pim

#!/bin/bash
# This script is used to make PIM assignments

print_help() {
    cat <<EOF
Usage: $(basename "$0") [OPTIONS]

Required parameters:
  --subscription, -s      Subscription ID or name (fuzzy search enabled)
  --resource-group, -g    Resource group name (fuzzy search enabled)

Optional parameters:
  --message, -m           Justification message
  --role, -r              Role name (will be prompted if not provided)
  --time, -t              Duration (will be prompted if not provided)
  --help                  Show this help message
EOF
    exit 1
}

check_dependencies() {
    for cmd in curl az jq fzf; do
        if ! command -v $cmd &>/dev/null; then
            echo "$cmd is required but not installed. Exiting."
            exit 1
        fi
    done
}

validate_time() {
    if [[ ! $time =~ ^[0-9]+[HM]$ ]]; then
        echo "Invalid time format. Use nH (hours, max 8) or nM (minutes, min 5, max 60)"
        exit 1
    fi
    if [[ $time == *H ]]; then
        local hours=${time%H}
        if ((hours < 1 || hours > 8)); then
            echo "Invalid hour format. Use 1-8H."
            exit 1
        fi
    elif [[ $time == *M ]]; then
        local minutes=${time%M}
        if ((minutes < 5 || minutes > 60)); then
            echo "Invalid minute format. Use 5-60M."
            exit 1
        fi
    fi
}

parse_arguments() {
    while [[ "$#" -gt 0 ]]; do
        case $1 in
        -s | --subscription)
            subscription="$2"
            shift
            ;;
        -g | --resource-group)
            resource_group="$2"
            shift
            ;;
        -m | --message)
            message="$2"
            shift
            ;;
        -r | --role)
            role="$2"
            shift
            ;;
        -t | --time)
            time="$2"
            shift
            ;;
        --help)
            print_help
            ;;
        *)
            echo "Unknown parameter passed: $1"
            print_help
            ;;
        esac
        shift
    done
}


fuzzy_select_subscription() {
    subscription=$(az account list --query "[].{name:name, id:id}" -o tsv | fzf --prompt="Select Subscription: " | awk '{$NF=""; print $0}' | sed 's/ $//')
    if [[ -z "$subscription" ]]; then
        echo "No subscription selected. Exiting."
        exit 1
    fi
}

fuzzy_select_resource_group() {
    resource_group=$(az group list --subscription "$subscription" --query "[].name" -o tsv | fzf --prompt="Select Resource Group: ")
    if [[ -z "$resource_group" ]]; then
        echo "No resource group selected. Exiting."
        exit 1
    fi
}

fuzzy_select_role() {
    roles=$(curl -s -H "Authorization: Bearer $token" -X GET \
        "https://management.azure.com/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.Authorization/roleEligibilityScheduleInstances?api-version=2020-10-01&\$filter=asTarget()" |
        jq -r '.value[].properties.expandedProperties.roleDefinition.displayName' | sort -u)
    role=$(echo "$roles" | fzf --prompt="Select Role: ")
    if [[ -z "$role" ]]; then
        echo "No role selected. Exiting."
        exit 1
    fi
}

main() {
    check_dependencies
    parse_arguments "$@"

    if [[ -z "$subscription" ]]; then
        fuzzy_select_subscription
    fi

    if [[ -z "$resource_group" ]]; then
        fuzzy_select_resource_group
    fi

    user_object_id=$(az ad user list --filter "mail eq '$(az account show --query user.name -o tsv)'" --query "[0].id" -o tsv)
    guid=$(uuidgen | tr '[:upper:]' '[:lower:]')
    token=$(az account get-access-token --query accessToken -o tsv)
    subscription_id=$(az account list --query "[?id=='$subscription' || name=='$subscription'].id" -o tsv)

    if [[ -z "$role" ]]; then
        fuzzy_select_role
    fi

    role_definition_id=$(curl -s -H "Authorization: Bearer $token" -X GET \
        "https://management.azure.com/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.Authorization/roleEligibilityScheduleInstances?api-version=2020-10-01&\$filter=asTarget()" |
        jq -r --arg resource_group "$resource_group" --arg role "$role" \
            '.value[] | select(.properties.scope | endswith($resource_group)) | select(.properties.expandedProperties.roleDefinition.displayName == $role) | .properties.expandedProperties.roleDefinition.id' | awk -F'/' '{print $NF}')

    if [[ -z "$time" ]]; then
        read -p "Please provide duration time (default: 1H, if empty). Format: 8H (hours) or 5M (minutes): " time
    	time=${time:-"1H"}
    fi
	validate_time
    if [[ -z "$message" ]]; then
        read -p "Please provide a justification message: " message
        if [[ -z "$message" ]]; then
            echo "Justification message cannot be empty"
            exit 1
        fi
    fi

    justification="${message// /_}"
    data=$(
        cat <<EOF
{
    "Properties": {
        "RoleDefinitionId": "/subscriptions/${subscription_id}/providers/Microsoft.Authorization/roleDefinitions/${role_definition_id}",
        "PrincipalId": "${user_object_id}",
        "RequestType": "SelfActivate",
        "Justification": "${justification}",
        "ScheduleInfo": {
            "StartDateTime": null,
            "Expiration": {
                "Type": "AfterDuration",
                "EndDateTime": null,
                "Duration": "PT${time}"
            }
        }
    }
}
EOF
    )

    response=$(curl -s -H "Authorization: Bearer $token" -X PUT -H "Content-Type: application/json" -d "$data" \
        "https://management.azure.com/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.Authorization/roleAssignmentScheduleRequests/${guid}?api-version=2020-10-01")

    if [[ $(echo "$response" | jq -r '.error') != "null" ]]; then
        echo "Error: $(echo "$response" | jq -r '.error.message')"
        exit 1
    fi

    if [[ $(echo "$response" | jq -r '.properties.status') == "Provisioned" ]]; then
        duration=$(echo "$response" | jq -r '.properties.scheduleInfo.expiration.duration')
        if [[ $duration == *"H" ]]; then
            # Extract hours and convert to minutes for the date command
            hours=$(echo "$duration" | grep -o '[0-9]\+')

            # fixes issue #5
            if [[ "$OSTYPE" == "darwin"* ]]; then
                expiration_time=$(date -v +${hours}H +"%Y-%m-%d %H:%M:%S")
            else
                expiration_time=$(date -d "+${hours} hours" +"%Y-%m-%d %H:%M:%S")
            fi

        elif [[ $duration == *"M" ]]; then
            # Extract minutes directly for the date command
            minutes=$(echo "$duration" | grep -o '[0-9]\+')

            # fixes issue #5
            if [[ "$OSTYPE" == "darwin"* ]]; then
                expiration_time=$(date -v +${minutes}M +"%Y-%m-%d %H:%M:%S")
            else
                expiration_time=$(date -d "+${minutes} minutes" +"%Y-%m-%d %H:%M:%S")
            fi
        
        fi

        echo "PIM assignment active. Expires: $expiration_time"
    else
        echo "An unknown error occurred."
    fi
}

main "$@"