main.py

from fastapi import FastAPI, Depends, HTTPException, BackgroundTasks, Request
from fastapi.middleware.cors import CORSMiddleware
from fastapi.staticfiles import StaticFiles
from fastapi.templating import Jinja2Templates
from sqlalchemy.orm import Session
import requests
import datetime
import urllib.parse
from pydantic import BaseModel
from typing import List, Optional
import time

import jwt

from database import engine, Base, get_db, DbToken, DbDeviceCode

app = FastAPI(title="GraphGuard API")

# Enable CORS for frontend
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

# Constants
TENANT = "common"
AUTHORITY = f"https://login.microsoftonline.com/{TENANT}"

class TokenImportRequest(BaseModel):
    access_token: str

class DeviceCodeRequest(BaseModel):
    client_id: str
    resource: str
    user_agent: Optional[str] = None
    forwarded_ip: Optional[str] = None

app.mount("/static", StaticFiles(directory="static"), name="static")
templates = Jinja2Templates(directory="templates")

@app.get("/")
def read_root(request: Request):
    return templates.TemplateResponse(request, "index.html")

# Token Routes
@app.get("/tokens")
def list_tokens(db: Session = Depends(get_db)):
    tokens = db.query(DbToken).all()
    return tokens

@app.delete("/tokens/{token_id}")
def delete_token(token_id: int, db: Session = Depends(get_db)):
    token = db.query(DbToken).filter(DbToken.id == token_id).first()
    if token:
        db.delete(token)
        db.commit()
    return {"status": "success"}

@app.post("/tokens/import")
def import_token(req: TokenImportRequest, db: Session = Depends(get_db)):
    try:
        decoded = jwt.decode(req.access_token, options={"verify_signature": False})
    except Exception as e:
        raise HTTPException(status_code=400, detail=f"Invalid JWT access token: {e}")
        
    username = decoded.get("upn", decoded.get("unique_name", decoded.get("email", "Unknown")))
    client_id = decoded.get("appid", decoded.get("azp", "Unknown"))
    resource = decoded.get("aud", "Unknown")
    expires_on = decoded.get("exp", int(time.time()) + 3600)
    
    new_token = DbToken(
        username=username,
        client_id=client_id,
        resource=resource,
        access_token=req.access_token,
        refresh_token=None,
        id_token=None,
        expires_on=expires_on,
        created_at=datetime.datetime.utcnow(),
        user_agent="Imported (Manual)",
        forwarded_ip=None
    )
    db.add(new_token)
    db.commit()
    return {"status": "success", "token_id": new_token.id}

# Auth / Device Code Flow
@app.post("/auth/devicecode")
def request_device_code(req: DeviceCodeRequest, db: Session = Depends(get_db)):
    # Standard OAUTH2 device code request to Microsoft Entra
    url = f"{AUTHORITY}/oauth2/devicecode?api-version=1.0"
    data = {"client_id": req.client_id, "resource": req.resource}
    headers = {}
    if req.user_agent: headers["User-Agent"] = req.user_agent
    if req.forwarded_ip: headers["X-Forwarded-For"] = req.forwarded_ip
    
    try:
        response = requests.post(url, data=data, headers=headers)
        response.raise_for_status()
        res_data = response.json()
    except Exception as e:
        raise HTTPException(status_code=400, detail=str(e))
    
    # Save to DB
    new_dc = DbDeviceCode(
        device_code=res_data.get("device_code"),
        user_code=res_data.get("user_code"),
        verification_uri=res_data.get("verification_url", res_data.get("verification_uri")),
        expires_in=res_data.get("expires_in"),
        interval=res_data.get("interval", 5),
        message=res_data.get("message"),
        status="pending",
        client_id=req.client_id,
        resource=req.resource,
        created_at=datetime.datetime.utcnow(),
        user_agent=req.user_agent,
        forwarded_ip=req.forwarded_ip
    )
    db.add(new_dc)
    db.commit()
    db.refresh(new_dc)
    
    return new_dc

@app.get("/auth/devicecode/{dc_id}/poll")
def poll_device_code(dc_id: int, db: Session = Depends(get_db)):
    dc = db.query(DbDeviceCode).filter(DbDeviceCode.id == dc_id).first()
    if not dc:
        raise HTTPException(status_code=404, detail="Device code not found")
        
    if dc.status != "pending":
        return {"status": dc.status}

    # Make polling request to Microsoft
    url = f"{AUTHORITY}/oauth2/token"
    # FOCI / standard device code check pattern
    # The grant_type is urn:ietf:params:oauth:grant-type:device_code or similar
    # AAD v1 uses grant_type=device_code
    data = {
        "client_id": dc.client_id,
        "grant_type": "device_code",
        "code": dc.device_code,
        "resource": dc.resource
    }
    headers = {}
    if dc.user_agent: headers["User-Agent"] = dc.user_agent
    if dc.forwarded_ip: headers["X-Forwarded-For"] = dc.forwarded_ip
    
    response = requests.post(url, data=data, headers=headers)
    res_data = response.json()
    
    if "error" in res_data:
        err = res_data["error"]
        if err == "authorization_pending":
            return {"status": "pending"}
        elif err == "expired_token":
            dc.status = "expired"
            db.commit()
            return {"status": "expired"}
        elif err == "access_denied":
            dc.status = "denied"
            db.commit()
            return {"status": "denied"}
        else:
            return {"status": "error", "message": err}
            
    if "access_token" in res_data:
        # Success! Save tokens
        dc.status = "success"
        
        # Extract the username directly from the JWT
        username = "Unknown"
        token_to_decode = res_data.get("id_token") or res_data.get("access_token")
        if token_to_decode:
            try:
                decoded = jwt.decode(token_to_decode, options={"verify_signature": False})
                username = decoded.get("upn", decoded.get("unique_name", decoded.get("email", "Unknown")))
            except Exception:
                pass
        
        new_token = DbToken(
            username=username,
            client_id=dc.client_id,
            resource=dc.resource,
            access_token=res_data["access_token"],
            refresh_token=res_data.get("refresh_token"),
            id_token=res_data.get("id_token"),
            expires_on=int(time.time()) + int(res_data.get("expires_in", 3600)),
            created_at=datetime.datetime.utcnow(),
            user_agent=dc.user_agent,
            forwarded_ip=dc.forwarded_ip
        )
        db.add(new_token)
        db.commit()
        return {"status": "success", "token_id": new_token.id}

# Microsoft Graph Endpoints Proxy
class GraphRequest(BaseModel):
    token_id: int
    endpoint: str # e.g. /v1.0/users
    method: str = "GET"
    payload: Optional[dict] = None

def get_graph_headers(token: DbToken):
    h = {"Authorization": f"Bearer {token.access_token}", "Content-Type": "application/json"}
    if token.user_agent: h["User-Agent"] = token.user_agent
    if token.forwarded_ip: h["X-Forwarded-For"] = token.forwarded_ip
    return h

@app.post("/graph/call")
def call_graph(req: GraphRequest, db: Session = Depends(get_db)):
    token = db.query(DbToken).filter(DbToken.id == req.token_id).first()
    if not token:
        raise HTTPException(status_code=404, detail="Token not found")
        
    url = f"https://graph.microsoft.com{req.endpoint}"
    
    try:
        if req.method.upper() == "GET":
            response = requests.get(url, headers=get_graph_headers(token))
        elif req.method.upper() == "POST":
            response = requests.post(url, headers=get_graph_headers(token), json=req.payload)
        elif req.method.upper() == "PATCH":
            response = requests.patch(url, headers=get_graph_headers(token), json=req.payload)
        elif req.method.upper() == "DELETE":
            response = requests.delete(url, headers=get_graph_headers(token))
        else:
            raise HTTPException(status_code=400, detail="Unsupported method")
            
        if response.status_code == 401:
            raise HTTPException(status_code=401, detail="Access token expired or unauthorized.")
            
        if response.status_code == 204 or response.text.strip() == "":
            return {"status": "success", "message": "No content returned"}
            
        return response.json()
    except requests.exceptions.RequestException as e:
        raise HTTPException(status_code=500, detail=str(e))

from pydantic import BaseModel
import base64

class UploadRequest(BaseModel):
    token_id: int
    path: str
    file_base64: str
    content_type: str = "application/octet-stream"

@app.post("/graph/upload")
def upload_file_graph(req: UploadRequest, db: Session = Depends(get_db)):
    token = db.query(DbToken).filter(DbToken.id == req.token_id).first()
    if not token:
        raise HTTPException(status_code=404, detail="Token not found")
        
    # Example path: /me/drive/root:/uploaded_file.txt:/content
    url = f"https://graph.microsoft.com/v1.0{req.path}"
    headers = {
        "Authorization": f"Bearer {token.access_token}",
        "Content-Type": req.content_type
    }
    
    content = base64.b64decode(req.file_base64)
    response = requests.put(url, headers=headers, data=content)
    
    if response.status_code >= 400:
        raise HTTPException(status_code=response.status_code, detail=response.text)
        
    return response.json()