#!/usr/bin/env python
# -----------------------------------------------------------------------
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#	 http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
# -----------------------------------------------------------------------

import sys

version_min = [2, 7]
version_info = sys.version_info
version_error = False
if(version_info[0] < version_min[0]):
	version_error = True
elif(version_info[0] == version_min[0]):
	if(version_info[1] < version_min[1]):
		version_error = True
if(version_error):
	print('Python minimum requirement is version '+str(version_min[0])+'.'+str(version_min[1]))
	sys.exit(1)

import argparse
import datetime
import os
import time
import traceback

from ducc_util import DuccUtil

# print message
def output(msg):
    print msg
    
# produce a time stamp
def get_timestamp():
    tod = time.time()
    timestamp = datetime.datetime.fromtimestamp(tod).strftime('%Y-%m-%d %H:%M:%S')      
    return timestamp

_flag_debug = False

# record debug message
def debug(mn,text):
    if(_flag_debug):
        type ='D'
        msg = get_timestamp()+' '+type+' '+mn+' '+text
        output(msg)

# command to check db access authorization

class AccessCheck(DuccUtil):
	
	# return method name
	def _mn(self):
		return traceback.extract_stack(None,2)[0][2]
	
	description = 'Determine if LOOKER can view OWNER database data through examination of db.access file in security directory, typically ~/.ducc.'\
				+ '  Return 1 if authorized, 0 otherwise.'\
				+ '  Rules: '\
				+ '  1. Authorized if OWNER == LOOKER'\
				+ '  or '\
				+ '  2. Authorized if OWNER db.access file is readable by all'\
				+ '  or '\
				+ '  3. Authorized if LOOKER groups contains the OWNER db.access file group'\
				+ ''
	
	def get_args(self):
		global _flag_debug
		parser = argparse.ArgumentParser(description=self.description)
		parser.add_argument('--owner', '-o', action='store', required=True, help='the user who owns the data')
		parser.add_argument('--looker', '-l', action='store', required=True, help='the user who views the data')
		parser.add_argument('--debug', '-d', action='store_true', help='display debugging messages')
		self.args = parser.parse_args()
		_flag_debug = self.args.debug
	
	# get property from ducc.properties file
	def get_ducc_property(self, key):
		value = self.ducc_properties.get(key)
		text = 'key:'+key+' '+'value:'+value
		debug(self._mn(),text)
	
	# get DUCC security home directory, by default user's $HOME
	def get_security_home(self):
		key = 'ducc.security.home'
		value = self.get_ducc_property(key)
		if(value == None):
			home_folder = os.getenv('HOME')
			value = home_folder.rsplit('/',1)[0]
		self.ducc_security_home = value
		text = value
		debug(self._mn(),text)
	
	# Access: (0644/-rw-r--r--)  Uid: ( 2077/watson)   Gid: ( 2001/limited)
	def get_permissions(self,line):
		normalized_line = line
		normalized_line = normalized_line.replace('(',' ')
		normalized_line = normalized_line.replace(')',' ')
		tokens = normalized_line.split()
		permissions = tokens[1]
		permissions = permissions.replace('/',' ')
		permissions = permissions.strip()
		permissions = permissions.split()[1]
        # -rw-r--r--
		return permissions
	
	# Access: (0644/-rw-r--r--)  Uid: ( 2077/watson)   Gid: ( 2001/limited)
	def get_group(self,line):
		normalized_line = line
		normalized_line = normalized_line.replace('(',' ')
		normalized_line = normalized_line.replace(')',' ')
		tokens = normalized_line.split()
		group = tokens[5]
		group = group.replace('/',' ')
		group = group.strip()
		group = group.split()[1]
        # limited
		return group
	
	# get db.access file info, comprising file permissions and file group
	def get_owner_access_data(self):
		permissions = '----------'
		group = ''
		ducc_ling = self.duccling
		self.get_security_home()
		security_file = os.path.join(self.ducc_security_home,self.args.owner,'.ducc','db.access')
		text = 'security_file:'+security_file
		debug(self._mn(),text)
		p0 = '-q'
		p1 = '-u'
		p2 = self.args.owner
		p3 = '/usr/bin/stat'
		p4 = security_file
		cmd = ducc_ling+' '+p0+' '+p1+' '+p2+' '+p3+' '+p4
		text = cmd
		debug(self._mn(),text)
		lines = self.popen(ducc_ling,p0,p1,p2,p3,p4)
		for line in lines:
			line = line.strip()
			if(('Access:' in line) and ('Gid:' in line)):
				permissions = self.get_permissions(line)
				group = self.get_group(line)
				text = 'permissions:'+permissions+' '+'group:'+group
				debug(self._mn(),text)
				break;
		return permissions, group
	
	# get looker's groups
	def get_looker_groups(self):
		groups = []
		ducc_ling = self.duccling
		p0 = '-q'
		p1 = '-u'
		p2 = self.args.owner
		p3 = '/usr/bin/groups'
		cmd = ducc_ling+' '+p0+' '+p1+' '+p2+' '+p3
		text = cmd
		debug(self._mn(),text)
		lines = self.popen(ducc_ling,p0,p1,p2,p3)
		for line in lines:
			line = line.strip()
			tokens = line.split()
			groups = tokens
		return groups
	
	# check if looker is authorized to access owner's db info
	def check_authorization(self):
		authorized = 0
		text = 'owner:'+self.args.owner+' '+'looker:'+self.args.looker
		debug(self._mn(),text)
		if(self.args.owner == self.args.looker):
			authorized = 1
			text = 'authorized:'+str(authorized)+' '+'reason: owner == looker'
			debug(self._mn(),text)
		else:
			file_permissions, file_group = self.get_owner_access_data()
			text = 'permissions:'+file_permissions+' '+'group:'+file_group
			debug(self._mn(),text)
			if(file_permissions[7] == 'r'):
				authorized = 1
				text = 'authorized:'+str(authorized)+' '+'reason: owner db.access file readable by all'
				debug(self._mn(),text)
			elif(file_permissions[4] == 'r'):
				looker_groups = self.get_looker_groups()
				text = 'groups:'+str(looker_groups)
				debug(self._mn(),text)
				if(file_group in looker_groups):
					authorized = 1
					text = 'authorized:'+str(authorized)+' '+'reason: looker in group assigned to db.access file'
					debug(self._mn(),text)
		return authorized
		
	def main(self, argv):
		authorized = 0
		self.get_args()
		authorized = self.check_authorization()
		print str(authorized)
		sys.exit(authorized)
		
if __name__ == '__main__':
	instance = AccessCheck()
	instance.main(sys.argv[1:])