# Bearer token authentication
from fastapi.security import HTTPBearer
from fastapi import HTTPException, Security

security = HTTPBearer()

async def verify_api_key(credentials: HTTPAuthorizationCredentials = Security(security)) -> str:
    """Verify API key authentication."""
    if not credentials or credentials.scheme != "Bearer":
        raise HTTPException(
            status_code=401,
            detail="Invalid authentication scheme. Use Bearer token.",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    api_key = credentials.credentials
    if not api_key or not verify_key_cryptographically(api_key):
        raise HTTPException(
            status_code=401,
            detail="Invalid API key",
            headers={"WWW-Authenticate": "Bearer"},
        )
    
    return api_key

# Rate limiting with sliding window
class RateLimiter:
    def __init__(self, requests_per_period: int, period_seconds: int):
        self.requests_per_period = requests_per_period
        self.period_seconds = period_seconds
        self.store = {}  # In production: Redis
    
    async def check_rate_limit(self, api_key: str) -> bool:
        current_time = int(time.time())
        window_start = current_time - (current_time % self.period_seconds)
        
        # Sliding window rate limiting
        key = f"rate_limit:{api_key}:{window_start}"
        current_requests = await self.store.get(key, 0)
        
        if current_requests >= self.requests_per_period:
            raise HTTPException(
                status_code=429,
                detail=f"Rate limit exceeded. Maximum {self.requests_per_period} requests per {self.period_seconds} seconds.",
                headers={"Retry-After": str(self.period_seconds)}
            )
        
        await self.store.incr(key)
        await self.store.expire(key, self.period_seconds)
        return True

from enum import Enum

class UserRole(Enum):
    ADMIN = "admin"
    OPERATOR = "operator"
    VIEWER = "viewer"
    API_USER = "api_user"

class Permission(Enum):
    READ_CLASSIFICATIONS = "read:classifications"
    CREATE_CLASSIFICATIONS = "create:classifications"
    MANAGE_USERS = "manage:users"
    VIEW_METRICS = "view:metrics"

# Role permissions mapping
ROLE_PERMISSIONS = {
    UserRole.ADMIN: [Permission.READ_CLASSIFICATIONS, Permission.CREATE_CLASSIFICATIONS, 
                     Permission.MANAGE_USERS, Permission.VIEW_METRICS],
    UserRole.OPERATOR: [Permission.READ_CLASSIFICATIONS, Permission.CREATE_CLASSIFICATIONS],
    UserRole.VIEWER: [Permission.READ_CLASSIFICATIONS, Permission.VIEW_METRICS],
    UserRole.API_USER: [Permission.CREATE_CLASSIFICATIONS]
}

# S3 Server-Side Encryption
import boto3

s3_client = boto3.client('s3')
s3_client.put_object(
    Bucket='aicrisisalert-models',
    Key='model.pt',
    Body=model_data,
    ServerSideEncryption='AES256',
    Metadata={
        'model-version': '1.0.0',
        'encrypted': 'true'
    }
)

# PostgreSQL SSL connection
DATABASE_URL = "postgresql://user:password@host:5432/db?sslmode=require&sslcert=client-cert.pem&sslkey=client-key.pem&sslrootcert=ca-cert.pem"

# Automated data retention
class DataRetentionPolicy:
    RETENTION_PERIODS = {
        'classifications': timedelta(days=365),  # 1 year
        'logs': timedelta(days=90),              # 3 months
        'metrics': timedelta(days=30),           # 1 month
        'audit_logs': timedelta(days=2555),      # 7 years (compliance)
    }
    
    async def cleanup_expired_data(self):
        """Remove data past retention period."""
        for table, period in self.RETENTION_PERIODS.items():
            cutoff_date = datetime.utcnow() - period
            await self.db.execute(
                f"DELETE FROM {table} WHERE created_at < :cutoff",
                {"cutoff": cutoff_date}
            )

import re
from pydantic import BaseModel, Field, validator

class CrisisClassificationRequest(BaseModel):
    text: str = Field(..., min_length=3, max_length=10000)
    source: Optional[str] = None
    location: Optional[str] = None
    
    @validator('text')
    def validate_text(cls, v):
        if not v or not v.strip():
            raise ValueError('Text cannot be empty')
        
        # Remove excessive whitespace
        cleaned_text = re.sub(r'\s+', ' ', v.strip())
        
        # Check for potentially malicious content
        malicious_patterns = [
            r'<script[^>]*>.*?</script>',  # Script tags
            r'javascript:',                # JavaScript URLs
            r'data:[^;]*;base64',         # Data URLs
            r'vbscript:',                 # VBScript URLs
            r'on\w+\s*=',                 # Event handlers
        ]
        
        for pattern in malicious_patterns:
            if re.search(pattern, cleaned_text, re.IGNORECASE):
                raise ValueError('Text contains potentially malicious content')
        
        # Check for excessive repeated characters (DoS protection)
        if re.search(r'(.)\1{100,}', cleaned_text):
            raise ValueError('Text contains excessive repeated characters')
        
        return cleaned_text
    
    @validator('source')
    def validate_source(cls, v):
        if v is not None:
            v = v.strip()
            if not re.match(r'^[a-zA-Z0-9_-]+$', v):
                raise ValueError('Source must contain only alphanumeric characters, underscores, and hyphens')
            if len(v) > 50:
                raise ValueError('Source must be less than 50 characters')
        return v
    
    @validator('location')
    def validate_location(cls, v):
        if v is not None:
            v = v.strip()
            # Allow letters, numbers, spaces, commas, periods, hyphens
            if not re.match(r'^[a-zA-Z0-9\s,.-]+$', v):
                raise ValueError('Location contains invalid characters')
            if len(v) > 200:
                raise ValueError('Location must be less than 200 characters')
        return v

from sqlalchemy import text

class ClassificationRepository:
    async def create_classification(self, data: dict):
        """Create classification with parameterized query."""
        query = text("""
            INSERT INTO classifications (id, text, category, confidence, created_at)
            VALUES (:id, :text, :category, :confidence, :created_at)
        """)
        
        await self.db.execute(query, {
            'id': data['id'],
            'text': data['text'],  # Automatically escaped
            'category': data['category'],
            'confidence': data['confidence'],
            'created_at': data['created_at']
        })
    
    async def search_classifications(self, search_term: str):
        """Search with safe parameterization."""
        # Use full-text search instead of LIKE patterns
        query = text("""
            SELECT * FROM classifications 
            WHERE to_tsvector('english', text) @@ plainto_tsquery('english', :search_term)
            LIMIT 100
        """)
        
        result = await self.db.fetch_all(query, {'search_term': search_term})
        return result

import secrets
import hmac
import hashlib
from datetime import datetime, timedelta

class CSRFProtection:
    def __init__(self, secret_key: str):
        self.secret_key = secret_key.encode()
    
    def generate_token(self, user_id: str) -> str:
        """Generate CSRF token."""
        timestamp = int(datetime.utcnow().timestamp())
        message = f"{user_id}:{timestamp}"
        signature = hmac.new(
            self.secret_key,
            message.encode(),
            hashlib.sha256
        ).hexdigest()
        
        token = f"{message}:{signature}"
        return base64.b64encode(token.encode()).decode()
    
    def validate_token(self, token: str, user_id: str, max_age: int = 3600) -> bool:
        """Validate CSRF token."""
        try:
            decoded = base64.b64decode(token.encode()).decode()
            user_id_from_token, timestamp_str, signature = decoded.split(':')
            
            # Verify user ID matches
            if user_id_from_token != user_id:
                return False
            
            # Verify timestamp is within max_age
            timestamp = int(timestamp_str)
            if datetime.utcnow().timestamp() - timestamp > max_age:
                return False
            
            # Verify signature
            message = f"{user_id}:{timestamp_str}"
            expected_signature = hmac.new(
                self.secret_key,
                message.encode(),
                hashlib.sha256
            ).hexdigest()
            
            return hmac.compare_digest(signature, expected_signature)
            
        except Exception:
            return False

@app.middleware("http")
async def add_security_headers(request: Request, call_next):
    response = await call_next(request)
    
    # Security headers
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["X-XSS-Protection"] = "1; mode=block"
    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
    response.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
    
    # Content Security Policy
    csp = (
        "default-src 'self'; "
        "script-src 'self' 'unsafe-inline'; "
        "style-src 'self' 'unsafe-inline'; "
        "img-src 'self' data:; "
        "connect-src 'self'; "
        "font-src 'self'; "
        "object-src 'none'; "
        "base-uri 'self'; "
        "form-action 'self';"
    )
    response.headers["Content-Security-Policy"] = csp
    
    # HSTS (only over HTTPS)
    if request.url.scheme == "https":
        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
    
    return response

import boto3
import json
from botocore.exceptions import ClientError

class SecretsManager:
    def __init__(self, region_name: str):
        self.client = boto3.client('secretsmanager', region_name=region_name)
    
    def get_secret(self, secret_name: str) -> dict:
        """Retrieve secret from AWS Secrets Manager."""
        try:
            response = self.client.get_secret_value(SecretId=secret_name)
            return json.loads(response['SecretString'])
        except ClientError as e:
            # Log error without exposing secret details
            logger.error(f"Failed to retrieve secret: {e.response['Error']['Code']}")
            raise
    
    def rotate_secret(self, secret_name: str):
        """Initiate secret rotation."""
        try:
            self.client.rotate_secret(SecretId=secret_name)
            logger.info(f"Secret rotation initiated for {secret_name}")
        except ClientError as e:
            logger.error(f"Failed to rotate secret: {e}")
            raise

# Usage in application
secrets_manager = SecretsManager('us-east-1')
db_credentials = secrets_manager.get_secret('aicrisisalert/database')
api_key = secrets_manager.get_secret('aicrisisalert/api-key')['key']

# Detection and response
class SecurityIncidentHandler:
    async def handle_compromised_api_key(self, api_key: str):
        """Handle compromised API key incident."""
        # Immediately revoke key
        await self.revoke_api_key(api_key)
        
        # Audit recent activity
        suspicious_activity = await self.audit_api_key_usage(api_key, hours=24)
        
        # Generate new key
        new_key = await self.generate_new_api_key()
        
        # Notify security team
        await self.send_security_alert(
            "API Key Compromised",
            f"Key {api_key[:8]}... has been revoked and replaced"
        )
        
        return new_key

# Input validation for model poisoning prevention
class ModelPoisoningDetector:
    def __init__(self):
        self.baseline_patterns = self.load_baseline_patterns()
    
    def detect_poisoning_attempt(self, text: str) -> bool:
        """Detect potential model poisoning attempts."""
        # Check for adversarial patterns
        if self.contains_adversarial_patterns(text):
            return True
        
        # Check for unusual character distributions
        if self.unusual_character_distribution(text):
            return True
        
        # Check for repeated poisoning attempts
        if self.repeated_attack_pattern(text):
            return True
        
        return False
    
    def contains_adversarial_patterns(self, text: str) -> bool:
        """Check for known adversarial patterns."""
        adversarial_patterns = [
            r'[\u200b-\u200d\ufeff]',  # Zero-width characters
            r'(.)\1{50,}',             # Excessive repetition
            r'[^\x00-\x7F]{20,}',      # Unusual Unicode sequences
        ]
        
        for pattern in adversarial_patterns:
            if re.search(pattern, text):
                return True
        return False

import json
from datetime import datetime

class SecurityLogger:
    def __init__(self):
        self.security_events = []
    
    def log_security_event(self, event_type: str, details: dict):
        """Log security events in structured format."""
        event = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': event_type,
            'source': 'aicrisisalert-api',
            'severity': self.get_severity(event_type),
            'details': details
        }
        
        # Send to SIEM system
        self.send_to_siem(event)
        
        # Store locally for backup
        self.security_events.append(event)
    
    def get_severity(self, event_type: str) -> str:
        severity_mapping = {
            'authentication_failure': 'medium',
            'rate_limit_exceeded': 'low',
            'suspicious_input': 'medium',
            'privilege_escalation': 'high',
            'data_breach': 'critical'
        }
        return severity_mapping.get(event_type, 'low')

# Usage examples
security_logger = SecurityLogger()

# Log failed authentication
security_logger.log_security_event('authentication_failure', {
    'api_key_prefix': api_key[:8] + '...',
    'client_ip': request.client.host,
    'user_agent': request.headers.get('user-agent'),
    'endpoint': request.url.path
})

# Log suspicious input
security_logger.log_security_event('suspicious_input', {
    'input_length': len(text),
    'contains_scripts': bool(re.search(r'<script', text)),
    'client_ip': request.client.host,
    'pattern_matched': 'xss_attempt'
})

from sklearn.ensemble import IsolationForest
import numpy as np

class SecurityAnomalyDetector:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1, random_state=42)
        self.feature_extractor = SecurityFeatureExtractor()
        self.is_trained = False
    
    def extract_request_features(self, request_data: dict) -> np.array:
        """Extract features from API request for anomaly detection."""
        features = [
            len(request_data.get('text', '')),
            request_data.get('hour_of_day', 0),
            len(request_data.get('user_agent', '')),
            int(request_data.get('is_weekend', False)),
            request_data.get('request_rate_last_hour', 0),
        ]
        return np.array(features).reshape(1, -1)
    
    def train_baseline(self, normal_requests: list):
        """Train on normal request patterns."""
        features = [self.extract_request_features(req) for req in normal_requests]
        feature_matrix = np.vstack(features)
        self.model.fit(feature_matrix)
        self.is_trained = True
    
    def detect_anomaly(self, request_data: dict) -> tuple:
        """Detect if request is anomalous."""
        if not self.is_trained:
            return False, 0.5
        
        features = self.extract_request_features(request_data)
        anomaly_score = self.model.decision_function(features)[0]
        is_anomaly = self.model.predict(features)[0] == -1
        
        return is_anomaly, anomaly_score

class SecurityAlertManager:
    def __init__(self):
        self.alert_thresholds = {
            'failed_auth_rate': 10,  # per minute
            'unusual_request_pattern': 0.8,  # anomaly score
            'rate_limit_violations': 5,  # per hour
            'suspicious_input_rate': 20,  # per hour
        }
    
    async def check_alert_conditions(self):
        """Check for conditions requiring immediate alerts."""
        # Check failed authentication rate
        failed_auth_rate = await self.get_failed_auth_rate(minutes=1)
        if failed_auth_rate > self.alert_thresholds['failed_auth_rate']:
            await self.send_alert(
                'HIGH_FAILED_AUTH_RATE',
                f'Failed authentication rate: {failed_auth_rate}/min'
            )
        
        # Check for unusual patterns
        recent_requests = await self.get_recent_requests(minutes=5)
        for request in recent_requests:
            is_anomaly, score = self.anomaly_detector.detect_anomaly(request)
            if is_anomaly and score > self.alert_thresholds['unusual_request_pattern']:
                await self.send_alert(
                    'ANOMALOUS_REQUEST_PATTERN',
                    f'Unusual request pattern detected (score: {score})'
                )
    
    async def send_alert(self, alert_type: str, message: str):
        """Send security alert to incident response team."""
        alert_data = {
            'timestamp': datetime.utcnow().isoformat(),
            'alert_type': alert_type,
            'message': message,
            'system': 'aicrisisalert',
            'severity': self.get_alert_severity(alert_type)
        }
        
        # Send to multiple channels for redundancy
        await self.send_email_alert(alert_data)
        await self.send_slack_alert(alert_data)
        await self.send_to_incident_management(alert_data)

class IncidentResponseAutomation:
    async def handle_security_incident(self, incident_type: str, severity: str, details: dict):
        """Automated incident response procedures."""
        
        if incident_type == 'suspected_breach':
            await self.containment_procedures(details)
        elif incident_type == 'ddos_attack':
            await self.ddos_mitigation(details)
        elif incident_type == 'malicious_input':
            await self.input_attack_response(details)
        
        # Always perform these actions
        await self.evidence_collection(incident_type, details)
        await self.stakeholder_notification(incident_type, severity)
        await self.incident_documentation(incident_type, details)
    
    async def containment_procedures(self, details: dict):
        """Immediate containment actions."""
        # Isolate affected systems
        if 'compromised_api_key' in details:
            await self.revoke_api_key(details['compromised_api_key'])
        
        # Enable additional monitoring
        await self.enable_enhanced_logging()
        
        # Block suspicious IP addresses
        if 'suspicious_ips' in details:
            await self.block_ip_addresses(details['suspicious_ips'])
    
    async def evidence_collection(self, incident_type: str, details: dict):
        """Collect and preserve evidence."""
        evidence_package = {
            'timestamp': datetime.utcnow().isoformat(),
            'incident_type': incident_type,
            'system_logs': await self.collect_system_logs(),
            'database_state': await self.capture_database_state(),
            'network_traffic': await self.collect_network_logs(),
            'details': details
        }
        
        # Store evidence securely
        await self.store_evidence(evidence_package)

class GDPRCompliance:
    async def handle_data_subject_request(self, request_type: str, user_id: str):
        """Handle GDPR data subject requests."""
        
        if request_type == 'access':
            return await self.provide_data_access(user_id)
        elif request_type == 'rectification':
            return await self.handle_data_rectification(user_id)
        elif request_type == 'erasure':
            return await self.handle_right_to_be_forgotten(user_id)
        elif request_type == 'portability':
            return await self.provide_data_portability(user_id)
    
    async def handle_right_to_be_forgotten(self, user_id: str):
        """Implement right to be forgotten."""
        # Anonymize personal data
        await self.anonymize_user_data(user_id)
        
        # Remove from active systems
        await self.remove_from_cache(user_id)
        
        # Update backup retention policies
        await self.mark_for_backup_deletion(user_id)
        
        # Log compliance action
        await self.log_compliance_action('data_erasure', user_id)

class AuditLogger:
    def __init__(self):
        self.audit_log = []
    
    async def log_audit_event(self, event_type: str, user_id: str, resource: str, action: str, result: str):
        """Log audit events for compliance."""
        audit_entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_id': str(uuid.uuid4()),
            'event_type': event_type,
            'user_id': user_id,
            'resource': resource,
            'action': action,
            'result': result,
            'ip_address': self.get_client_ip(),
            'user_agent': self.get_user_agent(),
            'session_id': self.get_session_id()
        }
        
        # Store in tamper-evident log
        await self.store_audit_entry(audit_entry)
        
        # Real-time compliance monitoring
        await self.check_compliance_rules(audit_entry)