class VCSecurityValidator:
    """VC 安全验证器"""
    
    def validate_vc(self, vc: dict) -> tuple[bool, list[str]]:
        """验证 VC 安全性"""
        errors = []
        
        # 1. 验证签名
        if not self._verify_signature(vc):
            errors.append("Invalid signature")
        
        # 2. 验证过期时间
        if self._is_expired(vc):
            errors.append("VC expired")
        
        # 3. 验证签发者
        if not self._verify_issuer(vc):
            errors.append("Untrusted issuer")
        
        # 4. 验证撤销状态
        if self._is_revoked(vc):
            errors.append("VC revoked")
        
        # 5. 验证权限范围
        if not self._validate_scope(vc):
            errors.append("Invalid scope")
        
        return len(errors) == 0, errors
    
    def _verify_signature(self, vc: dict) -> bool:
        """验证签名"""
        proof = vc.get("proof", {})
        # 使用签发者公钥验证
        return verify_jws(proof.get("proofValue"), vc)
    
    def _is_expired(self, vc: dict) -> bool:
        """检查是否过期"""
        expiration = vc.get("expirationDate")
        if expiration:
            return datetime.fromisoformat(expiration) < datetime.utcnow()
        return False
    
    def _verify_issuer(self, vc: dict) -> bool:
        """验证签发者"""
        issuer_did = vc.get("issuer", {}).get("id")
        return is_trusted_issuer(issuer_did)
    
    def _is_revoked(self, vc: dict) -> bool:
        """检查是否撤销"""
        vc_id = vc.get("id")
        return check_revocation_status(vc_id)

class EndToEndEncryption:
    """端到端加密"""
    
    def __init__(self, private_key: X25519PrivateKey):
        self.private_key = private_key
    
    def encrypt_for_peer(
        self, 
        data: bytes, 
        peer_public_key: X25519PublicKey
    ) -> bytes:
        """为特定接收者加密"""
        
        # 1. 密钥协商
        shared_key = self.private_key.exchange(peer_public_key)
        
        # 2. 派生加密密钥
        salt = os.urandom(16)
        encryption_key = HKDF(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            info=b"nexa-e2e-encryption"
        ).derive(shared_key)
        
        # 3. 加密
        nonce = os.urandom(12)
        cipher = ChaCha20Poly1305(encryption_key)
        ciphertext = cipher.encrypt(nonce, data, None)
        
        # 4. 组装消息
        return salt + nonce + ciphertext
    
    def decrypt_from_peer(
        self,
        encrypted_data: bytes,
        peer_public_key: X25519PublicKey
    ) -> bytes:
        """解密来自特定发送者的数据"""
        
        # 1. 解析消息
        salt = encrypted_data[:16]
        nonce = encrypted_data[16:28]
        ciphertext = encrypted_data[28:]
        
        # 2. 密钥协商
        shared_key = self.private_key.exchange(peer_public_key)
        
        # 3. 派生加密密钥
        encryption_key = HKDF(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            info=b"nexa-e2e-encryption"
        ).derive(shared_key)
        
        # 4. 解密
        cipher = ChaCha20Poly1305(encryption_key)
        return cipher.decrypt(nonce, ciphertext, None)

def sign_message(
    message: dict,
    private_key: Ed25519PrivateKey
) -> dict:
    """签名消息"""
    
    # 1. 规范化消息
    canonical = json.dumps(message, sort_keys=True)
    
    # 2. 添加时间戳防止重放
    timestamp = int(datetime.utcnow().timestamp())
    message["timestamp"] = timestamp
    
    # 3. 签名
    signature = private_key.sign(canonical.encode())
    
    # 4. 添加签名
    message["signature"] = base64.b64encode(signature).decode()
    
    return message

def verify_message(
    message: dict,
    public_key: Ed25519PublicKey
) -> bool:
    """验证消息签名"""
    
    # 1. 提取签名
    signature = base64.b64decode(message.pop("signature"))
    
    # 2. 检查时间戳
    timestamp = message.get("timestamp", 0)
    if abs(datetime.utcnow().timestamp() - timestamp) > 300:  # 5 分钟
        return False
    
    # 3. 规范化消息
    canonical = json.dumps(message, sort_keys=True)
    
    # 4. 验证签名
    try:
        public_key.verify(signature, canonical.encode())
        return True
    except Exception:
        return False

class ReplayProtection:
    """重放攻击防护"""
    
    def __init__(self, cache_ttl: int = 300):
        self.cache = TTLCache(maxsize=10000, ttl=cache_ttl)
    
    def check_and_record(self, message_id: str, timestamp: int) -> bool:
        """检查并记录消息 ID"""
        
        # 1. 检查时间戳是否在合理范围
        now = int(datetime.utcnow().timestamp())
        if abs(now - timestamp) > 300:  # 5 分钟
            return False
        
        # 2. 检查是否已处理
        if message_id in self.cache:
            return False
        
        # 3. 记录消息 ID
        self.cache[message_id] = True
        
        return True
    
    def generate_message_id(self) -> str:
        """生成唯一消息 ID"""
        return str(uuid.uuid4())

class DataEncryption:
    """数据加密管理"""
    
    def __init__(self, master_key: bytes):
        self.master_key = master_key
    
    def encrypt_data(self, data: bytes, context: str = "") -> bytes:
        """加密数据"""
        
        # 1. 生成数据加密密钥
        dek = os.urandom(32)
        
        # 2. 加密数据
        nonce = os.urandom(12)
        cipher = AESGCM(dek)
        ciphertext = cipher.encrypt(nonce, data, context.encode())
        
        # 3. 加密数据加密密钥
        kek_nonce = os.urandom(12)
        kek_cipher = AESGCM(self.master_key)
        encrypted_dek = kek_cipher.encrypt(kek_nonce, dek, None)
        
        # 4. 组装结果
        return kek_nonce + encrypted_dek + nonce + ciphertext
    
    def decrypt_data(self, encrypted_data: bytes, context: str = "") -> bytes:
        """解密数据"""
        
        # 1. 解析组件
        kek_nonce = encrypted_data[:12]
        encrypted_dek = encrypted_data[12:60]
        nonce = encrypted_data[60:72]
        ciphertext = encrypted_data[72:]
        
        # 2. 解密数据加密密钥
        kek_cipher = AESGCM(self.master_key)
        dek = kek_cipher.decrypt(kek_nonce, encrypted_dek, None)
        
        # 3. 解密数据
        cipher = AESGCM(dek)
        return cipher.decrypt(nonce, ciphertext, context.encode())

class DataSanitizer:
    """数据脱敏"""
    
    def sanitize_log(self, log_entry: dict) -> dict:
        """脱敏日志条目"""
        sanitized = log_entry.copy()
        
        # 敏感字段列表
        sensitive_fields = [
            "private_key",
            "signature",
            "token",
            "password",
            "secret"
        ]
        
        for field in sensitive_fields:
            if field in sanitized:
                sanitized[field] = "***REDACTED***"
        
        # 脱敏 DID（保留前 8 位）
        if "did" in sanitized:
            did = sanitized["did"]
            sanitized["did"] = did[:20] + "..." if len(did) > 20 else did
        
        # 脱敏 IP 地址
        if "ip" in sanitized:
            ip = sanitized["ip"]
            parts = ip.split(".")
            if len(parts) == 4:
                sanitized["ip"] = f"{parts[0]}.{parts[1]}.xxx.xxx"
        
        return sanitized

class ChannelSecurity:
    """通道安全"""
    
    def validate_channel_open(self, request: ChannelOpenRequest) -> bool:
        """验证通道开启请求"""
        
        # 1. 验证保证金充足
        if request.deposit <= 0:
            return False
        
        # 2. 验证双方签名
        if not self._verify_signatures(request):
            return False
        
        # 3. 验证超时设置合理
        if request.timeout < 3600:  # 最少 1 小时
            return False
        
        return True
    
    def validate_receipt(self, receipt: MicroReceipt) -> bool:
        """验证收据"""
        
        # 1. 验证双方签名
        if not self._verify_receipt_signatures(receipt):
            return False
        
        # 2. 验证序号递增
        if not self._verify_sequence(receipt):
            return False
        
        # 3. 验证余额一致性
        if not self._verify_balance(receipt):
            return False
        
        return True

class BudgetSecurity:
    """预算安全"""
    
    def __init__(self, config: BudgetConfig):
        self.config = config
        self.usage = defaultdict(int)
        self.lock = threading.Lock()
    
    def check_and_deduct(self, did: str, amount: int) -> bool:
        """检查并扣除预算"""
        with self.lock:
            # 1. 检查单次限制
            if amount > self.config.max_per_call:
                return False
            
            # 2. 检查累计限制
            if self.usage[did] + amount > self.config.max_total:
                return False
            
            # 3. 扣除预算
            self.usage[did] += amount
            return True
    
    def detect_abuse(self, did: str) -> bool:
        """检测滥用"""
        usage_rate = self.usage[did] / self.config.max_total
        return usage_rate > 0.8  # 超过 80% 使用率

class DDoSProtection:
    """DDoS 防护"""
    
    def __init__(self, config: DDoSConfig):
        self.config = config
        self.request_counts = defaultdict(list)
    
    def check_rate_limit(self, client_id: str) -> bool:
        """检查速率限制"""
        now = time.time()
        
        # 清理过期记录
        self.request_counts[client_id] = [
            t for t in self.request_counts[client_id]
            if now - t < self.config.window_seconds
        ]
        
        # 检查是否超限
        if len(self.request_counts[client_id]) >= self.config.max_requests:
            return False
        
        # 记录请求
        self.request_counts[client_id].append(now)
        return True
    
    def detect_attack(self) -> bool:
        """检测攻击"""
        total_requests = sum(len(v) for v in self.request_counts.values())
        return total_requests > self.config.attack_threshold

class IntrusionDetection:
    """入侵检测"""
    
    def __init__(self):
        self.alerts = []
        self.thresholds = {
            "failed_auth": 10,  # 10 次失败认证
            "suspicious_pattern": 5,  # 5 次可疑模式
            "abnormal_traffic": 1000  # 1000 次/分钟异常流量
        }
    
    def detect_anomaly(self, event: dict) -> Optional[Alert]:
        """检测异常"""
        
        # 1. 检测认证失败
        if event.get("type") == "auth_failure":
            if self._count_recent_failures(event["source"]) > self.thresholds["failed_auth"]:
                return Alert(
                    level="high",
                    type="brute_force",
                    source=event["source"],
                    message="Potential brute force attack detected"
                )
        
        # 2. 检测可疑模式
        if self._detect_suspicious_pattern(event):
            return Alert(
                level="medium",
                type="suspicious_activity",
                source=event.get("source"),
                message="Suspicious activity pattern detected"
            )
        
        return None

class SecurityHealthCheck:
    """安全健康检查"""
    
    def run_checks(self) -> dict:
        """运行安全检查"""
        results = {}
        
        # 1. 检查 TLS 配置
        results["tls"] = self._check_tls_config()
        
        # 2. 检查密钥状态
        results["keys"] = self._check_key_status()
        
        # 3. 检查证书有效期
        results["certificates"] = self._check_certificates()
        
        # 4. 检查审计日志
        results["audit"] = self._check_audit_logs()
        
        # 5. 检查网络规则
        results["network"] = self._check_network_rules()
        
        return results
    
    def _check_tls_config(self) -> dict:
        """检查 TLS 配置"""
        return {
            "status": "healthy" if self._is_tls_13() else "warning",
            "version": self._get_tls_version(),
            "cipher_suites": self._get_cipher_suites()
        }