require 'json'
require 'aws-sdk-ec2'
require 'aws-sdk'
require 'aws-sdk-secretsmanager'
require 'base64'


def terminate_connection(event: , context:)
  # puts event
  # puts context
  terminated_connections = []
  get_vpn_connections.each do |c|
    terminated_connection =  ec2_client.terminate_client_vpn_connections({client_vpn_endpoint_id: ENV["VPN_ENDPOINT"],                           username: c.username,
    	dry_run: false})

    terminated_connections << terminated_connection
  end

  {
    statusCode: 200,
    body: {
      message: "We've killed the following connections",
      input: event,
      terminated_connections: terminated_connections
    }.to_json
  }
end

def get_vpn_connections
  # https://docs.aws.amazon.com/sdk-for-ruby/v2/api/Aws/EC2/Client.html#describe_client_vpn_connections-instance_method
  response = ec2_client.describe_client_vpn_connections({ client_vpn_endpoint_id: ENV["VPN_ENDPOINT"], dry_run: false}) # assuming only a few end points

  connection_ids = response.connections.filter{ |c| c.status.code == "active"}

  return connection_ids
end


def ec2_client
  return @ec2_client || get_ec2_client
end

def get_ec2_client
  aws_access_key_id, aws_secret_access_key = JSON.parse(get_secret).first
  credentials = Aws::Credentials.new(aws_access_key_id, aws_secret_access_key)
  @ec2_client = Aws::EC2::Client.new(region: ENV["REGION"], credentials: credentials)
  return @ec2_client
end

def get_secret()
  secret_name = "terminate_vpn_user_secret"
  client = Aws::SecretsManager::Client.new(region: ENV["REGION"])

  # In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
  # See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
  # We rethrow the exception by default.
  begin
    get_secret_value_response = client.get_secret_value(secret_id: secret_name)
  rescue Aws::SecretsManager::Errors::DecryptionFailure => e
    # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
    # Deal with the exception here, and/or rethrow at your discretion.
    raise
  rescue Aws::SecretsManager::Errors::InternalServiceError => e
    # An error occurred on the server side.
    # Deal with the exception here, and/or rethrow at your discretion.
    raise
  rescue Aws::SecretsManager::Errors::InvalidParameterException => e
    # You provided an invalid value for a parameter.
    # Deal with the exception here, and/or rethrow at your discretion.
    raise
  rescue Aws::SecretsManager::Errors::InvalidRequestException => e
    # You provided a parameter value that is not valid for the current state of the resource.
    # Deal with the exception here, and/or rethrow at your discretion.
    raise
  rescue Aws::SecretsManager::Errors::ResourceNotFoundException => e
    # We can't find the resource that you asked for.
    # Deal with the exception here, and/or rethrow at your discretion.
    raise
  else
    # This block is ran if there were no exceptions.

    # Decrypts secret using the associated KMS CMK.
    # Depending on whether the secret is a string or binary, one of these fields will be populated.
    if get_secret_value_response.secret_string
      secret = get_secret_value_response.secret_string
    else
      decoded_binary_secret = Base64.decode64(get_secret_value_response.secret_binary)
    end

    # Your code goes here.
  end
end