#!/usr/bin/env python3
"""shadow: poprawki PAM. Podmienia wartosc klucza `build` (scalar YAML)."""
import re, sys, yaml

P = "/var/lib/pagan-sync/recipes/core/shadow/PAGBUILD.yaml"


def find_scalar_range(text, key):
    m = re.search(r"(?m)^" + re.escape(key) + r":", text)
    if not m:
        sys.exit(f"brak klucza {key}")
    i = m.end()
    while i < len(text) and text[i] in " \t":
        i += 1
    if i < len(text) and text[i] == '"':
        j = i + 1
        while j < len(text):
            if text[j] == "\\":
                j += 2
                continue
            if text[j] == '"':
                return i, j + 1
            j += 1
        sys.exit("nie znaleziono konca scalara")
    if i < len(text) and text[i] in "|>":
        line_start = text.rfind("\n", 0, m.start()) + 1
        key_indent = m.start() - line_start
        k = text.find("\n", i)
        start, j, end = k + 1, k + 1, k + 1
        while j < len(text):
            nl = text.find("\n", j)
            if nl == -1:
                nl = len(text)
            line = text[j:nl]
            if line.strip() == "":
                end = nl + 1
                j = nl + 1
                continue
            if (len(line) - len(line.lstrip(" "))) > key_indent:
                end = nl + 1
                j = nl + 1
            else:
                break
        return start, end
    sys.exit("nieobslugiwany styl scalara")


def esc(v):
    return '"' + v.replace("\\", "\\\\").replace('"', '\\"').replace("\n", "\\n") + '"'


def edit(old, new, label):
    text = open(P, encoding="utf-8").read()
    cur = (yaml.safe_load(text) or {}).get("build") or ""
    if new in cur:
        print(f"--  {label} (juz zastosowane)")
        return
    if cur.count(old) != 1:
        sys.exit(f"[{label}] w wartosci build: {cur.count(old)} wystapien")
    nv = cur.replace(old, new, 1)
    s, e = find_scalar_range(text, "build")
    open(P, "w", encoding="utf-8").write(text[:s] + esc(nv) + text[e:])
    print(f"OK  {label}")


edit("s@#ENCRYPT_METHOD DES@ENCRYPT_METHOD SHA512@",
     "s@^#ENCRYPT_METHOD .*@ENCRYPT_METHOD SHA512@",
     "ENCRYPT_METHOD SHA512")

edit("# Begin /etc/pam.d/system-account\n\naccount   required    pam_unix.so\n",
     "# Begin /etc/pam.d/system-account\n\n"
     "account   required    pam_unix.so\n"
     "account   required    pam_faillock.so\n",
     "system-account + faillock")

edit("# Begin /etc/pam.d/system-auth\n\nauth      required    pam_unix.so\n",
     "# Begin /etc/pam.d/system-auth\n\n"
     "# Blokada konta po nieudanych probach logowania. Parametry (deny,\n"
     "# unlock_time) ustawia /etc/security/faillock.conf; root nie jest objety.\n"
     "auth      required      pam_faillock.so preauth\n"
     "auth      [success=1 default=ignore]  pam_unix.so\n"
     "auth      [default=die] pam_faillock.so authfail\n"
     "auth      sufficient    pam_faillock.so authsucc\n",
     "system-auth + faillock")

edit("password  required    pam_pwhistory.so  retry=3\n",
     "# Jakosc hasel - parametry w /etc/security/pwquality.conf.\n"
     "# Pamiec: ostatnie 24 hasla.\n"
     "password  required    pam_pwquality.so  retry=3\n"
     "password  required    pam_pwhistory.so  remember=24 retry=3\n",
     "system-password + pwquality")

edit("rm -f ${PKGDIR}/etc/pam.d/system-auth ${PKGDIR}/etc/pam.d/system-account "
     "${PKGDIR}/etc/pam.d/system-login ${PKGDIR}/etc/pam.d/system-password "
     "${PKGDIR}/etc/pam.d/system-session",
     "# Pliki system-* ZOSTAJA w pakiecie - wczesniej byly usuwane i pozostawaly\n"
     "# niezarzadzane, przez co zmiany w PAM nie docieraly do systemu.",
     "system-* zarzadzane przez pakiet")

# pkgrel 2 -> 3
text = open(P, encoding="utf-8").read()
m = re.search(r"(?m)^pkgrel:\s*'?(\d+)'?\s*$", text)
if int(m.group(1)) == 2:
    text = text[:m.start()] + "pkgrel: '3'" + text[m.end():]
    open(P, "w", encoding="utf-8").write(text)
    print("OK  pkgrel -> 3")

print("shadow gotowy")