Canary Token Distribution

"""
Canary Token Generator and Inventory Manager.
Generates DNS, HTTP, and document-based canary tokens and
maintains a registry of deployed tokens for alert correlation.
"""
import json
import uuid
import hashlib
import os
from datetime import datetime
from typing import Dict, List

INVENTORY_FILE = "canary_inventory.json"
CALLBACK_DOMAIN = "tokens.shadow-cdf.internal"

class CanaryTokenManager:
    def __init__(self):
        self.inventory: List[Dict] = []
        self._load_inventory()

    def _load_inventory(self):
        if os.path.exists(INVENTORY_FILE):
            with open(INVENTORY_FILE) as f:
                self.inventory = json.load(f)

    def _save_inventory(self):
        with open(INVENTORY_FILE, "w") as f:
            json.dump(self.inventory, f, indent=2)

    def _generate_token_id(self) -> str:
        return hashlib.sha256(
            uuid.uuid4().bytes
        ).hexdigest()[:16]

    def create_dns_token(
        self, placement: str, description: str
    ) -> Dict:
        """Create a DNS-based canary token.
        Triggers when the hostname is resolved."""
        token_id = self._generate_token_id()
        hostname = f"{token_id}.{CALLBACK_DOMAIN}"

        token = {
            "type": "dns",
            "token_id": token_id,
            "trigger_value": hostname,
            "placement": placement,
            "description": description,
            "created_at": datetime.utcnow().isoformat(),
            "status": "active",
            "alert_message": f"DNS canary triggered: "
                             f"{placement} - {description}",
        }
        self.inventory.append(token)
        self._save_inventory()
        return token

    def create_http_token(
        self, placement: str, description: str
    ) -> Dict:
        """Create an HTTP-based canary token.
        Triggers when the URL is fetched."""
        token_id = self._generate_token_id()
        url = f"https://{CALLBACK_DOMAIN}/t/{token_id}/logo.png"

        token = {
            "type": "http",
            "token_id": token_id,
            "trigger_value": url,
            "placement": placement,
            "description": description,
            "embed_html": f'<img src="{url}" width="1" '
                          f'height="1" alt="" />',
            "created_at": datetime.utcnow().isoformat(),
            "status": "active",
        }
        self.inventory.append(token)
        self._save_inventory()
        return token

    def create_credential_token(
        self, username: str, password: str,
        placement: str, description: str,
    ) -> Dict:
        """Create a credential-based canary.
        Triggers when username/password is used for authentication."""
        token_id = self._generate_token_id()

        token = {
            "type": "credential",
            "token_id": token_id,
            "trigger_value": {
                "username": username,
                "password_hash": hashlib.sha256(
                    password.encode()
                ).hexdigest(),
            },
            "placement": placement,
            "description": description,
            "created_at": datetime.utcnow().isoformat(),
            "status": "active",
            "siem_query": f'event.action:"authentication" AND '
                          f'user.name:"{username}"',
        }
        self.inventory.append(token)
        self._save_inventory()
        return token

    def print_inventory_summary(self):
        print(f"\nCanary Token Inventory: {len(self.inventory)} tokens")
        print("-" * 60)
        for token in self.inventory:
            print(f"  [{token['type']:12s}] {token['token_id']}")
            print(f"    Placement: {token['placement']}")
            print(f"    Status:    {token['status']}")
            print()

if __name__ == "__main__":
    mgr = CanaryTokenManager()

    # Deploy tokens across the environment
    mgr.create_dns_token(
        placement="/opt/app/config/monitoring.conf",
        description="Fake monitoring endpoint in app config",
    )
    mgr.create_http_token(
        placement="IT_Network_Diagram_2026.docx",
        description="Tracking pixel in decoy network diagram",
    )
    mgr.create_credential_token(
        username="svc_sql_backup",
        password="SqlB4ckup#Pr0d!",
        placement="backup-config.sh on file-server-02",
        description="Trap DB credentials in backup script",
    )

    mgr.print_inventory_summary()