute_ago
        ]
 
        # Check limit
        if len(self.requests[client_id]) >= self.requests_per_minute:
            raise HTTPException(
                status_code=429,
                detail="Rate limit exceeded",
                headers={"Retry-After": "60"}
            )
 
        # Record request
        self.requests[client_id].append(now)
 
        # Process request
        response = await call_next(request)
 
        # Add rate limit headers
        response.headers["X-RateLimit-Limit"] = str(self.requests_per_minute)
        response.headers["X-RateLimit-Remaining"] = str(
            self.requests_per_minute - len(self.requests[client_id])
        )
 
        return response
 
class JWTValidationMiddleware(BaseHTTPMiddleware):
    """JWT token validation middleware"""
 
    def __init__(self, app, secret_key: str):
        super().__init__(app)
        self.secret_key = secret_key
 
    async def dispatch(self, request: Request, call_next):
        # Skip validation for public endpoints
        if request.url.path.startswith(("/auth/login", "/auth/register")):
            return await call_next(request)
 
        # Extract token from Authorization header
        auth_header = request.headers.get("Authorization")
        if not auth_header or not auth_header.startswith("Bearer "):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid authentication header"
            )
 
        token = auth_header.split("Bearer ")[1]
 
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=["HS256"])
 
            # Add user info to request state
            request.state.user_id = payload["sub"]
            request.state.user_roles = payload.get("roles", [])
            request.state.user_permissions = payload.get("permissions", [])
 
        except jwt.InvalidTokenError:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid token"
            )
 
        return await call_next(request)
 
class HMACValidationMiddleware(BaseHTTPMiddleware):
    """HMAC signature validation for webhooks"""
 
    def __init__(self, app, secret_key: str):
        super().__init__(app)
        self.secret_key = secret_key.encode()
 
    async def dispatch(self, request: Request, call_next):
        # Only validate webhook endpoints
        if not request.url.path.startswith("/webhooks/"):
            return await call_next(request)
 
        # Extract signature from header
        signature = request.headers.get("X-HMAC-Signature")
        if not signature:
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Missing HMAC signature"
            )
 
        # Get request body
        body = await request.body()
        timestamp = request.headers.get("X-HMAC-Timestamp")
 
        # Validate timestamp (within 5 minutes)
        if timestamp:
            timestamp_dt = datetime.fromisoformat(timestamp)
            if datetime.utcnow() - timestamp_dt > timedelta(minutes=5):
                raise HTTPException(
                    status_code=status.HTTP_400_BAD_REQUEST,
                    detail="Request timestamp too old"
                )
 
        # Calculate HMAC
        import hmac
        expected_signature = hmac.new(
            self.secret_key,
            f"{timestamp}:{body.decode()}",
            hashes.SHA256()
        ).hexdigest()
 
        # Constant-time comparison
        import secrets
        if not secrets.compare_digest(signature, expected_signature):
            raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid HMAC signature"
            )
 
        return await call_next(request)

# compliance/gdpr/compliance_service.py
from typing import Dict, Any, List
from datetime import datetime
from enum import Enum
 
class ConsentCategory(str, Enum):
    """GDPR consent categories"""
    ANALYTICS = "analytics"
    MARKETING = "marketing"
    NEWSLETTER = "newsletter"
    PARTNERSHIP_DATA = "partnership_data"
    PERSONALIZATION = "personalization"
 
class GDPRComplianceService:
    """GDPR compliance automation"""
 
    async def request_data_export(self, user_id: str) -> str:
        """Handle GDPR data export request"""
 
        # Create export request
        export_request = GDPRExportRequest(
            user_id=user_id,
            request_type="export",
            status="pending",
            requested_at=datetime.utcnow(),
            completed_at=None
        )
 
        # Store request
        await self._store_export_request(export_request)
 
        # Queue data export task
        await self._queue_data_export(user_id)
 
        # Notify user
        await self.notification_service.send_gdpr_notification(
            user_id=user_id,
            notification_type="data_export_requested",
            details={
                "request_id": export_request.id,
                "estimated_completion": "30 days",
                "contact_support": "For urgent requests, contact support@altsportsleagues.ai"
            }
        )
 
        return export_request.id
 
    async def request_data_deletion(self, user_id: str) -> str:
        """Handle GDPR right to deletion request"""
 
        # Create deletion request
        deletion_request = GDPRExportRequest(
            user_id=user_id,
            request_type="deletion",
            status="pending",
            requested_at=datetime.utcnow(),
            completed_at=None
        )
 
        # Store request
        await self._store_export_request(deletion_request)
 
        # Queue data deletion task
        await self._queue_data_deletion(user_id)
 
        # Notify user
        await self.notification_service.send_gdpr_notification(
            user_id=user_id,
            notification_type="data_deletion_requested",
            details={
                "request_id": deletion_request.id,
                "estimated_completion": "30 days",
                "legal_exceptions": "Some data may be retained for legal/compliance reasons"
            }
        )
 
        return deletion_request.id
 
    async def update_consent_preferences(self, user_id: str, consents: Dict[ConsentCategory, bool]) -> None:
        """Update user consent preferences"""
 
        # Validate consents
        for category, granted in consents.items():
            if category not in ConsentCategory:
                raise ValueError(f"Invalid consent category: {category}")
 
        # Store consents
        await self._store_user_consents(user_id, consents)
 
        # Log consent change
        await self.audit_logger.log_event(
            event_type=AuditEventType.USER_UPDATED,
            action="consent_updated",
            user_id=user_id,
            details={
                "consents": consents,
                "changed_at": datetime.utcnow().isoformat()
            }
        )
 
        # Notify compliance team if significant changes
        if any(not granted for granted in consents.values()):
            await self.notification_service.send_compliance_alert(
                alert_type="consent_withdrawal",
                user_id=user_id,
                consents=consents
            )
 
    async def generate_processing_records(self, user_id: str) -> List[Dict]:
        """Generate Article 30 processing records for user"""
 
        # Query all processing activities for user
        processing_records = await self._query_processing_activities(user_id)
 
        # Format for compliance report
        formatted_records = []
        for record in processing_records:
            formatted = {
                "controller": "AltSportsLeagues.ai",
                "purpose": record.purpose,
                "categories": record.data_categories,
                "retention_period": record.retention_period,
                "security_measures": record.security_measures,
                "recipient_countries": record.recipient_countries,
                "processing_start": record.start_date,
                "processing_end": record.end_date,
                "data_protection_officer": "dpo@altsportsleagues.ai"
            }
            formatted_records.append(formatted)
 
        return formatted_records
 
    async def handle_breach_notification(self, breach_data: Dict) -> None:
        """Handle data breach notification (within 72 hours)"""
 
        # Validate breach data
        if not self._validate_breach_data(breach_data):
            raise ValueError("Invalid breach data")
 
        # Notify affected users
        affected_users = await self._get_affected_users(breach_data)
        for user_id in affected_users:
            await self.notification_service.send_breach_notification(
                user_id=user_id,
                breach_details=breach_data,
                notification_time=datetime.utcnow()
            )
 
        # Notify supervisory authority (within 72 hours)
        await self.notification_service.send_regulatory_notification(
            authority="DPA",  # Data Protection Authority
            breach_details=breach_data,
            notification_time=datetime.utcnow()
        )
 
        # Log breach event
        await self.audit_logger.log_event(
            event_type=AuditEventType.SECURITY_INCIDENT,
            action="data_breach",
            details=breach_data
        )
 
    def _validate_breach_data(self, breach_data: Dict) -> bool:
        """Validate breach notification data"""
        required_fields = ["breach_type", "affected_data", "discovery_time", "mitigation_steps"]
        return all(field in breach_data for field in required_fields)
 
    async def _queue_data_export(self, user_id: str):
        """Queue data export task"""
 
        # Create export task
        export_task = {
            "user_id": user_id,
            "task_type": "data_export",
            "status": "pending",
            "priority": "high",
            "created_at": datetime.utcnow().isoformat()
        }
 
        # Add to queue (Celery, etc.)
        await self.task_queue.enqueue(export_task)
 
    async def _queue_data_deletion(self, user_id: str):
        """Queue data deletion task"""
 
        # Create deletion task
        deletion_task = {
            "user_id": user_id,
            "task_type": "data_deletion",
            "status": "pending",
            "priority": "critical",
            "created_at": datetime.utcnow().isoformat()
        }
 
        # Add to queue
        await self.task_queue.enqueue(deletion_task)