Data Residency and GDPR.

# data_residency/tenant_region.py

"""
Tenant region assignment and routing.

Each tenant is assigned to a region based on their data residency requirements.
"""

from dataclasses import dataclass
from typing import Optional, Dict
from enum import Enum
import logging

logger = logging.getLogger(__name__)


class DataRegion(Enum):
    """Supported data regions."""
    US = "us"
    EU = "eu"
    UK = "uk"
    APAC = "apac"
    BRAZIL = "brazil"
    INDIA = "india"


@dataclass
class RegionConfig:
    """Configuration for a data region."""
    region_id: DataRegion
    display_name: str
    aws_region: str
    database_endpoint: str
    storage_bucket: str
    search_endpoint: str
    cache_endpoint: str
    
    # Compliance attributes
    gdpr_compliant: bool = False
    data_localization: bool = False
    adequacy_decision: bool = False


# Region configurations
REGION_CONFIGS = {
    DataRegion.US: RegionConfig(
        region_id=DataRegion.US,
        display_name="United States",
        aws_region="us-east-1",
        database_endpoint="db-us.example.com",
        storage_bucket="data-us-example",
        search_endpoint="search-us.example.com",
        cache_endpoint="cache-us.example.com",
        gdpr_compliant=False,
        adequacy_decision=False  # DPF covers only certified recipients, not the US as a whole
    ),
    DataRegion.EU: RegionConfig(
        region_id=DataRegion.EU,
        display_name="European Union",
        aws_region="eu-central-1",
        database_endpoint="db-eu.example.com",
        storage_bucket="data-eu-example",
        search_endpoint="search-eu.example.com",
        cache_endpoint="cache-eu.example.com",
        gdpr_compliant=True,
        adequacy_decision=True
    ),
    DataRegion.UK: RegionConfig(
        region_id=DataRegion.UK,
        display_name="United Kingdom",
        aws_region="eu-west-2",
        database_endpoint="db-uk.example.com",
        storage_bucket="data-uk-example",
        search_endpoint="search-uk.example.com",
        cache_endpoint="cache-uk.example.com",
        gdpr_compliant=True,  # UK GDPR
        adequacy_decision=True
    ),
    DataRegion.APAC: RegionConfig(
        region_id=DataRegion.APAC,
        display_name="Asia Pacific",
        aws_region="ap-southeast-1",
        database_endpoint="db-apac.example.com",
        storage_bucket="data-apac-example",
        search_endpoint="search-apac.example.com",
        cache_endpoint="cache-apac.example.com",
        gdpr_compliant=False,
        adequacy_decision=False
    ),
}


@dataclass
class TenantRegionAssignment:
    """A tenant's region assignment."""
    tenant_id: str
    data_region: DataRegion
    reason: str  # Why this region was assigned
    assigned_at: str
    can_change: bool = True  # Some contracts lock the region


class TenantRegionService:
    """
    Service for managing tenant region assignments.
    """
    
    def __init__(self, db, cache):
        self.db = db
        self.cache = cache
    
    async def get_tenant_region(self, tenant_id: str) -> RegionConfig:
        """
        Get the region configuration for a tenant.
        """
        # Check cache first
        cache_key = f"tenant_region:{tenant_id}"
        cached = await self.cache.get(cache_key)
        
        if cached:
            return REGION_CONFIGS[DataRegion(cached)]
        
        # Load from database
        result = await self.db.fetchrow(
            "SELECT data_region FROM tenants WHERE id = $1",
            tenant_id
        )
        
        if not result:
            raise ValueError(f"Tenant not found: {tenant_id}")
        
        region = DataRegion(result["data_region"])
        
        # Cache for 1 hour
        await self.cache.set(cache_key, region.value, ttl=3600)
        
        return REGION_CONFIGS[region]
    
    async def assign_region(
        self,
        tenant_id: str,
        region: DataRegion,
        reason: str
    ) -> TenantRegionAssignment:
        """
        Assign a tenant to a data region.
        
        This should be done during tenant onboarding.
        Changing region later requires data migration.
        """
        from datetime import datetime, timezone
        
        # Validate region is supported
        if region not in REGION_CONFIGS:
            raise ValueError(f"Unsupported region: {region}")
        
        # Update tenant
        await self.db.execute(
            """
            UPDATE tenants 
            SET data_region = $2, region_assigned_at = $3, region_reason = $4
            WHERE id = $1
            """,
            tenant_id, region.value, datetime.now(timezone.utc), reason
        )
        
        # Invalidate cache
        await self.cache.delete(f"tenant_region:{tenant_id}")
        
        logger.info(
            f"Assigned tenant {tenant_id} to region {region.value}",
            extra={"tenant_id": tenant_id, "region": region.value, "reason": reason}
        )
        
        return TenantRegionAssignment(
            tenant_id=tenant_id,
            data_region=region,
            reason=reason,
            assigned_at=datetime.now(timezone.utc).isoformat()
        )
    
    async def suggest_region(
        self,
        country_code: str,
        compliance_requirements: list
    ) -> DataRegion:
        """
        Suggest a region based on country and compliance needs.
        """
        # EU countries → EU region
        eu_countries = [
            "AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR",
            "DE", "GR", "HU", "IE", "IT", "LV", "LT", "LU", "MT", "NL",
            "PL", "PT", "RO", "SK", "SI", "ES", "SE"
        ]
        
        if country_code in eu_countries:
            return DataRegion.EU
        
        if country_code == "GB":
            return DataRegion.UK
        
        if country_code == "US":
            return DataRegion.US
        
        if country_code == "BR":
            return DataRegion.BRAZIL
        
        if country_code == "IN":
            return DataRegion.INDIA
        
        # APAC countries
        apac_countries = ["AU", "NZ", "SG", "JP", "KR", "HK", "TW"]
        if country_code in apac_countries:
            return DataRegion.APAC
        
        # Default to US for others (with SCCs if needed)
        return DataRegion.US

# data_residency/database_router.py

"""
Database routing based on tenant region.

Routes database queries to the correct regional database.
"""

from typing import Dict, Any
import asyncpg
import logging

logger = logging.getLogger(__name__)


class RegionalDatabaseRouter:
    """
    Routes database connections to regional databases.
    
    Each tenant's data is stored in their assigned region's database.
    """
    
    def __init__(
        self,
        region_configs: Dict[DataRegion, RegionConfig],
        tenant_region_service: TenantRegionService
    ):
        self.region_configs = region_configs
        self.tenant_region_service = tenant_region_service
        self._pools: Dict[DataRegion, asyncpg.Pool] = {}
    
    async def initialize(self):
        """Initialize connection pools for all regions."""
        for region, config in self.region_configs.items():
            pool = await asyncpg.create_pool(
                host=config.database_endpoint,
                database="app_db",
                min_size=5,
                max_size=20
            )
            self._pools[region] = pool
            logger.info(f"Initialized database pool for region: {region.value}")
    
    async def get_connection(self, tenant_id: str):
        """
        Get database connection for a tenant.
        
        Routes to the correct regional database.
        """
        # Get tenant's region
        region_config = await self.tenant_region_service.get_tenant_region(tenant_id)
        region = region_config.region_id
        
        if region not in self._pools:
            raise ValueError(f"No database pool for region: {region}")
        
        return self._pools[region].acquire()
    
    async def execute_in_region(
        self,
        region: DataRegion,
        query: str,
        *args
    ) -> Any:
        """
        Execute a query in a specific region.
        
        Used for admin operations that target a specific region.
        """
        if region not in self._pools:
            raise ValueError(f"No database pool for region: {region}")
        
        async with self._pools[region].acquire() as conn:
            return await conn.fetch(query, *args)


class RegionalStorageRouter:
    """
    Routes file storage to regional S3 buckets.
    """
    
    def __init__(
        self,
        region_configs: Dict[DataRegion, RegionConfig],
        tenant_region_service: TenantRegionService
    ):
        self.region_configs = region_configs
        self.tenant_region_service = tenant_region_service
        self._clients: Dict[DataRegion, Any] = {}
    
    async def initialize(self):
        """Initialize S3 clients for all regions."""
        import aioboto3
        
        for region, config in self.region_configs.items():
            session = aioboto3.Session()
            client = await session.client(
                's3',
                region_name=config.aws_region
            ).__aenter__()
            self._clients[region] = (client, config.storage_bucket)
    
    async def upload_file(
        self,
        tenant_id: str,
        file_key: str,
        file_data: bytes,
        content_type: str
    ) -> str:
        """
        Upload a file to the tenant's regional storage.
        """
        region_config = await self.tenant_region_service.get_tenant_region(tenant_id)
        region = region_config.region_id
        
        client, bucket = self._clients[region]
        
        # Include tenant_id in key for organization
        full_key = f"tenants/{tenant_id}/{file_key}"
        
        await client.put_object(
            Bucket=bucket,
            Key=full_key,
            Body=file_data,
            ContentType=content_type,
            Metadata={
                "tenant_id": tenant_id,
                "region": region.value
            }
        )
        
        logger.info(
            f"Uploaded file to regional storage",
            extra={
                "tenant_id": tenant_id,
                "region": region.value,
                "bucket": bucket,
                "key": full_key
            }
        )
        
        return f"s3://{bucket}/{full_key}"
    
    async def get_file(
        self,
        tenant_id: str,
        file_key: str
    ) -> bytes:
        """
        Get a file from the tenant's regional storage.
        """
        region_config = await self.tenant_region_service.get_tenant_region(tenant_id)
        region = region_config.region_id
        
        client, bucket = self._clients[region]
        full_key = f"tenants/{tenant_id}/{file_key}"
        
        response = await client.get_object(Bucket=bucket, Key=full_key)
        return await response['Body'].read()

# data_residency/consent.py

"""
Consent management for GDPR compliance.

Tracks user consent for different processing purposes.
"""

from dataclasses import dataclass
from typing import List, Optional, Dict
from datetime import datetime, timezone
from enum import Enum
import uuid
import logging

logger = logging.getLogger(__name__)


class ConsentPurpose(Enum):
    """Purposes for which consent can be given."""
    SERVICE_DELIVERY = "service_delivery"  # Usually contract basis, not consent
    MARKETING_EMAIL = "marketing_email"
    MARKETING_PHONE = "marketing_phone"
    ANALYTICS = "analytics"
    PERSONALIZATION = "personalization"
    THIRD_PARTY_SHARING = "third_party_sharing"
    PROFILING = "profiling"
    COOKIES_ESSENTIAL = "cookies_essential"
    COOKIES_ANALYTICS = "cookies_analytics"
    COOKIES_MARKETING = "cookies_marketing"


class ConsentStatus(Enum):
    """Status of consent."""
    GRANTED = "granted"
    DENIED = "denied"
    WITHDRAWN = "withdrawn"
    NOT_ASKED = "not_asked"


@dataclass
class ConsentRecord:
    """Record of a consent decision."""
    id: str
    user_id: str
    tenant_id: str
    purpose: ConsentPurpose
    status: ConsentStatus
    granted_at: Optional[datetime]
    withdrawn_at: Optional[datetime]
    ip_address: str
    user_agent: str
    consent_text: str  # Exact text shown to user
    consent_version: str  # Version of consent form


@dataclass
class ConsentPreferences:
    """A user's current consent preferences."""
    user_id: str
    consents: Dict[ConsentPurpose, ConsentStatus]
    last_updated: datetime


class ConsentService:
    """
    Service for managing user consent.
    
    Key principles:
    - Consent must be freely given, specific, informed, unambiguous
    - Must be as easy to withdraw as to give
    - Must keep records of when/how consent was given
    - Consent is per-purpose, not blanket
    """
    
    def __init__(self, db, event_publisher):
        self.db = db
        self.events = event_publisher
    
    async def record_consent(
        self,
        user_id: str,
        tenant_id: str,
        purpose: ConsentPurpose,
        granted: bool,
        ip_address: str,
        user_agent: str,
        consent_text: str,
        consent_version: str
    ) -> ConsentRecord:
        """
        Record a consent decision.
        
        This creates an immutable audit record.
        """
        record = ConsentRecord(
            id=str(uuid.uuid4()),
            user_id=user_id,
            tenant_id=tenant_id,
            purpose=purpose,
            status=ConsentStatus.GRANTED if granted else ConsentStatus.DENIED,
            granted_at=datetime.now(timezone.utc) if granted else None,
            withdrawn_at=None,
            ip_address=ip_address,
            user_agent=user_agent,
            consent_text=consent_text,
            consent_version=consent_version
        )
        
        # Store in database (immutable log)
        await self.db.execute(
            """
            INSERT INTO consent_records 
            (id, user_id, tenant_id, purpose, status, granted_at, 
             ip_address, user_agent, consent_text, consent_version, created_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
            """,
            record.id, record.user_id, record.tenant_id,
            record.purpose.value, record.status.value, record.granted_at,
            record.ip_address, record.user_agent, record.consent_text,
            record.consent_version, datetime.now(timezone.utc)
        )
        
        # Update current preferences
        await self._update_current_preferences(
            user_id, tenant_id, purpose,
            ConsentStatus.GRANTED if granted else ConsentStatus.DENIED
        )
        
        # Publish event for downstream systems
        await self.events.publish(
            "consent",
            {
                "type": "consent.recorded",
                "user_id": user_id,
                "tenant_id": tenant_id,
                "purpose": purpose.value,
                "granted": granted
            }
        )
        
        logger.info(
            f"Consent recorded",
            extra={
                "user_id": user_id,
                "purpose": purpose.value,
                "granted": granted
            }
        )
        
        return record
    
    async def withdraw_consent(
        self,
        user_id: str,
        tenant_id: str,
        purpose: ConsentPurpose,
        ip_address: str,
        user_agent: str
    ) -> ConsentRecord:
        """
        Withdraw previously given consent.
        
        Must be as easy as giving consent.
        """
        record = ConsentRecord(
            id=str(uuid.uuid4()),
            user_id=user_id,
            tenant_id=tenant_id,
            purpose=purpose,
            status=ConsentStatus.WITHDRAWN,
            granted_at=None,
            withdrawn_at=datetime.now(timezone.utc),
            ip_address=ip_address,
            user_agent=user_agent,
            consent_text="Consent withdrawn by user",
            consent_version="withdrawal"
        )
        
        await self.db.execute(
            """
            INSERT INTO consent_records 
            (id, user_id, tenant_id, purpose, status, withdrawn_at,
             ip_address, user_agent, consent_text, consent_version, created_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
            """,
            record.id, record.user_id, record.tenant_id,
            record.purpose.value, record.status.value, record.withdrawn_at,
            record.ip_address, record.user_agent, record.consent_text,
            record.consent_version, datetime.now(timezone.utc)
        )
        
        await self._update_current_preferences(
            user_id, tenant_id, purpose, ConsentStatus.WITHDRAWN
        )
        
        # Publish event - systems must stop processing
        await self.events.publish(
            "consent",
            {
                "type": "consent.withdrawn",
                "user_id": user_id,
                "tenant_id": tenant_id,
                "purpose": purpose.value
            }
        )
        
        logger.info(
            f"Consent withdrawn",
            extra={"user_id": user_id, "purpose": purpose.value}
        )
        
        return record
    
    async def get_current_consent(
        self,
        user_id: str,
        tenant_id: str,
        purpose: ConsentPurpose
    ) -> ConsentStatus:
        """
        Get current consent status for a purpose.
        """
        result = await self.db.fetchrow(
            """
            SELECT status FROM user_consent_preferences
            WHERE user_id = $1 AND tenant_id = $2 AND purpose = $3
            """,
            user_id, tenant_id, purpose.value
        )
        
        if not result:
            return ConsentStatus.NOT_ASKED
        
        return ConsentStatus(result["status"])
    
    async def has_consent(
        self,
        user_id: str,
        tenant_id: str,
        purpose: ConsentPurpose
    ) -> bool:
        """
        Check if user has given consent for a purpose.
        """
        status = await self.get_current_consent(user_id, tenant_id, purpose)
        return status == ConsentStatus.GRANTED
    
    async def get_all_preferences(
        self,
        user_id: str,
        tenant_id: str
    ) -> ConsentPreferences:
        """
        Get all consent preferences for a user.
        """
        results = await self.db.fetch(
            """
            SELECT purpose, status, updated_at
            FROM user_consent_preferences
            WHERE user_id = $1 AND tenant_id = $2
            """,
            user_id, tenant_id
        )
        
        consents = {}
        last_updated = datetime.min.replace(tzinfo=timezone.utc)
        
        for row in results:
            consents[ConsentPurpose(row["purpose"])] = ConsentStatus(row["status"])
            if row["updated_at"] > last_updated:
                last_updated = row["updated_at"]
        
        return ConsentPreferences(
            user_id=user_id,
            consents=consents,
            last_updated=last_updated
        )
    
    async def get_consent_history(
        self,
        user_id: str,
        tenant_id: str
    ) -> List[ConsentRecord]:
        """
        Get full consent history for a user.
        
        Required for data subject access requests.
        """
        results = await self.db.fetch(
            """
            SELECT * FROM consent_records
            WHERE user_id = $1 AND tenant_id = $2
            ORDER BY created_at DESC
            """,
            user_id, tenant_id
        )
        
        return [
            ConsentRecord(
                id=row["id"],
                user_id=row["user_id"],
                tenant_id=row["tenant_id"],
                purpose=ConsentPurpose(row["purpose"]),
                status=ConsentStatus(row["status"]),
                granted_at=row["granted_at"],
                withdrawn_at=row["withdrawn_at"],
                ip_address=row["ip_address"],
                user_agent=row["user_agent"],
                consent_text=row["consent_text"],
                consent_version=row["consent_version"]
            )
            for row in results
        ]
    
    async def _update_current_preferences(
        self,
        user_id: str,
        tenant_id: str,
        purpose: ConsentPurpose,
        status: ConsentStatus
    ):
        """Update current preferences table."""
        await self.db.execute(
            """
            INSERT INTO user_consent_preferences (user_id, tenant_id, purpose, status, updated_at)
            VALUES ($1, $2, $3, $4, $5)
            ON CONFLICT (user_id, tenant_id, purpose) 
            DO UPDATE SET status = $4, updated_at = $5
            """,
            user_id, tenant_id, purpose.value, status.value, datetime.now(timezone.utc)
        )

# data_residency/consent_middleware.py

"""
Middleware and decorators for consent-aware processing.
"""

from functools import wraps
from fastapi import HTTPException


def requires_consent(purpose: ConsentPurpose):
    """
    Decorator that ensures user has consented to a purpose.
    
    Usage:
        @requires_consent(ConsentPurpose.MARKETING_EMAIL)
        async def send_marketing_email(user_id: str):
            ...
    """
    def decorator(func):
        @wraps(func)
        async def wrapper(*args, **kwargs):
            # Get user_id from kwargs or context
            user_id = kwargs.get("user_id")
            tenant_id = get_current_tenant_id()
            
            if not user_id:
                raise ValueError("user_id required for consent check")
            
            # Check consent
            has_consent = await consent_service.has_consent(
                user_id, tenant_id, purpose
            )
            
            if not has_consent:
                raise ConsentRequiredError(
                    f"User has not consented to {purpose.value}"
                )
            
            return await func(*args, **kwargs)
        return wrapper
    return decorator


class ConsentRequiredError(Exception):
    """Raised when required consent is not present."""
    pass


# Example usage in a service
class MarketingService:
    """Service that requires consent for operations."""
    
    def __init__(self, consent_service: ConsentService, email_client):
        self.consent = consent_service
        self.email = email_client
    
    async def send_newsletter(self, user_id: str, content: str):
        """
        Send newsletter to user.
        
        Requires marketing email consent.
        """
        tenant_id = get_current_tenant_id()
        
        # Check consent before sending
        if not await self.consent.has_consent(
            user_id, tenant_id, ConsentPurpose.MARKETING_EMAIL
        ):
            logger.info(
                f"Skipping newsletter for user without consent",
                extra={"user_id": user_id}
            )
            return False
        
        await self.email.send(
            to=user_id,
            subject="Newsletter",
            content=content
        )
        
        return True
    
    async def send_bulk_newsletter(self, user_ids: List[str], content: str):
        """
        Send newsletter to multiple users.
        
        Filters to only users with consent.
        """
        tenant_id = get_current_tenant_id()
        
        # Batch check consent
        consented_users = []
        
        for user_id in user_ids:
            if await self.consent.has_consent(
                user_id, tenant_id, ConsentPurpose.MARKETING_EMAIL
            ):
                consented_users.append(user_id)
        
        logger.info(
            f"Sending newsletter to {len(consented_users)}/{len(user_ids)} users with consent"
        )
        
        for user_id in consented_users:
            await self.email.send(
                to=user_id,
                subject="Newsletter",
                content=content
            )
        
        return len(consented_users)

# data_residency/transfer_assessment.py

"""
Cross-border data transfer assessment and documentation.
"""

from dataclasses import dataclass
from typing import List, Optional
from datetime import datetime, timezone
from enum import Enum


class TransferMechanism(Enum):
    """Legal mechanisms for cross-border transfers."""
    ADEQUACY_DECISION = "adequacy_decision"
    STANDARD_CONTRACTUAL_CLAUSES = "sccs"
    BINDING_CORPORATE_RULES = "bcrs"
    DEROGATION = "derogation"
    CONSENT = "consent"


class RiskLevel(Enum):
    """Risk level for data transfers."""
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    PROHIBITED = "prohibited"


@dataclass
class TransferAssessment:
    """Assessment of a cross-border data transfer."""
    id: str
    source_region: str
    destination_region: str
    data_categories: List[str]
    data_subjects: str  # Description of affected individuals
    transfer_mechanism: TransferMechanism
    risk_level: RiskLevel
    supplementary_measures: List[str]
    assessment_date: datetime
    next_review_date: datetime
    approved_by: str
    notes: str


class TransferImpactAssessment:
    """
    Performs Transfer Impact Assessments (TIAs) as required by Schrems II.
    """
    
    # Countries with adequacy decisions (simplified)
    ADEQUATE_COUNTRIES = {
        "EU", "EEA", "GB", "CH", "JP", "KR", "CA", "NZ", "IL", "UY", "AR", "BR"
    }
    
    # Countries with high surveillance risk (simplified assessment)
    HIGH_RISK_COUNTRIES = {
        "CN", "RU"  # This is a simplification - real assessment is more nuanced
    }
    
    def assess_transfer(
        self,
        source_country: str,
        destination_country: str,
        data_categories: List[str],
        special_categories: bool = False
    ) -> TransferAssessment:
        """
        Assess a proposed data transfer.
        """
        # Same region = no transfer
        if source_country == destination_country:
            return self._create_assessment(
                source_country, destination_country, data_categories,
                TransferMechanism.ADEQUACY_DECISION,  # Not really a transfer
                RiskLevel.LOW,
                []
            )
        
        # Check adequacy
        if destination_country in self.ADEQUATE_COUNTRIES:
            return self._create_assessment(
                source_country, destination_country, data_categories,
                TransferMechanism.ADEQUACY_DECISION,
                RiskLevel.LOW,
                []
            )
        
        # US-specific handling (Data Privacy Framework)
        if destination_country == "US":
            return self._create_assessment(
                source_country, destination_country, data_categories,
                TransferMechanism.ADEQUACY_DECISION,  # DPF
                RiskLevel.MEDIUM,  # Some risk remains
                ["Verify recipient is DPF certified (if not: SCCs + TIA)",
                 "Review specific data categories"]
            )
        
        # High-risk countries
        if destination_country in self.HIGH_RISK_COUNTRIES:
            if special_categories:
                return self._create_assessment(
                    source_country, destination_country, data_categories,
                    TransferMechanism.DEROGATION,
                    RiskLevel.PROHIBITED,
                    ["Transfer of special categories to this jurisdiction is not recommended"]
                )
            
            return self._create_assessment(
                source_country, destination_country, data_categories,
                TransferMechanism.STANDARD_CONTRACTUAL_CLAUSES,
                RiskLevel.HIGH,
                ["Implement encryption in transit and at rest",
                 "Minimize data transferred",
                 "Regular review of legal situation",
                 "Consider pseudonymization"]
            )
        
        # Default: SCCs with supplementary measures
        return self._create_assessment(
            source_country, destination_country, data_categories,
            TransferMechanism.STANDARD_CONTRACTUAL_CLAUSES,
            RiskLevel.MEDIUM,
            ["Sign SCCs with recipient",
             "Document supplementary measures",
             "Review annually"]
        )
    
    def _create_assessment(
        self,
        source: str,
        dest: str,
        data_categories: List[str],
        mechanism: TransferMechanism,
        risk: RiskLevel,
        measures: List[str]
    ) -> TransferAssessment:
        """Create assessment record."""
        import uuid
        from datetime import timedelta
        
        return TransferAssessment(
            id=str(uuid.uuid4()),
            source_region=source,
            destination_region=dest,
            data_categories=data_categories,
            data_subjects="Users and employees of tenant",
            transfer_mechanism=mechanism,
            risk_level=risk,
            supplementary_measures=measures,
            assessment_date=datetime.now(timezone.utc),
            next_review_date=datetime.now(timezone.utc) + timedelta(days=365),
            approved_by="",
            notes=""
        )

# data_residency/dpa.py

"""
Data Processing Agreement (DPA) management.

GDPR Article 28 requires written contracts with data processors.
"""

from dataclasses import dataclass
from typing import List, Optional
from datetime import datetime, timezone
from enum import Enum


class DPAStatus(Enum):
    """Status of a DPA."""
    DRAFT = "draft"
    PENDING_SIGNATURE = "pending_signature"
    ACTIVE = "active"
    EXPIRED = "expired"
    TERMINATED = "terminated"


@dataclass
class DataProcessingAgreement:
    """A Data Processing Agreement with a tenant or vendor."""
    id: str
    tenant_id: str
    counterparty_name: str
    counterparty_type: str  # "customer" or "vendor"
    
    # Processing details
    processing_purposes: List[str]
    data_categories: List[str]
    data_subject_categories: List[str]
    retention_period: str
    
    # Transfer details
    processing_locations: List[str]
    subprocessors: List[str]
    transfer_mechanism: Optional[str]
    
    # Agreement details
    status: DPAStatus
    signed_date: Optional[datetime]
    effective_date: Optional[datetime]
    expiration_date: Optional[datetime]
    document_url: str
    
    # Audit
    created_at: datetime
    updated_at: datetime


class DPAService:
    """
    Service for managing Data Processing Agreements.
    """
    
    def __init__(self, db, document_storage):
        self.db = db
        self.storage = document_storage
    
    async def create_dpa(
        self,
        tenant_id: str,
        counterparty_name: str,
        counterparty_type: str,
        processing_purposes: List[str],
        data_categories: List[str],
        processing_locations: List[str]
    ) -> DataProcessingAgreement:
        """
        Create a new DPA.
        """
        import uuid
        
        dpa_id = str(uuid.uuid4())
        
        dpa = DataProcessingAgreement(
            id=dpa_id,
            tenant_id=tenant_id,
            counterparty_name=counterparty_name,
            counterparty_type=counterparty_type,
            processing_purposes=processing_purposes,
            data_categories=data_categories,
            data_subject_categories=["Employees", "End users"],
            retention_period="As specified in main agreement",
            processing_locations=processing_locations,
            subprocessors=[],
            transfer_mechanism=None,
            status=DPAStatus.DRAFT,
            signed_date=None,
            effective_date=None,
            expiration_date=None,
            document_url="",
            created_at=datetime.now(timezone.utc),
            updated_at=datetime.now(timezone.utc)
        )
        
        # Store in database
        await self._save_dpa(dpa)
        
        return dpa
    
    async def get_active_dpas(self, tenant_id: str) -> List[DataProcessingAgreement]:
        """Get all active DPAs for a tenant."""
        results = await self.db.fetch(
            """
            SELECT * FROM data_processing_agreements
            WHERE tenant_id = $1 AND status = 'active'
            """,
            tenant_id
        )
        
        return [self._row_to_dpa(row) for row in results]
    
    async def get_subprocessors(self, tenant_id: str) -> List[dict]:
        """
        Get list of subprocessors for a tenant.
        
        Required for GDPR transparency.
        """
        # Our subprocessors (third-party services we use)
        our_subprocessors = [
            {
                "name": "Amazon Web Services",
                "purpose": "Cloud infrastructure",
                "location": "EU (Frankfurt)",
                "dpa_url": "https://aws.amazon.com/compliance/gdpr-center/"
            },
            {
                "name": "Stripe",
                "purpose": "Payment processing",
                "location": "US (with DPF certification)",
                "dpa_url": "https://stripe.com/legal/dpa"
            },
            {
                "name": "SendGrid",
                "purpose": "Email delivery",
                "location": "US (with SCCs)",
                "dpa_url": "https://www.twilio.com/en-us/legal/data-protection-addendum"
            }
        ]
        
        return our_subprocessors
    
    async def _save_dpa(self, dpa: DataProcessingAgreement):
        """Save DPA to database."""
        await self.db.execute(
            """
            INSERT INTO data_processing_agreements 
            (id, tenant_id, counterparty_name, counterparty_type,
             processing_purposes, data_categories, processing_locations,
             status, created_at, updated_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
            """,
            dpa.id, dpa.tenant_id, dpa.counterparty_name, dpa.counterparty_type,
            dpa.processing_purposes, dpa.data_categories, dpa.processing_locations,
            dpa.status.value, dpa.created_at, dpa.updated_at
        )
    
    def _row_to_dpa(self, row) -> DataProcessingAgreement:
        """Convert database row to DPA object."""
        return DataProcessingAgreement(
            id=row["id"],
            tenant_id=row["tenant_id"],
            counterparty_name=row["counterparty_name"],
            counterparty_type=row["counterparty_type"],
            processing_purposes=row["processing_purposes"],
            data_categories=row["data_categories"],
            data_subject_categories=row.get("data_subject_categories", []),
            retention_period=row.get("retention_period", ""),
            processing_locations=row["processing_locations"],
            subprocessors=row.get("subprocessors", []),
            transfer_mechanism=row.get("transfer_mechanism"),
            status=DPAStatus(row["status"]),
            signed_date=row.get("signed_date"),
            effective_date=row.get("effective_date"),
            expiration_date=row.get("expiration_date"),
            document_url=row.get("document_url", ""),
            created_at=row["created_at"],
            updated_at=row["updated_at"]
        )