#!/usr/bin/env python3
"""Agent for auditing HashiCorp Boundary zero trust access configuration."""

import os
import subprocess
import json
import argparse
from datetime import datetime, timezone


def run_boundary_cmd(args_list, addr, token):
    """Execute a boundary CLI command and return parsed JSON."""
    env_vars = {"BOUNDARY_ADDR": addr, "BOUNDARY_TOKEN": token}
    cmd = ["boundary"] + args_list + ["-format=json"]
    result = subprocess.run(cmd, capture_output=True, text=True, env={**dict(os.environ), **env_vars}, timeout=30)
    if result.returncode != 0:
        print(f"  [-] Error: {result.stderr.strip()[:200]}")
        return {}
    return json.loads(result.stdout) if result.stdout else {}


def list_scopes(addr, token):
    """List organization and project scopes."""
    data = run_boundary_cmd(["scopes", "list", "-scope-id=global"], addr, token)
    scopes = data.get("items", [])
    print(f"[*] Scopes: {len(scopes)}")
    for s in scopes:
        print(f"  {s.get('id')}: {s.get('name', 'unnamed')} (type={s.get('type')})")
    return scopes


def list_targets(addr, token, scope_id):
    """List targets (resources users can connect to) in a scope."""
    data = run_boundary_cmd(["targets", "list", f"-scope-id={scope_id}"], addr, token)
    targets = data.get("items", [])
    findings = []
    print(f"\n[*] Targets in scope {scope_id}: {len(targets)}")
    for t in targets:
        session_max = t.get("session_max_seconds", 0)
        conn_limit = t.get("session_connection_limit", -1)
        print(f"  {t.get('name')}: type={t.get('type')}, "
              f"max_sec={session_max}, conn_limit={conn_limit}")
        if conn_limit == -1:
            findings.append({"target": t.get("name"), "issue": "Unlimited connections",
                             "severity": "MEDIUM"})
        if session_max == 0 or session_max > 28800:
            findings.append({"target": t.get("name"),
                             "issue": f"Long session timeout ({session_max}s)", "severity": "HIGH"})
    return targets, findings


def list_host_catalogs(addr, token, scope_id):
    """List host catalogs (static or dynamic)."""
    data = run_boundary_cmd(["host-catalogs", "list", f"-scope-id={scope_id}"], addr, token)
    catalogs = data.get("items", [])
    print(f"\n[*] Host Catalogs in scope {scope_id}: {len(catalogs)}")
    for c in catalogs:
        print(f"  {c.get('id')}: {c.get('name', 'unnamed')} (type={c.get('type')})")
    return catalogs


def list_credential_stores(addr, token, scope_id):
    """List credential stores (Vault integration check)."""
    data = run_boundary_cmd(["credential-stores", "list", f"-scope-id={scope_id}"], addr, token)
    stores = data.get("items", [])
    print(f"\n[*] Credential Stores in scope {scope_id}: {len(stores)}")
    vault_stores = [s for s in stores if s.get("type") == "vault"]
    static_stores = [s for s in stores if s.get("type") == "static"]
    print(f"  Vault-backed: {len(vault_stores)}, Static: {len(static_stores)}")
    findings = []
    if static_stores:
        for s in static_stores:
            findings.append({"store": s.get("name"), "type": "static",
                             "issue": "Static credentials (not Vault-brokered)", "severity": "MEDIUM"})
    return stores, findings


def list_sessions(addr, token, scope_id):
    """List active sessions for audit."""
    data = run_boundary_cmd(["sessions", "list", f"-scope-id={scope_id}"], addr, token)
    sessions = data.get("items", [])
    print(f"\n[*] Active Sessions in scope {scope_id}: {len(sessions)}")
    for s in sessions[:10]:
        print(f"  {s.get('id')[:12]}... user={s.get('user_id', 'N/A')} "
              f"target={s.get('target_id', 'N/A')} status={s.get('status')}")
    return sessions


def check_auth_methods(addr, token, scope_id="global"):
    """Audit configured authentication methods."""
    data = run_boundary_cmd(["auth-methods", "list", f"-scope-id={scope_id}"], addr, token)
    methods = data.get("items", [])
    findings = []
    print(f"\n[*] Auth Methods: {len(methods)}")
    for m in methods:
        mtype = m.get("type", "unknown")
        print(f"  {m.get('name', 'unnamed')}: type={mtype}")
        if mtype == "password":
            findings.append({"method": m.get("name"), "type": mtype,
                             "issue": "Password-only auth (use OIDC for zero trust)", "severity": "HIGH"})
    return methods, findings


def generate_report(target_findings, cred_findings, auth_findings, output_path):
    """Generate Boundary audit report."""
    all_findings = target_findings + cred_findings + auth_findings
    report = {
        "audit_date": datetime.now(timezone.utc).isoformat(),
        "total_findings": len(all_findings),
        "target_findings": target_findings,
        "credential_findings": cred_findings,
        "auth_findings": auth_findings,
    }
    with open(output_path, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"\n[*] Report saved to {output_path}")


def main():
    parser = argparse.ArgumentParser(description="HashiCorp Boundary Zero Trust Audit Agent")
    parser.add_argument("action", choices=["scopes", "targets", "hosts", "creds",
                                           "sessions", "auth", "full-audit"])
    parser.add_argument("--addr", required=True, help="Boundary controller address")
    parser.add_argument("--token", required=True, help="Boundary auth token")
    parser.add_argument("--scope-id", default="global", help="Scope ID to audit")
    parser.add_argument("-o", "--output", default="boundary_audit.json")
    args = parser.parse_args()

    if args.action == "scopes":
        list_scopes(args.addr, args.token)
    elif args.action == "targets":
        list_targets(args.addr, args.token, args.scope_id)
    elif args.action == "hosts":
        list_host_catalogs(args.addr, args.token, args.scope_id)
    elif args.action == "creds":
        list_credential_stores(args.addr, args.token, args.scope_id)
    elif args.action == "sessions":
        list_sessions(args.addr, args.token, args.scope_id)
    elif args.action == "auth":
        check_auth_methods(args.addr, args.token)
    elif args.action == "full-audit":
        scopes = list_scopes(args.addr, args.token)
        all_tf, all_cf, all_af = [], [], []
        _, af = check_auth_methods(args.addr, args.token)
        all_af.extend(af)
        for s in scopes:
            sid = s.get("id")
            _, tf = list_targets(args.addr, args.token, sid)
            all_tf.extend(tf)
            _, cf = list_credential_stores(args.addr, args.token, sid)
            all_cf.extend(cf)
            list_sessions(args.addr, args.token, sid)
        generate_report(all_tf, all_cf, all_af, args.output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
HashiCorp Boundary Zero Trust Access Management.

Generates Boundary Terraform configurations, validates access policies,
and monitors session activity for compliance reporting.
"""

import json
import datetime
from dataclasses import dataclass, field
from pathlib import Path
from typing import Optional


@dataclass
class BoundaryScope:
    name: str
    description: str
    scope_type: str  # "org" or "project"
    parent_scope_id: str = "global"


@dataclass
class BoundaryTarget:
    name: str
    description: str
    target_type: str  # "ssh" or "tcp"
    default_port: int
    host_addresses: list = field(default_factory=list)
    session_max_seconds: int = 3600
    session_connection_limit: int = -1
    enable_recording: bool = False
    credential_type: str = "none"  # "none", "brokered", "injected"
    vault_path: str = ""


@dataclass
class BoundaryRole:
    name: str
    description: str
    scope_id: str
    grant_strings: list = field(default_factory=list)
    principal_groups: list = field(default_factory=list)


class BoundaryTerraformGenerator:
    """Generate Terraform configuration for Boundary resources."""

    def __init__(self, boundary_addr: str, vault_addr: str = ""):
        self.boundary_addr = boundary_addr
        self.vault_addr = vault_addr
        self.scopes: list[BoundaryScope] = []
        self.targets: list[BoundaryTarget] = []
        self.roles: list[BoundaryRole] = []
        self.oidc_config: dict = {}

    def add_scope(self, name: str, description: str, scope_type: str = "project",
                  parent: str = "global") -> BoundaryScope:
        scope = BoundaryScope(name=name, description=description,
                              scope_type=scope_type, parent_scope_id=parent)
        self.scopes.append(scope)
        return scope

    def add_target(self, name: str, description: str, target_type: str,
                   port: int, hosts: list, **kwargs) -> BoundaryTarget:
        target = BoundaryTarget(
            name=name, description=description, target_type=target_type,
            default_port=port, host_addresses=hosts, **kwargs
        )
        self.targets.append(target)
        return target

    def add_role(self, name: str, description: str, scope_id: str,
                 grants: list, groups: list) -> BoundaryRole:
        role = BoundaryRole(
            name=name, description=description, scope_id=scope_id,
            grant_strings=grants, principal_groups=groups
        )
        self.roles.append(role)
        return role

    def configure_oidc(self, issuer: str, client_id: str, scopes: list = None):
        self.oidc_config = {
            "issuer": issuer,
            "client_id": client_id,
            "scopes": scopes or ["openid", "profile", "groups"],
        }

    def generate_provider_block(self) -> str:
        return f'''terraform {{
  required_providers {{
    boundary = {{
      source  = "hashicorp/boundary"
      version = "~> 1.1"
    }}
  }}
}}

provider "boundary" {{
  addr             = "{self.boundary_addr}"
  recovery_kms_hcl = file("recovery_kms.hcl")
}}
'''

    def generate_scopes(self) -> str:
        blocks = []
        for scope in self.scopes:
            resource_name = scope.name.replace("-", "_")
            if scope.scope_type == "org":
                blocks.append(f'''
resource "boundary_scope" "{resource_name}" {{
  scope_id                 = "{scope.parent_scope_id}"
  name                     = "{scope.name}"
  description              = "{scope.description}"
  auto_create_admin_role   = true
  auto_create_default_role = true
}}
''')
            else:
                parent_ref = scope.parent_scope_id.replace("-", "_")
                blocks.append(f'''
resource "boundary_scope" "{resource_name}" {{
  name                     = "{scope.name}"
  description              = "{scope.description}"
  scope_id                 = boundary_scope.{parent_ref}.id
  auto_create_admin_role   = true
  auto_create_default_role = true
}}
''')
        return "\n".join(blocks)

    def generate_targets(self) -> str:
        blocks = []
        for target in self.targets:
            resource_name = target.name.replace("-", "_")
            recording_block = ""
            if target.enable_recording:
                recording_block = """
  enable_session_recording = true
  storage_bucket_id        = boundary_storage_bucket.sessions.id"""

            credential_block = ""
            if target.credential_type == "brokered" and target.vault_path:
                credential_block = f"""
  brokered_credential_source_ids = [
    boundary_credential_library_vault.{resource_name}_creds.id
  ]"""
            elif target.credential_type == "injected" and target.vault_path:
                credential_block = f"""
  injected_application_credential_source_ids = [
    boundary_credential_library_vault_ssh_certificate.{resource_name}_cert.id
  ]"""

            blocks.append(f'''
resource "boundary_target" "{resource_name}" {{
  name         = "{target.name}"
  description  = "{target.description}"
  type         = "{target.target_type}"
  scope_id     = boundary_scope.production.id
  default_port = {target.default_port}

  session_max_seconds      = {target.session_max_seconds}
  session_connection_limit = {target.session_connection_limit}{recording_block}{credential_block}
}}
''')
        return "\n".join(blocks)

    def generate_roles(self) -> str:
        blocks = []
        for role in self.roles:
            resource_name = role.name.replace("-", "_")
            grants = ",\n    ".join(f'"{g}"' for g in role.grant_strings)
            principals = ",\n    ".join(
                f'boundary_managed_group.{g.replace("-", "_")}.id'
                for g in role.principal_groups
            )
            blocks.append(f'''
resource "boundary_role" "{resource_name}" {{
  name          = "{role.name}"
  description   = "{role.description}"
  scope_id      = {role.scope_id}
  grant_strings = [
    {grants}
  ]
  principal_ids = [
    {principals}
  ]
}}
''')
        return "\n".join(blocks)

    def generate_full_config(self) -> str:
        sections = [
            self.generate_provider_block(),
            "# Scopes",
            self.generate_scopes(),
            "# Targets",
            self.generate_targets(),
            "# Roles",
            self.generate_roles(),
        ]
        return "\n".join(sections)

    def export_config(self, output_path: str):
        config = self.generate_full_config()
        path = Path(output_path)
        path.parent.mkdir(parents=True, exist_ok=True)
        with open(path, "w") as f:
            f.write(config)
        return config


class BoundaryAccessAuditor:
    """Audit and validate Boundary access configurations."""

    def __init__(self):
        self.findings: list[dict] = []

    def check_session_limits(self, targets: list[BoundaryTarget]) -> list[dict]:
        for target in targets:
            if target.session_max_seconds > 7200:
                self.findings.append({
                    "severity": "WARNING",
                    "target": target.name,
                    "finding": f"Session max exceeds 2 hours ({target.session_max_seconds}s)",
                    "recommendation": "Reduce session duration for privileged targets",
                })
            if target.session_connection_limit == -1:
                self.findings.append({
                    "severity": "INFO",
                    "target": target.name,
                    "finding": "Unlimited connections per session",
                    "recommendation": "Consider setting connection limits for sensitive targets",
                })
            if target.default_port == 22 and not target.enable_recording:
                self.findings.append({
                    "severity": "HIGH",
                    "target": target.name,
                    "finding": "SSH target without session recording",
                    "recommendation": "Enable session recording for SSH access",
                })
            if target.credential_type == "none":
                self.findings.append({
                    "severity": "MEDIUM",
                    "target": target.name,
                    "finding": "No credential management configured",
                    "recommendation": "Use Vault credential brokering or injection",
                })
        return self.findings

    def check_role_grants(self, roles: list[BoundaryRole]) -> list[dict]:
        for role in roles:
            for grant in role.grant_strings:
                if "ids=*" in grant and "actions=*" in grant:
                    self.findings.append({
                        "severity": "CRITICAL",
                        "role": role.name,
                        "finding": "Wildcard IDs and actions grant (admin-level access)",
                        "recommendation": "Restrict to specific resource types and actions",
                    })
                if "type=target" in grant and "authorize-session" in grant and "ids=*" in grant:
                    self.findings.append({
                        "severity": "HIGH",
                        "role": role.name,
                        "finding": "Role can authorize sessions to all targets",
                        "recommendation": "Restrict to specific target IDs or use target-level grants",
                    })
        return self.findings

    def generate_report(self) -> dict:
        report = {
            "audit_date": datetime.datetime.now().isoformat(),
            "total_findings": len(self.findings),
            "by_severity": {},
            "findings": self.findings,
        }
        for finding in self.findings:
            sev = finding["severity"]
            report["by_severity"][sev] = report["by_severity"].get(sev, 0) + 1
        return report


def main():
    """Generate example Boundary Terraform configuration."""
    gen = BoundaryTerraformGenerator(
        boundary_addr="https://boundary.example.com:9200",
        vault_addr="https://vault.example.com:8200"
    )

    # Create scopes
    gen.add_scope("production-org", "Production Organization", "org")
    gen.add_scope("production", "Production Infrastructure", "project", "production-org")

    # Create targets
    gen.add_target(
        "ssh-web-servers", "SSH to production web servers", "ssh", 22,
        ["10.0.1.10", "10.0.1.11"],
        session_max_seconds=3600, enable_recording=True,
        credential_type="injected", vault_path="ssh-signer/sign/web"
    )
    gen.add_target(
        "postgres-production", "Production PostgreSQL", "tcp", 5432,
        ["10.0.2.20"],
        session_max_seconds=1800,
        credential_type="brokered", vault_path="database/creds/readonly"
    )
    gen.add_target(
        "redis-cache", "Production Redis cache", "tcp", 6379,
        ["10.0.3.30"],
        session_max_seconds=900
    )

    # Create roles
    gen.add_role(
        "sre-full-access", "SRE team full production access",
        "boundary_scope.production.id",
        [
            "ids=*;type=target;actions=list,read,authorize-session",
            "ids=*;type=session;actions=list,read,cancel",
        ],
        ["sre-team"]
    )
    gen.add_role(
        "dev-readonly", "Dev team read-only access",
        "boundary_scope.production.id",
        [
            "ids=*;type=target;actions=list,read",
        ],
        ["dev-team"]
    )

    # Generate and export
    config = gen.export_config("boundary_config.tf")
    print("Generated Terraform configuration:")
    print(config[:2000])

    # Run audit
    auditor = BoundaryAccessAuditor()
    auditor.check_session_limits(gen.targets)
    auditor.check_role_grants(gen.roles)
    report = auditor.generate_report()

    print("\n" + "=" * 60)
    print("Access Audit Report")
    print("=" * 60)
    print(f"Total findings: {report['total_findings']}")
    for sev, count in report["by_severity"].items():
        print(f"  {sev}: {count}")
    for finding in report["findings"]:
        target_or_role = finding.get("target", finding.get("role", "N/A"))
        print(f"\n  [{finding['severity']}] {target_or_role}")
        print(f"    Finding: {finding['finding']}")
        print(f"    Recommendation: {finding['recommendation']}")


if __name__ == "__main__":
    main()