from diagrams import Cluster, Diagram, Edge
from diagrams.aws.compute import Lambda
from diagrams.aws.database import Dynamodb
from diagrams.aws.network import CloudFront
from diagrams.aws.security import Cognito
from diagrams.azure.identity import AzureActiveDirectory
from diagrams.onprem.client import Users

graph_attr = {
    "bgcolor": "transparent",
    "pad": "0.35",
    "rankdir": "LR",
    "splines": "ortho",
    "nodesep": "0.62",
    "ranksep": "1.05",
    "fontname": "Inter",
    "fontsize": "24",
}

node_attr = {
    "fontname": "Inter",
    "fontsize": "12",
}

edge_attr = {
    "fontname": "Inter",
    "fontsize": "10",
    "color": "#4A5568",
    "arrowsize": "0.8",
}

with Diagram(
    "Entra ID (Azure AD) <-> Amazon Cognito\nSAML-Federation fuer die Capita Web-Tools · Shared Cognito Pool",
    filename="/opt/diagram-tools-lab/site/assets/python-diagrams",
    direction="LR",
    curvestyle="ortho",
    outformat=["png", "svg"],
    show=False,
    graph_attr=graph_attr,
    node_attr=node_attr,
    edge_attr=edge_attr,
):
    user = Users("Mitarbeiter\nUser / Browser")

    with Cluster("AWS Cloud · eu-central-1"):
        web = CloudFront("Web-Tools\nApps Portal / CloudFront+S3")
        cognito = Cognito("Amazon Cognito\nUser Pool · Broker/SP")
        trigger = Lambda("Pre-Token Lambda\nApp-Zugriff+Gruppen")
        table = Dynamodb("DynamoDB\napp-access · Gruppen")

    with Cluster("Microsoft Azure · Entra ID Tenant"):
        entra = AzureActiveDirectory("Microsoft Entra ID\nIdP · MFA · Cond. Access\n4 Anmeldung + MFA")

    user >> Edge(label="1 Aufruf (HTTPS)", color="#4A5568") >> web
    web >> Edge(label="2 Login-Redirect · PKCE", color="#4A5568") >> cognito
    cognito >> Edge(label="3 SAML AuthnRequest", color="#0F6CBD", penwidth="2") >> entra
    entra >> Edge(label="5 SAML-Assertion\nemailaddress = UPN", color="#0F6CBD", penwidth="2") >> cognito
    cognito >> Edge(label="6 Pre-Token-Trigger", color="#4A5568") >> trigger
    trigger >> Edge(label="7 prueft Gruppen", color="#4A5568") >> table
    cognito >> Edge(label="8 Token (JWT) -> eingeloggt", color="#1F7A52", penwidth="2") >> web