from abc import ABC, abstractmethod
from dataclasses import dataclass
from typing import Optional, Dict, Any

@dataclass
class AuthRequest:
    tenant_id: str
    return_url: Optional[str] = None
    session_data: Dict[str, Any] = None

@dataclass
class AuthResult:
    success: bool
    user_id: Optional[str] = None
    access_token: Optional[str] = None
    refresh_token: Optional[str] = None
    redirect_url: Optional[str] = None
    error: Optional[str] = None

class AuthProvider(ABC):
    @abstractmethod
    async def authenticate(self, request: AuthRequest) -> AuthResult:
        pass

class PasswordAuthProvider(AuthProvider):
    async def authenticate(self, request: AuthRequest) -> AuthResult:
        # パスワード認証の実装
        pass

class SAMLAuthProvider(AuthProvider):
    async def authenticate(self, request: AuthRequest) -> AuthResult:
        # SAML認証の実装
        pass

class OIDCAuthProvider(AuthProvider):
    async def authenticate(self, request: AuthRequest) -> AuthResult:
        # OIDC認証の実装
        pass

class UnifiedAuthService:
    def __init__(self):
        self.providers = {
            'password': PasswordAuthProvider(),
            'saml': SAMLAuthProvider(),
            'oidc': OIDCAuthProvider(),
        }
    
    async def authenticate(self, method: str, request: AuthRequest) -> AuthResult:
        provider = self.providers.get(method)
        if not provider:
            return AuthResult(success=False, error="Unsupported auth method")
        
        # 共通の前処理
        await self.pre_auth_checks(request)
        
        # プロバイダ固有の認証
        result = await provider.authenticate(request)
        
        # 共通の後処理
        if result.success:
            await self.post_auth_process(result, request)
        
        return result

from enum import Enum
from typing import Dict, Optional

class ErrorCode(Enum):
    # 認証エラー
    INVALID_CREDENTIALS = "AUTH001"
    ACCOUNT_LOCKED = "AUTH002"
    SESSION_EXPIRED = "AUTH003"
    MFA_REQUIRED = "AUTH004"
    
    # 認可エラー
    INSUFFICIENT_PERMISSIONS = "AUTHZ001"
    RESOURCE_NOT_FOUND = "AUTHZ002"
    
    # 検証エラー
    INVALID_EMAIL = "VAL001"
    WEAK_PASSWORD = "VAL002"
    
    # システムエラー
    INTERNAL_ERROR = "SYS001"
    SERVICE_UNAVAILABLE = "SYS002"

class ErrorMessages:
    messages = {
        "ja": {
            ErrorCode.INVALID_CREDENTIALS: {
                "message": "メールアドレスまたはパスワードが正しくありません",
                "action": "入力内容を確認してください",
                "support": False
            },
            ErrorCode.ACCOUNT_LOCKED: {
                "message": "セキュリティ上の理由によりアカウントが一時的にロックされています",
                "action": "{retry_after}分後に再度お試しください",
                "support": True
            },
            ErrorCode.WEAK_PASSWORD: {
                "message": "パスワードが安全ではありません",
                "action": "より強力なパスワードを設定してください",
                "details": [
                    "10文字以上で設定してください",
                    "過去に使用したパスワードは使用できません",
                    "一般的な単語は避けてください"
                ],
                "support": False
            }
        },
        "en": {
            ErrorCode.INVALID_CREDENTIALS: {
                "message": "Invalid email or password",
                "action": "Please check your credentials",
                "support": False
            },
            ErrorCode.ACCOUNT_LOCKED: {
                "message": "Account temporarily locked for security reasons",
                "action": "Please try again in {retry_after} minutes",
                "support": True
            }
        },
        "zh": {
            ErrorCode.INVALID_CREDENTIALS: {
                "message": "邮箱或密码不正确",
                "action": "请检查您的输入",
                "support": False
            }
        }
    }

class LocalizedError:
    def __init__(self, code: ErrorCode, lang: str = "ja", **kwargs):
        self.code = code
        self.lang = lang
        self.params = kwargs
        
    def to_response(self) -> Dict:
        error_def = ErrorMessages.messages.get(self.lang, {}).get(self.code)
        
        if not error_def:
            # フォールバック
            error_def = ErrorMessages.messages["en"].get(
                self.code,
                {"message": "Unknown error", "action": "Contact support"}
            )
        
        # パラメータ置換
        message = error_def["message"]
        action = error_def.get("action", "")
        
        for key, value in self.params.items():
            message = message.replace(f"{{{{key}}}}", str(value))
            action = action.replace(f"{{{{key}}}}", str(value))
        
        response = {
            "error": {
                "code": self.code.value,
                "message": message,
                "action": action,
                "support_required": error_def.get("support", False),
                "request_id": self.params.get("request_id")
            }
        }
        
        if "details" in error_def:
            response["error"]["details"] = error_def["details"]
            
        return response

# セキュリティを考慮したエラーハンドリング
class SecureErrorHandler:
    @staticmethod
    def handle_auth_error(error_type: str, request_context: dict) -> LocalizedError:
        # ログには詳細を記録
        logger.warning(
            f"Authentication failed: {error_type}",
            extra={
                "user_email": request_context.get("email"),
                "ip_address": request_context.get("ip"),
                "user_agent": request_context.get("user_agent")
            }
        )
        
        # ユーザーには曖昧なエラーを返す
        if error_type in ["user_not_found", "invalid_password"]:
            return LocalizedError(
                ErrorCode.INVALID_CREDENTIALS,
                request_context.get("lang", "ja")
            )
        
        # アカウントロックは具体的な情報を提供
        if error_type == "account_locked":
            return LocalizedError(
                ErrorCode.ACCOUNT_LOCKED,
                request_context.get("lang", "ja"),
                retry_after=5
            )