<!--
  ~ Copyright (c) 2010-2023 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" oid="8098b124-c20c-4965-8adf-e528abedf7a4">
    <name>User Template</name>
    <mapping>
        <description>
          This mapping will remove assignments with grouper-grouper subtype for all users who don't have account linked on Grouper resource.
          This is addressing the situation when a user account on Grouper resource is deleted and therefore is not logner synchronized.
          Also, this will clean up all grouper-group assignments that shouldn't exist. We want such assignments exist only if they exists in Grouper resource.
        </description>
        <strength>strong</strength>
        <expression>
            <script>
                <code>
                  return null
                </code>
            </script>
        </expression>
        <target>
            <path>assignment</path>
            <set>
                <condition>
                    <script>
                        <code>
                           //FIXME replace XXX with OID of Grouper resource
                           if(!midpoint.hasLinkedAccount('XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX')) {
                             return assignment?.subtype?.contains('grouper-group')
                           } else {
                              return false
                           }
                        </code>
                    </script>
                </condition>
            </set>
        </target>
    </mapping>
</objectTemplate>
