vmis/backend/app/services/scheduler/schedule_account.py

"""
Schedule 2 — 帳號檢查（每 3 分鐘）
檢查每個 active 帳號的: SSO使用者 / Mailbox / NC使用者 / Quota
"""
import logging
from datetime import datetime
from app.core.utils import now_tw
from sqlalchemy.orm import Session

from app.models.account import Account
from app.models.result import AccountScheduleResult

logger = logging.getLogger(__name__)


def run_account_check(schedule_log_id: int, db: Session):
    from app.services.mail_client import MailClient
    from app.services.nextcloud_client import NextcloudClient

    from app.services.keycloak_client import get_keycloak_client

    accounts = (
        db.query(Account)
        .filter(Account.is_active == True)
        .all()
    )
    kc = get_keycloak_client()
    mail = MailClient()

    for account in accounts:
        tenant = account.tenant
        realm = tenant.keycloak_realm or tenant.code
        result = AccountScheduleResult(
            schedule_log_id=schedule_log_id,
            account_id=account.id,
            sso_account=account.sso_account,
            recorded_at=now_tw(),
        )
        fail_reasons = []

        # [1] SSO user check
        try:
            sso_uuid = kc.get_user_uuid(realm, account.sso_account)
            if sso_uuid:
                result.sso_result = True
                result.sso_uuid = sso_uuid
                if not account.sso_uuid:
                    account.sso_uuid = sso_uuid
            else:
                kc_email = account.notification_email or account.email
                sso_uuid = kc.create_user(realm, account.sso_account, kc_email, account.default_password)
                result.sso_result = sso_uuid is not None
                result.sso_uuid = sso_uuid
                if sso_uuid and not account.sso_uuid:
                    account.sso_uuid = sso_uuid
                    # 新使用者：寄送歡迎信（含設定密碼連結）
                    if account.notification_email:
                        kc.send_welcome_email(realm, sso_uuid)
            result.sso_done_at = now_tw()
        except Exception as e:
            result.sso_result = False
            result.sso_done_at = now_tw()
            fail_reasons.append(f"sso: {e}")

        # [2] Mailbox check (skip if mail domain not ready)
        try:
            email = account.email or f"{account.sso_account}@{tenant.domain}"
            mb_exists = mail.mailbox_exists(email)
            if mb_exists:
                result.mailbox_result = True
            else:
                created = mail.create_mailbox(email, account.default_password, account.quota_limit)
                result.mailbox_result = created
            result.mailbox_done_at = now_tw()
        except Exception as e:
            result.mailbox_result = False
            result.mailbox_done_at = now_tw()
            fail_reasons.append(f"mailbox: {e}")

        # [3] NC user check
        try:
            from app.core.config import settings as _cfg
            nc = NextcloudClient(tenant.domain, _cfg.NC_ADMIN_USER, _cfg.NC_ADMIN_PASSWORD)
            nc_exists = nc.user_exists(account.sso_account)
            if nc_exists:
                result.nc_result = True
            else:
                created = nc.create_user(account.sso_account, account.default_password, account.quota_limit)
                result.nc_result = created
            # 確保 quota 設定正確（無論新建或已存在）
            if result.nc_result and account.quota_limit:
                nc.set_user_quota(account.sso_account, account.quota_limit)
            result.nc_done_at = now_tw()
        except Exception as e:
            result.nc_result = False
            result.nc_done_at = now_tw()
            fail_reasons.append(f"nc: {e}")

        # [3.5] NC 台灣國定假日行事曆訂閱
        # 前置條件：NC 帳號已存在；MKCALENDAR 為 idempotent（已存在回傳 405 視為成功）
        TW_HOLIDAYS_ICS_URL = "https://www.officeholidays.com/ics-clean/taiwan"
        if result.nc_result:
            try:
                cal_ok = nc.subscribe_calendar(
                    account.sso_account,
                    "taiwan-public-holidays",
                    "台灣國定假日",
                    TW_HOLIDAYS_ICS_URL,
                    "#e9322d",
                )
                if cal_ok:
                    logger.info(f"NC calendar subscribed [{account.sso_account}]: taiwan-public-holidays")
                else:
                    logger.warning(f"NC calendar subscribe failed [{account.sso_account}]")
            except Exception as e:
                logger.warning(f"NC calendar subscribe error [{account.sso_account}]: {e}")

        # [4] NC Mail 帳號設定
        # 前置條件：NC 帳號已建立 + mailbox 已建立
        try:
            if result.nc_result and result.mailbox_result:
                import paramiko
                from app.core.config import settings as _cfg
                is_active = tenant.status == "active"
                nc_container = f"nc-{tenant.code}" if is_active else f"nc-{tenant.code}-test"
                email = account.email or f"{account.sso_account}@{tenant.domain}"

                ssh = paramiko.SSHClient()
                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
                ssh.connect(_cfg.DOCKER_SSH_HOST, username=_cfg.DOCKER_SSH_USER, timeout=15)

                def _ssh_run(cmd, timeout=60):
                    """執行 SSH 指令並回傳輸出，超時返回空字串"""
                    _, stdout, _ = ssh.exec_command(cmd)
                    stdout.channel.settimeout(timeout)
                    try:
                        out = stdout.read().decode().strip()
                    except Exception:
                        out = ""
                    return out

                # 確認是否已設定（occ mail:account:export 回傳帳號列表）
                export_out = _ssh_run(
                    f"docker exec -u www-data {nc_container} "
                    f"php /var/www/html/occ mail:account:export {account.sso_account} 2>/dev/null"
                )
                already_set = len(export_out) > 10 and "imap" in export_out.lower()

                if already_set:
                    result.nc_mail_result = True
                else:
                    display = account.legal_name or account.sso_account
                    create_cmd = (
                        f"docker exec -u www-data {nc_container} "
                        f"php /var/www/html/occ mail:account:create "
                        f"'{account.sso_account}' '{display}' '{email}' "
                        f"10.1.0.254 143 none '{email}' '{account.default_password}' "
                        f"10.1.0.254 587 none '{email}' '{account.default_password}' 2>&1"
                    )
                    out_text = _ssh_run(create_cmd)
                    logger.info(f"NC mail:account:create [{account.sso_account}]: {out_text}")
                    result.nc_mail_result = (
                        "error" not in out_text.lower() and "exception" not in out_text.lower()
                    )

                ssh.close()
            else:
                result.nc_mail_result = False
                fail_reasons.append(
                    f"nc_mail: skipped (nc={result.nc_result}, mailbox={result.mailbox_result})"
                )
            result.nc_mail_done_at = now_tw()
        except Exception as e:
            result.nc_mail_result = False
            result.nc_mail_done_at = now_tw()
            fail_reasons.append(f"nc_mail: {e}")

        # [5] Quota
        try:
            nc = NextcloudClient(tenant.domain, _cfg.NC_ADMIN_USER, _cfg.NC_ADMIN_PASSWORD)
            result.quota_usage = nc.get_user_quota_used_gb(account.sso_account)
        except Exception as e:
            logger.warning(f"Quota check failed for {account.account_code}: {e}")

        if fail_reasons:
            result.fail_reason = "; ".join(fail_reasons)

        db.add(result)

    db.commit()
    db.flush()
    logger.info(f"Account check done: {len(accounts)} accounts processed")