"""Lambda deactivate-iam-user function module."""

from lambdacommon.common_config import logger
import botocore
import boto3

import json
from datetime import datetime

client = boto3.client('iam')

now = datetime.now()
dt_string = now.strftime('%Y-%m-%d')


def get_access_keys(iam_user):
    """Get IAM user's access keys.

    Args:
        iam_user: iam_user name

     Returns:
        list: User access keys

    """
    response = client.list_access_keys(UserName=iam_user)
    access_keys = json.loads(json.dumps(response, default=str))['AccessKeyMetadata']  # noqa: E501
    return access_keys


def update_access_keys(iam_user, access_keys):
    """Update IAM user's access keys.

    Args:
        iam_user: iam_user name
        access_keys: List of users access keys

    """
    for each_key in access_keys:
        client.update_access_key(
            UserName=iam_user,
            AccessKeyId=each_key['AccessKeyId'],
            Status='Inactive'
        )


def delete_user_login_profile(iam_user):
    """Delete IAM login profile.

    Args:
        iam_user: iam_user name

    """
    try:
        client.delete_login_profile(UserName=iam_user)
    except botocore.exceptions.ClientError as error:
        if error.response['Error']['Message'].startswith('Login Profile'):
            logger.info('No login profile found for user')


def add_deactivated_tag(iam_user):
    """Add tag to iam user.

    Args:
        iam_user: iam_user name

    """
    client.tag_user(
        UserName=iam_user,
        Tags=[{
            'Key': 'Deactivated',
            'Value': dt_string
        }, ])

    logger.info('Add Deactivated tag to IAM user')


def handler(event, context):
    """Lambda entry point."""
    try:
        logger.info('Deactivate IAM user Lambda started')
        iam_user = event['user']
        access_keys = get_access_keys(iam_user)
        if access_keys:
            logger.info('Setting IAM access keys to inactive')
            update_access_keys(iam_user, access_keys)
        else:
            logger.info('No IAM access keys found')
        delete_user_login_profile(iam_user)
        add_deactivated_tag(iam_user)
        return {'status': 'OK'}
    except Exception as e:
        logger.exception(str(e))
        raise e