From 58a94b5938a2ad5e17428d718aadd4475e284923 Mon Sep 17 00:00:00 2001
From: abrown38 <a.brown@epcc.ed.ac.uk>
Date: Fri, 6 Sep 2024 10:49:51 +0100
Subject: [PATCH] project create for protected zone

---
 .../win_domain_controller/tasks/setup.yml     | 11 +++++-
 ansible/roles/win_study/tasks/permissions.yml | 37 +++++++++++++++++--
 ansible/roles/win_study/vars/main.yml         |  3 ++
 ansible/vars/common.yml                       |  1 +
 4 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml
index 0ae1c10..829d206 100644
--- a/ansible/roles/win_domain_controller/tasks/setup.yml
+++ b/ansible/roles/win_domain_controller/tasks/setup.yml
@@ -105,7 +105,7 @@
         protected: true
       loop: "{{ OUs }}"
 
-    - name: Create file-transfer user for
+    - name: Create file-transfer user
       community.windows.win_domain_user:
         name: "{{ filetransfer_user }}"
         firstname: File
@@ -113,6 +113,15 @@
         password: "{{ transfer_user_password }}"
         state: present
         password_never_expires: yes
+        
+    - name: Create file-manager user
+      community.windows.win_domain_user:
+        name: "{{ filemanager_user }}"
+        firstname: File
+        surname: Manager
+        password: "{{ file_manager_password }}"
+        state: present
+        password_never_expires: yes
   when: inventory_hostname in groups['meta-name_dc01']
 
 
diff --git a/ansible/roles/win_study/tasks/permissions.yml b/ansible/roles/win_study/tasks/permissions.yml
index 89aa887..67e04b1 100644
--- a/ansible/roles/win_study/tasks/permissions.yml
+++ b/ansible/roles/win_study/tasks/permissions.yml
@@ -9,13 +9,24 @@
         type: allow
         user: "{{ study_code }}"
         rights: Read,Write,Modify,Delete
-      loop: ["{{ study_folder }}", "{{ study_folder }}\\export"]
+      loop: "{{ s_drive_folders }}"
+      retries: 10
+      delay: 10
+
+    - name: Add file-manager permissions to study folders
+      win_acl:
+        path: "{{ item }}"
+        state: present
+        type: allow
+        user: "{{ filemanager_user }}"
+        rights: 'FullControl'
+      loop: "{{ s_drive_folders }}"
       retries: 10
       delay: 10
 
     - name: Add file-transfer user permissions to study folder
       win_acl:
-        path: '{{ study_folder }}\export'
+        path: "{{ study_folder }}\\export"
         state: present
         type: allow
         user: file-transfer
@@ -48,4 +59,24 @@
             type: allow
             user: "Users"
             rights: "FullControl"
-          loop: ["present", "absent"]
\ No newline at end of file
+          loop: ["present", "absent"]
+
+    - name: Protected Zone Tasks
+      tags: protected_permissions
+      block:
+        - name: Add exporter group permissions to study folder
+          win_acl:
+            path: "{{ study_folder }}\\export"
+            state: present
+            type: allow
+            user: "{{ exporter_group }}"
+            rights: Read,Write,Modify,Delete
+
+        - name: Remove study group permissions export folder
+          win_acl:
+            path: "{{ study_folder }}\\export"
+            state: absent
+            type: allow
+            user: "{{ study_code }}"
+            rights: Read,Write,Modify,Delete
+      when: project_zone == 'protected'
\ No newline at end of file
diff --git a/ansible/roles/win_study/vars/main.yml b/ansible/roles/win_study/vars/main.yml
index cb0a177..e12b482 100644
--- a/ansible/roles/win_study/vars/main.yml
+++ b/ansible/roles/win_study/vars/main.yml
@@ -1,3 +1,6 @@
 study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
+export_folder: "{{ study_folder }}\\export"
+import_folder: "{{ study_folder }}\\import"
 archive_folder: "{{ studydata_drive_letter }}:\\Archived_Studies"
 exporter_group: "{{ study_code }}-exporter"
+s_drive_folders: ["{{ study_folder }}", "{{ export_folder }}", "{{ import_folder }}"]
diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml
index 582ac68..3f5d1e1 100644
--- a/ansible/vars/common.yml
+++ b/ansible/vars/common.yml
@@ -16,6 +16,7 @@ user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d
 gpu_flavor: 3661211f-673a-4777-8857-fd243d6c407d # CHANGE THIS
 
 filetransfer_user: file-transfer
+filemanager_user: file-manager
 
 standard_vms:
   - { name: "{{ os_project }}-{{ win_project }}-dc01", security_group: "domain_controller", meta_name: dc01 }