package awssso

import (
	"fmt"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/identitystore"
	"github.com/aws/aws-sdk-go/service/ssoadmin"
	"strings"
	"time"
)

//定义一些必须的变量
var (
	//sso 一些固定配置
	AWSCONFIG = AWS_SSO_Config {
		IAM_Identity_Center_ARN:"arn:aws:sso:::instance/ssoins-7758e707bb6ea352",
		Identity_store_ID:"d-95670a3c83",
		IAM_SSO_Endpoint:"https://identitystore.ap-northeast-1.amazonaws.com",
		IAM_SSO_Region:"ap-northeast-1",
	}
)

//添加权限的结构体
type Add_Per_User_Info struct {
	Account string                //--target-id 账号ID
	Permission_set_arn string     //权限集的 ARN
	User_id string                //--principal-id 也就是 user 的 id
}

//带入 username 返回 userid信息(调用该函数除了检测error以外，还需要检查  userid 是否为空)
func Get_User_ID(username string) (string,error){
	var ret_userid string
	var ret_err error
	sess, err := session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	})
	if err != nil {
		panic(err)
	}
	svc := identitystore.New(sess, &aws.Config{
		Region:                       aws.String(AWSCONFIG.IAM_SSO_Region),
		Endpoint:                     aws.String(AWSCONFIG.IAM_SSO_Endpoint),
		CredentialsChainVerboseErrors: aws.Bool(true),
	})
	params := &identitystore.ListUsersInput{
		MaxResults: aws.Int64(100), // 设置每次返回的最大结果数
		IdentityStoreId: aws.String("d-95670a3c83"),
	}
	for {
		resp, err := svc.ListUsers(params)
		if err != nil {
			fmt.Println(err)
			ret_userid=""
			ret_err=err
			break
		}
		for _, user := range resp.Users {
			//fmt.Println(*user.UserName, *user.UserId)
			if strings.TrimSpace(username)==strings.TrimSpace(*user.UserName) {
				ret_userid=strings.TrimSpace(*user.UserId)
				ret_err=nil
				break
			}
		}
		if ret_userid!="" {
			break
		}
		// 处理 resp.Users 中的用户结果
		// 检查是否还有更多结果
		if resp.NextToken != nil {
			params.NextToken = resp.NextToken // 设置下一页请求的令牌
		} else {
			break // 已获取所有结果，退出循环
		}
	}
	return ret_userid,ret_err
}


//获取权限集的 ARN，带入权限集名称，得到 ARN 信息
func Get_Permissions_ARN(pername string)(string,error){
	// 创建AWS会话
	sess := session.Must(session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	}))

	// 指定区域
	sess.Config.Region = aws.String(AWSCONFIG.IAM_SSO_Region)

	client := ssoadmin.New(sess)

	params := &ssoadmin.ListPermissionSetsInput{
		InstanceArn: aws.String(AWSCONFIG.IAM_Identity_Center_ARN),
		MaxResults:  aws.Int64(100),
	}

	for {
		resp, err := client.ListPermissionSets(params)
		if err != nil {
			fmt.Println(err)
			return "", err
		}

		for _, currentArn := range resp.PermissionSets {
			Arn := *currentArn
			curName, err := GetPermissionSetName(sess, Arn)
			if err != nil {
				return "", err
			}
			if curName == pername {
				return Arn, nil
			}
		}

		// check the other results
		if resp.NextToken != nil {
			params.NextToken = resp.NextToken // // Next page token
		} else {
			break
		}
	}
	return "PermissionSet Not Found!", nil
}

//通过  permission arn 获取 权限集名称，PerArn 为权限集的 ARN，返回权限集名称
func GetPermissionSetName(sess *session.Session, PerArn string) (string, error) {
	client := ssoadmin.New(sess)

	params := &ssoadmin.DescribePermissionSetInput{
		InstanceArn:      aws.String(AWSCONFIG.IAM_Identity_Center_ARN),
		PermissionSetArn: aws.String(PerArn),
	}

	describePermissionSetOutput, err := client.DescribePermissionSet(params)
	if err != nil {
		return "", err
	}

	permissionSetName := *describePermissionSetOutput.PermissionSet.Name
	return permissionSetName, nil
}


//给指定用户赋予指定账号下的权限集
func (userinfo Add_Per_User_Info)Add_Permission_To_Account() error{
	//任何调用都先暂停10秒，避免出现增加权限和删除权限在10秒以内，AWS SDK 会抛出错误信息
	time.Sleep(10*time.Second)
	// 创建AWS会话
	sess := session.Must(session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	}))

	// 指定区域
	sess.Config.Region = aws.String(AWSCONFIG.IAM_SSO_Region)

	// 创建SSO Admin客户端
	svc := ssoadmin.New(sess)

	// 创建账户授权请求的参数
	params := &ssoadmin.CreateAccountAssignmentInput{
		InstanceArn:     aws.String(AWSCONFIG.IAM_Identity_Center_ARN),
		TargetId:       aws.String(userinfo.Account),
		TargetType:     aws.String("AWS_ACCOUNT"),
		PermissionSetArn: aws.String(userinfo.Permission_set_arn),
		PrincipalType:  aws.String("USER"),
		PrincipalId:    aws.String(userinfo.User_id),
	}

	// 发起账户授权请求
	_, err := svc.CreateAccountAssignment(params)
	if err != nil {
		return err
	}
	return nil
}

//给指定用户移除权限
func (userinfo Add_Per_User_Info)Remove_Permission_User_Account() error {
	//任何调用都先暂停10秒，避免出现增加权限和删除权限在10秒以内，AWS SDK 会抛出错误信息
	time.Sleep(10*time.Second)
	// 创建AWS会话
	sess := session.Must(session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	}))

	// 指定区域
	sess.Config.Region = aws.String(AWSCONFIG.IAM_SSO_Region)

	// 创建SSO Admin服务的客户端
	svc := ssoadmin.New(sess)

	// 构建删除账户分配的输入参数
	input := &ssoadmin.DeleteAccountAssignmentInput{
		InstanceArn:      aws.String(AWSCONFIG.IAM_Identity_Center_ARN),
		TargetId:         aws.String(userinfo.Account),
		TargetType:       aws.String("AWS_ACCOUNT"),
		PermissionSetArn: aws.String(userinfo.Permission_set_arn),
		PrincipalType:    aws.String("USER"),
		PrincipalId:      aws.String(userinfo.User_id),
	}

	// 调用删除账户分配操作
	_, err := svc.DeleteAccountAssignment(input)
	if err != nil {
		return err
	}
	return nil
}


func AWS_test(){

	// 创建AWS会话
	sess := session.Must(session.NewSessionWithOptions(session.Options{
		SharedConfigState: session.SharedConfigEnable,
	}))

	// 在EC2实例上设置区域配置
	sess.Config.Region = aws.String("ap-northeast-1")

	// 创建SSO Admin客户端
	client := ssoadmin.New(sess)

	// 准备命令参数
	params := &ssoadmin.ListPermissionSetsInput{
		InstanceArn: aws.String("arn:aws:sso:::instance/ssoins-7758e707bb6ea352"),
	}

	// 调用list-permission-sets命令
	resp, err := client.ListPermissionSets(params)
	if err != nil {
		fmt.Println("Error listing permission sets:", err)
		return
	}

	// 处理命令响应
	fmt.Println("Permission Sets:")
	for _, permissionSet := range resp.PermissionSets {
		fmt.Println(" -", *permissionSet)
	}
}