# -*- coding: utf-8 -*-

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.controllers.admin.gists

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gist controller for Kallithea

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: May 9, 2013

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import time

import logging

import traceback

import formencode.htmlfill

from pylons import request, response, tmpl_context as c, url

from pylons.i18n.translation import _

from webob.exc import HTTPFound, HTTPNotFound, HTTPForbidden

from kallithea.model.forms import GistForm

from kallithea.model.gist import GistModel

from kallithea.model.meta import Session

from kallithea.model.db import Gist, User

from kallithea.lib import helpers as h

from kallithea.lib.base import BaseController, render

from kallithea.lib.auth import LoginRequired, NotAnonymous

from kallithea.lib.utils import jsonify

from kallithea.lib.utils2 import safe_int, time_to_datetime

from kallithea.lib.helpers import Page

from sqlalchemy.sql.expression import or_

from kallithea.lib.vcs.exceptions import VCSError, NodeNotChangedError

log = logging.getLogger(__name__)

class GistsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    def __load_defaults(self, extra_values=None):

        c.lifetime_values = [

            (str(-1), _('Forever')),

            (str(5), _('5 minutes')),

            (str(60), _('1 hour')),

            (str(60 * 24), _('1 day')),

            (str(60 * 24 * 30), _('1 month')),

        ]

        if extra_values:

            c.lifetime_values.append(extra_values)

        c.lifetime_options = [(c.lifetime_values, _("Lifetime"))]

    @LoginRequired()

    def index(self):

        """GET /admin/gists: All items in the collection"""

        # url('gists')

        c.show_private = request.GET.get('private') and not_default_user

        c.show_public = request.GET.get('public') and not_default_user

        gists = Gist().query()\

            .filter(or_(Gist.gist_expires == -1, Gist.gist_expires >= time.time()))\

            .order_by(Gist.created_on.desc())

        # MY private

        if c.show_private and not c.show_public:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PRIVATE)\

                             .filter(Gist.gist_owner == c.authuser.user_id)

        # MY public

        elif c.show_public and not c.show_private:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PUBLIC)\

                             .filter(Gist.gist_owner == c.authuser.user_id)

        # MY public+private

        elif c.show_private and c.show_public:

            gists = gists.filter(or_(Gist.gist_type == Gist.GIST_PUBLIC,

                                     Gist.gist_type == Gist.GIST_PRIVATE))\

                             .filter(Gist.gist_owner == c.authuser.user_id)

        # default show ALL public gists

        if not c.show_public and not c.show_private:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PUBLIC)

        c.gists = gists

        p = safe_int(request.GET.get('page', 1), 1)

        c.gists_pager = Page(c.gists, page=p, items_per_page=10)

        return render('admin/gists/index.html')

    @LoginRequired()

    @NotAnonymous()

    def create(self):

        """POST /admin/gists: Create a new item"""

        # url('gists')

        self.__load_defaults()

        gist_form = GistForm([x[0] for x in c.lifetime_values])()

        try:

            form_result = gist_form.to_python(dict(request.POST))

            #TODO: multiple files support, from the form

            filename = form_result['filename'] or Gist.DEFAULT_FILENAME

            nodes = {

                filename: {

                    'content': form_result['content'],

                    'lexer': form_result['mimetype']  # None is autodetect

                }

            }

            _public = form_result['public']

            gist_type = Gist.GIST_PUBLIC if _public else Gist.GIST_PRIVATE

            gist = GistModel().create(

                description=form_result['description'],

                owner=c.authuser.user_id,

                gist_mapping=nodes,

                gist_type=gist_type,

                lifetime=form_result['lifetime']

            )

            Session().commit()

            new_gist_id = gist.gist_access_id

        except formencode.Invalid as errors:

            defaults = errors.value

            return formencode.htmlfill.render(

                render('admin/gists/new.html'),

                defaults=defaults,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8",

                force_defaults=False)

        except Exception as e:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during gist creation'), category='error')

            raise HTTPFound(location=url('new_gist'))

        raise HTTPFound(location=url('gist', gist_id=new_gist_id))

    @LoginRequired()

    @NotAnonymous()

    def new(self, format='html'):

        """GET /admin/gists/new: Form to create a new item"""

        # url('new_gist')

        self.__load_defaults()

        return render('admin/gists/new.html')

    @LoginRequired()

    @NotAnonymous()

    def update(self, gist_id):

        """PUT /admin/gists/gist_id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('gist', gist_id=ID),

        #           method='put')

        # url('gist', gist_id=ID)

    @LoginRequired()

# -*- coding: utf-8 -*-

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.controllers.login

~~~~~~~~~~~~~~~~~~~~~~~~~~~

Login controller for Kallithea

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Apr 22, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import logging

import re

import formencode

from formencode import htmlfill

from pylons.i18n.translation import _

from pylons import request, session, tmpl_context as c, url

from webob.exc import HTTPFound, HTTPBadRequest

import kallithea.lib.helpers as h

from kallithea.lib.auth import AuthUser, HasPermissionAnyDecorator

from kallithea.lib.base import BaseController, log_in_user, render

from kallithea.lib.exceptions import UserCreationError

from kallithea.lib.utils2 import safe_str

from kallithea.model.db import User, Setting

from kallithea.model.forms import \

    LoginForm, RegisterForm, PasswordResetRequestForm, PasswordResetConfirmationForm

from kallithea.model.user import UserModel

from kallithea.model.meta import Session

log = logging.getLogger(__name__)

class LoginController(BaseController):

    def __before__(self):

        super(LoginController, self).__before__()

    def _validate_came_from(self, came_from,

            _re=re.compile(r"/(?!/)[-!#$%&'()*+,./:;=?@_~0-9A-Za-z]*$")):

        """Return True if came_from is valid and can and should be used.

        Determines if a URI reference is valid and relative to the origin;

        or in RFC 3986 terms, whether it matches this production:

          origin-relative-ref = path-absolute [ "?" query ] [ "#" fragment ]

        with the exception that '%' escapes are not validated and '#' is

        allowed inside the fragment part.

        """

        return _re.match(came_from) is not None

    def index(self):

        c.came_from = safe_str(request.GET.get('came_from', ''))

        if c.came_from:

            if not self._validate_came_from(c.came_from):

                log.error('Invalid came_from (not server-relative): %r', c.came_from)

                raise HTTPBadRequest()

        else:

            c.came_from = url('home')

        ip_allowed = AuthUser.check_ip_allowed(self.authuser, self.ip_addr)

        # redirect if already logged in

            raise HTTPFound(location=c.came_from)

        if request.POST:

            # import Login Form validator class

            login_form = LoginForm()

            try:

                c.form_result = login_form.to_python(dict(request.POST))

                # form checks for username/password, now we're authenticated

                username = c.form_result['username']

                user = User.get_by_username(username, case_insensitive=True)

            except formencode.Invalid as errors:

                defaults = errors.value

                # remove password from filling in form again

                del defaults['password']

                return htmlfill.render(

                    render('/login.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

            except UserCreationError as e:

                # container auth or other auth functions that create users on

                # the fly can throw this exception signaling that there's issue

                # with user creation, explanation should be provided in

                # Exception itself

                h.flash(e, 'error')

            else:

                log_in_user(user, c.form_result['remember'],

                    is_external_auth=False)

                raise HTTPFound(location=c.came_from)

        return render('/login.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate',

                               'hg.register.manual_activate')

    def register(self):

        c.auto_active = 'hg.register.auto_activate' in User.get_default_user()\

            .AuthUser.permissions['global']

        settings = Setting.get_app_settings()

        captcha_private_key = settings.get('captcha_private_key')

        c.captcha_active = bool(captcha_private_key)

        c.captcha_public_key = settings.get('captcha_public_key')

        if request.POST:

            register_form = RegisterForm()()

            try:

                form_result = register_form.to_python(dict(request.POST))

                form_result['active'] = c.auto_active

                if c.captcha_active:

                    from kallithea.lib.recaptcha import submit

                    response = submit(request.POST.get('recaptcha_challenge_field'),

                                      request.POST.get('recaptcha_response_field'),

                                      private_key=captcha_private_key,

                                      remoteip=self.ip_addr)

                    if c.captcha_active and not response.is_valid:

                        _value = form_result

                        _msg = _('Bad captcha')

                        error_dict = {'recaptcha_field': _msg}

                        raise formencode.Invalid(_msg, _value, None,

                                                 error_dict=error_dict)

                UserModel().create_registration(form_result)

                h.flash(_('You have successfully registered into Kallithea'),

                        category='success')

                Session().commit()

                raise HTTPFound(location=url('login_home'))

            except formencode.Invalid as errors:

                return htmlfill.render(

                    render('/register.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

            except UserCreationError as e:

                # container auth or other auth functions that create users on

                # the fly can throw this exception signaling that there's issue

                # with user creation, explanation should be provided in

                # Exception itself

                h.flash(e, 'error')

        return render('/register.html')

    def password_reset(self):

        settings = Setting.get_app_settings()

        captcha_private_key = settings.get('captcha_private_key')

        c.captcha_active = bool(captcha_private_key)

        c.captcha_public_key = settings.get('captcha_public_key')

        if request.POST:

            password_reset_form = PasswordResetRequestForm()()

            try:

Original author and date, and relevant copyright and licensing information is below:

:created_on: Apr 18, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import traceback

import calendar

import logging

from time import mktime

from datetime import timedelta, date

from pylons import tmpl_context as c, request

from pylons.i18n.translation import _

from webob.exc import HTTPBadRequest

from beaker.cache import cache_region, region_invalidate

from kallithea.lib.compat import product

from kallithea.lib.vcs.exceptions import ChangesetError, EmptyRepositoryError, \

    NodeDoesNotExistError

from kallithea.config.conf import ALL_READMES, ALL_EXTS, LANGUAGES_EXTENSIONS_MAP

from kallithea.model.db import Statistics, CacheInvalidation, User

from kallithea.lib.utils import jsonify

from kallithea.lib.utils2 import safe_str

from kallithea.lib.auth import LoginRequired, HasRepoPermissionAnyDecorator,\

    NotAnonymous

from kallithea.lib.base import BaseRepoController, render

from kallithea.lib.vcs.backends.base import EmptyChangeset

from kallithea.lib.markup_renderer import MarkupRenderer

from kallithea.lib.celerylib import run_task

from kallithea.lib.celerylib.tasks import get_commits_stats

from kallithea.lib.compat import json

from kallithea.lib.vcs.nodes import FileNode

from kallithea.controllers.changelog import _load_changelog_summary

log = logging.getLogger(__name__)

README_FILES = [''.join([x[0][0], x[1][0]]) for x in

                    sorted(list(product(ALL_READMES, ALL_EXTS)),

                           key=lambda y:y[0][1] + y[1][1])]

class SummaryController(BaseRepoController):

    def __before__(self):

        super(SummaryController, self).__before__()

    def __get_readme_data(self, db_repo):

        repo_name = db_repo.repo_name

        log.debug('Looking for README file')

        @cache_region('long_term')

        def _get_readme_from_cache(key, kind):

            readme_data = None

            readme_file = None

            try:

                # gets the landing revision! or tip if fails

                cs = db_repo.get_landing_changeset()

                if isinstance(cs, EmptyChangeset):

                    raise EmptyRepositoryError()

                renderer = MarkupRenderer()

                for f in README_FILES:

                    try:

                        readme = cs.get_node(f)

                        if not isinstance(readme, FileNode):

                            continue

                        readme_file = f

                        log.debug('Found README file `%s` rendering...',

                                  readme_file)

                        readme_data = renderer.render(readme.content,

                                                      filename=f)

                        break

                    except NodeDoesNotExistError:

                        continue

            except ChangesetError:

                log.error(traceback.format_exc())

                pass

            except EmptyRepositoryError:

                pass

            return readme_data, readme_file

        kind = 'README'

        valid = CacheInvalidation.test_and_set_valid(repo_name, kind)

        if not valid:

            region_invalidate(_get_readme_from_cache, None, repo_name, kind)

        return _get_readme_from_cache(repo_name, kind)

    @LoginRequired()

    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

                                   'repository.admin')

    def index(self, repo_name):

        _load_changelog_summary()

            username = safe_str(self.authuser.username)

        _def_clone_uri = _def_clone_uri_by_id = c.clone_uri_tmpl

        if '{repo}' in _def_clone_uri:

            _def_clone_uri_by_id = _def_clone_uri.replace('{repo}', '_{repoid}')

        elif '{repoid}' in _def_clone_uri:

            _def_clone_uri_by_id = _def_clone_uri.replace('_{repoid}', '{repo}')

        c.clone_repo_url = c.db_repo.clone_url(user=username,

                                                uri_tmpl=_def_clone_uri)

        c.clone_repo_url_id = c.db_repo.clone_url(user=username,

                                                uri_tmpl=_def_clone_uri_by_id)

        if c.db_repo.enable_statistics:

            c.show_stats = True

        else:

            c.show_stats = False

        stats = self.sa.query(Statistics)\

            .filter(Statistics.repository == c.db_repo)\

            .scalar()

        c.stats_percentage = 0

        if stats and stats.languages:

            c.no_data = False is c.db_repo.enable_statistics

            lang_stats_d = json.loads(stats.languages)

            lang_stats = ((x, {"count": y,

                               "desc": LANGUAGES_EXTENSIONS_MAP.get(x)})

                          for x, y in lang_stats_d.items())

            c.trending_languages = json.dumps(

                sorted(lang_stats, reverse=True, key=lambda k: k[1])[:10]

            )

        else:

            c.no_data = True

            c.trending_languages = json.dumps([])

        c.enable_downloads = c.db_repo.enable_downloads

        c.readme_data, c.readme_file = \

            self.__get_readme_data(c.db_repo)

        return render('summary/summary.html')

    @LoginRequired()

    @NotAnonymous()

    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

                                   'repository.admin')

    @jsonify

    def repo_size(self, repo_name):

        if request.is_xhr:

            return c.db_repo._repo_size()

        else:

            raise HTTPBadRequest()

    @LoginRequired()

    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

                                   'repository.admin')

    def statistics(self, repo_name):

        if c.db_repo.enable_statistics:

            c.show_stats = True

            c.no_data_msg = _('No data ready yet')

        else:

            c.show_stats = False

            c.no_data_msg = _('Statistics are disabled for this repository')

        td = date.today() + timedelta(days=1)

        td_1m = td - timedelta(days=calendar.mdays[td.month])

        td_1y = td - timedelta(days=365)

        ts_min_m = mktime(td_1m.timetuple())

        ts_min_y = mktime(td_1y.timetuple())

        ts_max_y = mktime(td.timetuple())

        c.ts_min = ts_min_m

        c.ts_max = ts_max_y

        stats = self.sa.query(Statistics)\

            .filter(Statistics.repository == c.db_repo)\

            .scalar()

        c.stats_percentage = 0

        if stats and stats.languages:

            c.no_data = False is c.db_repo.enable_statistics

            lang_stats_d = json.loads(stats.languages)

            c.commit_data = stats.commit_activity

            c.overview_data = stats.commit_activity_combined

            lang_stats = ((x, {"count": y,

                               "desc": LANGUAGES_EXTENSIONS_MAP.get(x)})

                          for x, y in lang_stats_d.items())

            c.trending_languages = json.dumps(

                sorted(lang_stats, reverse=True, key=lambda k: k[1])[:10]

            )

            last_rev = stats.stat_on_revision + 1

            c.repo_last_rev = c.db_repo_scm_instance.count()\

                if c.db_repo_scm_instance.revisions else 0

        if multiple_counter[g_k] > 1:

            p = _choose_perm(p, cur_perm)

        permissions[UK][g_k] = p

    #user explicit permission for user groups

    user_user_groups_perms = Permission.get_default_user_group_perms(user_id)

    for perm in user_user_groups_perms:

        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

        p = perm.Permission.permission_name

        cur_perm = permissions[UK][u_k]

        if not explicit:

            p = _choose_perm(p, cur_perm)

        permissions[UK][u_k] = p

    return permissions

def allowed_api_access(controller_name, whitelist=None, api_key=None):

    """

    Check if given controller_name is in whitelist API access

    """

    if not whitelist:

        from kallithea import CONFIG

        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

                           sep=',')

        log.debug('whitelist of API access is: %s', whitelist)

    api_access_valid = controller_name in whitelist

    if api_access_valid:

        log.debug('controller:%s is in API whitelist', controller_name)

    else:

        msg = 'controller: %s is *NOT* in API whitelist' % (controller_name)

        if api_key:

            #if we use API key and don't have access it's a warning

            log.warning(msg)

        else:

            log.debug(msg)

    return api_access_valid

class AuthUser(object):

    """

    Represents a Kallithea user, including various authentication and

    authorization information. Typically used to store the current user,

    but is also used as a generic user information data structure in

    parts of the code, e.g. user management.

    Constructed from a database `User` object, a user ID or cookie dict,

    it looks up the user (if needed) and copies all attributes to itself,

    adding various non-persistent data. If lookup fails but anonymous

    access to Kallithea is enabled, the default user is loaded instead.

    `AuthUser` does not by itself authenticate users and the constructor

    sets the `is_authenticated` field to False, except when falling back

    to the default anonymous user (if enabled). It's up to other parts

    of the code to check e.g. if a supplied password is correct, and if

    so, set `is_authenticated` to True.

    However, `AuthUser` does refuse to load a user that is not `active`.

    """

    def __init__(self, user_id=None, dbuser=None,

            is_external_auth=False):

        self.is_authenticated = False

        self.is_external_auth = is_external_auth

        user_model = UserModel()

        self.anonymous_user = User.get_default_user(cache=True)

        # These attributes will be overriden by fill_data, below, unless the

        # requested user cannot be found and the default anonymous user is

        # not enabled.

        self.user_id = None

        self.username = None

        self.api_key = None

        self.name = ''

        self.lastname = ''

        self.email = ''

        self.admin = False

        self.inherit_default_permissions = False

        # Look up database user, if necessary.

        if user_id is not None:

            log.debug('Auth User lookup by USER ID %s', user_id)

            dbuser = user_model.get(user_id)

        else:

            # Note: dbuser is allowed to be None.

            log.debug('Auth User lookup by database user %s', dbuser)

        is_user_loaded = self._fill_data(dbuser)

        # If user cannot be found, try falling back to anonymous.

        if not is_user_loaded:

            is_user_loaded =  self._fill_data(self.anonymous_user)

        # The anonymous user is always "logged in".

            self.is_authenticated = True

        if not self.username:

            self.username = 'None'

        log.debug('Auth User is now %s', self)

    def _fill_data(self, dbuser):

        """

        Copies database fields from a `db.User` to this `AuthUser`. Does

        not copy `api_keys` and `permissions` attributes.

        Checks that `dbuser` is `active` (and not None) before copying;

        returns True on success.

        """

        if dbuser is not None and dbuser.active:

            log.debug('filling %s data', dbuser)

            for k, v in dbuser.get_dict().iteritems():

                assert k not in ['api_keys', 'permissions']

                setattr(self, k, v)

            return True

        return False

    @LazyProperty

    def permissions(self):

        return self.__get_perms(user=self, cache=False)

    @property

    def api_keys(self):

        return self._get_api_keys()

    def __get_perms(self, user, explicit=True, algo='higherwin', cache=False):

        """

        Fills user permission attribute with permissions taken from database

        works for permissions given for repositories, and for permissions that

        are granted to groups

        :param user: `AuthUser` instance

        :param explicit: In case there are permissions both for user and a group

            that user is part of, explicit flag will define if user will

            explicitly override permissions from group, if it's False it will

            make decision based on the algo

        :param algo: algorithm to decide what permission should be choose if

            it's multiple defined, eg user in two different groups. It also

            decides if explicit flag is turned off how to specify the permission

            for case when user is in a group + have defined separate permission

        """

        user_id = user.user_id

        user_is_admin = user.is_admin

        user_inherit_default_permissions = user.inherit_default_permissions

        log.debug('Getting PERMISSION tree')

        compute = conditional_cache('short_term', 'cache_desc',

                                    condition=cache, func=_cached_perms_data)

        return compute(user_id, user_is_admin,

                       user_inherit_default_permissions, explicit, algo)

    def _get_api_keys(self):

        api_keys = [self.api_key]

        for api_key in UserApiKeys.query()\

                .filter(UserApiKeys.user_id == self.user_id)\

                .filter(or_(UserApiKeys.expires == -1,

                            UserApiKeys.expires >= time.time())).all():

            api_keys.append(api_key.api_key)

        return api_keys

    @property

    def is_admin(self):

        return self.admin

    @property

    def repositories_admin(self):

        """

        Returns list of repositories you're an admin of

        """

        return [x[0] for x in self.permissions['repositories'].iteritems()

                if x[1] == 'repository.admin']

    @property

    def repository_groups_admin(self):

        """

        Returns list of repository groups you're an admin of

        """

        return [x[0] for x in self.permissions['repositories_groups'].iteritems()

                if x[1] == 'group.admin']

    @property

    def user_groups_admin(self):

        """

        Returns list of user groups you're an admin of

        """

        return [x[0] for x in self.permissions['user_groups'].iteritems()

                if x[1] == 'usergroup.admin']

    @staticmethod

    def check_ip_allowed(user, ip_addr):

        """

        Check if the given IP address (a `str`) is allowed for the given

        user (an `AuthUser` or `db.User`).

        """

        allowed_ips = AuthUser.get_allowed_ips(user.user_id, cache=True,

            inherit_from_default=user.inherit_default_permissions)

        if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):

            log.debug('IP:%s is in range of %s', ip_addr, allowed_ips)

            return True

        else:

            log.info('Access for IP:%s forbidden, '

                     'not in %s' % (ip_addr, allowed_ips))

            return False

    def __repr__(self):

        return "<AuthUser('id:%s[%s] auth:%s')>"\

            % (self.user_id, self.username, self.is_authenticated)

    def set_authenticated(self, authenticated=True):

            self.is_authenticated = authenticated

    def to_cookie(self):

        """ Serializes this login session to a cookie `dict`. """

        return {

            'user_id': self.user_id,

            'is_authenticated': self.is_authenticated,

            'is_external_auth': self.is_external_auth,

        }

    @staticmethod

    def from_cookie(cookie):

        """

        Deserializes an `AuthUser` from a cookie `dict`.

        """

        au = AuthUser(

            user_id=cookie.get('user_id'),

            is_external_auth=cookie.get('is_external_auth', False),

        )

        if not au.is_authenticated and au.user_id is not None:

            # user is not authenticated and not empty

            au.set_authenticated(cookie.get('is_authenticated'))

        return au

    @classmethod

    def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):

        _set = set()

        if inherit_from_default:

            default_ips = UserIpMap.query().filter(UserIpMap.user ==

                                            User.get_default_user(cache=True))

            if cache:

                default_ips = default_ips.options(FromCache("sql_cache_short",

                                                  "get_user_ips_default"))

            # populate from default user

            for ip in default_ips:

                try:

                    _set.add(ip.ip_addr)

                except ObjectDeletedError:

                    # since we use heavy caching sometimes it happens that we get

                    # deleted objects here, we just skip them

                    pass

        user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)

        if cache:

            user_ips = user_ips.options(FromCache("sql_cache_short",

                                                  "get_user_ips_%s" % user_id))

        for ip in user_ips:

            try:

                _set.add(ip.ip_addr)

            except ObjectDeletedError:

                # since we use heavy caching sometimes it happens that we get

                # deleted objects here, we just skip them

                pass

        return _set or set(['0.0.0.0/0', '::/0'])

def set_available_permissions(config):

    """

    This function will propagate pylons globals with all available defined

    permission given in db. We don't want to check each time from db for new

    permissions since adding a new permission also requires application restart

    ie. to decorate new views with the newly created permission

    :param config: current pylons config instance

    """

    log.info('getting information about all available permissions')

    try:

        sa = meta.Session

        all_perms = sa.query(Permission).all()

        config['available_permissions'] = [x.permission_name for x in all_perms]

    finally:

        meta.Session.remove()

#==============================================================================

# CHECK DECORATORS

#==============================================================================

def redirect_to_login(message=None):

    from kallithea.lib import helpers as h

    p = request.path_qs

    if message:

        h.flash(h.literal(message), category='warning')

    log.debug('Redirecting to login page, origin: %s', p)

    raise HTTPFound(location=url('login_home', came_from=p))

class LoginRequired(object):

    """

    Must be logged in to execute this function else

    redirect to login page

    :param api_access: if enabled this checks only for valid auth token