import secrets
import hashlib

def generate_api_key() -> tuple[str, str]:
    """
    Generate a cryptographically secure API key.
    Returns (key, key_hash).
    """
    # 32 bytes = 256 bits of entropy
    random_bytes = secrets.token_bytes(32)
    
    # URL-safe base64 encoding (43 chars)
    key_suffix = secrets.token_urlsafe(24)  # 24 bytes → 32 chars
    
    api_key = f"kikuai_{key_suffix}"
    
    # Store hash, not the key
    key_hash = hashlib.sha256(api_key.encode()).hexdigest()
    
    return api_key, key_hash

def validate_api_key(api_key: str, stored_hash: str) -> bool:
    """
    Validate API key against stored hash.
    Uses constant-time comparison to prevent timing attacks.
    """
    key_hash = hashlib.sha256(api_key.encode()).hexdigest()
    return secrets.compare_digest(key_hash, stored_hash)

# In Redis, store only the hash
redis_client.hset(f"api_key:{key_hash}", mapping={
    "user_id": user_id,
    "created_at": datetime.utcnow().isoformat(),
    "status": "active"
})

# Lookup by key requires hashing first
def lookup_key(api_key: str):
    key_hash = hashlib.sha256(api_key.encode()).hexdigest()
    return redis_client.hgetall(f"api_key:{key_hash}")

async def regenerate_api_key(user_id: int) -> str:
    """
    Regenerate API key for user.
    Old key is immediately invalidated.
    """
    # Get current key hash
    user_data = await get_user(user_id)
    old_key_hash = user_data.get("api_key_hash")
    
    # Generate new key
    new_key, new_key_hash = generate_api_key()
    
    # Atomic update: delete old, create new
    pipe = redis_client.pipeline()
    if old_key_hash:
        pipe.delete(f"api_key:{old_key_hash}")
    pipe.hset(f"api_key:{new_key_hash}", mapping={
        "user_id": user_id,
        "created_at": datetime.utcnow().isoformat(),
        "status": "active"
    })
    pipe.hset(f"user:{user_id}", "api_key_hash", new_key_hash)
    pipe.execute()
    
    return new_key  # Return to user once, never stored

import hmac
import hashlib
from fastapi import HTTPException, Header, Request

PADDLE_WEBHOOK_SECRET = os.getenv("PADDLE_WEBHOOK_SECRET")

async def verify_paddle_webhook(
    request: Request,
    paddle_signature: str = Header(..., alias="Paddle-Signature")
) -> dict:
    """
    Verify Paddle webhook signature.
    Raises HTTPException if invalid.
    """
    body = await request.body()
    
    # Parse signature header: ts=xxx;h1=xxx
    sig_parts = {}
    for part in paddle_signature.split(";"):
        key, value = part.split("=", 1)
        sig_parts[key] = value
    
    timestamp = sig_parts.get("ts")
    received_signature = sig_parts.get("h1")
    
    if not timestamp or not received_signature:
        raise HTTPException(401, "Invalid signature format")
    
    # Check timestamp freshness (prevent replay attacks)
    if abs(int(timestamp) - time.time()) > 300:  # 5 minutes
        raise HTTPException(401, "Webhook timestamp too old")
    
    # Compute expected signature
    signed_payload = f"{timestamp}:{body.decode()}"
    expected_signature = hmac.new(
        PADDLE_WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    
    # Constant-time comparison
    if not hmac.compare_digest(received_signature, expected_signature):
        raise HTTPException(401, "Invalid webhook signature")
    
    return await request.json()

from aiogram import Bot
from hashlib import sha256

TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN")
WEBHOOK_SECRET = sha256(TELEGRAM_BOT_TOKEN.encode()).hexdigest()[:32]

async def verify_telegram_webhook(
    request: Request,
    x_telegram_bot_api_secret_token: str = Header(None)
) -> bool:
    """
    Verify Telegram webhook using secret token.
    """
    if x_telegram_bot_api_secret_token != WEBHOOK_SECRET:
        raise HTTPException(401, "Invalid Telegram webhook token")
    return True

import time
from fastapi import Request, HTTPException

class RateLimiter:
    def __init__(self, redis_client):
        self.redis = redis_client
    
    async def check_rate_limit(
        self,
        key: str,
        limit: int,
        window_seconds: int
    ) -> tuple[bool, int]:
        """
        Check if rate limit is exceeded.
        Returns (allowed, remaining).
        """
        now = int(time.time())
        window_start = now - window_seconds
        
        # Use Redis sorted set for sliding window
        pipe = self.redis.pipeline()
        
        # Remove old entries
        pipe.zremrangebyscore(f"ratelimit:{key}", 0, window_start)
        
        # Count current entries
        pipe.zcard(f"ratelimit:{key}")
        
        # Add current request
        pipe.zadd(f"ratelimit:{key}", {f"{now}:{secrets.token_hex(4)}": now})
        
        # Set expiry
        pipe.expire(f"ratelimit:{key}", window_seconds)
        
        results = pipe.execute()
        current_count = results[1]
        
        if current_count >= limit:
            return False, 0
        
        return True, limit - current_count - 1
    
    async def rate_limit_middleware(
        self,
        request: Request,
        limit: int,
        window: int
    ):
        """Middleware to apply rate limiting."""
        # Determine key (API key or IP)
        api_key = request.headers.get("Authorization", "").replace("Bearer ", "")
        
        if api_key:
            key = f"apikey:{hashlib.md5(api_key.encode()).hexdigest()}"
        else:
            key = f"ip:{request.client.host}"
        
        allowed, remaining = await self.check_rate_limit(key, limit, window)
        
        # Set rate limit headers
        request.state.rate_limit_remaining = remaining
        request.state.rate_limit_limit = limit
        request.state.rate_limit_reset = int(time.time()) + window
        
        if not allowed:
            raise HTTPException(
                status_code=429,
                detail="Rate limit exceeded",
                headers={
                    "X-RateLimit-Limit": str(limit),
                    "X-RateLimit-Remaining": "0",
                    "X-RateLimit-Reset": str(request.state.rate_limit_reset),
                    "Retry-After": str(window)
                }
            )

class AdaptiveRateLimiter(RateLimiter):
    async def check_with_backoff(self, key: str, base_limit: int, window: int):
        """
        Apply exponential backoff for repeat offenders.
        """
        # Get violation count
        violations = int(self.redis.get(f"violations:{key}") or 0)
        
        # Reduce limit based on violations
        adjusted_limit = max(1, base_limit // (2 ** min(violations, 4)))
        
        allowed, remaining = await self.check_rate_limit(
            key, adjusted_limit, window
        )
        
        if not allowed:
            # Increment violations (decay after 1 hour)
            pipe = self.redis.pipeline()
            pipe.incr(f"violations:{key}")
            pipe.expire(f"violations:{key}", 3600)
            pipe.execute()
        
        return allowed, remaining

from fastapi import Request
import secrets

def generate_csrf_token(session_id: str) -> str:
    """Generate CSRF token tied to session."""
    token = secrets.token_urlsafe(32)
    redis_client.setex(f"csrf:{session_id}", 3600, token)
    return token

def verify_csrf_token(session_id: str, token: str) -> bool:
    """Verify CSRF token."""
    stored = redis_client.get(f"csrf:{session_id}")
    if not stored:
        return False
    return secrets.compare_digest(stored, token)

MAX_LOGIN_ATTEMPTS = 5
LOCKOUT_DURATION = 900  # 15 minutes

async def check_brute_force(user_id: int) -> bool:
    """
    Check if user is locked out due to too many failed attempts.
    """
    key = f"failed_attempts:{user_id}"
    attempts = int(redis_client.get(key) or 0)
    
    if attempts >= MAX_LOGIN_ATTEMPTS:
        ttl = redis_client.ttl(key)
        if ttl > 0:
            raise HTTPException(
                429,
                f"Too many failed attempts. Try again in {ttl} seconds."
            )
    
    return True

async def record_failed_attempt(user_id: int):
    """Record a failed authentication attempt."""
    key = f"failed_attempts:{user_id}"
    pipe = redis_client.pipeline()
    pipe.incr(key)
    pipe.expire(key, LOCKOUT_DURATION)
    pipe.execute()

async def clear_failed_attempts(user_id: int):
    """Clear failed attempts on successful login."""
    redis_client.delete(f"failed_attempts:{user_id}")

from fastapi import Request

MAX_BODY_SIZE = 1024 * 1024  # 1MB

@app.middleware("http")
async def limit_body_size(request: Request, call_next):
    if request.headers.get("content-length"):
        if int(request.headers["content-length"]) > MAX_BODY_SIZE:
            raise HTTPException(413, "Request body too large")
    return await call_next(request)

import re

def sanitize_key(key: str) -> str:
    """
    Sanitize Redis key to prevent injection.
    Only allow alphanumeric, underscore, colon.
    """
    if not re.match(r'^[a-zA-Z0-9_:]+$', key):
        raise ValueError(f"Invalid key format: {key}")
    return key

# Usage
user_key = sanitize_key(f"user:{user_id}")

async def export_user_data(user_id: int) -> dict:
    """
    Export all user data (GDPR right to access).
    """
    user = await get_user(user_id)
    transactions = await get_all_transactions(user_id)
    usage = await get_all_usage(user_id)
    
    return {
        "user": {
            "id": user_id,
            "created_at": user.get("created_at"),
            "status": user.get("status")
        },
        "transactions": transactions,
        "usage": usage,
        "exported_at": datetime.utcnow().isoformat()
    }

async def delete_user_data(user_id: int) -> bool:
    """
    Delete all user data (GDPR right to erasure).
    """
    # Get all keys related to user
    keys_to_delete = [
        f"user:{user_id}",
        f"transactions:{user_id}",
        f"transactions:{user_id}:recent",
    ]
    
    # Find all usage keys
    for key in redis_client.scan_iter(f"usage:{user_id}:*"):
        keys_to_delete.append(key)
    
    # Find and delete API keys
    user = await get_user(user_id)
    if user and user.get("api_key_hash"):
        keys_to_delete.append(f"api_key:{user['api_key_hash']}")
    
    # Delete all keys atomically
    if keys_to_delete:
        redis_client.delete(*keys_to_delete)
    
    # Log deletion for audit
    logger.info(f"Deleted user data for {user_id}")
    
    return True

SECURITY_EVENTS = [
    "api_key_created",
    "api_key_deleted",
    "api_key_regenerated",
    "failed_authentication",
    "rate_limit_exceeded",
    "webhook_signature_invalid",
    "suspicious_activity",
    "user_deleted"
]

async def log_security_event(
    event: str,
    user_id: int = None,
    details: dict = None,
    severity: str = "info"
):
    """Log security event for audit."""
    log_entry = {
        "timestamp": datetime.utcnow().isoformat(),
        "event": event,
        "user_id": user_id,
        "details": details,
        "severity": severity
    }
    
    # Store in Redis for quick access
    redis_client.lpush("security_events", json.dumps(log_entry))
    redis_client.ltrim("security_events", 0, 9999)  # Keep last 10k
    
    # Log to file/service
    if severity == "critical":
        logger.critical(log_entry)
    elif severity == "warning":
        logger.warning(log_entry)
    else:
        logger.info(log_entry)