#!/usr/bin/python
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils import common_koji


ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'status': ['preview'],
    'supported_by': 'community'
}


DOCUMENTATION = '''
---
module: koji_user

short_description: Create and manage Koji user accounts
description:
   - This module can add new users and manage existing users.
   - 'Koji only supports adding new users, not deleting them. Once they are
     defined, you can enable or disable the users with "state: enabled" or
     "state: disabled".'

options:
   name:
     description:
       - The name of the Koji user.
       - 'Example: "kdreyer".'
     required: true
   state:
     description:
       - Whether to set this user as "enabled" or "disabled". If unset, this
         defaults to "enabled".
   permissions:
     description:
       - A list of permissions for this user.
       - 'Example: [admin]'
   krb_principal:
     description:
       - Set a non-default krb principal for this user. If unset, Koji will
         use the standard krb principal scheme for user accounts.
       - Warning, Koji only allows you to set this one time, at the point at
         which you create the new account. You cannot edit the krb_principal
         for an existing account.
requirements:
  - "python >= 2.7"
  - "koji"
'''

EXAMPLES = '''
- name: create a koji user
  hosts: localhost
  tasks:
    - name: Add new kdreyer user
      koji_user:
        name: kdreyer
        state: enabled
        permissions: [admin]
'''


def ensure_user(session, name, check_mode, state, permissions, krb_principal):
    """
    Ensure that this user is configured in Koji.

    :param session: Koji client session
    :param str name: Koji builder user name
    :param bool check_mode: don't make any changes
    :param str state: "enabled" or "disabled"
    :param list permissions: list of permissions for this user.
    :param str krb_principal: custom kerberos principal, or None. Used only at
                              account creation time.
    """
    result = {'changed': False, 'stdout_lines': []}
    if state == 'enabled':
        desired_status = common_koji.koji.USER_STATUS['NORMAL']
    else:
        desired_status = common_koji.koji.USER_STATUS['BLOCKED']
    user = session.getUser(name)
    if not user:
        result['changed'] = True
        result['stdout_lines'] = ['created %s user' % name]
        if check_mode:
            return result
        common_koji.ensure_logged_in(session)
        id_ = session.createUser(name, desired_status, krb_principal)
        user = session.getUser(id_)
    if user['status'] != desired_status:
        result['changed'] = True
        result['stdout_lines'] = ['%s %s user' % (state, name)]
        if not check_mode:
            common_koji.ensure_logged_in(session)
        if state == 'enabled':
            session.enableUser(name)
        else:
            session.disableUser(name)
    if not permissions:
        return result
    current_perms = session.getUserPerms(user['id'])
    to_grant = set(permissions) - set(current_perms)
    to_revoke = set(current_perms) - set(permissions)
    if to_grant or to_revoke:
        result['changed'] = True
        if not check_mode:
            common_koji.ensure_logged_in(session)
    for permission in to_grant:
        result['stdout_lines'].append('grant %s' % permission)
        if not check_mode:
            session.grantPermission(name, permission, True)
    for permission in to_revoke:
        result['stdout_lines'].append('revoke %s' % permission)
        if not check_mode:
            session.revokePermission(name, permission)
    return result


def run_module():
    module_args = dict(
        koji=dict(type='str', required=False),
        name=dict(type='str', required=True),
        permissions=dict(type='list', required=True),
        krb_principal=dict(type='str', required=False, default=None),
        state=dict(type='str', choices=[
                   'enabled', 'disabled'], required=False, default='enabled'),
    )
    module = AnsibleModule(
        argument_spec=module_args,
        supports_check_mode=True
    )

    if not common_koji.HAS_KOJI:
        module.fail_json(msg='koji is required for this module')

    check_mode = module.check_mode
    params = module.params
    profile = params['koji']
    name = params['name']
    state = params['state']

    session = common_koji.get_session(profile)

    result = ensure_user(session, name, check_mode, state,
                         permissions=params['permissions'],
                         krb_principal=params['krb_principal'])

    module.exit_json(**result)


def main():
    run_module()


if __name__ == '__main__':
    main()