# 常見 shadow AI 模式：開發者於生產程式碼中使用個人 API 金鑰
 
import openai
 
# 個人 API 金鑰硬編碼或於本地 .env
openai.api_key = "sk-personal-key-here"
 
def process_customer_ticket(ticket_text):
    """使用 AI 分類與路由支援工單。
    由單一開發者於無安全審查下部署。"""
    response = openai.ChatCompletion.create(
        model="gpt-4",
        messages=[{
            "role": "user",
            "content": f"Classify this support ticket: {ticket_text}"
        }]
    )
    return response.choices[0].message.content

class ShadowAINetworkDetector:
    """經由監控網路流量偵測 shadow AI。"""
 
    AI_API_DOMAINS = [
        "api.openai.com",
        "api.anthropic.com",
        "generativelanguage.googleapis.com",
        "api.mistral.ai",
        "api.cohere.ai",
        "api.together.xyz",
        "api.fireworks.ai",
        "api.replicate.com",
        "api.huggingface.co",
    ]
 
    def analyze_dns_logs(self, dns_log_entries):
        """辨識對已知 AI API 端點之 DNS 查詢。"""
        findings = []
 
        for entry in dns_log_entries:
            for domain in self.AI_API_DOMAINS:
                if domain in entry["query"]:
                    findings.append({
                        "domain": domain,
                        "source_ip": entry["source_ip"],
                        "timestamp": entry["timestamp"],
                        "query_count": entry.get("count", 1)
                    })
 
        return self.deduplicate_and_rank(findings)
 
    def analyze_proxy_logs(self, proxy_log_entries):
        """分析 HTTP proxy 日誌以尋找 AI API 流量。"""
        ai_traffic = []
 
        for entry in proxy_log_entries:
            url = entry.get("url", "")
            for domain in self.AI_API_DOMAINS:
                if domain in url:
                    ai_traffic.append({
                        "url": url,
                        "method": entry.get("method"),
                        "user": entry.get("user"),
                        "source_ip": entry.get("source_ip"),
                        "content_type": entry.get("content_type"),
                        "request_size": entry.get("request_size"),
                        "timestamp": entry.get("timestamp")
                    })
 
        return ai_traffic

class ShadowAICodeScanner:
    """掃描程式碼儲存庫以尋找 shadow AI 使用。"""
 
    INDICATORS = {
        "api_key_patterns": [
            r"sk-[a-zA-Z0-9]{32,}",       # OpenAI 金鑰格式
            r"sk-ant-[a-zA-Z0-9-]{32,}",   # Anthropic 金鑰格式
            r"AIza[a-zA-Z0-9_-]{35}",       # Google API 金鑰
        ],
        "import_patterns": [
            r"import openai",
            r"from anthropic import",
            r"import google.generativeai",
            r"from langchain",
            r"import llama_index",
            r"from transformers import",
        ],
        "api_url_patterns": [
            r"api\.openai\.com",
            r"api\.anthropic\.com",
            r"generativelanguage\.googleapis\.com",
        ]
    }
 
    def scan_repository(self, repo_path):
        """掃描程式碼儲存庫以尋找 shadow AI 指標。"""
        findings = []
 
        for root, dirs, files in os.walk(repo_path):
            # 略過常見非程式碼目錄
            dirs[:] = [d for d in dirs if d not in
                       ['.git', 'node_modules', '__pycache__', 'venv']]
 
            for filename in files:
                if filename.endswith(('.py', '.js', '.ts', '.go', '.java',
                                     '.env', '.yaml', '.yml', '.json')):
                    filepath = os.path.join(root, filename)
                    file_findings = self.scan_file(filepath)
                    findings.extend(file_findings)
 
        return findings

def assess_shadow_ai_risk(deployment):
    """評估所發現 shadow AI 部署之風險。"""
    risk_factors = {
        "data_sensitivity": {
            "pii": 10,
            "financial": 9,
            "healthcare": 10,
            "internal_only": 5,
            "public": 1
        },
        "data_volume": {
            "high": 8,    # 每日數千筆
            "medium": 5,  # 每日數百筆
            "low": 2      # 偶爾使用
        },
        "authorization": {
            "none": 10,        # 完全無核准
            "informal": 7,     # 經理核准、無安全審查
            "partial": 4,      # 部分審查但不完整
            "approved": 1      # 完全核准（非 shadow AI）
        },
        "controls": {
            "none": 10,
            "basic": 6,
            "moderate": 3,
            "comprehensive": 1
        }
    }
 
    total_risk = sum(
        risk_factors[category].get(deployment.get(category, "none"), 5)
        for category in risk_factors
    )
    max_risk = sum(max(v.values()) for v in risk_factors.values())
 
    return {
        "risk_score": total_risk / max_risk,
        "risk_level": (
            "critical" if total_risk / max_risk > 0.8 else
            "high" if total_risk / max_risk > 0.6 else
            "medium" if total_risk / max_risk > 0.4 else
            "low"
        ),
        "factors": deployment
    }