foxhunt/tli/src/auth/mod.rs

//! Authentication and Security Module for Foxhunt Trading System
//!
//! This module provides comprehensive security features required for financial trading platforms:
//! - TLS/mTLS support for all gRPC connections
//! - API key management with rotation
//! - Role-based access control (RBAC)
//! - Audit logging for compliance
//! - Session management with secure tokens
//! - Rate limiting for protection
//!
//! Security Standards Compliance:
//! - SOX (Sarbanes-Oxley) audit requirements
//! - FINRA record keeping standards
//! - ISO 27001 security controls
//! - PCI DSS where applicable

use std::collections::HashMap;
use std::sync::Arc;
use std::time::{Duration, SystemTime, UNIX_EPOCH};
use tokio::sync::RwLock;
use uuid::Uuid;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use thiserror::Error;
use tracing::{info, warn, error, instrument};
use config::ConfigManager;

pub mod certificates;
pub mod cert_manager;
pub mod rbac;
pub mod session;
pub mod audit;
pub mod rate_limiter;
pub mod api_keys;
pub mod jwt;
pub mod mfa;
pub mod encryption;
pub mod security_monitor;
pub mod tls_service;
pub mod security_integration;
pub mod hsm_integration;

#[cfg(test)]
pub mod integration_tests;

pub use certificates::*;
// Use specific imports to avoid conflicts
pub use cert_manager::{CertificateConfig, CircuitBreakerConfig, CachedCertificate, CircuitState, CertificateManager};
pub use rbac::*;
pub use session::*;
pub use audit::*;
pub use rate_limiter::*;
pub use api_keys::*;
pub use jwt::*;
pub use mfa::*;
pub use encryption::*;
pub use security_monitor::*;
pub use tls_service::*;
pub use security_integration::*;

/// Authentication errors specific to trading system security
#[derive(Error, Debug)]
pub enum AuthError {
    #[error("Invalid credentials provided")]
    InvalidCredentials,
    #[error("Access denied: insufficient permissions for {operation}")]
    AccessDenied { operation: String },
    #[error("Session expired or invalid")]
    SessionExpired,
    #[error("API key invalid or revoked")]
    InvalidApiKey,
    #[error("Rate limit exceeded: {limit} requests per {window:?}")]
    RateLimitExceeded { limit: u64, window: Duration },
    #[error("Certificate validation failed: {reason}")]
    CertificateError { reason: String },
    #[error("Encryption operation failed: {reason}")]
    EncryptionError { reason: String },
    #[error("Audit log write failed: {reason}")]
    AuditError { reason: String },
    #[error("Configuration error: {message}")]
    ConfigError { message: String },
    #[error("Database error: {message}")]
    DatabaseError { message: String },
    
}

impl From<session::SessionError> for AuthError {
    fn from(err: session::SessionError) -> Self {
        match err {
            session::SessionError::SessionExpired { .. } => AuthError::SessionExpired,
            session::SessionError::InvalidTokenFormat => AuthError::InvalidCredentials,
            _ => AuthError::ConfigError { message: err.to_string() },
        }
    }
}

impl From<audit::AuditError> for AuthError {
    fn from(err: audit::AuditError) -> Self {
        AuthError::AuditError { reason: err.to_string() }
    }
}

impl From<certificates::CertificateError> for AuthError {
    fn from(err: certificates::CertificateError) -> Self {
        AuthError::CertificateError { reason: err.to_string() }
    }
}

impl From<rbac::RbacError> for AuthError {
    fn from(err: rbac::RbacError) -> Self {
        AuthError::ConfigError { message: err.to_string() }
    }
}

impl From<rate_limiter::RateLimitError> for AuthError {
    fn from(err: rate_limiter::RateLimitError) -> Self {
        match err {
            rate_limiter::RateLimitError::LimitExceeded { limit, window, .. } => {
                AuthError::RateLimitExceeded { limit, window }
            }
            _ => AuthError::ConfigError { message: err.to_string() },
        }
    }
}

impl From<api_keys::ApiKeyError> for AuthError {
    fn from(err: api_keys::ApiKeyError) -> Self {
        match err {
            api_keys::ApiKeyError::KeyExpired { .. } |
            api_keys::ApiKeyError::KeyRevoked { .. } |
            api_keys::ApiKeyError::KeyNotFound { .. } => AuthError::InvalidApiKey,
            _ => AuthError::ConfigError { message: err.to_string() },
        }
    }
}



/// Security configuration for the trading system
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SecurityConfig {
    /// TLS/mTLS configuration
    pub tls: TlsConfig,
    /// Session management settings
    pub session: SessionConfig,
    /// Rate limiting configuration
    pub rate_limiting: RateLimitConfig,
    /// API key management settings
    pub api_keys: ApiKeyConfig,
    /// Audit logging configuration
    pub audit: AuditConfig,
    /// RBAC configuration
    pub rbac: RbacConfig,
    
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TlsConfig {
    /// Path to server certificate
    pub cert_path: String,
    /// Path to private key
    pub key_path: String,
    /// Path to CA certificate for client verification
    pub ca_cert_path: String,
    /// Require mutual TLS authentication
    pub require_client_cert: bool,
    /// Minimum TLS version (1.2 or 1.3)
    pub min_version: String,
    /// Allowed cipher suites
    pub cipher_suites: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SessionConfig {
    /// Session timeout duration in seconds
    pub timeout_seconds: u64,
    /// Maximum concurrent sessions per user
    pub max_sessions_per_user: u32,
    /// Session token length in bytes
    pub token_length: usize,
    /// Require session refresh interval
    pub refresh_interval_seconds: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RateLimitConfig {
    /// Requests per minute for authenticated users
    pub authenticated_rpm: u64,
    /// Requests per minute for API keys
    pub api_key_rpm: u64,
    /// Burst allowance for trading operations
    pub trading_burst: u64,
    /// Window size for rate limiting
    pub window_seconds: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ApiKeyConfig {
    /// API key length in bytes
    pub key_length: usize,
    /// Default expiration time in days
    pub default_expiry_days: u32,
    /// Maximum keys per user
    pub max_keys_per_user: u32,
    /// Automatic rotation interval in days
    pub rotation_interval_days: u32,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuditConfig {
    /// Log all authentication attempts
    pub log_auth_attempts: bool,
    /// Log all permission checks
    pub log_permission_checks: bool,
    /// Log all trading operations
    pub log_trading_operations: bool,
    /// Log retention period in days
    pub retention_days: u32,
    /// Audit log encryption
    pub encrypt_logs: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RbacConfig {
    /// Enable strict permission checking
    pub strict_mode: bool,
    /// Cache permission lookups
    pub cache_permissions: bool,
    /// Permission cache TTL in seconds
    pub cache_ttl_seconds: u64,
}

/// Main authentication service for the trading system
pub struct AuthenticationService {
    config: SecurityConfig,
    certificate_manager: Arc<CertificateManager>,  // This refers to certificates::CertificateManager
    rbac_manager: Arc<RbacManager>,
    session_manager: Arc<SessionManager>,
    api_key_manager: Arc<ApiKeyManager>,
    rate_limiter: Arc<RateLimiter>,
    audit_logger: Arc<AuditLogger>,
    config_manager: Arc<ConfigManager>,
}

impl AuthenticationService {
    /// Create new authentication service with configuration
    pub async fn new(config: SecurityConfig) -> Result<Self, AuthError> {
        let certificate_manager = Arc::new(
            CertificateManager::new(&config.tls).await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("Certificate manager initialization failed: {}", e)
                })?
        );

        let rbac_manager = Arc::new(
            RbacManager::new(config.rbac.clone()).await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("RBAC manager initialization failed: {}", e)
                })?
        );

        let session_manager = Arc::new(
            SessionManager::new(config.session.clone()).await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("Session manager initialization failed: {}", e)
                })?
        );

        let api_key_manager = Arc::new(
            ApiKeyManager::new(config.api_keys.clone()).await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("API key manager initialization failed: {}", e)
                })?
        );

        let rate_limiter = Arc::new(
            RateLimiter::new(config.rate_limiting.clone())
                .map_err(|e| AuthError::ConfigError {
                    message: format!("Rate limiter initialization failed: {}", e)
                })?
        );

        let audit_logger = Arc::new(
            AuditLogger::new(config.audit.clone()).await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("Audit logger initialization failed: {}", e)
                })?
        );

        // Initialize ConfigManager for secure configuration access
        let config_manager = Arc::new(
            ConfigManager::from_env().await
                .map_err(|e| AuthError::ConfigError {
                    message: format!("Failed to initialize ConfigManager: {}", e)
                })?
        );
        
        info!("ConfigManager initialized successfully");

        info!("Authentication service initialized with security configuration");

        Ok(Self {
            config,
            certificate_manager,
            rbac_manager,
            session_manager,
            api_key_manager,
            rate_limiter,
            audit_logger,
            config_manager,
        })
    }

    /// Authenticate user with username/password
    #[instrument(skip(self, password))]
    pub async fn authenticate_user(
        &self,
        username: &str,
        password: &str,
        client_ip: &str,
    ) -> Result<AuthenticationResult, AuthError> {
        // Rate limiting check
        self.rate_limiter.check_auth_attempt(client_ip).await?;
        
        // Check account lockout
        self.rate_limiter.check_account_lockout(username).await?;

        // Audit log the authentication attempt
        self.audit_logger.log_auth_attempt(username, client_ip, "password").await?;

        // Verify credentials (in production, this would check against secure database)
        let user_id = match self.verify_credentials(username, password).await {
            Ok(user_id) => {
                // Record successful authentication
                self.rate_limiter.record_auth_success(&user_id, client_ip).await;
                user_id
            }
            Err(e) => {
                // Record failed authentication
                if let Err(rate_limit_err) = self.rate_limiter.record_auth_failure(username, client_ip).await {
                    warn!("Rate limiting error during auth failure recording: {}", rate_limit_err);
                }
                return Err(e);
            }
        };

        // Create session
        let session = self.session_manager.create_session(user_id.clone(), Some(client_ip.to_string()), None).await?;

        // Load user permissions
        let permissions = self.rbac_manager.get_user_permissions(&user_id).await?;

        // Audit log successful authentication
        self.audit_logger.log_auth_success(&user_id, client_ip, "password").await?;

        info!("User {} authenticated successfully from {}", username, client_ip);

        Ok(AuthenticationResult {
            user_id,
            session_token: session.token,
            expires_at: session.expires_at,
            permissions,
        })
    }

    /// Authenticate with API key
    #[instrument(skip(self, api_key))]
    pub async fn authenticate_api_key(
        &self,
        api_key: &str,
        client_ip: &str,
    ) -> Result<AuthenticationResult, AuthError> {
        // Rate limiting check for API keys
        self.rate_limiter.check_api_request(client_ip).await?;

        // Audit log the API key attempt
        self.audit_logger.log_auth_attempt("api_key", client_ip, "api_key").await?;

        // Verify API key
        let key_info = self.api_key_manager.verify_key(api_key).await?;

        // Load permissions for API key
        let permissions = self.rbac_manager.get_api_key_permissions(&key_info.id).await?;

        // Audit log successful API key authentication
        self.audit_logger.log_auth_success(&key_info.user_id, client_ip, "api_key").await?;

        info!("API key authenticated successfully from {}", client_ip);

        Ok(AuthenticationResult {
            user_id: key_info.user_id,
            session_token: format!("api:{}", key_info.id),
            expires_at: key_info.expires_at,
            permissions,
        })
    }

    /// Validate session token
    #[instrument(skip(self))]
    pub async fn validate_session(
        &self,
        session_token: &str,
        client_ip: &str,
    ) -> Result<SessionInfo, AuthError> {
        // Handle API key sessions
        if session_token.starts_with("api:") {
            let api_key_id = &session_token[4..];
            let key_info = self.api_key_manager.get_key_info(api_key_id).await?;
            let permissions = self.rbac_manager.get_api_key_permissions(api_key_id).await?;

            return Ok(SessionInfo {
                user_id: key_info.user_id,
                session_id: api_key_id.to_string(),
                expires_at: key_info.expires_at,
                permissions,
                last_activity: Utc::now(),
            });
        }

        // Validate regular session
        let session = self.session_manager.validate_session(session_token).await?;
        let permissions = self.rbac_manager.get_user_permissions(&session.user_id).await?;

        Ok(SessionInfo {
            user_id: session.user_id,
            session_id: session.id,
            expires_at: session.expires_at,
            permissions,
            last_activity: session.last_activity,
        })
    }

    /// Check if user has specific permission for operation
    #[instrument(skip(self))]
    pub async fn check_permission(
        &self,
        user_id: &str,
        permission: &str,
        resource: Option<&str>,
    ) -> Result<bool, AuthError> {
        let has_permission = self.rbac_manager
            .check_permission(user_id, permission, resource).await?;

        // Audit log permission check
        self.audit_logger.log_permission_check(
            user_id,
            permission,
            resource,
            has_permission
        ).await?;

        Ok(has_permission)
    }

    /// Create new API key for user
    #[instrument(skip(self))]
    pub async fn create_api_key(
        &self,
        user_id: &str,
        name: &str,
        permissions: Vec<String>,
        expires_in_days: Option<u32>,
    ) -> Result<ApiKeyResult, AuthError> {
        let api_key = self.api_key_manager.create_key(
            user_id,
            name,
            permissions,
            expires_in_days
        ).await?;

        // Audit log API key creation
        self.audit_logger.log_api_key_created(user_id, &api_key.id, name).await?;

        info!("API key created for user {}: {}", user_id, name);

        Ok(api_key)
    }

    /// Revoke API key
    #[instrument(skip(self))]
    pub async fn revoke_api_key(
        &self,
        user_id: &str,
        api_key_id: &str,
    ) -> Result<(), AuthError> {
        self.api_key_manager.revoke_key(api_key_id).await?;

        // Audit log API key revocation
        self.audit_logger.log_api_key_revoked(user_id, api_key_id).await?;

        info!("API key revoked: {}", api_key_id);

        Ok(())
    }

    /// Logout and invalidate session
    #[instrument(skip(self))]
    pub async fn logout(&self, session_token: &str) -> Result<(), AuthError> {
        if !session_token.starts_with("api:") {
            self.session_manager.invalidate_session(session_token).await?;

            // Audit log logout
            self.audit_logger.log_logout(session_token).await?;

            info!("User session logged out: {}", session_token);
        }

        Ok(())
    }

    /// Get TLS configuration for gRPC services
    pub fn get_tls_config(&self) -> &TlsConfig {
        &self.config.tls
    }

    /// Get certificate manager for TLS operations
    pub fn get_certificate_manager(&self) -> Arc<CertificateManager> {
        Arc::clone(&self.certificate_manager)
    }

    /// Get ConfigManager
    pub fn get_config_manager(&self) -> Arc<ConfigManager> {
        self.config_manager.clone()
    }
    
    /// Check if ConfigManager is available and healthy
    pub async fn is_config_service_healthy(&self) -> bool {
        // ConfigManager is always available, check basic health
        match self.config_manager.health_check().await {
            Ok(_) => true,
            Err(_) => false,
        }
    }

    /// Store JWT token using ConfigManager
    pub async fn store_jwt_token_secure(
        &self,
        user_id: &str,
        token: &str,
        _expires_at: Option<DateTime<Utc>>,
    ) -> Result<(), AuthError> {
        use config::ConfigCategory;
        let key = format!("jwt_token_{}", user_id);
        self.config_manager
            .set_config(ConfigCategory::Security, &key, token)
            .await
            .map_err(|e| AuthError::ConfigError { message: e.to_string() })?;
        Ok(())
    }
    
    /// Retrieve JWT token using ConfigManager
    pub async fn get_jwt_token_secure(&self, user_id: &str) -> Result<Option<String>, AuthError> {
        use config::ConfigCategory;
        let key = format!("jwt_token_{}", user_id);
        match self.config_manager.get_config::<String>(ConfigCategory::Security, &key).await {
            Ok(token) => Ok(token),
            Err(_) => Ok(None), // Token not found or error, return None
        }
    }

    /// Verify user credentials (placeholder - implement with secure database)
    async fn verify_credentials(&self, username: &str, password: &str) -> Result<String, AuthError> {
        // SECURITY: Use proper password hashing and database lookup
        use argon2::{Argon2, PasswordVerifier, password_hash::PasswordHash};
        
        // TODO: Replace with actual database lookup
        let stored_credentials = match username {
            "admin" => Some(("admin_user_id", "$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQxMjM$MOCK_HASH_REPLACE_WITH_REAL")),
            "trader" => Some(("trader_user_id", "$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQxMjM$MOCK_HASH_REPLACE_WITH_REAL")),
            "viewer" => Some(("viewer_user_id", "$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQxMjM$MOCK_HASH_REPLACE_WITH_REAL")),
            _ => None,
        };

        if let Some((user_id, password_hash)) = stored_credentials {
            // Parse the stored hash
            let parsed_hash = PasswordHash::new(password_hash)
                .map_err(|_| AuthError::InvalidCredentials)?;
            
            // Verify password using constant-time comparison
            match Argon2::default().verify_password(password.as_bytes(), &parsed_hash) {
                Ok(()) => Ok(user_id.to_string()),
                Err(_) => Err(AuthError::InvalidCredentials),
            }
        } else {
            Err(AuthError::InvalidCredentials)
        }
    }
}

/// Result of successful authentication
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthenticationResult {
    pub user_id: String,
    pub session_token: String,
    pub expires_at: DateTime<Utc>,
    pub permissions: Vec<String>,
}

/// Session information for validated tokens
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SessionInfo {
    pub user_id: String,
    pub session_id: String,
    pub expires_at: DateTime<Utc>,
    pub permissions: Vec<String>,
    pub last_activity: DateTime<Utc>,
}

/// API key creation result
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ApiKeyResult {
    pub id: String,
    pub key: String,
    pub name: String,
    pub permissions: Vec<String>,
    pub expires_at: DateTime<Utc>,
}

/// Default security configuration for trading system
impl Default for SecurityConfig {
    fn default() -> Self {
        Self {
            tls: TlsConfig {
                cert_path: "/etc/foxhunt/tls/server.crt".to_string(),
                key_path: "/etc/foxhunt/tls/server.key".to_string(),
                ca_cert_path: "/etc/foxhunt/tls/ca.crt".to_string(),
                require_client_cert: true,
                min_version: "1.3".to_string(),
                cipher_suites: vec![
                    "TLS_AES_256_GCM_SHA384".to_string(),
                    "TLS_CHACHA20_POLY1305_SHA256".to_string(),
                    "TLS_AES_128_GCM_SHA256".to_string(),
                ],
            },
            session: SessionConfig {
                timeout_seconds: 3600, // 1 hour
                max_sessions_per_user: 5,
                token_length: 32,
                refresh_interval_seconds: 300, // 5 minutes
            },
            rate_limiting: RateLimitConfig {
                authenticated_rpm: 1000,
                api_key_rpm: 5000,
                trading_burst: 100,
                window_seconds: 60,
            },
            api_keys: ApiKeyConfig {
                key_length: 64,
                default_expiry_days: 90,
                max_keys_per_user: 10,
                rotation_interval_days: 30,
            },
            audit: AuditConfig {
                log_auth_attempts: true,
                log_permission_checks: true,
                log_trading_operations: true,
                retention_days: 2555, // 7 years for financial compliance
                encrypt_logs: true,
            },
            rbac: RbacConfig {
                strict_mode: true,
                cache_permissions: true,
                cache_ttl_seconds: 300, // 5 minutes
            },
            vault: None, // Vault integration is optional
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[tokio::test]
    async fn test_security_config_default() {
        let config = SecurityConfig::default();
        assert_eq!(config.session.timeout_seconds, 3600);
        assert_eq!(config.tls.min_version, "1.3");
        assert!(config.audit.log_auth_attempts);
    }

    #[tokio::test]
    async fn test_auth_service_creation() {
        let config = SecurityConfig::default();
        // Note: This will fail without proper certificates in test environment
        // In production, use proper test certificates
        assert!(AuthenticationService::new(config).await.is_err());
    }
}