import os
import re
import pwd
import grp
import hmac
import shutil
import hashlib
import warnings
import subprocess
import functools
from pathlib import Path

from flask import Flask, request, jsonify, render_template, Response, session, redirect, url_for

app = Flask(__name__)

VALID_NAME = re.compile(r'^[A-Za-z0-9_-]+$')
VALID_NFS_CLIENT = re.compile(r'^[A-Za-z0-9.*:/\-]+$')
ALLOWED_PATH_BASE = Path('/srv').resolve()

_CONF_DIR   = '/etc/micronas'
_ENV_FILE   = '/etc/micronas/micronas.env'

# Mutable credential store — updated by setup/change without restart (single gunicorn worker).
_creds = {
    'user':  os.environ.get('MICRONAS_USER', ''),
    'hash':  os.environ.get('MICRONAS_PASS_HASH', ''),   # PBKDF2: "salt$hex"
    'plain': os.environ.get('MICRONAS_PASS', ''),        # legacy plaintext
}

def _is_configured():
    return bool(_creds['user'] and (_creds['hash'] or _creds['plain']))

def _hash_password(password):
    salt = os.urandom(16).hex()
    h = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 260_000).hex()
    return f'{salt}${h}'

def _verify_password(password):
    if _creds['hash']:
        try:
            salt, h = _creds['hash'].split('$', 1)
            computed = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 260_000).hex()
            return hmac.compare_digest(computed, h)
        except Exception:
            return False
    if _creds['plain']:
        return hmac.compare_digest(password, _creds['plain'])
    return False

def _save_credentials(user, password):
    h = _hash_password(password)
    _ensure_conf_dir()
    Path(_ENV_FILE).write_text(f'MICRONAS_USER={user}\nMICRONAS_PASS_HASH={h}\n')
    os.chmod(_ENV_FILE, 0o600)
    _creds['user']  = user
    _creds['hash']  = h
    _creds['plain'] = ''
    app.secret_key  = hashlib.sha256(h.encode()).hexdigest()

# Derive initial secret key from stored credentials
_secret_src = _creds['hash'] or _creds['plain'] or 'insecure-dev-key'
app.secret_key = hashlib.sha256(_secret_src.encode()).hexdigest()

if not _is_configured():
    warnings.warn('No credentials configured — first-time setup required at /setup', stacklevel=1)


def require_auth(f):
    @functools.wraps(f)
    def decorated(*args, **kwargs):
        if not _is_configured():
            if request.path.startswith('/api/'):
                return Response('Setup required', 403)
            return redirect(url_for('setup'))
        if not session.get('logged_in'):
            if request.path.startswith('/api/'):
                return Response('Unauthorized', 401)
            return redirect(url_for('login'))
        return f(*args, **kwargs)
    return decorated


def validate_path(path_str):
    try:
        p = Path(path_str).resolve()
    except Exception:
        raise ValueError('invalid path')
    allowed = str(ALLOWED_PATH_BASE)
    if not (str(p) == allowed or str(p).startswith(allowed + '/')):
        raise ValueError('path must be under /srv')
    return str(p)


def _path_stat(path):
    """Return owner, group, and octal mode for a path. Empty strings on error."""
    try:
        s = os.stat(path)
        return {
            'owner': pwd.getpwuid(s.st_uid).pw_name,
            'group': grp.getgrgid(s.st_gid).gr_name,
            'mode':  oct(s.st_mode)[-3:],
        }
    except Exception:
        return {'owner': '', 'group': '', 'mode': ''}


_VALID_SMB_ENTRY = re.compile(r'^@?[A-Za-z0-9_-]+$')   # allows @groupname for SMB


def _validate_users(valid_users):
    """Validate and return a cleaned comma-separated user list (SMB: allows @group)."""
    users = []
    for u in re.split(r'[\s,]+', valid_users):
        if not u:
            continue
        if not _VALID_SMB_ENTRY.match(u):
            raise ValueError(f'invalid username: {u!r}')
        users.append(u)
    return ', '.join(users)


def _validate_webdav_users(valid_users):
    """Validate and return space-separated WebDAV usernames (no @groups)."""
    users = []
    for u in re.split(r'[\s,]+', valid_users):
        if not u:
            continue
        if not VALID_NAME.match(u):
            raise ValueError(f'invalid WebDAV username: {u!r} (no groups)')
        users.append(u)
    return ' '.join(users)


# ===== SMB =====

_SMB_SKIP = {'global', 'homes', 'printers', 'print$', 'ipc$'}


def _parse_smb_conf():
    """Parse /etc/samba/smb.conf into sections. First entry (name=None) is the preamble."""
    sections = []
    current = {'name': None, 'lines': []}
    try:
        with open('/etc/samba/smb.conf', 'r') as f:
            for line in f:
                m = re.match(r'^\s*\[(.+)\]\s*$', line)
                if m:
                    sections.append(current)
                    current = {'name': m.group(1).strip(), 'lines': [line]}
                else:
                    current['lines'].append(line)
    except FileNotFoundError:
        return []
    sections.append(current)
    return sections


def _write_smb_conf(sections):
    with open('/etc/samba/smb.conf', 'w') as f:
        for s in sections:
            f.writelines(s['lines'])
    subprocess.run(['smbcontrol', 'all', 'reload-config'], capture_output=True)


def parse_smb():
    result = subprocess.run(['testparm', '-s'], capture_output=True, text=True)
    shares = []
    current = None

    for line in result.stdout.splitlines():
        line = line.rstrip()
        m = re.match(r'^\[(.+)\]$', line)
        if m:
            if current is not None and current['name'].lower() not in _SMB_SKIP:
                shares.append(current)
            current = {'name': m.group(1), 'path': '', 'valid_users': '',
                       'enabled': True, 'guest_ok': False, 'read_only': False,
                       'force_user': '', 'force_group': '', 'recycle_bin': False}
        elif current is not None and '=' in line:
            key, _, val = line.partition('=')
            key = key.strip().lower().replace(' ', '_')
            val = val.strip()
            if key == 'path':
                current['path'] = val
            elif key == 'valid_users':
                current['valid_users'] = val
            elif key == 'available':
                current['enabled'] = val.lower() not in ('no', 'false', '0')
            elif key == 'guest_ok':
                current['guest_ok'] = val.lower() in ('yes', 'true', '1')
            elif key in ('writable', 'writeable'):
                current['read_only'] = val.lower() in ('no', 'false', '0')
            elif key == 'read_only':
                current['read_only'] = val.lower() in ('yes', 'true', '1')
            elif key == 'force_user':
                current['force_user'] = val
            elif key == 'force_group':
                current['force_group'] = val
            elif key == 'vfs_objects' and 'recycle' in val:
                current['recycle_bin'] = True

    if current is not None and current['name'].lower() not in _SMB_SKIP:
        shares.append(current)

    return shares


def add_smb_share(name, path, valid_users):
    config = (
        f'\n[{name}]\n'
        f'   path = {path}\n'
        f'   valid users = {valid_users}\n'
        '   writable = yes\n'
        '   browseable = yes\n'
    )
    with open('/etc/samba/smb.conf', 'a') as f:
        f.write(config)
    subprocess.run(['smbcontrol', 'all', 'reload-config'], check=True)


# ===== NFS =====

_DISABLED_PREFIX = '## '   # marker MicroNAS uses for disabled exports


def _parse_exports():
    """Parse /etc/exports. Only lines starting with '## /' are treated as
    disabled exports — everything else that starts with '#' is a plain comment
    and is left untouched."""
    entries = []
    try:
        with open('/etc/exports', 'r') as f:
            for raw in f:
                stripped = raw.strip()
                if not stripped:
                    entries.append({'kind': 'blank', 'raw': raw})
                    continue
                if stripped.startswith(_DISABLED_PREFIX + '/'):
                    inner = stripped[len(_DISABLED_PREFIX):]
                    parts = inner.split(None, 1)
                    entries.append({'kind': 'export', 'enabled': False,
                                    'path': parts[0], 'rest': parts[1] if len(parts) > 1 else ''})
                    continue
                if stripped.startswith('#'):
                    entries.append({'kind': 'comment', 'raw': raw})
                    continue
                parts = stripped.split(None, 1)
                entries.append({'kind': 'export', 'enabled': True,
                                'path': parts[0], 'rest': parts[1] if len(parts) > 1 else ''})
    except FileNotFoundError:
        pass
    return entries


def _write_exports(entries):
    with open('/etc/exports', 'w') as f:
        for e in entries:
            if e['kind'] == 'export':
                prefix = '' if e['enabled'] else _DISABLED_PREFIX
                rest = f'\t{e["rest"]}' if e['rest'] else ''
                f.write(f'{prefix}{e["path"]}{rest}\n')
            else:
                f.write(e['raw'])
    subprocess.run(['exportfs', '-ra'], check=True)


def get_nfs_shares():
    shares = []
    for e in _parse_exports():
        if e['kind'] != 'export':
            continue
        rest = e['rest']
        shares.append({
            'path': e['path'],
            'clients': rest,
            'enabled': e['enabled'],
            'no_root_squash': 'no_root_squash' in rest,
            'all_squash': 'all_squash' in rest,
        })
    return shares


def add_nfs_share(path, clients, ro=False):
    options = 'ro' if ro else 'rw'
    export_line = f'{path}\t{clients}({options},sync,no_subtree_check)\n'
    with open('/etc/exports', 'a') as f:
        f.write(export_line)
    subprocess.run(['exportfs', '-ra'], check=True)


# ===== WEBDAV =====

WEBDAV_CONF   = '/etc/apache2/conf-available/micronas-webdav.conf'
WEBDAV_PASSWD = '/etc/micronas/webdav.passwd'
_WEBDAV_MARK  = 'MICRONAS'


def _parse_webdav_conf():
    shares = []
    try:
        content = Path(WEBDAV_CONF).read_text()
    except FileNotFoundError:
        return shares
    pattern = re.compile(
        r'# BEGIN ' + _WEBDAV_MARK + r' (\S+)\n(.*?)# END ' + _WEBDAV_MARK + r' \1',
        re.DOTALL,
    )
    for m in pattern.finditer(content):
        name  = m.group(1)
        block = m.group(2)
        alias_m = re.search(r'^Alias\s+\S+\s+(\S+)', block, re.M)
        users_m = re.search(r'Require user (.+)$',   block, re.M)
        shares.append({
            'name':  name,
            'path':  alias_m.group(1).strip() if alias_m else '',
            'users': users_m.group(1).strip() if users_m else '',
        })
    return shares


def _ensure_conf_dir():
    """Create /etc/micronas with correct ownership so Apache can traverse it."""
    os.makedirs(_CONF_DIR, mode=0o750, exist_ok=True)
    subprocess.run(['chown', 'root:www-data', _CONF_DIR], capture_output=True)


def _write_webdav_conf(shares):
    _ensure_conf_dir()
    os.makedirs('/var/lib/apache2/webdav', exist_ok=True)
    subprocess.run(['chown', 'www-data:www-data', '/var/lib/apache2/webdav'], capture_output=True)
    lines = ['# Managed by MicroNAS — do not edit manually\n\n',
             'DavLockDB /var/lib/apache2/webdav/DavLock\n\n']
    for s in shares:
        require = f'Require user {s["users"]}' if s.get('users') else 'Require valid-user'
        lines += [
            f'# BEGIN {_WEBDAV_MARK} {s["name"]}\n',
            f'Alias /dav/{s["name"]} {s["path"]}\n',
            f'<Directory {s["path"]}>\n',
            '    Options Indexes\n',
            '    AllowOverride None\n',
            '    Require all granted\n',
            '</Directory>\n',
            f'<Location /dav/{s["name"]}>\n',
            '    DAV On\n',
            '    AuthType Basic\n',
            '    AuthName "MicroNAS WebDAV"\n',
            f'    AuthUserFile {WEBDAV_PASSWD}\n',
            f'    {require}\n',
            '</Location>\n',
            f'# END {_WEBDAV_MARK} {s["name"]}\n\n',
        ]
    with open(WEBDAV_CONF, 'w') as f:
        f.writelines(lines)
    # Ensure passwd file exists and is readable by www-data (Apache) but not world-readable
    if not os.path.exists(WEBDAV_PASSWD):
        Path(WEBDAV_PASSWD).touch(mode=0o640)
    subprocess.run(['chown', 'root:www-data', WEBDAV_PASSWD], capture_output=True)
    subprocess.run(['a2enconf', 'micronas-webdav'], capture_output=True)
    subprocess.run(['systemctl', 'reload', 'apache2'], capture_output=True)


def _set_webdav_password(name, password):
    """Add or update a user in the WebDAV htpasswd file. Silent if htpasswd not installed."""
    flag = '-ci' if not os.path.exists(WEBDAV_PASSWD) else '-i'
    try:
        subprocess.run(['htpasswd', flag, WEBDAV_PASSWD, name],
                       input=password, capture_output=True, text=True)
    except FileNotFoundError:
        pass   # apache2-utils not installed — skip


def _remove_webdav_user(name):
    if os.path.exists(WEBDAV_PASSWD):
        try:
            subprocess.run(['htpasswd', '-D', WEBDAV_PASSWD, name], capture_output=True)
        except FileNotFoundError:
            pass


@app.route('/api/share/webdav', methods=['POST'])
@require_auth
def create_webdav():
    data  = request.json or {}
    name  = data.get('name', '').strip()
    path  = data.get('path', '')
    users = data.get('users', '')

    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid share name'}), 400
    try:
        safe_path   = validate_path(path)
        clean_users = _validate_webdav_users(users) if users else ''
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    shares = _parse_webdav_conf()
    if any(s['name'] == name for s in shares):
        return jsonify({'error': f'share {name!r} already exists'}), 400
    shares.append({'name': name, 'path': safe_path, 'users': clean_users})
    _write_webdav_conf(shares)
    return jsonify({'status': 'created'})


@app.route('/api/share/webdav/<name>', methods=['PATCH'])
@require_auth
def edit_webdav(name):
    data     = request.json or {}
    new_name = data.get('name', name).strip()
    path     = data.get('path', '')
    users    = data.get('users', '')

    if not VALID_NAME.match(new_name):
        return jsonify({'error': 'invalid share name'}), 400
    try:
        safe_path   = validate_path(path)
        clean_users = _validate_webdav_users(users) if users else ''
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    shares = _parse_webdav_conf()
    for s in shares:
        if s['name'] == name:
            s['name']  = new_name
            s['path']  = safe_path
            s['users'] = clean_users
            break
    else:
        return jsonify({'error': f'share {name!r} not found'}), 404
    _write_webdav_conf(shares)
    return jsonify({'status': 'updated'})


@app.route('/api/share/webdav/<name>', methods=['DELETE'])
@require_auth
def delete_webdav(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid share name'}), 400
    shares  = _parse_webdav_conf()
    filtered = [s for s in shares if s['name'] != name]
    if len(filtered) == len(shares):
        return jsonify({'error': f'share {name!r} not found'}), 404
    _write_webdav_conf(filtered)
    return jsonify({'status': 'deleted'})


# ===== AUTH ROUTES =====

@app.route('/setup', methods=['GET', 'POST'])
def setup():
    if _is_configured():
        return redirect(url_for('index'))
    error = None
    username = 'admin'
    if request.method == 'POST':
        username = request.form.get('username', '').strip()
        password = request.form.get('password', '')
        confirm  = request.form.get('confirm', '')
        if not username or not VALID_NAME.match(username):
            error = 'Invalid username (letters, digits, _ - only).'
        elif len(password) < 8:
            error = 'Password must be at least 8 characters.'
        elif password != confirm:
            error = 'Passwords do not match.'
        else:
            _save_credentials(username, password)
            return redirect(url_for('login'))
    return render_template('setup.html', error=error, username=username)


@app.route('/login', methods=['GET', 'POST'])
def login():
    if not _is_configured():
        return redirect(url_for('setup'))
    if session.get('logged_in'):
        return redirect(url_for('index'))
    error = None
    if request.method == 'POST':
        username = request.form.get('username', '')
        password = request.form.get('password', '')
        if username == _creds['user'] and _verify_password(password):
            session['logged_in'] = True
            return redirect(url_for('index'))
        error = 'Invalid username or password.'
    return render_template('login.html', error=error)


@app.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('login'))


# ===== MAIN ROUTES =====

@app.route('/')
@require_auth
def index():
    return render_template('index.html')


@app.route('/api/shares', methods=['GET'])
@require_auth
def get_all_shares():
    smb = parse_smb()
    for s in smb:
        s.update(_path_stat(s['path']))
    nfs = get_nfs_shares()
    for s in nfs:
        s.update(_path_stat(s['path']))
    webdav = _parse_webdav_conf()
    for s in webdav:
        s.update(_path_stat(s['path']))
    return jsonify({'smb': smb, 'nfs': nfs, 'webdav': webdav})


# ===== SMB CRUD =====

@app.route('/api/share/smb', methods=['POST'])
@require_auth
def create_smb():
    data = request.json or {}
    name = data.get('name', '')
    path = data.get('path', '')
    valid_users = data.get('validUsers', '')

    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid share name (letters, digits, _ -)'}), 400
    try:
        clean_users = _validate_users(valid_users)
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    add_smb_share(name, safe_path, clean_users)
    return jsonify({'type': 'smb', 'status': 'created'})


@app.route('/api/share/smb/<name>', methods=['DELETE'])
@require_auth
def delete_smb(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid share name'}), 400
    sections = _parse_smb_conf()
    filtered = [s for s in sections if s['name'] != name]
    if len(filtered) == len(sections):
        return jsonify({'error': f'share {name!r} not found'}), 404
    _write_smb_conf(filtered)
    return jsonify({'status': 'deleted'})


@app.route('/api/share/smb/<name>', methods=['PATCH'])
@require_auth
def edit_smb(name):
    data = request.json or {}
    new_name    = data.get('name', name).strip()
    path        = data.get('path', '')
    valid_users = data.get('validUsers', '')
    force_user   = data.get('forceUser', '').strip()
    force_group  = data.get('forceGroup', '').strip()
    guest_ok     = data.get('guestOk', False)
    read_only    = data.get('readOnly', False)
    recycle_bin  = data.get('recycleBin', False)

    if not VALID_NAME.match(new_name):
        return jsonify({'error': 'invalid share name'}), 400
    if force_user and not VALID_NAME.match(force_user):
        return jsonify({'error': 'invalid force user'}), 400
    if force_group and not VALID_NAME.match(force_group):
        return jsonify({'error': 'invalid force group'}), 400
    try:
        clean_users = _validate_users(valid_users)
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    lines = [
        f'[{new_name}]\n',
        f'   path = {safe_path}\n',
        f'   valid users = {clean_users}\n',
        f'   {"read only" if read_only else "writable"} = yes\n',
        '   browseable = yes\n',
    ]
    if force_user:
        lines.append(f'   force user = {force_user}\n')
    if force_group:
        lines.append(f'   force group = {force_group}\n')
    if guest_ok:
        lines.append('   guest ok = yes\n')
    if recycle_bin:
        lines.append('   vfs objects = recycle\n')
        lines.append('   recycle:repository = .recycle\n')
        lines.append('   recycle:keeptree = yes\n')
        lines.append('   recycle:versions = yes\n')

    sections = _parse_smb_conf()
    for s in sections:
        if s['name'] == name:
            s['name'] = new_name
            s['lines'] = lines
            break
    else:
        return jsonify({'error': f'share {name!r} not found'}), 404
    _write_smb_conf(sections)
    return jsonify({'status': 'updated'})


@app.route('/api/share/smb/<name>/toggle', methods=['POST'])
@require_auth
def toggle_smb(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid share name'}), 400
    enabled = (request.json or {}).get('enabled', True)

    sections = _parse_smb_conf()
    for s in sections:
        if s['name'] == name:
            s['lines'] = [l for l in s['lines'] if not re.match(r'\s*available\s*=', l, re.I)]
            if not enabled:
                s['lines'].append('   available = no\n')
            break
    else:
        return jsonify({'error': f'share {name!r} not found'}), 404
    _write_smb_conf(sections)
    return jsonify({'status': 'enabled' if enabled else 'disabled'})


# ===== NFS CRUD =====

@app.route('/api/share/nfs', methods=['POST'])
@require_auth
def create_nfs():
    data = request.json or {}
    path = data.get('path', '')
    clients = data.get('clients', '*')
    ro = data.get('readOnly', False)

    try:
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400
    if not VALID_NFS_CLIENT.match(clients):
        return jsonify({'error': 'invalid client spec'}), 400

    add_nfs_share(safe_path, clients, ro)
    return jsonify({'type': 'nfs', 'status': 'created'})


@app.route('/api/share/nfs', methods=['DELETE'])
@require_auth
def delete_nfs():
    path = (request.json or {}).get('path', '')
    try:
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    entries = _parse_exports()
    original = sum(1 for e in entries if e['kind'] == 'export')
    entries = [e for e in entries if not (e['kind'] == 'export' and e['path'] == safe_path)]
    if sum(1 for e in entries if e['kind'] == 'export') == original:
        return jsonify({'error': f'export {safe_path!r} not found'}), 404
    _write_exports(entries)
    return jsonify({'status': 'deleted'})


@app.route('/api/share/nfs', methods=['PATCH'])
@require_auth
def edit_nfs():
    data = request.json or {}
    path = data.get('path', '')
    clients = data.get('clients', '*')
    ro = data.get('readOnly', False)

    try:
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400
    if not VALID_NFS_CLIENT.match(clients):
        return jsonify({'error': 'invalid client spec'}), 400

    no_root_squash = data.get('noRootSquash', False)
    all_squash     = data.get('allSquash', False)
    options = ','.join(filter(None, [
        'ro' if ro else 'rw',
        'sync',
        'no_subtree_check',
        'no_root_squash' if no_root_squash else None,
        'all_squash' if all_squash else None,
    ]))
    new_rest = f'{clients}({options})'

    entries = _parse_exports()
    for e in entries:
        if e['kind'] == 'export' and e['path'] == safe_path:
            e['rest'] = new_rest
            break
    else:
        return jsonify({'error': f'export {safe_path!r} not found'}), 404
    _write_exports(entries)
    return jsonify({'status': 'updated'})


@app.route('/api/share/nfs/toggle', methods=['POST'])
@require_auth
def toggle_nfs():
    data = request.json or {}
    path = data.get('path', '')
    enabled = data.get('enabled', True)

    try:
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

    entries = _parse_exports()
    for e in entries:
        if e['kind'] == 'export' and e['path'] == safe_path:
            e['enabled'] = enabled
            break
    else:
        return jsonify({'error': f'export {safe_path!r} not found'}), 404
    _write_exports(entries)
    return jsonify({'status': 'enabled' if enabled else 'disabled'})


# ===== PERMISSIONS =====

@app.route('/api/permissions', methods=['POST'])
@require_auth
def set_permissions():
    data = request.json or {}
    path  = data.get('path', '')
    owner = data.get('owner', '').strip()
    group = data.get('group', '').strip()
    mode  = data.get('mode', '').strip()

    try:
        safe_path = validate_path(path)
    except ValueError as e:
        return jsonify({'error': str(e)}), 400
    if owner and not VALID_NAME.match(owner):
        return jsonify({'error': 'invalid owner name'}), 400
    if group and not VALID_NAME.match(group):
        return jsonify({'error': 'invalid group name'}), 400
    if mode and not re.match(r'^[0-7]{3,4}$', mode):
        return jsonify({'error': 'mode must be 3-4 octal digits (e.g. 770)'}), 400

    if owner or group:
        chown_arg = f'{owner}:{group}' if (owner and group) else (owner or f':{group}')
        r = subprocess.run(['chown', chown_arg, safe_path], capture_output=True, text=True)
        if r.returncode != 0:
            return jsonify({'error': r.stderr.strip() or 'chown failed'}), 500

    if mode:
        r = subprocess.run(['chmod', mode, safe_path], capture_output=True, text=True)
        if r.returncode != 0:
            return jsonify({'error': r.stderr.strip() or 'chmod failed'}), 500

    return jsonify({'status': 'ok', 'stat': _path_stat(safe_path)})


# ===== GROUPS =====

_GROUP_WHITELIST = {'root', 'staff', 'sambashare', 'www-data'}
_USER_WHITELIST  = {'www-data'}   # system accounts useful as folder owners


def _list_groups():
    groups = []
    with open('/etc/group', 'r') as f:
        for line in f:
            parts = line.strip().split(':')
            if len(parts) < 4:
                continue
            name, gid_str, members_str = parts[0], parts[2], parts[3]
            try:
                gid = int(gid_str)
            except ValueError:
                continue
            members = [m for m in members_str.split(',') if m]
            if gid >= 1000 or name in _GROUP_WHITELIST:
                groups.append({'name': name, 'gid': gid, 'members': members})
    return sorted(groups, key=lambda g: g['name'])


@app.route('/api/groups', methods=['GET'])
@require_auth
def list_groups():
    return jsonify(_list_groups())


@app.route('/api/groups', methods=['POST'])
@require_auth
def create_group():
    name = (request.json or {}).get('name', '')
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid group name'}), 400
    r = subprocess.run(['groupadd', name], capture_output=True, text=True)
    if r.returncode != 0:
        return jsonify({'error': r.stderr.strip() or 'groupadd failed'}), 400
    return jsonify({'status': 'created'})


@app.route('/api/groups/<name>', methods=['DELETE'])
@require_auth
def delete_group(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid group name'}), 400
    r = subprocess.run(['groupdel', name], capture_output=True, text=True)
    if r.returncode != 0:
        return jsonify({'error': r.stderr.strip() or 'groupdel failed'}), 500
    return jsonify({'status': 'deleted'})


@app.route('/api/groups/<name>/members', methods=['POST'])
@require_auth
def add_group_member(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid group name'}), 400
    user = (request.json or {}).get('user', '')
    if not VALID_NAME.match(user):
        return jsonify({'error': 'invalid username'}), 400
    r = subprocess.run(['gpasswd', '-a', user, name], capture_output=True, text=True)
    if r.returncode != 0:
        return jsonify({'error': r.stderr.strip() or 'gpasswd failed'}), 500
    return jsonify({'status': 'added'})


@app.route('/api/groups/<name>/members/<user>', methods=['DELETE'])
@require_auth
def remove_group_member(name, user):
    if not VALID_NAME.match(name) or not VALID_NAME.match(user):
        return jsonify({'error': 'invalid name'}), 400
    r = subprocess.run(['gpasswd', '-d', user, name], capture_output=True, text=True)
    if r.returncode != 0:
        return jsonify({'error': r.stderr.strip() or 'gpasswd failed'}), 500
    return jsonify({'status': 'removed'})


# ===== USERS =====

def _smb_users():
    try:
        r = subprocess.run(['pdbedit', '-L'], capture_output=True, text=True)
        return {line.split(':')[0].strip() for line in r.stdout.splitlines() if ':' in line}
    except FileNotFoundError:
        return set()


def _list_users():
    smb = _smb_users()
    users = []
    with open('/etc/passwd', 'r') as f:
        for line in f:
            parts = line.strip().split(':')
            if len(parts) < 4:
                continue
            name, uid = parts[0], parts[2]
            uid = int(uid)
            if uid < 1000 or uid == 65534:
                if name not in _USER_WHITELIST:
                    continue
            users.append({'name': name, 'uid': uid, 'smb': name in smb})
    return users


def _set_smb_password(name, password):
    r = subprocess.run(
        ['smbpasswd', '-a', '-s', name],
        input=f'{password}\n{password}\n',
        capture_output=True, text=True,
    )
    if r.returncode != 0:
        raise RuntimeError(r.stderr.strip() or 'smbpasswd failed')


@app.route('/api/users', methods=['GET'])
@require_auth
def list_users():
    return jsonify(_list_users())


@app.route('/api/users', methods=['POST'])
@require_auth
def create_user():
    data = request.json or {}
    name = data.get('name', '')
    password = data.get('password', '')

    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid username (letters, digits, _ -)'}), 400
    if len(password) < 8:
        return jsonify({'error': 'password must be at least 8 characters'}), 400

    try:
        subprocess.run(['useradd', '-M', '-s', '/usr/sbin/nologin', name], check=True)
    except subprocess.CalledProcessError:
        return jsonify({'error': f'user {name!r} already exists or useradd failed'}), 400
    try:
        _set_smb_password(name, password)
    except RuntimeError as e:
        return jsonify({'error': str(e)}), 500
    _set_webdav_password(name, password)
    return jsonify({'status': 'created'})


@app.route('/api/users/<name>', methods=['DELETE'])
@require_auth
def delete_user(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid username'}), 400
    subprocess.run(['smbpasswd', '-x', name], capture_output=True)
    _remove_webdav_user(name)
    try:
        subprocess.run(['userdel', name], check=True)
    except subprocess.CalledProcessError as e:
        return jsonify({'error': f'userdel failed: {e}'}), 500
    return jsonify({'status': 'deleted'})


@app.route('/api/admin/credentials', methods=['POST'])
@require_auth
def change_admin_credentials():
    data       = request.json or {}
    current_pw = data.get('currentPassword', '')
    new_user   = data.get('username', '').strip()
    new_pw     = data.get('password', '')

    if not _verify_password(current_pw):
        return jsonify({'error': 'Current password is incorrect.'}), 403
    if new_user and not VALID_NAME.match(new_user):
        return jsonify({'error': 'Invalid username.'}), 400
    if new_pw and len(new_pw) < 8:
        return jsonify({'error': 'Password must be at least 8 characters.'}), 400

    user = new_user or _creds['user']
    pw   = new_pw   or current_pw
    _save_credentials(user, pw)
    session.clear()
    return jsonify({'status': 'updated'})



@app.route('/api/users/<name>/password', methods=['POST'])
@require_auth
def change_password(name):
    if not VALID_NAME.match(name):
        return jsonify({'error': 'invalid username'}), 400
    data = request.json or {}
    password = data.get('password', '')
    if len(password) < 8:
        return jsonify({'error': 'password must be at least 8 characters'}), 400
    try:
        _set_smb_password(name, password)
    except RuntimeError as e:
        return jsonify({'error': str(e)}), 500
    _set_webdav_password(name, password)
    return jsonify({'status': 'updated'})


# ===== DASHBOARD =====

def _daemon_status():
    def is_active(service):
        r = subprocess.run(['systemctl', 'is-active', service], capture_output=True, text=True)
        return r.stdout.strip() == 'active'
    return {
        'smbd':    is_active('smbd'),
        'nfsd':    is_active('nfs-server'),
        'apache2': is_active('apache2'),
    }


def _server_ips():
    """Return list of {iface, ip} for all non-loopback IPv4 addresses."""
    try:
        r = subprocess.run(['ip', '-4', '-o', 'addr', 'show'], capture_output=True, text=True)
        result = []
        for line in r.stdout.splitlines():
            # Format: <idx>: <iface> inet <ip/prefix> ...
            m = re.match(r'\d+:\s+(\S+)\s+inet\s+([\d.]+)', line)
            if m and m.group(1) != 'lo':
                result.append({'iface': m.group(1), 'ip': m.group(2)})
        return result
    except Exception:
        return []


def _active_connections():
    """Parse smbstatus output to return list of active SMB sessions."""
    try:
        r = subprocess.run(['smbstatus', '-b'], capture_output=True, text=True, timeout=5)
        sessions = []
        in_section = False
        for line in r.stdout.splitlines():
            if re.match(r'-{10,}', line):
                in_section = True
                continue
            if not in_section or not line.strip():
                continue
            # "PID  Username  Group  Machine  Protocol  Encryption  Signing"
            # Skip the header row
            if line.strip().startswith('PID'):
                continue
            parts = line.split()
            if len(parts) >= 4:
                sessions.append({'user': parts[1], 'machine': parts[3]})
        return sessions
    except Exception:
        return []


@app.route('/api/service/<name>/restart', methods=['POST'])
@require_auth
def restart_service(name):
    service_map = {'smbd': 'smbd', 'nfsd': 'nfs-server', 'apache2': 'apache2'}
    if name not in service_map:
        return jsonify({'error': 'unknown service'}), 400
    r = subprocess.run(['systemctl', 'restart', service_map[name]], capture_output=True, text=True)
    if r.returncode != 0:
        return jsonify({'error': r.stderr.strip() or 'restart failed'}), 500
    return jsonify({'status': 'restarted'})


def _disk_usage():
    try:
        u = shutil.disk_usage('/srv')
        return {
            'path': '/srv',
            'total_gb': round(u.total / 1024**3, 1),
            'used_gb': round(u.used / 1024**3, 1),
            'free_gb': round(u.free / 1024**3, 1),
            'percent': round(u.used / u.total * 100, 1) if u.total else 0,
        }
    except Exception as e:
        return {'error': str(e)}


def _du_bytes(path):
    try:
        r = subprocess.run(['du', '-sb', path], capture_output=True, text=True, timeout=15)
        if r.returncode == 0:
            parts = r.stdout.split()
            return int(parts[0]) if parts else 0
    except Exception:
        pass
    return 0


def _shares_with_usage():
    result = []
    for s in parse_smb():
        result.append({
            'type': 'smb', 'name': s['name'], 'path': s['path'],
            'access': s['valid_users'], 'enabled': s['enabled'],
            'size_gb': round(_du_bytes(s['path']) / 1024**3, 2) if s['path'] else 0,
        })
    for s in get_nfs_shares():
        result.append({
            'type': 'nfs', 'name': None, 'path': s['path'],
            'access': s['clients'], 'enabled': s['enabled'],
            'size_gb': round(_du_bytes(s['path']) / 1024**3, 2) if s['path'] else 0,
        })
    for s in _parse_webdav_conf():
        result.append({
            'type': 'webdav', 'name': s['name'], 'path': s['path'],
            'access': s['users'] or 'all', 'enabled': True,
            'size_gb': round(_du_bytes(s['path']) / 1024**3, 2) if s['path'] else 0,
        })
    return result



@app.route('/api/dashboard', methods=['GET'])
@require_auth
def get_dashboard():
    return jsonify({
        'status': _daemon_status(),
        'disk': _disk_usage(),
        'shares': _shares_with_usage(),
        'ips': _server_ips(),
        'connections': _active_connections(),
    })


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=False)