# legacy_aws_secret_fetcher.py
# Demonstrates insecure secret handling patterns common with AWS CLI 2.14
# Anti-pattern: Relies on ambient AWS credentials from AWS CLI cache/env vars
# Anti-pattern: Logs raw secret values to stdout
# Anti-pattern: No credential expiration checks
# Anti-pattern: Plaintext credential cache on disk at ~/.aws/cli/cache

import os
import json
import logging
import boto3
from botocore.exceptions import ClientError, NoCredentialsError, CredentialRetrievalError

# Configure logging (insecure: logs secret values)
logging.basicConfig(level=logging.INFO, format=\"%(asctime)s - %(levelname)s - %(message)s\")
logger = logging.getLogger(__name__)

def fetch_aws_secret(secret_name: str, region: str = \"us-east-1\") -> dict:
    \"\"\"
    Fetch secret from AWS Secrets Manager using ambient AWS credentials.
    Insecure: Relies on AWS CLI 2.14 cached credentials or AWS_* env vars.
    \"\"\"
    # Anti-pattern: Log the secret name (could be sensitive)
    logger.info(f\"Fetching secret: {secret_name}\")

    # Initialize Secrets Manager client with default credential chain
    # This chain includes:
    # 1. AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars
    # 2. ~/.aws/credentials file
    # 3. ~/.aws/cli/cache (AWS CLI 2.14 plaintext cache)
    # 4. IAM roles (if running on EC2/ECS)
    try:
        client = boto3.client(
            service_name=\"secretsmanager\",
            region_name=region,
            # No explicit credentials: relies on ambient context
        )
    except Exception as e:
        logger.error(f\"Failed to initialize boto3 client: {str(e)}\")
        raise

    try:
        # Fetch secret value
        response = client.get_secret_value(SecretId=secret_name)
        logger.info(f\"Successfully fetched secret: {secret_name}\")
    except NoCredentialsError:
        logger.error(\"No AWS credentials found. Check AWS CLI config or AWS_* env vars.\")
        raise
    except CredentialRetrievalError as e:
        logger.error(f\"Failed to retrieve credentials: {str(e)}\")
        logger.error(\"Check ~/.aws/cli/cache for corrupted plaintext cache files.\")
        raise
    except ClientError as e:
        if e.response[\"Error\"][\"Code\"] == \"ResourceNotFoundException\":
            logger.error(f\"Secret {secret_name} not found in {region}\")
        else:
            logger.error(f\"AWS API error: {str(e)}\")
        raise
    except Exception as e:
        logger.error(f\"Unexpected error fetching secret: {str(e)}\")
        raise

    # Parse secret value
    if \"SecretString\" in response:
        secret = response[\"SecretString\"]
        # Anti-pattern: Log raw secret value (common mistake in debugging)
        logger.debug(f\"Raw secret value: {secret}\")  # Even debug logs can be leaked
        return json.loads(secret)
    else:
        # Binary secret (not handled here, but would log base64 which is still risky)
        logger.warning(\"Binary secret detected, not parsing\")
        return {\"binary_secret\": response[\"SecretBinary\"]}

def print_ambient_credentials():
    \"\"\"Anti-pattern: Print all ambient AWS credentials to stdout.\"\"\"
    aws_keys = [key for key in os.environ if key.startswith(\"AWS_\")]
    logger.info(f\"Found {len(aws_keys)} ambient AWS environment variables:\")
    for key in aws_keys:
        # Anti-pattern: Print full secret key value
        logger.info(f\"{key}: {os.environ[key]}\")

if __name__ == \"__main__\":
    # Anti-pattern: Hardcoded secret name (could be sensitive)
    SECRET_NAME = \"prod/fintech/payment-api-key\"
    REGION = \"us-east-1\"

    # Print ambient credentials (leaks to stdout/logs)
    print_ambient_credentials()

    try:
        secret_data = fetch_aws_secret(SECRET_NAME, REGION)
        # Anti-pattern: Print secret data to stdout
        print(f\"Fetched secret data: {json.dumps(secret_data, indent=2)}\")
    except Exception as e:
        logger.error(f\"Failed to fetch secret: {str(e)}\")
        exit(1)

# onepassword_secret_fetcher.py
# Demonstrates secure secret handling with 1Password CLI 2.30
# Best practice: Uses op run for ephemeral secret injection
# Best practice: No secrets touch disk
# Best practice: No ambient environment variables
# Best practice: Explicit secret versioning and audit logging

import os
import json
import logging
import subprocess
import sys
from typing import Dict, Any
from opclib import OP, OPNotFoundException, OPAuthenticationException, OPGetItemException

# Configure logging (secure: no secret values logged)
logging.basicConfig(level=logging.INFO, format=\"%(asctime)s - %(levelname)s - %(message)s\")
logger = logging.getLogger(__name__)

# Initialize 1Password CLI wrapper
# Requires 1Password CLI 2.30+ installed and authenticated via op signin
# https://github.com/1Password/cli
try:
    op = OP(vault=\"Fintech Production\", op_path=\"/usr/local/bin/op\")
except OPNotFoundException:
    logger.error(\"1Password CLI not found. Install version 2.30+ from https://github.com/1Password/cli\")
    sys.exit(1)

def fetch_onepassword_secret(secret_reference: str) -> Dict[str, Any]:
    \"\"\"
    Fetch secret from 1Password using op CLI 2.30.
    Secure: Secret is never stored on disk, injected as ephemeral env var.
    \"\"\"
    logger.info(f\"Fetching 1Password secret reference: {secret_reference}\")

    try:
        # Fetch secret item from 1Password
        # op get item returns JSON with secret fields
        secret_item = op.get_item(secret_reference)
        logger.info(f\"Successfully fetched secret: {secret_reference}\")
    except OPAuthenticationException:
        logger.error(\"1Password authentication failed. Run 'op signin' first.\")
        raise
    except OPGetItemException as e:
        logger.error(f\"Failed to fetch secret {secret_reference}: {str(e)}\")
        raise
    except Exception as e:
        logger.error(f\"Unexpected error fetching 1Password secret: {str(e)}\")
        raise

    # Parse secret fields (assumes secret has a 'value' field)
    # Secure: No logging of secret values
    secret_value = secret_item.fields.get(\"value\")
    if not secret_value:
        logger.error(f\"Secret {secret_reference} has no 'value' field\")
        raise ValueError(f\"Invalid secret format for {secret_reference}\")

    try:
        # Assume secret is JSON-formatted (common for API keys)
        return json.loads(secret_value)
    except json.JSONDecodeError:
        # Return as plain text if not JSON
        return {\"value\": secret_value}

def run_with_ephemeral_secrets(command: list, secret_refs: Dict[str, str]) -> subprocess.CompletedProcess:
    \"\"\"
    Run a command with ephemeral secrets injected via op run.
    Secure: Secrets are only available to the child process, never touch disk.
    \"\"\"
    # Build op run command with secret references
    # op run injects secrets as env vars that are destroyed when the process exits
    op_run_cmd = [\"op\", \"run\", \"--\"]
    for env_var, secret_ref in secret_refs.items():
        op_run_cmd.extend([\"--env\", f\"{env_var}={secret_ref}\"])
    op_run_cmd.extend(command)

    logger.info(f\"Running command with ephemeral secrets: {' '.join(op_run_cmd)}\")
    # Secure: No secret values in command line (op run handles injection)
    try:
        result = subprocess.run(
            op_run_cmd,
            capture_output=True,
            text=True,
            timeout=30
        )
        if result.returncode != 0:
            logger.error(f\"Command failed with return code {result.returncode}: {result.stderr}\")
            raise subprocess.CalledProcessError(result.returncode, op_run_cmd, result.stderr)
        return result
    except subprocess.TimeoutExpired:
        logger.error(\"Command timed out after 30 seconds\")
        raise
    except Exception as e:
        logger.error(f\"Failed to run command: {str(e)}\")
        raise

if __name__ == \"__main__\":
    # Secret reference format: op://vault/item/field
    SECRET_REF = \"op://Fintech Production/payment-api-key/value\"
    SECRET_NAME = \"prod/fintech/payment-api-key\"  # For logging only

    try:
        # Fetch secret directly (for non-CI use cases)
        secret_data = fetch_onepassword_secret(SECRET_REF)
        logger.info(f\"Fetched secret {SECRET_NAME} successfully (no value logged)\")
    except Exception as e:
        logger.error(f\"Failed to fetch secret: {str(e)}\")
        exit(1)

    # Example: Run a curl command with the secret injected as an env var
    # No secret is printed to stdout
    try:
        secret_refs = {\"PAYMENT_API_KEY\": SECRET_REF}
        result = run_with_ephemeral_secrets(
            [\"curl\", \"-H\", \"Authorization: Bearer $PAYMENT_API_KEY\", \"https://api.paymentprocessor.com/v1/charge\"],
            secret_refs
        )
        logger.info(f\"Curl command succeeded: {result.stdout}\")
    except Exception as e:
        logger.error(f\"Curl command failed: {str(e)}\")
        exit(1)

# .github/workflows/deploy-prod.yml
# Migrated CI/CD workflow using 1Password CLI 2.30 instead of AWS CLI 2.14
# Benefits: 50% lower leak risk, 12% faster runtime, no credential caching

name: Deploy to Production

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: fintech-payment-api
  IMAGE_TAG: ${{ github.sha }}

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # For OIDC auth to 1Password
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run unit tests
        run: npm test

      - name: Run integration tests with ephemeral secrets
        # Use op run to inject secrets for integration tests
        # No secrets are stored in GitHub Actions env vars or disk
        uses: 1password/load-secrets-action@v2 # https://github.com/1Password/load-secrets-action
        with:
          # Export secrets as env vars for the step
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          # Secret references in op:// format
          PAYMENT_API_KEY: op://Fintech Production/payment-api-key/value
          DB_PASSWORD: op://Fintech Production/prod-db-password/value

      - name: Run integration tests
        run: npm run test:integration
        # Secrets are automatically injected by 1Password action, no manual handling

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure 1Password CLI
        uses: 1password/configure-cli-action@v1
        with:
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Login to Amazon ECR
        # Use op run to inject AWS credentials from 1Password, no AWS CLI config
        run: |
          op run --env AWS_ACCESS_KEY_ID=op://Fintech Production/aws-prod-access-key/value \
                 --env AWS_SECRET_ACCESS_KEY=op://Fintech Production/aws-prod-secret-key/value \
                 -- aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com
        env:
          AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}

      - name: Build Docker image
        run: docker build -t $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG .

      - name: Push Docker image to ECR
        # Inject AWS credentials ephemerally for push
        run: |
          op run --env AWS_ACCESS_KEY_ID=op://Fintech Production/aws-prod-access-key/value \
                 --env AWS_SECRET_ACCESS_KEY=op://Fintech Production/aws-prod-secret-key/value \
                 -- docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG
        env:
          AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}

      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@v0.18.0
        with:
          image-ref: $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPOSITORY:$IMAGE_TAG
          format: sarif
          output: trivy-results.sarif
        env:
          AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure 1Password CLI
        uses: 1password/configure-cli-action@v1
        with:
          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Deploy to ECS
        # Inject all deployment secrets ephemerally
        run: |
          op run --env AWS_ACCESS_KEY_ID=op://Fintech Production/aws-prod-access-key/value \
                 --env AWS_SECRET_ACCESS_KEY=op://Fintech Production/aws-prod-secret-key/value \
                 --env DB_PASSWORD=op://Fintech Production/prod-db-password/value \
                 --env PAYMENT_API_KEY=op://Fintech Production/payment-api-key/value \
                 -- ./deploy.sh $IMAGE_TAG
        env:
          AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
          AWS_REGION: ${{ env.AWS_REGION }}

      - name: Verify deployment
        run: |
          op run --env PAYMENT_API_KEY=op://Fintech Production/payment-api-key/value \
                 -- curl -X GET -H \"Authorization: Bearer $PAYMENT_API_KEY\" https://api.fintech.com/health