# Dual-token authentication
ACCESS_TOKEN_EXPIRE_MINUTES = 30  # Short-lived access token
REFRESH_TOKEN_EXPIRE_DAYS = 7     # Long-lived refresh token

# Automatic token refresh before expiry
# Frontend handles refresh 5 minutes before expiration

# Session limits and tracking
MAX_CONCURRENT_SESSIONS = 3       # Per user limit
SESSION_TIMEOUT_MINUTES = 30      # Inactivity timeout
SESSION_WARNING_MINUTES = 5       # Warning before expiry

# Session fingerprinting
SESSION_FINGERPRINT = hash(IP + User_Agent + Device_ID)

# Requirements
MIN_LENGTH = 12
REQUIRE_UPPERCASE = True
REQUIRE_LOWERCASE = True
REQUIRE_NUMBERS = True
REQUIRE_SPECIAL = True
MAX_AGE_DAYS = 90

# Using bcrypt (current implementation)
import bcrypt

# Hash password
password = "SecurePassword123!"
salt = bcrypt.gensalt(rounds=12)
hashed = bcrypt.hashpw(password.encode('utf-8'), salt)

# Verify
bcrypt.checkpw(password.encode('utf-8'), hashed)

# Strong secret key with automatic rotation support
# The system now uses jwt_secret_manager.py for secure key management
JWT_SECRET_KEY = os.getenv('JWT_SECRET_KEY')  # Required in production

# Generate secure key:
# openssl rand -base64 32

# Short expiration
ACCESS_TOKEN_EXPIRE_MINUTES = 30
REFRESH_TOKEN_EXPIRE_DAYS = 7

# Algorithm
ALGORITHM = "HS256"  # Consider RS256 for production

# Session configuration
SESSION_COOKIE_SECURE = True  # HTTPS only
SESSION_COOKIE_HTTPONLY = True  # No JS access
SESSION_COOKIE_SAMESITE = 'Strict'
SESSION_TIMEOUT = 1800  # 30 minutes

ROLES = {
    'admin': [
        'devices.*',
        'users.*',
        'system.*',
        'rates.*'
    ],
    'operator': [
        'devices.view',
        'devices.control',
        'devices.edit',
        'rates.view'
    ],
    'viewer': [
        'devices.view',
        'rates.view',
        'costs.view'
    ],
    'guest': [
        'devices.view'
    ]
}

# Permission-based access control
@require_permission(Permission.DATA_EXPORT)
async def export_data(user: User = Depends(get_current_user)):
    # User ownership validation
    if user.role != "admin" and export.user_id != user.id:
        raise HTTPException(403, "Access denied")
    
    # Rate limiting: 10 exports per hour
    if get_export_count(user.id, last_hour=True) >= 10:
        raise HTTPException(429, "Export rate limit exceeded")
    
    # Comprehensive audit logging
    log_audit_event(
        event_type=AuditEventType.DATA_EXPORT,
        user_id=user.id,
        details={"devices": devices, "format": format}
    )

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(
    key_func=get_remote_address,
    default_limits=["100 per minute", "1000 per hour"]
)

# Endpoint-specific limits
@app.get("/api/devices")
@limiter.limit("10 per minute")
async def get_devices():
    pass

# Export-specific limits
@app.post("/api/exports/create")
@limiter.limit("10 per hour")  # Export rate limit
async def create_export():
    pass

API_KEY_HEADER = "X-API-Key"

async def verify_api_key(api_key: str = Header(...)):
    if api_key != settings.API_KEY:
        raise HTTPException(status_code=403)
    return api_key

# Using SQLCipher
import sqlcipher3

conn = sqlcipher3.connect('/app/data/kasa_monitor.db')
conn.execute("PRAGMA key = 'your-encryption-key'")

from enum import Enum
from datetime import datetime

class AuditEventType(Enum):
    # Authentication events
    LOGIN_SUCCESS = "login_success"
    LOGIN_FAILURE = "login_failure"
    LOGOUT = "logout"
    TOKEN_REFRESH = "token_refresh"
    SESSION_EXPIRED = "session_expired"
    
    # Data export events
    DATA_EXPORT = "data_export"
    DATA_EXPORTED = "data_exported"
    DATA_DELETED = "data_deleted"
    EXPORT_DOWNLOADED = "export_downloaded"
    
    # Security events
    PERMISSION_DENIED = "permission_denied"
    RATE_LIMIT_EXCEEDED = "rate_limit_exceeded"
    SUSPICIOUS_ACTIVITY = "suspicious_activity"

class AuditLogger:
    def log_event(self, event_type: AuditEventType, user_id: int, 
                  severity: str, details: dict):
        log_entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': event_type.value,
            'user_id': user_id,
            'severity': severity,  # INFO, WARNING, ERROR, CRITICAL
            'details': details,
            'ip_address': request.remote_addr,
            'user_agent': request.headers.get('User-Agent'),
            'session_id': session.get('session_id'),
            'checksum': self.calculate_checksum()  # Tamper-evident
        }
        
        # Store in database for compliance
        db.audit_logs.insert(log_entry)
        
        # Also write to file for backup
        logging.info(f"AUDIT: {json.dumps(log_entry)}")

# All export operations are logged
await log_audit_event(
    event_type=AuditEventType.DATA_EXPORT,
    user_id=user.id,
    severity="INFO",
    details={
        "export_id": export_id,
        "devices": devices,
        "date_range": date_range,
        "format": format,
        "records_count": count,
        "file_size": size
    }
)

from prometheus_client import Counter, Histogram

auth_attempts = Counter('auth_attempts_total', 'Total auth attempts')
auth_failures = Counter('auth_failures_total', 'Failed auth attempts')
api_latency = Histogram('api_latency_seconds', 'API latency')

# GDPR-compliant export with audit trail
@require_permission(Permission.DATA_EXPORT)
async def export_user_data(user_id: int):
    # Log data access for GDPR Article 30
    await log_audit_event(
        event_type=AuditEventType.DATA_EXPORT,
        user_id=user_id,
        severity="INFO",
        details={
            "purpose": "User data portability request",
            "lawful_basis": "User consent",
            "data_categories": ["device_data", "energy_usage"],
            "retention_days": 7
        }
    )
    
    # Export with privacy options
    return export_with_privacy_options(
        user_id=user_id,
        anonymize_ip=True,
        exclude_sensitive=True
    )