(defpackage :mfa-tool.credential-provider

   (:use :cl )

   (:export #:make-aws-session
            #:debug-provider

            #:setup-default-chain
            #:save-ubiquitous-credentials))

 (in-package :mfa-tool.credential-provider)

 
 (defstruct hash-ref name hash-table)
 (defstruct leaf name value)
 
 (defun normalize (key)
   (string-trim " " key))
 
 (defmethod architecture.builder-protocol:make-node
     ((builder (eql :my-builder)) (kind (eql :section)) &key name bounds)
   (declare (ignore bounds))
   (let ((name (normalize (car name))))
     (make-hash-ref :name (normalize name)
                    :hash-table (alexandria:alist-hash-table `((,name . ,(make-hash-table :test 'equal)))
                                                             :test 'equal))))
 
 (defmethod architecture.builder-protocol:relate
     ((builder  (eql :my-builder))
      (relation (eql :section-option))
      (left     hash-ref)
      (right    cons)
      &key)
   (alexandria:ensure-gethash (normalize (car right))
                              (gethash (hash-ref-name left)
                                       (hash-ref-hash-table left))
                              (normalize (cdr right)))
   left)
 
 (defmethod architecture.builder-protocol:make-node
     ((builder (eql :my-builder)) (kind (eql :option)) &key name value bounds)
   (declare (ignore bounds))
   (cons (car name)
         value))
 
 (defmethod architecture.builder-protocol:finish-node
     ((builder (eql :my-builder)) (kind (eql :section)) (node hash-ref))
   (hash-ref-hash-table node))
 
 (defun merge-hash-tables (tables)
   (reduce (lambda (next acc)
             (loop for key being each hash-key in next using (hash-value value)
                   do (setf (gethash key acc) value))
             acc)
           tables
           :initial-value (make-hash-table :test 'equal)
           :from-end t))
 
 (defun parse-ini (fn)
   (merge-hash-tables (parser.ini:parse (pathname fn)
                                        :my-builder)))
 
 (defclass fwoar-provider (aws-sdk/credentials/base:provider)

   ((file :initarg :file :initform (error "must pass a file name"))

    (profile :initarg :profile
             :initform aws-sdk:*aws-profile*
             :accessor provider-profile)
 
    (retrievedp :initform nil)))
 
 (defun read-credentials (provider)
   (with-slots (file) provider
     (when (probe-file file)
       (gethash (provider-profile provider)
                (parse-ini file)))))
 
 (defmethod aws-sdk/credentials/base:retrieve ((provider fwoar-provider))

   (with-slots (retrievedp) provider

     (setf retrievedp nil)
     (let ((section (read-credentials provider)))
       (when section
         (setf retrievedp t)
         (aws-sdk:make-credentials
          :access-key-id (gethash "aws_access_key_id" section)
          :secret-access-key (gethash "aws_secret_access_key" section)
          :session-token (gethash "aws_session_token" section)
          :provider-name "fwoar-provider")))))
 

 (defclass ubiquitous-provider (aws-sdk/credentials/base:provider)
   ((retrievedp :initform nil)))
 
 (defmethod aws-sdk/credentials/base:retrieve ((provider ubiquitous-provider))
   (when (and (ubiquitous:value :aws :access-key-id)
              (ubiquitous:value :aws :secret-access-key))
     (aws-sdk:make-credentials
      :access-key-id (ubiquitous:value :aws :access-key-id)
      :secret-access-key (ubiquitous:value :aws :secret-access-key)
      :session-token (ubiquitous:value :aws :session-token)
      :provider-name "ubiquitous-provider")))
 
 (defun save-ubiquitous-credentials (credentials)

   (prog1 credentials
     (setf (ubiquitous:value :aws :access-key-id)
           (aws-sdk/credentials/base:credentials-access-key-id credentials)

           (ubiquitous:value :aws :secret-access-key)
           (aws-sdk/credentials/base:credentials-secret-access-key credentials)

           (ubiquitous:value :aws :session-token)
           (aws-sdk/credentials/base:credentials-session-token credentials))
     (ubiquitous:offload)))

 (defun make-aws-session ()
   (let ((aws-sdk/credentials::*chained-providers*

           (list (make-instance 'fwoar-provider :file (merge-pathnames ".aws/credentials"
                                                                       (user-homedir-pathname)))
                 (make-instance 'ubiquitous-provider))))

     (aws:make-session :credentials (aws:default-aws-credentials))))

 
 (defun debug-provider (s)
   (pprint (read-credentials (make-instance 'fwoar-provider
                                            :file (merge-pathnames ".aws/credentials"
                                                                   (user-homedir-pathname))))
           s))
 
 (defun setup-default-chain ()
   (setf aws-sdk/credentials::*chained-providers*
         (list (make-instance 'fwoar-provider :file (merge-pathnames ".aws/credentials"
                                                                     (user-homedir-pathname)))
               (make-instance 'ubiquitous-provider))))