#!/usr/share/ucs-test/runner python
# coding=utf-8
## desc: Check if teacherStaff users have at least the required LDAP permissions for UCS@school
## roles: [domaincontroller_master]
## tags: [apptest]
## exposure: dangerous
## packages: [ucs-school-ldap-acls-master]

from ldap.filter import filter_format
from essential.acl import Acl
from essential.computerroom import Computers
from essential.schoolroom import ComputerRoom
import univention.testing.ucr as ucr_test
import univention.testing.ucsschool as utu


def main():
	with utu.UCSTestSchool() as schoolenv:
		with ucr_test.UCSTestConfigRegistry() as ucr:
			school, oudn = schoolenv.create_ou(name_edudc=ucr.get('hostname'))
			tea_staff, tea_staff_dn = schoolenv.create_user(school, is_teacher=True, is_staff=True)
			stu, stu_dn = schoolenv.create_user(school)
			class_name, class_dn = schoolenv.create_school_class(school)
			open_ldap_co = schoolenv.open_ldap_connection()
			# importing 2 random computers
			computers = Computers(open_ldap_co, school, 1, 0, 0)
			created_computers = computers.create()
			computers_dns = computers.get_dns(created_computers)
			room = ComputerRoom(school, host_members=computers_dns)
			room.add()

			acl = Acl(school, tea_staff_dn, 'ALLOWED')

			acl.assert_base_dn('read')

			acl.assert_student(stu_dn, 'write')

			acl.assert_room(room.dn(), 'write')

			acl.assert_teacher_group('write')
			acl.assert_student_group('write')

			shares_dn = 'cn=shares,%s' % utu.UCSTestSchool().get_ou_base_dn(school)
			acl.assert_shares(shares_dn, 'write')
			shares_dn = 'cn=Marktplatz,cn=shares,%s' % utu.UCSTestSchool().get_ou_base_dn(school)
			acl.assert_shares(shares_dn, 'write')
			shares_dn = 'cn=klassen,cn=shares,%s' % utu.UCSTestSchool().get_ou_base_dn(school)
			acl.assert_shares(shares_dn, 'read')

			acl.assert_temps('write')
			acl.assert_gid_temps('write')

			acl.assert_ou('read')

			acl.assert_global_containers('read')

			# Bug #41720
			share_dn = open_ldap_co.searchDn(filter=filter_format('(&(objectClass=univentionShare)(cn=%s))', (class_name,)))[0]
			acl.assert_share_object_access(share_dn, 'read', 'ALLOWED')
			acl.assert_share_object_access(share_dn, 'write', 'DENIED')
			# disabled on purpose - see Bug #42065
			# share_dn = 'cn=Marktplatz,cn=shares,%s' % (oudn,)
			# acl.assert_share_object_access(share_dn, 'read', 'ALLOWED')
			# acl.assert_share_object_access(share_dn, 'write', 'DENIED')


if __name__ == '__main__':
	main()
