from jose import jwt
from datetime import datetime, timedelta
from app.core.config import settings

def create_access_token(data: dict, expires_delta: timedelta = None):
    """Generate JWT access token"""
    to_encode = data.copy()

    if expires_delta:
        expire = datetime.utcnow() + expires_delta
    else:
        expire = datetime.utcnow() + timedelta(
            minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
        )

    to_encode.update({"exp": expire})

    encoded_jwt = jwt.encode(
        to_encode,
        settings.SECRET_KEY,
        algorithm=settings.ALGORITHM
    )

    return encoded_jwt

from jose import JWTError, jwt
from fastapi import HTTPException, status

def verify_token(token: str):
    """Verify and decode JWT token"""
    credentials_exception = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="Could not validate credentials",
        headers={"WWW-Authenticate": "Bearer"},
    )

    try:
        payload = jwt.decode(
            token,
            settings.SECRET_KEY,
            algorithms=[settings.ALGORITHM]
        )
        email: str = payload.get("sub")

        if email is None:
            raise credentials_exception

        return email

    except JWTError:
        raise credentials_exception

from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

def get_password_hash(password: str) -> str:
    """Hash password using bcrypt"""
    return pwd_context.hash(password)

def verify_password(plain_password: str, hashed_password: str) -> bool:
    """Verify password against hash"""
    return pwd_context.verify(plain_password, hashed_password)

# Register user
hashed_password = get_password_hash("mypassword123")
# Store: $2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewY5NU7z1zeP4.Oi

# Login
is_valid = verify_password("mypassword123", hashed_password)
# Returns: True

from cryptography.fernet import Fernet
from app.core.config import settings
import base64

def get_encryption_key():
    """Get or generate encryption key"""
    # Use SECRET_KEY from environment
    key = base64.urlsafe_b64encode(settings.SECRET_KEY.encode()[:32].ljust(32, b'0'))
    return key

def encrypt_credential(plain_text: str) -> str:
    """Encrypt credential using AES-256"""
    fernet = Fernet(get_encryption_key())
    encrypted = fernet.encrypt(plain_text.encode())
    return encrypted.decode()

def decrypt_credential(encrypted_text: str) -> str:
    """Decrypt credential"""
    fernet = Fernet(get_encryption_key())
    decrypted = fernet.decrypt(encrypted_text.encode())
    return decrypted.decode()

from app.models.credential import Credential
from app.core.security import encrypt_credential

# Encrypt before saving
credential = Credential(
    user_id=user.id,
    provider='aws',
    access_key=encrypt_credential(aws_access_key),
    secret_key=encrypt_credential(aws_secret_key),
    region='us-east-1'
)

db.add(credential)
db.commit()

from app.core.security import decrypt_credential

# Decrypt when using
credential = db.query(Credential).filter_by(id=cred_id).first()

aws_access_key = decrypt_credential(credential.access_key)
aws_secret_key = decrypt_credential(credential.secret_key)

# Use with boto3
ec2_client = boto3.client(
    'ec2',
    aws_access_key_id=aws_access_key,
    aws_secret_access_key=aws_secret_key
)

import secrets

# Generate 32-byte random key
secret_key = secrets.token_urlsafe(32)
print(secret_key)
# Output: 'Xg8f3kL9mN2pQ5rS7tU1vW4xY6zA0bC3dE5fG8hJ1kL4'

from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    DATABASE_URL: str
    SECRET_KEY: str
    ALGORITHM: str = "HS256"
    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30

    class Config:
        env_file = ".env"
        case_sensitive = True

settings = Settings()

from fastapi.middleware.cors import CORSMiddleware

origins = [
    "https://your-domain.com",
    "https://www.your-domain.com",
]

# Development
if settings.ENVIRONMENT == "development":
    origins.extend([
        "http://localhost:5173",
        "http://localhost:3000",
    ])

app.add_middleware(
    CORSMiddleware,
    allow_origins=origins,
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["*"],
    max_age=3600,
)

from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

@app.post("/auth/login")
@limiter.limit("5/minute")
def login(request: Request, ...):
    # Login logic
    pass

@app.get("/dashboard/stats")
@limiter.limit("60/minute")
def get_stats(request: Request, ...):
    # Dashboard logic
    pass

from pydantic import BaseModel, EmailStr, validator

class UserCreate(BaseModel):
    email: EmailStr  # Validates email format
    password: str
    full_name: str

    @validator('password')
    def password_strength(cls, v):
        if len(v) < 8:
            raise ValueError('Password must be at least 8 characters')
        if not any(char.isdigit() for char in v):
            raise ValueError('Password must contain at least one digit')
        if not any(char.isupper() for char in v):
            raise ValueError('Password must contain at least one uppercase letter')
        return v

    @validator('full_name')
    def name_not_empty(cls, v):
        if not v.strip():
            raise ValueError('Full name cannot be empty')
        return v

DATABASE_URL = "postgresql://user:pass@host:5432/db?sslmode=require"

engine = create_engine(
    DATABASE_URL,
    connect_args={
        "sslmode": "require",
        "sslrootcert": "/path/to/ca-cert.pem"
    }
)

# Always filter by user_id
@router.get("/inventory/vms")
def list_vms(
    db: Session = Depends(get_db),
    current_user: User = Depends(get_current_user)
):
    # Automatic user isolation
    vms = db.query(ResourceInventory).filter_by(
        user_id=current_user.id,  # ← User isolation
        resource_type='vm'
    ).all()

    return vms

# ✅ SAFE - Parameterized query
vms = db.query(ResourceInventory).filter_by(
    user_id=user_id,
    provider=provider
).all()

# ❌ UNSAFE - String concatenation
query = f"SELECT * FROM resource_inventory WHERE provider = '{provider}'"
db.execute(query)  # Vulnerable to SQL injection!

# ✅ GOOD - Encrypted in database
credential = Credential(
    provider='aws',
    access_key=encrypt_credential(aws_access_key),
    secret_key=encrypt_credential(aws_secret_key)
)

# ❌ BAD - Plain text
credential = Credential(
    provider='aws',
    access_key=aws_access_key,  # Plain text!
    secret_key=aws_secret_key   # Plain text!
)

# ✅ GOOD - Service principal with minimal permissions
{
    "tenant_id": encrypt_credential(tenant_id),
    "client_id": encrypt_credential(client_id),
    "client_secret": encrypt_credential(client_secret),
    "subscription_id": encrypt_credential(subscription_id)
}

# ✅ GOOD - Service account with limited scope
{
    "service_account_json": encrypt_credential(json.dumps(sa_json)),
    "project_id": project_id  # Not sensitive
}

from fastapi.middleware.trustedhost import TrustedHostMiddleware
from fastapi.middleware.httpsredirect import HTTPSRedirectMiddleware

# Force HTTPS in production
if settings.ENVIRONMENT == "production":
    app.add_middleware(HTTPSRedirectMiddleware)

# Trusted hosts
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["your-domain.com", "*.your-domain.com"]
)

# Security headers
@app.middleware("http")
async def add_security_headers(request: Request, call_next):
    response = await call_next(request)
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["X-XSS-Protection"] = "1; mode=block"
    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
    return response