module Propellor.Property.User where

import System.Posix

import Propellor.Base
import qualified Propellor.Property.File as File

data Eep = YesReallyDeleteHome

accountFor :: User -> Property DebianLike
accountFor user@(User u) = tightenTargets $ check nohomedir go
	`describe` ("account for " ++ u)
  where
	nohomedir = isNothing <$> catchMaybeIO (homedir user)
	go = cmdProperty "adduser"
		[ "--disabled-password"
		, "--gecos", ""
		, u
		]

systemAccountFor :: User -> Property DebianLike
systemAccountFor user@(User u) = systemAccountFor' user Nothing (Just (Group u))

systemAccountFor' :: User -> Maybe FilePath -> Maybe Group -> Property DebianLike
systemAccountFor' (User u) mhome mgroup = tightenTargets $ check nouser go
	`describe` ("system account for " ++ u)
  where
	nouser = isNothing <$> catchMaybeIO (getUserEntryForName u)
	go = cmdProperty "adduser" $
		[ "--system" ]
		++
		"--home" : maybe
			["/nonexistent", "--no-create-home"]
			( \h -> [ h ] )
			mhome
		++
		maybe [] ( \(Group g) -> ["--ingroup", g] ) mgroup
		++
		[ "--shell", "/usr/bin/nologin"
		, "--disabled-login"
		, "--disabled-password"
		, u
		]

-- | Removes user home directory!! Use with caution.
nuked :: User -> Eep -> Property DebianLike
nuked user@(User u) _ = tightenTargets $ check hashomedir go
	`describe` ("nuked user " ++ u)
  where
	hashomedir = isJust <$> catchMaybeIO (homedir user)
	go = cmdProperty "userdel"
		[ "-r"
		, u
		]

-- | Only ensures that the user has some password set. It may or may
-- not be a password from the PrivData.
hasSomePassword :: User -> Property (HasInfo + DebianLike)
hasSomePassword user = hasSomePassword' user hostContext

-- | While hasSomePassword uses the name of the host as context,
-- this allows specifying a different context. This is useful when
-- you want to use the same password on multiple hosts, for example.
hasSomePassword' :: IsContext c => User -> c -> Property (HasInfo + DebianLike)
hasSomePassword' user context = check ((/= HasPassword) <$> getPasswordStatus user) $
	hasPassword' user context

-- | Ensures that a user's password is set to a password from the PrivData.
-- (Will change any existing password.)
--
-- A user's password can be stored in the PrivData in either of two forms;
-- the full cleartext <Password> or a <CryptPassword> hash. The latter
-- is obviously more secure.
hasPassword :: User -> Property (HasInfo + DebianLike)
hasPassword user = hasPassword' user hostContext

hasPassword' :: IsContext c => User -> c -> Property (HasInfo + DebianLike)
hasPassword' (User u) context = go
	`requires` shadowConfig True
  where
	go :: Property (HasInfo + UnixLike)
	go = withSomePrivData srcs context $
		property (u ++ " has password") . setPassword
	srcs =
		[ PrivDataSource (CryptPassword u)
			"a crypt(3)ed password, which can be generated by, for example: perl -e 'print crypt(shift, q{$6$}.shift)' 'somepassword' 'somesalt'"
		, PrivDataSource (Password u) ("a password for " ++ u)
		]

setPassword :: (((PrivDataField, PrivData) -> Propellor Result) -> Propellor Result) -> Propellor Result
setPassword getpassword = getpassword $ go
  where
	go (Password user, password) = chpasswd (User user) (privDataVal password) []
	go (CryptPassword user, hash) = chpasswd (User user) (privDataVal hash) ["--encrypted"]
	go (f, _) = error $ "Unexpected type of privdata: " ++ show f

-- | Makes a user's password be the passed String. Highly insecure:
-- The password is right there in your config file for anyone to see!
hasInsecurePassword :: User -> String -> Property DebianLike
hasInsecurePassword u@(User n) p = property (n ++ " has insecure password") $
	chpasswd u p []

chpasswd :: User -> String -> [String] -> Propellor Result
chpasswd (User user) v ps = makeChange $ withHandle StdinHandle createProcessSuccess
	(proc "chpasswd" ps) $ \h -> do
		hPutStrLn h $ user ++ ":" ++ v
		hClose h

lockedPassword :: User -> Property DebianLike
lockedPassword user@(User u) = tightenTargets $ 
	check (not <$> isLockedPassword user) go
		`describe` ("locked " ++ u ++ " password")
  where
	go = cmdProperty "passwd"
		[ "--lock"
		, u
		]

data PasswordStatus = NoPassword | LockedPassword | HasPassword
	deriving (Eq)

getPasswordStatus :: User -> IO PasswordStatus
getPasswordStatus (User