db: consistently use the name settings for the return value from get_app_settings

Get rid of yet another old rc reference.

(The "settings" in auth is slightly different, but pretty much the same.)

auth: refactor permissions

Avoid using complex vague typing in dict-of-dicts.

lib: drop own asbool implementation and consistently use tg.support.converters as utils2.asbool

str2bool never reported error on odd input such as '' or '-1', but the tg
asbool behaviour of raising ValueError("String is not true/false: %r" % obj) in
that case seems fine.

auth: don't use json for debug logging

The json formatting is just a source of error - it will for example crash if
there should be bytes anywhere.

user: make get_by_username_or_email default to treat username case insensitive

The get_by_username_or_email is a flexible function, intended to find users in
multiple ways, suitable for login prompts. The function was sometimes used
with case sensitive user lookup, sometimes without. Instead, be consistent and
just default to be insensitive.

py3: use .__func__ instead of .im_func

Based on 2to3 -f methodattrs ... but manually dropping a __func__ because py3 unbound methods *are* the func itself.

auth: drop confusing and layering-violating User.AuthUser property

Keep it simple and just explicitly create an AuthUser if "needed". That can
perhaps be simplified further later on.

auth: move 'active' handling out of the individual auth modules

The 'active' flag in the Kallithea user database is very fundamental and should
not be specific to auth modules. Modules should only care about whether the
user is active in the external authentication system.

user_activation_state is thus removed, and 'hg.extern_activate.auto' is now
consistently checked for all kinds of external authentication.

auth: drop active_from_extern from internal auth API

Modules should never auth a user if the auth source knows the user is inactive.
Also, it is too late and unreliable to disable users when they try to log in.
There is thus no need for this concept.

Only the crowd module had some traces of actual active_from_extern usage. The
'active' flag for crowd users was fully controlled from crowd. Now, Instead,
just let crowd reject authentication of users that are inactive in crowd, and
leave the internal Kallithea 'active' flag under admin control.

codingstyle: trivial whitespace fixes

Reported by flake8.

auth: catch all exceptions while loading auth plugin - not just ImportError

A third party plugin could raise any kind of exception, so we should be
prepared for that.

auth: refactor auth plugin importing

The list of authentication plugins, configured in the database, may contain
plugins which are no longer available. Therefore directly import the plugin in
get_auth_plugins and report the ImportError to the log instead of
breaking kallithea completely.

Patch modified by Mads Kiilerich.

auth: when a auth plugin can't be imported try the next one instead of breaking completly

Some authentication modules depend on external services. This may cause the import
to fail.
Or another scenario is that a (third party) authentication module has been removed
and can't be imported anymore.

db: clean up SQLAlchemy session flushes

Many calls to Session().flush() were completely superfluous and have
been removed. (See also the note on "flush" in the contributor docs.)
For the remaining calls, a comment has been added to explain why it's
necessary.

compat: drop unnecessary wrappers for old Python versions

Made unnecessary by other cleanup or upgrade to Python 2.6+.

auth: cleanup of EXTERN_TYPE_INTERNAL

Don't set it in top level namespace - it is a weak link between the database
and the actual implementation. Don't make it more than that.

Don't hardcode in that many places that 'internal' is the default - just call
it DEFAULT_AUTH_TYPE.

Don't use it for extern_name - it is only intended for use as extern_type.

Remove unused uses.

auth: authenticate using either username or email address

Use User.get_by_username_or_email() in get_user.
In authenticate(), update username if get_user succeeds.

The point of this change is that the web login is a complex thing that
includes, apart the authentication itself, form validation and a bunch of
other things.

This change on its own makes it possible to authenticate a user using its email
address, but that on its own isn't enough for web login or git/hg auth.

cleanup: consistently use 'except ... as ...:'

Use the Python 2.6+ syntax instead of the old confusing 'except ..., ...'
syntax.

cleanup: avoid some 'except Exception' catching - catch specific exceptions or log it and show what happened

This has a risk of introducing regressions ... but we want to get rid of all
exception muting and make the whole system less fragile and easier to debug.

Second step in two-part process to rename directories.
This is the actual directory rename.