#!/bin/bash
#
VERSION=1

. /usr/share/univention-appcenter/joinscripthelper.sh
joinscript_init
eval "$(univention-config-registry shell)"

# TODO FIXME: remove following line!
SERVICE=borgbackup

ucs_addServiceToLocalhost "$SERVICE" "$@"

UDM_SYNTAX="$(cat << EOF | bzip2 | base64
import base64

class borgbackupRepository(simple):
	"""
	Simple syntax that checks for a valid repository name for borgbackup.

	>>> borgbackupRepository.parse('a')
	'a'
	>>> borgbackupRepository.parse('0')
	'0'
	>>> borgbackupRepository.parse('')
	Traceback (most recent call last):
	...
	valueError: This is not a valid repository name.
	>>> borgbackupRepository.parse('a' * 64)
	Traceback (most recent call last):
	...
	valueError: This is not a valid repository name.
	>>> borgbackupRepository.parse('!')
	Traceback (most recent call last):
	...
	valueError: This is not a valid repository name.
	>>> borgbackupRepository.parse('-')
	Traceback (most recent call last):
	...
	valueError: This is not a valid repository name.
	"""
	min_length = 1
	max_length = 63
	regex = re.compile(r"^(?![_-])[a-zA-Z0-9_-]{1,63}(?<![_-])$")
	error_message = _("This is not a valid repository name.")

class borgbackupSshKey(simple):
	"""
	Simple syntax that checks for a valid SSH key entry for authorized_keys file.
	<type> <key> <host>
	"""
	min_length = 16
	max_length = 1024
	# ssh-... <BASE64> <COMMENT>
	regex = re.compile(r"^\s*ssh-[a-z0-9-]+\s+[a-zA-Z0-9+/=]+\s+[a-zA-Z0-9@.:-]+\s*$")

	@classmethod
	def parse(self, text):
		try:
			key_type, key_data, comment = text.split()
		except valueError:
			raise univention.admin.uexceptions.valueError(_('Not a valid SSH key entry! (type key host)'))

		if key_data != base64.b64encode(base64.b64decode(key_data)):
			raise univention.admin.uexceptions.valueError(_('Not a valid SSH key entry! (invalid key data)'))

		return '{} {} {}'.format(key_type, key_data, comment)

class borgbackupKeyEntry(complex):
	"""
	Syntax for a borg backups SSH key entry
	"""
	delimiter = ' , '
	subsyntaxes = [(_('SSH key'), borgbackupSshKey), (_('Repository'), borgbackupRepository)]
	all_required = True
	subsyntax_names = ('sshkey', 'repository')
	size = ('FourThirds', 'TwoThirds')
EOF
)"


udm container/cn create --ignore_exists --position "cn=univention,$ldap_base" \
	--set name='udm_syntax'
udm settings/udm_syntax create --ignore_exists \
	--position "cn=udm_syntax,cn=univention,$ldap_base" \
	--set name="borgbackupSyntax" \
	--set filename="borgbackupSyntax.py" \
	--set data="$UDM_SYNTAX" \
	--set package="$SERVICE" \
	--set packageversion="$VERSION"

udm container/cn create --ignore_exists --position "cn=custom attributes,cn=univention,$ldap_base" \
	--set name='borgbackup'

udm settings/extended_attribute create --ignore_exists \
	--position "cn=borgbackup,cn=custom attributes,cn=univention,$ldap_base" \
	--set name='borgbackup-user-sshkey-fullaccess' \
	--set module='users/user' \
	--set tabName='Borgbackup' \
	--set groupName='SSH public keys for full access' \
	--set translationGroupName='"de_DE" "SSH-Schlüssel für vollen Zugriff"' \
	--set shortDescription='SSH public keys for full access' \
	--set translationShortDescription='"de_DE" "SSH-Schlüssel für vollen Zugriff"' \
	--set longDescription='A set of SSH public keys that allow full access to the specified repositories.' \
	--set translationLongDescription='"de_DE" "Ein Set aus SSH-Public-Keys, die den vollen Zugriff auf die angegebenen Repositories erlauben."' \
	--set objectClass='borgbackupUser' \
	--set ldapMapping='borgbackupSSHKeyFullAccess' \
	--set syntax="borgbackupKeyEntry" \
	--set fullWidth=1 \
	--set multivalue=1 \
	--set mayChange=1 \
	--set valueRequired=0

udm settings/extended_attribute create --ignore_exists \
	--position "cn=borgbackup,cn=custom attributes,cn=univention,$ldap_base" \
	--set name='borgbackup-user-sshkey-appendonly' \
	--set module='users/user' \
	--set tabName='Borgbackup' \
	--set groupName='SSH public keys for append-only access' \
	--set translationGroupName='"de_DE" "SSH-Schlüssel für Nur-Anhängen-Zugriff"' \
	--set shortDescription='SSH public keys for append-only access' \
	--set translationShortDescription='"de_DE" "SSH-Schlüssel für Nur-Anhängen-Zugriff"' \
	--set longDescription='A set of SSH public keys that allow append-only access to the specified repositories.' \
	--set translationLongDescription='"de_DE" "Ein Set aus SSH-Public-Keys, die nur anhängenden Zugriff auf die angegebenen Repositories erlauben."' \
	--set objectClass='borgbackupUser' \
	--set ldapMapping='borgbackupSSHKeyAppendOnly' \
	--set syntax="borgbackupKeyEntry" \
	--set fullWidth=1 \
	--set multivalue=1 \
	--set mayChange=1 \
	--set valueRequired=0

joinscript_save_current_version

exit 0
