Security Architecture.

# security/secrets.py

"""
Secrets management using AWS Secrets Manager / HashiCorp Vault.

Never store secrets in:
- Environment variables (inherited by child processes, readable via /proc, leak into crash dumps and debug pages)
- Config files (committed to git)
- Container images (visible in layers)
"""

from dataclasses import dataclass
from typing import Optional, Dict, Any
from datetime import datetime, timedelta, timezone
import json
import logging

logger = logging.getLogger(__name__)


@dataclass
class Secret:
    """A secret value with metadata."""
    name: str
    value: str
    version: str
    created_at: datetime
    expires_at: Optional[datetime]
    metadata: Dict[str, Any]


class SecretsManager:
    """
    Centralized secrets management.
    
    Features:
    - Automatic rotation
    - Audit logging
    - Caching with TTL
    - Tenant isolation
    
    `vault_client` is a thin wrapper that returns
    `{"data": {...secret fields...}, "metadata": {"version": ..., "created_time": ...}}`.
    Vault's raw KV v2 read nests the same two parts one level deeper, under
    `response["data"]["data"]` and `response["data"]["metadata"]`; hvac's
    `read_secret_version` returns that raw shape, so unwrap it in the wrapper.
    """
    
    def __init__(self, vault_client, cache, audit_logger):
        self.vault = vault_client
        self.cache = cache
        self.audit = audit_logger
        self._cache_ttl = 300  # 5 minutes
    
    async def get_secret(
        self,
        secret_name: str,
        tenant_id: Optional[str] = None
    ) -> Secret:
        """
        Retrieve a secret.
        
        Secrets are cached locally (in-process, never in a shared cache
        like Redis) to reduce Vault calls; the TTL bounds how long a
        rotated-out value can still be used.
        """
        # Build full path
        if tenant_id:
            path = f"tenants/{tenant_id}/secrets/{secret_name}"
        else:
            path = f"global/secrets/{secret_name}"
        
        # Check cache
        cache_key = f"secret:{path}"
        cached = await self.cache.get(cache_key)
        
        if cached:
            return Secret(**json.loads(cached))
        
        # Fetch from Vault
        try:
            result = await self.vault.read(path)
            
            secret = Secret(
                name=secret_name,
                value=result["data"]["value"],
                version=result["metadata"]["version"],
                created_at=datetime.fromisoformat(
                    result["metadata"]["created_time"].replace("Z", "+00:00")
                ),
                expires_at=result["data"].get("expires_at"),
                metadata=result["metadata"]
            )
            
            # Cache it
            await self.cache.set(
                cache_key,
                json.dumps(secret.__dict__, default=str),
                ttl=self._cache_ttl
            )
            
            # Audit log
            await self.audit.log(
                action="secret_accessed",
                secret_name=secret_name,
                tenant_id=tenant_id
            )
            
            return secret
            
        except Exception as e:
            logger.error(f"Failed to retrieve secret {secret_name}: {e}")
            raise SecretNotFoundError(f"Secret not found: {secret_name}")
    
    async def set_secret(
        self,
        secret_name: str,
        value: str,
        tenant_id: Optional[str] = None,
        expires_in: Optional[timedelta] = None
    ) -> Secret:
        """
        Store a secret.
        """
        if tenant_id:
            path = f"tenants/{tenant_id}/secrets/{secret_name}"
        else:
            path = f"global/secrets/{secret_name}"
        
        data = {"value": value}
        
        if expires_in:
            data["expires_at"] = (datetime.now(timezone.utc) + expires_in).isoformat()
        
        result = await self.vault.write(path, data)
        
        # Invalidate cache
        await self.cache.delete(f"secret:{path}")
        
        # Audit log
        await self.audit.log(
            action="secret_updated",
            secret_name=secret_name,
            tenant_id=tenant_id
        )
        
        return await self.get_secret(secret_name, tenant_id)
    
    async def rotate_secret(
        self,
        secret_name: str,
        rotation_func,
        tenant_id: Optional[str] = None
    ):
        """
        Rotate a secret using provided rotation function.
        
        rotation_func should:
        1. Generate new secret value
        2. Update external system (e.g., database password)
        3. Return new value
        """
        logger.info(f"Rotating secret: {secret_name}")
        
        try:
            # Generate new secret
            new_value = await rotation_func()
            
            # Store new version
            await self.set_secret(secret_name, new_value, tenant_id)
            
            # Audit log
            await self.audit.log(
                action="secret_rotated",
                secret_name=secret_name,
                tenant_id=tenant_id
            )
            
            logger.info(f"Secret rotated: {secret_name}")
            
        except Exception as e:
            logger.error(f"Secret rotation failed: {e}")
            await self.audit.log(
                action="secret_rotation_failed",
                secret_name=secret_name,
                tenant_id=tenant_id,
                error=str(e)
            )
            raise


class SecretNotFoundError(Exception):
    """Raised when a secret is not found."""
    pass


# Database credential rotation
async def rotate_database_password(db_admin_client, username: str):
    """
    Rotate a database user's password.
    
    This is called by SecretsManager.rotate_secret()
    
    Note: with a single user, connections opened with a cached old
    password fail until caches expire. Production rotations alternate
    between two users (AWS's "alternating users" strategy).
    """
    import secrets
    from psycopg import sql
    
    # Generate new password
    new_password = secrets.token_urlsafe(32)
    
    # ALTER USER can't take bind parameters: quote the identifier and
    # the literal safely instead of using an f-string
    await db_admin_client.execute(
        sql.SQL("ALTER USER {} WITH PASSWORD {}").format(
            sql.Identifier(username), sql.Literal(new_password)
        )
    )
    
    return new_password

# security/config.py

"""
Application configuration that separates secrets from config.

Config: In code/environment (non-sensitive)
Secrets: In secrets manager (sensitive)
"""

from dataclasses import dataclass
from typing import Optional
import os


@dataclass
class DatabaseConfig:
    """Database configuration (secrets fetched separately)."""
    host: str
    port: int
    database: str
    ssl_mode: str = "require"
    pool_size: int = 10
    
    # Note: No password here!
    
    @classmethod
    def from_env(cls):
        return cls(
            host=os.getenv("DB_HOST", "localhost"),
            port=int(os.getenv("DB_PORT", "5432")),
            database=os.getenv("DB_NAME", "app"),
            ssl_mode=os.getenv("DB_SSL_MODE", "require"),
            pool_size=int(os.getenv("DB_POOL_SIZE", "10"))
        )


@dataclass  
class AppConfig:
    """Application configuration."""
    environment: str
    debug: bool
    log_level: str
    
    database: DatabaseConfig
    
    # Secrets are NOT in config
    # They're fetched at runtime from SecretsManager
    
    @classmethod
    def from_env(cls):
        return cls(
            environment=os.getenv("ENVIRONMENT", "development"),
            debug=os.getenv("DEBUG", "false").lower() == "true",
            log_level=os.getenv("LOG_LEVEL", "INFO"),
            database=DatabaseConfig.from_env()
        )


class SecureConnectionFactory:
    """
    Creates database connections with secrets from vault.
    
    Secrets are fetched at connection time, not startup time.
    This allows rotation without restart.
    """
    
    def __init__(self, config: DatabaseConfig, secrets_manager: SecretsManager):
        self.config = config
        self.secrets = secrets_manager
    
    async def create_connection(self):
        """Create a database connection with current credentials."""
        import asyncpg
        
        # Fetch current password from secrets manager
        secret = await self.secrets.get_secret("database/app_user_password")
        
        return await asyncpg.connect(
            host=self.config.host,
            port=self.config.port,
            database=self.config.database,
            user="app_user",
            password=secret.value,  # From vault, not config
            ssl=self.config.ssl_mode
        )
    
    async def create_pool(self):
        """Create a connection pool with credential refresh."""
        import asyncpg
        
        async def get_password():
            secret = await self.secrets.get_secret("database/app_user_password")
            return secret.value
        
        return await asyncpg.create_pool(
            host=self.config.host,
            port=self.config.port,
            database=self.config.database,
            user="app_user",
            # Pass the coroutine function, not its result: asyncpg calls it
            # for every new connection, so the pool picks up rotations
            password=get_password,
            ssl=self.config.ssl_mode,
            min_size=2,
            max_size=self.config.pool_size
        )

# security/authentication.py

"""
Authentication service with multiple methods.
"""

from dataclasses import dataclass
from typing import Optional, List
from datetime import datetime, timedelta, timezone
from enum import Enum
import jwt
import bcrypt
import secrets
import logging

logger = logging.getLogger(__name__)


class AuthMethod(Enum):
    """Supported authentication methods."""
    PASSWORD = "password"
    API_KEY = "api_key"
    OAUTH = "oauth"
    SAML = "saml"
    MFA_TOTP = "mfa_totp"


@dataclass
class AuthenticatedUser:
    """Result of successful authentication."""
    user_id: str
    tenant_id: str
    email: str
    roles: List[str]
    permissions: List[str]
    auth_method: AuthMethod
    mfa_verified: bool
    session_id: str


@dataclass
class AuthToken:
    """JWT token with claims."""
    access_token: str
    refresh_token: str
    expires_at: datetime
    token_type: str = "Bearer"


class AuthenticationService:
    """
    Handles user authentication.
    
    Security features:
    - Password hashing with bcrypt
    - Rate limiting on failures
    - MFA support
    - Session management
    - Audit logging
    """
    
    def __init__(
        self,
        db,
        cache,
        secrets_manager,
        audit_logger
    ):
        self.db = db
        self.cache = cache
        self.secrets = secrets_manager
        self.audit = audit_logger
    
    async def authenticate_password(
        self,
        email: str,
        password: str,
        ip_address: str,
        user_agent: str
    ) -> Optional[AuthenticatedUser]:
        """
        Authenticate with email and password.
        """
        # Check rate limit
        if await self._is_rate_limited(email, ip_address):
            await self.audit.log(
                action="auth_rate_limited",
                email=email,
                ip_address=ip_address
            )
            raise AuthenticationError("Too many attempts. Try again later.")
        
        # Find user
        user = await self.db.fetchrow(
            """
            SELECT id, tenant_id, email, password_hash, roles, 
                   mfa_enabled, status
            FROM users 
            WHERE email = $1
            """,
            email.lower()
        )
        
        if not user:
            await self._record_failed_attempt(email, ip_address)
            await self.audit.log(
                action="auth_failed",
                reason="user_not_found",
                email=email,
                ip_address=ip_address
            )
            raise AuthenticationError("Invalid credentials")
        
        # Verify password (before revealing anything about the account)
        if not bcrypt.checkpw(
            password.encode(),
            user["password_hash"].encode()
        ):
            await self._record_failed_attempt(email, ip_address)
            await self.audit.log(
                action="auth_failed",
                reason="invalid_password",
                user_id=user["id"],
                ip_address=ip_address
            )
            raise AuthenticationError("Invalid credentials")
        
        # Check status only after the password is proven
        if user["status"] != "active":
            await self.audit.log(
                action="auth_failed",
                reason="account_inactive",
                user_id=user["id"]
            )
            raise AuthenticationError("Account is not active")
        
        # Clear rate limit on success
        await self._clear_failed_attempts(email, ip_address)
        
        # Create session
        session_id = secrets.token_urlsafe(32)
        
        authenticated = AuthenticatedUser(
            user_id=user["id"],
            tenant_id=user["tenant_id"],
            email=user["email"],
            roles=user["roles"],
            permissions=await self._get_permissions(user["roles"]),
            auth_method=AuthMethod.PASSWORD,
            mfa_verified=not user["mfa_enabled"],  # False if MFA required
            session_id=session_id
        )
        
        # Store session
        await self._create_session(authenticated, ip_address, user_agent)
        
        # Audit log
        await self.audit.log(
            action="auth_success",
            user_id=user["id"],
            method="password",
            ip_address=ip_address,
            mfa_required=user["mfa_enabled"]
        )
        
        return authenticated
    
    async def verify_mfa(
        self,
        session_id: str,
        totp_code: str
    ) -> AuthenticatedUser:
        """
        Verify MFA TOTP code.
        """
        # Get session
        session = await self._get_session(session_id)
        
        if not session:
            raise AuthenticationError("Session not found")
        
        if session["mfa_verified"]:
            raise AuthenticationError("MFA already verified")
        
        # Limit guesses: a 6-digit code is brute-forceable without this
        mfa_key = f"mfa:{session['user_id']}"
        if await self._is_rate_limited(mfa_key, "any"):
            raise AuthenticationError("Too many attempts. Try again later.")
        
        # Get user's TOTP secret
        user = await self.db.fetchrow(
            "SELECT mfa_secret FROM users WHERE id = $1",
            session["user_id"]
        )
        
        # Verify TOTP
        import pyotp
        totp = pyotp.TOTP(user["mfa_secret"])
        
        if not totp.verify(totp_code, valid_window=1):
            await self._record_failed_attempt(mfa_key, "any")
            await self.audit.log(
                action="mfa_failed",
                user_id=session["user_id"]
            )
            raise AuthenticationError("Invalid MFA code")
        
        # Update session
        await self._update_session_mfa(session_id)
        
        await self.audit.log(
            action="mfa_success",
            user_id=session["user_id"]
        )
        
        return AuthenticatedUser(
            user_id=session["user_id"],
            tenant_id=session["tenant_id"],
            email=session["email"],
            roles=session["roles"],
            permissions=await self._get_permissions(session["roles"]),
            auth_method=AuthMethod.MFA_TOTP,
            mfa_verified=True,
            session_id=session_id
        )
    
    async def create_tokens(
        self,
        user: AuthenticatedUser
    ) -> AuthToken:
        """
        Create JWT access and refresh tokens.
        """
        # Get signing key from secrets
        signing_key = await self.secrets.get_secret("jwt/signing_key")
        
        now = datetime.now(timezone.utc)
        access_expires = now + timedelta(minutes=15)
        refresh_expires = now + timedelta(days=7)
        
        # Access token (short-lived)
        access_payload = {
            "sub": user.user_id,
            "tenant_id": user.tenant_id,
            "email": user.email,
            "roles": user.roles,
            "session_id": user.session_id,
            "type": "access",
            "iat": now,
            "exp": access_expires
        }
        
        access_token = jwt.encode(
            access_payload,
            signing_key.value,
            algorithm="HS256"
        )
        
        # Refresh token (longer-lived, minimal claims)
        refresh_payload = {
            "sub": user.user_id,
            "session_id": user.session_id,
            "type": "refresh",
            "iat": now,
            "exp": refresh_expires
        }
        
        refresh_token = jwt.encode(
            refresh_payload,
            signing_key.value,
            algorithm="HS256"
        )
        
        return AuthToken(
            access_token=access_token,
            refresh_token=refresh_token,
            expires_at=access_expires
        )
    
    async def validate_token(self, token: str) -> AuthenticatedUser:
        """
        Validate a JWT token.
        """
        signing_key = await self.secrets.get_secret("jwt/signing_key")
        
        try:
            payload = jwt.decode(
                token,
                signing_key.value,
                algorithms=["HS256"]
            )
        except jwt.ExpiredSignatureError:
            raise AuthenticationError("Token expired")
        except jwt.InvalidTokenError:
            raise AuthenticationError("Invalid token")
        
        # Refresh tokens are signed with the same key: reject them here
        if payload.get("type") != "access":
            raise AuthenticationError("Invalid token type")
        
        # Verify session is still valid
        session = await self._get_session(payload["session_id"])
        
        if not session:
            raise AuthenticationError("Session expired")
        
        return AuthenticatedUser(
            user_id=payload["sub"],
            tenant_id=payload["tenant_id"],
            email=payload["email"],
            roles=payload["roles"],
            permissions=await self._get_permissions(payload["roles"]),
            auth_method=AuthMethod.PASSWORD,
            # From the server-side session: a token issued before the MFA
            # step must not count as MFA-verified
            mfa_verified=session.get("mfa_verified", False),
            session_id=payload["session_id"]
        )
    
    async def _is_rate_limited(self, email: str, ip_address: str) -> bool:
        """Check if login attempts are rate limited."""
        key = f"auth_attempts:{email}:{ip_address}"
        attempts = await self.cache.get(key)
        return attempts and int(attempts) >= 5
    
    async def _record_failed_attempt(self, email: str, ip_address: str):
        """Record a failed login attempt."""
        key = f"auth_attempts:{email}:{ip_address}"
        await self.cache.incr(key)
        await self.cache.expire(key, 900)  # 15 minutes
    
    async def _clear_failed_attempts(self, email: str, ip_address: str):
        """Clear failed attempts after successful login."""
        key = f"auth_attempts:{email}:{ip_address}"
        await self.cache.delete(key)
    
    async def _get_permissions(self, roles: List[str]) -> List[str]:
        """Get permissions for roles."""
        permissions = set()
        
        for role in roles:
            role_perms = await self.cache.get(f"role_permissions:{role}")
            if role_perms:
                permissions.update(role_perms)
        
        return list(permissions)
    
    async def _create_session(
        self,
        user: AuthenticatedUser,
        ip_address: str,
        user_agent: str
    ):
        """Create a new session."""
        await self.cache.setex(
            f"session:{user.session_id}",
            86400 * 7,  # 7 days
            {
                "user_id": user.user_id,
                "tenant_id": user.tenant_id,
                "email": user.email,
                "roles": user.roles,
                "mfa_verified": user.mfa_verified,
                "ip_address": ip_address,
                "user_agent": user_agent,
                "created_at": datetime.now(timezone.utc).isoformat()
            }
        )
    
    async def _get_session(self, session_id: str) -> Optional[dict]:
        """Get session by ID."""
        return await self.cache.get(f"session:{session_id}")
    
    async def _update_session_mfa(self, session_id: str):
        """Mark session as MFA verified."""
        session = await self._get_session(session_id)
        if session:
            session["mfa_verified"] = True
            await self.cache.setex(
                f"session:{session_id}",
                86400 * 7,
                session
            )


class AuthenticationError(Exception):
    """Authentication failed."""
    pass

# security/authorization.py

"""
Authorization service implementing RBAC and ABAC.
"""

from dataclasses import dataclass
from typing import List, Optional, Dict, Any
from enum import Enum
import functools
import logging

logger = logging.getLogger(__name__)


class Permission(Enum):
    """System permissions."""
    # User permissions
    USER_READ = "user:read"
    USER_WRITE = "user:write"
    USER_DELETE = "user:delete"
    
    # Resource permissions
    RESOURCE_READ = "resource:read"
    RESOURCE_WRITE = "resource:write"
    RESOURCE_DELETE = "resource:delete"
    
    # Admin permissions
    ADMIN_ACCESS = "admin:access"
    ADMIN_USERS = "admin:users"
    ADMIN_BILLING = "admin:billing"
    ADMIN_SETTINGS = "admin:settings"
    
    # Tenant permissions
    TENANT_MANAGE = "tenant:manage"


# Role definitions
ROLE_PERMISSIONS = {
    "viewer": [
        Permission.USER_READ,
        Permission.RESOURCE_READ,
    ],
    "editor": [
        Permission.USER_READ,
        Permission.RESOURCE_READ,
        Permission.RESOURCE_WRITE,
    ],
    "admin": [
        Permission.USER_READ,
        Permission.USER_WRITE,
        Permission.RESOURCE_READ,
        Permission.RESOURCE_WRITE,
        Permission.RESOURCE_DELETE,
        Permission.ADMIN_ACCESS,
        Permission.ADMIN_USERS,
        Permission.ADMIN_SETTINGS,
    ],
    "owner": [
        # All permissions
        *[p for p in Permission],
    ],
}


@dataclass
class AuthorizationContext:
    """Context for authorization decisions."""
    user_id: str
    tenant_id: str
    roles: List[str]
    resource_id: Optional[str] = None
    resource_type: Optional[str] = None
    resource_owner_id: Optional[str] = None
    resource_tenant_id: Optional[str] = None


class AuthorizationService:
    """
    Handles authorization decisions.
    
    Implements:
    - Role-Based Access Control (RBAC)
    - Attribute-Based Access Control (ABAC)
    - Tenant isolation
    """
    
    def __init__(self, db, cache, audit_logger):
        self.db = db
        self.cache = cache
        self.audit = audit_logger
    
    async def check_permission(
        self,
        context: AuthorizationContext,
        required_permission: Permission
    ) -> bool:
        """
        Check if user has a specific permission.
        """
        # Get user's permissions from roles
        user_permissions = set()
        
        for role in context.roles:
            role_perms = ROLE_PERMISSIONS.get(role, [])
            user_permissions.update(role_perms)
        
        has_permission = required_permission in user_permissions
        
        # Audit log
        await self.audit.log(
            action="authorization_check",
            user_id=context.user_id,
            permission=required_permission.value,
            granted=has_permission
        )
        
        return has_permission
    
    async def check_resource_access(
        self,
        context: AuthorizationContext,
        required_permission: Permission
    ) -> bool:
        """
        Check if user can access a specific resource.
        
        Enforces:
        1. Tenant isolation (user can only access own tenant's resources)
        2. Permission check
        3. Resource-level policies
        """
        # CRITICAL: Tenant isolation check
        if context.resource_tenant_id and context.resource_tenant_id != context.tenant_id:
            await self.audit.log(
                action="authorization_denied",
                reason="tenant_mismatch",
                user_id=context.user_id,
                user_tenant=context.tenant_id,
                resource_tenant=context.resource_tenant_id
            )
            return False
        
        # Check base permission
        if not await self.check_permission(context, required_permission):
            return False
        
        # Check resource-specific policies
        if context.resource_type:
            policy_result = await self._check_resource_policy(
                context, required_permission
            )
            if not policy_result:
                return False
        
        return True
    
    async def _check_resource_policy(
        self,
        context: AuthorizationContext,
        permission: Permission
    ) -> bool:
        """
        Check resource-specific access policies.
        
        For example: Users can only delete their own resources
        """
        # Delete operations: Must be owner or admin
        if permission in [Permission.RESOURCE_DELETE, Permission.USER_DELETE]:
            is_owner = context.resource_owner_id == context.user_id
            is_admin = "admin" in context.roles or "owner" in context.roles
            
            if not (is_owner or is_admin):
                await self.audit.log(
                    action="authorization_denied",
                    reason="not_owner_or_admin",
                    user_id=context.user_id,
                    resource_id=context.resource_id
                )
                return False
        
        return True
    
    async def get_accessible_resources(
        self,
        user_id: str,
        tenant_id: str,
        resource_type: str,
        permission: Permission
    ) -> List[str]:
        """
        Get list of resource IDs the user can access.
        
        Used for filtering queries.
        """
        # Table names can't be bound as parameters: map through an
        # allow-list (KeyError for anything unknown), never f-string input
        table = {"document": "documents", "project": "projects"}[resource_type]
        
        # For read permission, return all tenant resources
        if permission == Permission.RESOURCE_READ:
            result = await self.db.fetch(
                f"""
                SELECT id FROM {table} 
                WHERE tenant_id = $1
                """,
                tenant_id
            )
            return [row["id"] for row in result]
        
        # For write/delete, return owned resources + admin override
        user = await self.db.fetchrow(
            "SELECT roles FROM users WHERE id = $1 AND tenant_id = $2",
            user_id, tenant_id
        )
        
        if "admin" in user["roles"] or "owner" in user["roles"]:
            # Admins can access all tenant resources
            result = await self.db.fetch(
                f"SELECT id FROM {table} WHERE tenant_id = $1",
                tenant_id
            )
        else:
            # Regular users only their own
            result = await self.db.fetch(
                f"""
                SELECT id FROM {table} 
                WHERE tenant_id = $1 AND owner_id = $2
                """,
                tenant_id, user_id
            )
        
        return [row["id"] for row in result]


def require_permission(permission: Permission):
    """
    Decorator that enforces permission on endpoint.
    """
    def decorator(func):
        @functools.wraps(func)  # FastAPI reads the endpoint's signature
        async def wrapper(*args, **kwargs):
            # Get current user from context
            request = kwargs.get("request")
            user = request.state.user
            
            context = AuthorizationContext(
                user_id=user.user_id,
                tenant_id=user.tenant_id,
                roles=user.roles
            )
            
            auth_service = request.app.state.authorization
            
            if not await auth_service.check_permission(context, permission):
                raise PermissionDeniedError(
                    f"Permission denied: {permission.value}"
                )
            
            return await func(*args, **kwargs)
        
        return wrapper
    return decorator


class PermissionDeniedError(Exception):
    """User doesn't have required permission."""
    pass

# security/middleware.py

"""
Security middleware for request/response protection.
"""

from fastapi import Request, Response
from starlette.middleware.base import BaseHTTPMiddleware
import logging
import time
import uuid

logger = logging.getLogger(__name__)


class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    """
    Adds security headers to all responses.
    """
    
    async def dispatch(self, request: Request, call_next):
        response = await call_next(request)
        
        # Prevent clickjacking
        response.headers["X-Frame-Options"] = "DENY"
        
        # Prevent MIME type sniffing
        response.headers["X-Content-Type-Options"] = "nosniff"
        
        # Disable the legacy XSS auditor: removed from modern browsers and
        # itself exploitable; CSP below is the real XSS defence (OWASP)
        response.headers["X-XSS-Protection"] = "0"
        
        # Content Security Policy
        response.headers["Content-Security-Policy"] = (
            "default-src 'self'; "
            "script-src 'self'; "
            "style-src 'self' 'unsafe-inline'; "
            "img-src 'self' data: https:; "
            "font-src 'self'; "
            "connect-src 'self' https://api.example.com; "
            "frame-ancestors 'none';"
        )
        
        # Strict Transport Security
        response.headers["Strict-Transport-Security"] = (
            "max-age=31536000; includeSubDomains; preload"
        )
        
        # Referrer Policy
        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
        
        # Permissions Policy
        response.headers["Permissions-Policy"] = (
            "accelerometer=(), camera=(), geolocation=(), "
            "gyroscope=(), magnetometer=(), microphone=(), "
            "payment=(), usb=()"
        )
        
        return response


class RequestLoggingMiddleware(BaseHTTPMiddleware):
    """
    Logs all requests for security auditing.
    """
    
    async def dispatch(self, request: Request, call_next):
        start_time = time.time()
        
        # Generate request ID
        request_id = request.headers.get("X-Request-ID") or str(uuid.uuid4())
        
        # Log request
        logger.info(
            "Request started",
            extra={
                "request_id": request_id,
                "method": request.method,
                "path": request.url.path,
                "client_ip": request.client.host,
                "user_agent": request.headers.get("User-Agent"),
                "tenant_id": getattr(request.state, "tenant_id", None),
                "user_id": getattr(request.state, "user_id", None)
            }
        )
        
        response = await call_next(request)
        
        # Calculate duration
        duration = time.time() - start_time
        
        # Log response
        logger.info(
            "Request completed",
            extra={
                "request_id": request_id,
                "status_code": response.status_code,
                "duration_ms": round(duration * 1000, 2)
            }
        )
        
        # Add request ID to response
        response.headers["X-Request-ID"] = request_id
        
        return response


class InputSanitizationMiddleware(BaseHTTPMiddleware):
    """
    Coarse blocklist screening: one extra layer, NOT the injection defence.
    
    Blocklists are easy to bypass (encodings, comments, case/whitespace
    tricks) and also block legitimate input (e.g. a code snippet with "{{").
    The real defences are parameterized queries, output encoding/escaping,
    allow-list validation (below) and CSP.
    """
    
    # Patterns that might indicate attacks
    SUSPICIOUS_PATTERNS = [
        "<script",
        "javascript:",
        "onerror=",
        "onclick=",
        "UNION SELECT",
        "DROP TABLE",
        "'; --",
        "${",
        "{{",
    ]
    
    async def dispatch(self, request: Request, call_next):
        # Check query parameters
        for key, value in request.query_params.items():
            if self._is_suspicious(value):
                logger.warning(
                    "Suspicious query parameter blocked",
                    extra={
                        "param": key,
                        "client_ip": request.client.host
                    }
                )
                return Response(
                    content="Bad request",
                    status_code=400
                )
        
        # For POST/PUT, check body
        if request.method in ["POST", "PUT", "PATCH"]:
            body = await request.body()
            body_str = body.decode("utf-8", errors="ignore")
            
            if self._is_suspicious(body_str):
                logger.warning(
                    "Suspicious request body blocked",
                    extra={"client_ip": request.client.host}
                )
                return Response(
                    content="Bad request",
                    status_code=400
                )
        
        return await call_next(request)
    
    def _is_suspicious(self, value: str) -> bool:
        """Check if value contains suspicious patterns."""
        value_lower = value.lower()
        
        for pattern in self.SUSPICIOUS_PATTERNS:
            if pattern.lower() in value_lower:
                return True
        
        return False

# security/validation.py

"""
Input validation utilities.
"""

from pydantic import BaseModel, validator, EmailStr, constr
from typing import Optional, List
import re
import bleach


class SecureUserInput(BaseModel):
    """
    Base model with security validations.
    """
    
    class Config:
        # Strip whitespace from strings
        anystr_strip_whitespace = True
        # Limit string length
        max_anystr_length = 10000
    
    @validator("*", pre=True)
    def sanitize_strings(cls, v):
        """Sanitize string inputs."""
        if isinstance(v, str):
            # Remove null bytes
            v = v.replace("\x00", "")
            # Limit length
            v = v[:10000]
        return v


class CreateUserRequest(SecureUserInput):
    """Validated user creation request."""
    
    email: EmailStr
    name: constr(min_length=1, max_length=100)
    password: constr(min_length=12, max_length=128)
    
    @validator("name")
    def validate_name(cls, v):
        """Validate name contains only allowed characters."""
        if not re.match(r"^[\w\s\-'.]+$", v):
            raise ValueError("Name contains invalid characters")
        return v
    
    @validator("password")
    def validate_password(cls, v):
        """Validate password strength.

        Note: NIST SP 800-63B says not to impose composition rules; prefer
        length plus a blocklist of breached or common passwords.
        """
        if not re.search(r"[A-Z]", v):
            raise ValueError("Password must contain uppercase letter")
        if not re.search(r"[a-z]", v):
            raise ValueError("Password must contain lowercase letter")
        if not re.search(r"\d", v):
            raise ValueError("Password must contain digit")
        if not re.search(r"[!@#$%^&*(),.?\":{}|<>]", v):
            raise ValueError("Password must contain special character")
        return v


class ContentInput(SecureUserInput):
    """Validated content input (allows some HTML)."""
    
    title: constr(min_length=1, max_length=200)
    body: constr(min_length=1, max_length=50000)
    
    @validator("title")
    def sanitize_title(cls, v):
        """Strip all HTML from title."""
        return bleach.clean(v, tags=[], strip=True)
    
    @validator("body")
    def sanitize_body(cls, v):
        """Allow safe HTML in body."""
        allowed_tags = [
            "p", "br", "strong", "em", "u", "a", "ul", "ol", "li",
            "h1", "h2", "h3", "h4", "h5", "h6", "blockquote", "code", "pre"
        ]
        allowed_attrs = {
            "a": ["href", "title"],
        }
        return bleach.clean(
            v,
            tags=allowed_tags,
            attributes=allowed_attrs,
            strip=True
        )


def validate_uuid(value: str) -> bool:
    """Validate UUID format."""
    uuid_pattern = re.compile(
        r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
        re.IGNORECASE
    )
    return bool(uuid_pattern.match(value))


def validate_tenant_id(tenant_id: str) -> bool:
    """Validate tenant ID format and existence."""
    if not tenant_id:
        return False
    if not re.match(r'^[a-z0-9_-]{3,50}$', tenant_id):
        return False
    return True