kolab_fix_acl_shared_folders

#!/usr/bin/env bash

################################################################################
## 
## Fix shared mailbox sub-folder ACLs
## 
## Copyright (C) 2015-2024 Michael Roland <mi.roland@gmail.com>
## 
## This program is free software: you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation, either version 3 of the License, or
## (at your option) any later version.
## 
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
## GNU General Public License for more details.
## 
## You should have received a copy of the GNU General Public License
## along with this program.  If not, see <https://www.gnu.org/licenses/>.
## 
################################################################################


SCRIPT_NAME=$(basename $0)
SCRIPT_PATH=$(readlink -f "$(dirname $0)")


. "$SCRIPT_PATH/kolab_config_loader"


usage() {
	echo "Usage: ${SCRIPT_NAME} [options]"
	echo "Fix shared mailbox sub-folder ACLs"
	echo ""
	echo -e "Options:"
	echo -e "\t-h          Show this message"
	echo ""
	echo "Copyright (c) 2015-2024 Michael Roland <mi.roland@gmail.com>"
	echo "License GPLv3+: GNU GPL version 3 or later <https://www.gnu.org/licenses/>"
	echo ""
	echo "This is free software: you can redistribute and/or modify it under the"
	echo "terms of the GPLv3+.  There is NO WARRANTY; not even the implied warranty"
	echo "of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
	echo ""
}

while getopts ":h?:" opt; do
    case "$opt" in
    h|\?)
        if [ ! -z $OPTARG ] ; then
            echo "${SCRIPT_NAME}: invalid option -- $OPTARG" >&2
        fi
        usage
        exit 1
        ;;
    esac
done

shift $((OPTIND-1))
[ "$1" = "--" ] && shift


echo "Scanning shared mailboxes, fixing sub-folder permissions if incorrect ..."
mbxprefix="${IMAP_NAMESPACE_SHARED}${IMAP_HIERARCHY_SEP}"
for mailbox in $(${KOLAB_CMD}list-mailboxes "$mbxprefix%") ; do
    echo "Analyzing $mailbox ..."
    mbxname=$(echo "$mailbox" | sed -n -E 's/^'"$IMAP_NAMESPACE_SHARED"'[\'"$IMAP_HIERARCHY_SEP"'](.*?)(@[^@]*)$/\1/p')
    domain=$(echo "$mailbox" | sed -n -E 's/^'"$IMAP_NAMESPACE_SHARED"'[\'"$IMAP_HIERARCHY_SEP"'](.*?)(@[^@]*)$/\2/p')
    
    parent_acls=$(${KOLAB_CMD}list-mailbox-acls "$mbxprefix$mbxname$domain" | grep -E '^\s+[a-z]+\s+')
    for folder in $(${KOLAB_CMD}list-mailboxes "$mbxprefix$mbxname/*$domain") ; do
        folder_acls=$(${KOLAB_CMD}list-mailbox-acls "$folder" | grep -E '^\s+[a-z]+\s+')
        echo "$parent_acls" | while read parent_acl ; do
            p_perm=$(echo "$parent_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\1/p')
            p_user=$(echo "$parent_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\2/p')
            update_entry=1
            while read folder_acl <&3 ; do
                f_perm=$(echo "$folder_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\1/p')
                f_user=$(echo "$folder_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\2/p')
                if [ "$p_user" == "$f_user" -a "$p_perm" == "$f_perm" ] ; then
                    # Parent ACL entry already exists in current folder ACLs
                    update_entry=0
                    break
                fi
            done 3<<< "$folder_acls"
            if [ $update_entry -ne 0 ] ; then
                echo "Updating ACL for user $p_user on $folder ..."
                ${KOLAB_CMD}set-mailbox-acl "$folder" "$p_user" "$p_perm"
            fi
        done
        folder_acls=$(${KOLAB_CMD}list-mailbox-acls "$folder" | grep -E '^\s+[a-z]+\s+')
        echo "$folder_acls" | while read folder_acl ; do
            f_user=$(echo "$folder_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\2/p')
            remove_entry=1
            while read parent_acl <&3 ; do
                p_user=$(echo "$parent_acl" | sed -n -E 's/^\s*([a-z]+)\s+(.*?)$/\2/p')
                if [ "$p_user" == "$f_user" ] ; then
                    # Folder ACL entry has a corresponding parent ACL entry
                    remove_entry=0
                    break
                fi
            done 3<<< "$parent_acls"
            if [ $remove_entry -ne 0 ] ; then
                echo "Deleting ACL for user $f_user on $folder ..."
                ${KOLAB_CMD}delete-mailbox-acl "$folder" "$f_user"
            fi
        done
    done
done

echo "Done."