#! /usr/bin/perl -T
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
# NEEDGROUP osh-auditor
# SUDOERS %osh-auditor ALL=(root) NOPASSWD:/usr/bin/env perl -T /opt/bastion/bin/helper/osh-accountGetPasswordInfo *
# FILEMODE 0700
# FILEOWN 0 0

#>HEADER
use common::sense;
use Getopt::Long qw(:config no_auto_abbrev no_ignore_case);
use Sys::Hostname ();

use File::Basename;
use lib dirname(__FILE__) . '/../../lib/perl';
use OVH::Bastion;
use OVH::Bastion::Helper;

# Fetch command options
my $fnret;
my ($result,  @optwarns);
my ($account, $all);
eval {
    local $SIG{__WARN__} = sub { push @optwarns, shift };
    $result = GetOptions(
        "account=s" => sub { $account //= $_[1] },
        "all"       => sub { $all     //= $_[1] },
    );
};
if ($@) { die $@ }

if (!$result) {
    local $" = ", ";
    HEXIT('ERR_BAD_OPTIONS', msg => "Error parsing options: @optwarns");
}

OVH::Bastion::Helper::check_spurious_args();

if (!$account && !$all) {
    HEXIT('ERR_MISSING_PARAMETER', msg => "Missing argument 'account' or 'all'");
}

#<HEADER

#>PARAMS:ACCOUNT
if ($account) {
    osh_debug("Checking account");
    $fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $account);
    $fnret or HEXIT($fnret);

    # get returned untainted value
    $account = $fnret->value->{'account'};
}

#<PARAMS:ACCOUNT

#>RIGHTSCHECK
if ($self eq 'root') {
    osh_debug "Real root, skipping checks of permissions";
}
else {
    $fnret = OVH::Bastion::is_user_in_group(user => $self, group => "osh-auditor");
    $fnret or HEXIT('ERR_SECURITY_VIOLATION', msg => "You're not allowed to run this, dear $self");
}

#<RIGHTSCHECK

#>CODE
if ($account) {
    HEXIT(OVH::Bastion::sys_getpasswordinfo(user => $account));
}
$fnret = OVH::Bastion::get_account_list();
$fnret or HEXIT($fnret);

my %ret;
foreach my $acc (keys %{$fnret->value}) {
    $ret{$acc} = OVH::Bastion::sys_getpasswordinfo(user => $acc)->value;
    $ret{$acc}{'name'} = $acc;
}
HEXIT('OK', value => \%ret);