provisioning/core/nulib/lib_provisioning/kms/lib.nu

use std
use ../config/accessor.nu *
use ../utils/error.nu throw-error
use ../utils/interface.nu _print

def find_file [
    start_path: string
    match_path: string
    only_first: bool
] {
    mut found_path = ""
    mut search_path = $start_path
    let home_root = ($env.HOME | path dirname)
    while $found_path == "" and  $search_path != "/" and $search_path != $home_root {
        if $search_path == "" { break }
        let res = if $only_first {
            (^find $search_path -type f -name $match_path -print -quit | complete)
        } else {
            (^find $search_path -type f -name $match_path err> (if $nu.os-info.name == "windows" { "NUL" } else { "/dev/null" }) | complete)
        }
    if $res.exit_code == 0 { $found_path = ($res.stdout | str trim )  }
        $search_path = ($search_path | path dirname)
    }
    $found_path
}

export def run_cmd_kms [
    task: string
    cmd: string
    source_path: string
    error_exit: bool
]: nothing -> string {
    let kms_config = get_kms_config
    if ($kms_config | is-empty) {
        if $error_exit {
            (throw-error $"🛑 KMS configuration error" $"(_ansi red)No KMS configuration found(_ansi reset)"
                "run_cmd_kms" --span (metadata $task).span)
        } else {
            _print $"🛑 KMS configuration error (_ansi red)No KMS configuration found(_ansi reset)"
            return ""
        }
    }

    let kms_cmd = build_kms_command $cmd $source_path $kms_config
    let res = (^bash -c $kms_cmd | complete)
    
    if $res.exit_code != 0 {
        if $error_exit {
            (throw-error $"🛑 KMS error" $"(_ansi red)($source_path)(_ansi reset) ($res.stdout)"
                $"on_kms ($task)" --span (metadata $res).span)
        } else {
            _print $"🛑 KMS error (_ansi red)($source_path)(_ansi reset) ($res.exit_code)"
            return ""
        }
    }
    return $res.stdout
}

export def on_kms [
    task: string            
    source_path: string     
    output_path?: string    
    ...args                 
    --check (-c)            
    --error_exit
    --quiet
]: nothing -> string {
    match $task {
        "encrypt" | "encode" | "e" => {
            if not ( $source_path | path exists ) {
                if not $quiet { _print $"🛑 No file ($source_path) found to encrypt with KMS " }
                return ""
            }
            if (is_kms_file $source_path) {
                if not $quiet { _print $"🛑 File ($source_path) already encrypted with KMS " }
                return (open -r $source_path)
            }
            let result = (run_cmd_kms "encrypt" "encrypt" $source_path  $error_exit)
            if ($output_path | is-not-empty) {
                $result | save -f $output_path
                if not $quiet { _print $"Result saved in ($output_path) " }
            }
            return $result
        },
        "decrypt" | "decode" | "d" => {
            if not ( $source_path | path exists ) {
                if not $quiet { _print $"🛑 No file ($source_path) found to decrypt with KMS " }
                return ""
            }
            if not (is_kms_file $source_path) {
                if not $quiet { _print $"🛑 File ($source_path) is not encrypted with KMS " }
                return (open -r $source_path)
            }
            let result = (run_cmd_kms "decrypt" "decrypt" $source_path  $error_exit)
            if ($output_path | is-not-empty) {
                $result | save -f $output_path
                if not $quiet { _print $"Result saved in ($output_path) " }
            }
            return $result
        },
        "is_kms" | "i" => {
            return (is_kms_file $source_path)
        },
        _ => {
            (throw-error $"🛑 Option " $"(_ansi red)($task)(_ansi reset) undefined")
            return ""
        }
    }
}

export def is_kms_file [
    target: string
]: nothing -> bool {
    if not ($target | path exists) {
        (throw-error $"🛑 File (_ansi green_italic)($target)(_ansi reset)"
           $"(_ansi red_bold)Not found(_ansi reset)"
           $"is_kms_file ($target)"
            --span (metadata $target).span
        )
    }
    let file_content = (open $target --raw)
    # Check for KMS-specific markers in the encrypted file
    if ($file_content | find "-----BEGIN KMS ENCRYPTED DATA-----" | length) > 0 { return true }
    if ($file_content | find "kms:" | length) > 0 { return true }
    return false
}

export def decode_kms_file [
    source: string
    target: string
    quiet: bool
]: nothing -> nothing {
  if $quiet {
    on_kms "decrypt" $source --quiet
  } else {
    on_kms "decrypt" $source
  }  | save --force $target
}

def get_kms_config [] {
    let server_url = (get-kms-server)
    if ($server_url | is-empty) {
        return {}
    }

    {
        server_url: $server_url,
        auth_method: (get-kms-auth-method),
        client_cert: (get-kms-client-cert),
        client_key: (get-kms-client-key),
        ca_cert: (get-kms-ca-cert),
        api_token: (get-kms-api-token),
        username: (get-kms-username),
        password: (get-kms-password),
        timeout: (get-kms-timeout | into int),
        verify_ssl: (get-kms-verify-ssl | into bool)
    }
}

def build_kms_command [
    operation: string
    file_path: string
    config: record
]: nothing -> string {
    mut cmd_parts = []
    
    # Base command - using curl to interact with Cosmian KMS REST API
    $cmd_parts = ($cmd_parts | append "curl")
    
    # SSL verification
    if not $config.verify_ssl {
        $cmd_parts = ($cmd_parts | append "-k")
    }
    
    # Timeout
    $cmd_parts = ($cmd_parts | append $"--connect-timeout ($config.timeout)")
    
    # Authentication
    match $config.auth_method {
        "certificate" => {
            if ($config.client_cert | is-not-empty) and ($config.client_key | is-not-empty) {
                $cmd_parts = ($cmd_parts | append $"--cert ($config.client_cert)")
                $cmd_parts = ($cmd_parts | append $"--key ($config.client_key)")
            }
            if ($config.ca_cert | is-not-empty) {
                $cmd_parts = ($cmd_parts | append $"--cacert ($config.ca_cert)")
            }
        },
        "token" => {
            if ($config.api_token | is-not-empty) {
                $cmd_parts = ($cmd_parts | append $"-H 'Authorization: Bearer ($config.api_token)'")
            }
        },
        "basic" => {
            if ($config.username | is-not-empty) and ($config.password | is-not-empty) {
                $cmd_parts = ($cmd_parts | append $"--user ($config.username):($config.password)")
            }
        }
    }
    
    # Operation specific parameters
    match $operation {
        "encrypt" => {
            $cmd_parts = ($cmd_parts | append "-X POST")
            $cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
            $cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
            $cmd_parts = ($cmd_parts | append $"($config.server_url)/encrypt")
        },
        "decrypt" => {
            $cmd_parts = ($cmd_parts | append "-X POST")
            $cmd_parts = ($cmd_parts | append $"-H 'Content-Type: application/octet-stream'")
            $cmd_parts = ($cmd_parts | append $"--data-binary @($file_path)")
            $cmd_parts = ($cmd_parts | append $"($config.server_url)/decrypt")
        }
    }
    
    ($cmd_parts | str join " ")
}

export def get_def_kms_config [
    current_path: string
]: nothing -> string {
    let use_kms = (get-provisioning-use-kms)
    if ($use_kms | is-empty) { return ""}
    let start_path = if ($current_path | path exists) {
        $current_path
    } else {
        $"((get-kloud-path))/($current_path)"
    }
    let kms_file = "kms.yaml"
    mut provisioning_kms = (find_file $start_path $kms_file true )
    if $provisioning_kms == "" and ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file | path exists ) {
        $provisioning_kms = ($env.HOME | path join ".config"| path join "provisioning" | path join $kms_file )
    }
    if $provisioning_kms == "" and ($env.HOME | path join ".provisioning"| path join $kms_file | path exists ) {
       $provisioning_kms = ($env.HOME | path join ".provisioning"| path join $kms_file )
    }
    if $provisioning_kms == "" {
        _print $"❗Error no (_ansi red_bold)($kms_file)(_ansi reset) file for KMS operations found "
        exit 1
    }
    ($provisioning_kms | default "")
}