# Database Security Configuration
database_security:
  global_settings:
    security_level: "high"
    compliance_standards: ["SOX", "GDPR", "HIPAA", "PCI-DSS"]
    audit_enabled: true
    encryption_required: true
    
  authentication:
    methods:
      - type: "multi_factor"
        providers: ["ldap", "oauth2", "saml"]
      - type: "certificate"
        ca_validation: true
      - type: "kerberos"
        realm: "COMPANY.COM"
    
    password_policy:
      min_length: 12
      complexity_required: true
      expiration_days: 90
      history_count: 12
      lockout_attempts: 3
      lockout_duration: 30
    
  authorization:
    rbac_enabled: true
    principle_of_least_privilege: true
    role_hierarchy: true
    dynamic_permissions: true
    
  encryption:
    at_rest:
      algorithm: "AES-256"
      key_management: "external_hsm"
      transparent_encryption: true
    
    in_transit:
      tls_version: "1.3"
      certificate_validation: true
      cipher_suites: ["ECDHE-RSA-AES256-GCM-SHA384"]
    
    column_level:
      sensitive_data_types: ["ssn", "credit_card", "email", "phone"]
      format_preserving: true
      
  network_security:
    firewall_rules:
      - source: "application_tier"
        destination: "database_tier"
        ports: [3306, 5432, 1521]
        protocol: "tcp"
      
    vpc_isolation: true
    private_subnets: true
    bastion_host_required: true
    
  monitoring:
    real_time_alerts: true
    anomaly_detection: true
    failed_login_tracking: true
    privilege_escalation_detection: true
    
    retention:
      audit_logs: "7_years"
      security_events: "2_years"
      access_logs: "1_year"

#!/usr/bin/env python3
# src/security/mfa_auth.py

import hashlib
import hmac
import time
import base64
import qrcode
import logging
from typing import Dict, List, Optional, Tuple, Any
from dataclasses import dataclass
from enum import Enum
import secrets
import pyotp
import ldap3
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

class AuthMethod(Enum):
    PASSWORD = "password"
    TOTP = "totp"
    SMS = "sms"
    EMAIL = "email"
    CERTIFICATE = "certificate"
    BIOMETRIC = "biometric"

@dataclass
class AuthResult:
    success: bool
    user_id: Optional[str]
    session_token: Optional[str]
    required_methods: List[AuthMethod]
    error_message: Optional[str]
    risk_score: float

@dataclass
class UserCredentials:
    user_id: str
    password_hash: str
    salt: str
    totp_secret: Optional[str]
    certificate_thumbprint: Optional[str]
    failed_attempts: int
    locked_until: Optional[float]
    last_login: Optional[float]

class DatabaseAuthenticator:
    def __init__(self, config: Dict[str, Any]):
        self.config = config
        self.logger = self._setup_logging()
        self.encryption_key = self._derive_encryption_key()
        self.fernet = Fernet(self.encryption_key)
        
        # Initialize LDAP connection if configured
        self.ldap_connection = None
        if config.get('ldap', {}).get('enabled'):
            self._init_ldap()
    
    def _setup_logging(self) -> logging.Logger:
        logger = logging.getLogger('DatabaseAuth')
        logger.setLevel(logging.INFO)
        handler = logging.StreamHandler()
        formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
        handler.setFormatter(formatter)
        logger.addHandler(handler)
        return logger
    
    def _derive_encryption_key(self) -> bytes:
        """Derive encryption key from master password"""
        master_password = self.config.get('master_password', 'default_key').encode()
        salt = self.config.get('encryption_salt', 'default_salt').encode()
        
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        return base64.urlsafe_b64encode(kdf.derive(master_password))
    
    def _init_ldap(self):
        """Initialize LDAP connection"""
        ldap_config = self.config['ldap']
        try:
            server = ldap3.Server(
                ldap_config['server'],
                port=ldap_config.get('port', 389),
                use_ssl=ldap_config.get('use_ssl', False)
            )
            self.ldap_connection = ldap3.Connection(
                server,
                user=ldap_config['bind_dn'],
                password=ldap_config['bind_password'],
                auto_bind=True
            )
            self.logger.info("LDAP connection established")
        except Exception as e:
            self.logger.error(f"Failed to connect to LDAP: {e}")
    
    def hash_password(self, password: str, salt: Optional[str] = None) -> Tuple[str, str]:
        """Hash password with salt"""
        if salt is None:
            salt = secrets.token_hex(32)
        
        # Use PBKDF2 with SHA-256
        password_hash = hashlib.pbkdf2_hmac(
            'sha256',
            password.encode('utf-8'),
            salt.encode('utf-8'),
            100000  # iterations
        )
        
        return base64.b64encode(password_hash).decode('utf-8'), salt
    
    def verify_password(self, password: str, stored_hash: str, salt: str) -> bool:
        """Verify password against stored hash"""
        computed_hash, _ = self.hash_password(password, salt)
        return hmac.compare_digest(computed_hash, stored_hash)
    
    def generate_totp_secret(self, user_id: str) -> Tuple[str, str]:
        """Generate TOTP secret and QR code"""
        secret = pyotp.random_base32()
        
        # Create TOTP URI
        totp_uri = pyotp.totp.TOTP(secret).provisioning_uri(
            name=user_id,
            issuer_name=self.config.get('app_name', 'Database System')
        )
        
        # Generate QR code
        qr = qrcode.QRCode(version=1, box_size=10, border=5)
        qr.add_data(totp_uri)
        qr.make(fit=True)
        
        return secret, totp_uri
    
    def verify_totp(self, secret: str, token: str) -> bool:
        """Verify TOTP token"""
        totp = pyotp.TOTP(secret)
        return totp.verify(token, valid_window=1)  # Allow 30-second window
    
    def authenticate_ldap(self, username: str, password: str) -> bool:
        """Authenticate against LDAP"""
        if not self.ldap_connection:
            return False
        
        try:
            user_dn = f"uid={username},{self.config['ldap']['user_base']}"
            return self.ldap_connection.authenticate(user_dn, password)
        except Exception as e:
            self.logger.error(f"LDAP authentication failed: {e}")
            return False
    
    def calculate_risk_score(self, user_id: str, request_info: Dict[str, Any]) -> float:
        """Calculate authentication risk score"""
        risk_score = 0.0
        
        # Check for unusual login time
        current_hour = time.localtime().tm_hour
        if current_hour < 6 or current_hour > 22:
            risk_score += 0.2
        
        # Check for new IP address
        if request_info.get('ip_address') not in self._get_known_ips(user_id):
            risk_score += 0.3
        
        # Check for new device/user agent
        if request_info.get('user_agent') not in self._get_known_devices(user_id):
            risk_score += 0.2
        
        # Check for geographic anomaly
        if self._is_geographic_anomaly(user_id, request_info.get('ip_address')):
            risk_score += 0.4
        
        # Check for recent failed attempts
        failed_attempts = self._get_recent_failed_attempts(user_id)
        if failed_attempts > 0:
            risk_score += min(failed_attempts * 0.1, 0.3)
        
        return min(risk_score, 1.0)
    
    def _get_known_ips(self, user_id: str) -> List[str]:
        """Get list of known IP addresses for user"""
        # This would typically query a database
        return []
    
    def _get_known_devices(self, user_id: str) -> List[str]:
        """Get list of known devices for user"""
        # This would typically query a database
        return []
    
    def _is_geographic_anomaly(self, user_id: str, ip_address: str) -> bool:
        """Check if login location is anomalous"""
        # This would typically use IP geolocation services
        return False
    
    def _get_recent_failed_attempts(self, user_id: str) -> int:
        """Get count of recent failed login attempts"""
        # This would typically query audit logs
        return 0
    
    def authenticate(self, user_id: str, credentials: Dict[str, Any], 
                    request_info: Dict[str, Any]) -> AuthResult:
        """Main authentication method"""
        try:
            # Load user credentials
            user_creds = self._load_user_credentials(user_id)
            if not user_creds:
                return AuthResult(
                    success=False,
                    user_id=None,
                    session_token=None,
                    required_methods=[],
                    error_message="User not found",
                    risk_score=1.0
                )
            
            # Check if account is locked
            if user_creds.locked_until and time.time() < user_creds.locked_until:
                return AuthResult(
                    success=False,
                    user_id=None,
                    session_token=None,
                    required_methods=[],
                    error_message="Account locked",
                    risk_score=1.0
                )
            
            # Calculate risk score
            risk_score = self.calculate_risk_score(user_id, request_info)
            
            # Determine required authentication methods based on risk
            required_methods = self._determine_required_methods(risk_score)
            
            # Verify provided credentials
            auth_success = True
            
            # Password authentication
            if AuthMethod.PASSWORD in required_methods:
                password = credentials.get('password')
                if not password or not self.verify_password(
                    password, user_creds.password_hash, user_creds.salt
                ):
                    auth_success = False
            
            # TOTP authentication
            if AuthMethod.TOTP in required_methods:
                totp_token = credentials.get('totp_token')
                if not totp_token or not self.verify_totp(
                    user_creds.totp_secret, totp_token
                ):
                    auth_success = False
            
            # LDAP authentication
            if self.config.get('ldap', {}).get('enabled'):
                password = credentials.get('password')
                if password and not self.authenticate_ldap(user_id, password):
                    auth_success = False
            
            if auth_success:
                # Generate session token
                session_token = self._generate_session_token(user_id)
                
                # Update last login time
                self._update_last_login(user_id)
                
                # Reset failed attempts
                self._reset_failed_attempts(user_id)
                
                self.logger.info(f"Successful authentication for user: {user_id}")
                
                return AuthResult(
                    success=True,
                    user_id=user_id,
                    session_token=session_token,
                    required_methods=required_methods,
                    error_message=None,
                    risk_score=risk_score
                )
            else:
                # Increment failed attempts
                self._increment_failed_attempts(user_id)
                
                self.logger.warning(f"Failed authentication for user: {user_id}")
                
                return AuthResult(
                    success=False,
                    user_id=None,
                    session_token=None,
                    required_methods=required_methods,
                    error_message="Authentication failed",
                    risk_score=risk_score
                )
        
        except Exception as e:
            self.logger.error(f"Authentication error: {e}")
            return AuthResult(
                success=False,
                user_id=None,
                session_token=None,
                required_methods=[],
                error_message="Internal error",
                risk_score=1.0
            )
    
    def _determine_required_methods(self, risk_score: float) -> List[AuthMethod]:
        """Determine required authentication methods based on risk score"""
        methods = [AuthMethod.PASSWORD]
        
        if risk_score > 0.3:
            methods.append(AuthMethod.TOTP)
        
        if risk_score > 0.7:
            methods.append(AuthMethod.EMAIL)
        
        return methods
    
    def _load_user_credentials(self, user_id: str) -> Optional[UserCredentials]:
        """Load user credentials from database"""
        # This would typically query the database
        # For demo purposes, return a sample user
        if user_id == "demo_user":
            password_hash, salt = self.hash_password("demo_password")
            return UserCredentials(
                user_id=user_id,
                password_hash=password_hash,
                salt=salt,
                totp_secret="JBSWY3DPEHPK3PXP",
                certificate_thumbprint=None,
                failed_attempts=0,
                locked_until=None,
                last_login=None
            )
        return None
    
    def _generate_session_token(self, user_id: str) -> str:
        """Generate secure session token"""
        token_data = {
            'user_id': user_id,
            'timestamp': time.time(),
            'random': secrets.token_hex(16)
        }
        
        token_json = str(token_data).encode()
        encrypted_token = self.fernet.encrypt(token_json)
        return base64.urlsafe_b64encode(encrypted_token).decode()
    
    def _update_last_login(self, user_id: str):
        """Update last login timestamp"""
        # This would typically update the database
        pass
    
    def _reset_failed_attempts(self, user_id: str):
        """Reset failed login attempts counter"""
        # This would typically update the database
        pass
    
    def _increment_failed_attempts(self, user_id: str):
        """Increment failed login attempts counter"""
        # This would typically update the database
        pass

# Example usage
def main():
    config = {
        'master_password': 'secure_master_key_2024',
        'encryption_salt': 'database_security_salt',
        'app_name': 'Secure Database System',
        'ldap': {
            'enabled': False,
            'server': 'ldap.company.com',
            'port': 389,
            'bind_dn': 'cn=admin,dc=company,dc=com',
            'bind_password': 'admin_password',
            'user_base': 'ou=users,dc=company,dc=com'
        }
    }
    
    authenticator = DatabaseAuthenticator(config)
    
    # Test authentication
    credentials = {
        'password': 'demo_password',
        'totp_token': '123456'
    }
    
    request_info = {
        'ip_address': '192.168.1.100',
        'user_agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
        'timestamp': time.time()
    }
    
    result = authenticator.authenticate('demo_user', credentials, request_info)
    
    print(f"Authentication Result:")
    print(f"  Success: {result.success}")
    print(f"  User ID: {result.user_id}")
    print(f"  Session Token: {result.session_token}")
    print(f"  Required Methods: {[method.value for method in result.required_methods]}")
    print(f"  Risk Score: {result.risk_score}")
    print(f"  Error: {result.error_message}")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# src/security/rbac_system.py

import json
import logging
from typing import Dict, List, Set, Optional, Any
from dataclasses import dataclass, field
from enum import Enum
import time
from datetime import datetime, timedelta

class Permission(Enum):
    READ = "read"
    WRITE = "write"
    DELETE = "delete"
    EXECUTE = "execute"
    ADMIN = "admin"
    GRANT = "grant"

class ResourceType(Enum):
    TABLE = "table"
    VIEW = "view"
    PROCEDURE = "procedure"
    FUNCTION = "function"
    SCHEMA = "schema"
    DATABASE = "database"

@dataclass
class Resource:
    resource_type: ResourceType
    name: str
    schema: Optional[str] = None
    database: Optional[str] = None
    
    def __str__(self) -> str:
        parts = []
        if self.database:
            parts.append(self.database)
        if self.schema:
            parts.append(self.schema)
        parts.append(self.name)
        return ".".join(parts)

@dataclass
class Role:
    name: str
    description: str
    permissions: Dict[str, Set[Permission]] = field(default_factory=dict)
    parent_roles: Set[str] = field(default_factory=set)
    created_at: datetime = field(default_factory=datetime.now)
    is_active: bool = True

@dataclass
class User:
    user_id: str
    username: str
    email: str
    roles: Set[str] = field(default_factory=set)
    direct_permissions: Dict[str, Set[Permission]] = field(default_factory=dict)
    created_at: datetime = field(default_factory=datetime.now)
    last_login: Optional[datetime] = None
    is_active: bool = True
    session_timeout: int = 3600  # seconds

@dataclass
class AccessRequest:
    user_id: str
    resource: Resource
    permission: Permission
    context: Dict[str, Any] = field(default_factory=dict)
    timestamp: datetime = field(default_factory=datetime.now)

@dataclass
class AccessResult:
    granted: bool
    reason: str
    effective_permissions: Set[Permission]
    applied_policies: List[str]

class RBACManager:
    def __init__(self):
        self.logger = self._setup_logging()
        self.users: Dict[str, User] = {}
        self.roles: Dict[str, Role] = {}
        self.access_policies: List[Dict[str, Any]] = []
        self.audit_log: List[Dict[str, Any]] = []
        
        # Initialize default roles
        self._create_default_roles()
    
    def _setup_logging(self) -> logging.Logger:
        logger = logging.getLogger('RBACManager')
        logger.setLevel(logging.INFO)
        handler = logging.StreamHandler()
        formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
        handler.setFormatter(formatter)
        logger.addHandler(handler)
        return logger
    
    def _create_default_roles(self):
        """Create default system roles"""
        # Database Administrator
        dba_role = Role(
            name="dba",
            description="Database Administrator with full access"
        )
        dba_role.permissions["*"] = {Permission.READ, Permission.WRITE, 
                                   Permission.DELETE, Permission.EXECUTE, 
                                   Permission.ADMIN, Permission.GRANT}
        self.roles["dba"] = dba_role
        
        # Data Analyst
        analyst_role = Role(
            name="data_analyst",
            description="Read-only access to data tables"
        )
        analyst_role.permissions["*.data.*"] = {Permission.READ}
        self.roles["data_analyst"] = analyst_role
        
        # Application User
        app_user_role = Role(
            name="app_user",
            description="Standard application user"
        )
        app_user_role.permissions["app_db.public.*"] = {Permission.READ, Permission.WRITE}
        self.roles["app_user"] = app_user_role
        
        # Read-only User
        readonly_role = Role(
            name="readonly",
            description="Read-only access to specific schemas"
        )
        readonly_role.permissions["*.public.*"] = {Permission.READ}
        self.roles["readonly"] = readonly_role
    
    def create_user(self, user_id: str, username: str, email: str, 
                   roles: Optional[List[str]] = None) -> bool:
        """Create a new user"""
        try:
            if user_id in self.users:
                self.logger.warning(f"User {user_id} already exists")
                return False
            
            user = User(
                user_id=user_id,
                username=username,
                email=email,
                roles=set(roles or [])
            )
            
            # Validate roles exist
            for role_name in user.roles:
                if role_name not in self.roles:
                    self.logger.error(f"Role {role_name} does not exist")
                    return False
            
            self.users[user_id] = user
            self._audit_log("USER_CREATED", {"user_id": user_id, "username": username})
            self.logger.info(f"Created user: {username} ({user_id})")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to create user {user_id}: {e}")
            return False
    
    def create_role(self, name: str, description: str, 
                   parent_roles: Optional[List[str]] = None) -> bool:
        """Create a new role"""
        try:
            if name in self.roles:
                self.logger.warning(f"Role {name} already exists")
                return False
            
            role = Role(
                name=name,
                description=description,
                parent_roles=set(parent_roles or [])
            )
            
            # Validate parent roles exist
            for parent_role in role.parent_roles:
                if parent_role not in self.roles:
                    self.logger.error(f"Parent role {parent_role} does not exist")
                    return False
            
            self.roles[name] = role
            self._audit_log("ROLE_CREATED", {"role_name": name, "description": description})
            self.logger.info(f"Created role: {name}")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to create role {name}: {e}")
            return False
    
    def grant_permission(self, role_name: str, resource_pattern: str, 
                        permissions: List[Permission]) -> bool:
        """Grant permissions to a role"""
        try:
            if role_name not in self.roles:
                self.logger.error(f"Role {role_name} does not exist")
                return False
            
            role = self.roles[role_name]
            if resource_pattern not in role.permissions:
                role.permissions[resource_pattern] = set()
            
            role.permissions[resource_pattern].update(permissions)
            
            self._audit_log("PERMISSION_GRANTED", {
                "role_name": role_name,
                "resource_pattern": resource_pattern,
                "permissions": [p.value for p in permissions]
            })
            
            self.logger.info(f"Granted permissions to role {role_name}: {resource_pattern}")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to grant permission: {e}")
            return False
    
    def revoke_permission(self, role_name: str, resource_pattern: str, 
                         permissions: List[Permission]) -> bool:
        """Revoke permissions from a role"""
        try:
            if role_name not in self.roles:
                self.logger.error(f"Role {role_name} does not exist")
                return False
            
            role = self.roles[role_name]
            if resource_pattern in role.permissions:
                role.permissions[resource_pattern] -= set(permissions)
                
                # Remove empty permission sets
                if not role.permissions[resource_pattern]:
                    del role.permissions[resource_pattern]
            
            self._audit_log("PERMISSION_REVOKED", {
                "role_name": role_name,
                "resource_pattern": resource_pattern,
                "permissions": [p.value for p in permissions]
            })
            
            self.logger.info(f"Revoked permissions from role {role_name}: {resource_pattern}")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to revoke permission: {e}")
            return False
    
    def assign_role(self, user_id: str, role_name: str) -> bool:
        """Assign a role to a user"""
        try:
            if user_id not in self.users:
                self.logger.error(f"User {user_id} does not exist")
                return False
            
            if role_name not in self.roles:
                self.logger.error(f"Role {role_name} does not exist")
                return False
            
            self.users[user_id].roles.add(role_name)
            
            self._audit_log("ROLE_ASSIGNED", {
                "user_id": user_id,
                "role_name": role_name
            })
            
            self.logger.info(f"Assigned role {role_name} to user {user_id}")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to assign role: {e}")
            return False
    
    def remove_role(self, user_id: str, role_name: str) -> bool:
        """Remove a role from a user"""
        try:
            if user_id not in self.users:
                self.logger.error(f"User {user_id} does not exist")
                return False
            
            self.users[user_id].roles.discard(role_name)
            
            self._audit_log("ROLE_REMOVED", {
                "user_id": user_id,
                "role_name": role_name
            })
            
            self.logger.info(f"Removed role {role_name} from user {user_id}")
            return True
            
        except Exception as e:
            self.logger.error(f"Failed to remove role: {e}")
            return False
    
    def _get_effective_permissions(self, user_id: str) -> Dict[str, Set[Permission]]:
        """Get all effective permissions for a user"""
        if user_id not in self.users:
            return {}
        
        user = self.users[user_id]
        effective_permissions = {}
        
        # Start with direct permissions
        for resource_pattern, perms in user.direct_permissions.items():
            effective_permissions[resource_pattern] = perms.copy()
        
        # Add permissions from roles (including inherited roles)
        processed_roles = set()
        roles_to_process = list(user.roles)
        
        while roles_to_process:
            role_name = roles_to_process.pop(0)
            if role_name in processed_roles or role_name not in self.roles:
                continue
            
            processed_roles.add(role_name)
            role = self.roles[role_name]
            
            # Add parent roles to processing queue
            roles_to_process.extend(role.parent_roles)
            
            # Merge role permissions
            for resource_pattern, perms in role.permissions.items():
                if resource_pattern not in effective_permissions:
                    effective_permissions[resource_pattern] = set()
                effective_permissions[resource_pattern].update(perms)
        
        return effective_permissions
    
    def _match_resource_pattern(self, pattern: str, resource: Resource) -> bool:
        """Check if a resource matches a pattern"""
        resource_str = str(resource)
        
        # Handle wildcard patterns
        if pattern == "*":
            return True
        
        # Split pattern and resource into parts
        pattern_parts = pattern.split(".")
        resource_parts = resource_str.split(".")
        
        # Ensure same number of parts or pattern has wildcards
        if len(pattern_parts) != len(resource_parts):
            return False
        
        # Check each part
        for pattern_part, resource_part in zip(pattern_parts, resource_parts):
            if pattern_part != "*" and pattern_part != resource_part:
                return False
        
        return True
    
    def check_access(self, request: AccessRequest) -> AccessResult:
        """Check if a user has access to a resource"""
        try:
            if request.user_id not in self.users:
                return AccessResult(
                    granted=False,
                    reason="User not found",
                    effective_permissions=set(),
                    applied_policies=[]
                )
            
            user = self.users[request.user_id]
            
            # Check if user is active
            if not user.is_active:
                return AccessResult(
                    granted=False,
                    reason="User account is inactive",
                    effective_permissions=set(),
                    applied_policies=[]
                )
            
            # Get effective permissions
            effective_permissions = self._get_effective_permissions(request.user_id)
            
            # Find matching permissions
            granted_permissions = set()
            applied_policies = []
            
            for pattern, permissions in effective_permissions.items():
                if self._match_resource_pattern(pattern, request.resource):
                    granted_permissions.update(permissions)
                    applied_policies.append(f"Pattern: {pattern}")
            
            # Check if requested permission is granted
            access_granted = request.permission in granted_permissions
            
            # Apply additional policies
            policy_result = self._apply_access_policies(request, granted_permissions)
            if not policy_result['allowed']:
                access_granted = False
                applied_policies.extend(policy_result['policies'])
            
            # Log access attempt
            self._audit_log("ACCESS_CHECK", {
                "user_id": request.user_id,
                "resource": str(request.resource),
                "permission": request.permission.value,
                "granted": access_granted,
                "reason": "Permission granted" if access_granted else "Permission denied"
            })
            
            return AccessResult(
                granted=access_granted,
                reason="Permission granted" if access_granted else "Permission denied",
                effective_permissions=granted_permissions,
                applied_policies=applied_policies
            )
            
        except Exception as e:
            self.logger.error(f"Access check failed: {e}")
            return AccessResult(
                granted=False,
                reason=f"Internal error: {e}",
                effective_permissions=set(),
                applied_policies=[]
            )
    
    def _apply_access_policies(self, request: AccessRequest, 
                              granted_permissions: Set[Permission]) -> Dict[str, Any]:
        """Apply additional access policies"""
        policies_applied = []
        allowed = True
        
        # Time-based access policy
        current_hour = datetime.now().hour
        if current_hour < 6 or current_hour > 22:
            if Permission.ADMIN in granted_permissions:
                # Admin operations restricted during off-hours
                allowed = False
                policies_applied.append("Off-hours admin restriction")
        
        # Sensitive data access policy
        if "sensitive" in str(request.resource).lower():
            if Permission.READ in granted_permissions:
                # Additional logging for sensitive data access
                policies_applied.append("Sensitive data access logged")
        
        # High-privilege operation policy
        if request.permission in [Permission.DELETE, Permission.ADMIN]:
            # Require additional verification for high-privilege operations
            if not request.context.get('verified', False):
                allowed = False
                policies_applied.append("High-privilege operation requires verification")
        
        return {
            'allowed': allowed,
            'policies': policies_applied
        }
    
    def _audit_log(self, action: str, details: Dict[str, Any]):
        """Log audit event"""
        audit_entry = {
            'timestamp': datetime.now().isoformat(),
            'action': action,
            'details': details
        }
        self.audit_log.append(audit_entry)
    
    def get_user_permissions(self, user_id: str) -> Dict[str, Any]:
        """Get comprehensive permission report for a user"""
        if user_id not in self.users:
            return {}
        
        user = self.users[user_id]
        effective_permissions = self._get_effective_permissions(user_id)
        
        return {
            'user_id': user_id,
            'username': user.username,
            'roles': list(user.roles),
            'effective_permissions': {
                pattern: [p.value for p in perms]
                for pattern, perms in effective_permissions.items()
            },
            'direct_permissions': {
                pattern: [p.value for p in perms]
                for pattern, perms in user.direct_permissions.items()
            }
        }
    
    def export_configuration(self) -> Dict[str, Any]:
        """Export RBAC configuration"""
        return {
            'users': {
                user_id: {
                    'username': user.username,
                    'email': user.email,
                    'roles': list(user.roles),
                    'is_active': user.is_active
                }
                for user_id, user in self.users.items()
            },
            'roles': {
                role_name: {
                    'description': role.description,
                    'permissions': {
                        pattern: [p.value for p in perms]
                        for pattern, perms in role.permissions.items()
                    },
                    'parent_roles': list(role.parent_roles),
                    'is_active': role.is_active
                }
                for role_name, role in self.roles.items()
            }
        }

# Example usage
def main():
    rbac = RBACManager()
    
    # Create users
    rbac.create_user("alice", "Alice Smith", "alice@company.com", ["dba"])
    rbac.create_user("bob", "Bob Johnson", "bob@company.com", ["data_analyst"])
    rbac.create_user("charlie", "Charlie Brown", "charlie@company.com", ["app_user"])
    
    # Create custom role
    rbac.create_role("report_viewer", "Can view reports", ["readonly"])
    rbac.grant_permission("report_viewer", "reports.*", [Permission.READ])
    
    # Test access
    resource = Resource(ResourceType.TABLE, "users", "public", "app_db")
    request = AccessRequest("alice", resource, Permission.READ)
    
    result = rbac.check_access(request)
    print(f"Access Result for Alice:")
    print(f"  Granted: {result.granted}")
    print(f"  Reason: {result.reason}")
    print(f"  Effective Permissions: {[p.value for p in result.effective_permissions]}")
    
    # Get user permissions report
    permissions_report = rbac.get_user_permissions("alice")
    print(f"\nAlice's Permissions:")
    print(json.dumps(permissions_report, indent=2))

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# src/security/encryption_manager.py

import os
import base64
import json
import logging
from typing import Dict, List, Optional, Any, Tuple
from dataclasses import dataclass
from enum import Enum
import secrets
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
import hashlib
import hmac

class EncryptionAlgorithm(Enum):
    AES_256_GCM = "aes_256_gcm"
    AES_256_CBC = "aes_256_cbc"
    CHACHA20_POLY1305 = "chacha20_poly1305"
    RSA_OAEP = "rsa_oaep"
    FERNET = "fernet"

class KeyDerivationFunction(Enum):
    PBKDF2 = "pbkdf2"
    SCRYPT = "scrypt"
    ARGON2 = "argon2"

@dataclass
class EncryptionConfig:
    algorithm: EncryptionAlgorithm
    key_size: int
    kdf: KeyDerivationFunction
    iterations: int
    salt_size: int
    iv_size: int

@dataclass
class EncryptedData:
    ciphertext: bytes
    iv: Optional[bytes]
    salt: Optional[bytes]
    tag: Optional[bytes]
    algorithm: EncryptionAlgorithm
    metadata: Dict[str, Any]

class EncryptionManager:
    def __init__(self, config: Dict[str, Any]):
        self.config = config
        self.logger = self._setup_logging()
        self.master_key = self._derive_master_key()
        self.key_cache: Dict[str, bytes] = {}
        
        # Default encryption configurations
        self.encryption_configs = {
            'default': EncryptionConfig(
                algorithm=EncryptionAlgorithm.AES_256_GCM,
                key_size=32,
                kdf=KeyDerivationFunction.PBKDF2,
                iterations=100000,
                salt_size=16,
                iv_size=12
            ),
            'high_security': EncryptionConfig(
                algorithm=EncryptionAlgorithm.AES_256_GCM,
                key_size=32,
                kdf=KeyDerivationFunction.SCRYPT,
                iterations=32768,
                salt_size=32,
                iv_size=12
            ),
            'performance': EncryptionConfig(
                algorithm=EncryptionAlgorithm.CHACHA20_POLY1305,
                key_size=32,
                kdf=KeyDerivationFunction.PBKDF2,
                iterations=50000,
                salt_size=16,
                iv_size=12
            )
        }
    
    def _setup_logging(self) -> logging.Logger:
        logger = logging.getLogger('EncryptionManager')
        logger.setLevel(logging.INFO)
        handler = logging.StreamHandler()
        formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
        handler.setFormatter(formatter)
        logger.addHandler(handler)
        return logger
    
    def _derive_master_key(self) -> bytes:
        """Derive master key from configuration"""
        master_password = self.config.get('master_password', '').encode()
        salt = self.config.get('master_salt', 'default_salt').encode()
        
        if not master_password:
            # Generate random master key if no password provided
            return secrets.token_bytes(32)
        
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        return kdf.derive(master_password)
    
    def derive_key(self, password: str, salt: bytes, config: EncryptionConfig) -> bytes:
        """Derive encryption key from password"""
        password_bytes = password.encode('utf-8')
        
        if config.kdf == KeyDerivationFunction.PBKDF2:
            kdf = PBKDF2HMAC(
                algorithm=hashes.SHA256(),
                length=config.key_size,
                salt=salt,
                iterations=config.iterations,
            )
            return kdf.derive(password_bytes)
        
        elif config.kdf == KeyDerivationFunction.SCRYPT:
            kdf = Scrypt(
                algorithm=hashes.SHA256(),
                length=config.key_size,
                salt=salt,
                n=config.iterations,
                r=8,
                p=1,
            )
            return kdf.derive(password_bytes)
        
        else:
            raise ValueError(f"Unsupported KDF: {config.kdf}")
    
    def generate_key(self, key_id: str, config_name: str = 'default') -> bytes:
        """Generate and store a new encryption key"""
        config = self.encryption_configs[config_name]
        key = secrets.token_bytes(config.key_size)
        
        # Encrypt key with master key for storage
        encrypted_key = self._encrypt_key(key)
        
        # Store encrypted key (in production, this would be in a secure key store)
        self._store_key(key_id, encrypted_key)
        
        # Cache the key
        self.key_cache[key_id] = key
        
        self.logger.info(f"Generated new key: {key_id}")
        return key
    
    def get_key(self, key_id: str) -> Optional[bytes]:
        """Retrieve encryption key"""
        if key_id in self.key_cache:
            return self.key_cache[key_id]
        
        # Load from storage
        encrypted_key = self._load_key(key_id)
        if encrypted_key:
            key = self._decrypt_key(encrypted_key)
            self.key_cache[key_id] = key
            return key
        
        return None
    
    def _encrypt_key(self, key: bytes) -> bytes:
        """Encrypt key with master key"""
        fernet = Fernet(base64.urlsafe_b64encode(self.master_key))
        return fernet.encrypt(key)
    
    def _decrypt_key(self, encrypted_key: bytes) -> bytes:
        """Decrypt key with master key"""
        fernet = Fernet(base64.urlsafe_b64encode(self.master_key))
        return fernet.decrypt(encrypted_key)
    
    def _store_key(self, key_id: str, encrypted_key: bytes):
        """Store encrypted key (placeholder implementation)"""
        # In production, this would store in a secure key management system
        key_file = f"/tmp/keys/{key_id}.key"
        os.makedirs(os.path.dirname(key_file), exist_ok=True)
        with open(key_file, 'wb') as f:
            f.write(encrypted_key)
    
    def _load_key(self, key_id: str) -> Optional[bytes]:
        """Load encrypted key (placeholder implementation)"""
        key_file = f"/tmp/keys/{key_id}.key"
        try:
            with open(key_file, 'rb') as f:
                return f.read()
        except FileNotFoundError:
            return None
    
    def encrypt_data(self, data: bytes, key_id: str, 
                    config_name: str = 'default') -> EncryptedData:
        """Encrypt data using specified configuration"""
        config = self.encryption_configs[config_name]
        key = self.get_key(key_id)
        
        if not key:
            raise ValueError(f"Key not found: {key_id}")
        
        if config.algorithm == EncryptionAlgorithm.AES_256_GCM:
            return self._encrypt_aes_gcm(data, key, config)
        elif config.algorithm == EncryptionAlgorithm.AES_256_CBC:
            return self._encrypt_aes_cbc(data, key, config)
        elif config.algorithm == EncryptionAlgorithm.CHACHA20_POLY1305:
            return self._encrypt_chacha20(data, key, config)
        elif config.algorithm == EncryptionAlgorithm.FERNET:
            return self._encrypt_fernet(data, key, config)
        else:
            raise ValueError(f"Unsupported algorithm: {config.algorithm}")
    
    def decrypt_data(self, encrypted_data: EncryptedData, key_id: str) -> bytes:
        """Decrypt data"""
        key = self.get_key(key_id)
        
        if not key:
            raise ValueError(f"Key not found: {key_id}")
        
        if encrypted_data.algorithm == EncryptionAlgorithm.AES_256_GCM:
            return self._decrypt_aes_gcm(encrypted_data, key)
        elif encrypted_data.algorithm == EncryptionAlgorithm.AES_256_CBC:
            return self._decrypt_aes_cbc(encrypted_data, key)
        elif encrypted_data.algorithm == EncryptionAlgorithm.CHACHA20_POLY1305:
            return self._decrypt_chacha20(encrypted_data, key)
        elif encrypted_data.algorithm == EncryptionAlgorithm.FERNET:
            return self._decrypt_fernet(encrypted_data, key)
        else:
            raise ValueError(f"Unsupported algorithm: {encrypted_data.algorithm}")
    
    def _encrypt_aes_gcm(self, data: bytes, key: bytes, 
                        config: EncryptionConfig) -> EncryptedData:
        """Encrypt using AES-256-GCM"""
        iv = secrets.token_bytes(config.iv_size)
        
        cipher = Cipher(algorithms.AES(key), modes.GCM(iv))
        encryptor = cipher.encryptor()
        
        ciphertext = encryptor.update(data) + encryptor.finalize()
        
        return EncryptedData(
            ciphertext=ciphertext,
            iv=iv,
            salt=None,
            tag=encryptor.tag,
            algorithm=config.algorithm,
            metadata={'key_size': len(key)}
        )
    
    def _decrypt_aes_gcm(self, encrypted_data: EncryptedData, key: bytes) -> bytes:
        """Decrypt using AES-256-GCM"""
        cipher = Cipher(
            algorithms.AES(key), 
            modes.GCM(encrypted_data.iv, encrypted_data.tag)
        )
        decryptor = cipher.decryptor()
        
        return decryptor.update(encrypted_data.ciphertext) + decryptor.finalize()
    
    def _encrypt_aes_cbc(self, data: bytes, key: bytes, 
                        config: EncryptionConfig) -> EncryptedData:
        """Encrypt using AES-256-CBC"""
        iv = secrets.token_bytes(16)  # AES block size
        
        # Pad data to block size
        padding_length = 16 - (len(data) % 16)
        padded_data = data + bytes([padding_length] * padding_length)
        
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
        encryptor = cipher.encryptor()
        
        ciphertext = encryptor.update(padded_data) + encryptor.finalize()
        
        return EncryptedData(
            ciphertext=ciphertext,
            iv=iv,
            salt=None,
            tag=None,
            algorithm=config.algorithm,
            metadata={'key_size': len(key)}
        )
    
    def _decrypt_aes_cbc(self, encrypted_data: EncryptedData, key: bytes) -> bytes:
        """Decrypt using AES-256-CBC"""
        cipher = Cipher(algorithms.AES(key), modes.CBC(encrypted_data.iv))
        decryptor = cipher.decryptor()
        
        padded_data = decryptor.update(encrypted_data.ciphertext) + decryptor.finalize()
        
        # Remove padding
        padding_length = padded_data[-1]
        return padded_data[:-padding_length]
    
    def _encrypt_chacha20(self, data: bytes, key: bytes, 
                         config: EncryptionConfig) -> EncryptedData:
        """Encrypt using ChaCha20-Poly1305"""
        nonce = secrets.token_bytes(12)  # ChaCha20 nonce size
        
        cipher = Cipher(algorithms.ChaCha20(key, nonce), mode=None)
        encryptor = cipher.encryptor()
        
        ciphertext = encryptor.update(data) + encryptor.finalize()
        
        return EncryptedData(
            ciphertext=ciphertext,
            iv=nonce,
            salt=None,
            tag=None,
            algorithm=config.algorithm,
            metadata={'key_size': len(key)}
        )
    
    def _decrypt_chacha20(self, encrypted_data: EncryptedData, key: bytes) -> bytes:
        """Decrypt using ChaCha20-Poly1305"""
        cipher = Cipher(algorithms.ChaCha20(key, encrypted_data.iv), mode=None)
        decryptor = cipher.decryptor()
        
        return decryptor.update(encrypted_data.ciphertext) + decryptor.finalize()
    
    def _encrypt_fernet(self, data: bytes, key: bytes, 
                       config: EncryptionConfig) -> EncryptedData:
        """Encrypt using Fernet"""
        fernet = Fernet(base64.urlsafe_b64encode(key))
        ciphertext = fernet.encrypt(data)
        
        return EncryptedData(
            ciphertext=ciphertext,
            iv=None,
            salt=None,
            tag=None,
            algorithm=config.algorithm,
            metadata={'key_size': len(key)}
        )
    
    def _decrypt_fernet(self, encrypted_data: EncryptedData, key: bytes) -> bytes:
        """Decrypt using Fernet"""
        fernet = Fernet(base64.urlsafe_b64encode(key))
        return fernet.decrypt(encrypted_data.ciphertext)
    
    def encrypt_column_data(self, table_name: str, column_name: str, 
                           data: Any, data_type: str) -> str:
        """Encrypt column data with format preservation"""
        # Convert data to bytes
        if isinstance(data, str):
            data_bytes = data.encode('utf-8')
        elif isinstance(data, (int, float)):
            data_bytes = str(data).encode('utf-8')
        else:
            data_bytes = str(data).encode('utf-8')
        
        # Use column-specific key
        key_id = f"{table_name}.{column_name}"
        
        # Ensure key exists
        if not self.get_key(key_id):
            self.generate_key(key_id)
        
        # Encrypt data
        encrypted_data = self.encrypt_data(data_bytes, key_id)
        
        # Return base64-encoded ciphertext for storage
        return base64.b64encode(encrypted_data.ciphertext).decode('utf-8')
    
    def decrypt_column_data(self, table_name: str, column_name: str, 
                           encrypted_value: str, data_type: str) -> Any:
        """Decrypt column data and convert back to original type"""
        key_id = f"{table_name}.{column_name}"
        
        # Decode base64
        ciphertext = base64.b64decode(encrypted_value.encode('utf-8'))
        
        # Create EncryptedData object (simplified - in practice, store metadata)
        encrypted_data = EncryptedData(
            ciphertext=ciphertext,
            iv=None,
            salt=None,
            tag=None,
            algorithm=EncryptionAlgorithm.FERNET,
            metadata={}
        )
        
        # Decrypt
        decrypted_bytes = self.decrypt_data(encrypted_data, key_id)
        decrypted_str = decrypted_bytes.decode('utf-8')
        
        # Convert back to original type
        if data_type.lower() in ['int', 'integer', 'bigint']:
            return int(decrypted_str)
        elif data_type.lower() in ['float', 'double', 'decimal']:
            return float(decrypted_str)
        else:
            return decrypted_str
    
    def rotate_key(self, key_id: str) -> bool:
        """Rotate encryption key"""
        try:
            # Generate new key
            old_key = self.get_key(key_id)
            new_key = secrets.token_bytes(32)
            
            # Store new key with versioned ID
            new_key_id = f"{key_id}_v{int(time.time())}"
            encrypted_new_key = self._encrypt_key(new_key)
            self._store_key(new_key_id, encrypted_new_key)
            
            # Update key cache
            self.key_cache[key_id] = new_key
            
            self.logger.info(f"Rotated key: {key_id}")
            return True
            
        except Exception as e:
            self.logger.error(f"Key rotation failed for {key_id}: {e}")
            return False
    
    def generate_hash(self, data: str, salt: Optional[str] = None) -> Tuple[str, str]:
        """Generate secure hash for data"""
        if salt is None:
            salt = secrets.token_hex(16)
        
        # Use PBKDF2 for password-like data
        hash_value = hashlib.pbkdf2_hmac(
            'sha256',
            data.encode('utf-8'),
            salt.encode('utf-8'),
            100000
        )
        
        return base64.b64encode(hash_value).decode('utf-8'), salt
    
    def verify_hash(self, data: str, hash_value: str, salt: str) -> bool:
        """Verify data against hash"""
        computed_hash, _ = self.generate_hash(data, salt)
        return hmac.compare_digest(computed_hash, hash_value)

# Example usage
def main():
    config = {
        'master_password': 'secure_master_password_2024',
        'master_salt': 'encryption_salt_2024'
    }
    
    encryption_manager = EncryptionManager(config)
    
    # Generate a key for sensitive data
    key_id = "users.ssn"
    encryption_manager.generate_key(key_id)
    
    # Encrypt sensitive data
    sensitive_data = "123-45-6789"
    encrypted_ssn = encryption_manager.encrypt_column_data(
        "users", "ssn", sensitive_data, "varchar"
    )
    
    print(f"Original SSN: {sensitive_data}")
    print(f"Encrypted SSN: {encrypted_ssn}")
    
    # Decrypt data
    decrypted_ssn = encryption_manager.decrypt_column_data(
        "users", "ssn", encrypted_ssn, "varchar"
    )
    
    print(f"Decrypted SSN: {decrypted_ssn}")
    
    # Generate hash for password
    password = "user_password_123"
    hash_value, salt = encryption_manager.generate_hash(password)
    
    print(f"Password hash: {hash_value}")
    print(f"Salt: {salt}")
    
    # Verify password
    is_valid = encryption_manager.verify_hash(password, hash_value, salt)
    print(f"Password verification: {is_valid}")

if __name__ == "__main__":
    main()