{ config, pkgs, lib, ... }:

{

  home-manager.users.${config.user} = lib.mkIf pkgs.stdenv.isDarwin {

    home.packages = let
      ldap_scheme = "ldaps";
      ldap_host = "take2.t2.corp";
      ldap_port = "636";
      ldap_script = pkgs.writeShellScriptBin "ldap" ''
        SEARCH_FILTER="$@"
        ldapsearch -LLL \
            -B -o ldif-wrap=no \
            -H "${ldap_scheme}://${ldap_host}:${ldap_port}" \
            -D "TAKE2\\${pkgs.lib.toLower config.user}" \
            -w "$(${pkgs._1password}/bin/op item get T2 --fields label=password)" \
            -b "DC=take2,DC=t2,DC=corp" \
            -s "sub" -x "(cn=$SEARCH_FILTER)" \
            | jq --slurp \
                --raw-input 'split("\n\n")|map(split("\n")|map(select(.[0:1]!="#" and length>0)) |select(length > 0)|map(capture("^(?<key>[^:]*:?): *(?<value>.*)") |if .key[-1:.key|length] == ":" then .key=.key[0:-1]|.value=(.value|@base64d) else . end)| group_by(.key) | map({key:.[0].key,value:(if .|length > 1 then [.[].value] else .[].value end)}) | from_entries)' | jq -r 'del(.[].thumbnailPhoto)'
      '';
      ldapm_script = pkgs.writeShellScriptBin "ldapm" ''
        ${ldap_script}/bin/ldap "$@" | jq -r '.[0].memberOf'
      '';
      ldapg_script = pkgs.writeShellScriptBin "ldapg" ''
        ${ldap_script}/bin/ldap "$@" | jq -r '.[0].members'
      '';
    in [ ldap_script ldapm_script ldapg_script ];

  };

}