#!/usr/bin/python3
#
# Like what you see? Join us!
# https://www.univention.com/about-us/careers/vacancies/
#
# Copyright 2004-2025 Univention GmbH
#
# https://www.univention.de/
#
# All rights reserved.
#
# The source code of this program is made available
# under the terms of the GNU Affero General Public License version 3
# (GNU AGPL V3) as published by the Free Software Foundation.
#
# Binary versions of this program provided by Univention to you as
# well as other copyrighted, protected or trademarked materials like
# Logos, graphics, fonts, specific documentations and configurations,
# cryptographic keys etc. are subject to a license agreement between
# you and Univention and not subject to the GNU AGPL V3.
#
# In the case you use this program under the terms of the GNU AGPL V3,
# the program is provided in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License with the Debian GNU/Linux or Univention distribution in file
# /usr/share/common-licenses/AGPL-3; if not, see
# <https://www.gnu.org/licenses/>.

"""Check the samba account flags"""

import sys

import ldap

import univention.config_registry
import univention.uldap


ucr = univention.config_registry.ConfigRegistry()
ucr.load()

baseDN = ucr['ldap/base']

lo = univention.uldap.getAdminConnection().lo


def print_usage():
    print("\nUse: proof_sambaAccountFlags [query|update] \n")
    print("Without options you will see a list of SambaSamAccounts with possibly wrong Flags.", end=' ')
    print("The query-option will request each time for update of such elements, the update-option will", end=' ')
    print("update every found Flag. If you use both options only the first will define", end=' ')
    print("the behavior !\n")


# update all if command update is given
def main():
    # type: () -> None
    update_all = 0
    query = 0
    if len(sys.argv) > 1:
        if sys.argv[1] == "update":
            update_all = 1
        elif sys.argv[1] == "query":
            query = 1
        else:
            print_usage()
            sys.exit()

    # What we going to do:
    # 1. list all objectClass=univentionWindows
    # 2. look if Flag M is set, if yes query

    count_flags = 0
    count_updated_flags = 0

    for windows_dn, windows_attr in lo.search_s(baseDN, ldap.SCOPE_SUBTREE, 'objectClass=univentionWindows', ['sambaAcctFlags']):
        flags = windows_attr["sambaAcctFlags"][0].decode('utf-8')
        if 'M' in flags:
            print("found Windows-Account with old (wrong) Flag M (should be W) in %s (%s)" % (windows_dn, flags))
            count_flags += 1
            inp = ""
            if not update_all:
                if query:
                    print("update Flag (y/N)?")
                    inp = sys.stdin.readline()
            else:
                inp = "y"
            if inp[:1] == "y":
                modlist = [(ldap.MOD_REPLACE, "sambaAcctFlags", flags.replace('M', 'W').encode('utf-8'))]
                lo.modify(windows_dn, modlist)
                print("updated")
                count_updated_flags += 1

    print("Found", count_flags, "flags that seemed to be wrong, updated", end=' ')
    print(count_updated_flags, "of them.")

    if not query and not update_all:
        print("\nRun this script with an option to change the listed flags,")
        print("call \"proof_sambaAccountFlags help\" for details")


if __name__ == "__main__":
    main()
