import requests
from datetime import datetime, timedelta

class AuditLogAggregator:
    def __init__(self, loki_url: str):
        self.loki_url = loki_url

    def query_logs(self, start_time: datetime, end_time: datetime,
                   labels: dict) -> list:
        """Query Loki for logs matching specific labels and time range."""
        params = {
            "query": ' '.join([f'{k}="{v}"' for k, v in labels.items()]),
            "start": start_time.isoformat() + "Z",
            "end": end_time.isoformat() + "Z",
            "limit": 1000
        }
        response = requests.get(f"{self.loki_url}/loki/api/v1/query_range",
                                params=params)
        return response.json().get("data", {}).get("result", [])

    def aggregate_tool_logs(self, tool: str, days: int = 30) -> dict:
        """Aggregate logs from a specific tool over the past N days."""
        end_time = datetime.utcnow()
        start_time = end_time - timedelta(days=days)

        logs = self.query_logs(start_time, end_time, {"tool": tool})
        return {
            "tool": tool,
            "period": f"{start_time.date()} to {end_time.date()}",
            "event_count": len(logs),
            "events": logs
        }

class IdentityComplianceReporter:
    def __init__(self, domain: str, access_token: str):
        self.domain = domain
        self.access_token = access_token
        self.headers = {
            "Authorization": f"Bearer {access_token}",
            "Content-Type": "application/json"
        }

    def get_authentication_events(self, user_id: str,
                                  start_date: str) -> list:
        """Retrieve authentication events for a specific user."""
        url = f"https://{self.domain}/api/v2/users/{user_id}/logs"
        params = {"sort": "date:-1", "fields": "date,type,connection_name"}

        response = requests.get(url, headers=self.headers, params=params)
        events = response.json()

        # Filter for events after start_date
        return [e for e in events if e.get("date", "") >= start_date]

    def generate_access_report(self, group_id: str) -> dict:
        """Generate report of all users in a group with their roles."""
        url = f"https://{self.domain}/api/v2/groups/{group_id}/members"

        response = requests.get(url, headers=self.headers)
        members = response.json()

        report = {
            "group_id": group_id,
            "member_count": len(members),
            "members": [
                {
                    "user_id": m["user_id"],
                    "email": m.get("email"),
                    "name": m.get("name")
                }
                for m in members
            ]
        }
        return report

import boto3
from google.cloud import logging_v2

class CloudComplianceCollector:
    def __init__(self, aws_region: str, gcp_project_id: str):
        self.cloudtrail = boto3.client('cloudtrail', region_name=aws_region)
        self.gcp_client = logging_v2.Client(project=gcp_project_id)

    def get_aws_api_activity(self, days: int = 30) -> list:
        """Retrieve AWS API activity for compliance analysis."""
        response = self.cloudtrail.lookup_events(
            LookupAttributes=[
                {"AttributeKey": "EventSource",
                 "AttributeValue": "s3.amazonaws.com"}
            ],
            MaxResults=100
        )

        events = []
        for event in response.get("Events", []):
            events.append({
                "timestamp": event["EventTime"].isoformat(),
                "user": event.get("Username"),
                "event_name": event["EventName"],
                "resource": event.get("Resources", [{}])[0].get("ResourceName"),
                "ip": event.get("SourceIPAddress")
            })
        return events

    def get_gcp_audit_logs(self, filter_expr: str) -> list:
        """Retrieve GCP audit logs matching a filter expression."""
        filter_ = f"logName:syslog AND {filter_expr}"

        entries = self.gcp_client.list_entries(
            filter_=filter_,
            order_by=logging_v2.DESCENDING,
            page_size=100
        )

        return [
            {
                "timestamp": entry.timestamp.isoformat(),
                "method": entry.proto_payload.get("methodName"),
                "principal": entry.proto_payload.get("authenticationInfo", {}).get("principalEmail"),
                "resource": entry.resource.get("resourceName")
            }
            for entry in entries
        ]

class CompliancePipeline:
    def __init__(self):
        self.sources = []
        self.normalizer = AuditLogNormalizer()
        self.storage = AuditLogAggregator("http://loki:3100")

    def register_source(self, source_name: str, collector, schema: dict):
        """Register a new audit log source with its collector and schema."""
        self.sources.append({
            "name": source_name,
            "collector": collector,
            "schema": schema
        })

    def run_collection_cycle(self):
        """Execute one collection cycle across all registered sources."""
        results = []

        for source in self.sources:
            raw_events = source["collector"].collect()
            normalized = [
                self.normalizer.normalize(event, source["schema"])
                for event in raw_events
            ]

            for event in normalized:
                self.storage.ingest(event)

            results.append({
                "source": source["name"],
                "collected": len(raw_events),
                "normalized": len(normalized)
            })

        return results

    def generate_compliance_report(self, start: datetime,
                                   end: datetime) -> dict:
        """Generate a unified compliance report for the specified period."""
        all_logs = self.storage.query_range(start, end)

        return {
            "report_period": {"start": start, "end": end},
            "total_events": len(all_logs),
            "by_source": self._group_by_source(all_logs),
            "by_user": self._group_by_user(all_logs),
            "security_events": self._filter_security_events(all_logs),
            "generated_at": datetime.utcnow().isoformat()
        }

    def _group_by_source(self, events: list) -> dict:
        groups = {}
        for event in events:
            source = event.get("source", "unknown")
            groups[source] = groups.get(source, 0) + 1
        return groups

    def _filter_security_events(self, events: list) -> list:
        security_types = ["login_failure", "permission_change",
                         "data_export", "admin_action"]
        return [e for e in events if e.get("type") in security_types]