SharePoint: read security setting from CSV and apply them

# CSV (from EXCEL)
#Group Name,Folder Url,U1,U2,U3,U4,U5,U6,U7,U8,U9,U10,U11,U12
#Food Services,/sites/Policies/ACME1/Food Services,dtlynnf,,,,,,,,,,,
#Lab Services,/sites/Policies/ACME1/Lab Services,lbkathys,issimone,,,,,,,,,,
#Laundry and Linen,/sites/Policies/ACME1/Laundry,lnyvonne,lnkay,,,,,,,,,,

$w = Get-SPWeb http://acmeportal.acme.bm/sites/Policies
$ownerLogin = "acme\pinky"
$csvPath = "C:\temp\20150409\newGroups.csv"

$roleRead = "Read"
$roleContributeNotDelete = "Contribute not Delete"
$roleContribute = "Contribute"

$groupPoliciesVisitors = "Policies Visitors"
$groupPoliciesMembers = "Policies Members"

$grpPoliciesVisitors = $w.SiteGroups[$groupPoliciesVisitors]
if($grpPoliciesVisitors -eq $null){
    throw "Error"
}

$grpPoliciesMembers = $w.SiteGroups[$groupPoliciesMembers]
if($grpPoliciesMembers -eq $null){
    throw "Error"
}

$roleDefRead = $w.RoleDefinitions[$roleRead]
if($roleDefRead -eq $null){
    throw "Error"
}

$roleDefContribute = $w.RoleDefinitions[$roleContribute]
if($roleDefContribute -eq $null){
    throw "Error"
}

$roleDefContributeNotDelete = $w.RoleDefinitions[$roleContributeNotDelete]
if($roleDefContributeNotDelete -eq $null){
    throw "Error"
}


$lists = @( "ACME1", "ACME2")


function createGroups(){
    $recs = Import-Csv -Path $csvPath
    $owner = $w.EnsureUser($ownerLogin)

    foreach($rec in $recs){
        $grName = $rec."Group Name"
        $w.SiteGroups.Add($grName, $owner, $null, '')
        $g = $w.SiteGroups[$grName]
        Write-Host "Created group: $($g.Name)"
        foreach($i in 1..12){
            $memberX = $rec."U$($i)"
            if($memberX -ne $null -and $memberX -ne ""){
                $uu = Get-SPUser -Web $w -Identity "acme\$($memberX)" -ErrorAction SilentlyContinue
                if($uu -ne $null){
                    $g.AddUser($uu)
                    Write-Host "Added user: $($uu.DisplayName)"
                }
            }
        }
        $g.Update()
    }
}

function addSecurity(){
    $recs = Import-Csv -Path $csvPath
    $owner = $w.EnsureUser($ownerLogin)

    foreach($listName in $lists){
        $l = $w.Lists.TryGetList($listName)
        if($l -ne $null){
            setListSecurity $l
        }
    }

    foreach($rec in $recs){
        $grName = $rec."Group Name"
        $g = $w.SiteGroups[$grName]
        if($g -eq $null){
            write-host "Group `"$($grName)`" does not exist"
        } else {
            write-host "Processing group $($grName)"
            $fldUrl = $rec."Folder Url"
            if($fldUrl -ne $null -and $fldUrl -ne ""){
                $fld = $w.GetFolder($fldUrl)
                if($fld.Exists){
                    setFolderSecurity $fld $g
                } else {
                    Write-Host $("Folder `"" + $rec."Folder Url" + "`" does not exist")
                }
            } else {
                Write-Host "Folder not specified"
            }
        }
    }
}

function setListSecurity($l){
    $l.BreakRoleInheritance($false)
    $roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grpPoliciesMembers)
    $roleAssigment.RoleDefinitionBindings.Add($roleDefContribute)
    $l.RoleAssignments.Add($roleAssigment)

    $roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grpPoliciesVisitors)
    $roleAssigment.RoleDefinitionBindings.Add($roleDefRead)
    $l.RoleAssignments.Add($roleAssigment)
}

function setFolderSecurity($fld, $grp){
    # add admins
    setFolderSecurityLevel $fld $grpPoliciesMembers $roleDefContribute

    # add viewers
    setFolderSecurityLevel $fld $grpPoliciesVisitors $roleDefRead

    # add contributor not delete
    setFolderSecurityLevel $fld $grp $roleDefContributeNotDelete

}

function setFolderSecurityLevel($fld, $grp, $permLevel){
    #$fld.ServerRelativeUrl
    #$grp.Name
    #$permLevel.Name

    $item = $fld.Item
    if($item -eq $null){
        Write-Host "No item"
    } else {
        $item.BreakRoleInheritance($false)

        $roleAssigment = new-object Microsoft.SharePoint.SPRoleAssignment($grp)
        $roleAssigment.RoleDefinitionBindings.Add($permLevel)
        $item.RoleAssignments.Add($roleAssigment)
    }
}

function cleanSecurity() {
    foreach($listName in $lists){
        $l = $w.Lists.TryGetList($listName)
        if($l -ne $null){
            Write-Host -NoNewline "Processing list $($listName): "
            $l.ResetRoleInheritance()

            $query = new-object  -TypeName "Microsoft.SharePoint.SPQuery"
            $query.ViewAttributes = "Scope=`"RecursiveAll`""
            $items = $l.GetItems($query)

            $c = 0
            foreach($item in $items){
                $c++
                if($item.HasUniqueRoleAssignments){
                    $item.ResetRoleInheritance()
                    Write-Host -NoNewline "+"
                }
                if(($c % 100) -eq 0){
                    Write-Host -NoNewline "."
                }
            }
            Write-Host " done"
        }
    }
}

# run cleanSecurity and then addSecurity