from dataclasses import dataclass, field
from datetime import datetime, timedelta
from typing import List, Dict, Optional, Set
from enum import Enum
import hashlib
import logging
 
logger = logging.getLogger(__name__)
 
class AccessLevel(Enum):
    READ = "read"
    WRITE = "write"
    EXECUTE = "execute"
    ADMIN = "admin"
 
class SystemCriticality(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"  # Financial reporting systems
 
@dataclass
class User:
    id: str
    email: str
    department: str
    manager_id: str
    job_title: str
    hire_date: datetime
    termination_date: Optional[datetime] = None
    is_active: bool = True
 
@dataclass
class AccessRequest:
    id: str
    user_id: str
    system_id: str
    access_level: AccessLevel
    justification: str
    requested_at: datetime
    requested_by: str
    approved_by: Optional[str] = None
    approved_at: Optional[datetime] = None
    denied_by: Optional[str] = None
    denied_at: Optional[datetime] = None
    status: str = "pending"
    expiration_date: Optional[datetime] = None
 
@dataclass
class AccessGrant:
    id: str
    user_id: str
    system_id: str
    access_level: AccessLevel
    granted_at: datetime
    granted_by: str
    request_id: str
    expiration_date: Optional[datetime] = None
    last_review_date: Optional[datetime] = None
    is_active: bool = True
 
class SOXAccessControlManager:
    def __init__(self, db_connection):
        self.db = db_connection
        self.segregation_rules: Dict[str, Set[str]] = {}
        self.approval_matrix: Dict[SystemCriticality, List[str]] = {}
 
    def define_segregation_rules(self, rules: Dict[str, List[str]]):
        """Define segregation of duties rules."""
        self.segregation_rules = {k: set(v) for k, v in rules.items()}
 
        # Example rules for financial systems:
        # - Users with payment initiation cannot have payment approval
        # - Users with journal entry creation cannot have posting approval
        # - Users with vendor master data cannot have payment processing
 
    def define_approval_matrix(self, matrix: Dict[SystemCriticality, List[str]]):
        """Define approval requirements by system criticality."""
        self.approval_matrix = matrix
 
        # Example matrix:
        # LOW: Direct manager approval
        # MEDIUM: Manager + IT Security approval
        # HIGH: Manager + IT Security + System Owner approval
        # CRITICAL: Manager + IT Security + System Owner + Compliance approval
 
    def request_access(self, request: AccessRequest) -> Dict:
        """Submit access request with SOX controls."""
        # Validate request
        validation = self._validate_request(request)
        if not validation["is_valid"]:
            return {
                "success": False,
                "request_id": request.id,
                "errors": validation["errors"]
            }
 
        # Check segregation of duties
        sod_check = self._check_segregation_of_duties(
            request.user_id,
            request.system_id,
            request.access_level
        )
        if not sod_check["passes"]:
            return {
                "success": False,
                "request_id": request.id,
                "errors": [f"SOD Conflict: {sod_check['conflict']}"],
                "requires_exception": True
            }
 
        # Determine required approvers
        system_criticality = self._get_system_criticality(request.system_id)
        required_approvers = self._get_required_approvers(
            request.user_id,
            system_criticality
        )
 
        # Save request
        self._save_request(request)
 
        # Log audit trail
        self._log_audit_event(
            event_type="ACCESS_REQUEST_CREATED",
            user_id=request.requested_by,
            details={
                "request_id": request.id,
                "target_user": request.user_id,
                "system_id": request.system_id,
                "access_level": request.access_level.value,
                "required_approvers": required_approvers
            }
        )
 
        # Trigger approval workflow
        self._initiate_approval_workflow(request, required_approvers)
 
        return {
            "success": True,
            "request_id": request.id,
            "required_approvers": required_approvers,
            "status": "pending_approval"
        }
 
    def _validate_request(self, request: AccessRequest) -> Dict:
        """Validate access request."""
        errors = []
 
        # Check user exists and is active
        user = self._get_user(request.user_id)
        if not user:
            errors.append("User not found")
        elif not user.is_active:
            errors.append("User is not active")
 
        # Check system exists
        system = self._get_system(request.system_id)
        if not system:
            errors.append("System not found")
 
        # Check justification provided
        if not request.justification or len(request.justification) < 20:
            errors.append("Justification must be at least 20 characters")
 
        return {
            "is_valid": len(errors) == 0,
            "errors": errors
        }
 
    def _check_segregation_of_duties(self,
                                     user_id: str,
                                     system_id: str,
                                     access_level: AccessLevel) -> Dict:
        """Check for segregation of duties conflicts."""
        # Get user's current access
        current_access = self._get_user_access(user_id)
 
        # Create access key for checking
        new_access_key = f"{system_id}:{access_level.value}"
 
        # Check against segregation rules
        for existing_access in current_access:
            existing_key = f"{existing_access.system_id}:{existing_access.access_level.value}"
 
            # Check if new access conflicts with existing
            if existing_key in self.segregation_rules:
                if new_access_key in self.segregation_rules[existing_key]:
                    return {
                        "passes": False,
                        "conflict": f"Access to {new_access_key} conflicts with existing {existing_key}"
                    }
 
            # Check reverse
            if new_access_key in self.segregation_rules:
                if existing_key in self.segregation_rules[new_access_key]:
                    return {
                        "passes": False,
                        "conflict": f"Existing {existing_key} conflicts with requested {new_access_key}"
                    }
 
        return {"passes": True}
 
    def _get_required_approvers(self,
                               user_id: str,
                               criticality: SystemCriticality) -> List[Dict]:
        """Get required approvers based on criticality."""
        approvers = []
        user = self._get_user(user_id)
 
        if criticality in [SystemCriticality.LOW, SystemCriticality.MEDIUM,
                          SystemCriticality.HIGH, SystemCriticality.CRITICAL]:
            # Manager approval always required
            approvers.append({
                "role": "manager",
                "user_id": user.manager_id,
                "required": True
            })
 
        if criticality in [SystemCriticality.MEDIUM, SystemCriticality.HIGH,
                          SystemCriticality.CRITICAL]:
            # IT Security for medium and above
            approvers.append({
                "role": "it_security",
                "user_id": None,  # Any IT Security member
                "required": True
            })
 
        if criticality in [SystemCriticality.HIGH, SystemCriticality.CRITICAL]:
            # System owner for high and critical
            approvers.append({
                "role": "system_owner",
                "user_id": None,  # Determined by system
                "required": True
            })
 
        if criticality == SystemCriticality.CRITICAL:
            # Compliance officer for critical systems
            approvers.append({
                "role": "compliance",
                "user_id": None,
                "required": True
            })
 
        return approvers
 
    def approve_access(self,
                       request_id: str,
                       approver_id: str,
                       approval_role: str,
                       comments: str = "") -> Dict:
        """Process access approval."""
        request = self._get_request(request_id)
        if not request:
            return {"success": False, "error": "Request not found"}
 
        if request.status != "pending":
            return {"success": False, "error": f"Request is {request.status}"}
 
        # Validate approver authority
        if not self._validate_approver(approver_id, approval_role, request):
            return {"success": False, "error": "Approver not authorized"}
 
        # Record approval
        self._record_approval(request_id, approver_id, approval_role, comments)
 
        # Check if all required approvals received
        if self._all_approvals_received(request_id):
            # Grant access
            grant = self._grant_access(request)
 
            # Log audit trail
            self._log_audit_event(
                event_type="ACCESS_GRANTED",
                user_id=approver_id,
                details={
                    "request_id": request_id,
                    "grant_id": grant.id,
                    "target_user": request.user_id,
                    "system_id": request.system_id,
                    "access_level": request.access_level.value
                }
            )
 
            return {
                "success": True,
                "status": "approved",
                "grant_id": grant.id
            }
 
        return {
            "success": True,
            "status": "pending_additional_approvals"
        }
 
    def revoke_access(self,
                      grant_id: str,
                      revoked_by: str,
                      reason: str) -> Dict:
        """Revoke access with audit trail."""
        grant = self._get_grant(grant_id)
        if not grant:
            return {"success": False, "error": "Grant not found"}
 
        # Deactivate grant
        grant.is_active = False
        self._save_grant(grant)
 
        # Log audit trail
        self._log_audit_event(
            event_type="ACCESS_REVOKED",
            user_id=revoked_by,
            details={
                "grant_id": grant_id,
                "target_user": grant.user_id,
                "system_id": grant.system_id,
                "access_level": grant.access_level.value,
                "reason": reason
            }
        )
 
        return {"success": True, "status": "revoked"}
 
    def perform_access_review(self, reviewer_id: str) -> Dict:
        """Perform periodic access review for SOX compliance."""
        reviews_needed = []
        review_period_days = 90  # Quarterly review
 
        # Get all active grants for critical systems
        active_grants = self._get_active_grants_for_critical_systems()
 
        for grant in active_grants:
            last_review = grant.last_review_date or grant.granted_at
            days_since_review = (datetime.utcnow() - last_review).days
 
            if days_since_review >= review_period_days:
                reviews_needed.append({
                    "grant_id": grant.id,
                    "user_id": grant.user_id,
                    "system_id": grant.system_id,
                    "access_level": grant.access_level.value,
                    "days_since_review": days_since_review,
                    "granted_at": grant.granted_at.isoformat()
                })
 
        # Log audit event for review initiation
        self._log_audit_event(
            event_type="ACCESS_REVIEW_INITIATED",
            user_id=reviewer_id,
            details={
                "total_grants_reviewed": len(active_grants),
                "reviews_needed": len(reviews_needed)
            }
        )
 
        return {
            "review_date": datetime.utcnow().isoformat(),
            "reviewer_id": reviewer_id,
            "total_active_grants": len(active_grants),
            "reviews_needed": reviews_needed
        }
 
    def _log_audit_event(self, event_type: str, user_id: str, details: Dict):
        """Log audit event with tamper-evident hash."""
        timestamp = datetime.utcnow()
 
        # Get previous event hash for chain
        previous_hash = self._get_last_audit_hash()
 
        # Create event record
        event = {
            "event_type": event_type,
            "timestamp": timestamp.isoformat(),
            "user_id": user_id,
            "details": details,
            "previous_hash": previous_hash
        }
 
        # Generate hash for tamper detection
        event_string = f"{event_type}{timestamp.isoformat()}{user_id}{str(details)}{previous_hash}"
        event["hash"] = hashlib.sha256(event_string.encode()).hexdigest()
 
        # Store event
        self._store_audit_event(event)
 
        logger.info(f"Audit event logged: {event_type} by {user_id}")
 
    # Placeholder methods for database operations
    def _get_user(self, user_id: str) -> Optional[User]:
        pass
 
    def _get_system(self, system_id: str) -> Optional[Dict]:
        pass
 
    def _get_system_criticality(self, system_id: str) -> SystemCriticality:
        pass
 
    def _get_user_access(self, user_id: str) -> List[AccessGrant]:
        pass
 
    def _save_request(self, request: AccessRequest):
        pass
 
    def _get_request(self, request_id: str) -> Optional[AccessRequest]:
        pass
 
    def _validate_approver(self, approver_id: str, role: str, request: AccessRequest) -> bool:
        pass
 
    def _record_approval(self, request_id: str, approver_id: str, role: str, comments: str):
        pass
 
    def _all_approvals_received(self, request_id: str) -> bool:
        pass
 
    def _grant_access(self, request: AccessRequest) -> AccessGrant:
        pass
 
    def _get_grant(self, grant_id: str) -> Optional[AccessGrant]:
        pass
 
    def _save_grant(self, grant: AccessGrant):
        pass
 
    def _get_active_grants_for_critical_systems(self) -> List[AccessGrant]:
        pass
 
    def _get_last_audit_hash(self) -> str:
        pass
 
    def _store_audit_event(self, event: Dict):
        pass
 
    def _initiate_approval_workflow(self, request: AccessRequest, approvers: List[Dict]):
        pass

from dataclasses import dataclass, field
from datetime import datetime
from typing import List, Dict, Optional
from enum import Enum
 
class ChangeType(Enum):
    EMERGENCY = "emergency"
    STANDARD = "standard"
    MAJOR = "major"
 
class ChangeStatus(Enum):
    DRAFT = "draft"
    PENDING_APPROVAL = "pending_approval"
    APPROVED = "approved"
    IN_PROGRESS = "in_progress"
    COMPLETED = "completed"
    FAILED = "failed"
    ROLLED_BACK = "rolled_back"
    CANCELLED = "cancelled"
 
@dataclass
class ChangeRequest:
    id: str
    title: str
    description: str
    change_type: ChangeType
    system_id: str
    requested_by: str
    requested_at: datetime
    scheduled_start: datetime
    scheduled_end: datetime
    impact_assessment: str
    rollback_plan: str
    test_plan: str
    status: ChangeStatus = ChangeStatus.DRAFT
    approvals: List[Dict] = field(default_factory=list)
    implementation_notes: str = ""
    actual_start: Optional[datetime] = None
    actual_end: Optional[datetime] = None
 
class SOXChangeControlManager:
    def __init__(self, db_connection, notification_service):
        self.db = db_connection
        self.notifications = notification_service
 
    def create_change_request(self, change: ChangeRequest) -> Dict:
        """Create change request with SOX controls."""
        # Validate required fields
        validation = self._validate_change_request(change)
        if not validation["is_valid"]:
            return {
                "success": False,
                "errors": validation["errors"]
            }
 
        # Determine required approvals
        required_approvals = self._get_required_approvals(change)
 
        # Save change request
        self._save_change_request(change)
 
        # Log audit trail
        self._log_change_audit(
            change_id=change.id,
            action="CREATED",
            user_id=change.requested_by,
            details={
                "title": change.title,
                "type": change.change_type.value,
                "system_id": change.system_id
            }
        )
 
        return {
            "success": True,
            "change_id": change.id,
            "required_approvals": required_approvals
        }
 
    def _validate_change_request(self, change: ChangeRequest) -> Dict:
        """Validate change request for SOX compliance."""
        errors = []
 
        # Title and description required
        if not change.title or len(change.title) < 10:
            errors.append("Title must be at least 10 characters")
        if not change.description or len(change.description) < 50:
            errors.append("Description must be at least 50 characters")
 
        # Impact assessment required
        if not change.impact_assessment:
            errors.append("Impact assessment is required")
 
        # Rollback plan required
        if not change.rollback_plan:
            errors.append("Rollback plan is required")
 
        # Test plan required for non-emergency changes
        if change.change_type != ChangeType.EMERGENCY and not change.test_plan:
            errors.append("Test plan is required")
 
        # Scheduling validation
        if change.scheduled_start >= change.scheduled_end:
            errors.append("Scheduled end must be after scheduled start")
 
        if change.change_type != ChangeType.EMERGENCY:
            # Standard changes need 48 hour lead time
            min_lead_time = datetime.utcnow() + timedelta(hours=48)
            if change.scheduled_start < min_lead_time:
                errors.append("Standard changes require 48 hour minimum lead time")
 
        return {
            "is_valid": len(errors) == 0,
            "errors": errors
        }
 
    def _get_required_approvals(self, change: ChangeRequest) -> List[Dict]:
        """Get required approvals based on change type."""
        approvals = []
 
        if change.change_type == ChangeType.EMERGENCY:
            approvals = [
                {"role": "it_manager", "required": True},
                {"role": "system_owner", "required": True}
            ]
        elif change.change_type == ChangeType.STANDARD:
            approvals = [
                {"role": "technical_lead", "required": True},
                {"role": "it_manager", "required": True},
                {"role": "qa_lead", "required": True}
            ]
        elif change.change_type == ChangeType.MAJOR:
            approvals = [
                {"role": "technical_lead", "required": True},
                {"role": "it_manager", "required": True},
                {"role": "qa_lead", "required": True},
                {"role": "business_owner", "required": True},
                {"role": "security_officer", "required": True},
                {"role": "change_advisory_board", "required": True}
            ]
 
        return approvals
 
    def approve_change(self,
                       change_id: str,
                       approver_id: str,
                       role: str,
                       approved: bool,
                       comments: str = "") -> Dict:
        """Process change approval."""
        change = self._get_change_request(change_id)
        if not change:
            return {"success": False, "error": "Change not found"}
 
        # Record approval/rejection
        approval_record = {
            "approver_id": approver_id,
            "role": role,
            "approved": approved,
            "comments": comments,
            "timestamp": datetime.utcnow().isoformat()
        }
 
        change.approvals.append(approval_record)
        self._save_change_request(change)
 
        # Log audit trail
        self._log_change_audit(
            change_id=change_id,
            action="APPROVED" if approved else "REJECTED",
            user_id=approver_id,
            details={
                "role": role,
                "comments": comments
            }
        )
 
        if not approved:
            change.status = ChangeStatus.CANCELLED
            self._save_change_request(change)
            return {"success": True, "status": "rejected"}
 
        # Check if all approvals received
        if self._all_approvals_received(change):
            change.status = ChangeStatus.APPROVED
            self._save_change_request(change)
            self._notify_implementers(change)
            return {"success": True, "status": "approved"}
 
        return {"success": True, "status": "pending_additional_approvals"}
 
    def start_implementation(self,
                            change_id: str,
                            implementer_id: str) -> Dict:
        """Start change implementation."""
        change = self._get_change_request(change_id)
        if not change:
            return {"success": False, "error": "Change not found"}
 
        if change.status != ChangeStatus.APPROVED:
            return {"success": False, "error": "Change not approved"}
 
        # Verify implementation window
        now = datetime.utcnow()
        if not (change.scheduled_start <= now <= change.scheduled_end):
            if change.change_type != ChangeType.EMERGENCY:
                return {
                    "success": False,
                    "error": "Outside scheduled implementation window"
                }
 
        change.status = ChangeStatus.IN_PROGRESS
        change.actual_start = now
        self._save_change_request(change)
 
        # Log audit trail
        self._log_change_audit(
            change_id=change_id,
            action="IMPLEMENTATION_STARTED",
            user_id=implementer_id,
            details={"actual_start": now.isoformat()}
        )
 
        return {"success": True, "status": "in_progress"}
 
    def complete_implementation(self,
                               change_id: str,
                               implementer_id: str,
                               success: bool,
                               notes: str = "") -> Dict:
        """Complete change implementation."""
        change = self._get_change_request(change_id)
        if not change:
            return {"success": False, "error": "Change not found"}
 
        if change.status != ChangeStatus.IN_PROGRESS:
            return {"success": False, "error": "Change not in progress"}
 
        now = datetime.utcnow()
        change.actual_end = now
        change.implementation_notes = notes
 
        if success:
            change.status = ChangeStatus.COMPLETED
        else:
            change.status = ChangeStatus.FAILED
 
        self._save_change_request(change)
 
        # Log audit trail
        self._log_change_audit(
            change_id=change_id,
            action="IMPLEMENTATION_COMPLETED" if success else "IMPLEMENTATION_FAILED",
            user_id=implementer_id,
            details={
                "actual_end": now.isoformat(),
                "notes": notes,
                "success": success
            }
        )
 
        # Trigger post-implementation review for major changes
        if change.change_type == ChangeType.MAJOR:
            self._schedule_post_implementation_review(change)
 
        return {
            "success": True,
            "status": change.status.value
        }
 
    def rollback_change(self,
                        change_id: str,
                        implementer_id: str,
                        reason: str) -> Dict:
        """Execute rollback for failed change."""
        change = self._get_change_request(change_id)
        if not change:
            return {"success": False, "error": "Change not found"}
 
        # Log rollback initiation
        self._log_change_audit(
            change_id=change_id,
            action="ROLLBACK_INITIATED",
            user_id=implementer_id,
            details={"reason": reason}
        )
 
        # Execute rollback plan (implementation-specific)
        rollback_success = self._execute_rollback(change)
 
        if rollback_success:
            change.status = ChangeStatus.ROLLED_BACK
            self._save_change_request(change)
 
            self._log_change_audit(
                change_id=change_id,
                action="ROLLBACK_COMPLETED",
                user_id=implementer_id,
                details={}
            )
        else:
            self._log_change_audit(
                change_id=change_id,
                action="ROLLBACK_FAILED",
                user_id=implementer_id,
                details={"error": "Rollback execution failed"}
            )
 
            # Escalate to incident management
            self._escalate_to_incident_management(change, reason)
 
        return {
            "success": rollback_success,
            "status": change.status.value
        }
 
    def generate_change_report(self,
                               start_date: datetime,
                               end_date: datetime) -> Dict:
        """Generate SOX change control report."""
        changes = self._get_changes_in_period(start_date, end_date)
 
        report = {
            "period": {
                "start": start_date.isoformat(),
                "end": end_date.isoformat()
            },
            "summary": {
                "total_changes": len(changes),
                "by_type": {},
                "by_status": {},
                "emergency_changes": 0,
                "unauthorized_changes": 0
            },
            "changes": [],
            "compliance_issues": []
        }
 
        for change in changes:
            # Categorize
            change_type = change.change_type.value
            change_status = change.status.value
 
            report["summary"]["by_type"][change_type] = \
                report["summary"]["by_type"].get(change_type, 0) + 1
            report["summary"]["by_status"][change_status] = \
                report["summary"]["by_status"].get(change_status, 0) + 1
 
            if change.change_type == ChangeType.EMERGENCY:
                report["summary"]["emergency_changes"] += 1
 
            # Check for compliance issues
            issues = self._check_change_compliance(change)
            if issues:
                report["compliance_issues"].extend(issues)
 
            report["changes"].append({
                "id": change.id,
                "title": change.title,
                "type": change_type,
                "status": change_status,
                "requested_by": change.requested_by,
                "requested_at": change.requested_at.isoformat(),
                "approvals": len(change.approvals)
            })
 
        return report
 
    def _check_change_compliance(self, change: ChangeRequest) -> List[Dict]:
        """Check change for compliance issues."""
        issues = []
 
        # Check for missing approvals
        required = self._get_required_approvals(change)
        received = set(a["role"] for a in change.approvals if a["approved"])
 
        for req in required:
            if req["role"] not in received and change.status == ChangeStatus.COMPLETED:
                issues.append({
                    "change_id": change.id,
                    "issue": "MISSING_APPROVAL",
                    "details": f"Missing required approval from {req['role']}"
                })
 
        # Check for implementation outside window
        if change.actual_start and change.change_type != ChangeType.EMERGENCY:
            if change.actual_start < change.scheduled_start:
                issues.append({
                    "change_id": change.id,
                    "issue": "EARLY_IMPLEMENTATION",
                    "details": "Implementation started before scheduled time"
                })
 
        # Check for missing documentation
        if not change.implementation_notes and change.status == ChangeStatus.COMPLETED:
            issues.append({
                "change_id": change.id,
                "issue": "MISSING_DOCUMENTATION",
                "details": "Implementation notes not provided"
            })
 
        return issues
 
    def _log_change_audit(self, change_id: str, action: str, user_id: str, details: Dict):
        """Log change audit trail."""
        pass
 
    def _get_change_request(self, change_id: str) -> Optional[ChangeRequest]:
        pass
 
    def _save_change_request(self, change: ChangeRequest):
        pass
 
    def _all_approvals_received(self, change: ChangeRequest) -> bool:
        pass
 
    def _notify_implementers(self, change: ChangeRequest):
        pass
 
    def _execute_rollback(self, change: ChangeRequest) -> bool:
        pass
 
    def _escalate_to_incident_management(self, change: ChangeRequest, reason: str):
        pass
 
    def _get_changes_in_period(self, start: datetime, end: datetime) -> List[ChangeRequest]:
        pass
 
    def _schedule_post_implementation_review(self, change: ChangeRequest):
        pass

from datetime import datetime
from typing import Dict, List, Optional
import hashlib
import json
 
class SOXAuditTrail:
    def __init__(self, db_connection, encryption_service):
        self.db = db_connection
        self.encryption = encryption_service
 
    def log_event(self,
                  event_type: str,
                  user_id: str,
                  resource_type: str,
                  resource_id: str,
                  action: str,
                  details: Dict,
                  ip_address: Optional[str] = None) -> str:
        """Log audit event with tamper-evident hash chain."""
        timestamp = datetime.utcnow()
 
        # Get previous hash for chain integrity
        previous_hash = self._get_last_hash()
 
        # Create event record
        event = {
            "event_id": self._generate_event_id(),
            "timestamp": timestamp.isoformat(),
            "event_type": event_type,
            "user_id": user_id,
            "resource_type": resource_type,
            "resource_id": resource_id,
            "action": action,
            "details": details,
            "ip_address": ip_address,
            "previous_hash": previous_hash
        }
 
        # Generate hash for tamper detection
        event["hash"] = self._generate_hash(event)
 
        # Encrypt sensitive details
        if "sensitive" in details:
            event["details"]["sensitive"] = self.encryption.encrypt(
                json.dumps(details["sensitive"])
            )
 
        # Store event
        self._store_event(event)
 
        return event["event_id"]
 
    def _generate_hash(self, event: Dict) -> str:
        """Generate SHA-256 hash of event for tamper detection."""
        hash_input = (
            f"{event['timestamp']}"
            f"{event['event_type']}"
            f"{event['user_id']}"
            f"{event['resource_type']}"
            f"{event['resource_id']}"
            f"{event['action']}"
            f"{json.dumps(event['details'], sort_keys=True)}"
            f"{event['previous_hash']}"
        )
        return hashlib.sha256(hash_input.encode()).hexdigest()
 
    def verify_integrity(self, start_date: datetime, end_date: datetime) -> Dict:
        """Verify audit trail integrity for a period."""
        events = self._get_events_in_period(start_date, end_date)
 
        verification_result = {
            "period": {
                "start": start_date.isoformat(),
                "end": end_date.isoformat()
            },
            "total_events": len(events),
            "verified_events": 0,
            "integrity_failures": [],
            "chain_breaks": []
        }
 
        previous_hash = None
        for i, event in enumerate(events):
            # Verify hash
            calculated_hash = self._generate_hash({
                **event,
                "hash": None,
                "previous_hash": event["previous_hash"]
            })
 
            if calculated_hash != event["hash"]:
                verification_result["integrity_failures"].append({
                    "event_id": event["event_id"],
                    "timestamp": event["timestamp"],
                    "reason": "Hash mismatch - possible tampering"
                })
            else:
                verification_result["verified_events"] += 1
 
            # Verify chain
            if previous_hash and event["previous_hash"] != previous_hash:
                verification_result["chain_breaks"].append({
                    "event_id": event["event_id"],
                    "timestamp": event["timestamp"],
                    "reason": "Chain break - previous hash mismatch"
                })
 
            previous_hash = event["hash"]
 
        verification_result["is_valid"] = (
            len(verification_result["integrity_failures"]) == 0 and
            len(verification_result["chain_breaks"]) == 0
        )
 
        return verification_result
 
    def search_events(self,
                      user_id: Optional[str] = None,
                      resource_type: Optional[str] = None,
                      resource_id: Optional[str] = None,
                      event_type: Optional[str] = None,
                      start_date: Optional[datetime] = None,
                      end_date: Optional[datetime] = None,
                      limit: int = 100) -> List[Dict]:
        """Search audit events with filters."""
        query_params = {
            "user_id": user_id,
            "resource_type": resource_type,
            "resource_id": resource_id,
            "event_type": event_type,
            "start_date": start_date,
            "end_date": end_date,
            "limit": limit
        }
 
        # Log the search itself for audit purposes
        self.log_event(
            event_type="AUDIT_SEARCH",
            user_id="system",  # Should be actual searcher
            resource_type="audit_trail",
            resource_id="search",
            action="SEARCH",
            details={"query_params": query_params}
        )
 
        return self._execute_search(query_params)
 
    def generate_sox_report(self,
                            report_period: str,
                            start_date: datetime,
                            end_date: datetime) -> Dict:
        """Generate SOX compliance audit report."""
        events = self._get_events_in_period(start_date, end_date)
 
        report = {
            "report_type": "SOX_COMPLIANCE_AUDIT",
            "period": report_period,
            "generated_at": datetime.utcnow().isoformat(),
            "date_range": {
                "start": start_date.isoformat(),
                "end": end_date.isoformat()
            },
            "summary": {
                "total_events": len(events),
                "by_type": {},
                "by_user": {},
                "high_risk_events": 0
            },
            "access_control_events": [],
            "change_control_events": [],
            "financial_system_events": [],
            "integrity_verification": None
        }
 
        # Categorize events
        for event in events:
            event_type = event["event_type"]
            report["summary"]["by_type"][event_type] = \
                report["summary"]["by_type"].get(event_type, 0) + 1
 
            user_id = event["user_id"]
            report["summary"]["by_user"][user_id] = \
                report["summary"]["by_user"].get(user_id, 0) + 1
 
            # Categorize by area
            if event_type.startswith("ACCESS_"):
                report["access_control_events"].append(event)
            elif event_type.startswith("CHANGE_"):
                report["change_control_events"].append(event)
            elif event["resource_type"] in ["financial_system", "ledger", "payment"]:
                report["financial_system_events"].append(event)
 
            # Flag high-risk events
            if self._is_high_risk_event(event):
                report["summary"]["high_risk_events"] += 1
 
        # Verify integrity
        report["integrity_verification"] = self.verify_integrity(start_date, end_date)
 
        return report
 
    def _is_high_risk_event(self, event: Dict) -> bool:
        """Determine if event is high-risk for SOX."""
        high_risk_types = [
            "ACCESS_GRANTED",
            "ACCESS_REVOKED",
            "EMERGENCY_CHANGE",
            "ROLLBACK_INITIATED",
            "SEGREGATION_OVERRIDE",
            "ADMIN_ACCESS"
        ]
        return event["event_type"] in high_risk_types
 
    def _generate_event_id(self) -> str:
        pass
 
    def _get_last_hash(self) -> str:
        pass
 
    def _store_event(self, event: Dict):
        pass
 
    def _get_events_in_period(self, start: datetime, end: datetime) -> List[Dict]:
        pass
 
    def _execute_search(self, params: Dict) -> List[Dict]:
        pass

class SOXComplianceDashboard:
    def __init__(self, access_manager, change_manager, audit_trail):
        self.access = access_manager
        self.changes = change_manager
        self.audit = audit_trail
 
    def generate_quarterly_report(self, quarter: str, year: int) -> Dict:
        """Generate quarterly SOX compliance report."""
        start_date, end_date = self._get_quarter_dates(quarter, year)
 
        return {
            "report_period": f"Q{quarter} {year}",
            "access_control_summary": self._generate_access_summary(start_date, end_date),
            "change_control_summary": self._generate_change_summary(start_date, end_date),
            "audit_trail_summary": self._generate_audit_summary(start_date, end_date),
            "control_effectiveness": self._assess_control_effectiveness(start_date, end_date),
            "recommendations": self._generate_recommendations()
        }
 
    def _generate_access_summary(self, start_date: datetime, end_date: datetime) -> Dict:
        """Summarize access control activities."""
        return {
            "new_access_grants": 0,
            "access_revocations": 0,
            "access_reviews_completed": 0,
            "segregation_conflicts_detected": 0,
            "segregation_exceptions_approved": 0
        }
 
    def _generate_change_summary(self, start_date: datetime, end_date: datetime) -> Dict:
        """Summarize change control activities."""
        return self.changes.generate_change_report(start_date, end_date)["summary"]
 
    def _generate_audit_summary(self, start_date: datetime, end_date: datetime) -> Dict:
        """Summarize audit trail status."""
        integrity = self.audit.verify_integrity(start_date, end_date)
        return {
            "total_events": integrity["total_events"],
            "integrity_verified": integrity["is_valid"],
            "failures": len(integrity["integrity_failures"])
        }
 
    def _assess_control_effectiveness(self, start_date: datetime, end_date: datetime) -> Dict:
        """Assess overall control effectiveness."""
        return {
            "access_control": "effective",
            "change_control": "effective",
            "audit_trail": "effective",
            "overall": "effective"
        }
 
    def _generate_recommendations(self) -> List[str]:
        """Generate improvement recommendations."""
        return []
 
    def _get_quarter_dates(self, quarter: str, year: int):
        """Get start and end dates for a quarter."""
        quarters = {
            "1": (1, 3),
            "2": (4, 6),
            "3": (7, 9),
            "4": (10, 12)
        }
        start_month, end_month = quarters[quarter]
        start_date = datetime(year, start_month, 1)
        if end_month == 12:
            end_date = datetime(year + 1, 1, 1) - timedelta(seconds=1)
        else:
            end_date = datetime(year, end_month + 1, 1) - timedelta(seconds=1)
        return start_date, end_date