#! /usr/bin/perl -T
# vim: set filetype=perl ts=4 sw=4 sts=4 et:
# FILEMODE 0700
# FILEOWN 0 0

#>HEADER
use common::sense;
use Getopt::Long qw(:config no_auto_abbrev no_ignore_case);

use File::Basename;
use lib dirname(__FILE__) . '/../../lib/perl';
use OVH::Result;
use OVH::Bastion;
use OVH::Bastion::Helper;

# Fetch command options
my $fnret;
my ($result,  @optwarns);
my ($account, $step);
eval {
    local $SIG{__WARN__} = sub { push @optwarns, shift };
    $result = GetOptions(
        "account=s" => sub { $account //= $_[1] },
        "step=i"    => sub { $step    //= $_[1] },
    );
};
if ($@) { die $@ }

if (!$result) {
    local $" = ", ";
    HEXIT('ERR_BAD_OPTIONS', msg => "Error parsing options: @optwarns");
}

OVH::Bastion::Helper::check_spurious_args();

if (!$account || !defined $step) {
    HEXIT('ERR_MISSING_PARAMETER', msg => "Missing argument 'account' or 'step'");
}

#>RIGHTSCHECK
if ($self eq 'root') {
    osh_debug "Real root, skipping checks of permissions";
}
elsif ($self ne $account) {
    HEXIT('ERR_SECURITY_VIOLATION', msg => "You're not allowed to run this, dear $self");
}

#<RIGHTSCHECK

#>PARAMS:ACCOUNT
osh_debug("Checking account");
$fnret = OVH::Bastion::is_bastion_account_valid_and_existing(account => $account);
$fnret or HEXIT($fnret);
$account = $fnret->value->{'account'};    # untainted

#<PARAMS:ACCOUNT

if ($step == 0) {

    # get password status
    HEXIT(OVH::Bastion::sys_getpasswordinfo(user => $account));
}
elsif ($step == 1) {

    # set a temporary password
    my $password = sprintf("%04d-%04d-%04d-%04d", rand(10000), rand(10000), rand(10000), rand(10000));
    $fnret = OVH::Bastion::sys_changepassword(user => $account, password => $password);
    if (!$fnret) {
        if ($fnret->msg) {
            warn_syslog("Error when calling sys_changepassword(): " . $fnret->msg);
            HEXIT($fnret);
        }

        # chpasswd can fail if there is a PAM misconfiguration or other
        # badly configured subsystem, which can error silently, in which
        # case give a hint to the user, as fnret->msg is empty in this case
        warn_syslog("Error when calling sys_changepassword(): silent error, misconfigured PAM?");
        HEXIT(
            R(
                'ERR_INTERNAL',
                msg => "A system error occurred when attempting to change the password, please check with your sysadmin"
            )
        );
    }
    $fnret or HEXIT($fnret);

    # force password change in 1 day max (it should be done several seconds after anyway)
    $fnret = OVH::Bastion::sys_setpasswordpolicy(
        user         => $account,
        inactiveDays => OVH::Bastion::config('MFAPasswordInactiveDays')->value,
        minDays      => 0,
        maxDays      => 1,
        warnDays     => 1
    );
    $fnret or HEXIT($fnret);

    HEXIT('OK', value => {password => $password});
}

elsif ($step == 2) {
    $fnret = OVH::Bastion::sys_addmembertogroup(user => $account, group => OVH::Bastion::MFA_PASSWORD_CONFIGURED_GROUP);
    $fnret or HEXIT($fnret);

    # now that we have the final password set, apply the bastionwide password policy
    $fnret = OVH::Bastion::sys_setpasswordpolicy(
        user         => $account,
        inactiveDays => OVH::Bastion::config('MFAPasswordInactiveDays')->value,
        minDays      => OVH::Bastion::config('MFAPasswordMinDays')->value,
        maxDays      => OVH::Bastion::config('MFAPasswordMaxDays')->value,
        warnDays     => OVH::Bastion::config('MFAPasswordWarnDays')->value
    );
    $fnret or HEXIT($fnret);

    HEXIT('OK');
}

HEXIT('ERR_INVALID_PARAMETER', msg => "Parameter --step expects 0, 1 or 2");