#!/usr/bin/env bash
set -euo pipefail

GROUP="family"
PSO="family-relaxed"
PRECEDENCE="200"

[[ $# -eq 1 ]] || { echo "Usage: $0 user1,user2,user3"; exit 1; }

SUDO=(sudo)
[[ "${EUID}" -eq 0 ]] && SUDO=()

IFS=',' read -ra USERS <<< "$1"

# Return 0 if the given option string appears in pso create --help
pso_supports() {
  local opt="$1"
  "${SUDO[@]}" samba-tool domain passwordsettings pso create --help 2>&1 | grep -q -- "${opt}"
}

echo "Ensuring group exists: ${GROUP}"
if ! "${SUDO[@]}" samba-tool group show "${GROUP}" >/dev/null 2>&1; then
  "${SUDO[@]}" samba-tool group add "${GROUP}"
else
  echo "Group ${GROUP} already exists"
fi

echo "Ensuring relaxed password policy exists: ${PSO}"
if ! "${SUDO[@]}" samba-tool domain passwordsettings pso show "${PSO}" >/dev/null 2>&1; then
  # Build args using only options supported by this samba-tool build.
  ARGS=( domain passwordsettings pso create "${PSO}" "${PRECEDENCE}" )

  # Min length
  if pso_supports --min-pwd-length; then
    ARGS+=( --min-pwd-length=4 )
  fi

  # Complexity off
  if pso_supports --complexity; then
    ARGS+=( --complexity=off )
  fi

  # Never expire
  if pso_supports --max-pwd-age; then
    ARGS+=( --max-pwd-age=0 )
  fi
  if pso_supports --min-pwd-age; then
    ARGS+=( --min-pwd-age=0 )
  fi

  # Password history option name varies across builds
  if pso_supports --pwd-history-length; then
    ARGS+=( --pwd-history-length=0 )
  elif pso_supports --password-history; then
    ARGS+=( --password-history=0 )
  fi

  # Lockout option names vary too; only add if supported
  if pso_supports --lockout-threshold; then
    ARGS+=( --lockout-threshold=0 )
  elif pso_supports --lockout-limit; then
    ARGS+=( --lockout-limit=0 )
  fi

  echo "Creating PSO ${PSO} with supported options..."
  "${SUDO[@]}" samba-tool "${ARGS[@]}"
else
  echo "PSO ${PSO} already exists"
fi

echo "Applying PSO ${PSO} to group ${GROUP}"
out="$("${SUDO[@]}" samba-tool domain passwordsettings pso apply "${PSO}" "${GROUP}" 2>&1)" || true
if echo "$out" | grep -q "already applies"; then
  echo "PSO ${PSO} already applies to ${GROUP}"
elif echo "$out" | grep -qi "^ERROR:"; then
  echo "$out" >&2
  exit 1
else
  echo "$out"
fi

echo "Creating/ensuring users and adding to ${GROUP}"
for user in "${USERS[@]}"; do
  user="$(echo "$user" | xargs)"
  [[ -n "$user" ]] || continue

  echo "  - ${user}"
  if ! "${SUDO[@]}" samba-tool user show "${user}" >/dev/null 2>&1; then
      TMPPW="$(openssl rand -base64 36 | tr -d '\n' | tr '/+' 'Aa' | cut -c1-20)1aA!"
      "${SUDO[@]}" samba-tool user create "${user}" "${TMPPW}"
      echo "    created with temporary strong password"
  else
      echo "    user exists"
  fi

  # membership first
  "${SUDO[@]}" samba-tool group addmembers "${GROUP}" "${user}" >/dev/null 2>&1 || true

  # ensure password never expires
  "${SUDO[@]}" samba-tool user setexpiry "${user}" --noexpiry >/dev/null
  "${SUDO[@]}" samba-tool user setpassword "${user}" --must-change-at-next-login=no

  # now set the final (possibly weak) password under the PSO
  echo "    set final password for ${user}"
  "${SUDO[@]}" samba-tool user setpassword "${user}"
done

echo "Done."
echo "Verify:"
echo "  sudo samba-tool group listmembers ${GROUP}"
echo "  sudo samba-tool domain passwordsettings pso show-user anna"