"""Scene 3, going deeper: the different doors to the locked box, for real.

Looks up Secrets Manager's public front doors with standard tools. No AWS
account, no sign-in, nothing is called beyond DNS and a TLS hello:

    1. The regular public door:   secretsmanager.us-east-1.amazonaws.com
    2. The certified (FIPS) door: secretsmanager-fips.us-east-1.amazonaws.com
    3. The same door in another city: secretsmanager.us-west-2.amazonaws.com

The private hallway (a VPC interface endpoint) only exists inside a private
network, so it can't be looked up from the internet; that is the point of it.

    python3 lab/front_doors.py          # print transcript
    python3 lab/front_doors.py --save   # also write replays/front-doors.txt
"""
import socket
import ssl
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
REPLAY = ROOT / "replays" / "front-doors.txt"
DOORS = [
    ("regular public door", "secretsmanager.us-east-1.amazonaws.com"),
    ("certified FIPS door", "secretsmanager-fips.us-east-1.amazonaws.com"),
    ("same door, another city", "secretsmanager.us-west-2.amazonaws.com"),
]

lines = []


def say(text=""):
    print(text)
    lines.append(text)


def knock(host):
    ctx = ssl.create_default_context()
    with socket.create_connection((host, 443), timeout=8) as raw:
        with ctx.wrap_socket(raw, server_hostname=host) as tls:
            cert = tls.getpeercert()
            names = [v for k, v in cert.get("subjectAltName", ()) if k == "DNS"]
            issuer = dict(x[0] for x in cert["issuer"]).get("organizationName", "?")
            return tls.version(), issuer, names


def main():
    for label, host in DOORS:
        say(f"# The {label}")
        say(f"$ {host}")
        version, issuer, names = knock(host)
        covers = host in names or any(n.startswith("*.") and host.endswith(n[1:]) for n in names)
        say(f"   answers with a badge issued by {issuer}; the badge covers this exact name: {covers}")
        say()
    say("# The private hallway")
    say("   A VPC interface endpoint has no public address: it is reachable only from inside")
    say("   the customer's private network, so requests never cross the public internet.")

    if "--save" in sys.argv:
        REPLAY.write_text("\n".join(lines) + "\n")
        print(f"\nSaved {REPLAY.relative_to(ROOT)}")


if __name__ == "__main__":
    main()