#!/usr/bin/env bash
# site/user -- reset a WordPress password or create an administrator
#
# The password is fed to wp-cli through --prompt, never as an argument, so it
# does not appear in the process list or in shell history.
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t site_m_user)"

site_pick_domain "${1:-}" || exit $?
domain=$SITE_DOMAIN
root=$(nv_site_get "$domain" root_path "$(site_domain_root "$domain")")
user=$(site_web_user "$domain")

[ -f "$root/wp-config.php" ] || { ui_err "$(t wp_update_not_wp)"; exit 2; }
[ -x /usr/local/bin/wp ] || { ui_err "$(t site_wp_nocli)"; exit 1; }

WP="sudo -u $user /usr/local/bin/wp --path=$root"

ui_section "$(t wp_users)"
$WP user list --fields=ID,user_login,user_email,roles --format=table 2>/dev/null | sed 's/^/  /'
ui_blank
ui_info "1) $(t wp_user_reset)"
ui_info "2) $(t wp_user_create)"
ui_info "0) $(t menu_back)"
ui_blank

printf '  %s: ' "$(t menu_prompt_short)"
read -r pick || exit 130
case $pick in 1|2) ;; 0) exit 0 ;; *) ui_err "$(t menu_invalid)"; exit 2 ;; esac

if [ "$pick" = "1" ]; then
    printf '  %s: ' "$(t wp_user_login)"
    read -r login || exit 130
    login=$(nv_trim "$login")
    nv_valid_ident "$login" || { ui_err "$(t db_bad_user)"; exit 2; }
    $WP user get "$login" --field=ID >/dev/null 2>&1 || { ui_err "$(t wp_user_missing)"; exit 2; }

    pass=$(site_random_password)
    if printf '%s\n' "$pass" | $WP user update "$login" --prompt=user_pass 2>/dev/null; then
        nv_trace wp-user "$domain reset-password $login"
        ui_ok "$(t wp_user_reset_done "$login")"
        ui_kv "$(t db_pass)" "$pass"
        ui_warn "$(t db_pass_once)"
    else
        nv_fail 3501 "$(t wp_user_failed)"
        exit 1
    fi
    exit 0
fi

printf '  %s: ' "$(t wp_user_login)"
read -r login || exit 130
login=$(nv_trim "$login")
nv_valid_ident "$login" || { ui_err "$(t db_bad_user)"; exit 2; }

printf '  %s: ' "$(t wp_user_email)"
read -r email || exit 130
email=$(nv_trim "$email")
[ -z "$email" ] && email="admin@$domain"
nv_valid_email "$email" || { ui_err "$(t ssl_bad_email)"; exit 2; }

pass=$(site_random_password)
if printf '%s\n' "$pass" | $WP user create "$login" "$email" --role=administrator --prompt=user_pass 2>/dev/null; then
    nv_trace wp-user "$domain create-admin $login"
    ui_ok "$(t wp_user_created "$login")"
    ui_kv "$(t db_pass)" "$pass"
    ui_warn "$(t db_pass_once)"
else
    nv_fail 3502 "$(t wp_user_failed)"
    exit 1
fi
exit 0
