#!/usr/bin/python3
import argparse
import getpass
import json
import os
import ssl
import sys
import urllib.error
import urllib.request

parser = argparse.ArgumentParser(
    description="Unwrap a response wrapping token and store the AppRole secret ID in the JSON configuration file.",
)
parser.add_argument("config", help="path to the JSON configuration file of the instance")
args = parser.parse_args()

with open(args.config) as file:
    config = json.load(file)

if "vault_addr" not in config:
    sys.exit(f"vault_addr is not set in {args.config}")

context = ssl.create_default_context(cafile=config.get("vault_cacert") or None)
request = urllib.request.Request(
    f"{config['vault_addr'].rstrip('/')}/v1/sys/wrapping/unwrap",
    data=b"{}",
    headers={
        "Content-Type": "application/json",
        "X-Vault-Token": getpass.getpass("Wrapping token: "),
    },
    method="POST",
)
try:
    with urllib.request.urlopen(request, context=context) as response:
        config["secret_id"] = json.load(response)["data"]["secret_id"]
except urllib.error.HTTPError as error:
    sys.exit(f"Vault returned {error.code} for sys/wrapping/unwrap: {error.read().decode()}")

descriptor = os.open(args.config, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
os.fchmod(descriptor, 0o600)
with os.fdopen(descriptor, "w") as file:
    json.dump(config, file, indent=2)
    file.write("\n")
print(f"The secret ID was written to {args.config}")