#!/usr/bin/env python3
"""Agent for assessing identity verification controls in zero trust architecture."""

import json
import argparse
from datetime import datetime
from collections import Counter


CISA_ZT_IDENTITY_LEVELS = {
    "traditional": {
        "description": "Password-based auth, static policies",
        "score": 1,
    },
    "initial": {
        "description": "MFA deployed, basic conditional access",
        "score": 2,
    },
    "advanced": {
        "description": "Phishing-resistant MFA, risk-based access",
        "score": 3,
    },
    "optimal": {
        "description": "Continuous verification, passwordless, behavioral analytics",
        "score": 4,
    },
}


def assess_authentication_methods(auth_config):
    """Assess authentication method strength against zero trust requirements."""
    findings = []
    methods = auth_config.get("methods", auth_config.get("authentication", {}))

    if isinstance(methods, dict):
        mfa_enabled = methods.get("mfa_enabled", False)
        phishing_resistant = methods.get("phishing_resistant_mfa", False)
        passwordless = methods.get("passwordless", False)
        fido2 = methods.get("fido2_enabled", False)
        sso = methods.get("sso_enabled", False)

        if not mfa_enabled:
            findings.append({"control": "MFA", "status": "MISSING",
                             "severity": "CRITICAL"})
        elif not phishing_resistant:
            findings.append({"control": "Phishing-resistant MFA", "status": "MISSING",
                             "severity": "HIGH",
                             "recommendation": "Deploy FIDO2 or certificate-based auth"})

        if not fido2:
            findings.append({"control": "FIDO2/WebAuthn", "status": "NOT_DEPLOYED",
                             "severity": "MEDIUM"})
        if not passwordless:
            findings.append({"control": "Passwordless authentication",
                             "status": "NOT_DEPLOYED", "severity": "MEDIUM"})
        if not sso:
            findings.append({"control": "SSO", "status": "NOT_DEPLOYED",
                             "severity": "HIGH"})
    return findings


def assess_conditional_access(policies_path):
    """Assess conditional access policies for zero trust alignment."""
    with open(policies_path) as f:
        policies = json.load(f)
    items = policies if isinstance(policies, list) else policies.get("policies", [])
    findings = []
    required_signals = ["device_compliance", "location", "risk_level",
                        "application", "user_group"]
    covered_signals = set()

    for policy in items:
        conditions = policy.get("conditions", {})
        for signal in required_signals:
            if conditions.get(signal) or signal in str(conditions):
                covered_signals.add(signal)
        if policy.get("grant_controls", {}).get("operator") == "OR":
            findings.append({
                "policy": policy.get("name", ""),
                "issue": "Grant controls use OR (should be AND)",
                "severity": "HIGH",
            })
        if not policy.get("state", "").lower() in ("enabled", "on"):
            findings.append({
                "policy": policy.get("name", ""),
                "issue": "Policy not enabled",
                "severity": "MEDIUM",
            })

    missing = set(required_signals) - covered_signals
    for signal in missing:
        findings.append({
            "control": f"Conditional access signal: {signal}",
            "status": "NOT_COVERED",
            "severity": "HIGH",
        })
    return {"findings": findings, "covered_signals": list(covered_signals),
            "missing_signals": list(missing)}


def assess_identity_maturity(config):
    """Assess identity pillar maturity against CISA Zero Trust Maturity Model."""
    scores = {}
    categories = {
        "authentication": {
            "checks": ["mfa_enforced", "phishing_resistant_mfa", "passwordless",
                        "continuous_auth"],
        },
        "identity_stores": {
            "checks": ["centralized_idp", "cloud_identity", "directory_sync",
                        "identity_federation"],
        },
        "risk_assessment": {
            "checks": ["risk_based_access", "behavioral_analytics",
                        "impossible_travel_detection", "session_risk_scoring"],
        },
        "visibility": {
            "checks": ["identity_audit_logging", "real_time_monitoring",
                        "identity_analytics_dashboard", "automated_anomaly_detection"],
        },
    }

    for category, info in categories.items():
        implemented = sum(1 for check in info["checks"]
                          if config.get(category, {}).get(check, False))
        total = len(info["checks"])
        ratio = implemented / total if total else 0
        if ratio >= 0.9:
            level = "optimal"
        elif ratio >= 0.6:
            level = "advanced"
        elif ratio >= 0.3:
            level = "initial"
        else:
            level = "traditional"
        scores[category] = {
            "implemented": implemented,
            "total": total,
            "ratio": round(ratio, 2),
            "maturity_level": level,
            "score": CISA_ZT_IDENTITY_LEVELS[level]["score"],
        }

    avg_score = sum(s["score"] for s in scores.values()) / len(scores) if scores else 0
    for level_name, level_info in CISA_ZT_IDENTITY_LEVELS.items():
        if level_info["score"] >= avg_score:
            overall_level = level_name
            break
    else:
        overall_level = "traditional"

    return {"categories": scores, "overall_score": round(avg_score, 1),
            "overall_level": overall_level}


def analyze_auth_events(events_path):
    """Analyze authentication events for zero trust insights."""
    with open(events_path) as f:
        events = json.load(f)
    items = events if isinstance(events, list) else events.get("events", [])

    by_method = Counter(e.get("auth_method", "unknown") for e in items)
    by_result = Counter(e.get("result", "unknown") for e in items)
    risky = [e for e in items if e.get("risk_level", "").lower() in ("high", "critical")]
    mfa_bypassed = [e for e in items if e.get("mfa_bypassed", False)]

    return {
        "total_events": len(items),
        "by_method": dict(by_method),
        "by_result": dict(by_result),
        "high_risk_events": len(risky),
        "mfa_bypass_events": len(mfa_bypassed),
        "password_only_rate": round(
            by_method.get("password", 0) / len(items) * 100, 1) if items else 0,
    }


def main():
    parser = argparse.ArgumentParser(description="Zero Trust Identity Verification Agent")
    parser.add_argument("--auth-config", help="Authentication config JSON")
    parser.add_argument("--policies", help="Conditional access policies JSON")
    parser.add_argument("--maturity-config", help="Identity maturity assessment config JSON")
    parser.add_argument("--auth-events", help="Authentication events log JSON")
    parser.add_argument("--action", choices=["auth", "policies", "maturity", "events", "full"],
                        default="full")
    parser.add_argument("--output", default="zt_identity_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "results": {}}

    if args.action in ("auth", "full") and args.auth_config:
        with open(args.auth_config) as f:
            config = json.load(f)
        findings = assess_authentication_methods(config)
        report["results"]["auth_assessment"] = findings
        critical = sum(1 for f in findings if f.get("severity") == "CRITICAL")
        print(f"[+] Auth findings: {len(findings)}, {critical} critical")

    if args.action in ("policies", "full") and args.policies:
        result = assess_conditional_access(args.policies)
        report["results"]["conditional_access"] = result
        print(f"[+] Missing signals: {result['missing_signals']}")

    if args.action in ("maturity", "full") and args.maturity_config:
        with open(args.maturity_config) as f:
            config = json.load(f)
        result = assess_identity_maturity(config)
        report["results"]["maturity"] = result
        print(f"[+] Identity maturity: {result['overall_level']} (score: {result['overall_score']})")

    if args.action in ("events", "full") and args.auth_events:
        result = analyze_auth_events(args.auth_events)
        report["results"]["events"] = result
        print(f"[+] Auth events: {result['total_events']}, password-only: {result['password_only_rate']}%")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Identity Verification Assessment Tool for Zero Trust

Analyzes identity configurations, evaluates MFA strength, assesses
conditional access policies, and generates identity maturity reports.
"""

import json
import csv
import sys
from datetime import datetime, timedelta
from pathlib import Path
from collections import defaultdict
from typing import Optional


def assess_mfa_strength(mfa_config: dict) -> dict:
    """Evaluate MFA configuration against zero trust requirements."""
    findings = []
    score = 100

    methods = mfa_config.get("enabled_methods", [])
    phishing_resistant = {"fido2", "webauthn", "certificate", "windows_hello", "platform_authenticator"}
    phishable = {"sms", "voice", "email_otp"}
    moderate = {"totp", "push_notification", "authenticator_app"}

    enabled_phishing_resistant = set(methods) & phishing_resistant
    enabled_phishable = set(methods) & phishable

    if not enabled_phishing_resistant:
        findings.append({
            "severity": "critical",
            "finding": "No phishing-resistant MFA methods enabled",
            "recommendation": "Deploy FIDO2 security keys or platform authenticators",
            "reference": "NIST SP 800-63B AAL3, CISA ZT Identity Pillar (Advanced)"
        })
        score -= 40

    if enabled_phishable:
        findings.append({
            "severity": "high",
            "finding": f"Phishable MFA methods still enabled: {', '.join(enabled_phishable)}",
            "recommendation": "Disable SMS, voice, and email OTP methods",
            "reference": "CISA Phishing-Resistant MFA Guidance"
        })
        score -= 20

    if not mfa_config.get("enforced_for_all_users"):
        findings.append({
            "severity": "critical",
            "finding": "MFA not enforced for all users",
            "recommendation": "Enable MFA requirement for all user accounts",
            "reference": "CISA ZT Identity Pillar (Initial)"
        })
        score -= 30

    if not mfa_config.get("number_matching_enabled") and "push_notification" in methods:
        findings.append({
            "severity": "high",
            "finding": "Push notification MFA without number matching",
            "recommendation": "Enable number matching to prevent MFA fatigue attacks",
            "reference": "Microsoft MFA fatigue defense guidance"
        })
        score -= 10

    enrollment_rate = mfa_config.get("enrollment_rate_percent", 0)
    if enrollment_rate < 95:
        findings.append({
            "severity": "warning",
            "finding": f"MFA enrollment rate is {enrollment_rate}% (target: 95%+)",
            "recommendation": "Launch enrollment campaign for remaining users",
            "reference": "CISA ZT Identity Pillar (Advanced)"
        })
        score -= 10

    return {
        "mfa_score": max(score, 0),
        "phishing_resistant_methods": list(enabled_phishing_resistant),
        "phishable_methods": list(enabled_phishable),
        "findings": findings,
        "maturity_level": (
            "optimal" if score >= 90 else
            "advanced" if score >= 70 else
            "initial" if score >= 50 else
            "traditional"
        )
    }


def assess_conditional_access(policies: list) -> dict:
    """Evaluate conditional access policies for zero trust alignment."""
    findings = []
    coverage = {
        "legacy_auth_blocked": False,
        "mfa_required_all": False,
        "device_compliance_required": False,
        "location_restrictions": False,
        "session_controls": False,
        "risk_based_policies": False,
        "privileged_access_secured": False,
    }

    for policy in policies:
        conditions = policy.get("conditions", {})
        grant_controls = policy.get("grant_controls", {})
        session_controls = policy.get("session_controls", {})

        if policy.get("blocks_legacy_auth"):
            coverage["legacy_auth_blocked"] = True

        if grant_controls.get("require_mfa") and conditions.get("users") == "all":
            coverage["mfa_required_all"] = True

        if grant_controls.get("require_compliant_device"):
            coverage["device_compliance_required"] = True

        if conditions.get("locations") and conditions["locations"].get("excluded_trusted"):
            coverage["location_restrictions"] = True

        if session_controls.get("sign_in_frequency") or session_controls.get("persistent_browser"):
            coverage["session_controls"] = True

        if conditions.get("user_risk") or conditions.get("sign_in_risk"):
            coverage["risk_based_policies"] = True

        if conditions.get("roles") and "privileged" in str(conditions.get("roles", [])).lower():
            coverage["privileged_access_secured"] = True

    if not coverage["legacy_auth_blocked"]:
        findings.append({
            "severity": "critical",
            "finding": "Legacy authentication protocols not blocked",
            "recommendation": "Create policy blocking basic auth, IMAP, POP3, SMTP AUTH",
        })

    if not coverage["mfa_required_all"]:
        findings.append({
            "severity": "critical",
            "finding": "MFA not required for all users",
            "recommendation": "Create policy requiring MFA for all user sign-ins",
        })

    if not coverage["device_compliance_required"]:
        findings.append({
            "severity": "high",
            "finding": "Device compliance not required for access",
            "recommendation": "Require managed and compliant devices for sensitive apps",
        })

    if not coverage["risk_based_policies"]:
        findings.append({
            "severity": "high",
            "finding": "No risk-based conditional access policies",
            "recommendation": "Enable user risk and sign-in risk based policies",
        })

    if not coverage["session_controls"]:
        findings.append({
            "severity": "warning",
            "finding": "No session lifetime controls configured",
            "recommendation": "Configure sign-in frequency and browser session persistence",
        })

    covered = sum(1 for v in coverage.values() if v)
    total = len(coverage)

    return {
        "coverage": coverage,
        "coverage_score": round((covered / total) * 100),
        "policies_evaluated": len(policies),
        "findings": findings,
    }


def analyze_sign_in_logs(logs: list) -> dict:
    """Analyze sign-in logs for identity security insights."""
    stats = {
        "total_sign_ins": len(logs),
        "successful": 0,
        "failed": 0,
        "mfa_challenged": 0,
        "risk_events": [],
        "locations": defaultdict(int),
        "devices": defaultdict(int),
        "applications": defaultdict(int),
        "auth_methods": defaultdict(int),
        "risky_sign_ins": [],
    }

    for log in logs:
        if log.get("status") == "success":
            stats["successful"] += 1
        else:
            stats["failed"] += 1

        if log.get("mfa_required"):
            stats["mfa_challenged"] += 1

        location = log.get("location", {}).get("country", "unknown")
        stats["locations"][location] += 1

        device = log.get("device", {}).get("os", "unknown")
        stats["devices"][device] += 1

        app = log.get("application", "unknown")
        stats["applications"][app] += 1

        method = log.get("auth_method", "password")
        stats["auth_methods"][method] += 1

        risk_level = log.get("risk_level", "none")
        if risk_level in ("medium", "high"):
            stats["risky_sign_ins"].append({
                "user": log.get("user", "unknown"),
                "risk_level": risk_level,
                "risk_detail": log.get("risk_detail", ""),
                "location": location,
                "timestamp": log.get("timestamp", ""),
                "application": app,
            })

    stats["locations"] = dict(stats["locations"])
    stats["devices"] = dict(stats["devices"])
    stats["applications"] = dict(stats["applications"])
    stats["auth_methods"] = dict(stats["auth_methods"])
    stats["mfa_coverage_percent"] = round(
        (stats["mfa_challenged"] / max(stats["total_sign_ins"], 1)) * 100, 1
    )

    return stats


def detect_impossible_travel(sign_ins: list, max_speed_kmh: int = 900) -> list:
    """Detect impossible travel scenarios from sign-in logs."""
    alerts = []
    user_logins = defaultdict(list)

    for si in sign_ins:
        user = si.get("user", "")
        if user and si.get("location", {}).get("latitude"):
            user_logins[user].append(si)

    for user, logins in user_logins.items():
        sorted_logins = sorted(logins, key=lambda x: x.get("timestamp", ""))

        for i in range(1, len(sorted_logins)):
            prev = sorted_logins[i - 1]
            curr = sorted_logins[i]

            lat1 = prev["location"].get("latitude", 0)
            lon1 = prev["location"].get("longitude", 0)
            lat2 = curr["location"].get("latitude", 0)
            lon2 = curr["location"].get("longitude", 0)

            import math
            R = 6371
            dlat = math.radians(lat2 - lat1)
            dlon = math.radians(lon2 - lon1)
            a = (math.sin(dlat / 2) ** 2 +
                 math.cos(math.radians(lat1)) * math.cos(math.radians(lat2)) *
                 math.sin(dlon / 2) ** 2)
            c = 2 * math.atan2(math.sqrt(a), math.sqrt(1 - a))
            distance_km = R * c

            try:
                t1 = datetime.fromisoformat(prev.get("timestamp", "").replace("Z", "+00:00"))
                t2 = datetime.fromisoformat(curr.get("timestamp", "").replace("Z", "+00:00"))
                time_diff_hours = (t2 - t1).total_seconds() / 3600
            except (ValueError, TypeError):
                continue

            if time_diff_hours > 0:
                required_speed = distance_km / time_diff_hours
                if required_speed > max_speed_kmh and distance_km > 100:
                    alerts.append({
                        "user": user,
                        "severity": "high",
                        "type": "impossible_travel",
                        "from_location": prev["location"],
                        "to_location": curr["location"],
                        "distance_km": round(distance_km),
                        "time_diff_hours": round(time_diff_hours, 2),
                        "required_speed_kmh": round(required_speed),
                        "from_time": prev.get("timestamp"),
                        "to_time": curr.get("timestamp"),
                    })

    return alerts


def generate_identity_maturity_report(config: dict) -> dict:
    """Generate a comprehensive identity maturity assessment."""
    report = {
        "generated": datetime.now().isoformat(),
        "overall_maturity": "traditional",
        "pillars": {},
    }

    mfa_assessment = assess_mfa_strength(config.get("mfa", {}))
    report["pillars"]["mfa"] = mfa_assessment

    ca_assessment = assess_conditional_access(config.get("conditional_access_policies", []))
    report["pillars"]["conditional_access"] = ca_assessment

    governance = config.get("governance", {})
    gov_score = 0
    if governance.get("automated_provisioning"): gov_score += 25
    if governance.get("access_reviews_enabled"): gov_score += 25
    if governance.get("jit_access_enabled"): gov_score += 25
    if governance.get("lifecycle_automation"): gov_score += 25
    report["pillars"]["governance"] = {"score": gov_score}

    monitoring = config.get("monitoring", {})
    mon_score = 0
    if monitoring.get("siem_integration"): mon_score += 25
    if monitoring.get("ueba_enabled"): mon_score += 25
    if monitoring.get("identity_threat_detection"): mon_score += 25
    if monitoring.get("cae_enabled"): mon_score += 25
    report["pillars"]["monitoring"] = {"score": mon_score}

    avg_score = (
        mfa_assessment["mfa_score"] +
        ca_assessment["coverage_score"] +
        gov_score +
        mon_score
    ) / 4

    report["overall_score"] = round(avg_score)
    report["overall_maturity"] = (
        "optimal" if avg_score >= 90 else
        "advanced" if avg_score >= 70 else
        "initial" if avg_score >= 50 else
        "traditional"
    )

    return report


def main():
    import argparse
    parser = argparse.ArgumentParser(description="Identity Verification Assessment Tool")
    parser.add_argument("--config", type=str, help="Path to identity configuration JSON")
    parser.add_argument("--logs", type=str, help="Path to sign-in logs JSON")
    parser.add_argument("--action", choices=["assess", "analyze-logs", "detect-travel", "report"],
                        default="report")
    parser.add_argument("--output", type=str, default="identity_report.json")
    args = parser.parse_args()

    if args.action == "assess" and args.config:
        with open(args.config) as f:
            config = json.load(f)
        mfa_result = assess_mfa_strength(config.get("mfa", {}))
        ca_result = assess_conditional_access(config.get("conditional_access_policies", []))
        result = {"mfa": mfa_result, "conditional_access": ca_result}
        with open(args.output, "w") as f:
            json.dump(result, f, indent=2)
        print(f"MFA Score: {mfa_result['mfa_score']}, CA Coverage: {ca_result['coverage_score']}%")

    elif args.action == "analyze-logs" and args.logs:
        with open(args.logs) as f:
            logs = json.load(f)
        stats = analyze_sign_in_logs(logs)
        with open(args.output, "w") as f:
            json.dump(stats, f, indent=2)
        print(f"Analyzed {stats['total_sign_ins']} sign-ins, {len(stats['risky_sign_ins'])} risky")

    elif args.action == "detect-travel" and args.logs:
        with open(args.logs) as f:
            logs = json.load(f)
        alerts = detect_impossible_travel(logs)
        with open(args.output, "w") as f:
            json.dump(alerts, f, indent=2)
        print(f"Detected {len(alerts)} impossible travel events")

    elif args.action == "report" and args.config:
        with open(args.config) as f:
            config = json.load(f)
        report = generate_identity_maturity_report(config)
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"Identity Maturity: {report['overall_maturity']} (Score: {report['overall_score']})")

    else:
        parser.print_help()

    if args.output and Path(args.output).exists():
        print(f"Output saved to {args.output}")


if __name__ == "__main__":
    main()