import ipaddress
import os
import requests
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID

# Configuration via environment variables
CERTIFICATE_SIGN_PATH = os.environ.get('CERTIFICATE_SIGN_PATH') # URL for DAPI certificate sign request
SECRET_CODE = os.environ.get('SECRET_CODE')                   # Secret code provided by DECTA

# Define the CSR Details (Subject) using standard DECTA metadata
subject = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, "GB"),                          # United Kingdom
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Greater London"),    # County/State
    x509.NameAttribute(NameOID.LOCALITY_NAME, "London"),                     # City
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Example company"),        # Legal Company Name
    x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Example Operations"),
    x509.NameAttribute(NameOID.EMAIL_ADDRESS, "admin@company.co.uk"),
    x509.NameAttribute(NameOID.COMMON_NAME, "company-name"),
])

# Define the CSR Details (AlternativeName) using your service static IP
san_extension = x509.SubjectAlternativeName([
    x509.IPAddress(ipaddress.IPv4Address("192.0.2.1"))
])

# Generate the Private Key
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
)

# Build the CSR
csr = (
    x509.CertificateSigningRequestBuilder()
    .subject_name(subject)
    .add_extension(
        san_extension,
        critical=False,
    )
    .sign(private_key, hashes.SHA256())
)

# Serialize the Private Key (PEM format)
private_key_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.TraditionalOpenSSL,
    encryption_algorithm=serialization.NoEncryption() 
)

# Serialize the CSR (PEM format)
csr_pem = csr.public_bytes(serialization.Encoding.PEM)

# Call certificate sign request
try:
    response = requests.post(
        CERTIFICATE_SIGN_PATH, 
        json={"encodedCSR": csr_pem.decode('utf-8')}, 
        headers={
            "SECRET": SECRET_CODE,
            "Content-Type": "application/json"
        }
    )
    response.raise_for_status()

    print(f"HTTP Status: {response.status_code}")
    print(f"Response: {response.text}") # Save response data in a safe place!

    # Securely save the private key to a local file
    with open('private_key.pem', 'wb') as f:
        f.write(private_key_pem)
    print("Your private key has been safely saved to 'private_key.pem'")

except Exception as e:
    print(f"Error occurred: {e}")

import json
import os
import requests
from jwcrypto import jwk, jws
from jwcrypto.common import json_encode
from urllib.parse import urlencode, quote

# Configuration via environment variables
DAPI_URL = os.environ.get('DAPI_URL')              # DAPI base URL
PRIVATE_KEY_ENV = os.environ.get('PRIVATE_KEY')    # PEM string (without end of line symbols)
THUMBPRINT = os.environ.get('THUMBPRINT')          # Signed certificate thumbprint

# Define request data
uri = "/v1/api/cards" 
params = {"product": "eq:100", "cardName": "eq:Test Name"} 
data = "" # Empty body for GET request

# Format query parameters for the JWS Payload
query_string = urlencode(params, safe=' :', quote_via=quote)

# Construct JWS Payload: ensure URI is followed by '?' if query parameters exist
jws_payload = uri + ("?" + query_string if query_string else "") + data

# JWCrypto Setup
jwk_key = jwk.JWK.from_pem(PRIVATE_KEY_ENV.encode('utf-8'))
jwstoken = jws.JWS(jws_payload.encode('utf-8'))

# Add signature using RS256 and protected header
jwstoken.add_signature(
    jwk_key,
    'RS256',
    protected=json_encode({"x5t#S256": THUMBPRINT, "alg": "RS256"})
)
signature = json.loads(jwstoken.serialize())

# Send authorized GET request
try:
    response = requests.get(
        DAPI_URL + uri,
        data=data,
        params=params,
        headers={
            "token-header": signature['protected'],
            "token-signature": signature['signature'],
            "Content-Type": "application/json"
        }
    )
    print(f"HTTP Status: {response.status_code}")
    print(f"Response: {response.text}")
except Exception as e:
    print(f"Error occurred: {e}")