#!/usr/bin/env python3
"""Cloudflare Access zero trust audit agent using Cloudflare API."""

import json
import sys
import argparse
from datetime import datetime

try:
    import requests
except ImportError:
    print("Install: pip install requests")
    sys.exit(1)


class CloudflareAccessClient:
    """Cloudflare Access API client."""

    def __init__(self, api_token, account_id):
        self.base = f"https://api.cloudflare.com/client/v4/accounts/{account_id}/access"
        self.headers = {"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"}

    def _get(self, endpoint):
        resp = requests.get(f"{self.base}/{endpoint}", headers=self.headers, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def list_applications(self):
        return self._get("apps")

    def list_policies(self, app_id):
        return self._get(f"apps/{app_id}/policies")

    def list_groups(self):
        return self._get("groups")

    def list_identity_providers(self):
        return self._get("identity_providers")

    def list_service_tokens(self):
        return self._get("service_tokens")


def audit_access_config(client):
    """Audit Cloudflare Access configuration."""
    findings = []
    apps = client.list_applications()
    for app in apps.get("result", []):
        if not app.get("session_duration"):
            findings.append({
                "type": "no_session_timeout",
                "app": app.get("name", ""),
                "severity": "MEDIUM",
            })
    tokens = client.list_service_tokens()
    for token in tokens.get("result", []):
        if token.get("expires_at"):
            expiry = datetime.fromisoformat(token["expires_at"].replace("Z", "+00:00"))
            if expiry.replace(tzinfo=None) < datetime.utcnow():
                findings.append({
                    "type": "expired_service_token",
                    "token_name": token.get("name", ""),
                    "severity": "HIGH",
                })
    return findings


def run_audit(api_token, account_id):
    """Execute Cloudflare Access audit."""
    client = CloudflareAccessClient(api_token, account_id)
    print(f"\n{'='*60}")
    print(f"  CLOUDFLARE ACCESS ZERO TRUST AUDIT")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    apps = client.list_applications()
    app_list = apps.get("result", [])
    print(f"--- APPLICATIONS ({len(app_list)}) ---")
    for a in app_list[:10]:
        print(f"  {a.get('name', '')}: domain={a.get('domain', '')} type={a.get('type', '')}")

    idps = client.list_identity_providers()
    idp_list = idps.get("result", [])
    print(f"\n--- IDENTITY PROVIDERS ({len(idp_list)}) ---")
    for idp in idp_list:
        print(f"  {idp.get('name', '')}: type={idp.get('type', '')}")

    findings = audit_access_config(client)
    print(f"\n--- FINDINGS ({len(findings)}) ---")
    for f in findings:
        print(f"  [{f['severity']}] {f['type']}: {f.get('app', f.get('token_name', ''))}")

    return {"apps": len(app_list), "idps": len(idp_list), "findings": findings}


def main():
    parser = argparse.ArgumentParser(description="Cloudflare Access Audit Agent")
    parser.add_argument("--api-token", required=True, help="Cloudflare API token")
    parser.add_argument("--account-id", required=True, help="Cloudflare account ID")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    report = run_audit(args.api_token, args.account_id)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Cloudflare Access Zero Trust - Deployment Audit Tool

Queries Cloudflare API to audit Access applications, policies, tunnel
health, and device enrollment for zero trust compliance validation.

Requirements:
    pip install requests
"""

import json
import sys
from datetime import datetime, timezone
from typing import Any

import requests

CF_API_BASE = "https://api.cloudflare.com/client/v4"


class CloudflareAccessAuditor:
    """Audit Cloudflare Zero Trust Access deployment."""

    def __init__(self, api_token: str, account_id: str):
        self.api_token = api_token
        self.account_id = account_id
        self.headers = {
            "Authorization": f"Bearer {api_token}",
            "Content-Type": "application/json"
        }

    def _get(self, endpoint: str, params: dict = None) -> dict:
        """Make authenticated GET request."""
        url = f"{CF_API_BASE}/accounts/{self.account_id}/{endpoint}"
        resp = requests.get(url, headers=self.headers, params=params or {}, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def audit_access_applications(self) -> dict[str, Any]:
        """Audit all Access applications and their configurations."""
        print("\n[1/5] Auditing Access Applications...")
        data = self._get("access/apps")
        apps = data.get("result", [])

        stats = {
            "total": len(apps),
            "self_hosted": 0,
            "saas": 0,
            "ssh": 0,
            "vnc": 0,
            "without_policies": 0,
            "session_durations": {},
            "apps": []
        }

        for app in apps:
            app_type = app.get("type", "unknown")
            name = app.get("name", "unknown")
            domain = app.get("domain", "N/A")
            session = app.get("session_duration", "24h")
            policies_count = len(app.get("policies", []))

            if app_type == "self_hosted":
                stats["self_hosted"] += 1
            elif app_type == "saas":
                stats["saas"] += 1
            elif app_type == "ssh":
                stats["ssh"] += 1
            elif app_type == "vnc":
                stats["vnc"] += 1

            if policies_count == 0:
                stats["without_policies"] += 1
                print(f"  [WARN] App '{name}' has no access policies!")

            stats["session_durations"][session] = stats["session_durations"].get(session, 0) + 1
            stats["apps"].append({
                "name": name, "type": app_type, "domain": domain,
                "session": session, "policies": policies_count
            })
            print(f"  [{app_type.upper()}] {name} ({domain}) - {policies_count} policies, session: {session}")

        return stats

    def audit_tunnels(self) -> dict[str, Any]:
        """Audit Cloudflare Tunnel health and configuration."""
        print("\n[2/5] Auditing Cloudflare Tunnels...")
        data = self._get("cfd_tunnel", params={"is_deleted": "false"})
        tunnels = data.get("result", [])

        stats = {
            "total": len(tunnels),
            "healthy": 0,
            "degraded": 0,
            "inactive": 0,
            "tunnels": []
        }

        for tunnel in tunnels:
            name = tunnel.get("name", "unknown")
            status = tunnel.get("status", "unknown")
            connections = tunnel.get("connections", [])
            created = tunnel.get("created_at", "")

            if status == "healthy":
                stats["healthy"] += 1
            elif status == "degraded":
                stats["degraded"] += 1
                print(f"  [WARN] Tunnel '{name}' is degraded")
            else:
                stats["inactive"] += 1
                print(f"  [WARN] Tunnel '{name}' is inactive")

            stats["tunnels"].append({
                "name": name, "status": status,
                "connections": len(connections), "created": created
            })

        print(f"  Total: {stats['total']}, Healthy: {stats['healthy']}, "
              f"Degraded: {stats['degraded']}, Inactive: {stats['inactive']}")
        return stats

    def audit_device_posture(self) -> dict[str, Any]:
        """Audit device posture rules configuration."""
        print("\n[3/5] Auditing Device Posture Rules...")
        data = self._get("devices/posture")
        rules = data.get("result", [])

        stats = {
            "total": len(rules),
            "types": {},
            "rules": []
        }

        for rule in rules:
            name = rule.get("name", "unknown")
            rule_type = rule.get("type", "unknown")
            stats["types"][rule_type] = stats["types"].get(rule_type, 0) + 1
            stats["rules"].append({"name": name, "type": rule_type})
            print(f"  [{rule_type}] {name}")

        required_types = {"disk_encryption", "os_version", "firewall"}
        missing = required_types - set(stats["types"].keys())
        if missing:
            print(f"  [WARN] Missing recommended posture types: {missing}")

        return stats

    def audit_device_enrollment(self) -> dict[str, Any]:
        """Audit enrolled devices."""
        print("\n[4/5] Auditing Device Enrollment...")
        data = self._get("devices")
        devices = data.get("result", [])

        stats = {
            "total": len(devices),
            "os_distribution": {},
            "active": 0,
            "revoked": 0
        }

        for device in devices:
            os_type = device.get("os_version", "unknown").split(" ")[0] if device.get("os_version") else "unknown"
            stats["os_distribution"][os_type] = stats["os_distribution"].get(os_type, 0) + 1
            if device.get("revoked_at"):
                stats["revoked"] += 1
            else:
                stats["active"] += 1

        print(f"  Total: {stats['total']}, Active: {stats['active']}, Revoked: {stats['revoked']}")
        print(f"  OS Distribution: {stats['os_distribution']}")
        return stats

    def generate_report(self, apps, tunnels, posture, devices) -> str:
        """Generate comprehensive audit report."""
        print("\n[5/5] Generating report...")
        now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")

        report = f"""
Cloudflare Zero Trust Access Audit Report
{'=' * 55}
Account: {self.account_id}
Generated: {now}

1. ACCESS APPLICATIONS
   Total applications:         {apps['total']}
   Self-hosted:                {apps['self_hosted']}
   SaaS:                       {apps['saas']}
   SSH/Infrastructure:         {apps['ssh']}
   Without policies:           {apps['without_policies']}
   Session durations:          {apps['session_durations']}

2. TUNNEL INFRASTRUCTURE
   Total tunnels:              {tunnels['total']}
   Healthy:                    {tunnels['healthy']}
   Degraded:                   {tunnels['degraded']}
   Inactive:                   {tunnels['inactive']}

3. DEVICE POSTURE
   Posture rules defined:      {posture['total']}
   Rule types:                 {posture['types']}

4. DEVICE ENROLLMENT
   Total devices:              {devices['total']}
   Active:                     {devices['active']}
   Revoked:                    {devices['revoked']}

5. RECOMMENDATIONS
"""
        recs = []
        if apps['without_policies'] > 0:
            recs.append(f"   - {apps['without_policies']} app(s) without policies - add access rules immediately")
        if tunnels['degraded'] > 0 or tunnels['inactive'] > 0:
            recs.append(f"   - {tunnels['degraded'] + tunnels['inactive']} tunnel(s) need attention")
        if "disk_encryption" not in posture.get("types", {}):
            recs.append("   - Add disk encryption posture rule")
        if "os_version" not in posture.get("types", {}):
            recs.append("   - Add OS version posture rule")
        if not recs:
            recs.append("   - No critical issues found")
        report += "\n".join(recs)
        return report


def main():
    if len(sys.argv) < 3:
        print("Usage: python process.py <cf_api_token> <account_id>")
        sys.exit(1)

    auditor = CloudflareAccessAuditor(sys.argv[1], sys.argv[2])
    apps = auditor.audit_access_applications()
    tunnels = auditor.audit_tunnels()
    posture = auditor.audit_device_posture()
    devices = auditor.audit_device_enrollment()
    report = auditor.generate_report(apps, tunnels, posture, devices)
    print(report)

    filename = f"cloudflare_zt_audit_{datetime.now().strftime('%Y%m%d')}.txt"
    with open(filename, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {filename}")


if __name__ == "__main__":
    main()