# bash completion for vpn-router-user                                  -*- shell-script -*-

# The names of the users and of the groups of the router's directory, read as root; nothing for other users.
_vpn_router_user_names()
{
    vpn-router-user --json list 2>/dev/null |
        python3 -c 'import json, sys; print("\n".join(user["name"] for user in json.load(sys.stdin)["users"]))' 2>/dev/null
}

_vpn_router_user_groups()
{
    vpn-router-group --json list 2>/dev/null |
        python3 -c 'import json, sys; print("\n".join(group["name"] for group in json.load(sys.stdin)["groups"]))' 2>/dev/null
}

_vpn_router_user()
{
    local cur prev words cword split
    _init_completion -s || return

    local commands='list add update passwd disable enable unlock remove profile otp-new otp-enrol otp-remove console
        passkeys-remove'

    # The command is the first word that is not an option; the arguments are the words after it but option values.
    local i command='' args=0
    for ((i = 1; i < cword; i++)); do
        if [[ -z $command ]]; then
            [[ ${words[i]} != -* ]] && command=${words[i]}
            continue
        fi
        case ${words[i]} in
            --first-name | --last-name | --email | --display-name | --description | --redirect-uri | \
                --post-logout-redirect-uri | --allowed-group | --account) ((i++)) ;;
            -*) ;;
            *) ((args++)) ;;
        esac
    done

    if [[ -z $command ]]; then
        if [[ $cur == -* ]]; then
            COMPREPLY=($(compgen -W '--json --help' -- "$cur"))
        else
            COMPREPLY=($(compgen -W "$commands" -- "$cur"))
        fi
        return
    fi

    case $prev in
        --allowed-group)
            COMPREPLY=($(compgen -W "$(_vpn_router_user_groups)" -- "$cur"))
            return
            ;;
        --account)
            # The local accounts console --account takes: a uid from 1000 to 19999, not nobody.
            COMPREPLY=($(compgen -W "$(getent passwd | awk -F: '$3 >= 1000 && $3 < 20000 && $1 != "nobody" { print $1 }')" -- "$cur"))
            return
            ;;
        --first-name | --last-name | --email | --display-name | --description | --redirect-uri | --post-logout-redirect-uri)
            return
            ;;
    esac
    $split && return

    if [[ $cur == -* ]]; then
        local options='--help'
        case $command in
            add) options+=' --first-name --last-name --email --service --display-name --description --redirect-uri
                --post-logout-redirect-uri --allowed-group' ;;
            update) options+=' --first-name --last-name --email --display-name --description --redirect-uri
                --post-logout-redirect-uri --allowed-group' ;;
            console) options+=' --posix --account --off' ;;
        esac
        COMPREPLY=($(compgen -W "$options" -- "$cur"))
        return
    fi

    # The user name, which add takes new; otp-enrol then takes a code.
    if ((args == 0)) && [[ $command != @(list|add) ]]; then
        COMPREPLY=($(compgen -W "$(_vpn_router_user_names)" -- "$cur"))
    fi
} &&
    complete -F _vpn_router_user vpn-router-user

# ex: filetype=sh