# utils/vault_client.py
import hvac
import os

class VaultClient:
    def __init__(self):
        self.client = hvac.Client(
            url=os.getenv('VAULT_URL', 'http://localhost:8200'),
            token=os.getenv('VAULT_TOKEN')
        )
        
    def get_secret(self, path):
        """Pobranie sekretu z Vault"""
        try:
            response = self.client.secrets.kv.v2.read_secret_version(path=path)
            return response['data']['data']
        except Exception as e:
            print(f"Error reading secret {path}: {e}")
            return None
    
    def put_secret(self, path, secret):
        """Zapisanie sekretu do Vault"""
        try:
            self.client.secrets.kv.v2.create_or_update_secret(
                path=path,
                secret=secret
            )
            return True
        except Exception as e:
            print(f"Error writing secret {path}: {e}")
            return False

# Przykład użycia
vault = VaultClient()
api_keys = vault.get_secret('trading-bot/api-keys')
if api_keys:
    binance_key = api_keys.get('binance_api_key')

# utils/encryption.py
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import os
import base64

class DataEncryption:
    def __init__(self, password=None):
        if not password:
            password = os.getenv('ENCRYPTION_PASSWORD', 'default-password')
        
        # Derive key from password
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=b'stable_salt_for_trading_bot',  # W produkcji użyj losowej soli
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(password.encode()))
        self.cipher = Fernet(key)
    
    def encrypt(self, data):
        """Szyfrowanie danych"""
        if isinstance(data, str):
            data = data.encode()
        return self.cipher.encrypt(data)
    
    def decrypt(self, encrypted_data):
        """Deszyfrowanie danych"""
        decrypted = self.cipher.decrypt(encrypted_data)
        return decrypted.decode()

# Przykład użycia
encryptor = DataEncryption()
encrypted_api_key = encryptor.encrypt("your_api_key")
stored_key = encryptor.decrypt(encrypted_api_key)

# monitoring/security_monitor.py
import re
import time
import json
from datetime import datetime
from collections import defaultdict

class SecurityMonitor:
    def __init__(self):
        self.failed_logins = defaultdict(int)
        self.suspicious_ips = set()
        self.api_abuse = defaultdict(int)
        
    def analyze_log_line(self, log_line):
        """Analiza linii loga pod kątem zagrożeń"""
        alerts = []
        
        # Wykrywanie prób łamania haseł
        if "failed login" in log_line.lower():
            ip = self.extract_ip(log_line)
            if ip:
                self.failed_logins[ip] += 1
                if self.failed_logins[ip] > 5:
                    alerts.append({
                        'type': 'brute_force',
                        'ip': ip,
                        'count': self.failed_logins[ip],
                        'timestamp': datetime.now().isoformat()
                    })
        
        # Wykrywanie nadmiernego użycia API
        if "api_call" in log_line:
            ip = self.extract_ip(log_line)
            if ip:
                self.api_abuse[ip] += 1
                if self.api_abuse[ip] > 1000:  # 1000 zapytań na minutę
                    alerts.append({
                        'type': 'api_abuse',
                        'ip': ip,
                        'count': self.api_abuse[ip],
                        'timestamp': datetime.now().isoformat()
                    })
        
        # Wykrywanie nietypowych wzorców
        suspicious_patterns = [
            r'\.\./',  # Directory traversal
            r'<script',  # XSS attempts
            r'union.*select',  # SQL injection
            r'eval\(',  # Code injection
        ]
        
        for pattern in suspicious_patterns:
            if re.search(pattern, log_line, re.IGNORECASE):
                alerts.append({
                    'type': 'suspicious_pattern',
                    'pattern': pattern,
                    'log_line': log_line,
                    'timestamp': datetime.now().isoformat()
                })
        
        return alerts
    
    def extract_ip(self, log_line):
        """Wyodrębnienie IP z linii loga"""
        ip_pattern = r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
        match = re.search(ip_pattern, log_line)
        return match.group(1) if match else None
    
    def send_alert(self, alert):
        """Wysłanie alertu"""
        # Integracja z Slack, email, webhook, itp.
        print(f"ALERT: {json.dumps(alert, indent=2)}")
        
        # Można dodać integracje:
        # - Slack webhook
        # - Email
        # - PagerDuty
        # - Custom webhook

# utils/gdpr_compliance.py
from datetime import datetime, timedelta
import json

class GDPRManager:
    def __init__(self, db_connection):
        self.db = db_connection
        
    def log_data_access(self, user_id, data_type, purpose):
        """Logowanie dostępu do danych osobowych"""
        self.db.execute("""
            INSERT INTO data_access_log (user_id, data_type, purpose, timestamp)
            VALUES (?, ?, ?, ?)
        """, (user_id, data_type, purpose, datetime.now()))
    
    def anonymize_user_data(self, user_id):
        """Anonimizacja danych użytkownika"""
        # Zachowaj tylko niezbędne dane dla audytu
        self.db.execute("""
            UPDATE users SET 
                email = 'anonymized@example.com',
                name = 'Anonymized User',
                phone = NULL,
                address = NULL
            WHERE id = ?
        """, (user_id,))
        
        # Loguj anonimizację
        self.log_data_access(user_id, 'user_profile', 'anonymization')
    
    def export_user_data(self, user_id):
        """Eksport wszystkich danych użytkownika"""
        user_data = {
            'profile': self.get_user_profile(user_id),
            'trading_history': self.get_trading_history(user_id),
            'api_usage': self.get_api_usage(user_id),
            'logs': self.get_user_logs(user_id)
        }
        
        self.log_data_access(user_id, 'full_export', 'data_portability')
        return json.dumps(user_data, indent=2)

# utils/audit_trail.py
import json
from datetime import datetime
from functools import wraps

def audit_action(action_type):
    """Dekorator do audytu akcji"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            start_time = datetime.now()
            
            try:
                result = func(*args, **kwargs)
                
                # Loguj sukces
                log_audit_event({
                    'action_type': action_type,
                    'function': func.__name__,
                    'args': str(args)[:200],  # Limit długości
                    'kwargs': str(kwargs)[:200],
                    'status': 'success',
                    'timestamp': start_time.isoformat(),
                    'duration_ms': (datetime.now() - start_time).total_seconds() * 1000
                })
                
                return result
                
            except Exception as e:
                # Loguj błąd
                log_audit_event({
                    'action_type': action_type,
                    'function': func.__name__,
                    'args': str(args)[:200],
                    'kwargs': str(kwargs)[:200],
                    'status': 'error',
                    'error': str(e),
                    'timestamp': start_time.isoformat(),
                    'duration_ms': (datetime.now() - start_time).total_seconds() * 1000
                })
                raise
                
        return wrapper
    return decorator

def log_audit_event(event):
    """Zapisanie zdarzenia audytu"""
    # Zapisz do bazy danych lub systemu logów
    with open('/var/log/trading-bot/audit.log', 'a') as f:
        f.write(json.dumps(event) + '\n')

# Przykład użycia
@audit_action('place_order')
def place_order(symbol, quantity, price):
    # Implementacja zlecenia
    pass

@audit_action('withdraw_funds')
def withdraw_funds(amount, destination):
    # Implementacja wypłaty
    pass