#!/usr/bin/env python3
"""Agent for running OWASP ZAP DAST scans and parsing results for CI/CD integration."""

import subprocess
import json
import argparse
import sys
import os


def run_baseline_scan(target_url, output_dir):
    """Run ZAP baseline scan (passive only, fast)."""
    print(f"[*] Running ZAP baseline scan on {target_url}...")
    report_path = os.path.join(output_dir, "zap_baseline.json")
    cmd = ["docker", "run", "--rm", "-v", f"{os.path.abspath(output_dir)}:/zap/wrk",
           "zaproxy/zap-stable", "zap-baseline.py", "-t", target_url,
           "-J", "zap_baseline.json", "-I"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    print(f"  Return code: {result.returncode} (0=pass, 1=warn, 2=fail)")
    return report_path, result.returncode


def run_full_scan(target_url, output_dir, mins=5):
    """Run ZAP full scan (active + passive, slower)."""
    print(f"[*] Running ZAP full scan on {target_url} ({mins} min)...")
    report_path = os.path.join(output_dir, "zap_full.json")
    cmd = ["docker", "run", "--rm", "-v", f"{os.path.abspath(output_dir)}:/zap/wrk",
           "zaproxy/zap-stable", "zap-full-scan.py", "-t", target_url,
           "-J", "zap_full.json", "-m", str(mins), "-I"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=mins * 120)
    print(f"  Return code: {result.returncode}")
    return report_path, result.returncode


def run_api_scan(target_spec, output_dir, spec_format="openapi"):
    """Run ZAP API scan against an OpenAPI/Swagger spec."""
    print(f"[*] Running ZAP API scan with {spec_format} spec...")
    report_path = os.path.join(output_dir, "zap_api.json")
    cmd = ["docker", "run", "--rm", "-v", f"{os.path.abspath(output_dir)}:/zap/wrk",
           "zaproxy/zap-stable", "zap-api-scan.py", "-t", target_spec,
           "-f", spec_format, "-J", "zap_api.json", "-I"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    print(f"  Return code: {result.returncode}")
    return report_path, result.returncode


def parse_zap_report(report_path):
    """Parse ZAP JSON report and extract findings by risk level."""
    if not os.path.exists(report_path):
        print(f"  [-] Report not found: {report_path}")
        return []
    with open(report_path) as f:
        data = json.load(f)
    alerts = []
    for site in data.get("site", []):
        for alert in site.get("alerts", []):
            alerts.append({
                "name": alert.get("name"), "risk": alert.get("riskdesc", "").split()[0],
                "confidence": alert.get("confidence"), "count": alert.get("count", 0),
                "cweid": alert.get("cweid"), "wascid": alert.get("wascid"),
                "solution": alert.get("solution", "")[:200],
            })
    risk_counts = {}
    for a in alerts:
        risk_counts[a["risk"]] = risk_counts.get(a["risk"], 0) + 1
    print(f"\n[*] Findings: {len(alerts)} unique alerts")
    for risk, count in sorted(risk_counts.items()):
        print(f"  {risk}: {count}")
    return alerts


def apply_quality_gate(alerts, fail_on="High"):
    """Apply quality gate: fail if findings at or above threshold."""
    severity_order = {"Informational": 0, "Low": 1, "Medium": 2, "High": 3}
    threshold = severity_order.get(fail_on, 3)
    blocking = [a for a in alerts if severity_order.get(a.get("risk", ""), 0) >= threshold]
    if blocking:
        print(f"\n[!] QUALITY GATE FAILED: {len(blocking)} findings at {fail_on}+ severity")
        for b in blocking[:5]:
            print(f"  - {b['risk']}: {b['name']}")
        return False
    print(f"\n[+] Quality gate passed (threshold: {fail_on})")
    return True


def generate_sarif(alerts, output_path):
    """Convert ZAP findings to SARIF format for GitHub Advanced Security."""
    rules, results = [], []
    for i, a in enumerate(alerts):
        rule_id = f"ZAP-{a.get('cweid', i)}"
        rules.append({"id": rule_id, "shortDescription": {"text": a["name"]},
                       "defaultConfiguration": {"level": "warning"}})
        results.append({"ruleId": rule_id, "message": {"text": a["name"]},
                         "level": "warning" if a["risk"] != "High" else "error"})
    sarif = {"$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0",
             "runs": [{"tool": {"driver": {"name": "OWASP ZAP", "rules": rules}},
                        "results": results}]}
    with open(output_path, "w") as f:
        json.dump(sarif, f, indent=2)
    print(f"[*] SARIF report: {output_path}")


def main():
    parser = argparse.ArgumentParser(description="OWASP ZAP DAST Pipeline Agent")
    parser.add_argument("action", choices=["baseline", "full", "api", "parse", "gate"])
    parser.add_argument("--target", help="Target URL or API spec URL")
    parser.add_argument("--report", help="Path to existing ZAP JSON report")
    parser.add_argument("--fail-on", default="High", choices=["Low", "Medium", "High"])
    parser.add_argument("--scan-mins", type=int, default=5)
    parser.add_argument("-o", "--output", default=".")
    args = parser.parse_args()

    os.makedirs(args.output, exist_ok=True)
    if args.action == "baseline":
        rpt, _ = run_baseline_scan(args.target, args.output)
        alerts = parse_zap_report(rpt)
        apply_quality_gate(alerts, args.fail_on)
    elif args.action == "full":
        rpt, _ = run_full_scan(args.target, args.output, args.scan_mins)
        alerts = parse_zap_report(rpt)
        apply_quality_gate(alerts, args.fail_on)
    elif args.action == "api":
        rpt, _ = run_api_scan(args.target, args.output)
        alerts = parse_zap_report(rpt)
        apply_quality_gate(alerts, args.fail_on)
    elif args.action == "parse":
        alerts = parse_zap_report(args.report)
        generate_sarif(alerts, os.path.join(args.output, "zap.sarif"))
    elif args.action == "gate":
        alerts = parse_zap_report(args.report)
        passed = apply_quality_gate(alerts, args.fail_on)
        sys.exit(0 if passed else 1)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
OWASP ZAP DAST Pipeline Script

Orchestrates ZAP scans, parses results, evaluates quality gates,
and generates consolidated DAST reports.

Usage:
    python process.py --target http://localhost:8080 --scan-type baseline
    python process.py --target http://staging.example.com --scan-type api --openapi-url /openapi.json
"""

import argparse
import json
import os
import subprocess
import sys
from dataclasses import dataclass, field
from datetime import datetime, timezone
from typing import Optional


RISK_LEVELS = {"High": 0, "Medium": 1, "Low": 2, "Informational": 3}


@dataclass
class ZapAlert:
    alert_id: int
    name: str
    risk: str
    confidence: str
    description: str
    url: str
    method: str
    evidence: str
    solution: str
    cwe_id: int = 0
    wasc_id: int = 0
    instances_count: int = 1


def run_zap_scan(target: str, scan_type: str = "baseline",
                 rules_file: Optional[str] = None,
                 openapi_url: Optional[str] = None,
                 report_dir: str = "/tmp/zap") -> dict:
    """Run ZAP scan via Docker and return results."""
    os.makedirs(report_dir, exist_ok=True)

    scan_scripts = {
        "baseline": "zap-baseline.py",
        "full": "zap-full-scan.py",
        "api": "zap-api-scan.py"
    }

    script = scan_scripts.get(scan_type, "zap-baseline.py")

    cmd = [
        "docker", "run", "--rm",
        "-v", f"{report_dir}:/zap/wrk",
        "--network", "host",
        "zaproxy/zap-stable",
        script,
        "-t", target,
        "-J", "report.json",
        "-r", "report.html",
        "-w", "report.md"
    ]

    if rules_file and os.path.exists(rules_file):
        cmd.extend(["-c", f"/zap/wrk/{os.path.basename(rules_file)}"])

    if scan_type == "api" and openapi_url:
        cmd.extend(["-f", "openapi"])

    cmd.extend(["-I"])  # Don't return error on warnings

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)

        json_report = os.path.join(report_dir, "report.json")
        if os.path.exists(json_report):
            with open(json_report, "r") as f:
                return json.load(f)

        return {"error": f"No report generated. stderr: {proc.stderr[:300]}"}

    except subprocess.TimeoutExpired:
        return {"error": "ZAP scan timed out after 3600 seconds"}
    except FileNotFoundError:
        return {"error": "Docker not found. Install Docker to run ZAP scans."}


def parse_zap_results(zap_json: dict) -> list:
    """Parse ZAP JSON report into ZapAlert objects."""
    alerts = []

    for site in zap_json.get("site", []):
        for alert in site.get("alerts", []):
            instances = alert.get("instances", [])
            first_instance = instances[0] if instances else {}

            alerts.append(ZapAlert(
                alert_id=int(alert.get("pluginid", 0)),
                name=alert.get("name", ""),
                risk=alert.get("riskdesc", "").split(" ")[0] if alert.get("riskdesc") else "Informational",
                confidence=alert.get("confidence", ""),
                description=alert.get("desc", "")[:300],
                url=first_instance.get("uri", ""),
                method=first_instance.get("method", ""),
                evidence=first_instance.get("evidence", "")[:200],
                solution=alert.get("solution", "")[:300],
                cwe_id=int(alert.get("cweid", 0)),
                wasc_id=int(alert.get("wascid", 0)),
                instances_count=len(instances)
            ))

    return alerts


def apply_rules(alerts: list, rules_file: Optional[str]) -> list:
    """Apply rules.tsv to override alert actions."""
    if not rules_file or not os.path.exists(rules_file):
        return alerts

    rules = {}
    with open(rules_file, "r") as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith("#"):
                continue
            parts = line.split("\t")
            if len(parts) >= 2:
                rules[int(parts[0])] = parts[1].upper()

    filtered = []
    for alert in alerts:
        action = rules.get(alert.alert_id, "WARN")
        if action != "IGNORE":
            alert.confidence = action  # Reuse field for action tracking
            filtered.append(alert)

    return filtered


def evaluate_quality_gate(alerts: list, threshold: str,
                          rules_file: Optional[str] = None) -> dict:
    """Evaluate quality gate based on alert risk levels."""
    threshold_level = RISK_LEVELS.get(threshold, 1)

    rules = {}
    if rules_file and os.path.exists(rules_file):
        with open(rules_file, "r") as f:
            for line in f:
                line = line.strip()
                if not line or line.startswith("#"):
                    continue
                parts = line.split("\t")
                if len(parts) >= 2:
                    rules[int(parts[0])] = parts[1].upper()

    blocking = []
    for a in alerts:
        action = rules.get(a.alert_id, "WARN")
        if action == "FAIL" and RISK_LEVELS.get(a.risk, 3) <= threshold_level:
            blocking.append(a)

    risk_counts = {}
    for a in alerts:
        risk_counts[a.risk] = risk_counts.get(a.risk, 0) + 1

    return {
        "passed": len(blocking) == 0,
        "threshold": threshold,
        "total_alerts": len(alerts),
        "blocking_count": len(blocking),
        "risk_counts": risk_counts,
        "blocking_details": [
            {"id": a.alert_id, "name": a.name, "risk": a.risk,
             "url": a.url, "cwe": a.cwe_id}
            for a in blocking[:15]
        ]
    }


def main():
    parser = argparse.ArgumentParser(description="OWASP ZAP DAST Pipeline")
    parser.add_argument("--target", required=True, help="Target URL to scan")
    parser.add_argument("--scan-type", default="baseline", choices=["baseline", "full", "api"])
    parser.add_argument("--rules-file", default=None, help="Path to rules.tsv")
    parser.add_argument("--openapi-url", default=None, help="OpenAPI spec URL for API scan")
    parser.add_argument("--output", default="dast-report.json")
    parser.add_argument("--report-dir", default="/tmp/zap")
    parser.add_argument("--risk-threshold", default="Medium", choices=["High", "Medium", "Low"])
    parser.add_argument("--fail-on-findings", action="store_true")
    args = parser.parse_args()

    print(f"[*] Running ZAP {args.scan_type} scan against {args.target}")

    zap_json = run_zap_scan(
        args.target, args.scan_type,
        rules_file=args.rules_file,
        openapi_url=args.openapi_url,
        report_dir=args.report_dir
    )

    if "error" in zap_json:
        print(f"[ERROR] {zap_json['error']}")
        sys.exit(2)

    alerts = parse_zap_results(zap_json)
    quality_gate = evaluate_quality_gate(alerts, args.risk_threshold, args.rules_file)

    report = {
        "metadata": {
            "target": args.target,
            "scan_type": args.scan_type,
            "scan_date": datetime.now(timezone.utc).isoformat()
        },
        "quality_gate": quality_gate,
        "alerts": [
            {"id": a.alert_id, "name": a.name, "risk": a.risk,
             "url": a.url, "method": a.method, "cwe": a.cwe_id,
             "solution": a.solution, "instances": a.instances_count}
            for a in sorted(alerts, key=lambda x: RISK_LEVELS.get(x.risk, 3))
        ]
    }

    output_path = os.path.abspath(args.output)
    with open(output_path, "w") as f:
        json.dump(report, f, indent=2)
    print(f"[*] Report: {output_path}")

    if quality_gate["passed"]:
        print(f"\n[PASS] Quality gate passed. {quality_gate['total_alerts']} alerts, none blocking.")
    else:
        print(f"\n[FAIL] {quality_gate['blocking_count']} blocking alerts:")
        for d in quality_gate["blocking_details"]:
            print(f"  [{d['risk']}] {d['id']} - {d['name']} ({d['url'][:80]})")

    if args.fail_on_findings and not quality_gate["passed"]:
        sys.exit(1)


if __name__ == "__main__":
    main()