import json, os, re, ssl, sys, urllib.error, urllib.request

DEFAULT_BASE = "https://hashlookup.circl.lu"


def _cfg():
    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))


def _inputs():
    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))


def _base(cfg):
    return (str(cfg.get("base_url") or "").strip() or DEFAULT_BASE).rstrip("/")


def _ctx(cfg):
    if cfg.get("insecure") in (True, "true", "True", 1, "1"):
        c = ssl.create_default_context()
        c.check_hostname = False
        c.verify_mode = ssl.CERT_NONE
        return c
    return None


def call(cfg, path, body=None):
    data = json.dumps(body).encode("utf-8") if body is not None else None
    headers = {"Accept": "application/json", "User-Agent": "riposte-soar"}
    if data is not None:
        headers["Content-Type"] = "application/json"
    req = urllib.request.Request(_base(cfg) + path, data=data, headers=headers, method="POST" if data is not None else "GET")
    with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r:
        raw = r.read()
        return json.loads(raw) if raw else {}


def _run(fn):
    try:
        print(json.dumps(fn(_cfg(), _inputs())))
    except urllib.error.HTTPError as e:
        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
        sys.exit(1)
    except Exception as e:
        print(json.dumps({"error": str(e)}))
        sys.exit(1)


KINDS = {32: "md5", 40: "sha1", 64: "sha256"}


def kind_of(h):
    h = h.strip().lower()
    if not re.fullmatch(r"[0-9a-f]+", h) or len(h) not in KINDS:
        raise Exception("not an MD5, SHA-1 or SHA-256 hash: " + h)
    return KINDS[len(h)], h


def annotate(rec):
    # score: 0 for a known file, 100 when CIRCL itself flags the record as
    # malicious — what an enrichment rule maps with benign 0 / malicious 100.
    rec = dict(rec)
    rec["known"] = True
    rec["score"] = 100 if rec.get("KnownMalicious") else 0
    return rec


def main(cfg, inputs):
    info = call(cfg, "/info")
    return {"ok": True, "info": info}


_run(main)