#!/bin/python
import boto3
from pprint import pprint, pformat
import json
import codecs
import sys
import argparse
import logging
import uuid


def parse_arguments():
    parser = argparse.ArgumentParser()
    parser.add_argument('--accesskey', help='AWS Access key', default='')
    parser.add_argument('--secretkey', help='AWS Secret key', default='')
    parser.add_argument('--region', help='AWS Default region', default='us-east-1')
    parser.add_argument('--profile', help='AWS profile', default='')
    parser.add_argument('--outfile', help='Path to output file with results', default='')
    parser.add_argument('--sourcepath', help='Source path (part of a secret name)', default='')
    parser.add_argument('--destpath', help='Destination path (part of a secret name)', default='')
    parser.add_argument('--keyalias', help='KMS key by which newly created secrets will be encrypted', default='')
    #requiredNamed = parser.add_argument_group('required named arguments')
    #requiredNamed.add_argument('--env', help='Environment prefix', required=True)
    #requiredNamed.add_argument('--projectgroup', help='Name of the project group', required=True)
    #requiredNamed.add_argument('--project', help='Name of the project', required=True)
    return parser.parse_args()

if __name__ == "__main__":
    logger = logging.getLogger('')
    logger.setLevel(logging.DEBUG)

    args = parse_arguments()
    # Using project-specific parameters and common parameters for project group
    source_path = "apollo/uat/privateapi/"
    dest_path = 'apollo/dev/privateapi/'

    # Initialize the client with credentials or with IAM role.
    if (args.accesskey and args.secretkey):
        secrets_client = boto3.client(
          'secretsmanager',
          aws_access_key_id = args.accesskey,
          aws_secret_access_key = args.secretkey,
          region_name = args.region
        )
        sts_client = boto3.client(
          'sts',
          aws_access_key_id = args.accesskey,
          aws_secret_access_key = args.secretkey,
          region_name = args.region
        )
    else:
        secrets_client = boto3.client('secretsmanager', region_name=args.region)

    print(sts_client.get_caller_identity().get('Account'))

    response = secrets_client.list_secrets()
    source_secrets = [x for x in response['SecretList'] if source_path in x['Name']]
    while 'NextToken' in response:
        response = secrets_client.list_secrets(NextToken=response['NextToken'])
        source_secrets += [x for x in response['SecretList'] if source_path in x['Name']]

    for secret in source_secrets:
        secret_value = secrets_client.get_secret_value(SecretId=secret['ARN'])['SecretString']
        secret_name = dest_path + secret['Name'].split('/')[-1]
        kms_name = args.keyalias
        print(f"Secret name: {secret_name} Secret value: {secret_value} UUID {str(uuid.uuid4())} KMS {kms_name}")
        try:
            secrets_client.create_secret(
              Name=secret_name,
              ClientRequestToken=str(uuid.uuid4()),
              KmsKeyId=kms_name,
              SecretString=secret_value,
            )
        except secrets_client.exceptions.ResourceExistsException:
            print(f"Secret {secret_name} already exists")

    response = secrets_client.list_secrets()
    dest_secrets = [x for x in response['SecretList'] if dest_path in x['Name']]
    while 'NextToken' in response:
        response = secrets_client.list_secrets(NextToken=response['NextToken'])
        dest_secrets += [x for x in response['SecretList'] if dest_path in x['Name']]

    secrets_list = [
      { "name": x['Name'].split('/')[-1], "valueFrom": x['ARN'] }
      for x in dest_secrets
    ]

    with open(args.outputfile, 'wb') as f:
        json.dump(
          secrets_list,
          codecs.getwriter('utf-8')(f),
          indent=2,
          ensure_ascii=False
        )