src/security/compliance_integration.py

"""
MorphGuard Compliance Integration
Integrates regulatory compliance with main application
"""

import asyncio
import logging
from datetime import datetime, timedelta
from typing import Dict, Any, Optional
from dataclasses import dataclass
import hashlib

from .regulatory_compliance import (
    ComplianceOrchestrator, 
    ProcessingLawfulBasis,
    DataSubjectRight
)
from .privacy_protection import PrivacyProtectionSystem
from .adversarial_defense import AdversarialDefenseSystem

logger = logging.getLogger(__name__)

@dataclass
class BiometricProcessingRequest:
    user_id: str
    biometric_data: bytes
    operation_type: str  # 'authentication', 'enrollment', 'verification'
    purpose: str
    user_jurisdiction: str
    quality_metrics: Dict[str, float]
    processing_start_time: datetime

class MorphGuardComplianceManager:
    """
    Main compliance manager that integrates all security and regulatory components
    """
    
    def __init__(self):
        self.compliance_orchestrator = ComplianceOrchestrator()
        self.privacy_system = PrivacyProtectionSystem()
        self.adversarial_defense = AdversarialDefenseSystem()
        
        # Get reference to BIPA manager for direct biometric compliance
        self.bipa_manager = self.compliance_orchestrator.bipa_manager
        
        logger.info("MorphGuard Compliance Manager initialized")
    
    async def process_biometric_data_with_compliance(
        self, 
        request: BiometricProcessingRequest
    ) -> Dict[str, Any]:
        """
        Process biometric data with full compliance checks and logging
        """
        processing_start = datetime.now()
        
        try:
            # Step 1: Adversarial Defense Check
            threat_detected = await self._check_adversarial_threats(request)
            if threat_detected['is_threat']:
                return {
                    'success': False,
                    'error': 'Security threat detected',
                    'threat_details': threat_detected,
                    'compliance_status': 'rejected_security'
                }
            
            # Step 2: Verify Compliance Prerequisites
            compliance_check = await self._verify_compliance_prerequisites(request)
            if not compliance_check['valid']:
                return {
                    'success': False,
                    'error': 'Compliance requirements not met',
                    'details': compliance_check,
                    'compliance_status': 'rejected_compliance'
                }
            
            # Step 3: Apply Privacy Protection
            protected_data = await self._apply_privacy_protection(request)
            
            # Step 4: Process Biometric Data (placeholder for actual processing)
            processing_result = await self._process_biometric_data(
                protected_data, request
            )
            
            # Step 5: Log Processing for Compliance
            await self._log_compliant_processing(request, processing_result, processing_start)
            
            # Step 6: Schedule Data Lifecycle Management
            await self._schedule_data_lifecycle(request)
            
            return {
                'success': True,
                'processing_result': processing_result,
                'compliance_status': 'compliant',
                'privacy_measures_applied': True,
                'security_verified': True,
                'processing_time_ms': (datetime.now() - processing_start).total_seconds() * 1000
            }
            
        except Exception as e:
            logger.error(f"Compliance processing failed for user {request.user_id}: {e}")
            return {
                'success': False,
                'error': str(e),
                'compliance_status': 'error'
            }
    
    async def _check_adversarial_threats(
        self, 
        request: BiometricProcessingRequest
    ) -> Dict[str, Any]:
        """Check for adversarial threats"""
        
        # Convert biometric data to format expected by adversarial defense
        # In real implementation, this would convert bytes to appropriate tensor format
        try:
            threat_result = self.adversarial_defense.detect_presentation_attack(
                request.biometric_data
            )
            
            deepfake_result = self.adversarial_defense.detect_deepfake(
                request.biometric_data
            )
            
            pixel_result = self.adversarial_defense.detect_pixel_perturbations(
                request.biometric_data
            )
            
            is_threat = (
                threat_result.get('is_attack', False) or
                deepfake_result.get('is_deepfake', False) or
                pixel_result.get('has_perturbations', False)
            )
            
            return {
                'is_threat': is_threat,
                'presentation_attack': threat_result,
                'deepfake_detection': deepfake_result,
                'pixel_perturbation': pixel_result,
                'overall_confidence': min(
                    threat_result.get('confidence', 1.0),
                    deepfake_result.get('confidence', 1.0),
                    pixel_result.get('confidence', 1.0)
                )
            }
            
        except Exception as e:
            logger.error(f"Adversarial threat detection failed: {e}")
            return {
                'is_threat': True,  # Fail secure
                'error': str(e)
            }
    
    async def _verify_compliance_prerequisites(
        self, 
        request: BiometricProcessingRequest
    ) -> Dict[str, Any]:
        """Verify all compliance prerequisites are met"""
        
        # Check BIPA compliance for Illinois users processing biometric data
        if request.user_jurisdiction == "IL":
            bipa_status = self.bipa_manager.get_bipa_compliance_status(request.user_id)
            
            if not bipa_status['compliance_summary']['has_valid_consent']:
                return {
                    'valid': False,
                    'reason': 'BIPA consent required for Illinois users',
                    'required_action': 'collect_bipa_consent',
                    'bipa_status': bipa_status
                }
        
        # Check GDPR compliance for EU users
        if request.user_jurisdiction in ["EU", "UK", "EEA"]:
            # Verify GDPR consent exists
            # This would check the GDPR consent records
            pass
        
        # Check quality metrics meet minimum standards
        if request.quality_metrics:
            min_quality = 0.7  # Minimum quality threshold
            overall_quality = request.quality_metrics.get('overall_quality', 0.0)
            
            if overall_quality < min_quality:
                return {
                    'valid': False,
                    'reason': f'Biometric quality too low: {overall_quality:.2f} < {min_quality}',
                    'required_action': 'recapture_biometric',
                    'quality_metrics': request.quality_metrics
                }
        
        return {
            'valid': True,
            'compliance_frameworks': self._get_applicable_frameworks(request.user_jurisdiction)
        }
    
    def _get_applicable_frameworks(self, jurisdiction: str) -> list:
        """Get applicable compliance frameworks for jurisdiction"""
        frameworks = []
        
        if jurisdiction in ["EU", "UK", "EEA"]:
            frameworks.append("GDPR")
        
        if jurisdiction == "CA":
            frameworks.append("CCPA")
        
        if jurisdiction == "IL":
            frameworks.append("BIPA")
        
        # Add other frameworks as needed
        return frameworks
    
    async def _apply_privacy_protection(
        self, 
        request: BiometricProcessingRequest
    ) -> bytes:
        """Apply privacy protection measures to biometric data"""
        
        try:
            # Apply differential privacy
            protected_data = self.privacy_system.apply_differential_privacy(
                request.biometric_data,
                epsilon=1.0,  # Privacy budget
                delta=1e-5
            )
            
            # Apply homomorphic encryption if required
            if request.user_jurisdiction in ["EU", "IL"]:  # Higher privacy requirements
                encrypted_data = self.privacy_system.encrypt_homomorphic(protected_data)
                return encrypted_data
            
            return protected_data
            
        except Exception as e:
            logger.error(f"Privacy protection failed: {e}")
            raise
    
    async def _process_biometric_data(
        self, 
        protected_data: bytes, 
        request: BiometricProcessingRequest
    ) -> Dict[str, Any]:
        """
        Process the biometric data (placeholder for actual ML processing)
        In real implementation, this would call the actual biometric processing models
        """
        
        processing_time = (datetime.now() - request.processing_start_time).total_seconds() * 1000
        
        # Simulate processing result
        return {
            'operation_successful': True,
            'processing_time_ms': processing_time,
            'confidence_score': 0.95,
            'data_hash': hashlib.sha256(protected_data).hexdigest(),
            'privacy_preserved': True
        }
    
    async def _log_compliant_processing(
        self, 
        request: BiometricProcessingRequest,
        processing_result: Dict[str, Any],
        processing_start: datetime
    ):
        """Log the processing for compliance audit trails"""
        
        processing_time_ms = (datetime.now() - processing_start).total_seconds() * 1000
        data_hash = processing_result.get('data_hash', '')
        
        # Log to appropriate compliance systems based on jurisdiction
        if request.user_jurisdiction == "IL":
            # Log to BIPA compliance system
            try:
                self.bipa_manager.log_biometric_processing(
                    user_id=request.user_id,
                    biometric_data_hash=data_hash,
                    operation=request.operation_type,
                    purpose=request.purpose,
                    processing_time_ms=int(processing_time_ms),
                    quality_score=request.quality_metrics.get('overall_quality'),
                    ai_model_version="morphguard_v2.0"
                )
                
                # Log quality metrics
                self.bipa_manager.log_biometric_quality_assessment(
                    user_id=request.user_id,
                    biometric_type="face_biometric",
                    quality_metrics=request.quality_metrics
                )
                
            except Exception as e:
                logger.error(f"BIPA logging failed: {e}")
        
        # Log to GDPR system for EU users
        if request.user_jurisdiction in ["EU", "UK", "EEA"]:
            try:
                self.compliance_orchestrator.gdpr_manager.record_data_processing(
                    user_id=request.user_id,
                    data_type="face_biometric_data",
                    purpose=request.purpose,
                    lawful_basis=ProcessingLawfulBasis.CONSENT,
                    data_location="EU"
                )
            except Exception as e:
                logger.error(f"GDPR logging failed: {e}")
    
    async def _schedule_data_lifecycle(self, request: BiometricProcessingRequest):
        """Schedule data lifecycle management (retention, deletion)"""
        
        # For BIPA users, ensure automatic deletion is scheduled
        if request.user_jurisdiction == "IL":
            try:
                deletions = self.bipa_manager.schedule_automatic_deletion()
                if deletions:
                    logger.info(f"Scheduled {len(deletions)} BIPA deletions")
            except Exception as e:
                logger.error(f"BIPA deletion scheduling failed: {e}")
        
        # For GDPR users, run retention cleanup
        if request.user_jurisdiction in ["EU", "UK", "EEA"]:
            try:
                deleted_count = self.compliance_orchestrator.gdpr_manager.automated_data_retention_cleanup()
                if deleted_count > 0:
                    logger.info(f"GDPR automated cleanup: {deleted_count} records deleted")
            except Exception as e:
                logger.error(f"GDPR retention cleanup failed: {e}")
    
    async def collect_user_consent(
        self, 
        user_id: str, 
        jurisdiction: str, 
        biometric_type: str = "face_biometric",
        purpose: str = "authentication"
    ) -> Dict[str, Any]:
        """Collect appropriate consent based on user jurisdiction"""
        
        if jurisdiction == "IL":
            # Collect BIPA consent
            consent_result = self.bipa_manager.collect_informed_consent(
                user_id=user_id,
                biometric_type=biometric_type,
                purpose=purpose,
                retention_period=1095  # 3 years maximum for BIPA
            )
            
            return {
                'consent_type': 'BIPA',
                'result': consent_result,
                'next_step': 'acknowledge_disclosure'
            }
        
        elif jurisdiction in ["EU", "UK", "EEA"]:
            # Collect GDPR consent
            consent_id = self.compliance_orchestrator.gdpr_manager.record_consent(
                user_id=user_id,
                purpose=purpose,
                lawful_basis=ProcessingLawfulBasis.CONSENT,
                consent_text=f"I consent to processing my {biometric_type} for {purpose}"
            )
            
            return {
                'consent_type': 'GDPR',
                'consent_id': consent_id,
                'next_step': 'processing_authorized'
            }
        
        elif jurisdiction == "CA":
            # Handle CCPA (no explicit consent required, but transparency needed)
            processing_id = self.compliance_orchestrator.gdpr_manager.record_data_processing(
                user_id=user_id,
                data_type=biometric_type,
                purpose=purpose,
                lawful_basis=ProcessingLawfulBasis.LEGITIMATE_INTERESTS
            )
            
            return {
                'consent_type': 'CCPA_DISCLOSURE',
                'processing_id': processing_id,
                'next_step': 'processing_authorized'
            }
        
        else:
            # Default processing for other jurisdictions
            return {
                'consent_type': 'STANDARD',
                'next_step': 'processing_authorized'
            }
    
    async def handle_user_rights_request(
        self, 
        user_id: str, 
        request_type: str, 
        jurisdiction: str
    ) -> Dict[str, Any]:
        """Handle user rights requests (access, deletion, etc.)"""
        
        return self.compliance_orchestrator.handle_user_request(
            user_id=user_id,
            request_type=request_type,
            jurisdiction=jurisdiction
        )
    
    async def generate_compliance_dashboard_data(self) -> Dict[str, Any]:
        """Generate data for compliance dashboard"""
        
        comprehensive_report = self.compliance_orchestrator.generate_comprehensive_compliance_report()
        
        # Add real-time metrics
        current_time = datetime.now()
        
        # Get BIPA-specific metrics
        bipa_deletions = self.bipa_manager.schedule_automatic_deletion()
        
        dashboard_data = {
            'timestamp': current_time.isoformat(),
            'compliance_score': comprehensive_report['overall_compliance_score'],
            'gdpr_metrics': comprehensive_report['gdpr_compliance'],
            'ccpa_metrics': comprehensive_report['ccpa_compliance'],
            'bipa_metrics': comprehensive_report['bipa_compliance'],
            'pending_deletions': {
                'bipa': len(bipa_deletions),
                'gdpr': comprehensive_report['gdpr_compliance']['retention_compliance']['overdue_for_deletion']
            },
            'security_metrics': {
                'adversarial_defense_active': True,
                'privacy_protection_active': True,
                'encryption_rate': comprehensive_report['gdpr_compliance']['security_measures']['encryption_rate']
            },
            'recent_activities': {
                'total_processing_requests_24h': 0,  # Would query from TimescaleDB
                'consent_requests_24h': 0,  # Would query from compliance databases
                'rights_requests_24h': 0    # Would query from compliance databases
            }
        }
        
        return dashboard_data
    
    async def run_automated_compliance_maintenance(self):
        """Run automated compliance maintenance tasks"""
        
        logger.info("Starting automated compliance maintenance")
        
        try:
            # Run GDPR automated tasks
            self.compliance_orchestrator.run_automated_compliance_tasks()
            
            # Execute pending BIPA deletions
            deletions = self.bipa_manager.schedule_automatic_deletion()
            if deletions:
                deletion_ids = [d['deletion_id'] for d in deletions]
                results = self.bipa_manager.execute_bipa_deletions(deletion_ids)
                successful_deletions = sum(1 for success in results.values() if success)
                logger.info(f"Executed {successful_deletions}/{len(deletion_ids)} BIPA deletions")
            
            # Update privacy protection models if needed
            await self.privacy_system.update_privacy_parameters()
            
            # Update adversarial defense models if needed
            await self.adversarial_defense.update_defense_models()
            
            logger.info("Automated compliance maintenance completed successfully")
            
        except Exception as e:
            logger.error(f"Automated compliance maintenance failed: {e}")
            raise


# Async wrapper for integration with Flask/FastAPI
class AsyncComplianceWrapper:
    """Async wrapper for integration with web frameworks"""
    
    def __init__(self):
        self.compliance_manager = MorphGuardComplianceManager()
        self.loop = None
    
    def process_biometric_sync(self, request_data: Dict[str, Any]) -> Dict[str, Any]:
        """Synchronous wrapper for biometric processing"""
        
        request = BiometricProcessingRequest(
            user_id=request_data['user_id'],
            biometric_data=request_data['biometric_data'],
            operation_type=request_data['operation_type'],
            purpose=request_data['purpose'],
            user_jurisdiction=request_data['user_jurisdiction'],
            quality_metrics=request_data.get('quality_metrics', {}),
            processing_start_time=datetime.now()
        )
        
        # Run in event loop
        if self.loop is None:
            self.loop = asyncio.new_event_loop()
            asyncio.set_event_loop(self.loop)
        
        return self.loop.run_until_complete(
            self.compliance_manager.process_biometric_data_with_compliance(request)
        )
    
    def collect_consent_sync(self, user_id: str, jurisdiction: str, 
                           biometric_type: str = "face_biometric",
                           purpose: str = "authentication") -> Dict[str, Any]:
        """Synchronous wrapper for consent collection"""
        
        if self.loop is None:
            self.loop = asyncio.new_event_loop()
            asyncio.set_event_loop(self.loop)
        
        return self.loop.run_until_complete(
            self.compliance_manager.collect_user_consent(
                user_id, jurisdiction, biometric_type, purpose
            )
        )
    
    def get_dashboard_data_sync(self) -> Dict[str, Any]:
        """Synchronous wrapper for dashboard data"""
        
        if self.loop is None:
            self.loop = asyncio.new_event_loop()
            asyncio.set_event_loop(self.loop)
        
        return self.loop.run_until_complete(
            self.compliance_manager.generate_compliance_dashboard_data()
        )


if __name__ == "__main__":
    # Example usage
    import asyncio
    logging.basicConfig(level=logging.INFO)
    
    async def test_compliance_integration():
        manager = MorphGuardComplianceManager()
        
        # Test BIPA consent collection
        consent_result = await manager.collect_user_consent(
            user_id="test_user_il",
            jurisdiction="IL",
            biometric_type="face_biometric",
            purpose="authentication"
        )
        print(f"BIPA Consent Result: {consent_result}")
        
        # Test compliance dashboard
        dashboard_data = await manager.generate_compliance_dashboard_data()
        print(f"Compliance Score: {dashboard_data['compliance_score']:.2f}")
        
        # Run maintenance
        await manager.run_automated_compliance_maintenance()
    
    # Run test
    asyncio.run(test_compliance_integration())