#!/usr/bin/env python3
"""Google Identity-Aware Proxy (IAP) configuration agent using google-cloud-iap."""

import json
import sys
import argparse
from datetime import datetime

try:
    from google.cloud import iap_v1
except ImportError:
    print("Install: pip install google-cloud-iap google-cloud-resource-manager")
    sys.exit(1)


def list_iap_tunnels(project_id):
    """List IAP TCP forwarding tunnels."""
    client = iap_v1.IdentityAwareProxyAdminServiceClient()
    parent = f"projects/{project_id}"
    tunnels = []
    try:
        request = iap_v1.ListTunnelDestGroupsRequest(parent=f"{parent}/iap_tunnel/locations/-")
        for group in client.list_tunnel_dest_groups(request=request):
            tunnels.append({
                "name": group.name,
                "cidrs": list(group.cidrs),
                "fqdns": list(group.fqdns),
            })
    except Exception as e:
        tunnels.append({"error": str(e)})
    return tunnels


def get_iap_settings(project_id, resource_type="web"):
    """Get IAP settings for web resources."""
    client = iap_v1.IdentityAwareProxyAdminServiceClient()
    resource_name = f"projects/{project_id}/iap_web"
    try:
        request = iap_v1.GetIapSettingsRequest(name=resource_name)
        settings = client.get_iap_settings(request=request)
        return {
            "name": settings.name,
            "access_settings": {
                "cors_settings": str(settings.access_settings.cors_settings) if settings.access_settings else "",
            },
        }
    except Exception as e:
        return {"error": str(e)}


def audit_iap_iam_policy(project_id):
    """Audit IAM bindings for IAP-secured resources."""
    client = iap_v1.IdentityAwareProxyAdminServiceClient()
    resource = f"projects/{project_id}/iap_web"
    try:
        policy = client.get_iam_policy(request={"resource": resource})
        bindings = []
        for binding in policy.bindings:
            bindings.append({
                "role": binding.role,
                "members": list(binding.members),
                "condition": str(binding.condition) if binding.condition else None,
            })
        return bindings
    except Exception as e:
        return [{"error": str(e)}]


def check_oauth_consent(project_id):
    """Verify OAuth consent screen configuration."""
    return {
        "check": "OAuth consent screen",
        "project": project_id,
        "requirements": [
            "Application type: Internal (for organization apps)",
            "Support email: Valid group email",
            "Authorized domains: Company domains only",
            "Scopes: Minimal required (email, profile)",
        ],
        "verification_url": f"https://console.cloud.google.com/apis/credentials/consent?project={project_id}",
    }


def run_audit(project_id):
    """Execute IAP configuration audit."""
    print(f"\n{'='*60}")
    print(f"  GOOGLE IAP CONFIGURATION AUDIT")
    print(f"  Project: {project_id}")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    settings = get_iap_settings(project_id)
    print(f"--- IAP SETTINGS ---")
    print(f"  {json.dumps(settings, indent=2)}")

    bindings = audit_iap_iam_policy(project_id)
    print(f"\n--- IAM BINDINGS ({len(bindings)}) ---")
    for b in bindings:
        if "error" not in b:
            print(f"  {b['role']}: {', '.join(b['members'][:3])}")

    tunnels = list_iap_tunnels(project_id)
    print(f"\n--- TCP TUNNELS ({len(tunnels)}) ---")
    for t in tunnels:
        if "error" not in t:
            print(f"  {t['name']}: CIDRs={t['cidrs']}")

    consent = check_oauth_consent(project_id)
    print(f"\n--- OAUTH CONSENT ---")
    for req in consent["requirements"]:
        print(f"  - {req}")

    return {"settings": settings, "bindings": bindings, "tunnels": tunnels, "consent": consent}


def main():
    parser = argparse.ArgumentParser(description="Google IAP Audit Agent")
    parser.add_argument("--project", required=True, help="GCP project ID")
    parser.add_argument("--audit", action="store_true", help="Run full audit")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    if args.audit:
        report = run_audit(args.project)
        if args.output:
            with open(args.output, "w") as f:
                json.dump(report, f, indent=2, default=str)
            print(f"\n[+] Report saved to {args.output}")
    else:
        parser.print_help()


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Google Cloud IAP - Configuration Audit Tool

Audits IAP-enabled backend services, IAM bindings, access levels,
session settings, and access logs for compliance validation.

Requirements:
    pip install google-cloud-compute google-auth requests
"""

import json
import subprocess
import sys
from datetime import datetime, timedelta, timezone
from typing import Any


def run_gcloud(args: list[str]) -> Any:
    """Execute gcloud command and return JSON output."""
    cmd = ["gcloud"] + args + ["--format=json"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if result.returncode != 0:
        return []
    try:
        return json.loads(result.stdout) if result.stdout.strip() else []
    except json.JSONDecodeError:
        return []


def audit_iap_backends(project_id: str) -> list[dict]:
    """Audit all backend services for IAP configuration."""
    print("\n[1/5] Auditing IAP-enabled backend services...")
    backends = run_gcloud(["compute", "backend-services", "list", "--project", project_id])
    if not isinstance(backends, list):
        return []

    results = []
    for backend in backends:
        name = backend.get("name", "unknown")
        iap = backend.get("iap", {})
        enabled = iap.get("enabled", False)

        info = {"name": name, "iap_enabled": enabled, "bindings": [], "has_conditions": False}

        if enabled:
            policy = run_gcloud([
                "iap", "web", "get-iam-policy",
                "--resource-type=backend-services",
                "--service", name, "--project", project_id
            ])
            bindings = policy.get("bindings", []) if isinstance(policy, dict) else []
            info["bindings"] = bindings
            info["bindings_count"] = len(bindings)
            info["has_conditions"] = any(b.get("condition") for b in bindings)
            print(f"  [IAP ON]  {name}: {len(bindings)} bindings, conditions: {info['has_conditions']}")
        else:
            print(f"  [IAP OFF] {name}")

        results.append(info)
    return results


def audit_access_levels(policy_id: str) -> list[dict]:
    """Audit Access Context Manager levels."""
    print("\n[2/5] Auditing access levels...")
    if not policy_id:
        print("  Skipped - no policy ID provided")
        return []

    levels = run_gcloud(["access-context-manager", "levels", "list", "--policy", policy_id])
    if not isinstance(levels, list):
        return []

    results = []
    for level in levels:
        name = level.get("name", "").split("/")[-1]
        title = level.get("title", "")
        basic = level.get("basic", {})
        has_device = any(
            c.get("devicePolicy") for c in basic.get("conditions", [])
        )
        has_ip = any(
            c.get("ipSubnetworks") for c in basic.get("conditions", [])
        )
        results.append({"name": name, "title": title, "has_device": has_device, "has_ip": has_ip})
        print(f"  {title}: device_policy={has_device}, ip_restriction={has_ip}")

    return results


def audit_iap_tunnel_access(project_id: str) -> dict:
    """Audit IAP TCP tunnel permissions."""
    print("\n[3/5] Auditing IAP tunnel access...")
    instances = run_gcloud(["compute", "instances", "list", "--project", project_id])
    if not isinstance(instances, list):
        return {"total_vms": 0}

    stats = {"total_vms": len(instances), "with_external_ip": 0, "tunnel_accessible": 0}
    for vm in instances:
        name = vm.get("name", "unknown")
        interfaces = vm.get("networkInterfaces", [])
        has_ext_ip = any(
            iface.get("accessConfigs") for iface in interfaces
        )
        if has_ext_ip:
            stats["with_external_ip"] += 1

    print(f"  Total VMs: {stats['total_vms']}, With external IP: {stats['with_external_ip']}")
    if stats["with_external_ip"] > 0:
        print(f"  [WARN] {stats['with_external_ip']} VMs have external IPs - consider removing for IAP-only access")
    return stats


def audit_iap_logs(project_id: str) -> dict:
    """Analyze recent IAP access logs."""
    print("\n[4/5] Analyzing IAP access logs (24h)...")
    start = (datetime.now(timezone.utc) - timedelta(hours=24)).strftime("%Y-%m-%dT%H:%M:%SZ")
    logs = run_gcloud([
        "logging", "read",
        f'resource.type="gce_backend_service" AND protoPayload.serviceName="iap.googleapis.com" AND timestamp>="{start}"',
        "--project", project_id, "--limit=500"
    ])
    if not isinstance(logs, list):
        return {"total": 0, "allowed": 0, "denied": 0}

    stats = {"total": len(logs), "allowed": 0, "denied": 0, "users": set()}
    for entry in logs:
        payload = entry.get("protoPayload", {})
        status = payload.get("status", {}).get("code", 0)
        user = payload.get("authenticationInfo", {}).get("principalEmail", "")
        if status == 0:
            stats["allowed"] += 1
        else:
            stats["denied"] += 1
        if user:
            stats["users"].add(user)

    stats["unique_users"] = len(stats["users"])
    del stats["users"]
    print(f"  Requests: {stats['total']}, Allowed: {stats['allowed']}, Denied: {stats['denied']}")
    return stats


def generate_report(project_id: str, backends: list, levels: list,
                    tunnels: dict, logs: dict) -> str:
    """Generate IAP audit report."""
    print("\n[5/5] Generating report...")
    now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
    iap_on = [b for b in backends if b["iap_enabled"]]
    iap_off = [b for b in backends if not b["iap_enabled"]]
    with_conditions = [b for b in iap_on if b.get("has_conditions")]

    report = f"""
Google Cloud IAP Audit Report
{'=' * 55}
Project: {project_id}
Generated: {now}

1. BACKEND SERVICES
   Total backend services:       {len(backends)}
   IAP enabled:                  {len(iap_on)}
   IAP disabled:                 {len(iap_off)}
   With access level conditions: {len(with_conditions)} / {len(iap_on)}

2. ACCESS LEVELS
   Total defined:                {len(levels)}
   With device policy:           {sum(1 for l in levels if l['has_device'])}
   With IP restrictions:         {sum(1 for l in levels if l['has_ip'])}

3. VM ACCESS
   Total VMs:                    {tunnels['total_vms']}
   With external IP:             {tunnels['with_external_ip']}

4. ACCESS LOGS (24h)
   Total requests:               {logs['total']}
   Allowed:                      {logs['allowed']}
   Denied:                       {logs['denied']}
   Unique users:                 {logs.get('unique_users', 0)}

5. RECOMMENDATIONS
"""
    recs = []
    if iap_off:
        recs.append(f"   - Enable IAP on {len(iap_off)} unprotected backend service(s)")
    if len(with_conditions) < len(iap_on):
        recs.append(f"   - Add access level conditions to {len(iap_on) - len(with_conditions)} IAP service(s)")
    if tunnels["with_external_ip"] > 0:
        recs.append(f"   - Remove external IPs from {tunnels['with_external_ip']} VM(s) for IAP-only access")
    if not recs:
        recs.append("   - Configuration meets best practices")
    report += "\n".join(recs)
    return report


def main():
    if len(sys.argv) < 2:
        print("Usage: python process.py <project-id> [access-policy-id]")
        sys.exit(1)

    project_id = sys.argv[1]
    policy_id = sys.argv[2] if len(sys.argv) > 2 else None

    backends = audit_iap_backends(project_id)
    levels = audit_access_levels(policy_id)
    tunnels = audit_iap_tunnel_access(project_id)
    logs = audit_iap_logs(project_id)
    report = generate_report(project_id, backends, levels, tunnels, logs)
    print(report)

    filename = f"iap_audit_{project_id}_{datetime.now().strftime('%Y%m%d')}.txt"
    with open(filename, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {filename}")


if __name__ == "__main__":
    main()