# CSV (from EXCEL)
#Group Name,Folder Url,U1,U2,U3,U4,U5,U6,U7,U8,U9,U10,U11,U12
#Food Services,/sites/Policies/ACME1/Food Services,dtlynnf,,,,,,,,,,,
#Lab Services,/sites/Policies/ACME1/Lab Services,lbkathys,issimone,,,,,,,,,,
#Laundry and Linen,/sites/Policies/ACME1/Laundry,lnyvonne,lnkay,,,,,,,,,,

$w = Get-SPWeb http://acmeportal.acme.bm/sites/Policies
$ownerLogin = "acme\pinky"
$csvPath = "C:\temp\20150409\newGroups.csv"

$roleRead = "Read"
$roleContributeNotDelete = "Contribute not Delete"
$roleContribute = "Contribute"

$groupPoliciesVisitors = "Policies Visitors"
$groupPoliciesMembers = "Policies Members"

$grpPoliciesVisitors = $w.SiteGroups[$groupPoliciesVisitors]
if($grpPoliciesVisitors -eq $null){
	throw "Error"
}

$grpPoliciesMembers = $w.SiteGroups[$groupPoliciesMembers]
if($grpPoliciesMembers -eq $null){
	throw "Error"
}

$roleDefRead = $w.RoleDefinitions[$roleRead]
if($roleDefRead -eq $null){
	throw "Error"
}

$roleDefContribute = $w.RoleDefinitions[$roleContribute]
if($roleDefContribute -eq $null){
	throw "Error"
}

$roleDefContributeNotDelete = $w.RoleDefinitions[$roleContributeNotDelete]
if($roleDefContributeNotDelete -eq $null){
	throw "Error"
}


$lists = @( "ACME1", "ACME2")


function createGroups(){
	$recs = Import-Csv -Path $csvPath
	$owner = $w.EnsureUser($ownerLogin)

	foreach($rec in $recs){
		$grName = $rec."Group Name"
		$w.SiteGroups.Add($grName, $owner, $null, '')
		$g = $w.SiteGroups[$grName]
		Write-Host "Created group: $($g.Name)"
		foreach($i in 1..12){
			$memberX = $rec."U$($i)"
			if($memberX -ne $null -and $memberX -ne ""){
				$uu = Get-SPUser -Web $w -Identity "acme\$($memberX)" -ErrorAction SilentlyContinue
				if($uu -ne $null){
					$g.AddUser($uu)
					Write-Host "Added user: $($uu.DisplayName)"
				}
			}
		}
		$g.Update()
	}
}

function addSecurity(){
	$recs = Import-Csv -Path $csvPath
	$owner = $w.EnsureUser($ownerLogin)

	foreach($listName in $lists){
		$l = $w.Lists.TryGetList($listName)
		if($l -ne $null){
			setListSecurity $l
		}
	}

	foreach($rec in $recs){
		$grName = $rec."Group Name"
		$g = $w.SiteGroups[$grName]
		if($g -eq $null){
			write-host "Group `"$($grName)`" does not exist"
		} else {
			write-host "Processing group $($grName)"
			$fldUrl = $rec."Folder Url"
			if($fldUrl -ne $null -and $fldUrl -ne ""){
				$fld = $w.GetFolder($fldUrl)
				if($fld.Exists){
					setFolderSecurity $fld $g
				} else {
					Write-Host $("Folder `"" + $rec."Folder Url" + "`" does not exist")
				}
			} else {
				Write-Host "Folder not specified"
			}
		}
	}
}

function setListSecurity($l){
	$l.BreakRoleInheritance($false)
	$roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grpPoliciesMembers)
	$roleAssigment.RoleDefinitionBindings.Add($roleDefContribute)
	$l.RoleAssignments.Add($roleAssigment)

	$roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grpPoliciesVisitors)
	$roleAssigment.RoleDefinitionBindings.Add($roleDefRead)
	$l.RoleAssignments.Add($roleAssigment)
}

function setFolderSecurity($fld, $grp){
	# add admins
	setFolderSecurityLevel $fld $grpPoliciesMembers $roleDefContribute
	
	# add viewers
	setFolderSecurityLevel $fld $grpPoliciesVisitors $roleDefRead
	
	# add contributor not delete
	setFolderSecurityLevel $fld $grp $roleDefContributeNotDelete

}

function setFolderSecurityLevel($fld, $grp, $permLevel){
	#$fld.ServerRelativeUrl
	#$grp.Name
	#$permLevel.Name
	
	$item = $fld.Item
	if($item -eq $null){
		Write-Host "No item"
	} else {
		$item.BreakRoleInheritance($false)

		$roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grp)
		$roleAssigment.RoleDefinitionBindings.Add($permLevel)
		$item.RoleAssignments.Add($roleAssigment)
	}
}

function cleanSecurity() {
	foreach($listName in $lists){
		$l = $w.Lists.TryGetList($listName)
		if($l -ne $null){
			Write-Host -NoNewline "Processing list $($listName): "
			$l.ResetRoleInheritance()

			$query = new-object  -TypeName "Microsoft.SharePoint.SPQuery"
			$query.ViewAttributes = "Scope=`"RecursiveAll`""
			$items = $l.GetItems($query)

			$c = 0
			foreach($item in $items){
				$c++
				if($item.HasUniqueRoleAssignments){
					$item.ResetRoleInheritance()
					Write-Host -NoNewline "+"
				}
				if(($c % 100) -eq 0){
					Write-Host -NoNewline "."
				}
			}
			Write-Host " done"
		}
	}
}

# run cleanSecurity and then addSecurity