#!/usr/bin/python3
"""Manage the users of the router's directory from the command line, with vpnrouter_users.

Passwords and TOTP secrets are read from the first line of standard input, never from the
command line. The
answer is text for people on standard output, and a failure is a message on standard error.
With --json the answer is JSON on standard output, and a failure is {"error": ...} there too.
The exit status says what failed: 2 the request is invalid, 3 the user does not exist, 4 the
user exists, 1 anything else. -h or --help shows the commands and their options.

  vpn-router-user [--json] list
  vpn-router-user [--json] add <name> --first-name F --last-name L --email E   (password on stdin)
  vpn-router-user [--json] add <name> [--email E]   (a Manager-only account; password on stdin)
  vpn-router-user [--json] add <name> --service [--display-name N] [--description D] [--email E]
                  [--redirect-uri U ...] [--post-logout-redirect-uri U ...] [--allowed-group G ...]
                                                  (a service account; password on stdin)
  vpn-router-user [--json] update <name> [--first-name F] [--last-name L] [--email E]
  vpn-router-user [--json] update <name> [--display-name N] [--description D] [--email E]
                  [--redirect-uri U ...] [--post-logout-redirect-uri U ...] [--allowed-group G ...]
                                                  (a service account)

A service account with a redirect URI is a client of the OpenID Provider; each of the three options may be repeated,
and replaces all values of its kind; one '' removes them.
  vpn-router-user [--json] passwd <name>       (password on stdin)
  vpn-router-user [--json] disable <name>
  vpn-router-user [--json] enable <name>
  vpn-router-user [--json] unlock <name>
  vpn-router-user [--json] remove <name>
  vpn-router-user [--json] profile <name>
  vpn-router-user [--json] otp-new <name>
  vpn-router-user [--json] otp-enrol <name> <code>   (secret on stdin)
  vpn-router-user [--json] otp-remove <name>
  vpn-router-user [--json] console <name> (--posix | --account LOCAL | --off)
  vpn-router-user [--json] passkeys-remove <name>
"""

import argparse
import json
import sys

sys.path.insert(0, '/usr/lib/vpn-router')

import ldap

import vpnrouter
import vpnrouter_auth
import vpnrouter_passkeys
import vpnrouter_s3
import vpnrouter_users
from vpnrouter_users import Failure

#: The help line of each command.
HELP = {
    'list': 'list the users',
    'add': 'add a VPN user with the three person options and issue the certificate, or without the names a '
           'Manager-only account, or with --service a service account, each with an optional e-mail address; the '
           'password is read from standard input',
    'update': "change the first name, the last name or the e-mail address; a Manager-only account has only the "
              "e-mail address, which '' removes",
    'passwd': 'set the password, read from standard input',
    'disable': 'lock the user out of OpenVPN',
    'enable': 'let the user in again',
    'unlock': 'end a lockout after failed logins',
    'remove': 'revoke the certificate and remove the user',
    'profile': 'print the OpenVPN client profile',
    'otp-new': 'make a TOTP secret and its otpauth URI; nothing is stored',
    'otp-enrol': 'store the TOTP secret read from standard input, when the code is a code of it',
    'otp-remove': 'remove the TOTP token',
    'console': "switch the console login of a member of admins with a TOTP token on, as the user's own POSIX account "
               'in the directory or as a local account, or off',
    'passkeys-remove': "remove all the user's passkeys",
}

#: The help of the person options.
PERSON_HELP = {'first_name': 'the first name', 'last_name': 'the last name', 'email': 'the e-mail address',
               'display_name': "a service account's display name; '' removes it",
               'description': "a service account's description; '' removes it"}

#: The OpenID Provider client settings of a service account, their options and help.
CLIENT_OPTIONS = (
    ('redirect_uris', 'redirect-uri', 'a redirect URI of the OpenID Provider client'),
    ('post_logout_redirect_uris', 'post-logout-redirect-uri', 'a post-logout redirect URI of the OpenID Provider client'),
    ('allowed_groups', 'allowed-group', 'a group whose members may sign in to the OpenID Provider client'),
)


class Parser(argparse.ArgumentParser):
    """An argument parser whose errors are Failures with status 2, so that --json answers them as JSON."""

    def error(self, message):
        raise Failure(f'{message}; see {self.prog} --help', 2)


def parse(argv):
    parser = Parser(prog='vpn-router-user', description='Manage the users of the router.')
    parser.add_argument('--json', action='store_true', help='answer in JSON')
    commands = parser.add_subparsers(dest='command', required=True, metavar='command', parser_class=Parser)
    for command, text in HELP.items():
        sub = commands.add_parser(command, help=text, description=text[0].upper() + text[1:] + '.')
        if command != 'list':
            sub.add_argument('name', help='the user name')
        if command in ('add', 'update'):
            for key, _ in vpnrouter_users.PERSON + vpnrouter_users.LABELS:
                sub.add_argument(f'--{key.replace("_", "-")}', dest=key, metavar='TEXT', help=PERSON_HELP[key])
            for key, option, text in CLIENT_OPTIONS:
                sub.add_argument(f'--{option}', dest=key, action='append', metavar='VALUE',
                                 help=f"{text}, of a service account; repeat it for more, '' for none")
        if command == 'add':
            sub.add_argument('--service', action='store_true', help='add a service account, which cannot sign in to the web service')
        if command == 'otp-enrol':
            sub.add_argument('code', help='a code of the secret from the authenticator')
        if command == 'console':
            choice = sub.add_mutually_exclusive_group(required=True)
            choice.add_argument('--posix', action='store_true', help="run the console as the user's own POSIX account")
            choice.add_argument('--account', metavar='LOCAL', help='run the console as this local account')
            choice.add_argument('--off', action='store_true', help='switch console login off')
    return parser.parse_args(argv)


def password():
    """The password or the TOTP secret from the first line of standard input."""
    return sys.stdin.readline().rstrip('\n')


def run(connection, options, secret):
    """The answer of the command the options name; secret is the password of add and passwd, the TOTP secret of otp-enrol."""
    command = options.command
    if command == 'list':
        return vpnrouter_users.list_users(connection)
    values = {key: getattr(options, key, None) for key, _ in vpnrouter_users.PERSON + vpnrouter_users.LABELS}
    for key, _, _ in CLIENT_OPTIONS:
        given = getattr(options, key, None)
        if given is not None:
            values[key] = [value for value in given if value]
    if command == 'add':
        return vpnrouter_users.add(connection, options.name, secret, values, service=options.service)
    if command == 'update':
        return vpnrouter_users.update(connection, options.name, values)
    if command == 'passwd':
        return vpnrouter_users.passwd(connection, options.name, secret)
    if command == 'otp-enrol':
        return vpnrouter_users.otp_enrol(connection, options.name, secret, options.code)
    if command == 'console':
        return vpnrouter_users.console(connection, options.name, not options.off, options.account)
    if command == 'passkeys-remove':
        return vpnrouter_passkeys.remove(connection, options.name)
    return getattr(vpnrouter_users, command.replace('-', '_'))(connection, options.name)


def console_text(user):
    """The console login of a user as a cell: -, off, posix (uid N) or local and the account, refused without a TOTP
    token."""
    console = user['console']
    if console is None or not console['enabled']:
        return '-' if console is None else 'off'
    text = f'local {console["account"]}' if console['local'] else f'posix (uid {console["uid"]})'
    return text if user['otp'] else f'{text}, refused: no OTP'


def client_text(user):
    """The OpenID Provider client settings of a service account as a cell: -, or the numbers of its URIs and its allowed
    groups."""
    if not user.get('redirect_uris'):
        return '-'
    groups = ','.join(user['allowed_groups']) or 'all users'
    return f'{len(user["redirect_uris"])} redirect, {len(user["post_logout_redirect_uris"])} logout, {groups}'


def text_of(answer):
    """The answer as text for people."""
    if 'profile' in answer:
        return answer['profile'].rstrip('\n')
    if 'secret' in answer:
        return f'secret  {answer["secret"]}\nuri     {answer["uri"]}'
    if answer.get('removed'):
        return f'user {answer["name"]} removed'
    users = answer['users'] if 'users' in answer else [answer]
    if not users:
        return 'no users'
    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'PASSKEYS', 'CONSOLE', 'FIRST NAME', 'LAST NAME', 'E-MAIL',
            'OIDC CLIENT')
    rows = [(user['name'], 'internal' if user['internal'] else 'service' if user['service'] else 'manager' if user['manager_only'] else 'vpn',
             'disabled' if not user['enabled'] else 'locked' if user['locked'] else 'enabled',
             'issued' if user['certificate'] else 'missing',
             'enrolled' if user['otp'] else '-', str(len(user['passkeys'])) if user['passkeys'] else '-', console_text(user),
             user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-', client_text(user))
            for user in users]
    widths = [max(len(row[column]) for row in (head, *rows)) for column in range(len(head))]
    return '\n'.join('  '.join(cell.ljust(width) for cell, width in zip(row, widths)).rstrip() for row in (head, *rows))


def main(argv):
    # A request that cannot be parsed is answered in JSON when --json is among the arguments.
    as_json = '--json' in argv
    try:
        options = parse(argv)
        as_json = options.json
        if options.command != 'list':
            vpnrouter_users.check_name(options.name)
        secret = password() if options.command in ('add', 'passwd', 'otp-enrol') else None
        with vpnrouter_users.session() as connection:
            answer = run(connection, options, secret)
        if options.command in vpnrouter_auth.REVOKING:
            vpnrouter_auth.revoke(vpnrouter.load_config(), options.name)
        if options.command in vpnrouter_s3.FOLLOWING and (problem := vpnrouter_s3.follow(options.name)):
            print(f'vpn-router-user: {problem}', file=sys.stderr)
    except Failure as failure:
        message, status = str(failure), failure.status
    except (ldap.LDAPError, OSError) as exc:
        message, status = f'the user directory failed: {exc}', 1
    except vpnrouter_auth.DatabaseError as exc:
        message, status = str(exc), 1
    else:
        print(json.dumps(answer) if as_json else text_of(answer))
        return 0
    if as_json:
        print(json.dumps({'error': message}))
    else:
        print(f'vpn-router-user: {message}', file=sys.stderr)
    return status


if __name__ == '__main__':
    sys.exit(main(sys.argv[1:]))