#!/usr/bin/env python3
# cert_monitor.py — checks expiry for a list of domains and alerts via email

import ssl
import socket
import smtplib
import datetime
from email.mime.text import MIMEText
from dataclasses import dataclass, field
from typing import Optional

DOMAINS = [
    "example.com",
    "api.example.com",
    "admin.example.com",
]
ALERT_DAYS = 14        # Warn when cert expires within this many days
SMTP_HOST = "localhost"
ALERT_EMAIL = "ops@example.com"


@dataclass
class CertStatus:
    domain: str
    days_remaining: Optional[int] = None
    error: Optional[str] = None

    @property
    def expiring_soon(self) -> bool:
        return self.days_remaining is not None and self.days_remaining < ALERT_DAYS

    @property
    def ok(self) -> bool:
        return self.error is None and not self.expiring_soon


def check_cert_expiry(domain: str, port: int = 443) -> CertStatus:
    ctx = ssl.create_default_context()
    try:
        with ctx.wrap_socket(
            socket.create_connection((domain, port), timeout=10),
            server_hostname=domain,
        ) as conn:
            cert = conn.getpeercert()
            expiry_str = cert["notAfter"]
            expiry = datetime.datetime.strptime(expiry_str, "%b %d %H:%M:%S %Y %Z")
            days_remaining = (expiry - datetime.datetime.utcnow()).days
            return CertStatus(domain=domain, days_remaining=days_remaining)
    except Exception as e:
        return CertStatus(domain=domain, error=str(e))


def send_alert(statuses: list[CertStatus]) -> None:
    problems = [s for s in statuses if not s.ok]
    if not problems:
        return

    lines = []
    for s in problems:
        if s.error:
            lines.append(f"  ERROR  {s.domain}: {s.error}")
        else:
            lines.append(f"  EXPIRING {s.domain}: {s.days_remaining} days remaining")

    body = "SSL certificate alert:\n\n" + "\n".join(lines)
    msg = MIMEText(body)
    msg["Subject"] = f"SSL Alert: {len(problems)} domain(s) need attention"
    msg["From"] = ALERT_EMAIL
    msg["To"] = ALERT_EMAIL

    with smtplib.SMTP(SMTP_HOST) as smtp:
        smtp.sendmail(ALERT_EMAIL, [ALERT_EMAIL], msg.as_string())


if __name__ == "__main__":
    statuses = [check_cert_expiry(d) for d in DOMAINS]
    for s in statuses:
        if s.ok:
            print(f"OK      {s.domain}: {s.days_remaining}d remaining")
        elif s.error:
            print(f"ERROR   {s.domain}: {s.error}")
        else:
            print(f"WARN    {s.domain}: expires in {s.days_remaining}d")
    send_alert(statuses)

# tls_auditor.py
import anthropic
import subprocess
import json

def audit_tls_config(domain: str) -> str:
    """Run testssl.sh and have Claude analyze the results."""
    client = anthropic.Anthropic()

    # Run testssl.sh (must be installed)
    result = subprocess.run(
        ["testssl", "--json", "--quiet", domain],
        capture_output=True, text=True, timeout=120
    )

    if result.returncode not in (0, 1):  # testssl exits 1 on warnings
        return f"testssl.sh failed: {result.stderr}"

    try:
        findings = json.loads(result.stdout)
    except json.JSONDecodeError:
        findings = result.stdout[:5000]  # Fall back to raw text

    message = client.messages.create(
        model="claude-opus-4-6",
        max_tokens=2048,
        messages=[{
            "role": "user",
            "content": f"""Analyze this TLS configuration audit for {domain}:

{json.dumps(findings, indent=2)[:6000]}

Provide:
1. Critical issues that must be fixed immediately
2. Recommended improvements for security hardening
3. Specific config changes (show the nginx/apache directives to add/change)
4. Overall grade and reasoning"""
        }]
    )

    return message.content[0].text


if __name__ == "__main__":
    import sys
    domain = sys.argv[1] if len(sys.argv) > 1 else "example.com"
    print(audit_tls_config(domain))