require 'foreman/util'

namespace :security do
  desc 'Generate new encryption key'
  task :generate_encryption_key do
    include Foreman::Util
    File.open(Rails.root.join('config', 'initializers', 'encryption_key.rb'), "w") do |fd|
      fd.write("# Be sure to restart your server when you modify this file.

# Your encryption key for encrypting and decrypting database fields.
# If you change this key, all encrypted data will NOT be able to be decrypted by Foreman!
# Make sure the key is at least 32 bytes such as SecureRandom.hex(20)

# You can use `rake security:generate_encryption_key` to regenerate this file.

module EncryptionKey
  ENCRYPTION_KEY = '#{secure_encryption_key}'
end
")
      puts "Encryption key generated in file config/initializers/encryption_key.rb"
      puts "Restart the server and then run rake db:compute_resources:encrypt"
    end
  end
end

namespace :db do
  def modify_encryptable_fields(klass, action)
    klass.order(:id).each do |encryptable_resource|
      encryptable_resource.encryptable_fields.each do |field|
        str = encryptable_resource.read_attribute(field.to_sym)
        encryptable_resource.update_column(field.to_sym,
                                       encryptable_resource.send("#{action}_field", str))
      end
    end
  end

  desc <<-END_DESC
Encrypt all passwords (compute resources, LDAP authentication sources) using
the encryption key in config/initializers/encryption_key.rb.

Plugins might enhance this task.

This task is idempotent and it will just skip already encrypted passwords.
END_DESC
  task :encrypt_all do
    Rake::Task['db:auth_sources_ldap:encrypt'].invoke
    Rake::Task['db:compute_resources:encrypt'].invoke
  end

  desc <<-END_DESC
Decrypt all passwords (compute resources, LDAP authentication sources) using the encryption key
in config/initializers/encryption_key.rb.

Plugins might enhance this task.

This task is idempotent and it will just skip already decrypted passwords.
END_DESC
  task :decrypt_all do
    Rake::Task['db:auth_sources_ldap:decrypt'].invoke
    Rake::Task['db:compute_resources:decrypt'].invoke
  end

  namespace :auth_sources_ldap do
    desc "Encrypt LDAP authentication source fields"
    task :encrypt => :environment do
      modify_encryptable_fields(AuthSourceLdap, :encrypt)
    end

    desc "Decrypt LDAP authentication source fields"
    task :decrypt => :environment do
      modify_encryptable_fields(AuthSourceLdap, :decrypt)
    end
  end

  namespace :compute_resources do
    desc "Encrypt compute resource fields"
    task :encrypt => :environment do
      modify_encryptable_fields(ComputeResource, :encrypt)
    end

    desc "Decrypt compute resource fields"
    task :decrypt => :environment do
      modify_encryptable_fields(ComputeResource, :decrypt)
    end
  end
end
