# Identity verification for every request
from fastapi import FastAPI, Depends, HTTPException
from jose import jwt, JWTError
import httpx

app = FastAPI()

async def verify_identity(token: str = Depends(oauth2_scheme)):
    try:
        # Verify JWT with identity provider
        payload = jwt.decode(
            token,
            key=get_signing_key(),
            algorithms=["RS256"],
            audience="api://myapp",
            issuer="https://identity.mycompany.com"
        )
        
        # Check token isn't revoked
        if await is_token_revoked(payload["jti"]):
            raise HTTPException(status_code=401, detail="Token revoked")
        
        # Verify user is still active
        user = await get_user(payload["sub"])
        if not user.is_active:
            raise HTTPException(status_code=401, detail="User deactivated")
        
        return user
        
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

# Attribute-based access control (ABAC)
from dataclasses import dataclass
from enum import Enum
from typing import List
import time

class Action(Enum):
    READ = "read"
    WRITE = "write"
    DELETE = "delete"
    ADMIN = "admin"

@dataclass
class AccessContext:
    user_id: str
    user_role: str
    user_department: str
    device_trust_score: float
    device_location: str
    request_time: int
    resource_sensitivity: str
    mfa_verified: bool

def evaluate_access(ctx: AccessContext, action: Action) -> bool:
    # Start with deny
    allowed = False
    
    # Basic role check
    if action == Action.ADMIN and ctx.user_role != "admin":
        return False
    
    # Device trust requirements scale with sensitivity
    trust_requirements = {
        "public": 0.0,
        "internal": 0.5,
        "confidential": 0.8,
        "restricted": 0.95
    }
    
    if ctx.device_trust_score < trust_requirements[ctx.resource_sensitivity]:
        return False
    
    # MFA required for sensitive resources
    if ctx.resource_sensitivity in ["confidential", "restricted"]:
        if not ctx.mfa_verified:
            return False
    
    # Location-based restrictions
    restricted_locations = ["CN", "RU", "KP"]
    if ctx.device_location in restricted_locations:
        if ctx.resource_sensitivity != "public":
            return False
    
    # Time-based restrictions (no admin access outside business hours)
    hour = time.localtime(ctx.request_time).tm_hour
    if action == Action.ADMIN and not (9 <= hour <= 18):
        return False
    
    return True

# Real-time risk scoring
from dataclasses import dataclass, field
from typing import List
import asyncio

@dataclass
class SessionRisk:
    session_id: str
    base_risk: float = 0.0
    risk_factors: List[str] = field(default_factory=list)
    
    @property
    def total_risk(self) -> float:
        factor_weights = {
            "unusual_location": 0.3,
            "new_device": 0.2,
            "off_hours": 0.1,
            "high_velocity": 0.4,
            "failed_mfa": 0.5,
            "impossible_travel": 0.8
        }
        return self.base_risk + sum(
            factor_weights.get(f, 0.1) for f in self.risk_factors
        )

class ContinuousAuthenticator:
    def __init__(self):
        self.sessions = {}
    
    async def evaluate_request(self, session_id: str, request) -> bool:
        risk = self.sessions.get(session_id, SessionRisk(session_id))
        
        # Check for impossible travel
        if self.is_impossible_travel(session_id, request.location):
            risk.risk_factors.append("impossible_travel")
        
        # Check request velocity
        if self.is_high_velocity(session_id):
            risk.risk_factors.append("high_velocity")
        
        # Evaluate total risk
        self.sessions[session_id] = risk
        
        if risk.total_risk > 0.7:
            await self.require_step_up_auth(session_id)
            return False
        
        if risk.total_risk > 0.9:
            await self.terminate_session(session_id)
            return False
        
        return True