#!/usr/bin/python3
import argparse
import json
import ssl
import sys
import urllib.error
import urllib.request

parser = argparse.ArgumentParser(
    description="Log in to Vault with AppRole using a JSON configuration file and print the token properties.",
)
parser.add_argument("config", help="path to the JSON configuration file of the instance")
args = parser.parse_args()

with open(args.config) as file:
    config = json.load(file)

for name in ("vault_addr", "role_id", "secret_id"):
    if name not in config:
        sys.exit(f"{name} is not set in {args.config}")

context = ssl.create_default_context(cafile=config.get("vault_cacert") or None)
request = urllib.request.Request(
    f"{config['vault_addr'].rstrip('/')}/v1/auth/approle/login",
    data=json.dumps({"role_id": config["role_id"], "secret_id": config["secret_id"]}).encode(),
    headers={"Content-Type": "application/json"},
    method="POST",
)
try:
    with urllib.request.urlopen(request, context=context) as response:
        auth = json.load(response)["auth"]
except urllib.error.HTTPError as error:
    sys.exit(f"Vault returned {error.code} for auth/approle/login: {error.read().decode()}")

print(f"Login succeeded: token type {auth['token_type']}, policies {auth['token_policies']}, valid for {auth['lease_duration']} seconds")