# Token structure
{
  "sub": "user_id",
  "exp": timestamp + 3600,  # 1 hour expiration
  "iat": timestamp,
  "permissions": ["read", "write", "admin"]
}

class UserRole(Enum):
    ADMIN = "admin"           # Full access
    DEVELOPER = "developer"   # Code & workflow access
    OPERATOR = "operator"     # Execute workflows only
    VIEWER = "viewer"         # Read-only access

# Permission matrix
ROLE_PERMISSIONS = {
    "admin": ["*"],
    "developer": ["agents.*", "workflows.*", "tools.*"],
    "operator": ["workflows.execute", "agents.execute"],
    "viewer": ["*.read"]
}

from cryptography.fernet import Fernet

# Generate key
key = Fernet.generate_key()

# Save securely (NOT in code!)
with open('.credential_key', 'wb') as f:
    f.write(key)

# Restrict permissions
os.chmod('.credential_key', 0o600)  # Only owner can read

from cryptography.fernet import Fernet
import json

# Load key
with open('.credential_key', 'rb') as f:
    key = f.read()

fernet = Fernet(key)

# Encrypt credential data
credential_data = {
    "access_key_id": "AKIA...",
    "secret_access_key": "...",
    "region": "us-east-1"
}

encrypted_data = fernet.encrypt(
    json.dumps(credential_data).encode()
)

# Store in database (encrypted)
credential.encrypted_data = encrypted_data.decode()

# Decrypt only when needed
def get_credential_data(credential_id: int):
    credential = db.query(Credential).filter(id=credential_id).first()
    
    # Decrypt
    decrypted = fernet.decrypt(credential.encrypted_data.encode())
    
    # Return as dict
    return json.loads(decrypted)

# Decrypted data NEVER stored, only used immediately

# Retention policy
AUDIT_LOG_RETENTION = {
    'security_events': 365,      # 1 year
    'api_calls': 90,            # 3 months  
    'tool_executions': 180,     # 6 months
    'credential_access': 365    # 1 year
}

# Automated cleanup job (nightly)
async def cleanup_old_audit_logs():
    for event_type, days in AUDIT_LOG_RETENTION.items():
        cutoff = datetime.now() - timedelta(days=days)
        
        deleted = db.query(AuditLog).filter(
            AuditLog.event_type == event_type,
            AuditLog.created_at < cutoff
        ).delete()
        
        logger.info(f"Cleaned up {deleted} old {event_type} logs")

# Right to access
GET /api/users/{id}/data-export

# Right to deletion
DELETE /api/users/{id}/data

# Right to portability
GET /api/users/{id}/data-export?format=json

# Agent should only have tools it needs
code_review_agent_tools = [
    'search_knowledge',   # ✅ Needs for research
    'read_file',          # ✅ Needs to view code
    'github_pr_mcp'       # ✅ Needs to comment on PRs
    # ❌ NOT write_file (shouldn't modify during review)
    # ❌ NOT execute_command (no shell access needed)
]

ALLOWED_COMMANDS = [
    'npm test',
    'npm run build',
    'git status',
    'git log',
    'pytest',
    'docker ps',
    'docker logs'
]

FORBIDDEN_COMMANDS = [
    'rm -rf /',
    'dd if=',
    'mkfs',
    'format',
    ':(){ :|:& };:',  # Fork bomb
    'chmod 777',
    'chown root',
    'sudo'
]

import os
from dotenv import load_dotenv

load_dotenv()

# ✅ Good
OPENAI_API_KEY = os.getenv('OPENAI_API_KEY')

# ❌ Bad
OPENAI_API_KEY = "sk-actual-key-here"

# Failed authentication attempts
SELECT COUNT(*) as failed_attempts
FROM audit_logs
WHERE event_type = 'authentication'
AND success = false
AND created_at > NOW() - INTERVAL '1 hour'
GROUP BY ip_address
HAVING COUNT(*) > 5;

# Suspicious tool executions
SELECT *
FROM audit_logs
WHERE event_type = 'tool_execution'
AND action = 'execute_command'
AND created_at > NOW() - INTERVAL '24 hours';

# Unusual credential access patterns
SELECT credential_id, COUNT(*) as access_count
FROM audit_logs
WHERE event_type = 'credential_access'
AND created_at > NOW() - INTERVAL '1 hour'
GROUP BY credential_id
HAVING COUNT(*) > 50;  # >50 accesses per hour = suspicious

# Alert on suspicious activity
async def check_security_events():
    # Check failed logins
    failed_logins = await count_failed_logins_last_hour()
    if failed_logins > 10:
        await send_alert("High failed login rate", severity="high")
    
    # Check unusual credential access
    credential_access = await check_credential_access_patterns()
    if credential_access.is_anomalous:
        await send_alert("Unusual credential access", severity="critical")
    
    # Check shell command attempts
    shell_commands = await count_shell_command_attempts()
    if shell_commands > 0:
        await send_alert("Shell command execution detected", severity="medium")

async def handle_security_incident(incident: SecurityIncident):
    if incident.level == "critical":
        # Immediate lockdown
        await disable_all_api_keys()
        await lock_all_credentials()
        await notify_admin_immediately()
        await create_incident_report()
    
    elif incident.level == "high":
        # Block and investigate
        await block_ip_address(incident.ip)
        await disable_affected_credentials()
        await notify_admin()
        await log_incident()
    
    elif incident.level == "medium":
        # Monitor and log
        await increase_monitoring(incident.resource)
        await log_incident()
    
    # Always log
    await audit_log(incident)