package App::Netdisco::Web::Plugin::AdminTask::Users;

use Dancer ':syntax';
use Dancer::Plugin::Ajax;
use Dancer::Plugin::DBIC;
use Dancer::Plugin::Auth::Extensible;
use Dancer::Plugin::Passphrase;

use App::Netdisco::Web::Plugin;
use App::Netdisco::Util::Port 'sync_portctl_roles';
use List::MoreUtils 'uniq';
use Digest::MD5 ();

register_admin_task({
  tag => 'users',
  label => 'User Management',
  provides_csv => 1,
});

sub _sanity_ok {
    return 0 unless param('username')
      and param('username') =~ m/^[[:print:] ]+$/;
    return 1;
}

sub _make_password {
  my $pass = (shift || passphrase->generate_random);
  if (setting('safe_password_store')) {
      return passphrase($pass)->generate;
  }
  else {
      return Digest::MD5::md5_hex($pass),
  }
}

ajax '/ajax/control/admin/users/add' => require_role setting('defanged_admin') => sub {
    send_error('Bad Request', 400) unless _sanity_ok();

    schema('netdisco')->txn_do(sub {
      schema('netdisco')->resultset('User')
        ->create({
          username => param('username'),
          fullname => param('fullname'),

          (param('auth_method') eq 'permanent_token' ? (
            password => undef,
            ldap => \'false', radius => \'false', tacacs => \'false',
            token_auth_only  => \'true',
            token_no_expire  => \"true",
            token_acl        => (param('token_acl') || undef),
          ) : (
            password => _make_password(param('password')),
            token_auth_only => \'false',
            token_no_expire => \"false",
            token_acl       => undef,
            (param('auth_method') ? (
              (ldap => (param('auth_method') eq 'ldap' ? \'true' : \'false')),
              (radius => (param('auth_method') eq 'radius' ? \'true' : \'false')),
              (tacacs => (param('auth_method') eq 'tacacs' ? \'true' : \'false')),
            ) : (
              ldap => \'false',
              radius => \'false',
              tacacs => \'false',
            )),
          )),

          port_control => (param('port_control') ? \'true' : \'false'),
          portctl_role =>
            ((param('port_control') and param('port_control') ne '_global_')
              ? param('port_control') : ''),

          admin => (param('admin') ? \'true' : \'false'),
          note => param('note'),
        });
    });

    return '';
};

ajax '/ajax/control/admin/users/del' => require_role setting('defanged_admin') => sub {
    send_error('Bad Request', 400) unless _sanity_ok();

    schema('netdisco')->txn_do(sub {
      schema('netdisco')->resultset('User')
        ->find({username => param('username')})->delete;
    });

    return '';
};

ajax '/ajax/control/admin/users/update' => require_role setting('defanged_admin') => sub {
    send_error('Bad Request', 400) unless _sanity_ok();

    schema('netdisco')->txn_do(sub {
      my $user = schema('netdisco')->resultset('User')
        ->find({username => param('username')});
      return unless $user;

      $user->update({
        fullname => param('fullname'),

        ((param('auth_method') eq 'permanent_token') ? (
          password => undef,
          ldap => \'false', radius => \'false', tacacs => \'false',
          token_auth_only  => \'true',
          token_no_expire  => (param('auth_method') eq 'permanent_token' ? \"true" : \"false"),
          token_acl        => (param('token_acl') || undef),
        ) : (
          token_auth_only => \'false',
          token_no_expire => \"false",
          token_acl       => undef,
          ((param('password') and param('password') ne '********')
            ? (password => _make_password(param('password')))
            : ()),
          (param('auth_method') ? (
            (ldap => (param('auth_method') eq 'ldap' ? \'true' : \'false')),
            (radius => (param('auth_method') eq 'radius' ? \'true' : \'false')),
            (tacacs => (param('auth_method') eq 'tacacs' ? \'true' : \'false')),
          ) : (
            ldap => \'false',
            radius => \'false',
            tacacs => \'false',
          )),
        )),

        port_control => (param('port_control') ? \'true' : \'false'),
        portctl_role =>
          ((param('port_control') and param('port_control') ne '_global_')
            ? param('port_control') : ''),

        admin => (param('admin') ? \'true' : \'false'),
        note => param('note'),
      });
    });

    return '';
};

ajax '/ajax/control/admin/users/token' => require_role setting('defanged_admin') => sub {
  send_error('Bad Request', 400) unless _sanity_ok();

  my $user = schema('netdisco')->resultset('User')
    ->find({ username => param('username') });
  send_error('Not Found', 404) unless $user and $user->in_storage;

  my $token;
  schema('netdisco')->txn_do(sub {
    $user->update({ token => \'md5(random()::text)', token_from => time });
    $user->discard_changes();
    $token = $user->token;
  });

  header('Content-Type' => 'text/plain');
  return $token;
};

get '/ajax/content/admin/users' => require_role admin => sub {
    my @results = schema('netdisco')->resultset('User')
      ->search(undef, {
        '+columns' => {
          created    => \"to_char(creation, 'YYYY-MM-DD HH24:MI')",
          last_seen  => \"to_char(last_on,  'YYYY-MM-DD HH24:MI')",
          token_hint => \"right(token, 8)",
        },
        order_by => [qw/fullname username/]
      })->hri->all;

    return unless scalar @results;

    sync_portctl_roles();
    my @port_control_roles = keys %{ setting('portctl_by_role') || {} };
    push @port_control_roles,
      schema(vars->{'tenant'})->resultset('AccessControlListName')->host_port_acl_names;

    my @host_group_acls =
      schema(vars->{'tenant'})->resultset('AccessControlListName')->host_acl_names;

    if ( request->is_ajax ) {
        template 'ajax/admintask/users.tt',
            { results => \@results,
              host_group_acls => [ uniq sort {$a cmp $b} @host_group_acls ],
              port_control_roles => [ uniq sort {$a cmp $b} @port_control_roles ],
            },
            { layout  => undef };
    }
    else {
        header( 'Content-Type' => 'text/comma-separated-values' );
        template 'ajax/admintask/users_csv.tt',
            { results => \@results, },
            { layout  => undef };
    }
};

true;
