import json, os, re, ssl, sys, urllib.error, urllib.request

DEFAULT_BASE = "https://hashlookup.circl.lu"


def _cfg():
    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))


def _inputs():
    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))


def _base(cfg):
    return (str(cfg.get("base_url") or "").strip() or DEFAULT_BASE).rstrip("/")


def _ctx(cfg):
    if cfg.get("insecure") in (True, "true", "True", 1, "1"):
        c = ssl.create_default_context()
        c.check_hostname = False
        c.verify_mode = ssl.CERT_NONE
        return c
    return None


def call(cfg, path, body=None):
    data = json.dumps(body).encode("utf-8") if body is not None else None
    headers = {"Accept": "application/json", "User-Agent": "riposte-soar"}
    if data is not None:
        headers["Content-Type"] = "application/json"
    req = urllib.request.Request(_base(cfg) + path, data=data, headers=headers, method="POST" if data is not None else "GET")
    with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r:
        raw = r.read()
        return json.loads(raw) if raw else {}


def _run(fn):
    try:
        print(json.dumps(fn(_cfg(), _inputs())))
    except urllib.error.HTTPError as e:
        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
        sys.exit(1)
    except Exception as e:
        print(json.dumps({"error": str(e)}))
        sys.exit(1)


KINDS = {32: "md5", 40: "sha1", 64: "sha256"}


def kind_of(h):
    h = h.strip().lower()
    if not re.fullmatch(r"[0-9a-f]+", h) or len(h) not in KINDS:
        raise Exception("not an MD5, SHA-1 or SHA-256 hash: " + h)
    return KINDS[len(h)], h


def annotate(rec):
    # score: 0 for a known file, 100 when CIRCL itself flags the record as
    # malicious — what an enrichment rule maps with benign 0 / malicious 100.
    rec = dict(rec)
    rec["known"] = True
    rec["score"] = 100 if rec.get("KnownMalicious") else 0
    return rec


def parse_list(v):
    if isinstance(v, list):
        return [str(x) for x in v]
    s = str(v or "").strip()
    if s.startswith("["):
        return [str(x) for x in json.loads(s)]
    return [x for x in re.split(r"[\s,;]+", s) if x]


def main(cfg, inputs):
    groups = {"md5": [], "sha1": [], "sha256": []}
    for raw in parse_list(inputs.get("hashes")):
        kind, h = kind_of(raw)
        if h not in groups[kind]:
            groups[kind].append(h)
    known, unknown = [], []
    for kind in ("md5", "sha1"):
        hs = groups[kind]
        for i in range(0, len(hs), 500):
            chunk = hs[i:i + 500]
            res = call(cfg, "/bulk/" + kind, {"hashes": chunk})
            found = set()
            for rec in res if isinstance(res, list) else []:
                key = str(rec.get("MD5" if kind == "md5" else "SHA-1", "")).lower()
                if key and "message" not in rec:
                    found.add(key)
                    known.append(annotate(rec))
            unknown.extend(h for h in chunk if h not in found)
    for h in groups["sha256"]:
        try:
            known.append(annotate(call(cfg, "/lookup/sha256/" + h)))
        except urllib.error.HTTPError as e:
            if e.code != 404:
                raise
            unknown.append(h)
    return {"known": known, "unknown": unknown, "known_count": len(known), "unknown_count": len(unknown)}


_run(main)