#!/bin/bash
# Switch support@geonet.co.id from authsource mailcow → ldap
# Inbox/fetchmail unchanged — only IMAP/SMTP login uses AD password
set -euo pipefail

MAILBOX='support@geonet.co.id'
STACK='/opt/stacks/mailcow'
MYSQL_C='mailcowdockerized-mysql-mailcow-1'
DOVECOT_C='mailcowdockerized-dovecot-mailcow-1'
SOGO_C='mailcowdockerized-sogo-mailcow-1'
PHP_C='mailcowdockerized-php-fpm-mailcow-1'

mysql_q() {
  docker exec "$MYSQL_C" bash -lc "mysql mailcow -uroot -p\"\$MYSQL_ROOT_PASSWORD\" -N -e \"$1\""
}

echo "== Pre-check =="
BEFORE=$(mysql_q "SELECT username, active, authsource FROM mailbox WHERE username='${MAILBOX}';")
echo "Mailbox: $BEFORE"
if ! echo "$BEFORE" | grep -q "$MAILBOX"; then
  echo "ERROR: mailbox ${MAILBOX} not found"
  exit 1
fi

echo "== LDAP sync (import/provision) =="
docker exec "$PHP_C" php /crons/ldap-sync.php || true

echo "== Switch authsource to ldap =="
mysql_q "UPDATE mailbox SET authsource='ldap' WHERE username='${MAILBOX}';"
AFTER=$(mysql_q "SELECT username, active, authsource FROM mailbox WHERE username='${MAILBOX}';")
echo "Mailbox after: $AFTER"

echo "== SOGo static view (LDAP user) =="
# LDAP users: clear local password hash in SOGo view; SOGo authenticates via LDAP
docker exec "$MYSQL_C" bash -lc "mysql mailcow -uroot -p\"\$MYSQL_ROOT_PASSWORD\" -e \"
UPDATE _sogo_static_view SET c_password = NULL WHERE c_name = '${MAILBOX}';
\"" || echo "WARN: _sogo_static_view update skipped (table/row may differ)"

echo "== Restart mail services =="
cd "$STACK"
docker compose restart dovecot-mailcow sogo-mailcow

echo "== fetchmail timer =="
systemctl is-active fetchmail-support.timer
docker exec "$DOVECOT_C" doveadm mailbox status -u "$MAILBOX" messages INBOX 2>/dev/null || true

echo ""
echo "DONE. Test IMAP with AD password for ${MAILBOX}"
echo "fetchmail POP3 drain unchanged (cPanel -> same inbox)"