from pulumi import Config, export

from ol_infrastructure.components.services.vault import (
    OLVaultPKIIntermediateCABackend,
    OLVaultPKIIntermediateCABackendConfig,
    OLVaultPKIIntermediateEnvBackend,
    OLVaultPKIIntermediateEnvBackendConfig,
    OLVaultPKIIntermediateRole,
    OLVaultPKIIntermediateRoleConfig,
)
from ol_infrastructure.lib.ol_types import BusinessUnit
from ol_infrastructure.lib.pulumi_helper import parse_stack
from ol_infrastructure.lib.vault import VaultPKIKeyTypeBits

SIX_MONTHS = 60 * 60 * 24 * 30 * 6  # noqa: WPS432
TWELVE_MONTHS = 60 * 60 * 24 * 30 * 12  # noqa: WPS432

env_config = Config("environment")
stack_info = parse_stack()
pki_intermediate_export = {}

# The files should be generated by the offline Root CA and copied locally prior to
# running this. More information here - https://docs.odl.mit.edu/en/platform/security/vault-pki
try:
    int_ca_pem_bundle_file = open("/tmp/int_ca_pe_bundle_file.pem").read()
    int_ca_cert_file = open("/tmp/int_ca_cert_file").read()
    pki_intermediate_ca_config = OLVaultPKIIntermediateCABackendConfig(
        max_ttl=TWELVE_MONTHS,
        default_ttl=TWELVE_MONTHS,
        intermediate_ca_pem_bundle=int_ca_pem_bundle_file,
        intermediate_ca_cert=int_ca_cert_file,
    )
except OSError:
    raise OSError("Could not find or read cert files")

pki_intermediate_ca = OLVaultPKIIntermediateCABackend(pki_intermediate_ca_config)

for business_unit in BusinessUnit:
    pki_intermediate_env_config = OLVaultPKIIntermediateEnvBackendConfig(
        max_ttl=TWELVE_MONTHS,
        default_ttl=TWELVE_MONTHS,
        environment_name=f"{business_unit.value}-{stack_info.env_suffix}",
    )

    pki_intermediate_env = OLVaultPKIIntermediateEnvBackend(pki_intermediate_env_config)

    pki_fluentd_server_role_config = OLVaultPKIIntermediateRoleConfig(
        pki_intermediate_backend=pki_intermediate_env.name,
        role_name="fluentd-server",
        key_config=VaultPKIKeyTypeBits.rsa,
        max_ttl=SIX_MONTHS,
        default_ttl=SIX_MONTHS,
        key_usages=["DigitalSignature", "KeyAgreement", "KeyEncipherment"],
        allowed_domains=[
            "fluentd.service.consul",
            "nearest-fluentd.query.consul",
            "fluentd-master.service.consul",
            "fluentd.service.operations.consul",
            "operations-fluentd.query.consul",
        ],
        cert_type="server",
    )

    pki_fluentd_server_role = OLVaultPKIIntermediateRole(pki_fluentd_server_role_config)

    pki_fluentd_client_role_config = OLVaultPKIIntermediateRoleConfig(
        pki_intermediate_backend=pki_intermediate_env.name,
        role_name="fluentd-client",
        key_config=VaultPKIKeyTypeBits.rsa,
        max_ttl=SIX_MONTHS,
        default_ttl=SIX_MONTHS,
        key_usages=["DigitalSignature", "KeyAgreement", "KeyEncipherment"],
        allowed_domains=[f"fluentd.*.{business_unit.value}-{stack_info.env_suffix}"],
        cert_type="client",
    )

    pki_fluentd_client_role = OLVaultPKIIntermediateRole(pki_fluentd_client_role_config)

    pki_intermediate_export.update(
        {
            f"pki_intermediate_{business_unit.value}-{stack_info.env_suffix}": pki_intermediate_env.name,
            f"pki_fluentd_server_role_{business_unit.value}-{stack_info.env_suffix}": pki_fluentd_server_role.name,
            f"pki_fluentd_client_role_{business_unit.value}-{stack_info.env_suffix}": pki_fluentd_client_role.name,
        }
    )

export("pki_intermediate_export", pki_intermediate_export)
export("pki_intermediate_ca", pki_intermediate_ca.name)
