#!/usr/bin/env python3
"""
A utility script to verify AWS credentials by connecting to an S3 bucket.
"""

import os
import sys
import boto3
from botocore.exceptions import ClientError
from dotenv import load_dotenv

def verify_aws_credentials(bucket_name=None, aws_access_key_id=None, aws_secret_access_key=None, region_name=None):
    """
    Verifies if the provided AWS credentials are valid by attempting to list objects in the specified bucket.
    
    Args:
        bucket_name (str): Name of the S3 bucket to connect to
        aws_access_key_id (str): AWS access key ID
        aws_secret_access_key (str): AWS secret access key
        region_name (str): AWS region name
        
    Returns:
        bool: True if credentials are valid, False otherwise
    """
    try:
        # Create an S3 client
        s3 = boto3.client(
            's3',
            aws_access_key_id=aws_access_key_id,
            aws_secret_access_key=aws_secret_access_key,
            region_name=region_name
        )
        
        # Try to list objects in the bucket (only requesting max 1 item to minimize data transfer)
        response = s3.list_objects_v2(Bucket=bucket_name, MaxKeys=1)
        
        # If we get here, the credentials are valid
        print(f"✅ AWS credentials verification successful!")
        print(f"✅ Successfully connected to bucket: {bucket_name}")
        
        # Optionally print the first object if any exist
        if 'Contents' in response and len(response['Contents']) > 0:
            print(f"✅ First object in bucket: {response['Contents'][0]['Key']}")
        else:
            print("ℹ️ The bucket is empty.")
        
        return True
    
    except ClientError as e:
        error_code = e.response.get('Error', {}).get('Code', 'Unknown')
        error_message = e.response.get('Error', {}).get('Message', str(e))
        
        print(f"❌ AWS credentials verification failed!")
        print(f"❌ Error code: {error_code}")
        print(f"❌ Error message: {error_message}")
        
        if error_code == 'InvalidAccessKeyId':
            print("ℹ️ The AWS Access Key ID you provided does not exist in our records.")
        elif error_code == 'SignatureDoesNotMatch':
            print("ℹ️ The AWS Secret Access Key you provided is incorrect.")
        elif error_code == 'AccessDenied':
            print("ℹ️ The provided credentials do not have permission to access this bucket.")
        elif error_code == 'NoSuchBucket':
            print(f"ℹ️ The bucket '{bucket_name}' does not exist.")
            
        return False
    
    except Exception as e:
        print(f"❌ An unexpected error occurred: {str(e)}")
        return False

def main():
    """Main function to run the script."""
    # Load environment variables from .env file
    load_dotenv()
    
    # Get credentials from environment variables or command line arguments
    bucket_name = os.getenv('AWS_S3_BUCKET_NAME')
    aws_access_key_id = os.getenv('AWS_ACCESS_KEY_ID')
    aws_secret_access_key = os.getenv('AWS_SECRET_ACCESS_KEY')
    region_name = os.getenv('AWS_REGION', 'us-east-1')  # Default to us-east-1 if not specified
    
    # Override with command line arguments if provided
    if len(sys.argv) > 1:
        bucket_name = sys.argv[1]
    if len(sys.argv) > 2:
        aws_access_key_id = sys.argv[2]
    if len(sys.argv) > 3:
        aws_secret_access_key = sys.argv[3]
    if len(sys.argv) > 4:
        region_name = sys.argv[4]
    
    # Check if required parameters are provided
    if not all([bucket_name, aws_access_key_id, aws_secret_access_key]):
        print("❌ Missing required parameters!")
        print("Required parameters can be provided as environment variables or command line arguments:")
        print("  - AWS_S3_BUCKET_NAME / 1st argument: S3 bucket name")
        print("  - AWS_ACCESS_KEY_ID / 2nd argument: AWS access key ID")
        print("  - AWS_SECRET_ACCESS_KEY / 3rd argument: AWS secret access key")
        print("  - AWS_REGION / 4th argument: AWS region name (default: us-east-1)")
        print("\nUsage: python verify_aws_credentials.py [bucket_name] [access_key_id] [secret_access_key] [region]")
        sys.exit(1)
    
    # Verify the credentials
    success = verify_aws_credentials(
        bucket_name=bucket_name,
        aws_access_key_id=aws_access_key_id,
        aws_secret_access_key=aws_secret_access_key,
        region_name=region_name
    )
    
    # Exit with appropriate status code
    sys.exit(0 if success else 1)

if __name__ == "__main__":
    main()