#!/usr/bin/env python3
"""Agent for managing Saviynt access recertification campaigns via REST API."""

import os
import requests
import json
import argparse
from datetime import datetime, timezone
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def authenticate(base_url, username, password):
    """Authenticate to Saviynt EIC and get OAuth token."""
    url = f"{base_url}/ECM/api/login"
    payload = {"username": username, "password": password}
    resp = requests.post(url, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    token = resp.json().get("access_token")
    print(f"[*] Authenticated to Saviynt EIC")
    return {"Authorization": f"Bearer {token}"}


def list_campaigns(base_url, headers, status="active"):
    """List certification campaigns."""
    url = f"{base_url}/ECM/api/v5/listCertification"
    payload = {"certificationstatus": status, "max": 50, "offset": 0}
    resp = requests.post(url, headers=headers, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    campaigns = resp.json().get("certifications", [])
    print(f"\n[*] Campaigns ({status}): {len(campaigns)}")
    for c in campaigns:
        print(f"  {c.get('certificationname')} - certifier: {c.get('certifier', 'N/A')} "
              f"| due: {c.get('duedate', 'N/A')}")
    return campaigns


def get_campaign_details(base_url, headers, cert_key):
    """Get detailed campaign status including item counts."""
    url = f"{base_url}/ECM/api/v5/getCertificationDetails"
    payload = {"certkey": cert_key}
    resp = requests.post(url, headers=headers, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    details = resp.json()
    total = details.get("totalitems", 0)
    certified = details.get("certifieditems", 0)
    revoked = details.get("revokeditems", 0)
    pending = total - certified - revoked
    print(f"\n[*] Campaign {cert_key}: total={total}, certified={certified}, "
          f"revoked={revoked}, pending={pending}")
    return details


def get_pending_items(base_url, headers, cert_key, max_items=100):
    """Get items pending review in a certification campaign."""
    url = f"{base_url}/ECM/api/v5/getCertificationItems"
    payload = {"certkey": cert_key, "status": "pending", "max": max_items, "offset": 0}
    resp = requests.post(url, headers=headers, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    items = resp.json().get("certificationitems", [])
    print(f"\n[*] Pending items: {len(items)}")
    high_risk = [i for i in items if i.get("risk_score", 0) > 7]
    print(f"  High-risk items (score > 7): {len(high_risk)}")
    for i in high_risk[:10]:
        print(f"  [!] {i.get('username')} - {i.get('entitlement_value')} "
              f"(risk: {i.get('risk_score')})")
    return items


def certify_items(base_url, headers, cert_key, item_ids, action="certify"):
    """Certify or revoke items in a campaign."""
    url = f"{base_url}/ECM/api/v5/certifyItems"
    payload = {"certkey": cert_key, "itemids": item_ids, "action": action,
               "comments": f"Auto-{action} by recertification agent"}
    resp = requests.post(url, headers=headers, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    print(f"[*] {action.capitalize()}d {len(item_ids)} items in campaign {cert_key}")
    return resp.json()


def check_overdue_campaigns(base_url, headers):
    """Find campaigns past their due date."""
    url = f"{base_url}/ECM/api/v5/listCertification"
    payload = {"certificationstatus": "active", "max": 200, "offset": 0}
    resp = requests.post(url, headers=headers, json=payload, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    campaigns = resp.json().get("certifications", [])
    now = datetime.now(timezone.utc)
    overdue = []
    for c in campaigns:
        due = c.get("duedate", "")
        if due:
            try:
                due_dt = datetime.fromisoformat(due.replace("Z", "+00:00"))
                if due_dt < now:
                    overdue.append({"name": c.get("certificationname"),
                                    "due": due, "certifier": c.get("certifier")})
            except ValueError:
                pass
    print(f"\n[*] Overdue campaigns: {len(overdue)}")
    for o in overdue:
        print(f"  [!] {o['name']} (due: {o['due']}, certifier: {o['certifier']})")
    return overdue


def generate_report(campaigns, overdue, output_path):
    """Generate recertification status report."""
    report = {"report_date": datetime.now(timezone.utc).isoformat(),
              "active_campaigns": len(campaigns), "overdue_campaigns": len(overdue),
              "campaigns": campaigns[:50], "overdue": overdue}
    with open(output_path, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"\n[*] Report saved to {output_path}")


def main():
    parser = argparse.ArgumentParser(description="Saviynt Access Recertification Agent")
    parser.add_argument("action", choices=["list", "details", "pending", "overdue", "full-audit"])
    parser.add_argument("--url", required=True, help="Saviynt EIC base URL")
    parser.add_argument("--username", required=True)
    parser.add_argument("--password", required=True)
    parser.add_argument("--cert-key", help="Certification campaign key")
    parser.add_argument("-o", "--output", default="recert_report.json")
    args = parser.parse_args()

    headers = authenticate(args.url, args.username, args.password)
    if args.action == "list":
        list_campaigns(args.url, headers)
    elif args.action == "details" and args.cert_key:
        get_campaign_details(args.url, headers, args.cert_key)
    elif args.action == "pending" and args.cert_key:
        get_pending_items(args.url, headers, args.cert_key)
    elif args.action == "overdue":
        check_overdue_campaigns(args.url, headers)
    elif args.action == "full-audit":
        campaigns = list_campaigns(args.url, headers)
        overdue = check_overdue_campaigns(args.url, headers)
        generate_report(campaigns, overdue, args.output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Saviynt Access Recertification Campaign Manager

Manages access recertification campaigns via Saviynt REST API,
tracks campaign progress, and generates compliance reports.

Requirements:
    pip install requests pandas
"""

import json
import logging
import sys
from datetime import datetime, timedelta, timezone

try:
    import requests
except ImportError:
    print("[ERROR] requests required: pip install requests")
    sys.exit(1)

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger("saviynt_recert")


class SaviyntCampaignManager:
    """Manage Saviynt access recertification campaigns."""

    def __init__(self, base_url, username, password):
        self.base_url = base_url.rstrip("/")
        self.token = self._authenticate(username, password)

    def _authenticate(self, username, password):
        """Authenticate and retrieve API token."""
        resp = requests.post(
            f"{self.base_url}/ECM/api/login",
            json={"username": username, "password": password},
        )
        resp.raise_for_status()
        token = resp.json().get("access_token")
        if not token:
            raise Exception("Authentication failed: no token returned")
        logger.info("Authenticated to Saviynt EIC")
        return token

    def _api_call(self, method, endpoint, json_data=None):
        headers = {
            "Authorization": f"Bearer {self.token}",
            "Content-Type": "application/json",
        }
        url = f"{self.base_url}{endpoint}"
        resp = requests.request(method, url, headers=headers, json=json_data)
        resp.raise_for_status()
        return resp.json()

    def create_campaign(self, name, campaign_type, certifier_type,
                         due_days=14, scope=None):
        """Create a new certification campaign."""
        due_date = (datetime.now(timezone.utc) + timedelta(days=due_days)).strftime(
            "%Y-%m-%d"
        )
        payload = {
            "campaignname": name,
            "campaigntype": campaign_type,  # UserManager, EntitlementOwner, Application
            "certifier": certifier_type,
            "duedate": due_date,
            "reminderdays": "7,10,13",
            "autorevoke": True,
            "autorevokedays": due_days + 1,
            "status": "New",
        }
        if scope:
            payload["scope"] = scope

        result = self._api_call("POST", "/ECM/api/v5/createCampaign", payload)
        campaign_id = result.get("campaignId")
        logger.info(f"Campaign created: {name} (ID: {campaign_id})")
        return result

    def launch_campaign(self, campaign_id):
        """Launch an existing campaign, sending notifications to certifiers."""
        result = self._api_call(
            "POST", "/ECM/api/v5/launchCampaign",
            {"campaignId": campaign_id}
        )
        logger.info(f"Campaign {campaign_id} launched")
        return result

    def get_campaign_status(self, campaign_id):
        """Get campaign progress and statistics."""
        result = self._api_call(
            "GET", f"/ECM/api/v5/getCampaignDetails?campaignId={campaign_id}"
        )
        return {
            "campaign_id": campaign_id,
            "name": result.get("campaignname"),
            "status": result.get("status"),
            "total_items": result.get("totalLineItems", 0),
            "certified": result.get("certifiedCount", 0),
            "revoked": result.get("revokedCount", 0),
            "pending": result.get("pendingCount", 0),
            "completion_pct": result.get("completionPercentage", 0),
            "due_date": result.get("duedate"),
        }

    def get_all_campaigns(self, status=None):
        """List all certification campaigns."""
        params = {}
        if status:
            params["status"] = status
        result = self._api_call("GET", "/ECM/api/v5/getCampaigns")
        campaigns = result.get("campaigns", [])
        if status:
            campaigns = [c for c in campaigns if c.get("status") == status]
        return campaigns

    def get_certification_items(self, campaign_id, status_filter=None):
        """Get individual certification line items for a campaign."""
        result = self._api_call(
            "POST", "/ECM/api/v5/getCertificationDetails",
            {"campaignId": campaign_id, "max": 1000}
        )
        items = result.get("certifications", [])
        if status_filter:
            items = [i for i in items if i.get("status") == status_filter]
        return items

    def generate_compliance_report(self, campaign_id):
        """Generate a compliance-ready report for a completed campaign."""
        status = self.get_campaign_status(campaign_id)
        items = self.get_certification_items(campaign_id)

        certified_items = [i for i in items if i.get("decision") == "Certify"]
        revoked_items = [i for i in items if i.get("decision") == "Revoke"]
        pending_items = [i for i in items if not i.get("decision")]

        report = {
            "report_title": "Access Recertification Compliance Report",
            "campaign_name": status.get("name"),
            "campaign_id": campaign_id,
            "generated_at": datetime.now(timezone.utc).isoformat(),
            "metrics": {
                "total_items_reviewed": status["total_items"],
                "certified": status["certified"],
                "revoked": status["revoked"],
                "pending": status["pending"],
                "completion_rate": f"{status['completion_pct']}%",
                "certification_rate": (
                    f"{(status['certified'] / status['total_items'] * 100):.1f}%"
                    if status["total_items"] else "N/A"
                ),
                "revocation_rate": (
                    f"{(status['revoked'] / status['total_items'] * 100):.1f}%"
                    if status["total_items"] else "N/A"
                ),
            },
            "findings": [],
        }

        if pending_items:
            report["findings"].append({
                "severity": "High",
                "finding": f"{len(pending_items)} items not reviewed by due date",
                "action": "Auto-revoke or manual follow-up required",
            })

        revoke_rate = status["revoked"] / status["total_items"] if status["total_items"] else 0
        if revoke_rate > 0.20:
            report["findings"].append({
                "severity": "Medium",
                "finding": f"High revocation rate ({revoke_rate:.0%}) suggests over-provisioning",
                "action": "Review provisioning policies and role definitions",
            })

        return report


class RecertificationScheduler:
    """Schedule recurring certification campaigns based on compliance needs."""

    def __init__(self):
        self.schedules = []

    def add_schedule(self, name, frequency_days, campaign_type,
                      certifier_type, scope=None):
        """Add a recurring certification schedule."""
        self.schedules.append({
            "name": name,
            "frequency_days": frequency_days,
            "campaign_type": campaign_type,
            "certifier_type": certifier_type,
            "scope": scope,
            "last_run": None,
        })

    def get_due_campaigns(self):
        """Check which campaigns are due to run."""
        now = datetime.now(timezone.utc)
        due = []
        for schedule in self.schedules:
            if schedule["last_run"] is None:
                due.append(schedule)
            else:
                next_run = schedule["last_run"] + timedelta(days=schedule["frequency_days"])
                if now >= next_run:
                    due.append(schedule)
        return due

    def export_schedule(self, output_path):
        """Export certification schedule for documentation."""
        with open(output_path, "w") as f:
            json.dump({
                "schedules": self.schedules,
                "exported_at": datetime.now(timezone.utc).isoformat(),
            }, f, indent=2, default=str)
        logger.info(f"Schedule exported to {output_path}")


if __name__ == "__main__":
    print("=" * 60)
    print("Saviynt Access Recertification Campaign Manager")
    print("=" * 60)
    print()
    print("Usage:")
    print("  mgr = SaviyntCampaignManager('https://tenant.saviyntcloud.com',")
    print("      'admin', 'password')")
    print("  mgr.create_campaign('Q1 Review', 'UserManager', 'Manager')")
    print("  mgr.launch_campaign(campaign_id)")
    print("  report = mgr.generate_compliance_report(campaign_id)")