# User Roles and Permissions
ROLES = {
    "tourist": {
        "permissions": [
            "read:places",
            "read:reviews",
            "write:reviews",
            "read:transit",
            "read:analytics"
        ]
    },
    "verified_user": {
        "inherits": "tourist",
        "permissions": [
            "write:places",
            "moderate:reviews"
        ]
    },
    "business_owner": {
        "inherits": "verified_user",
        "permissions": [
            "manage:own_places",
            "respond:reviews"
        ]
    },
    "moderator": {
        "inherits": "verified_user",
        "permissions": [
            "moderate:places",
            "moderate:reviews",
            "moderate:users"
        ]
    },
    "admin": {
        "permissions": ["*"]  # All permissions
    }
}

# Decorator for permission checking
from functools import wraps
from fastapi import HTTPException, Depends

def require_permission(permission: str):
    def decorator(func):
        @wraps(func)
        async def wrapper(*args, **kwargs):
            current_user = kwargs.get('current_user')
            if not current_user:
                raise HTTPException(status_code=401, detail="Authentication required")
            
            if not has_permission(current_user, permission):
                raise HTTPException(status_code=403, detail="Insufficient permissions")
            
            return await func(*args, **kwargs)
        return wrapper
    return decorator

# Usage
@router.post("/places/")
@require_permission("write:places")
async def create_place(
    place_data: PlaceCreate,
    current_user: User = Depends(get_current_user)
):
    return await place_service.create(place_data, current_user.id)

# PII Encryption Example
from cryptography.fernet import Fernet
import os

class PIIHandler:
    def __init__(self):
        self.key = os.environ.get('PII_ENCRYPTION_KEY').encode()
        self.cipher = Fernet(self.key)
    
    def encrypt_pii(self, data: str) -> str:
        """Encrypt personally identifiable information."""
        return self.cipher.encrypt(data.encode()).decode()
    
    def decrypt_pii(self, encrypted_data: str) -> str:
        """Decrypt personally identifiable information."""
        return self.cipher.decrypt(encrypted_data.encode()).decode()
    
    def mask_email(self, email: str) -> str:
        """Mask email for logging purposes."""
        local, domain = email.split('@')
        return f"{local[0]}***@{domain}"

from pydantic import BaseModel, validator, EmailStr
from typing import Optional
import re

class UserRegistration(BaseModel):
    username: str
    email: EmailStr
    password: str
    first_name: str
    last_name: str
    
    @validator('username')
    def validate_username(cls, v):
        if not re.match(r'^[a-zA-Z0-9_]{3,20}$', v):
            raise ValueError('Username must be 3-20 alphanumeric characters')
        return v
    
    @validator('password')
    def validate_password(cls, v):
        if len(v) < 8:
            raise ValueError('Password must be at least 8 characters')
        if not re.search(r'[A-Z]', v):
            raise ValueError('Password must contain uppercase letter')
        if not re.search(r'[a-z]', v):
            raise ValueError('Password must contain lowercase letter')
        if not re.search(r'\d', v):
            raise ValueError('Password must contain digit')
        return v

# Safe parameterized queries
from sqlalchemy import text

# ❌ Vulnerable to SQL injection
async def get_places_unsafe(category: str):
    query = f"SELECT * FROM places WHERE category = '{category}'"
    return await database.fetch_all(query)

# ✅ Safe parameterized query
async def get_places_safe(category: str):
    query = text("SELECT * FROM places WHERE category = :category")
    return await database.fetch_all(query, values={"category": category})

from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded

limiter = Limiter(key_func=get_remote_address)

# Different limits for different endpoints
@router.post("/auth/login")
@limiter.limit("5/minute")  # Strict limit for auth
async def login(request: Request, credentials: UserLogin):
    pass

@router.get("/places/search")
@limiter.limit("100/minute")  # Generous limit for search
async def search_places(request: Request, q: str):
    pass

@router.post("/reviews/")
@limiter.limit("10/hour")  # Prevent review spam
async def create_review(request: Request, review: ReviewCreate):
    pass

from fastapi.middleware.cors import CORSMiddleware
from fastapi.middleware.trustedhost import TrustedHostMiddleware

# CORS Configuration
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://navigate-la28.com", "https://www.navigate-la28.com"],
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["*"],
)

# Security Headers Middleware
@app.middleware("http")
async def add_security_headers(request, call_next):
    response = await call_next(request)
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["X-XSS-Protection"] = "1; mode=block"
    response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
    response.headers["Content-Security-Policy"] = "default-src 'self'; script-src 'self' 'unsafe-inline'"
    return response

# Security code review checklist
SECURITY_CHECKLIST = {
    "authentication": [
        "Password complexity requirements",
        "Account lockout mechanisms",
        "Session timeout implementation",
        "Multi-factor authentication support"
    ],
    "authorization": [
        "Role-based access control",
        "Privilege escalation prevention",
        "Resource-level permissions",
        "Default deny policies"
    ],
    "data_protection": [
        "Sensitive data encryption",
        "PII handling compliance",
        "Secure data transmission",
        "Data retention policies"
    ],
    "input_validation": [
        "SQL injection prevention",
        "XSS prevention",
        "File upload security",
        "JSON/XML parsing safety"
    ]
}