import anthropic
import yaml
from pathlib import Path

client = anthropic.Anthropic()

def analyze_api_security(openapi_spec_path: str) -> str:
    spec = yaml.safe_load(Path(openapi_spec_path).read_text())

    # Extract endpoints for analysis
    endpoints = []
    for path, methods in spec.get('paths', {}).items():
        for method, details in methods.items():
            if method in ('get', 'post', 'put', 'patch', 'delete'):
                endpoints.append({
                    'method': method.upper(),
                    'path': path,
                    'parameters': details.get('parameters', []),
                    'requestBody': details.get('requestBody', {}),
                    'security': details.get('security', spec.get('security', [])),
                    'description': details.get('description', '')
                })

    response = client.messages.create(
        model='claude-sonnet-4-5',
        max_tokens=3000,
        messages=[{
            'role': 'user',
            'content': f"""You are an API security auditor. Analyze these API endpoints for security vulnerabilities.

API Specification Summary:
- Base URL: {spec.get('servers', [{}])[0].get('url', 'unknown')}
- Authentication: {spec.get('components', {}).get('securitySchemes', {})}

Endpoints ({len(endpoints)} total):
{yaml.dump(endpoints[:30], default_flow_style=False)}

For each finding, provide:
1. Vulnerability type (OWASP API Top 10 category if applicable)
2. Affected endpoint(s)
3. Specific attack scenario
4. Test case to verify the vulnerability exists
5. Recommended fix

Focus on: broken object-level auth, missing rate limits, excessive data exposure,
broken function-level auth, and mass assignment vulnerabilities."""
        }]
    )

    return response.content[0].text

# Run analysis
findings = analyze_api_security('./api/openapi.yaml')
print(findings)

def generate_security_tests(endpoint: dict, framework: str = 'pytest') -> str:
    """Generate security test cases for a specific API endpoint."""

    response = client.messages.create(
        model='claude-sonnet-4-5',
        max_tokens=2048,
        messages=[{
            'role': 'user',
            'content': f"""Generate {framework} security test cases for this API endpoint.

Endpoint: {endpoint['method']} {endpoint['path']}
Description: {endpoint.get('description', 'No description')}
Parameters: {endpoint.get('parameters', [])}
Auth required: {bool(endpoint.get('security'))}

Generate tests for:
1. Authentication bypass attempts
2. Authorization violations (accessing other users' resources)
3. Input validation (SQL injection, XSS, path traversal)
4. Rate limiting verification
5. Mass assignment (sending unexpected fields)

Use realistic test data. Mark tests that require a valid auth token with a fixture."""
        }]
    )

    return response.content[0].text

# Example: Generate tests for a user profile endpoint
endpoint = {
    'method': 'GET',
    'path': '/api/users/{userId}/profile',
    'description': 'Get user profile by ID',
    'parameters': [{'name': 'userId', 'in': 'path', 'required': True}],
    'security': [{'bearerAuth': []}]
}

tests = generate_security_tests(endpoint)

import pytest
import requests

BASE_URL = "http://localhost:8000"

@pytest.fixture
def auth_headers(test_user_token):
    return {"Authorization": f"Bearer {test_user_token}"}

@pytest.fixture
def other_user_id(db):
    """Create a second user to test cross-user access."""
    user = db.users.create(email="other@test.com", password="password")
    return str(user.id)

class TestUserProfileSecurity:

    def test_requires_authentication(self):
        """Should return 401 without auth token."""
        response = requests.get(f"{BASE_URL}/api/users/any-id/profile")
        assert response.status_code == 401

    def test_cannot_access_other_user_profile(self, auth_headers, other_user_id):
        """Should return 403 when accessing another user's profile."""
        response = requests.get(
            f"{BASE_URL}/api/users/{other_user_id}/profile",
            headers=auth_headers
        )
        assert response.status_code == 403

    def test_invalid_token_rejected(self):
        """Should reject malformed JWT tokens."""
        test_tokens = [
            "invalid.token.here",
            "Bearer ",
            "eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.",  # None algorithm
            "A" * 500,  # Very long token
        ]
        for token in test_tokens:
            response = requests.get(
                f"{BASE_URL}/api/users/1/profile",
                headers={"Authorization": f"Bearer {token}"}
            )
            assert response.status_code in (401, 422), f"Token {token[:20]}... was accepted"

    def test_path_traversal_in_user_id(self, auth_headers):
        """Should not expose data through path traversal."""
        traversal_attempts = [
            "../admin",
            "..%2F..%2Fadmin",
            "1; DROP TABLE users--",
            "' OR '1'='1",
        ]
        for attempt in traversal_attempts:
            response = requests.get(
                f"{BASE_URL}/api/users/{attempt}/profile",
                headers=auth_headers
            )
            assert response.status_code in (400, 404, 422), \
                f"Traversal attempt '{attempt}' returned unexpected status"

import anthropic
import httpx
import json

def ai_fuzz_endpoint(
    method: str,
    url: str,
    schema: dict,
    auth_token: str,
    num_cases: int = 20
) -> list[dict]:
    """Generate and test fuzzing cases using AI."""

    # Ask Claude for interesting edge cases given the schema
    client = anthropic.Anthropic()
    response = client.messages.create(
        model='claude-haiku-4-5',
        max_tokens=1024,
        messages=[{
            'role': 'user',
            'content': f"""Generate {num_cases} interesting test payloads for fuzzing this API endpoint.
Focus on: boundary values, type confusion, unexpected types, XSS payloads, SQL injection.

Schema:
{json.dumps(schema, indent=2)}

Return JSON array of test payloads only, no explanation."""
        }]
    )

    try:
        payloads = json.loads(response.content[0].text)
    except json.JSONDecodeError:
        return []

    results = []
    for payload in payloads:
        resp = httpx.request(
            method,
            url,
            json=payload,
            headers={"Authorization": f"Bearer {auth_token}"},
            timeout=5.0
        )
        results.append({
            'payload': payload,
            'status': resp.status_code,
            'suspicious': resp.status_code == 500,  # 500s indicate potential bugs
            'response_size': len(resp.content)
        })

    return results

# Flag suspicious responses for manual review
fuzz_results = ai_fuzz_endpoint(
    'POST', '/api/orders',
    schema={"userId": "string", "items": "array", "couponCode": "string"},
    auth_token="your_test_token"
)

for result in fuzz_results:
    if result['suspicious']:
        print(f"SUSPICIOUS: {result['payload']} -> {result['status']}")