# coding=utf-8

import sys, os, re, socket
import requests

def f_appuser_grant_check(username='', usergrant=[]):
    """
    应用用户权限检查:
    *.* 只允许 select
    系统库 只允许 select
    其它库 不限制
    INFORMATION_SCHEMA/METRICS_SCHEMA/PERFORMANCE_SCHEMA/mysql.* 只允许执行select
    """
    sys_database_lst = ['INFORMATION_SCHEMA', 'METRICS_SCHEMA', 'PERFORMANCE_SCHEMA', 'mysql']
    readonly_lst = ['SELECT', 'USAGE']
    check_flag = 0
    for grant_sql in usergrant:
        grant_sql_re = re.findall(r'GRANT (.*) ON (.*)\.', grant_sql, flags=re.IGNORECASE)
        grant_sql_privs = grant_sql_re[0][0].upper()
        grant_sql_db = grant_sql_re[0][1]
        # print(grant_sql_privs, grant_sql_db)
        if grant_sql_db in sys_database_lst and grant_sql_privs not in readonly_lst:
            check_flag += 1
        if grant_sql_db == "*" and grant_sql_privs not in readonly_lst:
            check_flag += 1
    print('kv:%s用户权限检查' %(username.replace("'", "")))
    if check_flag == 0:
        print('kv:0')
    else:
        print('kv:1')

def f_appuser_count_check(admin_users=""):
    sql_stmt = """select count(1) from mysql.user where user not in ('%s')""" % (admin_users.replace(",", "','"))
    sql_cmd = """mysql --login-path=tidblogin -NBe "%s" """ % (sql_stmt)
    script_result = os.popen(sql_cmd).read().splitlines()
    print("kv:应用用户数目大于0")
    if len(script_result) > 0 and script_result[0] > 0:
        print('kv:0')
    else:
        print('kv:1')

def main():
    # 读取配置文件,获取管理用户清单
    os_cmd = os.popen('grep -w ^tidb /etc/passwd').read()
    tidb_home = os_cmd.split(':')[5]
    base_path = "%s/scripts/normalcheck" %(tidb_home)
    vars_file = "%s/config/tidb_vars.config" %(base_path)
    with open(vars_file, mode='r') as f:
        for line in f:
            if line.split('=')[0] == "ADMINUSERS":
                ADMINUSERS = line.strip().split('=')[1].replace('"', '')

    #主机名第3位等1的是主集群,等2的是备集群
    HOSTNAME = socket.gethostname()
    if HOSTNAME[2:3] == '1':
        adminusers_grant_dict["repl"] = ["GRANT SELECT ON *.* TO 'repl'@'%'"]

    # 检查应用用户数目
    f_appuser_count_check(ADMINUSERS)

    # 检查应用用户权限
    sql_stmt = """select concat(user,'@''',host,'''') from mysql.user where user not in ('%s')""" % (
        ADMINUSERS.replace(",", "','"))
    # sql_stmt = """select concat(user,'@''',host,'''') from mysql.user"""
    sql_cmd = """mysql --login-path=tidblogin -NBe "%s" """ % (sql_stmt)
    user_lst = os.popen(sql_cmd).read().splitlines()
    for _user in user_lst:
        sql_stmt = """show grants for %s """ % (_user)
        sql_cmd = """mysql --login-path=tidblogin -NBe "%s" """ % (sql_stmt)
        usergrant_lst = os.popen(sql_cmd).read().splitlines()
        f_appuser_grant_check(username=_user, usergrant=usergrant_lst)


if __name__ == '__main__':
    main()