#!/usr/bin/env python3
"""Export Aiden audit events to a local NDJSON file.

Pages past the server's per-page cap automatically. Use ``--format ocsf`` when
handing the file to a SIEM or external auditor.

Usage:
  export STACKGEN_URL=https://app.stackgen.com
  export STACKGEN_TOKEN=stackgen_…
  export STACKGEN_WORKSPACE_ID=<workspace-uuid>
  python examples/automation/audit-export.py --days 7 --output audit.ndjson
  python examples/automation/audit-export.py --days 30 --event-type break_glass_activated
  python examples/automation/audit-export.py --days 7 --format ocsf --output audit-ocsf.ndjson
"""

from __future__ import annotations

import argparse
import os
from datetime import datetime, timedelta, timezone

from stackgen import StackgenClient, StackgenConfig


def require_env(name: str, *fallbacks: str) -> str:
    for key in (name, *fallbacks):
        value = (os.environ.get(key) or "").strip()
        if value:
            return value
    raise SystemExit(f"missing env {name}")


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument(
        "--days",
        type=int,
        default=7,
        help="how many days back to export (default: 7)",
    )
    parser.add_argument(
        "--output",
        default="audit.ndjson",
        help="local NDJSON path (default: audit.ndjson)",
    )
    parser.add_argument(
        "--event-type",
        default=None,
        help="optional event_type filter (e.g. break_glass_activated)",
    )
    parser.add_argument(
        "--format",
        choices=("native", "ocsf"),
        default="native",
        help="native AuditEvent objects, or OCSF API Activity for SIEM hand-off",
    )
    parser.add_argument(
        "--max-events",
        type=int,
        default=None,
        help="optional cap for a dry run",
    )
    args = parser.parse_args()
    if args.days < 1:
        raise SystemExit("--days must be >= 1")

    client = StackgenClient(
        StackgenConfig(
            base_url=require_env("STACKGEN_URL"),
            api_token=require_env("STACKGEN_TOKEN"),
            workspace_id=require_env("STACKGEN_WORKSPACE_ID", "STACKGEN_PROJECT"),
        )
    )

    now = datetime.now(timezone.utc)
    start = now - timedelta(days=args.days)
    params: dict[str, object] = {
        "from": start.strftime("%Y-%m-%dT%H:%M:%SZ"),
        "to": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
        "format": args.format,
    }
    if args.event_type:
        params["event_type"] = args.event_type
    if args.max_events is not None:
        params["max_events"] = args.max_events

    result = client.aiden.export_audit_events(args.output, **params)
    print(f"wrote {result.count} events to {result.output_path}")


if __name__ == "__main__":
    main()