from diagrams import Cluster, Diagram, Edge
from diagrams.aws.compute import Lambda
from diagrams.aws.database import Dynamodb
from diagrams.aws.network import CloudFront
from diagrams.aws.security import Cognito
from diagrams.azure.identity import AzureActiveDirectory, ConditionalAccess
from diagrams.onprem.client import Users

graph_attr = {
    "bgcolor": "transparent",
    "pad": "0.35",
    "rankdir": "TB",
    "splines": "ortho",
    "nodesep": "0.65",
    "ranksep": "0.75",
    "fontname": "Inter",
    "fontsize": "22",
}

node_attr = {
    "fontname": "Inter",
    "fontsize": "12",
}

edge_attr = {
    "fontname": "Inter",
    "fontsize": "10",
    "color": "#4A5568",
    "arrowsize": "0.75",
}

with Diagram(
    "Python diagrams · Broker Hub",
    filename="/opt/diagram-tools-lab/site/assets/python-diagrams-hub",
    direction="TB",
    curvestyle="ortho",
    outformat=["png", "svg"],
    show=False,
    graph_attr=graph_attr,
    node_attr=node_attr,
    edge_attr=edge_attr,
):
    user = Users("Mitarbeiter\nBrowser")

    with Cluster("Apps Portal"):
        web = CloudFront("Web-Tools\nCloudFront + S3")

    cognito = Cognito("Amazon Cognito\nBroker / SP")

    with Cluster("Microsoft Azure · Entra ID Tenant"):
        entra = AzureActiveDirectory("Entra ID\nSAML IdP")
        mfa = ConditionalAccess("MFA +\nConditional Access")

    with Cluster("AWS App Access"):
        trigger = Lambda("Pre-Token\nLambda")
        table = Dynamodb("DynamoDB\napp-access")

    user >> Edge(label="1 HTTPS") >> web
    web >> Edge(label="2 login + PKCE") >> cognito
    cognito >> Edge(label="3 AuthnRequest", color="#0F6CBD", penwidth="2") >> entra
    entra >> Edge(label="4 MFA / CA", color="#0F6CBD", style="dashed") >> mfa
    entra >> Edge(label="5 Assertion", color="#0F6CBD", penwidth="2") >> cognito
    cognito >> Edge(label="6 Pre-token") >> trigger
    trigger >> Edge(label="7 groups") >> table
    cognito >> Edge(label="8 JWT", color="#1F7A52", penwidth="2") >> web