ad-user-creator/ad_user_creator/user_service.py

from __future__ import annotations

from dataclasses import asdict
from typing import Dict, List, Optional, Tuple

from ad_user_creator.exceptions import InputValidationError, LdapOperationError
from ad_user_creator.ldap_client import LdapClient
from ad_user_creator.models import AppConfig, ResolvedUserPlan, UserInputRecord, UserProcessResult
from ad_user_creator.persistence import StateStore


def build_department_dn_fragment(dept_ou: str) -> str:
    parts = [part.strip() for part in dept_ou.split("/") if part.strip()]
    if not parts:
        raise InputValidationError("部门 OU 不能为空")
    return ",".join(f"OU={part}" for part in reversed(parts))


def build_user_dn(display_name: str, dept_ou: str, people_base_dn: str) -> str:
    dept_fragment = build_department_dn_fragment(dept_ou)
    return f"CN={display_name},{dept_fragment},{people_base_dn}"


class UserService:
    def __init__(self, config: AppConfig, state_store: StateStore, ldap_client: LdapClient) -> None:
        self.config = config
        self.state_store = state_store
        self.ldap_client = ldap_client
        self.group_gid_map = dict(config.groups_gid_map)
        self.discovered_group_gid_map: Dict[str, int] = {}

    def get_discovered_group_gid_map(self) -> Dict[str, int]:
        return dict(self.discovered_group_gid_map)

    def preview_plan(self, record: UserInputRecord) -> ResolvedUserPlan:
        gid_number = self._resolve_base_gid(record.base_group, allow_ad_gid_lookup=False)
        next_uid_number = self.state_store.get_next_uid_number()
        return self._resolve_plan(record, next_uid_number, gid_number, optional_missing_groups=[])

    def process_user(self, record: UserInputRecord, dry_run: bool = False) -> UserProcessResult:
        uid_value = record.sam_account_name
        allow_ad_gid_lookup = not dry_run
        project_gid_map = self._build_group_gid_map(record.project_groups, allow_ad_gid_lookup)
        resource_gid_map = self._build_group_gid_map(record.resource_groups, allow_ad_gid_lookup)
        try:
            gid_number = self._resolve_base_gid(record.base_group, allow_ad_gid_lookup)
        except InputValidationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=str(exc),
                uid=uid_value,
                base_gid=None,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                raw=asdict(record),
            )

        optional_missing_groups: List[str] = []
        if not dry_run:
            base_ok, missing_optional = self._validate_groups(record)
            optional_missing_groups = missing_optional
            if not base_ok:
                return UserProcessResult(
                    status="FAILED",
                    reason=f"基础组不存在: {record.base_group}",
                    uid=uid_value,
                    base_gid=gid_number,
                    project_group_gid_map=project_gid_map,
                    resource_group_gid_map=resource_gid_map,
                    raw=asdict(record),
                )
            if missing_optional and not self.config.behavior.skip_missing_optional_groups:
                return UserProcessResult(
                    status="FAILED",
                    reason=f"可选组不存在且配置不允许跳过: {','.join(missing_optional)}",
                    uid=uid_value,
                    base_gid=gid_number,
                    project_group_gid_map=project_gid_map,
                    resource_group_gid_map=resource_gid_map,
                    raw=asdict(record),
                )

        if not dry_run:
            existing_user_dn = self.ldap_client.find_user_dn_by_sam(record.sam_account_name)
            if existing_user_dn:
                return self._process_existing_user(
                    record=record,
                    existing_user_dn=existing_user_dn,
                    gid_number=gid_number,
                    optional_missing_groups=optional_missing_groups,
                    uid_value=uid_value,
                    project_gid_map=project_gid_map,
                    resource_gid_map=resource_gid_map,
                )

        uid_number = self.state_store.get_next_uid_number() if dry_run else self.state_store.commit_next_uid_number()
        plan = self._resolve_plan(record, uid_number, gid_number, optional_missing_groups=optional_missing_groups)

        if dry_run:
            reason = "dry-run 未写入 LDAP（将执行: 创建用户->设置初始密码->启用用户->加组）"
            if optional_missing_groups:
                reason += f"；可选组缺失: {','.join(optional_missing_groups)}"
            return UserProcessResult(
                status="CREATED",
                reason=reason,
                user_dn=plan.user_dn,
                uid_number=plan.uid_number,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=plan.uid_number,
                raw=asdict(record),
            )

        attrs = self._build_ldap_attributes(plan)
        try:
            self.ldap_client.create_user(plan.user_dn, attrs)
        except LdapOperationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=f"create-user-failed: {exc}",
                user_dn=plan.user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=plan.uid_number,
                raw=asdict(record),
            )

        try:
            self.ldap_client.set_user_password(plan.user_dn, self.config.defaults.initial_password)
        except LdapOperationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=f"password-set-failed: {exc}",
                user_dn=plan.user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=plan.uid_number,
                raw=asdict(record),
            )

        try:
            self.ldap_client.set_user_enabled(plan.user_dn, enabled=True)
        except LdapOperationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=f"enable-user-failed: {exc}",
                user_dn=plan.user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=plan.uid_number,
                raw=asdict(record),
            )

        try:
            added_groups = self._ensure_groups(
                plan.user_dn,
                plan.base_group,
                plan.project_groups,
                plan.resource_groups,
                plan.optional_missing_groups,
            )
        except LdapOperationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=f"add-group-failed: {exc}",
                user_dn=plan.user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                raw=asdict(record),
            )

        reason = "创建成功"
        if optional_missing_groups:
            reason += f"；可选组已跳过: {','.join(optional_missing_groups)}"
        if added_groups:
            reason += f"；新增组成员: {','.join(added_groups)}"
        return UserProcessResult(
            status="CREATED",
            reason=reason,
            user_dn=plan.user_dn,
            uid_number=plan.uid_number,
            uid=uid_value,
            base_gid=gid_number,
            project_group_gid_map=project_gid_map,
            resource_group_gid_map=resource_gid_map,
            linux_uid_number=plan.uid_number,
            raw=asdict(record),
        )

    def _resolve_group_gid(self, group_name: str, allow_ad_gid_lookup: bool) -> Tuple[Optional[int], str]:
        if allow_ad_gid_lookup:
            gid_from_ad = self.ldap_client.get_group_gid_number(group_name)
            if gid_from_ad is not None:
                self.group_gid_map[group_name] = gid_from_ad
                self.discovered_group_gid_map[group_name] = gid_from_ad
                return gid_from_ad, "ad"
        gid_from_config = self.group_gid_map.get(group_name)
        if gid_from_config is not None:
            return int(gid_from_config), "config"
        return None, "none"

    def _resolve_base_gid(self, base_group: str, allow_ad_gid_lookup: bool) -> int:
        gid, _ = self._resolve_group_gid(base_group, allow_ad_gid_lookup)
        if gid is None:
            raise InputValidationError(f"基础组未配置 gidNumber: {base_group}")
        return gid

    def _resolve_plan(
        self,
        record: UserInputRecord,
        uid_number: int,
        gid_number: int,
        optional_missing_groups: List[str],
    ) -> ResolvedUserPlan:
        user_dn = build_user_dn(record.display_name, record.dept_ou, self.config.ldap.people_base_dn)
        return ResolvedUserPlan(
            user_dn=user_dn,
            display_name=record.display_name,
            sam_account_name=record.sam_account_name,
            email=record.email,
            uid=record.sam_account_name,
            uid_number=uid_number,
            gid_number=gid_number,
            unix_home_directory=f"/home/{record.sam_account_name}",
            base_group=record.base_group,
            project_groups=record.project_groups,
            resource_groups=record.resource_groups,
            optional_missing_groups=optional_missing_groups,
        )

    def _validate_groups(self, record: UserInputRecord) -> Tuple[bool, List[str]]:
        if not self.ldap_client.group_exists(record.base_group):
            return False, []
        optional_missing: List[str] = []
        for group in record.project_groups + record.resource_groups:
            if not self.ldap_client.group_exists(group):
                optional_missing.append(group)
        return True, optional_missing

    def _build_ldap_attributes(self, plan: ResolvedUserPlan) -> Dict[str, object]:
        attrs: Dict[str, object] = {
            "cn": plan.display_name,
            "displayName": plan.display_name,
            "sAMAccountName": plan.sam_account_name,
            "mail": plan.email,
            "uid": plan.uid,
            "uidNumber": str(plan.uid_number),
            "gidNumber": str(plan.gid_number),
            "unixHomeDirectory": plan.unix_home_directory,
            "userAccountControl": "514",
        }
        if self.config.ldap.upn_suffix:
            attrs["userPrincipalName"] = f"{plan.sam_account_name}@{self.config.ldap.upn_suffix}"
        return attrs

    def _build_desired_update_attrs(self, record: UserInputRecord, gid_number: int) -> Dict[str, str]:
        desired = {
            "displayName": record.display_name,
            "mail": record.email,
            "uid": record.sam_account_name,
            "unixHomeDirectory": f"/home/{record.sam_account_name}",
            "gidNumber": str(gid_number),
        }
        if self.config.ldap.upn_suffix:
            desired["userPrincipalName"] = f"{record.sam_account_name}@{self.config.ldap.upn_suffix}"
        return desired

    def _build_group_gid_map(self, groups: List[str], allow_ad_gid_lookup: bool) -> Dict[str, str]:
        group_gid_map: Dict[str, str] = {}
        for group in groups:
            gid, _ = self._resolve_group_gid(group, allow_ad_gid_lookup)
            group_gid_map[group] = "NA" if gid is None else str(gid)
        return group_gid_map

    def _calculate_attr_changes(self, current: Dict[str, str], desired: Dict[str, str]) -> Dict[str, str]:
        changes: Dict[str, str] = {}
        for key, desired_value in desired.items():
            current_value = str(current.get(key, "") or "").strip()
            if current_value != str(desired_value).strip():
                changes[key] = desired_value
        return changes

    def _ensure_groups(
        self,
        user_dn: str,
        base_group: str,
        project_groups: List[str],
        resource_groups: List[str],
        optional_missing_groups: List[str],
    ) -> List[str]:
        added_groups: List[str] = []
        base_group_dn = self.ldap_client.get_group_dn(base_group)
        if self.ldap_client.add_user_to_group_if_missing(user_dn, base_group_dn):
            added_groups.append(base_group)

        optional_groups = list(project_groups) + list(resource_groups)
        skip_set = set(optional_missing_groups)
        for group in optional_groups:
            if group in skip_set:
                continue
            group_dn = self.ldap_client.get_group_dn(group)
            if self.ldap_client.add_user_to_group_if_missing(user_dn, group_dn):
                added_groups.append(group)
        return added_groups

    def _process_existing_user(
        self,
        record: UserInputRecord,
        existing_user_dn: str,
        gid_number: int,
        optional_missing_groups: List[str],
        uid_value: str,
        project_gid_map: Dict[str, str],
        resource_gid_map: Dict[str, str],
    ) -> UserProcessResult:
        attrs_to_read = ["displayName", "mail", "uid", "uidNumber", "unixHomeDirectory", "gidNumber"]
        if self.config.ldap.upn_suffix:
            attrs_to_read.append("userPrincipalName")

        try:
            current_attrs = self.ldap_client.get_user_attributes(existing_user_dn, attrs_to_read)
            desired_attrs = self._build_desired_update_attrs(record, gid_number)
            changes = self._calculate_attr_changes(current_attrs, desired_attrs)
            if changes:
                self.ldap_client.modify_user_attributes(existing_user_dn, changes)

            added_groups = self._ensure_groups(
                user_dn=existing_user_dn,
                base_group=record.base_group,
                project_groups=record.project_groups,
                resource_groups=record.resource_groups,
                optional_missing_groups=optional_missing_groups,
            )
        except LdapOperationError as exc:
            return UserProcessResult(
                status="FAILED",
                reason=f"update-user-failed: {exc}",
                user_dn=existing_user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=None,
                raw=asdict(record),
            )
        linux_uid_number: Optional[int] = None
        raw_uid_number = str(current_attrs.get("uidNumber", "") or "").strip()
        if raw_uid_number.isdigit():
            linux_uid_number = int(raw_uid_number)

        if changes:
            reason = f"已更新字段: {','.join(changes.keys())}"
            if added_groups:
                reason += f"；新增组成员: {','.join(added_groups)}"
            if optional_missing_groups:
                reason += f"；可选组已跳过: {','.join(optional_missing_groups)}"
            return UserProcessResult(
                status="UPDATED",
                reason=reason,
                user_dn=existing_user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=linux_uid_number,
                raw=asdict(record),
            )

        reason = "用户已存在且字段无变化"
        if added_groups:
            reason += f"；新增组成员: {','.join(added_groups)}"
            return UserProcessResult(
                status="UPDATED",
                reason=reason,
                user_dn=existing_user_dn,
                uid=uid_value,
                base_gid=gid_number,
                project_group_gid_map=project_gid_map,
                resource_group_gid_map=resource_gid_map,
                linux_uid_number=linux_uid_number,
                raw=asdict(record),
            )
        if optional_missing_groups:
            reason += f"；可选组已跳过: {','.join(optional_missing_groups)}"
        return UserProcessResult(
            status="SKIPPED_NO_CHANGE",
            reason=reason,
            user_dn=existing_user_dn,
            uid=uid_value,
            base_gid=gid_number,
            project_group_gid_map=project_gid_map,
            resource_group_gid_map=resource_gid_map,
            linux_uid_number=linux_uid_number,
            raw=asdict(record),
        )