# org_visibility.py
class OrganizationVisibility:
    def __init__(self, org_name, token):
        self.github = Github(token)
        self.org = self.github.get_organization(org_name)
    
    def set_member_visibility(self, username, visibility='public'):
        """
        メンバーの可視性を設定
        visibility: 'public' or 'private'
        """
        member = self.org.get_member(username)
        
        if visibility == 'public':
            self.org.publicize_membership(member)
        else:
            self.org.conceal_membership(member)
    
    def enforce_visibility_policy(self, policy='public'):
        """組織全体の可視性ポリシーを適用"""
        for member in self.org.get_members():
            try:
                if policy == 'public':
                    self.org.publicize_membership(member)
                elif policy == 'private':
                    self.org.conceal_membership(member)
                elif policy == 'optional':
                    # デフォルトはプライベート、個人で選択可能
                    pass
            except Exception as e:
                print(f"Failed to set visibility for {member.login}: {e}")

# team_manager.py
class TeamManager:
    def __init__(self, org_name, token):
        self.github = Github(token)
        self.org = self.github.get_organization(org_name)
    
    def create_team_hierarchy(self, hierarchy_config):
        """階層的なチーム構造を作成"""
        def create_team_recursive(config, parent=None):
            # チームを作成
            team = self.org.create_team(
                name=config['name'],
                description=config.get('description', ''),
                privacy=config.get('privacy', 'closed'),
                parent_team_id=parent.id if parent else None
            )
            
            # メンテナーを追加
            for maintainer in config.get('maintainers', []):
                team.add_membership(
                    self.github.get_user(maintainer),
                    role='maintainer'
                )
            
            # メンバーを追加
            for member in config.get('members', []):
                team.add_membership(
                    self.github.get_user(member),
                    role='member'
                )
            
            # サブチームを作成
            for sub_config in config.get('sub_teams', []):
                create_team_recursive(sub_config, team)
            
            return team
        
        # ルートチームから作成開始
        create_team_recursive(hierarchy_config)
    
    def sync_team_with_ldap(self, team_name, ldap_group):
        """LDAPグループとチームを同期"""
        team = self.org.get_team_by_slug(team_name)
        
        # LDAP/SAML同期の設定（Enterprise only）
        team.create_or_update_ldap_mapping(
            ldap_dn=f"cn={ldap_group},ou=groups,dc=company,dc=com"
        )

def grant_team_permissions(self, team_name, repo_patterns, permission='write'):
    """
    チームに複数リポジトリへの権限を付与
    
    Args:
        team_name: チーム名
        repo_patterns: リポジトリパターンのリスト
        permission: 'read', 'write', 'admin'
    """
    team = self.org.get_team_by_slug(team_name)
    
    for repo in self.org.get_repos():
        for pattern in repo_patterns:
            if self._match_pattern(repo.name, pattern):
                team.add_to_repos(repo)
                team.set_repo_permission(repo, permission)
                print(f"Granted {permission} to {team_name} for {repo.name}")

def _match_pattern(self, name, pattern):
    """ワイルドカードパターンマッチング"""
    import fnmatch
    return fnmatch.fnmatch(name, pattern)

# 使用例
manager.grant_team_permissions(
    'ml_engineering',
    ['ml-*', 'model-*', 'training-*'],
    'write'
)

# collaborator_manager.py
from datetime import datetime, timedelta
import json

class CollaboratorManager:
    def __init__(self, org_name, token):
        self.github = Github(token)
        self.org = self.github.get_organization(org_name)
        self.metadata_file = "collaborator_metadata.json"
    
    def add_outside_collaborator(self, username, repo_name, 
                               permission='read', days=90, 
                               reason="", approvers=[]):
        """外部協力者を追加（メタデータ付き）"""
        repo = self.org.get_repo(repo_name)
        
        # GitHubに追加
        repo.add_to_collaborators(username, permission)
        
        # メタデータを保存
        metadata = self.load_metadata()
        metadata[username] = {
            'repos': {
                repo_name: {
                    'permission': permission,
                    'added_date': datetime.now().isoformat(),
                    'expiry_date': (datetime.now() + timedelta(days=days)).isoformat(),
                    'reason': reason,
                    'approvers': approvers
                }
            }
        }
        self.save_metadata(metadata)
        
        # 通知
        self.notify_addition(username, repo_name, days)
    
    def check_expirations(self):
        """期限切れの協力者をチェック"""
        metadata = self.load_metadata()
        expired = []
        warning = []
        
        for username, user_data in metadata.items():
            for repo_name, repo_data in user_data['repos'].items():
                expiry = datetime.fromisoformat(repo_data['expiry_date'])
                days_until_expiry = (expiry - datetime.now()).days
                
                if days_until_expiry <= 0:
                    expired.append({
                        'username': username,
                        'repo': repo_name,
                        'expired_days': abs(days_until_expiry)
                    })
                elif days_until_expiry <= 14:
                    warning.append({
                        'username': username,
                        'repo': repo_name,
                        'days_remaining': days_until_expiry
                    })
        
        return {'expired': expired, 'warning': warning}
    
    def remove_expired_collaborators(self, dry_run=True):
        """期限切れの協力者を削除"""
        check_result = self.check_expirations()
        
        for item in check_result['expired']:
            if not dry_run:
                repo = self.org.get_repo(item['repo'])
                repo.remove_from_collaborators(item['username'])
                
                # メタデータを更新
                metadata = self.load_metadata()
                del metadata[item['username']]['repos'][item['repo']]
                if not metadata[item['username']]['repos']:
                    del metadata[item['username']]
                self.save_metadata(metadata)
                
            print(f"{'[DRY RUN] ' if dry_run else ''}Removed {item['username']} from {item['repo']}")
    
    def generate_access_report(self):
        """外部協力者のアクセスレポート生成"""
        report = {
            'generated_at': datetime.now().isoformat(),
            'total_collaborators': 0,
            'by_permission': {'read': 0, 'write': 0, 'admin': 0},
            'by_repo': {},
            'expiring_soon': [],
            'inactive_users': []
        }
        
        # 全リポジトリを確認
        for repo in self.org.get_repos():
            collaborators = []
            
            for collab in repo.get_collaborators(affiliation='outside'):
                permission = repo.get_collaborator_permission(collab)
                collaborators.append({
                    'username': collab.login,
                    'permission': permission,
                    'last_active': self.get_last_activity(collab, repo)
                })
                
                report['by_permission'][permission] += 1
                
                # 非アクティブユーザー
                if self.get_last_activity(collab, repo) > 30:
                    report['inactive_users'].append({
                        'username': collab.login,
                        'repo': repo.name,
                        'days_inactive': self.get_last_activity(collab, repo)
                    })
            
            if collaborators:
                report['by_repo'][repo.name] = collaborators
                report['total_collaborators'] += len(collaborators)
        
        return report

# scim_sync.py
class SCIMSync:
    def __init__(self, org_name, scim_token):
        self.org_name = org_name
        self.scim_endpoint = f"https://api.github.com/scim/v2/organizations/{org_name}"
        self.headers = {
            'Authorization': f'Bearer {scim_token}',
            'Content-Type': 'application/scim+json'
        }
    
    def create_user(self, user_data):
        """SCIMでユーザーを作成"""
        scim_user = {
            "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
            "userName": user_data['username'],
            "name": {
                "givenName": user_data['first_name'],
                "familyName": user_data['last_name']
            },
            "emails": [{
                "value": user_data['email'],
                "primary": True
            }],
            "externalId": user_data['employee_id'],
            "active": True
        }
        
        response = requests.post(
            f"{self.scim_endpoint}/Users",
            json=scim_user,
            headers=self.headers
        )
        
        return response.json()
    
    def sync_groups(self, group_mappings):
        """ADグループとGitHubチームを同期"""
        for ad_group, github_team in group_mappings.items():
            ad_members = self.get_ad_group_members(ad_group)
            
            # GitHubチームを作成/更新
            team_data = {
                "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
                "displayName": github_team,
                "members": [
                    {"value": member['id']} for member in ad_members
                ]
            }
            
            # 既存チームを検索
            existing_team = self.find_team(github_team)
            
            if existing_team:
                # 更新
                requests.put(
                    f"{self.scim_endpoint}/Groups/{existing_team['id']}",
                    json=team_data,
                    headers=self.headers
                )
            else:
                # 作成
                requests.post(
                    f"{self.scim_endpoint}/Groups",
                    json=team_data,
                    headers=self.headers
                )

# audit_log_collector.py
class AuditLogCollector:
    def __init__(self, org_name, token):
        self.org_name = org_name
        self.headers = {
            'Authorization': f'token {token}',
            'Accept': 'application/vnd.github.v3+json'
        }
        
    def fetch_audit_log(self, start_date=None, end_date=None):
        """監査ログを取得"""
        url = f"https://api.github.com/orgs/{self.org_name}/audit-log"
        
        params = {}
        if start_date:
            params['after'] = start_date.isoformat()
        if end_date:
            params['before'] = end_date.isoformat()
            
        all_events = []
        page = 1
        
        while True:
            params['page'] = page
            response = requests.get(url, headers=self.headers, params=params)
            
            if response.status_code != 200:
                break
                
            events = response.json()
            if not events:
                break
                
            all_events.extend(events)
            page += 1
            
        return all_events
    
    def analyze_security_events(self, events):
        """セキュリティ関連イベントを分析"""
        security_events = {
            'auth_failures': [],
            'permission_changes': [],
            'repo_visibility_changes': [],
            'member_changes': [],
            'suspicious_activities': []
        }
        
        for event in events:
            # 認証失敗
            if event['action'] == 'auth.login_failed':
                security_events['auth_failures'].append(event)
                
            # 権限変更
            elif event['action'] in ['team.add_repository', 
                                   'org.update_member_permission']:
                security_events['permission_changes'].append(event)
                
            # リポジトリ可視性変更
            elif event['action'] == 'repo.change_visibility':
                security_events['repo_visibility_changes'].append(event)
                
            # メンバー変更
            elif event['action'] in ['org.add_member', 'org.remove_member']:
                security_events['member_changes'].append(event)
                
            # 疑わしい活動
            if self.is_suspicious(event):
                security_events['suspicious_activities'].append(event)
                
        return security_events
    
    def is_suspicious(self, event):
        """疑わしい活動を検出"""
        suspicious_patterns = [
            # 短時間での大量操作
            lambda e: e['action'].startswith('repo.download') and 
                     self.count_recent_downloads(e['actor']) > 10,
            
            # 通常と異なる時間帯のアクセス
            lambda e: self.is_unusual_time(e['timestamp']),
            
            # 通常と異なる場所からのアクセス
            lambda e: self.is_unusual_location(e.get('actor_location'))
        ]
        
        return any(pattern(event) for pattern in suspicious_patterns)
    
    def generate_compliance_report(self, start_date, end_date):
        """コンプライアンスレポート生成"""
        events = self.fetch_audit_log(start_date, end_date)
        
        report = {
            'period': {
                'start': start_date.isoformat(),
                'end': end_date.isoformat()
            },
            'summary': {
                'total_events': len(events),
                'unique_actors': len(set(e['actor'] for e in events)),
                'event_types': {}
            },
            'security_analysis': self.analyze_security_events(events),
            'compliance_checks': {
                'unauthorized_access_attempts': 0,
                'policy_violations': 0,
                'data_exports': 0
            }
        }
        
        # イベントタイプ別集計
        for event in events:
            action = event['action']
            report['summary']['event_types'][action] = \
                report['summary']['event_types'].get(action, 0) + 1
        
        return report