<!-- Basic SRI implementation for external JavaScript -->
<script src="https://cdn.example.com/library.js" 
        integrity="sha256-abc123def456ghi789jkl012mno345pqr678stu901vwx234yz"
        crossorigin="anonymous"></script>

<!-- CSS with SRI protection -->
<link rel="stylesheet" 
      href="https://cdn.example.com/styles.css"
      integrity="sha384-def456ghi789jkl012mno345pqr678stu901vwx234yz567abc"
      crossorigin="anonymous">

<!-- Multiple algorithm fallback -->
<script src="https://cdn.example.com/critical.js"
        integrity="sha256-primary123 sha384-fallback456 sha512-backup789"
        crossorigin="anonymous"></script>

import hashlib
import base64
from pathlib import Path

def generate_sri_hash(file_path: str, algorithm: str = 'sha256') -> str:
    """Generate SRI-compatible hash for a file."""
    
    # Read file content
    content = Path(file_path).read_bytes()
    
    # Create hash object
    hash_obj = hashlib.new(algorithm)
    hash_obj.update(content)
    
    # Generate base64 encoded digest
    digest = base64.b64encode(hash_obj.digest()).decode('ascii')
    
    return f"{algorithm}-{digest}"

def verify_file_integrity(file_path: str, expected_hash: str) -> bool:
    """Verify file integrity against expected SRI hash."""
    
    algorithm, expected_digest = expected_hash.split('-', 1)
    actual_hash = generate_sri_hash(file_path, algorithm)
    
    return actual_hash == expected_hash

# Example usage
js_file = 'static/js/app.bundle.js'
sri_hash = generate_sri_hash(js_file, 'sha384')
print(f"SRI Hash: {sri_hash}")

# Verify integrity
is_valid = verify_file_integrity(js_file, sri_hash)
print(f"File integrity: {'Valid' if is_valid else 'Compromised'}")

# Generate for multiple algorithms
for algo in ['sha256', 'sha384', 'sha512']:
    hash_value = generate_sri_hash(js_file, algo)
    print(f"{algo.upper()}: {hash_value}")

// Client-side integrity violation handler
window.addEventListener('securitypolicyviolation', function(e) {
    if (e.violatedDirective === 'script-src' && e.disposition === 'enforce') {
        console.error('Script integrity violation detected:', {
            blockedURI: e.blockedURI,
            violatedDirective: e.violatedDirective,
            originalPolicy: e.originalPolicy
        });
        
        // Report to security monitoring
        fetch('/api/security/report', {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
                type: 'integrity_violation',
                uri: e.blockedURI,
                timestamp: new Date().toISOString(),
                userAgent: navigator.userAgent
            })
        });
        
        // Fallback to local assets
        loadFallbackAssets();
    }
});

function loadFallbackAssets() {
    // Remove compromised scripts
    document.querySelectorAll('script[integrity]').forEach(script => {
        if (!script.getAttribute('data-verified')) {
            script.remove();
        }
    });
    
    // Load local fallback
    const fallbackScript = document.createElement('script');
    fallbackScript.src = '/local/js/fallback.js';
    fallbackScript.setAttribute('data-fallback', 'true');
    document.head.appendChild(fallbackScript);
}