use clap::Subcommand;
use strum::Display;

use crate::cli::OutputFormat;

#[derive(Subcommand, Clone, Display, Eq, PartialEq)]
pub enum AclCommand {
    /// find obects with Generic All ACEs
    GA {
        /// Output format
        #[clap(value_enum, short('F'), long("format"), default_value_t = OutputFormat::Csv)]
        format: OutputFormat,

        /// include the distinguished name (DN) in the output.
        ///
        /// Note that this
        /// property is not an attribute of the AD entry iself; instead it is
        /// constructed from the relative DN (RDN) of the entry and
        /// all of its parents. That's why this property is normally not shown.
        #[clap(short('D'), long("include-dn"))]
        include_dn: bool,
    },

    /// This options find all objects with CONTROL_ACCESS, but
    /// without object GUID
    ///
    /// If the ObjectType field does not contain a GUID, the ACE is deemed to
    /// control the right to perform all operations associated with the objects
    /// that are controlled by control access rights
    AllCr {
        /// Output format
        #[clap(value_enum, short('F'), long("format"), default_value_t = OutputFormat::Csv)]
        format: OutputFormat,

        /// include the distinguished name (DN) in the output.
        ///
        /// Note that this
        /// property is not an attribute of the AD entry iself; instead it is
        /// constructed from the relative DN (RDN) of the entry and
        /// all of its parents. That's why this property is normally not shown.
        #[clap(short('D'), long("include-dn"))]
        include_dn: bool,
    },

    /// Find all objects with the DCSync right (DS-Replication-Get-Changes-In-Filtered-Set)
    DCSync {
        /// Output format
        #[clap(value_enum, short('F'), long("format"), default_value_t = OutputFormat::Csv)]
        format: OutputFormat,

        /// include the distinguished name (DN) in the output.
        ///
        /// Note that this
        /// property is not an attribute of the AD entry iself; instead it is
        /// constructed from the relative DN (RDN) of the entry and
        /// all of its parents. That's why this property is normally not shown.
        #[clap(short('D'), long("include-dn"))]
        include_dn: bool,
    },

    /// analyze extended rights
    ExtendedRights {
        #[clap(subcommand)]
        command: crate::cli::extended_rights::command::Command
    },
    
    /// Show hidden objects (objects which deny the “Everyone” principal
    /// (SID: S-1-1-0) RIGHT_READ_CONTROL)
    Hidden {
        /// Output format
        #[clap(value_enum, short('F'), long("format"), default_value_t = OutputFormat::Csv)]
        format: OutputFormat,

        /// include the distinguished name (DN) in the output.
        ///
        /// Note that this
        /// property is not an attribute of the AD entry iself; instead it is
        /// constructed from the relative DN (RDN) of the entry and
        /// all of its parents. That's why this property is normally not shown.
        #[clap(short('D'), long("include-dn"))]
        include_dn: bool,
    },
}
