#!/bin/bash
# Fix SOGo for mailcow-auth mailboxes (authsource=mailcow), especially new domains.
# Run after: new domain/mailbox, password change in Admin UI, or SOGo Unauthorized.
# Usage: fix-sogo-domain.sh [user@domain.tld]
set -euo pipefail
STACK='/opt/stacks/mailcow'
USER="${1:-admin@gisportal.id}"

echo "== Sync c_password from mailbox (authsource=mailcow) =="
docker exec mailcowdockerized-mysql-mailcow-1 bash -lc '
mysql mailcow -uroot -p"$MYSQL_ROOT_PASSWORD" -e "
UPDATE _sogo_static_view s
INNER JOIN mailbox m ON m.username = s.c_name
SET s.c_password = m.password
WHERE m.authsource = \"mailcow\" AND m.active IN (\"1\",\"2\");
"
'

echo "== Verify: $USER =="
docker exec mailcowdockerized-mysql-mailcow-1 bash -lc "
mysql mailcow -uroot -p\"\$MYSQL_ROOT_PASSWORD\" -N -e \"
SELECT 'mailbox', LEFT(password,55) FROM mailbox WHERE username='${USER}';
SELECT 'sogo', LEFT(c_password,55) FROM _sogo_static_view WHERE c_name='${USER}';
\"
"

echo "== Restart SOGo =="
cd "$STACK"
docker compose restart sogo-mailcow
sleep 8

echo "== SOGo domains =="
docker exec mailcowdockerized-sogo-mailcow-1 grep -E '<key>(geonet|gisportal|gegeo)' /var/lib/sogo/GNUstep/Defaults/sogod.plist || \
  docker exec mailcowdockerized-sogo-mailcow-1 grep '<key>.*\.id</key>' /var/lib/sogo/GNUstep/Defaults/sogod.plist

echo ""
echo "DONE. Login SOGo with Mailcow mailbox password (NOT AD password for authsource=mailcow)."