#!/usr/bin/env python3
"""Agent for scanning Infrastructure as Code templates for security misconfigurations."""

import json
import argparse
import subprocess
from datetime import datetime
from collections import Counter
from pathlib import Path


def run_checkov(target_path, framework=None):
    """Run Checkov IaC security scanner."""
    cmd = ["checkov", "-d", target_path, "--output", "json", "--quiet"]
    if framework:
        cmd.extend(["--framework", framework])
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    try:
        return json.loads(result.stdout) if result.stdout.strip() else {"error": result.stderr}
    except json.JSONDecodeError:
        return {"raw": result.stdout[:2000], "error": result.stderr}


def run_tfsec(target_path):
    """Run tfsec Terraform security scanner."""
    cmd = ["tfsec", target_path, "--format", "json"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    try:
        return json.loads(result.stdout) if result.stdout.strip() else {"error": result.stderr}
    except json.JSONDecodeError:
        return {"raw": result.stdout[:2000]}


def analyze_checkov_results(results):
    """Analyze Checkov scan results and categorize findings."""
    if isinstance(results, list):
        all_checks = results
    elif isinstance(results, dict):
        all_checks = results.get("results", {}).get("failed_checks", [])
    else:
        return {"error": "Invalid results format"}

    by_severity = Counter()
    by_resource_type = Counter()
    by_check = Counter()
    findings = []

    for check in all_checks:
        severity = check.get("severity", check.get("check_result", {}).get("severity", "MEDIUM"))
        by_severity[severity] += 1
        resource = check.get("resource", "unknown")
        by_resource_type[resource.split(".")[0]] += 1
        by_check[check.get("check_id", "unknown")] += 1
        if severity in ("CRITICAL", "HIGH"):
            findings.append({
                "check_id": check.get("check_id", ""),
                "check_name": check.get("check", check.get("name", "")),
                "resource": resource,
                "file": check.get("file_path", check.get("repo_file_path", "")),
                "line": check.get("file_line_range", []),
                "severity": severity,
                "guideline": check.get("guideline", ""),
            })

    return {
        "total_failures": len(all_checks),
        "by_severity": dict(by_severity),
        "by_resource_type": dict(by_resource_type.most_common(10)),
        "top_checks": dict(by_check.most_common(10)),
        "critical_findings": findings[:30],
    }


def scan_terraform_files(dir_path):
    """Scan Terraform files for common security misconfigurations."""
    findings = []
    tf_files = list(Path(dir_path).rglob("*.tf"))

    risky_patterns = {
        '"0.0.0.0/0"': {"issue": "Open CIDR block", "severity": "HIGH"},
        "cidr_blocks = [": {"issue": "Check CIDR block restrictions", "severity": "MEDIUM"},
        "publicly_accessible": {"issue": "Public accessibility setting", "severity": "HIGH"},
        "encrypted = false": {"issue": "Encryption disabled", "severity": "CRITICAL"},
        "enable_logging = false": {"issue": "Logging disabled", "severity": "HIGH"},
        "versioning {": {"issue": "Check versioning enabled", "severity": "MEDIUM"},
        'protocol = "-1"': {"issue": "All protocols allowed", "severity": "HIGH"},
        "from_port = 0": {"issue": "All ports open", "severity": "HIGH"},
    }

    for tf_file in tf_files:
        try:
            content = tf_file.read_text(encoding="utf-8", errors="ignore")
            for pattern, info in risky_patterns.items():
                if pattern in content:
                    lines = [i + 1 for i, line in enumerate(content.split("\n"))
                             if pattern in line]
                    for line in lines[:5]:
                        findings.append({
                            "file": str(tf_file),
                            "line": line,
                            "pattern": pattern,
                            "issue": info["issue"],
                            "severity": info["severity"],
                        })
        except (OSError, PermissionError):
            continue

    return findings


def generate_ci_config(scanner="checkov", framework="terraform"):
    """Generate CI/CD pipeline config for IaC scanning."""
    configs = {
        "github_actions": f"""name: IaC Security Scan
on: [push, pull_request]
jobs:
  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run {scanner}
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: {framework}
          soft_fail: false
          output_format: sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif
""",
        "gitlab_ci": f"""iac-scan:
  image: bridgecrew/checkov:latest
  script:
    - checkov -d . --framework {framework} --output junitxml > checkov.xml
  artifacts:
    reports:
      junit: checkov.xml
""",
    }
    return configs


def main():
    parser = argparse.ArgumentParser(description="IaC Security Scanning Agent")
    parser.add_argument("--scan-dir", help="Directory to scan")
    parser.add_argument("--framework", choices=["terraform", "cloudformation",
                                                  "kubernetes", "helm", "all"])
    parser.add_argument("--scanner", choices=["checkov", "tfsec", "builtin"], default="builtin")
    parser.add_argument("--gen-ci", action="store_true", help="Generate CI config")
    parser.add_argument("--output", default="iac_security_report.json")
    args = parser.parse_args()

    report = {"generated_at": datetime.utcnow().isoformat(), "results": {}}

    if args.scan_dir:
        if args.scanner == "checkov":
            raw = run_checkov(args.scan_dir, args.framework)
            analysis = analyze_checkov_results(raw)
            report["results"]["checkov"] = analysis
            print(f"[+] Checkov: {analysis.get('total_failures', 0)} failures")
        elif args.scanner == "tfsec":
            raw = run_tfsec(args.scan_dir)
            report["results"]["tfsec"] = raw
            print("[+] tfsec scan complete")
        else:
            findings = scan_terraform_files(args.scan_dir)
            report["results"]["builtin_scan"] = findings
            print(f"[+] Built-in scan: {len(findings)} findings")

    if args.gen_ci:
        configs = generate_ci_config(args.scanner or "checkov", args.framework or "terraform")
        report["results"]["ci_configs"] = configs
        print("[+] CI configs generated")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
IaC Security Scanning Pipeline Script

Runs Checkov and/or tfsec against IaC directories, aggregates findings,
evaluates quality gates, and generates reports.

Usage:
    python process.py --iac-dir ./terraform --framework terraform
    python process.py --iac-dir ./k8s --framework kubernetes --output report.json
"""

import argparse
import json
import os
import subprocess
import sys
from dataclasses import dataclass, field
from datetime import datetime, timezone
from typing import Optional


SEVERITY_MAP = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}


@dataclass
class IaCFinding:
    check_id: str
    check_name: str
    severity: str
    resource: str
    file_path: str
    guideline: str
    framework: str
    tool: str
    file_line_range: list = field(default_factory=list)


def run_checkov(iac_dir: str, framework: str = "terraform",
                skip_checks: Optional[list] = None,
                custom_checks_dir: Optional[str] = None,
                baseline: Optional[str] = None) -> dict:
    """Run Checkov scan and return JSON results."""
    cmd = [
        "checkov", "-d", iac_dir,
        "--framework", framework,
        "--output", "json",
        "--compact",
        "--quiet"
    ]

    if skip_checks:
        cmd.extend(["--skip-check", ",".join(skip_checks)])
    if custom_checks_dir:
        cmd.extend(["--external-checks-dir", custom_checks_dir])
    if baseline:
        cmd.extend(["--baseline", baseline])

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        if proc.stdout:
            try:
                return json.loads(proc.stdout)
            except json.JSONDecodeError:
                return {"error": "Failed to parse Checkov JSON output"}
        return {"error": proc.stderr[:500] if proc.stderr else "No output from Checkov"}
    except subprocess.TimeoutExpired:
        return {"error": "Checkov scan timed out"}
    except FileNotFoundError:
        return {"error": "checkov not found. Install with: pip install checkov"}


def run_tfsec(iac_dir: str) -> dict:
    """Run tfsec scan and return JSON results."""
    cmd = ["tfsec", iac_dir, "--format", "json", "--no-color"]

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        if proc.stdout:
            try:
                return json.loads(proc.stdout)
            except json.JSONDecodeError:
                return {"error": "Failed to parse tfsec JSON output"}
        return {"error": proc.stderr[:500] if proc.stderr else "No output from tfsec"}
    except FileNotFoundError:
        return {"error": "tfsec not found. Install from https://aquasecurity.github.io/tfsec/"}


def parse_checkov_results(checkov_json: dict) -> tuple:
    """Parse Checkov JSON output into findings."""
    findings = []
    passed_count = 0
    skipped_count = 0

    results_list = checkov_json if isinstance(checkov_json, list) else [checkov_json]

    for result_block in results_list:
        for check_type in result_block.get("results", {}):
            if check_type == "passed_checks":
                passed_count += len(result_block["results"].get("passed_checks", []))
            elif check_type == "skipped_checks":
                skipped_count += len(result_block["results"].get("skipped_checks", []))
            elif check_type == "failed_checks":
                for check in result_block["results"].get("failed_checks", []):
                    severity = check.get("severity", "MEDIUM")
                    if not severity or severity == "UNKNOWN":
                        severity = "MEDIUM"

                    findings.append(IaCFinding(
                        check_id=check.get("check_id", ""),
                        check_name=check.get("check_result", {}).get("name", check.get("name", "")),
                        severity=severity.upper(),
                        resource=check.get("resource", ""),
                        file_path=check.get("file_path", ""),
                        guideline=check.get("guideline", ""),
                        framework=check.get("check_type", "terraform"),
                        tool="checkov",
                        file_line_range=check.get("file_line_range", [])
                    ))

    return findings, passed_count, skipped_count


def parse_tfsec_results(tfsec_json: dict) -> list:
    """Parse tfsec JSON output into findings."""
    findings = []
    for result in tfsec_json.get("results", []):
        findings.append(IaCFinding(
            check_id=result.get("rule_id", result.get("long_id", "")),
            check_name=result.get("rule_description", ""),
            severity=result.get("severity", "MEDIUM").upper(),
            resource=result.get("resource", ""),
            file_path=result.get("location", {}).get("filename", ""),
            guideline=result.get("resolution", ""),
            framework="terraform",
            tool="tfsec",
            file_line_range=[
                result.get("location", {}).get("start_line", 0),
                result.get("location", {}).get("end_line", 0)
            ]
        ))
    return findings


def evaluate_quality_gate(findings: list, threshold: str) -> dict:
    """Evaluate quality gate based on finding severities."""
    threshold_level = SEVERITY_MAP.get(threshold.upper(), 1)
    blocking = [f for f in findings if SEVERITY_MAP.get(f.severity, 3) <= threshold_level]

    severity_counts = {}
    for f in findings:
        severity_counts[f.severity] = severity_counts.get(f.severity, 0) + 1

    return {
        "passed": len(blocking) == 0,
        "threshold": threshold.upper(),
        "total_findings": len(findings),
        "blocking_count": len(blocking),
        "severity_counts": severity_counts,
        "blocking_details": [
            {
                "check_id": f.check_id,
                "name": f.check_name,
                "severity": f.severity,
                "resource": f.resource,
                "file": f.file_path,
                "lines": f.file_line_range
            }
            for f in blocking[:25]
        ]
    }


def main():
    parser = argparse.ArgumentParser(description="IaC Security Scanning Pipeline")
    parser.add_argument("--iac-dir", required=True, help="Directory containing IaC files")
    parser.add_argument("--framework", default="terraform",
                        choices=["terraform", "cloudformation", "kubernetes", "helm", "all"])
    parser.add_argument("--output", default="iac-security-report.json")
    parser.add_argument("--severity-threshold", default="high",
                        choices=["critical", "high", "medium", "low"])
    parser.add_argument("--fail-on-findings", action="store_true")
    parser.add_argument("--skip-checks", nargs="*", help="Check IDs to skip")
    parser.add_argument("--custom-checks-dir", default=None)
    parser.add_argument("--run-tfsec", action="store_true", help="Also run tfsec")
    args = parser.parse_args()

    iac_dir = os.path.abspath(args.iac_dir)
    all_findings = []

    print(f"[*] Scanning IaC: {iac_dir} (framework: {args.framework})")

    checkov_json = run_checkov(iac_dir, args.framework, args.skip_checks, args.custom_checks_dir)
    if "error" in checkov_json:
        print(f"[WARN] Checkov: {checkov_json['error']}")
    else:
        findings, passed, skipped = parse_checkov_results(checkov_json)
        all_findings.extend(findings)
        print(f"    Checkov: {len(findings)} failed, {passed} passed, {skipped} skipped")

    if args.run_tfsec and args.framework in ("terraform", "all"):
        tfsec_json = run_tfsec(iac_dir)
        if "error" not in tfsec_json:
            tfsec_findings = parse_tfsec_results(tfsec_json)
            all_findings.extend(tfsec_findings)
            print(f"    tfsec: {len(tfsec_findings)} findings")

    quality_gate = evaluate_quality_gate(all_findings, args.severity_threshold)

    report = {
        "metadata": {
            "directory": iac_dir,
            "framework": args.framework,
            "scan_date": datetime.now(timezone.utc).isoformat()
        },
        "quality_gate": quality_gate,
        "findings": [
            {
                "check_id": f.check_id, "name": f.check_name,
                "severity": f.severity, "resource": f.resource,
                "file": f.file_path, "lines": f.file_line_range,
                "guideline": f.guideline, "tool": f.tool
            }
            for f in sorted(all_findings, key=lambda x: SEVERITY_MAP.get(x.severity, 3))
        ]
    }

    output_path = os.path.abspath(args.output)
    with open(output_path, "w") as f:
        json.dump(report, f, indent=2)
    print(f"[*] Report: {output_path}")

    if quality_gate["passed"]:
        print(f"\n[PASS] Quality gate passed. {quality_gate['total_findings']} findings, none blocking.")
    else:
        print(f"\n[FAIL] {quality_gate['blocking_count']} blocking findings:")
        for d in quality_gate["blocking_details"][:10]:
            print(f"  [{d['severity']}] {d['check_id']}: {d['resource']} ({d['file']})")

    if args.fail_on_findings and not quality_gate["passed"]:
        sys.exit(1)


if __name__ == "__main__":
    main()