# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.lib.auth

~~~~~~~~~~~~~~~~~~

authentication and permission libraries

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Apr 4, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import time

import os

import logging

import traceback

import hashlib

import itertools

import collections

from decorator import decorator

from pylons import url, request, session

from pylons.i18n.translation import _

from webhelpers.pylonslib import secure_form

from sqlalchemy import or_

from sqlalchemy.orm.exc import ObjectDeletedError

from sqlalchemy.orm import joinedload

from webob.exc import HTTPFound, HTTPBadRequest, HTTPForbidden, HTTPMethodNotAllowed

from kallithea import __platform__, is_windows, is_unix

from kallithea.lib.vcs.utils.lazy import LazyProperty

from kallithea.model import meta

from kallithea.model.meta import Session

from kallithea.model.user import UserModel

from kallithea.model.db import User, Repository, Permission, \

    UserToPerm, UserGroupRepoToPerm, UserGroupToPerm, UserGroupMember, \

    RepoGroup, UserGroupRepoGroupToPerm, UserIpMap, UserGroupUserGroupToPerm, \

    UserGroup, UserApiKeys

from kallithea.lib.utils import get_repo_slug, get_repo_group_slug, \

    get_user_group_slug, conditional_cache

from kallithea.lib.caching_query import FromCache

log = logging.getLogger(__name__)

class PasswordGenerator(object):

    """

    This is a simple class for generating password from different sets of

    characters

    usage::

        passwd_gen = PasswordGenerator()

        #print 8-letter password containing only big and small letters

            of alphabet

        passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)

    """

    ALPHABETS_NUM = r'''1234567890'''

    ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''

    ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''

    ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''

    ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \

        + ALPHABETS_NUM + ALPHABETS_SPECIAL

    ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM

    ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL

    ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM

    ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM

    def gen_password(self, length, alphabet=ALPHABETS_FULL):

        assert len(alphabet) <= 256, alphabet

        l = []

        while len(l) < length:

            i = ord(os.urandom(1))

            if i < len(alphabet):

                l.append(alphabet[i])

        return ''.join(l)

class KallitheaCrypto(object):

    @classmethod

    def hash_string(cls, str_):

        """

        Cryptographic function used for password hashing based on pybcrypt

        or Python's own OpenSSL wrapper on windows

        :param password: password to hash

        """

        if is_windows:

            return hashlib.sha256(str_).hexdigest()

        elif is_unix:

            import bcrypt

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

    @classmethod

    def hash_check(cls, password, hashed):

        """

        Checks matching password with it's hashed value, runs different

        implementation based on platform it runs on

        :param password: password

        :param hashed: password in hashed form

        """

        if is_windows:

            return hashlib.sha256(password).hexdigest() == hashed

        elif is_unix:

            import bcrypt

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

def get_crypt_password(password):

    return KallitheaCrypto.hash_string(password)

def check_password(password, hashed):

    return KallitheaCrypto.hash_check(password, hashed)

def _cached_perms_data(user_id, user_is_admin, user_inherit_default_permissions,

                       explicit, algo):

    RK = 'repositories'

    GK = 'repositories_groups'

    UK = 'user_groups'

    GLOBAL = 'global'

    PERM_WEIGHTS = Permission.PERM_WEIGHTS

    permissions = {RK: {}, GK: {}, UK: {}, GLOBAL: set()}

    def _choose_perm(new_perm, cur_perm):

        new_perm_val = PERM_WEIGHTS[new_perm]

        cur_perm_val = PERM_WEIGHTS[cur_perm]

        if algo == 'higherwin':

            if new_perm_val > cur_perm_val:

                return new_perm

            return cur_perm

        elif algo == 'lowerwin':

            if new_perm_val < cur_perm_val:

                return new_perm

            return cur_perm

    #======================================================================

    # fetch default permissions

    #======================================================================

    default_user = User.get_by_username('default', cache=True)

    default_user_id = default_user.user_id

    default_repo_perms = Permission.get_default_perms(default_user_id)

    default_repo_groups_perms = Permission.get_default_group_perms(default_user_id)

    default_user_group_perms = Permission.get_default_user_group_perms(default_user_id)

    if user_is_admin:

        #==================================================================

        # admin users have all rights;

        return callback_handler(eval(matches.groups()[0]))

_meta = open(os.path.join(here, 'kallithea', '__init__.py'), 'rb')

_metadata = _meta.read()

_meta.close()

callback = lambda V: ('.'.join(map(str, V[:3])) + '.'.join(V[3:]))

__version__ = _get_meta_var('VERSION', _metadata, callback)

__license__ = _get_meta_var('__license__', _metadata)

__author__ = _get_meta_var('__author__', _metadata)

__url__ = _get_meta_var('__url__', _metadata)

# defines current platform

__platform__ = platform.system()

is_windows = __platform__ in ['Windows']

requirements = [

    "waitress==0.8.8",

    "webob>=1.0.8,<=1.1.1",

    "webtest==1.4.3",

    "Pylons>=1.0.0,<=1.0.2",

    "Beaker==1.6.4",

    "WebHelpers==1.3",

    "formencode>=1.2.4,<=1.2.6",

    "SQLAlchemy>=0.7.10,<1.1",

    "Mako>=0.9.0,<=1.0.0",

    "pygments>=1.5",

    "whoosh>=2.4.0,<=2.5.7",

    "celery>=2.2.5,<2.3",

    "babel>=0.9.6,<=1.3",

    "python-dateutil>=1.5.0,<2.0.0",

    "markdown==2.2.1",

    "docutils>=0.8.1,<=0.11",

    "mock",

    "URLObject==2.3.4",

    "Routes==1.13",

    "pytest>=2.7.0,<3.0",

    "pytest-sugar>=0.7.0,<1.0.0",

    "dulwich>=0.9.9,<=0.9.9",

    "mercurial>=2.9,<3.9",

]

if sys.version_info < (2, 7):

    requirements.append("importlib==1.0.1")

    requirements.append("unittest2")

    requirements.append("argparse")

if not is_windows:

dependency_links = [

]

classifiers = [

    'Development Status :: 4 - Beta',

    'Environment :: Web Environment',

    'Framework :: Pylons',

    'Intended Audience :: Developers',

    'License :: OSI Approved :: GNU General Public License (GPL)',

    'Operating System :: OS Independent',

    'Programming Language :: Python',

    'Programming Language :: Python :: 2.6',

    'Programming Language :: Python :: 2.7',

    'Topic :: Software Development :: Version Control',

]

# additional files from project that goes somewhere in the filesystem

# relative to sys.prefix

data_files = []

description = ('Kallithea is a fast and powerful management tool '

               'for Mercurial and Git with a built in push/pull server, '

               'full text search and code-review.')

keywords = ' '.join([

    'kallithea', 'mercurial', 'git', 'code review',

    'repo groups', 'ldap', 'repository management', 'hgweb replacement',

    'hgwebdir', 'gitweb replacement', 'serving hgweb',

])

# long description

README_FILE = 'README.rst'

CHANGELOG_FILE = 'docs/changelog.rst'

try:

    long_description = open(README_FILE).read() + '\n\n' + \

        open(CHANGELOG_FILE).read()

except IOError as err:

    sys.stderr.write(

        "[WARNING] Cannot find file specified as long_description (%s)\n or "

        "changelog (%s) skipping that file" % (README_FILE, CHANGELOG_FILE)

    )

    long_description = description

try: