#
# Add users expected by tests to an OS X machine. Assumes passwordless sudo to
# root.
#
# WARNING: this creates non-privilged accounts with pre-set passwords!
#

- hosts: test-targets
  gather_facts: true
  become: true
  tasks:
    - name: Disable non-localhost SSH for Mitogen users
      blockinfile:
        path: /etc/ssh/sshd_config
        block: |
          Match User mitogen__* Address !127.0.0.1
            DenyUsers *

    #
    # Hashed passwords.
    #
    - name: Create Mitogen test group
      group:
        name: "mitogen__group"

    - name: Create Mitogen test users
      user:
        name: "mitogen__{{item}}"
        shell: /bin/bash
        groups: mitogen__group
        password: "{{ (item + '_password') | password_hash('sha256') }}"
      with_items:
        - has_sudo
        - has_sudo_pubkey
        - require_tty
        - pw_required
        - require_tty_pw_required
        - slow_user
      when: ansible_system != 'Darwin'

    - name: Create Mitogen test users
      user:
        name: "mitogen__user{{item}}"
        shell: /bin/bash
        password: "{{ ('user' + item + '_password') | password_hash('sha256') }}"
      with_sequence: start=1 end=21
      when: ansible_system != 'Darwin'

    #
    # Plaintext passwords
    #
    - name: Create Mitogen test users
      user:
        name: "mitogen__{{item}}"
        shell: /bin/bash
        groups: mitogen__group
        password: "{{item}}_password"
      with_items:
        - has_sudo
        - has_sudo_pubkey
        - require_tty
        - pw_required
        - require_tty_pw_required
        - readonly_homedir
        - slow_user
      when: ansible_system == 'Darwin'

    - name: Create Mitogen test users
      user:
        name: "mitogen__user{{item}}"
        shell: /bin/bash
        password: "user{{item}}_password"
      with_sequence: start=1 end=21
      when: ansible_system == 'Darwin'

    - name: Hide test users from login window.
      shell: >
        defaults
        write
        /Library/Preferences/com.apple.loginwindow
        HiddenUsersList
        -array-add '{{item}}'
      with_items:
        - mitogen__require_tty
        - mitogen__pw_required
        - mitogen__require_tty_pw_required
      when: ansible_system == 'Darwin'

    - name: Hide test users from login window.
      shell: >
        defaults
        write
        /Library/Preferences/com.apple.loginwindow
        HiddenUsersList
        -array-add 'mitogen__user{{item}}'
      with_sequence: start=1 end=21
      when: ansible_distribution == 'MacOSX'

    - name: Readonly homedir for one account
      shell: "chown -R root: ~mitogen__readonly_homedir"

    - name: Slow bash profile for one account
      copy:
        dest: ~mitogen__slow_user/.{{item}}
        src: ../data/docker/mitogen__slow_user.profile
      with_items:
      - bashrc
      - profile

    - name: Install pubkey for one account
      file:
        path: ~mitogen__has_sudo_pubkey/.ssh
        state: directory
        mode: go=
        owner: mitogen__has_sudo_pubkey

    - name: Install pubkey for one account
      copy:
        dest: ~mitogen__has_sudo_pubkey/.ssh/authorized_keys
        src: ../data/docker/mitogen__has_sudo_pubkey.key.pub
        mode: go=
        owner: mitogen__has_sudo_pubkey

    - name: Require a TTY for two accounts
      lineinfile:
        path: /etc/sudoers
        line: "{{item}}"
      with_items:
        - Defaults>mitogen__pw_required targetpw
        - Defaults>mitogen__require_tty requiretty
        - Defaults>mitogen__require_tty_pw_required requiretty,targetpw

    - name: Require password for two accounts
      lineinfile:
        path: /etc/sudoers
        line: "{{lookup('pipe', 'whoami')}} ALL = ({{item}}) ALL"
      with_items:
        - mitogen__pw_required
        - mitogen__require_tty_pw_required

    - name: Allow passwordless for two accounts
      lineinfile:
        path: /etc/sudoers
        line: "{{lookup('pipe', 'whoami')}} ALL = ({{item}}) NOPASSWD:ALL"
      with_items:
        - mitogen__require_tty
        - mitogen__readonly_homedir

    - name: Allow passwordless for many accounts
      lineinfile:
        path: /etc/sudoers
        line: "{{lookup('pipe', 'whoami')}} ALL = (mitogen__user{{item}}) NOPASSWD:ALL"
      with_sequence: start=1 end=21