#!/usr/bin/env python3
# =============================================================================
# SiCABE — lib/authz_ldap.py
# -----------------------------------------------------------------------------
# Pengelolaan GRUP & USER OpenLDAP (sumber grup Trino & StarRocks) untuk CLI
# sicabe-authz. Melengkapi model OPA: nama grup LDAP (cn) WAJIB sama dengan kunci
# `roles` di config/opa/authz.yml DAN `permitted_groups` di bootstrap.sh.
#
# Strategi tulis: SELALU coba tulis (via ldapadd/ldapmodify/ldapdelete). Bila
# gagal (mis. LDAP existing read-only), LDIF yang setara dicetak agar bisa
# diterapkan admin LDAP secara manual.
#
# Semua operasi memakai ldap-utils; bila container openldap LOKAL berjalan,
# perintah dijalankan lewat `docker exec` (tak perlu ldap-utils di host).
# =============================================================================
from __future__ import annotations

import os
import re
import subprocess
import sys

DRY = os.environ.get("SICABE_AUTHZ_DRY_RUN") == "1"


class LdapError(Exception):
    """Operasi LDAP gagal / konfigurasi tak lengkap."""


def _say(msg: str) -> None:
    print(f"[DRY-RUN] {msg}" if DRY else f"{msg}")


# ── Konfigurasi & eksekusi ──────────────────────────────────────────────────

def config() -> dict:
    return {
        "container": os.environ.get("LDAP_CONTAINER_NAME", "sicabe-openldap"),
        "admin_dn": os.environ.get("LDAP_ADMIN_DN", "cn=admin,dc=sicabe,dc=local"),
        "password": os.environ.get("LDAP_ADMIN_PASSWORD", ""),
        "host": os.environ.get("LDAP_HOST", "localhost"),
        "port": os.environ.get("LDAP_PORT") or os.environ.get("OPENLDAP_PORT", "12389"),
        "users_dn": os.environ.get("LDAP_USERS_DN", "ou=users,dc=sicabe,dc=local"),
        "groups_dn": os.environ.get("LDAP_GROUPS_DN", "ou=groups,dc=sicabe,dc=local"),
    }


def is_local(conf: dict) -> bool:
    r = subprocess.run(["docker", "ps", "--format", "{{.Names}}"], capture_output=True, text=True)
    return conf["container"] in r.stdout.split()


def endpoint(conf: dict) -> str:
    return "ldap://localhost" if is_local(conf) else f"ldap://{conf['host']}:{conf['port']}"


def _run(conf: dict, args: list, stdin: str | None = None):
    cmd = (["docker", "exec", "-i", conf["container"]] if is_local(conf) else []) + args
    return subprocess.run(cmd, input=stdin, capture_output=True, text=True)


def _search(conf: dict, base: str, filt: str, attrs: list | None = None) -> list:
    args = ["ldapsearch", "-LLL", "-x", "-H", endpoint(conf), "-D", conf["admin_dn"],
            "-w", conf["password"], "-b", base, filt]
    if attrs:
        args += attrs
    r = _run(conf, args)
    if r.returncode != 0 and "No such object" not in r.stderr:
        raise LdapError(f"ldapsearch gagal: {r.stderr.strip() or 'periksa LDAP_URL/kredensial'}")
    return parse_ldif(r.stdout)


def _apply(conf: dict, tool: str, ldif: str, action: str) -> None:
    """Jalankan ldapadd/ldapmodify/ldapdelete; bila gagal, cetak LDIF setara."""
    if DRY:
        _say(f"{tool} ({action})"); print(_indent(ldif)); return
    r = _run(conf, [tool, "-x", "-H", endpoint(conf), "-D", conf["admin_dn"],
                    "-w", conf["password"]], stdin=ldif)
    if r.returncode != 0:
        print(f"  GAGAL: {r.stderr.strip()}", file=sys.stderr)
        print("  LDIF yang setara (untuk diterapkan admin LDAP):", file=sys.stderr)
        print(_indent(ldif), file=sys.stderr)
        raise LdapError(f"{tool} gagal untuk {action}")
    _say(f"{tool} ok: {action}")


def _delete(conf: dict, dn: str, action: str) -> None:
    """ldapdelete TIDAK membaca LDIF dari stdin — DN diberikan sebagai argumen."""
    if DRY:
        _say(f"ldapdelete ({action})"); print(_indent(f"dn: {dn}")); return
    r = _run(conf, ["ldapdelete", "-x", "-H", endpoint(conf), "-D", conf["admin_dn"],
                    "-w", conf["password"], dn])
    if r.returncode != 0:
        print(f"  GAGAL: {r.stderr.strip()}", file=sys.stderr)
        print(f"  DN: {dn}", file=sys.stderr)
        raise LdapError(f"ldapdelete gagal untuk {action}")
    _say(f"ldapdelete ok: {action}")


def _indent(text: str) -> str:
    return "\n".join("    " + ln for ln in text.strip().splitlines())


def parse_ldif(text: str) -> list:
    entries, cur, prev = [], {}, None
    for raw in text.splitlines():
        if raw.startswith("#"):
            continue
        if not raw.strip():
            if cur:
                entries.append(cur)
            cur, prev = {}, None
            continue
        if raw[:1] == " " and prev:               # lanjutan (folded line)
            cur[prev] = cur[prev] + raw[1:]
            continue
        if ":" not in raw:
            continue
        k, _, v = raw.partition(":")
        k = k.strip()
        v = v.strip()
        if k in cur:
            if not isinstance(cur[k], list):
                cur[k] = [cur[k]]
            cur[k].append(v)
        else:
            cur[k] = v
        prev = k
    if cur:
        entries.append(cur)
    return entries


# ── Query LDAP ──────────────────────────────────────────────────────────────

def groups(conf: dict) -> dict:
    out = {}
    for e in _search(conf, conf["groups_dn"], "(objectClass=groupOfNames)", ["cn", "member"]):
        cn = e.get("cn")
        if cn:
            m = e.get("member", [])
            out[cn] = m if isinstance(m, list) else [m]
    return out


def users(conf: dict) -> list:
    return sorted(e["uid"] for e in _search(conf, conf["users_dn"], "(objectClass=inetOrgPerson)", ["uid"])
                  if e.get("uid"))


def _user_dn(conf: dict, uid: str) -> str:
    return f"uid={uid},{conf['users_dn']}"


def _group_dn(conf: dict, cn: str) -> str:
    return f"cn={cn},{conf['groups_dn']}"


def _next_number(conf: dict) -> int:
    nums = [int(e["uidNumber"]) for e in _search(conf, conf["users_dn"], "(uidNumber=*)", ["uidNumber"])
            if str(e.get("uidNumber", "")).isdigit()]
    return (max(nums) + 1) if nums else 1000


# ── Perintah: group ─────────────────────────────────────────────────────────

def group_list(conf: dict, with_members: bool) -> int:
    for cn, members in sorted(groups(conf).items()):
        print(f"{cn} ({len(members)} member)" if not with_members else cn)
        if with_members:
            for m in members:
                print(f"    {m}")
    return 0


def group_add(conf: dict, cn: str, member_uids: list) -> int:
    if cn in groups(conf):
        raise LdapError(f"grup {cn!r} sudah ada")
    if not member_uids:
        raise LdapError("groupOfNames butuh minimal 1 member — beri --member <uid>")
    lines = [f"dn: {_group_dn(conf, cn)}", "objectClass: groupOfNames", f"cn: {cn}"]
    for uid in member_uids:
        lines.append(f"member: {_user_dn(conf, uid)}")
    _apply(conf, "ldapadd", "\n".join(lines) + "\n", f"buat grup {cn}")
    return 0


def group_remove(conf: dict, cn: str) -> int:
    if cn not in groups(conf):
        raise LdapError(f"grup {cn!r} tidak ada")
    _delete(conf, _group_dn(conf, cn), f"hapus grup {cn}")
    return 0


def group_member(conf: dict, cn: str, uid: str, add: bool) -> int:
    if cn not in groups(conf):
        raise LdapError(f"grup {cn!r} tidak ada")
    verb = "add" if add else "delete"
    ldif = (f"dn: {_group_dn(conf, cn)}\nchangetype: modify\n{verb}: member\n"
            f"member: {_user_dn(conf, uid)}\n")
    _apply(conf, "ldapmodify", ldif, f"{'tambah' if add else 'hapus'} {uid} di {cn}")
    return 0


def group_rename(conf: dict, model_path, old: str, new: str) -> int:
    import authz as A
    if old not in groups(conf):
        raise LdapError(f"grup {old!r} tidak ada")
    if new in groups(conf):
        raise LdapError(f"grup {new!r} sudah ada")
    model = A.load_model(model_path)
    if old not in model.get("roles", {}):
        raise LdapError(f"role {old!r} tidak ada di {model_path} — nama grup LDAP harus sama dengan kunci roles")
    # 1) LDAP: rename entry (modrdn)
    ldif = (f"dn: {_group_dn(conf, old)}\nchangetype: modrdn\nnewrdn: cn={new}\n"
            f"deleteoldrdn: 1\n")
    _apply(conf, "ldapmodify", ldif, f"rename grup LDAP {old} -> {new}")
    # 2) model OPA: ganti kunci role
    roles = model["roles"]
    model["roles"] = { (new if k == old else k): v for k, v in roles.items() }
    A.save_model(model_path, model)
    _say(f"authz.yml: roles {old} -> {new}")
    # 3) StarRocks permitted_groups di bootstrap.sh
    _update_permitted_groups(old, new)
    return 0


# ── Perintah: user ──────────────────────────────────────────────────────────

def user_list(conf: dict, service: bool) -> int:
    if service:
        import authz as A
        for u, r in (A.load_model(A.DEFAULT_MODEL).get("users", {}) or {}).items():
            print(f"{u} -> {r}   (service account)")
        return 0
    for uid in users(conf):
        print(uid)
    return 0


def user_add(conf: dict, uid: str, cn: str | None, mail: str | None,
             password: str | None, group: str | None) -> int:
    if uid in users(conf):
        raise LdapError(f"user {uid!r} sudah ada")
    n = _next_number(conf)
    lines = [f"dn: {_user_dn(conf, uid)}", "objectClass: inetOrgPerson", "objectClass: posixAccount",
             f"uid: {uid}", f"cn: {cn or uid}", f"sn: {cn or uid}", f"mail: {mail or uid + '@sicabe.local'}",
             f"uidNumber: {n}", f"gidNumber: {n}", f"homeDirectory: /home/{uid}"]
    if password:
        lines.append(f"userPassword: {password}")
    _apply(conf, "ldapadd", "\n".join(lines) + "\n", f"buat user {uid}")
    if group:
        group_member(conf, group, uid, add=True)
    print(f"  catatan: pastikan user Keycloak dengan username '{uid}' ada (auth = Keycloak OIDC).")
    return 0


def user_remove(conf: dict, uid: str) -> int:
    if uid not in users(conf):
        raise LdapError(f"user {uid!r} tidak ada")
    dn = _user_dn(conf, uid)
    for cn, members in groups(conf).items():
        if dn in members:
            group_member(conf, cn, uid, add=False)
    _delete(conf, dn, f"hapus user {uid}")
    return 0


# ── Konsistensi: grup LDAP == roles OPA == permitted_groups StarRocks ────────

BS_RE = re.compile(r"('permitted_groups'\s*=\s*')([^']*)(')")


def _bootstrap_path() -> str:
    # Bisa ditimpa (untuk pengujian): SICABE_BOOTSTRAP=/path/ke/bootstrap.sh
    return os.environ.get("SICABE_BOOTSTRAP") or os.path.join(
        os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "bootstrap.sh")


def permitted_groups() -> list:
    with open(_bootstrap_path(), encoding="utf-8") as fh:
        for line in fh:
            m = BS_RE.search(line)
            if m:
                return [g for g in m.group(2).split(",") if g]
    return []


def _update_permitted_groups(old: str, new: str) -> None:
    path = _bootstrap_path()
    with open(path, encoding="utf-8") as fh:
        text = fh.read()
    if f"'{old}'" not in text and f",{old}," not in text and not re.search(rf"\b{re.escape(old)}\b", text):
        return
    new_text = BS_RE.sub(lambda m: m.group(1) + ",".join(new if g == old else g for g in m.group(2).split(",")) + m.group(3), text, count=1)
    if new_text == text:
        print(f"  (permitted_groups tidak memuat {old})")
        return
    if DRY:
        _say(f"bootstrap.sh: permitted_groups {old} -> {new}")
    else:
        with open(path, "w", encoding="utf-8") as fh:
            fh.write(new_text)
        print(f"  bootstrap.sh: permitted_groups {old} -> {new}")


def group_check(conf: dict, model_path) -> int:
    import authz as A
    roles = set(A.load_model(model_path).get("roles", {}))
    cns = set(groups(conf))
    permitted = set(permitted_groups())
    problems = 0
    for c in sorted(cns - roles):
        print(f"  ❌ grup LDAP {c!r} tidak punya role di authz.yml"); problems += 1
    for g in sorted(permitted - roles):
        print(f"  ❌ permitted_groups memuat {g!r} yang bukan role"); problems += 1
    if cns != permitted:
        only_cn, only_pg = sorted(cns - permitted), sorted(permitted - cns)
        if only_cn:
            print(f"  ❌ grup LDAP tanpa permitted_groups: {only_cn}"); problems += 1
        if only_pg:
            print(f"  ❌ permitted_groups tanpa grup LDAP: {only_pg}"); problems += 1
    no_group = sorted(roles - cns)
    if no_group:
        print(f"  ℹ role tanpa grup LDAP (mis. khusus service account): {no_group}")
    if problems == 0:
        print(f"  ✅ konsisten: grup LDAP == permitted_groups ⊆ roles ({len(cns)} grup)")
    else:
        print(f"  {problems} masalah · perbaiki dgn: sicabe-authz group sync / group add")
    return 1 if problems else 0


def group_sync(conf: dict, model_path, apply: bool) -> int:
    import authz as A
    roles = set(A.load_model(model_path).get("roles", {}))
    cns = sorted(groups(conf))
    for c in cns:
        if c not in roles:
            print(f"  ❌ grup LDAP {c!r} tanpa role di authz.yml — tambahkan: sicabe-authz role add {c}")
    # permitted_groups StarRocks = daftar GRUP LDAP (bukan semua role). Setara -> biarkan.
    if set(permitted_groups()) == set(cns):
        print(f"  permitted_groups sudah sinkron ({','.join(permitted_groups())})")
        return 0
    path = _bootstrap_path()
    with open(path, encoding="utf-8") as fh:
        text = fh.read()
    new_text = BS_RE.sub(lambda m: m.group(1) + ",".join(cns) + m.group(3), text, count=1)
    if apply and not DRY:
        with open(path, "w", encoding="utf-8") as fh:
            fh.write(new_text)
        print(f"  bootstrap.sh: permitted_groups -> {','.join(cns)}")
    else:
        _say(f"bootstrap.sh: permitted_groups -> {','.join(cns)}")
    return 0