from pypanther import LogType, Rule, RuleTest, Severity, panther_managed
from pypanther.helpers.auth0 import auth0_alert_context, is_auth0_config_event


@panther_managed
class Auth0MFAFactorSettingEnabled(Rule):
    default_description = "An Auth0 user enabled an mfa factor in your organization's mfa settings."
    display_name = "Auth0 mfa factor enabled"
    default_runbook = "Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture."
    default_reference = "https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors"
    default_severity = Severity.INFO
    log_types = [LogType.AUTH0_EVENTS]
    id = "Auth0.MFA.Factor.Setting.Enabled-prototype"

    def rule(self, event):
        description = event.deep_get("data", "description", default="<NO_DESCRIPTION_FOUND>")
        enabled = event.deep_get("data", "details", "response", "body", "enabled")
        return all(
            [
                description == "Update a Multi-factor Authentication Factor",
                enabled is True,
                is_auth0_config_event(event),
            ],
        )

    def title(self, event):
        user = event.deep_get("data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>")
        path = event.deep_get("data", "details", "request", "path", default="<NO_PATH_FOUND>")
        p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
        return f"Auth0 User [{user}] enabled mfa factor settings for [{path}] in your organization’s tenant [{p_source_label}]."

    def alert_context(self, event):
        return auth0_alert_context(event)

    tests = [
        RuleTest(
            name="MFA Enabled",
            expected_result=True,
            log={
                "data": {
                    "client_id": "1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr",
                    "client_name": "",
                    "date": "2023-05-15 21:55:18.060000000",
                    "description": "Update a Multi-factor Authentication Factor",
                    "details": {
                        "request": {
                            "auth": {
                                "credentials": {
                                    "jti": "949869e066205b5076e6df203fdd7b9b",
                                    "scopes": [
                                        "create:actions",
                                        "create:actions_log_sessions",
                                        "create:authentication_methods",
                                        "create:client_credentials",
                                        "create:client_grants",
                                        "create:clients",
                                        "create:connections",
                                        "create:custom_domains",
                                        "create:email_provider",
                                        "create:email_templates",
                                        "create:guardian_enrollment_tickets",
                                        "create:integrations",
                                        "create:log_streams",
                                        "create:organization_connections",
                                        "create:organization_invitations",
                                        "create:organization_member_roles",
                                        "create:organization_members",
                                        "create:organizations",
                                        "create:requested_scopes",
                                        "create:resource_servers",
                                        "create:roles",
                                        "create:rules",
                                        "create:shields",
                                        "create:signing_keys",
                                        "create:tenant_invitations",
                                        "create:test_email_dispatch",
                                        "create:users",
                                        "delete:actions",
                                        "delete:anomaly_blocks",
                                        "delete:authentication_methods",
                                        "delete:branding",
                                        "delete:client_credentials",
                                        "delete:client_grants",
                                        "delete:clients",
                                        "delete:connections",
                                        "delete:custom_domains",
                                        "delete:device_credentials",
                                        "delete:email_provider",
                                        "delete:email_templates",
                                        "delete:grants",
                                        "delete:guardian_enrollments",
                                        "delete:integrations",
                                        "delete:log_streams",
                                        "delete:organization_connections",
                                        "delete:organization_invitations",
                                        "delete:organization_member_roles",
                                        "delete:organization_members",
                                        "delete:organizations",
                                        "delete:owners",
                                        "delete:requested_scopes",
                                        "delete:resource_servers",
                                        "delete:roles",
                                        "delete:rules",
                                        "delete:rules_configs",
                                        "delete:shields",
                                        "delete:tenant_invitations",
                                        "delete:tenant_members",
                                        "delete:tenants",
                                        "delete:users",
                                        "read:actions",
                                        "read:anomaly_blocks",
                                        "read:attack_protection",
                                        "read:authentication_methods",
                                        "read:branding",
                                        "read:checks",
                                        "read:client_credentials",
                                        "read:client_grants",
                                        "read:client_keys",
                                        "read:clients",
                                        "read:connections",
                                        "read:custom_domains",
                                        "read:device_credentials",
                                        "read:email_provider",
                                        "read:email_templates",
                                        "read:email_triggers",
                                        "read:entity_counts",
                                        "read:grants",
                                        "read:guardian_factors",
                                        "read:insights",
                                        "read:integrations",
                                        "read:log_streams",
                                        "read:logs",
                                        "read:mfa_policies",
                                        "read:organization_connections",
                                        "read:organization_invitations",
                                        "read:organization_member_roles",
                                        "read:organization_members",
                                        "read:organizations",
                                        "read:prompts",
                                        "read:requested_scopes",
                                        "read:resource_servers",
                                        "read:roles",
                                        "read:rules",
                                        "read:rules_configs",
                                        "read:shields",
                                        "read:signing_keys",
                                        "read:stats",
                                        "read:tenant_invitations",
                                        "read:tenant_members",
                                        "read:tenant_settings",
                                        "read:triggers",
                                        "read:users",
                                        "run:checks",
                                        "update:actions",
                                        "update:attack_protection",
                                        "update:authentication_methods",
                                        "update:branding",
                                        "update:client_credentials",
                                        "update:client_grants",
                                        "update:client_keys",
                                        "update:clients",
                                        "update:connections",
                                        "update:custom_domains",
                                        "update:email_provider",
                                        "update:email_templates",
                                        "update:email_triggers",
                                        "update:guardian_factors",
                                        "update:integrations",
                                        "update:log_streams",
                                        "update:mfa_policies",
                                        "update:organization_connections",
                                        "update:organizations",
                                        "update:prompts",
                                        "update:requested_scopes",
                                        "update:resource_servers",
                                        "update:roles",
                                        "update:rules",
                                        "update:rules_configs",
                                        "update:shields",
                                        "update:signing_keys",
                                        "update:tenant_members",
                                        "update:tenant_settings",
                                        "update:triggers",
                                        "update:users",
                                    ],
                                },
                                "strategy": "jwt",
                                "user": {
                                    "email": "user.name@yourcompany.io",
                                    "name": "User Name",
                                    "user_id": "google-oauth2|105261262156475850461",
                                },
                            },
                            "body": {"AfterAuthentication": False},
                            "channel": "https://manage.auth0.com/",
                            "ip": "12.12.12.12",
                            "method": "patch",
                            "path": "/api/v2/risk-assessment/config",
                            "query": {},
                            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
                        },
                        "response": {"body": {"Enabled": True}, "statusCode": 200},
                    },
                    "ip": "12.12.12.12",
                    "log_id": "90020230515215719063964000000000000001223372037488829643",
                    "type": "sapi",
                    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
                    "user_id": "google-oauth2|105261262156475850461",
                },
                "log_id": "90020230515215719063964000000000000001223372037488829643",
                "p_any_ip_addresses": ["12.12.12.12"],
                "p_any_usernames": ["google-oauth2|105261262156475850461"],
                "p_event_time": "2023-05-15 21:55:18.06",
                "p_log_type": "Auth0.Events",
                "p_parse_time": "2023-05-15 21:58:28.629",
                "p_row_id": "42b742dba9d5f3f284d49b971814",
                "p_schema_version": 0,
                "p_source_id": "b9031579-b2c5-45c2-b15c-632b995a4e36",
                "p_source_label": "Org Tenant Label",
            },
        ),
        RuleTest(
            name="MFA disabled",
            expected_result=False,
            log={
                "data": {
                    "client_id": "1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr",
                    "client_name": "",
                    "date": "2023-05-15 21:55:18.060000000",
                    "description": "Update a Multi-factor Authentication Factor",
                    "details": {
                        "request": {
                            "auth": {
                                "credentials": {
                                    "jti": "949869e066205b5076e6df203fdd7b9b",
                                    "scopes": [
                                        "create:actions",
                                        "create:actions_log_sessions",
                                        "create:authentication_methods",
                                        "create:client_credentials",
                                        "create:client_grants",
                                        "create:clients",
                                        "create:connections",
                                        "create:custom_domains",
                                        "create:email_provider",
                                        "create:email_templates",
                                        "create:guardian_enrollment_tickets",
                                        "create:integrations",
                                        "create:log_streams",
                                        "create:organization_connections",
                                        "create:organization_invitations",
                                        "create:organization_member_roles",
                                        "create:organization_members",
                                        "create:organizations",
                                        "create:requested_scopes",
                                        "create:resource_servers",
                                        "create:roles",
                                        "create:rules",
                                        "create:shields",
                                        "create:signing_keys",
                                        "create:tenant_invitations",
                                        "create:test_email_dispatch",
                                        "create:users",
                                        "delete:actions",
                                        "delete:anomaly_blocks",
                                        "delete:authentication_methods",
                                        "delete:branding",
                                        "delete:client_credentials",
                                        "delete:client_grants",
                                        "delete:clients",
                                        "delete:connections",
                                        "delete:custom_domains",
                                        "delete:device_credentials",
                                        "delete:email_provider",
                                        "delete:email_templates",
                                        "delete:grants",
                                        "delete:guardian_enrollments",
                                        "delete:integrations",
                                        "delete:log_streams",
                                        "delete:organization_connections",
                                        "delete:organization_invitations",
                                        "delete:organization_member_roles",
                                        "delete:organization_members",
                                        "delete:organizations",
                                        "delete:owners",
                                        "delete:requested_scopes",
                                        "delete:resource_servers",
                                        "delete:roles",
                                        "delete:rules",
                                        "delete:rules_configs",
                                        "delete:shields",
                                        "delete:tenant_invitations",
                                        "delete:tenant_members",
                                        "delete:tenants",
                                        "delete:users",
                                        "read:actions",
                                        "read:anomaly_blocks",
                                        "read:attack_protection",
                                        "read:authentication_methods",
                                        "read:branding",
                                        "read:checks",
                                        "read:client_credentials",
                                        "read:client_grants",
                                        "read:client_keys",
                                        "read:clients",
                                        "read:connections",
                                        "read:custom_domains",
                                        "read:device_credentials",
                                        "read:email_provider",
                                        "read:email_templates",
                                        "read:email_triggers",
                                        "read:entity_counts",
                                        "read:grants",
                                        "read:guardian_factors",
                                        "read:insights",
                                        "read:integrations",
                                        "read:log_streams",
                                        "read:logs",
                                        "read:mfa_policies",
                                        "read:organization_connections",
                                        "read:organization_invitations",
                                        "read:organization_member_roles",
                                        "read:organization_members",
                                        "read:organizations",
                                        "read:prompts",
                                        "read:requested_scopes",
                                        "read:resource_servers",
                                        "read:roles",
                                        "read:rules",
                                        "read:rules_configs",
                                        "read:shields",
                                        "read:signing_keys",
                                        "read:stats",
                                        "read:tenant_invitations",
                                        "read:tenant_members",
                                        "read:tenant_settings",
                                        "read:triggers",
                                        "read:users",
                                        "run:checks",
                                        "update:actions",
                                        "update:attack_protection",
                                        "update:authentication_methods",
                                        "update:branding",
                                        "update:client_credentials",
                                        "update:client_grants",
                                        "update:client_keys",
                                        "update:clients",
                                        "update:connections",
                                        "update:custom_domains",
                                        "update:email_provider",
                                        "update:email_templates",
                                        "update:email_triggers",
                                        "update:guardian_factors",
                                        "update:integrations",
                                        "update:log_streams",
                                        "update:mfa_policies",
                                        "update:organization_connections",
                                        "update:organizations",
                                        "update:prompts",
                                        "update:requested_scopes",
                                        "update:resource_servers",
                                        "update:roles",
                                        "update:rules",
                                        "update:rules_configs",
                                        "update:shields",
                                        "update:signing_keys",
                                        "update:tenant_members",
                                        "update:tenant_settings",
                                        "update:triggers",
                                        "update:users",
                                    ],
                                },
                                "strategy": "jwt",
                                "user": {
                                    "email": "user.name@yourcompany.io",
                                    "name": "User Name",
                                    "user_id": "google-oauth2|105261262156475850461",
                                },
                            },
                            "body": {"AfterAuthentication": False},
                            "channel": "https://manage.auth0.com/",
                            "ip": "12.12.12.12",
                            "method": "patch",
                            "path": "/api/v2/risk-assessment/config",
                            "query": {},
                            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
                        },
                        "response": {"body": {"Enabled": False}, "statusCode": 200},
                    },
                    "ip": "12.12.12.12",
                    "log_id": "90020230515215719063964000000000000001223372037488829643",
                    "type": "sapi",
                    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
                    "user_id": "google-oauth2|105261262156475850461",
                },
                "log_id": "90020230515215719063964000000000000001223372037488829643",
                "p_any_ip_addresses": ["12.12.12.12"],
                "p_any_usernames": ["google-oauth2|105261262156475850461"],
                "p_event_time": "2023-05-15 21:55:18.06",
                "p_log_type": "Auth0.Events",
                "p_parse_time": "2023-05-15 21:58:28.629",
                "p_row_id": "42b742dba9d5f3f284d49b971814",
                "p_schema_version": 0,
                "p_source_id": "b9031579-b2c5-45c2-b15c-632b995a4e36",
                "p_source_label": "Org Tenant Label",
            },
        ),
    ]
