#!/usr/share/ucs-test/runner python
## -*- coding: utf-8 -*-
## desc: check login authentication
## tags: [apptest]
## exposure: dangerous
## packages:
##   - univention-ox

import univention.testing.udm as testing_udm
import univention.testing.ucr as testing_ucr
import univention.testing.strings as uts
import univention.testing.utils as utils
from univention.ox.api.http.http_api_client import OXHttpApi, LoginError
from essential.common import OXTestEmptyQueue
from univention.ox.wait_for_ox_server import wait_for_ox_server


wait_for_ox_server()
with testing_udm.UCSTestUDM() as udm, testing_ucr.UCSTestConfigRegistry() as ucr, OXTestEmptyQueue():
	mail_domain = ucr['mail/hosteddomains'].split()[0]

	print('*** Creating non-OX user...')
	nonox_user_password = uts.random_string()
	nonox_user_dn, nonox_username = udm.create_user(
		mailPrimaryAddress='{}@{}'.format(uts.random_username(), mail_domain),
		password=nonox_user_password,
		isOxUser='Not')

	try:
		OXHttpApi(nonox_username, nonox_user_password)
	except LoginError as exc:
		print('*** OK: could not log in with non-OX user.')
	else:
		utils.fail('Could login with non-OX user')

	print('*** Converting non-OX user to OX user...')
	converted_user_password = uts.random_string()
	converted_user_dn, converted_username = udm.create_user(
		password=converted_user_password,
		isOxUser='Not')

	try:
		OXHttpApi(converted_username, converted_user_password)
	except LoginError as exc:
		print('*** OK: could not log in with non-OX user.')
	else:
		utils.fail('Could login with non-OX user (user is about to be activated)')

	# activate OX features at user object
	udm.modify_object(
		'users/user',
		dn=converted_user_dn,
		mailPrimaryAddress='{}@{}'.format(uts.random_username(), mail_domain),
		isOxUser='OK')

	try:
		OXHttpApi(converted_username, converted_user_password)
	except LoginError as exc:
		utils.fail('Could not login with correct password.')
	print('*** OK: logged in with correct password.')

	print('*** Creating OX user...')
	ox_user_password = uts.random_string()
	ox_user_dn, ox_username = udm.create_user(
		mailPrimaryAddress='{}@{}'.format(uts.random_username(), mail_domain),
		password=ox_user_password,
		isOxUser='OK')

	try:
		OXHttpApi(ox_username, ox_user_password)
	except LoginError as exc:
		utils.fail('Could not login with correct password.')
	print('*** OK: logged in with correct password.')

	try:
		OXHttpApi(ox_username, ox_user_password + 'a')
	except LoginError as exc:
		print('*** OK: could not log in with wrong password.')
	else:
		utils.fail('Could login with wrong password.')

	print('*** Changing password of OX user...')
	new_ox_user_password = uts.random_string()
	udm.modify_object('users/user', dn=ox_user_dn, password=new_ox_user_password)

	try:
		OXHttpApi(ox_username, ox_user_password)
	except LoginError as exc:
		print('*** OK: could not log in with old password.')
	else:
		utils.fail('Logged in with old password.')

	try:
		OXHttpApi(ox_username, new_ox_user_password)
	except LoginError as exc:
		utils.fail('Could not login with new password.')
	print('*** OK: logged in with new password.')
