# -*- coding: utf-8 -*-
from setuphelpers import *
import win32security
import win32net
import os


audit_local_admins = None
# Give domain Name
domain_name = os.environ["USERDOMAIN"]

# Define allowed users in admin group
allowed_admins_list = [
    rf"{get_computername()}\tisadmin",
    rf"{domain_name}\tis-adm",
]
dict_sid_name = {}


def install():
    pass


def audit():
    global dict_sid_name, audit_local_admins

    if len(get_computername()) > 15:
        print("Computer name longer than 15 characters.")
        return "ERROR"

    audit_local_admins = makepath(install_location("WAPT_is1"), "private", "persistent", control.package_uuid, "audit-local-admins-cache.json")

    try:
        dict_sid_name = cache_info()
    except:
        dict_sid_name = {}

    # domain admins group name
    name_group_admin = get_name_with_sid("S-1-5-32-544")

    # local user administrator group name
    local_administrator = str(
        get_computername()
        + "\\"
        + get_name_with_sid(win32security.ConvertSidToStringSid(win32net.NetUserModalsGet(get_computername(), 2)["domain_id"]) + "-500")
    ).lower()

    # allowed for local administror user and domain name ...
    allow_admin = [local_administrator, domain_name.lower() + "\\"]

    # Try add "domain admins" group in allow admin list
    try:
        allow_admin.append(str("%s\\%s".lower() % (domain_name, get_name_with_sid("%s-512" % get_domain_sid()))).lower())
    except Exception as e:
        print("Domain controllers are unavailable?")
        error(e)

    # convert allowed_admins_list in lower and add in allow_admin liste
    newlist = []
    for l in allowed_admins_list:
        newlist.append(l.lower())
    allow_admin.extend(newlist)

    json_write_file(audit_local_admins, dict_sid_name)

    # print bad user in admin list
    unallowed_user_in_admins_group = False
    listerror = []
    admins_users = local_group_members(name_group_admin)

    admins_dict = {"unallowed": {}, "allowed": {}}

    for user in admins_users:
        domain = user.split("\\")[0]
        username = user.split("\\")[-1]

        if not user.lower() in allow_admin:
            listerror.append(user)
            admins_dict["unallowed"][domain] = admins_dict["unallowed"].get(domain, [])
            admins_dict["unallowed"][domain].append(username)
        else:
            admins_dict["allowed"][domain] = admins_dict["allowed"].get(domain, [])
            admins_dict["allowed"][domain].append(username)

    print("ADMINS LIST : %s" % ",".join(admins_users))  # Allowed users in admin list:    
    if listerror:
        print("UNALLOWED ADMINS LIST : %s" % ",".join(listerror))  # Bad users in admin list:
        unallowed_user_in_admins_group = True


    WAPT.write_audit_data_if_changed("audit-local-admins", "audit-local-admins", admins_dict)

    if unallowed_user_in_admins_group:
        return "ERROR"

    return "OK"


def cache_info():
    global audit_local_admins
    return json_load_file(audit_local_admins)


# Get Name With SID
def get_name_with_sid(osid):
    global dict_sid_name
    try:
        sid = win32security.GetBinarySid(osid)
        name, domain, typ = win32security.LookupAccountSid(wincomputername(), sid)
        dict_sid_name[osid] = name
        return name
    except:
        if osid in dict_sid_name:
            return dict_sid_name[osid]
        error("Failed name resolution for %s" % osid)


# Found Domain SID
def get_domain_sid():
    global dict_sid_name
    try:
        umi2 = win32net.NetUserModalsGet(win32net.NetGetDCName(), 2)
        domain_sid = umi2["domain_id"]
        name = win32security.ConvertSidToStringSid(domain_sid)
        dict_sid_name["get_domain_sid"] = name
        return name
    except:
        if "get_domain_sid" in dict_sid_name:
            return dict_sid_name["get_domain_sid"]
        error("Domain SID is not available")