#!/usr/share/ucs-test/runner python
## -*- coding: utf-8 -*-
## desc: Check access combinations when creating and modifying users with mobility (OXBug #22780).
## tags: [apptest]
## exposure: dangerous
## packages:
##   - univention-ox
##   - univention-ox-usm

import univention.testing.strings as uts
import univention.testing.utils as utils
import univention.testing.ucr as ucr_test
import univention.testing.udm as udm_test
import random
from essential.common import get_access_combination_name, verify_ox_access_permissions, verify_ox_mailenabled_flag, ox_access_list, OXTestEmptyQueue
from univention.ox.wait_for_ox_server import wait_for_ox_server


wait_for_ox_server()
def main():
	with udm_test.UCSTestUDM() as udm, OXTestEmptyQueue():
		with ucr_test.UCSTestConfigRegistry() as ucr:
			context_id = ucr.get('ox/context/id', '10')
			user_dn, user_name = udm.create_user(
				mailPrimaryAddress='{}@{}'.format(uts.random_name(), ucr.get('domainname')),
				mailHomeServer='{}.{}'.format(ucr.get('hostname'), ucr.get('domainname')),
				position='cn=users,{}'.format(ucr.get('ldap/base'))
			)

			# verify default values
			utils.verify_ldap_object(user_dn, {'oxAccess': ['premium']})
			verify_ox_access_permissions(user_name, 'oxseforucs_premium', context_id)

			access_items = ox_access_list[:]
			# prevent UDM error for old oxAccess == new oxAccess --> no modification
			while True:
				random.shuffle(access_items)
				ox_access_name = get_access_combination_name(access_items[0], False)
				if ox_access_name.split('_')[1] != 'premium':
					break
			for udm_access_name in access_items:
				for with_usm in (False, True, False):
					ox_access_name = get_access_combination_name(udm_access_name, with_usm)
					print("\n\nudm_access_name={}   ox_access_name={}   with_usm={}".format(udm_access_name, ox_access_name, with_usm))
					udm_with_usm = 'OK' if with_usm else 'Not'

					udm.modify_object('users/user', dn=user_dn, oxAccess=udm_access_name, oxAccessUSM=udm_with_usm)
					utils.verify_ldap_object(user_dn, {'oxAccess': [udm_access_name], 'oxAccessUSM': [udm_with_usm]})
					if udm_access_name not in ('none',):
						verify_ox_access_permissions(user_name, ox_access_name, context_id)
					else:
						verify_ox_mailenabled_flag(user_name, context_id, False)

if __name__ == '__main__':
	main()
