# secrets_manager.py
import base64
from nacl import encoding, public

class SecretsManager:
    def __init__(self, github_client):
        self.github = github_client
    
    def encrypt_secret(self, public_key, secret_value):
        """GitHub用にシークレットを暗号化"""
        public_key_obj = public.PublicKey(
            public_key.encode("utf-8"), 
            encoding.Base64Encoder()
        )
        sealed_box = public.SealedBox(public_key_obj)
        encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
        
        return base64.b64encode(encrypted).decode("utf-8")
    
    def set_repository_secret(self, repo_name, secret_name, secret_value):
        """リポジトリシークレットを設定"""
        repo = self.github.get_repo(repo_name)
        
        # 公開鍵を取得
        public_key = repo.get_public_key()
        
        # 暗号化
        encrypted_value = self.encrypt_secret(
            public_key.key, 
            secret_value
        )
        
        # シークレットを作成/更新
        repo.create_secret(
            secret_name,
            encrypted_value,
            public_key.key_id
        )
    
    def rotate_secrets(self, repo_name, secret_mapping):
        """シークレットのローテーション"""
        repo = self.github.get_repo(repo_name)
        
        rotation_log = []
        
        for secret_name, new_value in secret_mapping.items():
            try:
                # 新しい値を設定
                self.set_repository_secret(repo_name, secret_name, new_value)
                
                rotation_log.append({
                    'secret': secret_name,
                    'status': 'rotated',
                    'timestamp': datetime.now().isoformat()
                })
                
                # 通知
                self.notify_secret_rotation(repo_name, secret_name)
                
            except Exception as e:
                rotation_log.append({
                    'secret': secret_name,
                    'status': 'failed',
                    'error': str(e),
                    'timestamp': datetime.now().isoformat()
                })
        
        return rotation_log

# environment_manager.py
class EnvironmentManager:
    def __init__(self, repo):
        self.repo = repo
    
    def create_environment(self, env_name, protection_rules=None):
        """環境を作成して保護ルールを設定"""
        # GitHub APIを使用して環境を作成
        url = f"{self.repo.url}/environments/{env_name}"
        
        data = {
            "wait_timer": protection_rules.get("wait_timer", 0),
            "reviewers": [
                {"type": "User", "id": user_id} 
                for user_id in protection_rules.get("required_reviewers", [])
            ],
            "deployment_branch_policy": {
                "protected_branches": protection_rules.get("protected_branches", True),
                "custom_branch_policies": protection_rules.get("branch_patterns", False)
            }
        }
        
        response = requests.put(url, json=data, headers=self.headers)
        return response.json()
    
    def set_environment_secrets(self, env_name, secrets):
        """環境固有のシークレットを設定"""
        for secret_name, secret_value in secrets.items():
            self.set_environment_secret(
                env_name, 
                secret_name, 
                secret_value
            )
    
    def deploy_with_approval(self, env_name, deployment_data):
        """承認付きデプロイメント"""
        # デプロイメントを作成
        deployment = self.repo.create_deployment(
            ref=deployment_data['ref'],
            environment=env_name,
            required_contexts=[],
            payload=deployment_data.get('payload', {})
        )
        
        # 承認待ち
        if self.requires_approval(env_name):
            print(f"Waiting for approval for {env_name} deployment...")
            # 承認プロセス
            
        return deployment

# config_template.py
import os
from typing import Dict, Any

class ConfigTemplate:
    """環境別設定テンプレート"""
    
    @staticmethod
    def get_config(environment: str) -> Dict[str, Any]:
        base_config = {
            'app_name': 'ml-platform',
            'version': '1.0.0',
            'features': {
                'ml_monitoring': True,
                'auto_scaling': False,
                'debug_mode': False
            }
        }
        
        env_configs = {
            'development': {
                'database_url': os.getenv('DEV_DATABASE_URL'),
                'api_endpoint': 'https://dev-api.example.com',
                'log_level': 'DEBUG',
                'features': {
                    'ml_monitoring': True,
                    'auto_scaling': False,
                    'debug_mode': True
                }
            },
            'staging': {
                'database_url': os.getenv('STAGING_DATABASE_URL'),
                'api_endpoint': 'https://staging-api.example.com',
                'log_level': 'INFO',
                'features': {
                    'ml_monitoring': True,
                    'auto_scaling': True,
                    'debug_mode': False
                }
            },
            'production': {
                'database_url': os.getenv('PROD_DATABASE_URL'),
                'api_endpoint': 'https://api.example.com',
                'log_level': 'WARNING',
                'features': {
                    'ml_monitoring': True,
                    'auto_scaling': True,
                    'debug_mode': False
                }
            }
        }
        
        # ベース設定と環境固有設定をマージ
        config = base_config.copy()
        config.update(env_configs.get(environment, {}))
        
        return config
    
    @staticmethod
    def validate_config(config: Dict[str, Any]) -> bool:
        """設定の妥当性を検証"""
        required_keys = ['database_url', 'api_endpoint', 'log_level']
        
        for key in required_keys:
            if key not in config or not config[key]:
                raise ValueError(f"Missing required config: {key}")
        
        return True

# vulnerability_reporter.py
import json
from datetime import datetime
from typing import List, Dict

class VulnerabilityReporter:
    def __init__(self, github_client):
        self.github = github_client
        
    def get_vulnerability_alerts(self, repo_name):
        """脆弱性アラートを取得"""
        repo = self.github.get_repo(repo_name)
        
        query = """
        query($owner: String!, $name: String!) {
          repository(owner: $owner, name: $name) {
            vulnerabilityAlerts(first: 100) {
              nodes {
                createdAt
                dismissedAt
                securityVulnerability {
                  package {
                    name
                    ecosystem
                  }
                  severity
                  advisory {
                    summary
                    description
                    cvss {
                      score
                    }
                  }
                }
              }
            }
          }
        }
        """
        
        # GraphQL APIを使用
        import requests
        
        headers = {
            'Authorization': f'token {self.github._Github__requester._Requester__authorizationHeader.split()[1]}',
            'Content-Type': 'application/json'
        }
        
        data = {
            'query': query,
            'variables': {"owner": repo.owner.login, "name": repo.name}
        }
        
        response = requests.post(
            'https://api.github.com/graphql',
            headers=headers,
            json=data
        )
        result = response.json()
        
        return result['data']['repository']['vulnerabilityAlerts']['nodes']
    
    def generate_report(self, repos: List[str]) -> Dict:
        """複数リポジトリの脆弱性レポート生成"""
        report = {
            'generated_at': datetime.now().isoformat(),
            'summary': {
                'total_vulnerabilities': 0,
                'critical': 0,
                'high': 0,
                'medium': 0,
                'low': 0
            },
            'by_repository': {},
            'by_package': {}
        }
        
        for repo_name in repos:
            alerts = self.get_vulnerability_alerts(repo_name)
            active_alerts = [a for a in alerts if not a['dismissedAt']]
            
            repo_summary = {
                'total': len(active_alerts),
                'by_severity': {},
                'vulnerabilities': []
            }
            
            for alert in active_alerts:
                vuln = alert['securityVulnerability']
                severity = vuln['severity']
                package_name = vuln['package']['name']
                
                # サマリー更新
                report['summary']['total_vulnerabilities'] += 1
                report['summary'][severity.lower()] += 1
                
                # リポジトリ別
                repo_summary['by_severity'][severity] = \
                    repo_summary['by_severity'].get(severity, 0) + 1
                
                repo_summary['vulnerabilities'].append({
                    'package': package_name,
                    'severity': severity,
                    'summary': vuln['advisory']['summary'],
                    'cvss_score': vuln['advisory']['cvss']['score']
                })
                
                # パッケージ別
                if package_name not in report['by_package']:
                    report['by_package'][package_name] = {
                        'affected_repos': [],
                        'severity': severity
                    }
                report['by_package'][package_name]['affected_repos'].append(repo_name)
            
            report['by_repository'][repo_name] = repo_summary
        
        return report
    
    def prioritize_fixes(self, report: Dict) -> List[Dict]:
        """修正の優先順位付け"""
        priorities = []
        
        for package, info in report['by_package'].items():
            score = 0
            
            # 深刻度によるスコア
            severity_scores = {
                'CRITICAL': 40,
                'HIGH': 30,
                'MEDIUM': 20,
                'LOW': 10
            }
            score += severity_scores.get(info['severity'], 0)
            
            # 影響範囲によるスコア
            score += len(info['affected_repos']) * 5
            
            priorities.append({
                'package': package,
                'priority_score': score,
                'severity': info['severity'],
                'affected_repos': info['affected_repos']
            })
        
        # スコアの高い順にソート
        priorities.sort(key=lambda x: x['priority_score'], reverse=True)
        
        return priorities

# incident_response.py
from enum import Enum
from datetime import datetime
import asyncio

class IncidentSeverity(Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"

class IncidentResponse:
    def __init__(self):
        self.response_times = {
            IncidentSeverity.CRITICAL: 30,    # 30分
            IncidentSeverity.HIGH: 120,       # 2時間
            IncidentSeverity.MEDIUM: 480,     # 8時間
            IncidentSeverity.LOW: 1440        # 24時間
        }
    
    async def handle_incident(self, incident):
        """インシデント対応のオーケストレーション"""
        # 1. インシデントの記録
        incident_id = self.log_incident(incident)
        
        # 2. 深刻度の評価
        severity = self.assess_severity(incident)
        
        # 3. 通知
        await self.notify_stakeholders(incident_id, severity)
        
        # 4. 初期対応
        if severity in [IncidentSeverity.CRITICAL, IncidentSeverity.HIGH]:
            await self.immediate_containment(incident)
        
        # 5. 調査
        investigation = await self.investigate(incident)
        
        # 6. 修復
        await self.remediate(incident, investigation)
        
        # 7. 事後分析
        await self.post_mortem(incident_id)
        
        return incident_id
    
    def assess_severity(self, incident):
        """インシデントの深刻度を評価"""
        severity_factors = {
            'data_breach': IncidentSeverity.CRITICAL,
            'unauthorized_access': IncidentSeverity.HIGH,
            'malware_detection': IncidentSeverity.HIGH,
            'policy_violation': IncidentSeverity.MEDIUM,
            'suspicious_activity': IncidentSeverity.LOW
        }
        
        return severity_factors.get(
            incident['type'], 
            IncidentSeverity.MEDIUM
        )
    
    async def immediate_containment(self, incident):
        """即座の封じ込め措置"""
        actions = []
        
        if incident['type'] == 'unauthorized_access':
            # アクセストークンの無効化
            actions.append(self.revoke_tokens(incident['user']))
            
            # リポジトリへのアクセス制限
            actions.append(self.restrict_access(incident['repositories']))
            
        elif incident['type'] == 'data_breach':
            # 影響を受けたシークレットのローテーション
            actions.append(self.rotate_secrets(incident['compromised_secrets']))
            
            # 監査ログの保全
            actions.append(self.preserve_audit_logs())
            
        await asyncio.gather(*actions)
    
    def generate_incident_report(self, incident_id):
        """インシデントレポートの生成"""
        incident = self.get_incident(incident_id)
        
        report = f"""
# Security Incident Report

## Incident ID: {incident_id}

### Summary
- **Date/Time**: {incident['timestamp']}
- **Type**: {incident['type']}
- **Severity**: {incident['severity']}
- **Status**: {incident['status']}

### Timeline
{self.format_timeline(incident['timeline'])}

### Impact Assessment
- **Affected Systems**: {incident['affected_systems']}
- **Data Exposure**: {incident['data_exposure']}
- **User Impact**: {incident['user_impact']}

### Response Actions
{self.format_actions(incident['response_actions'])}

### Root Cause Analysis
{incident['root_cause']}

### Lessons Learned
{incident['lessons_learned']}

### Recommendations
{self.format_recommendations(incident['recommendations'])}
"""
        return report

# security_monitor.py
class SecurityMonitor:
    def __init__(self):
        self.alert_threshold = {
            'failed_logins': 5,
            'api_rate_limit': 1000,
            'suspicious_downloads': 10
        }
    
    async def monitor_events(self):
        """セキュリティイベントの監視"""
        while True:
            events = await self.fetch_recent_events()
            
            for event in events:
                if self.is_suspicious(event):
                    await self.trigger_alert(event)
            
            await asyncio.sleep(60)  # 1分ごとにチェック
    
    def is_suspicious(self, event):
        """疑わしいイベントの検出"""
        suspicious_patterns = [
            # 大量のリポジトリダウンロード
            lambda e: e['action'] == 'repo.download' and 
                     e['count'] > self.alert_threshold['suspicious_downloads'],
            
            # 短時間での複数の認証失敗
            lambda e: e['action'] == 'auth.failed' and
                     e['count'] > self.alert_threshold['failed_logins'],
            
            # 異常なAPI使用
            lambda e: e['action'] == 'api.call' and
                     e['rate'] > self.alert_threshold['api_rate_limit'],
            
            # 不審な時間帯のアクセス
            lambda e: e['hour'] < 6 or e['hour'] > 22,
            
            # 不審な地域からのアクセス
            lambda e: e['country'] not in ['JP', 'US', 'GB']
        ]
        
        return any(pattern(event) for pattern in suspicious_patterns)