┌─────────────────────────────────────────────────────────────┐
│                    External Threats                         │
└─────────────────┬───────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────┐
│         WAF & DDoS Protection (CloudFlare)                  │
└─────────────────┬───────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────┐
│            Load Balancer Security Groups                    │
└─────────────────┬───────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────┐
│         Application Security (TLS, Authentication)          │
└─────────────────┬───────────────────────────────────────────┘
                  │
┌─────────────────▼───────────────────────────────────────────┐
│              Database Encryption & Access Controls          │
└─────────────────────────────────────────────────────────────┘

vpc_security:
  network_segmentation:
    public_subnets:
      - purpose: "Load balancer and NAT gateways"
      - access: "Internet Gateway"
      - protection: "Security groups, NACLs"
    
    private_subnets:
      - purpose: "Application servers"
      - access: "NAT Gateway only"
      - protection: "Security groups, no direct internet"
    
    database_subnets:
      - purpose: "Database instances"
      - access: "Application subnets only"
      - protection: "Database security groups"

  security_groups:
    alb_security_group:
      ingress:
        - port: 443
          protocol: tcp
          source: 0.0.0.0/0
        - port: 80
          protocol: tcp
          source: 0.0.0.0/0
      egress:
        - port: 8000
          protocol: tcp
          target: application_security_group
    
    application_security_group:
      ingress:
        - port: 8000
          protocol: tcp
          source: alb_security_group
      egress:
        - port: 5432
          protocol: tcp
          target: database_security_group
        - port: 6379
          protocol: tcp
          target: redis_security_group
    
    database_security_group:
      ingress:
        - port: 5432
          protocol: tcp
          source: application_security_group
      egress: []

# Network ACL rules for additional security layer
NETWORK_ACL_RULES = {
    'private_subnet_nacl': {
        'inbound_rules': [
            {
                'rule_number': 100,
                'protocol': 'tcp',
                'port_range': '8000-8000',
                'cidr_block': '10.0.1.0/24',  # ALB subnet
                'action': 'allow'
            },
            {
                'rule_number': 200,
                'protocol': 'tcp',
                'port_range': '1024-65535',  # Ephemeral ports
                'cidr_block': '0.0.0.0/0',
                'action': 'allow'
            }
        ],
        'outbound_rules': [
            {
                'rule_number': 100,
                'protocol': 'tcp',
                'port_range': '5432-5432',
                'cidr_block': '10.0.20.0/24',  # Database subnet
                'action': 'allow'
            },
            {
                'rule_number': 200,
                'protocol': 'tcp',
                'port_range': '443-443',
                'cidr_block': '0.0.0.0/0',
                'action': 'allow'
            }
        ]
    }
}

class SecurityMiddleware:
    def __init__(self):
        self.rate_limiter = RateLimiter()
        self.jwt_validator = JWTValidator()
        
    def process_request(self, request):
        # Rate limiting
        if not self.rate_limiter.allow_request(request):
            return HttpResponse("Rate limit exceeded", status=429)
        
        # JWT validation
        if request.path.startswith('/api/'):
            if not self.jwt_validator.validate_token(request):
                return HttpResponse("Unauthorized", status=401)
        
        # CSRF protection
        if request.method in ['POST', 'PUT', 'DELETE']:
            if not self.validate_csrf_token(request):
                return HttpResponse("CSRF token invalid", status=403)
        
        return None

class JWTValidator:
    def __init__(self):
        self.secret_key = settings.JWT_SECRET_KEY
        self.algorithm = 'HS256'
        
    def validate_token(self, request):
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            return False
        
        token = auth_header.split(' ')[1]
        
        try:
            payload = jwt.decode(token, self.secret_key, algorithms=[self.algorithm])
            
            # Check token expiration
            if payload.get('exp', 0) < time.time():
                return False
            
            # Attach user to request
            user_id = payload.get('user_id')
            request.user = User.objects.get(id=user_id)
            
            return True
            
        except (jwt.InvalidTokenError, User.DoesNotExist):
            return False

class SecureSerializer(serializers.ModelSerializer):
    def validate(self, data):
        # XSS protection
        for field_name, value in data.items():
            if isinstance(value, str):
                data[field_name] = bleach.clean(
                    value,
                    tags=[],  # No HTML tags allowed
                    attributes={},
                    protocols=[],
                    strip=True
                )
        
        return super().validate(data)

class InputSanitizer:
    @staticmethod
    def sanitize_sql_input(query_string):
        """Prevent SQL injection attacks."""
        # Use parameterized queries only
        # Never use string formatting for SQL
        dangerous_patterns = [
            r"(\s*(union|select|insert|update|delete|drop|exec|execute)\s+)",
            r"(\s*(-{2}|#|\/\*|\*\/)\s*)",
            r"(\s*;\s*)"
        ]
        
        for pattern in dangerous_patterns:
            if re.search(pattern, query_string, re.IGNORECASE):
                raise ValidationError("Invalid input detected")
        
        return query_string
    
    @staticmethod
    def validate_file_upload(file):
        """Validate uploaded files for security."""
        # Check file size
        if file.size > settings.MAX_UPLOAD_SIZE:
            raise ValidationError("File too large")
        
        # Check file type
        allowed_types = ['pdf', 'doc', 'docx', 'jpg', 'png']
        file_extension = file.name.split('.')[-1].lower()
        
        if file_extension not in allowed_types:
            raise ValidationError("File type not allowed")
        
        # Scan file content
        magic_mime = magic.from_buffer(file.read(1024), mime=True)
        file.seek(0)  # Reset file pointer
        
        allowed_mimes = {
            'pdf': 'application/pdf',
            'doc': 'application/msword',
            'docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            'jpg': 'image/jpeg',
            'png': 'image/png'
        }
        
        if magic_mime not in allowed_mimes.values():
            raise ValidationError("File content does not match extension")
        
        return file

class EncryptionService:
    def __init__(self):
        self.key = settings.ENCRYPTION_KEY
        self.cipher_suite = Fernet(self.key)
        
    def encrypt_sensitive_data(self, data):
        """Encrypt sensitive data before storing in database."""
        if isinstance(data, str):
            data = data.encode('utf-8')
        
        encrypted_data = self.cipher_suite.encrypt(data)
        return base64.b64encode(encrypted_data).decode('utf-8')
    
    def decrypt_sensitive_data(self, encrypted_data):
        """Decrypt sensitive data after retrieving from database."""
        try:
            encrypted_bytes = base64.b64decode(encrypted_data.encode('utf-8'))
            decrypted_data = self.cipher_suite.decrypt(encrypted_bytes)
            return decrypted_data.decode('utf-8')
        except Exception as e:
            logger.error(f"Decryption failed: {e}")
            raise

# Database field encryption
class EncryptedTextField(models.TextField):
    def __init__(self, *args, **kwargs):
        self.encryption_service = EncryptionService()
        super().__init__(*args, **kwargs)
    
    def from_db_value(self, value, expression, connection):
        if value is None:
            return value
        return self.encryption_service.decrypt_sensitive_data(value)
    
    def to_python(self, value):
        if isinstance(value, str) or value is None:
            return value
        return self.encryption_service.decrypt_sensitive_data(value)
    
    def get_prep_value(self, value):
        if value is None:
            return value
        return self.encryption_service.encrypt_sensitive_data(value)

# Usage in models
class InterviewSession(models.Model):
    # Regular fields
    session_id = models.UUIDField(default=uuid.uuid4)
    
    # Encrypted sensitive data
    interviewer_notes = EncryptedTextField(blank=True, null=True)
    personal_feedback = EncryptedTextField(blank=True, null=True)

# TLS Configuration
tls_security:
  minimum_version: "TLSv1.2"
  preferred_version: "TLSv1.3"
  
  cipher_suites:
    - "TLS_AES_256_GCM_SHA384"
    - "TLS_CHACHA20_POLY1305_SHA256"
    - "TLS_AES_128_GCM_SHA256"
    - "ECDHE-RSA-AES256-GCM-SHA384"
    - "ECDHE-RSA-AES128-GCM-SHA256"
  
  ssl_certificate:
    provider: "AWS Certificate Manager"
    type: "RSA-2048"
    validation: "DNS"
    auto_renewal: true
  
  hsts_configuration:
    max_age: 31536000  # 1 year
    include_subdomains: true
    preload: true

class RoleBasedAccessControl:
    ROLES = {
        'candidate': {
            'permissions': [
                'view_own_interviews',
                'create_practice_sessions',
                'view_own_analytics',
                'update_own_profile'
            ]
        },
        'employer': {
            'permissions': [
                'view_company_interviews',
                'create_job_postings',
                'view_candidate_profiles',
                'access_analytics_dashboard',
                'manage_team_members'
            ]
        },
        'admin': {
            'permissions': [
                'view_all_data',
                'manage_users', 
                'access_system_metrics',
                'configure_platform_settings'
            ]
        }
    }
    
    def check_permission(self, user, permission):
        user_role = user.role
        role_permissions = self.ROLES.get(user_role, {}).get('permissions', [])
        
        return permission in role_permissions
    
    def require_permission(permission):
        def decorator(view_func):
            def wrapper(request, *args, **kwargs):
                rbac = RoleBasedAccessControl()
                
                if not rbac.check_permission(request.user, permission):
                    return HttpResponse("Forbidden", status=403)
                
                return view_func(request, *args, **kwargs)
            
            return wrapper
        return decorator

# Usage in views
@require_permission('view_company_interviews')
def company_interviews_view(request):
    # View implementation
    pass

class MFAService:
    def __init__(self):
        self.totp = pyotp.TOTP()
        
    def enable_2fa(self, user):
        """Enable 2FA for user account."""
        secret = pyotp.random_base32()
        
        # Store encrypted secret
        user.secret_key = EncryptionService().encrypt_sensitive_data(secret)
        user.enable_2fa = True
        user.save()
        
        # Generate QR code for authenticator app
        provisioning_uri = pyotp.totp.TOTP(secret).provisioning_uri(
            name=user.email,
            issuer_name="JobHive"
        )
        
        qr_code = qrcode.make(provisioning_uri)
        
        return {
            'secret': secret,
            'qr_code': qr_code,
            'backup_codes': self.generate_backup_codes(user)
        }
    
    def verify_2fa_token(self, user, token):
        """Verify 2FA token for user."""
        if not user.enable_2fa:
            return True
        
        decrypted_secret = EncryptionService().decrypt_sensitive_data(user.secret_key)
        totp = pyotp.TOTP(decrypted_secret)
        
        # Verify token with 30-second window
        return totp.verify(token, valid_window=1)
    
    def generate_backup_codes(self, user):
        """Generate backup codes for 2FA recovery."""
        backup_codes = []
        
        for _ in range(8):
            code = ''.join(secrets.choice(string.ascii_uppercase + string.digits) for _ in range(8))
            backup_codes.append(code)
            
            # Store hashed backup codes
            BackupCode.objects.create(
                user=user,
                code_hash=hashlib.sha256(code.encode()).hexdigest(),
                used=False
            )
        
        return backup_codes

class GDPRComplianceService:
    def __init__(self):
        self.legal_bases = {
            'consent': 'User has given clear consent',
            'contract': 'Processing necessary for contract performance',
            'legal_obligation': 'Processing required by law',
            'legitimate_interests': 'Legitimate business interests'
        }
    
    def record_consent(self, user, data_type, purpose):
        """Record user consent for data processing."""
        ConsentRecord.objects.create(
            user=user,
            data_type=data_type,
            purpose=purpose,
            legal_basis='consent',
            consent_given_at=timezone.now(),
            consent_method='explicit_checkbox',
            ip_address=self.get_client_ip(request),
            user_agent=request.META.get('HTTP_USER_AGENT', '')
        )
    
    def process_data_subject_request(self, user, request_type):
        """Handle GDPR data subject requests."""
        
        if request_type == 'access':
            return self.generate_data_export(user)
        
        elif request_type == 'rectification':
            return self.provide_data_correction_form(user)
        
        elif request_type == 'erasure':
            return self.initiate_data_deletion(user)
        
        elif request_type == 'portability':
            return self.generate_portable_data_export(user)
        
        elif request_type == 'restriction':
            return self.restrict_data_processing(user)
    
    def generate_data_export(self, user):
        """Generate comprehensive data export for user."""
        user_data = {
            'personal_information': {
                'email': user.email,
                'name': f"{user.first_name} {user.last_name}",
                'registration_date': user.date_joined.isoformat(),
                'last_login': user.last_login.isoformat() if user.last_login else None
            },
            'interview_data': [],
            'usage_data': [],
            'billing_data': []
        }
        
        # Interview sessions
        for interview in user.interviewsession_set.all():
            user_data['interview_data'].append({
                'session_id': str(interview.session_id),
                'date': interview.start_time.isoformat(),
                'duration': interview.duration,
                'scores': {
                    'technical': interview.technical_accuracy,
                    'behavioral': interview.behavioral_score
                }
            })
        
        # Usage records
        for usage in user.usage_records.all():
            user_data['usage_data'].append({
                'type': usage.usage_type,
                'quantity': usage.quantity,
                'date': usage.created_at.isoformat()
            })
        
        return user_data
    
    def initiate_data_deletion(self, user):
        """Initiate GDPR-compliant data deletion."""
        # Mark for deletion (don't delete immediately for audit trail)
        DeletionRequest.objects.create(
            user=user,
            requested_at=timezone.now(),
            status='pending',
            retention_period_end=timezone.now() + timedelta(days=30)
        )
        
        # Anonymize immediately identifiable data
        user.email = f"deleted_user_{user.id}@example.com"
        user.first_name = "Deleted"
        user.last_name = "User"
        user.is_active = False
        user.save()
        
        # Schedule complete deletion after retention period
        schedule_data_deletion.apply_async(
            args=[user.id],
            eta=timezone.now() + timedelta(days=30)
        )

class DataRetentionService:
    RETENTION_POLICIES = {
        'interview_recordings': timedelta(days=365),  # 1 year
        'user_analytics': timedelta(days=1095),       # 3 years
        'billing_records': timedelta(days=2555),      # 7 years (legal requirement)
        'audit_logs': timedelta(days=365),            # 1 year
        'error_logs': timedelta(days=90),             # 3 months
        'deleted_user_data': timedelta(days=30)       # 30 days grace period
    }
    
    def cleanup_expired_data(self):
        """Automated cleanup of expired data."""
        
        for data_type, retention_period in self.RETENTION_POLICIES.items():
            cutoff_date = timezone.now() - retention_period
            
            if data_type == 'interview_recordings':
                # Delete old video/audio files from S3
                self.cleanup_interview_recordings(cutoff_date)
            
            elif data_type == 'user_analytics':
                # Anonymize old analytics data
                self.anonymize_old_analytics(cutoff_date)
            
            elif data_type == 'audit_logs':
                # Delete old audit logs
                AuditLog.objects.filter(created_at__lt=cutoff_date).delete()
    
    def cleanup_interview_recordings(self, cutoff_date):
        """Remove old interview recordings from storage."""
        old_sessions = InterviewSession.objects.filter(
            start_time__lt=cutoff_date,
            recording_url__isnull=False
        )
        
        for session in old_sessions:
            # Delete from S3
            s3_client = boto3.client('s3')
            try:
                s3_client.delete_object(
                    Bucket=settings.AWS_STORAGE_BUCKET_NAME,
                    Key=session.recording_key
                )
                
                # Clear recording reference
                session.recording_url = None
                session.recording_key = None
                session.save()
                
            except ClientError as e:
                logger.error(f"Failed to delete recording: {e}")

class CCPAComplianceService:
    def handle_ccpa_request(self, user, request_type):
        """Handle CCPA consumer requests."""
        
        ccpa_request = CCPARequest.objects.create(
            user=user,
            request_type=request_type,
            status='pending',
            submitted_at=timezone.now()
        )
        
        if request_type == 'know':
            return self.provide_information_disclosure(user)
        
        elif request_type == 'delete':
            return self.process_deletion_request(user)
        
        elif request_type == 'opt_out':
            return self.opt_out_of_sale(user)
        
        return ccpa_request
    
    def provide_information_disclosure(self, user):
        """Provide CCPA-required information about data collection."""
        return {
            'categories_collected': [
                'Personal identifiers (name, email)',
                'Professional information (resume, skills)',
                'Audio/video recordings (interview sessions)',
                'Usage data (platform interactions)'
            ],
            'sources': [
                'Directly from user',
                'From user devices (cookies, logs)',
                'From third parties (OAuth providers)'
            ],
            'business_purposes': [
                'Providing interview services',
                'Improving AI algorithms',
                'Customer support',
                'Security and fraud prevention'
            ],
            'third_party_sharing': 'None - data is not sold',
            'retention_periods': dict(DataRetentionService.RETENTION_POLICIES)
        }

class SecurityMonitoringService:
    def __init__(self):
        self.alert_thresholds = {
            'failed_login_attempts': 5,
            'suspicious_api_calls': 10,
            'unusual_data_access': 3,
            'privilege_escalation_attempts': 1
        }
    
    def monitor_security_events(self):
        """Monitor for security events and anomalies."""
        
        # Failed login monitoring
        self.monitor_failed_logins()
        
        # API abuse detection
        self.detect_api_abuse()
        
        # Data access anomalies
        self.detect_unusual_data_access()
        
        # Privilege escalation attempts
        self.monitor_privilege_escalation()
    
    def monitor_failed_logins(self):
        """Monitor for suspicious login patterns."""
        
        # Check for repeated failed logins from same IP
        recent_failures = LoginAttempt.objects.filter(
            success=False,
            timestamp__gte=timezone.now() - timedelta(minutes=15)
        ).values('ip_address').annotate(
            failure_count=Count('id')
        ).filter(
            failure_count__gte=self.alert_thresholds['failed_login_attempts']
        )
        
        for failure_pattern in recent_failures:
            self.create_security_alert(
                alert_type='suspicious_login',
                severity='medium',
                details={
                    'ip_address': failure_pattern['ip_address'],
                    'failure_count': failure_pattern['failure_count'],
                    'time_window': '15 minutes'
                }
            )
            
            # Implement IP blocking
            self.block_ip_address(failure_pattern['ip_address'], duration=timedelta(hours=1))
    
    def create_security_alert(self, alert_type, severity, details):
        """Create security alert for investigation."""
        
        alert = SecurityAlert.objects.create(
            alert_type=alert_type,
            severity=severity,
            details=details,
            status='open',
            created_at=timezone.now()
        )
        
        # Send immediate notification for high severity
        if severity == 'high':
            self.send_security_notification(alert)
        
        return alert

class SecurityIncidentResponse:
    def __init__(self):
        self.response_team = [
            '[email protected]',
            '[email protected]',
            '[email protected]'
        ]
    
    def handle_security_incident(self, incident_type, severity, details):
        """Coordinate security incident response."""
        
        incident = SecurityIncident.objects.create(
            incident_type=incident_type,
            severity=severity,
            status='investigating',
            details=details,
            reported_at=timezone.now()
        )
        
        # Immediate response actions
        if severity == 'critical':
            self.execute_emergency_response(incident)
        
        # Notify response team
        self.notify_response_team(incident)
        
        # Begin containment procedures
        self.initiate_containment(incident)
        
        return incident
    
    def execute_emergency_response(self, incident):
        """Execute emergency response procedures."""
        
        # Potential actions based on incident type
        emergency_actions = {
            'data_breach': [
                'isolate_affected_systems',
                'preserve_forensic_evidence',
                'notify_legal_team',
                'prepare_breach_notification'
            ],
            'system_compromise': [
                'isolate_compromised_systems',
                'revoke_potentially_compromised_credentials',
                'activate_backup_systems',
                'preserve_audit_logs'
            ],
            'dos_attack': [
                'activate_ddos_mitigation',
                'scale_infrastructure',
                'block_malicious_traffic',
                'monitor_system_performance'
            ]
        }
        
        actions = emergency_actions.get(incident.incident_type, [])
        
        for action in actions:
            try:
                getattr(self, action)(incident)
                IncidentAction.objects.create(
                    incident=incident,
                    action=action,
                    status='completed',
                    executed_at=timezone.now()
                )
            except Exception as e:
                logger.error(f"Emergency action failed: {action} - {e}")

class VulnerabilityScanner:
    def __init__(self):
        self.scan_types = ['dependency', 'code', 'infrastructure', 'configuration']
    
    def run_security_scan(self, scan_type='all'):
        """Run comprehensive security scans."""
        
        results = {}
        
        if scan_type in ['all', 'dependency']:
            results['dependency'] = self.scan_dependencies()
        
        if scan_type in ['all', 'code']:
            results['code'] = self.scan_code_vulnerabilities()
        
        if scan_type in ['all', 'infrastructure']:
            results['infrastructure'] = self.scan_infrastructure()
        
        if scan_type in ['all', 'configuration']:
            results['configuration'] = self.scan_configuration()
        
        # Generate scan report
        scan_report = VulnerabilityScanReport.objects.create(
            scan_type=scan_type,
            results=results,
            scan_date=timezone.now(),
            severity_summary=self.calculate_severity_summary(results)
        )
        
        # Alert on critical vulnerabilities
        self.process_critical_vulnerabilities(results)
        
        return scan_report
    
    def scan_dependencies(self):
        """Scan for known vulnerabilities in dependencies."""
        # Using safety for Python dependencies
        vulnerabilities = []
        
        try:
            result = subprocess.run(
                ['safety', 'check', '--json'],
                capture_output=True,
                text=True
            )
            
            if result.stdout:
                safety_results = json.loads(result.stdout)
                
                for vuln in safety_results:
                    vulnerabilities.append({
                        'package': vuln['package_name'],
                        'version': vuln['analyzed_version'],
                        'vulnerability_id': vuln['vulnerability_id'],
                        'severity': vuln.get('severity', 'unknown'),
                        'description': vuln['vulnerability']
                    })
        
        except Exception as e:
            logger.error(f"Dependency scan failed: {e}")
        
        return vulnerabilities
    
    def scan_code_vulnerabilities(self):
        """Scan code for security vulnerabilities."""
        # Using bandit for Python code scanning
        vulnerabilities = []
        
        try:
            result = subprocess.run(
                ['bandit', '-r', '.', '-f', 'json'],
                capture_output=True,
                text=True
            )
            
            if result.stdout:
                bandit_results = json.loads(result.stdout)
                
                for issue in bandit_results.get('results', []):
                    vulnerabilities.append({
                        'file': issue['filename'],
                        'line': issue['line_number'],
                        'test_id': issue['test_id'],
                        'severity': issue['issue_severity'],
                        'confidence': issue['issue_confidence'],
                        'description': issue['issue_text']
                    })
        
        except Exception as e:
            logger.error(f"Code scan failed: {e}")
        
        return vulnerabilities

class SOC2ComplianceFramework:
    def __init__(self):
        self.trust_criteria = [
            'security',
            'availability', 
            'processing_integrity',
            'confidentiality',
            'privacy'
        ]
    
    def security_controls(self):
        """Implement SOC 2 security controls."""
        return {
            'access_controls': {
                'multi_factor_authentication': 'Implemented',
                'role_based_access': 'Implemented',
                'privileged_access_management': 'Implemented',
                'access_reviews': 'Quarterly'
            },
            'system_operations': {
                'change_management': 'Formal process implemented',
                'incident_response': 'Documented procedures',
                'vulnerability_management': 'Regular scanning and patching',
                'backup_and_recovery': 'Automated daily backups'
            },
            'risk_management': {
                'risk_assessment': 'Annual comprehensive assessment',
                'risk_mitigation': 'Documented mitigation strategies',
                'vendor_management': 'Security reviews for all vendors'
            }
        }
    
    def availability_controls(self):
        """Implement SOC 2 availability controls."""
        return {
            'system_monitoring': {
                'uptime_monitoring': '24/7 automated monitoring',
                'performance_monitoring': 'Real-time metrics',
                'capacity_planning': 'Quarterly capacity reviews'
            },
            'disaster_recovery': {
                'recovery_procedures': 'Documented and tested',
                'backup_strategy': 'Multi-region backup storage',
                'rto_rpo_targets': 'RTO: 4 hours, RPO: 15 minutes'
            }
        }
    
    def generate_compliance_report(self):
        """Generate SOC 2 compliance status report."""
        
        compliance_status = {}
        
        for criterion in self.trust_criteria:
            controls = getattr(self, f'{criterion}_controls')()
            compliance_status[criterion] = {
                'status': 'compliant',
                'controls': controls,
                'last_reviewed': timezone.now().date(),
                'next_review': timezone.now().date() + timedelta(days=90)
            }
        
        return compliance_status

class FERPACompliance:
    """Family Educational Rights and Privacy Act compliance for educational institutions."""
    
    def __init__(self):
        self.educational_record_types = [
            'academic_transcripts',
            'interview_assessments', 
            'skill_evaluations',
            'career_counseling_notes'
        ]
    
    def handle_educational_record(self, record_type, student_data, institution):
        """Handle educational records according to FERPA requirements."""
        
        # Verify institutional relationship
        if not self.verify_institutional_access(institution, student_data['student_id']):
            raise PermissionDenied("Institution does not have access to this student's records")
        
        # Log educational record access
        FERPAAccessLog.objects.create(
            student_id=student_data['student_id'],
            institution=institution,
            record_type=record_type,
            accessed_by=request.user,
            access_purpose='career_services',
            access_timestamp=timezone.now()
        )
        
        return self.format_educational_record(record_type, student_data)
    
    def handle_directory_information(self, student_data):
        """Handle directory information sharing according to FERPA."""
        
        # Check if student has opted out of directory information sharing
        if student_data.get('ferpa_directory_opt_out', False):
            return self.get_limited_directory_info(student_data)
        
        return self.get_full_directory_info(student_data)

class SecureSDLC:
    def __init__(self):
        self.security_gates = [
            'requirements_security_review',
            'design_security_review', 
            'code_security_scan',
            'penetration_testing',
            'security_acceptance_testing'
        ]
    
    def security_requirements_checklist(self):
        """Security requirements for new features."""
        return {
            'authentication': 'How will users be authenticated?',
            'authorization': 'What permissions are required?',
            'data_classification': 'What type of data will be processed?',
            'encryption': 'What data needs encryption?',
            'audit_logging': 'What events need to be logged?',
            'input_validation': 'What inputs need validation?',
            'error_handling': 'How will errors be handled securely?',
            'third_party_integrations': 'What security reviews are needed?'
        }
    
    def pre_deployment_security_checklist(self):
        """Security checklist before deployment."""
        checklist = [
            'security_scan_passed',
            'dependency_vulnerabilities_resolved',
            'secrets_properly_managed',
            'access_controls_verified',
            'encryption_properly_implemented',
            'logging_and_monitoring_configured',
            'backup_and_recovery_tested',
            'incident_response_procedures_updated'
        ]
        
        return {item: False for item in checklist}

class SecurityTrainingProgram:
    def __init__(self):
        self.training_modules = [
            'secure_coding_practices',
            'data_protection_fundamentals',
            'incident_response_procedures',
            'social_engineering_awareness',
            'gdpr_compliance_overview'
        ]
    
    def assign_security_training(self, employee, role):
        """Assign role-appropriate security training."""
        
        required_modules = self.get_required_modules(role)
        
        for module in required_modules:
            SecurityTrainingAssignment.objects.create(
                employee=employee,
                training_module=module,
                assigned_date=timezone.now(),
                due_date=timezone.now() + timedelta(days=30),
                status='assigned'
            )
    
    def track_training_completion(self):
        """Track and report on security training completion."""
        
        completion_stats = SecurityTrainingAssignment.objects.values(
            'training_module'
        ).annotate(
            total_assigned=Count('id'),
            completed=Count('id', filter=Q(status='completed')),
            overdue=Count('id', filter=Q(
                status='assigned',
                due_date__lt=timezone.now()
            ))
        )
        
        return completion_stats