# 1️⃣ Create a virtual environment (recommended)
python -m venv venv
source venv/bin/activate   # on Windows: venv\Scripts\activate

# 2️⃣ Install required packages
pip install --upgrade pip
pip install requests python-dotenv tenacity

# 1️⃣ Initialise a new npm project (skip if you already have one)
npm init -y

# 2️⃣ Install dependencies
npm install axios dotenv typescript ts-node @types/node --save-dev

# 3️⃣ Create a basic tsconfig.json (if you don't have one)
npx tsc --init --rootDir src --outDir dist --esModuleInterop --resolveJsonModule --lib es6,dom

# file: cisco_zeroday.py
"""
Cisco Zero‑Day Highlights API client – Python version.

Features:
- Supports API‑key auth (X-API-Key) **or** OAuth 2.0 client‑credentials flow.
- Automatic token retrieval & caching (valid for 1 hour by default).
- Retry with exponential back‑off for transient errors (5xx, 429).
- Structured logging via the standard library logging module.
"""

import os
import json
import time
import logging
from typing import Optional, Dict

import requests
from dotenv import load_dotenv
from tenacity import retry, stop_after_attempt, wait_exponential, retry_if_exception_type

# ----------------------------------------------------------------------
# Configuration & logging
# ----------------------------------------------------------------------
load_dotenv()  # pulls variables from .env into os.environ

API_BASE_URL = os.getenv("CISCO_API_BASE", "https://api.cisco.com/v0")
ZERO_DAY_ENDPOINT = f"{API_BASE_URL}/zeroday/highlights"

# Choose auth method: set USE_API_KEY=true to use X-API-Key header,
# otherwise the script will fetch an OAuth token.
USE_API_KEY = os.getenv("USE_API_KEY", "false").lower() == "true"

API_KEY = os.getenv("CISCO_API_KEY")
CLIENT_ID = os.getenv("CISCO_CLIENT_ID")
CLIENT_SECRET = os.getenv("CISCO_CLIENT_SECRET")
TOKEN_URL = os.getenv(
    "CISCO_TOKEN_URL", "https://cloudsso.cisco.com/as/token.oauth2"
)  # Cisco's token endpoint (example)

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s - %(message)s",
)
log = logging.getLogger(__name__)

# ----------------------------------------------------------------------
# OAuth token handling (cached in-memory for simplicity)
# ----------------------------------------------------------------------
_cached_token: Optional[str] = None
_token_expires_at: float = 0.0  # epoch seconds


def _fetch_oauth_token() -> str:
    """Obtain a Bearer token using client‑credentials grant."""
    global _cached_token, _token_expires_at
    log.info("Requesting new OAuth token from %s", TOKEN_URL)

    resp = requests.post(
        TOKEN_URL,
        data={"grant_type": "client_credentials"},
        auth=(CLIENT_ID, CLIENT_SECRET),
        timeout=10,
    )
    resp.raise_for_status()
    data = resp.json()
    _cached_token = data["access_token"]
    # Cisco tokens usually have an `expires_in` field (seconds)
    _token_expires_at = time.time() + int(data.get("expires_in", 3600)) - 30  # 30s safety margin
    log.info("OAuth token acquired, expires in %s seconds", data.get("expires_in"))
    return _cached_token


def get_auth_headers() -> Dict[str, str]:
    """Return the appropriate headers for the chosen auth method."""
    if USE_API_KEY:
        if not API_KEY:
            raise RuntimeError("CISCO_API_KEY not set but USE_API_KEY=true")
        return {"X-API-Key": API_KEY, "Accept": "application/json"}
    # OAuth path
    global _cached_token, _token_expires_at
    if not _cached_token or time.time() >= _token_expires_at:
        _fetch_oauth_token()
    return {"Authorization": f"Bearer {_cached_token}", "Accept": "application/json"}


# ----------------------------------------------------------------------
# Core request logic with retry
# ----------------------------------------------------------------------
def _should_retry(exception: BaseException) -> bool:
    """Retry on connection errors, timeouts, or HTTP 5xx/429."""
    if isinstance(exception, (requests.ConnectionError, requests.Timeout)):
        return True
    if isinstance(exception, requests.HTTPError):
        return exception.response.status_code in {429, 500, 502, 503, 504}
    return False


@retry(
    reraise=True,
    stop=stop_after_attempt(4),
    wait=wait_exponential(multiplier=1, min=2, max=10),
    retry=retry_if_exception_type((requests.ConnectionError, requests.Timeout, requests.HTTPError)),
)
def _make_request(url: str, headers: Dict[str, str]) -> requests.Response:
    log.debug("GET %s with headers %s", url, {k: v for k, v in headers.items() if k.lower() != "authorization"})
    resp = requests.get(url, headers=headers, timeout=15)
    resp.raise_for_status()  # will raise HTTPError for 4xx/5xx
    return resp


def fetch_zero_day_highlights() -> Dict:
    """
    Main entry point – returns the parsed JSON payload from the Cisco API.
    Raises:
        RuntimeError: if required credentials are missing.
        requests.HTTPError: for non‑retryable HTTP errors (e.g., 401, 403, 404).
    """
    headers = get_auth_headers()
    try:
        response = _make_request(ZERO_DAY_ENDPOINT, headers)
    except requests.HTTPError as exc:
        # Surface useful info for auth‑related problems
        if exc.response.status_code == 401:
            raise RuntimeError(
                "Unauthorized (401). Check your API key or OAuth client credentials."
            ) from exc
        if exc.response.status_code == 403:
            raise RuntimeError(
                "Forbidden (403). The token/API key may lack required scopes."
            ) from exc
        raise  # re‑raise other HTTP errors after retries exhausted

    try:
        data = response.json()
    except json.JSONDecodeError as exc:
        raise RuntimeError("Failed to decode JSON response") from exc

    log.info("Successfully retrieved Zero‑Day Highlights (%d items)", len(data.get("items", [])))
    return data


# ----------------------------------------------------------------------
# Simple CLI for manual testing
# ----------------------------------------------------------------------
if __name__ == "__main__":
    try:
        result = fetch_zero_day_highlights()
        print(json.dumps(result, indent=2))
    except Exception as err:  # pragma: no cover – defensive
        log.error("Error while calling Cisco API: %s", err)
        exit(1)

# 1️⃣ Create a .env file (see Step 4)
# 2️⃣ Execute
python cisco_zeroday.py

// file: src/ciscoZeroDay.ts
/**
 * Cisco Zero‑Day Highlights API client – TypeScript version.
 *
 * Demonstrates:
 *   • API‑key authentication (X-API-Key) **or** OAuth 2.0 client‑credentials flow.
 *   • Automatic token caching & refresh.
 *   • Retry logic with exponential back‑off (axios-retry).
 *   • Strong typing of the response payload.
 */

import axios, { AxiosInstance, AxiosError, AxiosResponse } from "axios";
import * as dotenv from "dotenv";
import { retry, exponentialBackOff } from "axios-retry";
import { config } from "dotenv";

config(); // loads .env into process.env

// ----------------------------------------------------------------------
// Environment variables
// ----------------------------------------------------------------------
const API_BASE = process.env.CISCO_API_BASE ?? "https://api.cisco.com/v0";
const ZERO_DAY_ENDPOINT = `${API_BASE}/zeroday/highlights`;

const USE_API_KEY = process.env.USE_API_KEY?.toLowerCase() === "true";

const API_KEY = process.env.CISCO_API_KEY;
const CLIENT_ID = process.env.CISCO_CLIENT_ID;
const CLIENT_SECRET = process.env.CISCO_CLIENT_SECRET;
const TOKEN_URL =
  process.env.CISCO_TOKEN_URL ?? "https://cloudsso.cisco.com/as/token.oauth2";

if (!USE_API_KEY && (!CLIENT_ID || !CLIENT_SECRET)) {
  throw new Error(
    "OAuth mode selected but CISCO_CLIENT_ID or CISCO_CLIENT_SECRET missing"
  );
}
if (USE_API_KEY && !API_KEY) {
  throw new Error("API‑key mode selected but CISCO_API_KEY missing");
}

// ----------------------------------------------------------------------
// Axios instance with retry & logging
// ----------------------------------------------------------------------
const api: AxiosInstance = axios.create({
  baseURL: API_BASE,
  timeout: 15000, // 15 s
  headers: { Accept: "application/json" },
});

// Retry on network errors, 429, 5xx
retry(api, {
  retries: 3,
  retryDelay: exponentialBackOff,
  retryCondition: (error: AxiosError) => {
    if (!error.response) return true; // network error
    const status = error.response.status;
    return status === 429 || status >= 500;
  },
});

// Optional: log requests/responses in dev
if (process.env.NODE_ENV !== "production") {
  api.interceptors.request.use((cfg) => {
    console.debug(`[REQ] ${cfg.method?.toUpperCase()} ${cfg.url}`);
    return cfg;
  });
  api.interceptors.response.use(
    (res) => {
      console.debug(`[RES] ${res.status} ${res.config.url}`);
      return res;
    },
    (err) => {
      console.error(`[ERR] ${err.message}`);
      return Promise.reject(err);
    }
  );
}

// ----------------------------------------------------------------------
// OAuth token handling (simple in‑memory cache)
// ----------------------------------------------------------------------
let accessToken: string | null = null;
let tokenExpiresAt: number = 0; // epoch ms

async function fetchOAuthToken(): Promise<string> {
  console.info("Fetching OAuth client‑credentials token...");
  const { data } = await axios.post(
    TOKEN_URL,
    new URLSearchParams({ grant_type: "client_credentials" }),
    {
      auth: { username: CLIENT_ID!, password: CLIENT_SECRET! },
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
    }
  );
  accessToken = data.access_token;
  // expires_in is in seconds; subtract 30 s for safety
  tokenExpiresAt = Date.now() + (data.expires_in ?? 3600) * 1000 - 30_000;
  console.info(`OAuth token acquired, expires in ${data.expires_in}s`);
  return accessToken;
}

function getAuthHeaders(): Record<string, string> {
  if (USE_API_KEY) {
    return { "X-API-Key": API_KEY! };
  }
  // OAuth path – ensure we have a valid token
  if (!accessToken || Date.now() >= tokenExpiresAt) {
    // NOTE: fire‑and‑wait; in high‑throughput services you might want a lock or singleton.
    // For this demo we just await.
    // In a real service you'd use a mutex or a library like `async-lock`.
    // eslint-disable-next-line @typescript-eslint/no-floating-promises
    fetchOAuthToken();
  }
  return { Authorization: `Bearer ${accessToken}` };
}

// ----------------------------------------------------------------------
// Response shape (adjust to the actual Cisco schema)
// ----------------------------------------------------------------------
interface ZeroDayItem {
  id: string;
  title: string;
  severity: "low" | "medium" | "high" | "critical";
  published: string; // ISO‑8601 date
  cvssScore?: number;
  advisoryUrl?: string;
}

interface ZeroDayResponse {
  items: ZeroDayItem[];
  totalCount: number;
  // add any extra pagination fields if the API provides them
}

// ----------------------------------------------------------------------
// Core function
// ----------------------------------------------------------------------
export async function fetchZeroDayHighlights(): Promise<ZeroDayResponse> {
  const headers = getAuthHeaders();
  try {
    const response: AxiosResponse<ZeroDayResponse> = await api.get(
      "/zeroday/highlights",
      { headers }
    );
    return response.data;
  } catch (err) {
    const axiosErr = err as AxiosError;
    if (axiosErr.response) {
      const { status, data } = axiosErr.response;
      if (status === 401) {
        throw new Error(
          `Unauthorized (401). Verify your API key or OAuth client credentials. ${JSON.stringify(
            data
          )}`
        );
      }
      if (status === 403) {
        throw new Error(
          `Forbidden (403). The token/API key may lack required scopes. ${JSON.stringify(
            data
          )}`
        );
      }
    }
    // If we get here, the error is either network or a non‑retryable HTTP error
    throw err;
  }
}

// ----------------------------------------------------------------------
// Simple CLI demo (run with `ts-node src/ciscoZeroDay.ts`)
// ----------------------------------------------------------------------
if (require.main === module) {
  (async () => {
    try {
      const result = await fetchZeroDayHighlights();
      console.log(JSON.stringify(result, null, 2));
    } catch (e) {
      console.error("Failed to fetch Zero‑Day Highlights:", e);
      process.exit(1);
    }
  })();
}

# 1️⃣ Create a .env file (see Step 4)
# 2️⃣ Compile & run with ts-node (no build step needed for demo)
npx ts-node src/ciscoZeroDay.ts

# ======================
# Cisco API Endpoint
# ======================
# Base URL for all Cisco endpoints used in this demo.
CISCO_API_BASE=https://api.cisco.com/v0

# ======================
# Authentication Choice
# ======================
# Set to "true" to use a static API key (X-API-Key header).
# Set to "false" (or omit) to use OAuth 2.0 client‑credentials flow.
USE_API_KEY=false

# ----------------------
# API‑Key mode (if USE_API_KEY=true)
# ----------------------
CISCO_API_KEY=your_api_key_here

# ----------------------
# OAuth mode (if USE_API_KEY=false)
# ----------------------
CISCO_CLIENT_ID=your_client_id_here
CISCO_CLIENT_SECRET=your_client_secret_here
# Optional: override the token endpoint if your Cisco tenant uses a custom URL.
CISCO_TOKEN_URL=https://cloudsso.cisco.com/as/token.oauth2

# ======================
# Miscellaneous
# ======================
# Set to "development" or "production" to toggle verbose logging.
NODE_ENV=development

# API‑key mode
curl -H "X-API-Key: $CISCO_API_KEY" \
     -H "Accept: application/json" \
     https://api.cisco.com/v0/zeroday/highlights

# OAuth mode (fetch token first)
TOKEN=$(curl -s -u "$CISCO_CLIENT_ID:$CISCO_CLIENT_SECRET" \
          -d "grant_type=client_credentials" \
          https://cloudsso.cisco.com/as/token.oauth2 | jq -r .access_token)

curl -H "Authorization: Bearer $TOKEN" \
     -H "Accept: application/json" \
     https://api.cisco.com/v0/zeroday/highlights