#!/usr/bin/env python
# coding=utf-8

import sys, os, re, socket

def f_adminuser_count_check(admin_users=""):
    admin_users_lst = admin_users.split(',')
    admin_users_cnt = len(admin_users_lst)
    sql_stmt = """select count(1) from mysql.user where user in ('%s')""" % (admin_users.replace(",", "','"))
    sql_cmd = """mysql --login-path=tidblogin -NBe "%s" """ % (sql_stmt)
    script_result = os.popen(sql_cmd).read().splitlines()
    print("kv:管理用户数目:%s" %(admin_users))
    if len(script_result) > 0 and script_result[0] == admin_users_cnt:
        print('kv:0')
    else:
        print('kv:1')

def f_adminuser_grant_check(admin_users=""):
    admin_users_lst = admin_users.split(',')
    for adminuser in admin_users_lst:
        if adminuser == "root":
            continue
        sql_stmt = """show grants for %s""" % (adminuser)
        sql_cmd = """mysql --login-path=tidblogin -NBe "%s" """ % (sql_stmt)
        script_result = os.popen(sql_cmd).read().splitlines()
        print("kv:%s用户权限合理" % (adminuser))
        if adminuser not in adminusers_grant_dict:
            print("kv:1")
            print("%s用户权限规范不存在" % (adminuser))
            continue

        if script_result == adminusers_grant_dict[adminuser]:
            print("kv:0")
        else:
            print("kv:1")
            print("%s\n%s" %(adminusers_grant_dict[adminuser], script_result))

def main():
    # 读取配置文件,获取管理用户清单
    os_cmd = os.popen('grep -w ^tidb /etc/passwd').read()
    tidb_home = os_cmd.split(':')[5]
    base_path = "%s/scripts/normalcheck" %(tidb_home)
    vars_file = "%s/config/tidb_vars.config" %(base_path)
    with open(vars_file, mode='r') as f:
        for line in f:
            if line.split('=')[0] == "ADMINUSERS":
                print(line)
                ADMINUSERS = line.strip().split('=')[1].replace('"', '')


    #admin 用户权限明细
    global adminusers_grant_dict
    adminusers_grant_dict = {"tidb": ["GRANT ALL PRIVILEGES ON *.* TO 'tidb'@'%' WITH GRANT OPTION"],
                             "timon": ["GRANT PROCESS,SHOW DATABASES,SHOW VIEW ON *.* TO 'timon'@'%'",
                                       "GRANT SELECT ON INFORMATION_SCHEMA.* TO 'timon'@'%'",
                                       "GRANT SELECT ON METRICS_SCHEMA.* TO 'timon'@'%'",
                                       "GRANT SELECT ON PERFORMANCE_SCHEMA.* TO 'timon'@'%'",
                                       "GRANT SELECT ON mysql.* TO 'timon'@'%'"],
                             "repl": ["GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,ALTER,EXECUTE,INDEX ON *.* TO 'repl'@'%'"],
                             "dsg": ["GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,ALTER,EXECUTE,INDEX ON *.* TO 'dsg'@'%'"]
                             }
    #主集群repl用户设置只读
    #主机名第3位等1的是主集群,等2的是备集群
    HOSTNAME = socket.gethostname()
    if HOSTNAME[2:3] == '1':
        adminusers_grant_dict["repl"] = ["GRANT SELECT ON *.* TO 'repl'@'%'"]

    # 检查管理用户数目
    f_adminuser_count_check(ADMINUSERS)

    # 检查管理用户权限
    f_adminuser_grant_check(ADMINUSERS)

if __name__ == '__main__':
    main()