import sys
import json
import os
from ldap3 import Server, Connection, SUBTREE
from ldap3.utils.conv import escape_filter_chars

username = os.environ.get("username", "").strip()
password = os.environ.get("password", "")

if not username or not password:
    sys.exit(1)

LDAP_URL     = "ldap://127.0.0.1"
LDAP_PORT    = 389
BASE_DN      = "ou=users,dc=zakobar,dc=com"
RO_DN        = "cn=readonly,dc=zakobar,dc=com"
RO_PASS_FILE = "/run/secrets/ldap-ro-password"

try:
    with open(RO_PASS_FILE) as f:
        ro_password = f.read().strip()
    if not ro_password:
        sys.exit(1)

    server = Server(LDAP_URL, port=LDAP_PORT)

    # Step 1: search-bind as readonly to find user DN + display name
    ro_conn = Connection(server, user=RO_DN, password=ro_password)
    if not ro_conn.bind():
        sys.exit(1)

    ro_conn.search(
        BASE_DN,
        f"(uid={escape_filter_chars(username)})",
        search_scope=SUBTREE,
        attributes=["cn", "uid"],
    )

    if not ro_conn.entries:
        sys.exit(1)

    user_dn      = ro_conn.entries[0].entry_dn
    display_name = str(ro_conn.entries[0].cn)
    ro_conn.unbind()

    # Step 2: bind as user to verify password
    user_conn = Connection(server, user=user_dn, password=password)
    if not user_conn.bind():
        sys.exit(1)
    user_conn.unbind()

    print(json.dumps({"name": display_name}))
    sys.exit(0)

except Exception:
    sys.exit(1)