#!/usr/bin/env zsh
# vi: set ft=zsh tw=80 ts=2

function getComputerName() {
	local moduleAnswer
	local computerName="`scutil --get ComputerName 2> /dev/null`"
	getModuleAnswerByKeyRegEx '_hostname$' && computerName=$moduleAnswer
	print -- $computerName
}

function getDefaultFullname() {
	local computerName="`getComputerName`"
	lop -- -d 'Default full name based on current computer name is:' -d "$computerName"
	print "${computerName}"
}

function getDefaultUsername() {
	local username="`getDefaultFullname | tr '[:upper:]' '[:lower:]' | tr -C '[:alnum:]\n' '-'`"
	lop -- -d 'Default username based on current computer name is:' -d "$username"
	print "${username}"
}

function isAPFSFilesystem() {
	[[ $(diskutil info / | awk 'sub(/File System Personality: /,""){print $0}') = *APFS* ]]
}

function getUsersWithSecureToken() {
	local username uuid
	for uuid in ${$(diskutil apfs listUsers / | awk '/\+\-\-/ {print $2}')}; do
		username="$(dscl . -search /Users GeneratedUID ${uuid} | awk 'NR==1{print $1}')"
		checkSecureTokenForUser ${username} && secureTokenUsers+=("${username}")
	done
}

function getDefaultUserPictures() {
	pushd -q '/Library/User Pictures'
	defaultUserPictures=("${(@f)$(find -E . -type f -iregex '.*\.(tif|png|jpeg|jpg)' | abbreviatePaths)}")
	popd -q
}

function convertPathToDefaultPicture() {
	local resolved=''
	lop -- -d 'Converting path' -d "${filevault_picture}" -d 'to default picture path if necessary.'
	if [ -r "${filevault_picture}" ]; then
		lop -- -d 'Path seems to be a valid path already. Skipping conversion.'
		return
	fi
	pushd -q '/Library/User Pictures'
	resolved="`find "$_" -type f -path "*${filevault_picture}" 2> /dev/null`"
	lop -- -d 'Resolved path is' -d "${resolved}"
	popd -q
	[ -n "${resolved}" -a -r "${resolved}" ] && filevault_picture="${resolved}"
}

function _isPathToPicture() {
	local filevault_picture=$1
	convertPathToDefaultPicture
	[ -r "${filevault_picture}" ] || { lop -- -d 'Resolved path is not a valid path. Returning.'; return 10 }
	[[ "${filevault_picture:e:l}" =~ (tif|png|jpeg|jpg) ]] || return 11
}

function isPathToPicture() {
	indicateActivity -- "Verifying $1 as picture path" _isPathToPicture $1
}

function _checkSecureTokenForUser() {
	local u=$1
	sysadminctl -secureTokenStatus "${u}" 2>&1 | grep ENABLED >&! /dev/null
}

function checkSecureTokenForUser() {
	local u=$1
	indicateActivity -- "Checking if user $u has a secure token set" _checkSecureTokenForUser $u
}

function _checkUserPassword() {
	local username=$1 password=$2
	dscl . -authonly ${username} ${password} >&! /dev/null
}

function checkSecureTokenUserPassword() {
	indicateActivity -- "Checking password for user ${secure_token_user_username}" _checkUserPassword ${secure_token_user_username} ${secure_token_user_password}
}

function checkFileVaultUserPassword() {
	indicateActivity -- "Checking password for user ${filevault_username}" _checkUserPassword ${filevault_username} ${filevault_password}
}

function _doesFileVaultUserExist() {
	dscl . -list /Users | grep "${filevault_username}" >&! /dev/null
}

function doesFileVaultUserExist() {
	indicateActivity -- "Checking if ${filevault_username} already exists" _doesFileVaultUserExist
}

function _createFileVaultUser() {
	local un=${filevault_username} fn=${filevault_fullname} pw=${filevault_password} result=
	lop -- -d 'Creating FileVault user' -d "${un}"
	sysadminctl -addUser ${un} -fullName ${fn} -shell /usr/bin/false -home /var/empty -password ${pw} -picture ${filevault_picture}
	result=$?
	lop -- -d 'Return value of sysadminctl is ' -d "$?"
	return $result
}

function createFileVaultUser() {
	indicateActivity -- "Creating FileVault user ${filevault_username}" _createFileVaultUser
}

function _configureFileVaultUser() {
	local un=${filevault_username}
	dscl . -create "/Users/${un}" IsHidden 1
	chsh -s /usr/bin/false "${un}" >&! /dev/null
}

function configureFileVaultUser() {
	indicateActivity -- "Configuring FileVault user ${filevault_username}" _configureFileVaultUser
}

function configureSecureToken() {
	local un=${filevault_username} up=${filevault_password}
	local stun=${secure_token_user_username} stup=${secure_token_user_password}
	indicateActivity -- "Enable secure token for ${un}" sysadminctl -secureTokenOn "${un}" -password "${up}" -adminUser "${stun}" -adminPassword "${stup}"
}

function canUserUnlockDisk() {
	local username=$1
	for fdeuser in ${(f)"$(fdesetup list | cut -d',' -f1)"}; do
		[[ ${fdeuser} = ${username} ]] && return
	done
	return 1
}

function getFDESetupXMLForUser() {
	local username="${1}" password="${2}"
	cat <<- XML
	<?xml version="1.0" encoding=\"UTF-8\"?>
	<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
	<plist version=\"1.0\">
	<dict>
	<key>Username</key>
	<string>${username}</string>
	<key>Password</key>
	<string>${password}</string>
	</dict>
	</plist>
	XML
}

function _enableFileVaultForSecureTokenUser() {
	local username="${1}" password="${2}"
	getFDESetupXMLForUser "${username}" "${password}" | fdesetup enable -inputplist
}

function enableFileVaultForSecureTokenUser() {
	fdesetup isactive >&! /dev/null && return
	indicateActivity -- "Enable FileVault for secure token" _enableFileVaultForSecureTokenUser ${secure_token_user_username} ${secure_token_user_password}
}

function _allowUserToUnlockDisk() {
	local username="${1}" password="${2}"
	getFDESetupXMLForUser ${username} ${password} | fdesetup add -inputplist
}

function allowFileVaultUserToUnlockDisk() {
	indicateActivity -- "Allow FileVault user to unlock disk" _allowUserToUnlockDisk ${filevault_username} ${filevault_password}
}

function _allowOnlyFileVaultUserToUnlock() {
	local fdeuser
	for fdeuser in ${(f)"$(fdesetup list | cut -d',' -f1)"}; do
 	[[ ${fdeuser} != ${filevault_username} ]] && fdesetup remove -user "${fdeuser}"
	done
	return 0
}

function allowOnlyFileVaultUserToUnlock() {
	indicateActivity -- "Disallow everyone else from unlocking disk" _allowOnlyFileVaultUserToUnlock
}

function configure_system() {
	lop -y h1 -- -i 'Setup FileVault System'
	checkSecureTokenForUser "${secure_token_user_username}" || { lop -- -e 'The provided secure token user has no secure token.'; return 10 }
	checkSecureTokenUserPassword || { lop -- -e 'The secure token user password is incorrect.'; return 11 }
	indicateActivity -- "Resolving path of picture ${filevault_picture}" convertPathToDefaultPicture
	isPathToPicture "${filevault_picture}" || { lop -- -e 'The provided FileVault user picture is not a valid path to a TIF, PNG or JPEG file.'; return 12 }

	if doesFileVaultUserExist; then
		checkFileVaultUserPassword || { lop -- -e 'The FileVault user password is incorrect.'; return 13 }
	else
		createFileVaultUser || { lop -- -e 'Was not able to create FileVault user.'; return 14 }
	fi
	configureFileVaultUser || { lop -- -e 'Could not configure FileVault user.'; return 15 }
	enableFileVaultForSecureTokenUser || { lop -- -e 'Could not enable FileVault for secure token user.'; return 16 }
	checkSecureTokenForUser "${filevault_username}" || configureSecureToken || { lop -- -e 'Could not configure secure token for FileVault user.'; return 17 }
	canUserUnlockDisk ${filevault_username} || allowFileVaultUserToUnlockDisk || { lop -- -e 'Was not able to allow FileVault user to unlock disk.'; return 18 }
	allowOnlyFileVaultUserToUnlock "${filevault_username}" || { lop -- -e 'Was not able to deactivate all other user from unlocking disk.'; return 19 }
	indicateActivity -- 'Update APFS preboot volume' diskutil apfs updatePreboot / || { lop -- -e 'Was not able to update APFS preboot volume.'; return 20 }
}

function getHelpPrerequisites() {
	cmds=(
		[tr]=''
		[scutil]=''
	)
	addDocoptsToCmds
}

function getQuestionsPrerequisites() {
	cmds=(
		[find]=''
		[dscl]=''
		[dseditgroup]=''
		[awk]=''
		[diskutil]=''
		[sysadminctl]=''
	)
	isAPFSFilesystem || { lop -- -e 'This module requires an APFS filesystem.'; return 10 }
}

function getExecPrerequisites() {
	cmds=(
		[cut]=''
		[cat]=''
		[fdesetup]=''
		[base64]=''
		[dsimport]=''
	)
	requireRootPrivileges
}

function getQuestions() {
	local secureTokenUsers=() defaultUserPictures=()
	local defaultUsername="`getDefaultUsername`" defaultFullname="`getDefaultFullname`"
	getUsersWithSecureToken
	getDefaultUserPictures
	local defaultUsernameHint= defaultFullnameHint=
	[ -n "${defaultUsername}" ] && defaultUsernameHint="default:${defaultUsername};"
	[ -n "${defaultFullname}" ] && defaultFullnameHint="default:${defaultFullname};"
	questions=(
		'i: filevault-fullname=What shall the FileVault user'\''s full name be? # '"${defaultFullnameHint}"
		'i: filevault-username=What shall the FileVault user'\''s username be? # '"${defaultUsernameHint}"
		'p: filevault-password=What shall the FileVault user'\''s password be?'
		's: filevault-picture=Select a picture for FileVault user or enter the path to your own picture # validator:'"${cmdPath}"',is-picture;choose from:'"${(j.,.)defaultUserPictures};"
		's: secure-token-user-username=Which user with a secure token shall be used? # choose from:'"${(j.,.)secureTokenUsers};"
		'p: secure-token-user-password=What is the secure token user'\''s password?'
	)
}

function preQuestionHook() {
	if [[ "${is_picture}" = true ]]; then
		isPathToPicture ${pathstr}
		exit $?
	fi
}

function getUsage() {
	local cmdName=$1 text='' varname=
	local defaultUsername="`getDefaultUsername`" defaultFullname="`getDefaultFullname`"
	for varname in defaultUsername defaultFullname; do
		local ${varname}Str=
		[ -n "${(P)varname}" ] && local ${varname}Str=" [default: ${(P)varname}]"
	done
	read -r -d '' text <<- USAGE
	Usage:
	  $cmdName show-questions [<modkey> <modans>]...
	  $cmdName is-picture <pathstr>
	  $cmdName [-v] [-d FILE] --filevault-fullname NAME --filevault-username NAME --filevault-password PASSWORD --filevault-picture PATH_TO_PIC --secure-token-user-username NAME --secure-token-user-password PASSWORD

	Create a designated FileVault user who may not login to the system but is the
	only one able to unlock the disk. That way a secure password can be used to
	unlock the disk as opposed to macOS standard, where each user is allowed to
	unlock the disk with his password that may or may not be secure (in terms of
	length and randomness).

	Options:
	  --filevault-fullname NAME             Full name of the designated FileVault user. An
	                                        existing FileVault user will be renamed to that
	                                        name ${defaultFullnameStr}.
	  --filevault-username NAME             Username of the designated FileVault user. An
	                                        existing FileVault user will be renamed to that
	                                        name ${defaultUsernameStr}.
	  --filevault-password PASSWORD         Password of the designated FileVault user. The password
	                                        an existing FileVault user will not be changed.
	  --filevault-picture PATH_TO_PIC       The path to the picture that shall be made the FileVault
	                                        user picture. The picture of an existing FileVault user
	                                        will be updated.
	  --secure-token-user-username NAME     The username of an user with a secure token.
	  --secure-token-user-password PASSWORD The password of the secure token user.
	  -d FILE, --logfile FILE               Print log message to logfile instead of stdout.
	  -v, --verbose                         Be more verbose.
	----
	$cmdName 0.1.0
	Copyright (C) 2022 Rezart Qelibari, Astzweig GmbH & Co. KG
	License EUPL-1.2. There is NO WARRANTY, to the extent permitted by law.
	USAGE
	print -- ${text}
}

if [[ "${ZSH_EVAL_CONTEXT}" == toplevel ]]; then
	test -f "${ASTZWEIG_MACOS_SYSTEM_LIB}" || { echo 'This module requires macos-system library. Please run again with macos-system library provieded as a path in ASTZWEIG_MACOS_SYSTEM_LIB env variable.'; return 10 }
	source "${ASTZWEIG_MACOS_SYSTEM_LIB}"
	module_main $0 "$@"
fi