# Install necessary libraries. For this demonstration, we'll primarily use built-in modules.
# If interacting with cloud providers or specific services, their respective SDKs would be installed here.
# For example: !pip install google-cloud-secret-manager boto3 azure-keyvault

# !pip install requests  # Example if making HTTP calls

import os
import time
import random
import logging
from collections import deque
from datetime import datetime, timedelta

# Configure logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

# Example of third-party library imports (if applicable)
# import requests
# import pandas as pd
# import numpy as np
# import matplotlib.pyplot as plt
# import seaborn as sns

def create_initial_state(key_names: list[str], rotation_interval_hours: int = 720) -> dict:
    """
    Initializes the system state for API key management.

    Parameters
    ----------
    key_names : list[str]
        A list of identifiers for the API keys to be managed.
    rotation_interval_hours : int, optional
        The desired interval (in hours) for key rotation, defaults to 720 hours (30 days).

    Returns
    -------
    dict
        An initialized state dictionary.
    """
    state = {
        "api_keys": {},
        "rotation_schedule": {},
        "key_history": {},
        "metrics": {
            "rotation_attempts": 0,
            "rotation_successes": 0,
            "rotation_failures": 0,
            "last_rotation_times": {},
            "next_rotation_times": {}
        }
    }

    for name in key_names:
        state["api_keys"][name] = {
            "current_key_value": f"initial_key_{name}_secret", # Placeholder
            "status": "active",
            "created_at": datetime.now(),
            "last_rotated_at": datetime.now()
        }
        state["rotation_schedule"][name] = {
            "interval_hours": rotation_interval_hours,
            "next_rotation_due": datetime.now() + timedelta(hours=rotation_interval_hours)
        }
        state["key_history"][name] = deque([{
            "key_value": state["api_keys"][name]["current_key_value"],
            "created_at": state["api_keys"][name]["created_at"],
            "status": "active"
        }])
        state["metrics"]["last_rotation_times"][name] = datetime.now()
        state["metrics"]["next_rotation_times"][name] = state["rotation_schedule"][name]["next_rotation_due"]
        logger.info(f"Initialized state for API key: {name} with next rotation due: {state['rotation_schedule'][name]['next_rotation_due']}")

    return state

def generate_new_api_key(key_name: str) -> str:
    """
    Simulates the generation of a new API key.

    In a real application, this would interact with a secrets management service
    or an identity provider to securely create a new key.

    Parameters
    ----------
    key_name : str
        The identifier of the API key for which a new value is being generated.

    Returns
    -------
    str
        A newly generated API key string.
    """
    # Simulate a delay for key generation, with random jitter
    time.sleep(0.1 + random.uniform(0, 0.05))
    new_key = f"sk-gen_{key_name}_{os.urandom(16).hex()}"
    logger.info(f"Successfully generated new API key for {key_name}.")
    return new_key

def deploy_new_api_key(state: dict, key_name: str, new_key_value: str) -> dict:
    """
    Simulates the deployment of a new API key and updates the system state.

    This function marks the current key as 'deprecated' (or 'inactive') and sets
    the new key as 'active'. It also updates the key history.

    Parameters
    ----------
    state : dict
        The current state dictionary.
    key_name : str
        The identifier of the API key being deployed.
    new_key_value : str
        The newly generated API key string.

    Returns
    -------
    dict
        The updated state dictionary.
    """
    if key_name not in state["api_keys"]:
        logger.warning(f"Attempted to deploy key for unknown key_name: {key_name}")
        return state

    # Mark the old key in history as deprecated
    if state["key_history"][key_name]:
        old_key_entry = state["key_history"][key_name][-1]
        old_key_entry["status"] = "deprecated"
        old_key_entry["deprecated_at"] = datetime.now()
        logger.info(f"Marked old key for {key_name} as deprecated.")

    # Update the current key in api_keys
    state["api_keys"][key_name]["current_key_value"] = new_key_value
    state["api_keys"][key_name]["last_rotated_at"] = datetime.now()
    state["api_keys"][key_name]["status"] = "active"
    logger.info(f"Updated current key for {key_name} to new value.")

    # Add the new key to history
    new_key_entry = {
        "key_value": new_key_value,
        "created_at": datetime.now(),
        "status": "active"
    }
    state["key_history"][key_name].append(new_key_entry)

    logger.info(f"Deployed new API key for {key_name} and updated history.")
    return state

def deactivate_old_api_key(state: dict, key_name: str, old_key_value: str) -> dict:
    """
    Simulates the deactivation or revocation of an old API key.

    This function iterates through the key history for the given key_name
    and updates the status of the specified old_key_value to 'inactive'.

    Parameters
    ----------
    state : dict
        The current state dictionary.
    key_name : str
        The identifier of the API key whose old version is to be deactivated.
    old_key_value : str
        The specific old API key value to be deactivated.

    Returns
    -------
    dict
        The updated state dictionary.
    """
    if key_name not in state["api_keys"]:
        logger.warning(f"Attempted to deactivate key for unknown key_name: {key_name}")
        return state

    found_and_deactivated = False
    for key_entry in state["key_history"][key_name]:
        if key_entry["key_value"] == old_key_value and key_entry["status"] == "deprecated":
            key_entry["status"] = "inactive"
            key_entry["deactivated_at"] = datetime.now()
            found_and_deactivated = True
            logger.info(f"Deactivated old API key for {key_name}: {old_key_value}.")
            break

    if not found_and_deactivated:
        logger.warning(f"Old key {old_key_value} not found or not in 'deprecated' status for {key_name}. No action taken.")

    return state

def rotate_api_key(state: dict, key_name: str, max_retries: int = 5, base_backoff_seconds: float = 1.0) -> dict:
    """
    Orchestrates the rotation of a single API key, including retries with exponential backoff.

    Parameters
    ----------
    state : dict
        The current state dictionary.
    key_name : str
        The identifier of the API key to be rotated.
    max_retries : int, optional
        Maximum number of retries for each step (generate, deploy, deactivate), defaults to 5.
    base_backoff_seconds : float, optional
        Base delay in seconds for exponential backoff, defaults to 1.0.

    Returns
    -------
    dict
        The updated state dictionary.
    """
    logger.info(f"Attempting to rotate API key: {key_name}")
    state["metrics"]["rotation_attempts"] += 1

    if key_name not in state["api_keys"]:
        logger.error(f"API key '{key_name}' not found in state. Skipping rotation.")
        state["metrics"]["rotation_failures"] += 1
        return state

    old_key_value = state["api_keys"][key_name]["current_key_value"]
    new_key_value = None
    success = False

    # Step 1: Generate New Key with Retries
    for i in range(max_retries):
        try:
            logger.debug(f"Attempt {i+1} to generate new key for {key_name}")
            new_key_value = generate_new_api_key(key_name)
            success = True
            break
        except Exception as e:
            logger.warning(f"Failed to generate new key for {key_name} (attempt {i+1}/{max_retries}): {e}")
            if i < max_retries - 1:
                sleep_time = (base_backoff_seconds * (2 ** i)) + random.uniform(0, 0.1 * (2 ** i)) # Add jitter
                logger.info(f"Retrying key generation for {key_name} in {sleep_time:.2f} seconds...")
                time.sleep(sleep_time)

    if not success:
        logger.error(f"Failed to generate new key for {key_name} after {max_retries} attempts. Aborting rotation.")
        state["metrics"]["rotation_failures"] += 1
        return state

    success = False
    # Step 2: Deploy New Key with Retries
    for i in range(max_retries):
        try:
            logger.debug(f"Attempt {i+1} to deploy new key for {key_name}")
            state = deploy_new_api_key(state, key_name, new_key_value)
            # In a real system, a validation step would go here before deactivation
            # e.g., test new_key_value against an endpoint.
            logger.info(f"New key {new_key_value} for {key_name} deployed successfully.")
            success = True
            break
        except Exception as e:
            logger.warning(f"Failed to deploy new key for {key_name} (attempt {i+1}/{max_retries}): {e}")
            if i < max_retries - 1:
                sleep_time = (base_backoff_seconds * (2 ** i)) + random.uniform(0, 0.1 * (2 ** i)) # Add jitter
                logger.info(f"Retrying key deployment for {key_name} in {sleep_time:.2f} seconds...")
                time.sleep(sleep_time)

    if not success:
        logger.error(f"Failed to deploy new key for {key_name} after {max_retries} attempts. It might be necessary to rollback or manually intervene. Old key: {old_key_value}")
        state["metrics"]["rotation_failures"] += 1
        return state

    # Step 3: Deactivate Old Key (typically with less strict retry, as new key is active)
    # It's important to ensure the new key is fully operational before deactivating the old one.
    success_deactivation = False
    for i in range(max_retries):
        try:
            logger.debug(f"Attempt {i+1} to deactivate old key for {key_name}")
            state = deactivate_old_api_key(state, key_name, old_key_value)
            success_deactivation = True
            break
        except Exception as e:
            logger.warning(f"Failed to deactivate old key for {key_name} (attempt {i+1}/{max_retries}): {e}")
            if i < max_retries - 1:
                sleep_time = (base_backoff_seconds * (2 ** i)) + random.uniform(0, 0.1 * (2 ** i)) # Add jitter
                logger.info(f"Retrying key deactivation for {key_name} in {sleep_time:.2f} seconds...")
                time.sleep(sleep_time)

    if not success_deactivation:
        logger.error(f"Failed to deactivate old key {old_key_value} for {key_name} after {max_retries} attempts. Manual intervention may be required to revoke it.")
        # This is a partial success, as the new key is deployed, but the old one is still active.
        # We might want to handle this differently, e.g., set a flag for manual cleanup.
    else:
        logger.info(f"Old key {old_key_value} for {key_name} successfully deactivated.")

    state["api_keys"][key_name]["last_rotated_at"] = datetime.now()
    state["rotation_schedule"][key_name]["next_rotation_due"] = datetime.now() + timedelta(hours=state["rotation_schedule"][key_name]["interval_hours"])
    state["metrics"]["rotation_successes"] += 1
    state["metrics"]["last_rotation_times"][key_name] = datetime.now()
    state["metrics"]["next_rotation_times"][key_name] = state["rotation_schedule"][key_name]["next_rotation_due"]

    logger.info(f"API key {key_name} rotated successfully. Next rotation due: {state['rotation_schedule'][key_name]['next_rotation_due']}")
    return state

import pandas as pd

def summarize_rotation_metrics(state: dict) -> dict:
    """
    Summarizes the API key rotation metrics from the system state.

    Parameters
    ----------
    state : dict
        The current state dictionary.

    Returns
    -------
    dict
        A dictionary containing summarized metrics.
    """
    metrics = state["metrics"]
    total_attempts = metrics["rotation_attempts"]
    total_successes = metrics["rotation_successes"]
    total_failures = metrics["rotation_failures"]

    success_rate = (total_successes / total_attempts * 100) if total_attempts > 0 else 0

    summary = {
        "total_rotation_attempts": total_attempts,
        "total_rotation_successes": total_successes,
        "total_rotation_failures": total_failures,
        "overall_success_rate_percent": f"{success_rate:.2f}%"
    }
    logger.info(f"Rotation Summary: Attempts={total_attempts}, Successes={total_successes}, Failures={total_failures}, Success Rate={success_rate:.2f}%")

    key_details = []
    for key_name, last_time in metrics["last_rotation_times"].items():
        next_time = metrics["next_rotation_times"].get(key_name)
        key_details.append({
            "Key Name": key_name,
            "Last Rotated": last_time.strftime("%Y-%m-%d %H:%M:%S"),
            "Next Rotation Due": next_time.strftime("%Y-%m-%d %H:%M:%S") if next_time else "N/A",
            "Status": state["api_keys"][key_name]["status"]
        })
    summary["key_rotation_details"] = pd.DataFrame(key_details)
    logger.debug("Generated key rotation details DataFrame.")

    return summary

def get_keys_due_for_rotation(state: dict) -> list[str]:
    """
    Identifies API keys that are due for rotation based on their schedule.

    Parameters
    ----------
    state : dict
        The current state dictionary.

    Returns
    -------
    list[str]
        A list of key names that are due for rotation.
    """
    keys_to_rotate = []
    current_time = datetime.now()

    for key_name, schedule_info in state["rotation_schedule"].items():
        if current_time >= schedule_info["next_rotation_due"]:
            keys_to_rotate.append(key_name)
            logger.info(f"API key '{key_name}' is due for rotation. Next rotation was scheduled for {schedule_info['next_rotation_due']}.")
        else:
            logger.debug(f"API key '{key_name}' is not yet due for rotation. Next rotation due: {schedule_info['next_rotation_due']}.")

    return keys_to_rotate

# Initialize the state for two API keys with different rotation intervals
initial_key_names = ["service_a_key", "service_b_key"]

# Key A rotates every 12 hours, Key B every 24 hours
state = create_initial_state(initial_key_names, rotation_interval_hours=12) # Default will be overridden for B
state["rotation_schedule"]["service_b_key"]["interval_hours"] = 24
state["rotation_schedule"]["service_b_key"]["next_rotation_due"] = state["api_keys"]["service_b_key"]["created_at"] + timedelta(hours=24)

logger.info("Initial state created with two API keys.")

# Display initial state summary (optional, for debugging)
# import json
# print(json.dumps(state, default=str, indent=2))

# Display initial key rotation details using the summarizer function
initial_summary = summarize_rotation_metrics(state)
print("\n--- Initial Rotation Metrics Summary ---")
display(initial_summary["key_rotation_details"])

# Manually adjust next_rotation_due for service_a_key to be in the past to trigger rotation
# Note: In a real system, time would pass naturally. For simulation, we'll force it.
state["rotation_schedule"]["service_a_key"]["next_rotation_due"] = datetime.now() - timedelta(hours=1)
logger.info(f"Manually set service_a_key's next rotation due to be in the past: {state['rotation_schedule']['service_a_key']['next_rotation_due']}")

# Get keys due for rotation
keys_due = get_keys_due_for_rotation(state)
logger.info(f"Keys identified as due for rotation: {keys_due}")

# Perform rotation for each key identified
for key in keys_due:
    logger.info(f"--- Initiating rotation for {key} ---")
    state = rotate_api_key(state, key)
    logger.info(f"--- Rotation complete for {key} ---")

# Summarize metrics after first rotation
summary_after_first_rotation = summarize_rotation_metrics(state)
print("\n--- Summary After First Rotation ---")
display(summary_after_first_rotation["key_rotation_details"])
print(f"Total Rotation Attempts: {summary_after_first_rotation['total_rotation_attempts']}")
print(f"Total Rotation Successes: {summary_after_first_rotation['total_rotation_successes']}")
print(f"Overall Success Rate: {summary_after_first_rotation['overall_success_rate_percent']}")

# Advance time further to make service_b_key due for rotation.
# Original 'created_at' for service_b_key was recent, and interval was 24 hours.
# We will set its next rotation due to be in the past.
state["rotation_schedule"]["service_b_key"]["next_rotation_due"] = datetime.now() - timedelta(hours=1)
logger.info(f"Manually set service_b_key's next rotation due to be in the past: {state['rotation_schedule']['service_b_key']['next_rotation_due']}")

# Get keys due for rotation again
keys_due_second_round = get_keys_due_for_rotation(state)
logger.info(f"Keys identified as due for second round of rotation: {keys_due_second_round}")

# Perform rotation for keys identified in the second round
for key in keys_due_second_round:
    logger.info(f"--- Initiating rotation for {key} ---")
    state = rotate_api_key(state, key)
    logger.info(f"--- Rotation complete for {key} ---")

# Summarize metrics after second rotation
summary_after_second_rotation = summarize_rotation_metrics(state)
print("\n--- Summary After Second Rotation ---")
display(summary_after_second_rotation["key_rotation_details"])
print(f"Total Rotation Attempts: {summary_after_second_rotation['total_rotation_attempts']}")
print(f"Total Rotation Successes: {summary_after_second_rotation['total_rotation_successes']}")
print(f"Overall Success Rate: {summary_after_second_rotation['overall_success_rate_percent']}")

import pandas as pd

def display_audit_log(state: dict):
    """
    Generates and displays a detailed audit log of all API key versions.
    """
    audit_records = []
    for key_name, history in state['key_history'].items():
        for entry in history:
            record = {
                "Key Name": key_name,
                "Key Value": entry['key_value'],
                "Status": entry['status'],
                "Created At": entry['created_at'].strftime('%H:%M:%S'),
                "Deprecated At": entry.get('deprecated_at', pd.NaT),
                "Deactivated At": entry.get('deactivated_at', pd.NaT)
            }
            # Format timestamps for display
            if pd.notna(record["Deprecated At"]): record["Deprecated At"] = record["Deprecated At"].strftime('%H:%M:%S')
            if pd.notna(record["Deactivated At"]): record["Deactivated At"] = record["Deactivated At"].strftime('%H:%M:%S')

            audit_records.append(record)

    audit_df = pd.DataFrame(audit_records)
    print("\n--- COMPREHENSIVE KEY AUDIT LOG ---")
    display(audit_df)

# Execute the detailed audit log
display_audit_log(state)