<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2026 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<task xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3"
        xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3"
        oid="d06d59f4-4f42-4d0b-9b7b-121110000001">
    <name>Migrate plaintext password hints</name>
    <description>Encrypts legacy plaintext user password hints by rewriting only credentials/password/hint.</description>

    <assignment>
        <targetRef oid="00000000-0000-0000-0000-000000000509"
                relation="org:default"
                type="c:ArchetypeType"/>
    </assignment>

    <ownerRef oid="00000000-0000-0000-0000-000000000002"
            relation="org:default"
            type="c:UserType"/>
    <executionState>suspended</executionState>
    <schedule>
        <recurrence>single</recurrence>
    </schedule>

    <activity>
        <work>
            <iterativeScripting>
                <objects>
                    <type>UserType</type>
                </objects>
                <scriptExecutionRequest>
                    <s:execute>
                        <s:script>
                            <code><![CDATA[
                                import com.evolveum.midpoint.model.api.ModelExecuteOptions
                                import com.evolveum.midpoint.xml.ns._public.common.common_3.*
                                import com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType

                                def user = input as UserType
                                def hint = user.credentials?.password?.hint
                                def clearHint = hint?.clearValue

                                if (clearHint == null || clearHint.isEmpty()) {
                                    return
                                }

                                def replacement = new ProtectedStringType()
                                replacement.setClearValue(clearHint)

                                def delta = midpoint.deltaFor(UserType.class)
                                        .item(UserType.F_CREDENTIALS, CredentialsType.F_PASSWORD, PasswordType.F_HINT)
                                        .replace(replacement)
                                        .asObjectDelta(user.oid)

                                midpoint.modifyObject(delta, ModelExecuteOptions.create().raw())
                            ]]></code>
                        </s:script>
                    </s:execute>
                </scriptExecutionRequest>
            </iterativeScripting>
        </work>
    </activity>
</task>
