from kallithea.lib.paster_commands.common import ask_ok

from kallithea.model.user import UserModel

from kallithea.model.base import init_model

from kallithea.model.db import User, Permission, Ui, \

    Setting, UserToPerm, RepoGroup, \

    UserRepoGroupToPerm, CacheInvalidation, Repository

from sqlalchemy.engine import create_engine

from kallithea.model.repo_group import RepoGroupModel

#from kallithea.model import meta

from kallithea.model.meta import Session, Base

from kallithea.model.repo import RepoModel

from kallithea.model.permission import PermissionModel

log = logging.getLogger(__name__)

def notify(msg):

    """

    Notification for migrations messages

    """

    ml = len(msg) + (4 * 2)

    print('\n%s\n*** %s ***\n%s' % ('*' * ml, msg, '*' * ml)).upper()

class DbManage(object):

    def __init__(self, log_sql, dbconf, root, tests=False, SESSION=None, cli_args=None):

        self.dbname = dbconf.split('/')[-1]

        self.tests = tests

        self.root = root

        self.dburi = dbconf

        self.log_sql = log_sql

        self.db_exists = False

        self.cli_args = cli_args or {}

        self.init_db(SESSION=SESSION)

    def _ask_ok(self, msg):

        """Invoke ask_ok unless the force_ask option provides the answer"""

        force_ask = self.cli_args.get('force_ask')

        if force_ask is not None:

            return force_ask

        return ask_ok(msg)

    def init_db(self, SESSION=None):

        if SESSION:

            self.sa = SESSION

        else:

            #init new sessions

            engine = create_engine(self.dburi, echo=self.log_sql)

            init_model(engine)

            self.sa = Session()

    def create_tables(self, override=False):

        """

        Create a auth database

        """

        log.info("Any existing database is going to be destroyed")

        if self.tests:

            destroy = True

        else:

            destroy = self._ask_ok('Are you sure to destroy old database ? [y/n]')

        if not destroy:

            print 'Nothing done.'

            sys.exit(0)

        if destroy:

            Base.metadata.drop_all()

        checkfirst = not override

        Base.metadata.create_all(checkfirst=checkfirst)

        # Create an Alembic configuration and generate the version table,

        # "stamping" it with the most recent Alembic migration revision, to

        # tell Alembic that all the schema upgrades are already in effect.

        alembic_cfg = alembic.config.Config()

        alembic_cfg.set_main_option('script_location', 'kallithea:alembic')

        alembic_cfg.set_main_option('sqlalchemy.url', self.dburi)

        # This command will give an error in an Alembic multi-head scenario,

        # but in practice, such a scenario should not come up during database

        # creation, even during development.

        alembic.command.stamp(alembic_cfg, 'head')

        log.info('Created tables for %s', self.dbname)

    def fix_repo_paths(self):

        """

        Fixes a old kallithea version path into new one without a '*'

        """

        paths = self.sa.query(Ui) \

                .filter(Ui.ui_key == '/') \

                .scalar()

        paths.ui_value = paths.ui_value.replace('*', '')

        self.sa.commit()

    def fix_default_user(self):

        """

        Fixes a old default user with some 'nicer' default values,

        used mostly for anonymous access

        """

        def_user = self.sa.query(User).filter_by(is_default_user=True).one()

        def_user.name = 'Anonymous'

        def_user.lastname = 'User'

        def_user.email = 'anonymous@kallithea-scm.org'

        self.sa.commit()

    def fix_settings(self):

        """

        Fixes kallithea settings adds ga_code key for google analytics

        """

        hgsettings3 = Setting('ga_code', '')

        self.sa.add(hgsettings3)

        self.sa.commit()

    def admin_prompt(self, second=False):

        if not self.tests:

            import getpass

            username = self.cli_args.get('username')

            password = self.cli_args.get('password')

            email = self.cli_args.get('email')

            def get_password():

                password = getpass.getpass('Specify admin password '

                                           '(min 6 chars):')

                confirm = getpass.getpass('Confirm password:')

                if password != confirm:

                    log.error('passwords mismatch')

                    return False

                if len(password) < 6:

                    log.error('password is to short use at least 6 characters')

                    return False

                return password

            if username is None:

                username = raw_input('Specify admin username:')

            if password is None:

                password = get_password()

                if not password:

                    #second try

                    password = get_password()

                    if not password:

                        sys.exit()

            if email is None:

                email = raw_input('Specify admin email:')

            self.create_user(username, password, email, True)

        else:

            log.info('creating admin and regular test users')

            from kallithea.tests.base import TEST_USER_ADMIN_LOGIN, \

            TEST_USER_ADMIN_PASS, TEST_USER_ADMIN_EMAIL, \

            TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS, \

            TEST_USER_REGULAR_EMAIL, TEST_USER_REGULAR2_LOGIN, \

            TEST_USER_REGULAR2_PASS, TEST_USER_REGULAR2_EMAIL

            self.create_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS,

                             TEST_USER_ADMIN_EMAIL, True)

            self.create_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS,

                             TEST_USER_REGULAR_EMAIL, False)

            self.create_user(TEST_USER_REGULAR2_LOGIN, TEST_USER_REGULAR2_PASS,

                             TEST_USER_REGULAR2_EMAIL, False)

    def create_ui_settings(self, repo_store_path):

        """

        Creates ui settings, fills out hooks

        """

        #HOOKS

        hooks1_key = Ui.HOOK_UPDATE

        hooks1_ = self.sa.query(Ui) \

            .filter(Ui.ui_key == hooks1_key).scalar()

        hooks1 = Ui() if hooks1_ is None else hooks1_

        hooks1.ui_section = 'hooks'

        hooks1.ui_key = hooks1_key

        hooks1.ui_value = 'hg update >&2'

        hooks1.ui_active = False

        self.sa.add(hooks1)

        hooks2_key = Ui.HOOK_REPO_SIZE

        hooks2_ = self.sa.query(Ui) \

            .filter(Ui.ui_key == hooks2_key).scalar()

        hooks2 = Ui() if hooks2_ is None else hooks2_

        hooks2.ui_section = 'hooks'

        hooks2.ui_key = hooks2_key

        hooks2.ui_value = 'python:kallithea.lib.hooks.repo_size'

        self.sa.add(hooks2)

        hooks3 = Ui()

        hooks3.ui_section = 'hooks'

        hooks3.ui_key = Ui.HOOK_PUSH

        hooks3.ui_value = 'python:kallithea.lib.hooks.log_push_action'

        self.sa.add(hooks3)

        hooks4 = Ui()

        hooks4.ui_section = 'hooks'

        hooks4.ui_key = Ui.HOOK_PRE_PUSH

        hooks4.ui_value = 'python:kallithea.lib.hooks.pre_push'

        self.sa.add(hooks4)

        hooks5 = Ui()

        hooks5.ui_section = 'hooks'

        hooks5.ui_key = Ui.HOOK_PULL

        hooks5.ui_value = 'python:kallithea.lib.hooks.log_pull_action'

        self.sa.add(hooks5)

        hooks6 = Ui()

        hooks6.ui_section = 'hooks'

        hooks6.ui_key = Ui.HOOK_PRE_PULL

        hooks6.ui_value = 'python:kallithea.lib.hooks.pre_pull'

        self.sa.add(hooks6)

        # enable largefiles

        largefiles = Ui()

        largefiles.ui_section = 'extensions'

        largefiles.ui_key = 'largefiles'

        largefiles.ui_value = ''

        self.sa.add(largefiles)

        # set default largefiles cache dir, defaults to

        # /repo location/.cache/largefiles

        largefiles = Ui()

        largefiles.ui_section = 'largefiles'

        largefiles.ui_key = 'usercache'

        largefiles.ui_value = os.path.join(repo_store_path, '.cache',

                                           'largefiles')

        self.sa.add(largefiles)

        # enable hgsubversion disabled by default

        hgsubversion = Ui()

        hgsubversion.ui_section = 'extensions'

        hgsubversion.ui_key = 'hgsubversion'

        hgsubversion.ui_value = ''

        hgsubversion.ui_active = False

        self.sa.add(hgsubversion)

        # enable hggit disabled by default

        hggit = Ui()

        hggit.ui_section = 'extensions'

        hggit.ui_key = 'hggit'

        hggit.ui_value = ''

        hggit.ui_active = False

        self.sa.add(hggit)

    def create_auth_plugin_options(self, skip_existing=False):

        """

        Create default auth plugin settings, and make it active

        :param skip_existing:

        """

        for k, v, t in [('auth_plugins', 'kallithea.lib.auth_modules.auth_internal', 'list'),

                     ('auth_internal_enabled', 'True', 'bool')]:

            if skip_existing and Setting.get_by_name(k) != None:

                log.debug('Skipping option %s', k)

                continue

            setting = Setting(k, v, t)

            self.sa.add(setting)

    def create_default_options(self, skip_existing=False):

        """Creates default settings"""

        for k, v, t in [

            ('default_repo_enable_locking',  False, 'bool'),

            ('default_repo_enable_downloads', False, 'bool'),

            ('default_repo_enable_statistics', False, 'bool'),

            ('default_repo_private', False, 'bool'),

            ('default_repo_type', 'hg', 'unicode')]:

            if skip_existing and Setting.get_by_name(k) is not None:

                log.debug('Skipping option %s', k)

                continue

            setting = Setting(k, v, t)

            self.sa.add(setting)

    def fixup_groups(self):

        def_usr = User.get_default_user()

        for g in RepoGroup.query().all():

            g.group_name = g.get_new_name(g.name)

            # get default perm

            default = UserRepoGroupToPerm.query() \

                .filter(UserRepoGroupToPerm.group == g) \

                .filter(UserRepoGroupToPerm.user == def_usr) \

                .scalar()

            if default is None:

                log.debug('missing default permission for group %s adding', g)

                RepoGroupModel()._create_default_perms(g)

    def reset_permissions(self, username):

        """

        Resets permissions to default state, useful when old systems had

        bad permissions, we must clean them up

        :param username:

        """

        default_user = User.get_by_username(username)

        if not default_user:

            return

        u2p = UserToPerm.query() \

            .filter(UserToPerm.user == default_user).all()

        fixed = False

        if len(u2p) != len(Permission.DEFAULT_USER_PERMISSIONS):

            for p in u2p:

                Session().delete(p)

            fixed = True

            self.populate_default_permissions()

        return fixed

    def update_repo_info(self):

        for repo in Repository.query():

            repo.update_changeset_cache()

    def config_prompt(self, test_repo_path='', retries=3):

        _path = self.cli_args.get('repos_location')

        if retries == 3:

            log.info('Setting up repositories config')

        if _path is not None:

            path = _path

        elif not self.tests and not test_repo_path:

            path = raw_input(

                 'Enter a valid absolute path to store repositories. '

                 'All repositories in that path will be added automatically:'

            )

        else:

            path = test_repo_path

        path_ok = True

        # check proper dir

        if not os.path.isdir(path):

            path_ok = False

            log.error('Given path %s is not a valid directory', path)

        elif not os.path.isabs(path):

            path_ok = False

            log.error('Given path %s is not an absolute path', path)

        # check if path is at least readable.

        if not os.access(path, os.R_OK):

            path_ok = False

            log.error('Given path %s is not readable', path)

        # check write access, warn user about non writeable paths

        elif not os.access(path, os.W_OK) and path_ok:

            log.warning('No write permission to given path %s', path)

            if not self._ask_ok('Given path %s is not writeable, do you want to '

                          'continue with read only mode ? [y/n]' % (path,)):

                log.error('Canceled by user')

                sys.exit(-1)

        if retries == 0:

            sys.exit('max retries reached')

        if not path_ok:

            if _path is not None:

                sys.exit('Invalid repo path: %s' % _path)

            retries -= 1

            return self.config_prompt(test_repo_path, retries) # recursing!!!

        real_path = os.path.normpath(os.path.realpath(path))

        if real_path != os.path.normpath(path):

            log.warning('Using normalized path %s instead of %s', real_path, path)

        return real_path

    def create_settings(self, path):

        self.create_ui_settings(path)

        ui_config = [

            ('web', 'allow_archive', 'gz zip bz2'),

            ('web', 'baseurl', '/'),

            ('paths', '/', path),

        for st in reversed(self.get_statuses(pull_request.org_repo,

                                             pull_request=pull_request,

                                             with_revisions=True)):

            cs_statuses[st.author.username] = st

        # collect votes from official reviewers

        pull_request_reviewers = []

        pull_request_pending_reviewers = []

        relevant_statuses = []

        for user in pull_request.get_reviewer_users():

            st = cs_statuses.get(user.username)

            relevant_statuses.append(st)

            status = ChangesetStatus.STATUS_NOT_REVIEWED if st is None else st.status

            if status in (ChangesetStatus.STATUS_NOT_REVIEWED,

                          ChangesetStatus.STATUS_UNDER_REVIEW):

                pull_request_pending_reviewers.append(user)

            pull_request_reviewers.append((user, status))

        result = self._calculate_status(relevant_statuses)

        return (pull_request_reviewers,

                pull_request_pending_reviewers,

                result)

    def get_statuses(self, repo, revision=None, pull_request=None,

                     with_revisions=False):

        q = self._get_status_query(repo, revision, pull_request,

                                   with_revisions)

        q = q.options(joinedload('author'))

        return q.all()

    def get_status(self, repo, revision=None, pull_request=None, as_str=True):

        """

        Returns latest status of changeset for given revision or for given

        pull request. Statuses are versioned inside a table itself and

        version == 0 is always the current one

        :param repo:

        :param revision: 40char hash or None

        :param pull_request: pull_request reference

        :param as_str: return status as string not object

        """

        q = self._get_status_query(repo, revision, pull_request)

        # need to use first here since there can be multiple statuses

        # returned from pull_request

        status = q.first()

        if as_str:

            return str(status.status) if status else ChangesetStatus.DEFAULT

        return status

    def set_status(self, repo, status, user, comment, revision=None,

                   pull_request=None, dont_allow_on_closed_pull_request=False):

        """

        Creates new status for changeset or updates the old ones bumping their

        version, leaving the current status at the value of 'status'.

        :param repo:

        :param status:

        :param user:

        :param comment:

        :param revision:

        :param pull_request:

        :param dont_allow_on_closed_pull_request: don't allow a status change

            if last status was for pull request and it's closed. We shouldn't

            mess around this manually

        """

        repo = Repository.guess_instance(repo)

        q = ChangesetStatus.query()

        if revision is not None:

            assert pull_request is None

            q = q.filter(ChangesetStatus.repo == repo)

            q = q.filter(ChangesetStatus.revision == revision)

            revisions = [revision]

        else:

            assert pull_request is not None

            pull_request = PullRequest.guess_instance(pull_request)

            repo = pull_request.org_repo

            q = q.filter(ChangesetStatus.repo == repo)

            q = q.filter(ChangesetStatus.revision.in_(pull_request.revisions))

            revisions = pull_request.revisions

        cur_statuses = q.all()

        #if statuses exists and last is associated with a closed pull request

        # we need to check if we can allow this status change

        if (dont_allow_on_closed_pull_request and cur_statuses

            and getattr(cur_statuses[0].pull_request, 'status', '')

                == PullRequest.STATUS_CLOSED):

            raise StatusChangeOnClosedPullRequestError(

                'Changing status on closed pull request is not allowed'

            )

        #update all current statuses with older version

        for st in cur_statuses:

            st.version += 1

        new_statuses = []

        for rev in revisions:

            new_status = ChangesetStatus()

            new_status.version = 0 # default

            new_status.author = User.guess_instance(user)

            new_status.repo = Repository.guess_instance(repo)

            new_status.status = status

            new_status.comment = comment

            new_status.revision = rev

            new_status.pull_request = pull_request

            new_statuses.append(new_status)

            self.sa.add(new_status)

        return new_statuses

from kallithea.lib.utils2 import safe_unicode, safe_int, \

    time_to_datetime, AttributeDict

from kallithea.lib.compat import json

from kallithea.model.base import BaseModel

from kallithea.model.db import Gist, User

from kallithea.model.repo import RepoModel

from kallithea.model.scm import ScmModel

log = logging.getLogger(__name__)

GIST_STORE_LOC = '.rc_gist_store'

GIST_METADATA_FILE = '.rc_gist_metadata'

def make_gist_id():

    """Generate a random, URL safe, almost certainly unique gist identifier."""

    rnd = random.SystemRandom() # use cryptographically secure system PRNG

    alphabet = '23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjklmnpqrstuvwxyz'

    length = 20

    return u''.join(rnd.choice(alphabet) for _ in xrange(length))

class GistModel(BaseModel):

    def __delete_gist(self, gist):

        """

        removes gist from filesystem

        :param gist: gist object

        """

        root_path = RepoModel().repos_path

        rm_path = os.path.join(root_path, GIST_STORE_LOC, gist.gist_access_id)

        log.info("Removing %s", rm_path)

        shutil.rmtree(rm_path)

    def _store_metadata(self, repo, gist_id, gist_access_id, user_id, gist_type,

                        gist_expires):

        """

        store metadata inside the gist, this can be later used for imports

        or gist identification

        """

        metadata = {

            'metadata_version': '1',

            'gist_db_id': gist_id,

            'gist_access_id': gist_access_id,

            'gist_owner_id': user_id,

            'gist_type': gist_type,

            'gist_expires': gist_expires,

            'gist_updated': time.time(),

        }

        with open(os.path.join(repo.path, '.hg', GIST_METADATA_FILE), 'wb') as f:

            f.write(json.dumps(metadata))

    def get_gist(self, gist):

        return Gist.guess_instance(gist)

    def get_gist_files(self, gist_access_id, revision=None):

        """

        Get files for given gist

        :param gist_access_id:

        """

        repo = Gist.get_by_access_id(gist_access_id)

        cs = repo.scm_instance.get_changeset(revision)

        return cs, [n for n in cs.get_node('/')]

    def create(self, description, owner, gist_mapping,

               gist_type=Gist.GIST_PUBLIC, lifetime=-1):

        """

        :param description: description of the gist

        :param owner: user who created this gist

        :param gist_mapping: mapping {filename:{'content':content},...}

        :param gist_type: type of gist private/public

        :param lifetime: in minutes, -1 == forever

        """

        owner = User.guess_instance(owner)

        gist_id = make_gist_id()

        lifetime = safe_int(lifetime, -1)

        gist_expires = time.time() + (lifetime * 60) if lifetime != -1 else -1

        log.debug('set GIST expiration date to: %s',

                  time_to_datetime(gist_expires)

                   if gist_expires != -1 else 'forever')

        #create the Database version

        gist = Gist()

        gist.gist_description = description

        gist.gist_access_id = gist_id

        gist.owner_id = owner.user_id

        gist.gist_expires = gist_expires

        gist.gist_type = safe_unicode(gist_type)

        self.sa.add(gist)

        self.sa.flush() # make database assign gist.gist_id

        if gist_type == Gist.GIST_PUBLIC:

            # use DB ID for easy to use GIST ID

            gist_id = safe_unicode(gist.gist_id)

            gist.gist_access_id = gist_id

        gist_repo_path = os.path.join(GIST_STORE_LOC, gist_id)

        log.debug('Creating new %s GIST repo in %s', gist_type, gist_repo_path)

        repo = RepoModel()._create_filesystem_repo(

            repo_name=gist_id, repo_type='hg', repo_group=GIST_STORE_LOC)

        processed_mapping = {}

        for filename in gist_mapping:

            if filename != os.path.basename(filename):

                raise Exception('Filename cannot be inside a directory')

            content = gist_mapping[filename]['content']

            #TODO: expand support for setting explicit lexers

#             if lexer is None:

#                 try:

#                     guess_lexer = pygments.lexers.guess_lexer_for_filename

#                     lexer = guess_lexer(filename,content)

#                 except pygments.util.ClassNotFound:

#                     lexer = 'text'

            processed_mapping[filename] = {'content': content}

        # now create single multifile commit

        message = 'added file'

        message += 's: ' if len(processed_mapping) > 1 else ': '

        message += ', '.join([x for x in processed_mapping])

        #fake Kallithea Repository object

        fake_repo = AttributeDict(dict(

            repo_name=gist_repo_path,

            scm_instance_no_cache=lambda: repo,

        ))

        ScmModel().create_nodes(

            user=owner.user_id, repo=fake_repo,

            message=message,

            nodes=processed_mapping,

            trigger_push_hook=False

        )

        self._store_metadata(repo, gist.gist_id, gist.gist_access_id,

                             owner.user_id, gist.gist_type, gist.gist_expires)

        return gist

    def delete(self, gist, fs_remove=True):

        gist = Gist.guess_instance(gist)

        try:

            self.sa.delete(gist)

            if fs_remove:

                self.__delete_gist(gist)

            else:

                log.debug('skipping removal from filesystem')

        except Exception:

            log.error(traceback.format_exc())

            raise

    def update(self, gist, description, owner, gist_mapping, gist_type,

               lifetime):

        gist = Gist.guess_instance(gist)

        gist_repo = gist.scm_instance

        lifetime = safe_int(lifetime, -1)

        if lifetime == 0:  # preserve old value

            gist_expires = gist.gist_expires

        else:

            gist_expires = time.time() + (lifetime * 60) if lifetime != -1 else -1

        #calculate operation type based on given data

        gist_mapping_op = {}

        for k, v in gist_mapping.items():

            # add, mod, del

            if not v['org_filename'] and v['filename']:

                op = 'add'

            elif v['org_filename'] and not v['filename']:

                op = 'del'

            else:

                op = 'mod'

            v['op'] = op

            gist_mapping_op[k] = v

        gist.gist_description = description

        gist.gist_expires = gist_expires

        gist.owner = owner

        gist.gist_type = gist_type

        message = 'updated file'

        message += 's: ' if len(gist_mapping) > 1 else ': '

        message += ', '.join([x for x in gist_mapping])

        #fake Kallithea Repository object

        fake_repo = AttributeDict(dict(

            repo_name=gist_repo.path,

            scm_instance_no_cache=lambda: gist_repo,

        ))

        self._store_metadata(gist_repo, gist.gist_id, gist.gist_access_id,

                             owner.user_id, gist.gist_type, gist.gist_expires)

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.model.permission

~~~~~~~~~~~~~~~~~~~~~~~~~~

permissions model for Kallithea

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Aug 20, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import logging

import traceback

from sqlalchemy.exc import DatabaseError

from kallithea.model.base import BaseModel

from kallithea.model.db import User, Permission, UserToPerm, UserRepoToPerm, \

    UserRepoGroupToPerm, UserUserGroupToPerm

from kallithea.lib.utils2 import str2bool

log = logging.getLogger(__name__)

class PermissionModel(BaseModel):

    """

    Permissions model for Kallithea

    """

    def create_permissions(self):

        """

        Create permissions for whole system

        """

        for p in Permission.PERMS:

            if not Permission.get_by_key(p[0]):

                new_perm = Permission()

                new_perm.permission_name = p[0]

                self.sa.add(new_perm)

    def create_default_permissions(self, user, force=False):

        """

        Create missing default permissions for user. If force is set, the default

        permissions for the user are reset, otherwise only missing permissions are

        created.

        :param user:

        """

        user = User.guess_instance(user)

        def _make_perm(perm):

            new_perm = UserToPerm()

            new_perm.user = user

            new_perm.permission = Permission.get_by_key(perm)

            return new_perm

        def _get_group(perm_name):

            return '.'.join(perm_name.split('.')[:1])

        perms = UserToPerm.query().filter(UserToPerm.user == user).all()

        defined_perms_groups = map(_get_group,

                                (x.permission.permission_name for x in perms))

        log.debug('GOT ALREADY DEFINED:%s', perms)

        DEFAULT_PERMS = Permission.DEFAULT_USER_PERMISSIONS

        if force:

            for perm in perms:

                self.sa.delete(perm)

            self.sa.commit()

            defined_perms_groups = []

        # For every default permission that needs to be created, we check if

        # its group is already defined. If it's not, we create default permission.

        for perm_name in DEFAULT_PERMS:

            gr = _get_group(perm_name)

            if gr not in defined_perms_groups:

                log.debug('GR:%s not found, creating permission %s',

                          gr, perm_name)

                new_perm = _make_perm(perm_name)

                self.sa.add(new_perm)

    def update(self, form_result):

        perm_user = User.get_by_username(username=form_result['perm_user_name'])

        try:

            # stage 1 set anonymous access

            if perm_user.is_default_user:

                perm_user.active = str2bool(form_result['anonymous'])

            # stage 2 reset defaults and set them from form data

            def _make_new(usr, perm_name):

                log.debug('Creating new permission:%s', perm_name)

                new = UserToPerm()

                new.user = usr

                new.permission = Permission.get_by_key(perm_name)

                return new

            # clear current entries, to make this function idempotent

            # it will fix even if we define more permissions or permissions

            # are somehow missing

            u2p = self.sa.query(UserToPerm) \

                .filter(UserToPerm.user == perm_user) \

                .all()

            for p in u2p:

                self.sa.delete(p)

            #create fresh set of permissions

            for def_perm_key in ['default_repo_perm',

                                 'default_group_perm',

                                 'default_user_group_perm',

                                 'default_repo_create',

                                 'create_on_write', # special case for create repos on write access to group

                                 #'default_repo_group_create', #not implemented yet

                                 'default_user_group_create',

                                 'default_fork',

                                 'default_register',

                                 'default_extern_activate']:

                p = _make_new(perm_user, form_result[def_perm_key])

                self.sa.add(p)

            #stage 3 update all default permissions for repos if checked

            if form_result['overwrite_default_repo']:

                _def_name = form_result['default_repo_perm'].split('repository.')[-1]

                _def = Permission.get_by_key('repository.' + _def_name)

                # repos

                for r2p in self.sa.query(UserRepoToPerm) \

                               .filter(UserRepoToPerm.user == perm_user) \

                               .all():

                    #don't reset PRIVATE repositories

                    if not r2p.repository.private:

                        r2p.permission = _def

            if form_result['overwrite_default_group']:

                _def_name = form_result['default_group_perm'].split('group.')[-1]

                # groups

                _def = Permission.get_by_key('group.' + _def_name)

                for g2p in self.sa.query(UserRepoGroupToPerm) \

                               .filter(UserRepoGroupToPerm.user == perm_user) \

                               .all():

                    g2p.permission = _def

            if form_result['overwrite_default_user_group']:

                _def_name = form_result['default_user_group_perm'].split('usergroup.')[-1]

                # groups

                _def = Permission.get_by_key('usergroup.' + _def_name)

                for g2p in self.sa.query(UserUserGroupToPerm) \

                               .filter(UserUserGroupToPerm.user == perm_user) \

                               .all():

                    g2p.permission = _def

            self.sa.commit()

        except (DatabaseError,):

            log.error(traceback.format_exc())

            self.sa.rollback()

            raise