"""Run inside the existing identity-provisioner pod; never print credentials.

Default is read-only. --apply adds only the approved user's named group.
"""
import json
import os
import sys
from provisioner import LLDAPProvisioner


def main():
    apply = sys.argv[1:] == ['--apply']
    if sys.argv[1:] not in ([], ['--apply']):
        raise ValueError()
    if os.environ['LLDAP_URL'] != 'http://lldap.sso.svc.cluster.local:17170':
        raise ValueError()
    client = LLDAPProvisioner(base_url=os.environ['LLDAP_URL'], admin_password=os.environ['LLDAP_ADMIN_PASSWORD'])
    token = client._login()
    user = client._user(token, 'tegwick')
    if not user or user['id'] != 'tegwick' or user['email'].lower() != 'bernd.worsch@gmail.com':
        raise ValueError()
    before = {g['displayName'] for g in user['groups']}
    if apply and 'railiance-admins' not in before:
        groups = client._gql(token, 'query { groups { id displayName } }', {})['groups']
        group = client._ensure_group(token, groups, 'railiance-admins')
        client._add_group(token, 'tegwick', group)
    after = {g['displayName'] for g in client._user(token, 'tegwick')['groups']}
    if not before <= after or after - before - {'railiance-admins'}:
        raise ValueError()
    if apply and 'railiance-admins' not in after:
        raise ValueError()
    print(json.dumps({'mode': 'apply' if apply else 'inspect', 'directory_user': 'tegwick',
        'email_matches_requested_recipient': True, 'group': 'railiance-admins',
        'member': 'railiance-admins' in after, 'other_memberships_preserved': True,
        'signed_role_claim_verified': False}))


try:
    main()
except Exception:
    print('{"status":"directory-operation-refused"}')
    sys.exit(1)