from diagrams import Cluster, Diagram, Edge
from diagrams.aws.compute import Lambda
from diagrams.aws.database import Dynamodb
from diagrams.aws.network import CloudFront
from diagrams.aws.security import Cognito
from diagrams.azure.identity import AzureActiveDirectory
from diagrams.onprem.client import Users

graph_attr = {
    "bgcolor": "transparent",
    "pad": "0.30",
    "rankdir": "LR",
    "splines": "ortho",
    "nodesep": "0.50",
    "ranksep": "0.95",
    "fontname": "Inter",
    "fontsize": "22",
}

node_attr = {
    "fontname": "Inter",
    "fontsize": "11",
}

edge_attr = {
    "fontname": "Inter",
    "fontsize": "9",
    "color": "#4A5568",
    "arrowsize": "0.7",
}

with Diagram(
    "Python diagrams · Trust Zones",
    filename="/opt/diagram-tools-lab/site/assets/python-diagrams-zones",
    direction="LR",
    curvestyle="ortho",
    outformat=["png", "svg"],
    show=False,
    graph_attr=graph_attr,
    node_attr=node_attr,
    edge_attr=edge_attr,
):
    user = Users("Mitarbeiter")

    with Cluster("AWS Cloud · eu-central-1"):
        web = CloudFront("Web-Tools\nCloudFront + S3")
        cognito = Cognito("Cognito\nBroker / SP")
        trigger = Lambda("Pre-Token\nLambda")
        table = Dynamodb("DynamoDB\nGroups")

    with Cluster("Microsoft Azure · Entra ID Tenant"):
        entra = AzureActiveDirectory("Entra ID\nIdP · MFA · CA")

    user >> Edge(label="1 HTTPS") >> web
    web >> Edge(label="2 PKCE") >> cognito
    cognito >> Edge(label="3 SAML req", color="#0F6CBD", penwidth="2") >> entra
    entra >> Edge(label="5 Assertion", color="#0F6CBD", penwidth="2") >> cognito
    cognito >> Edge(label="6 trigger") >> trigger
    trigger >> Edge(label="7 groups") >> table
    cognito >> Edge(label="8 JWT", color="#1F7A52", penwidth="2", constraint="false") >> web