if salt is None:

        salt = _RandomNameSequence().next()

    return hashlib.sha1(username + salt).hexdigest()

def authfunc(environ, username, password):

    """Dummy authentication function used in Mercurial/Git/ and access control,

    :param environ: needed only for using in Basic auth

    """

    return authenticate(username, password)

def authenticate(username, password):

    """Authentication function used for access control,

    firstly checks for db authentication then if ldap is enabled for ldap

    authentication, also creates ldap user if not in database

    :param username: username

    :param password: password

    """

    user_model = UserModel()

    user = User.get_by_username(username)

    log.debug('Authenticating user using RhodeCode account')

    if user is not None and not user.ldap_dn:

        if user.active:

            if user.username == 'default' and user.active:

                log.info('user %s authenticated correctly as anonymous user',

                         username)

                return True

            elif user.username == username and check_password(password,

                                                              user.password):

                log.info('user %s authenticated correctly', username)

                return True

        else:

            log.warning('user %s is disabled', username)

    else:

        log.debug('Regular authentication failed')

        user_obj = User.get_by_username(username, case_insensitive=True)

        if user_obj is not None and not user_obj.ldap_dn:

            log.debug('this user already exists as non ldap')

            return False

        ldap_settings = RhodeCodeSettings.get_ldap_settings()

        #======================================================================

        # FALLBACK TO LDAP AUTH IF ENABLE

        #======================================================================

        if str2bool(ldap_settings.get('ldap_active')):

            log.debug("Authenticating user using ldap")

            kwargs = {

                  'server': ldap_settings.get('ldap_host', ''),

                  'base_dn': ldap_settings.get('ldap_base_dn', ''),

                  'port': ldap_settings.get('ldap_port'),

                  'bind_dn': ldap_settings.get('ldap_dn_user'),

                  'bind_pass': ldap_settings.get('ldap_dn_pass'),

                  'tls_kind': ldap_settings.get('ldap_tls_kind'),

                  'tls_reqcert': ldap_settings.get('ldap_tls_reqcert'),

                  'ldap_filter': ldap_settings.get('ldap_filter'),

                  'search_scope': ldap_settings.get('ldap_search_scope'),

                  'attr_login': ldap_settings.get('ldap_attr_login'),

                  'ldap_version': 3,

                  }

            log.debug('Checking for ldap authentication')

            try:

                aldap = AuthLdap(**kwargs)

                (user_dn, ldap_attrs) = aldap.authenticate_ldap(username,

                                                                password)

                log.debug('Got ldap DN response %s', user_dn)

                get_ldap_attr = lambda k: ldap_attrs.get(ldap_settings\

                                                           .get(k), [''])[0]

                user_attrs = {

                 'name': safe_unicode(get_ldap_attr('ldap_attr_firstname')),

                 'lastname': safe_unicode(get_ldap_attr('ldap_attr_lastname')),

                 'email': get_ldap_attr('ldap_attr_email'),

                }

                if user_model.create_ldap(username, password, user_dn,

                                          user_attrs):

                    log.info('created new ldap user %s', username)

                return True

            except (LdapUsernameError, LdapPasswordError,):

                pass

            except (Exception,):

                log.error(traceback.format_exc())

                pass

    return False

def get_container_username(environ, cfg=config):

    from paste.httpheaders import REMOTE_USER

    from paste.deploy.converters import asbool

    username = REMOTE_USER(environ)

    if not username and asbool(cfg.get('proxypass_auth_enabled', False)):

        username = environ.get('HTTP_X_FORWARDED_USER')

    if username:

        #Removing realm and domain from username

        username = username.partition('@')[0]

        username = username.rpartition('\\')[2]

        log.debug('Received username %s from container', username)

    return username

class  AuthUser(object):

    """

    A simple object that handles all attributes of user in RhodeCode

    It does lookup based on API key,given user, or user present in session

    Then it fills all required information for such user. It also checks if

    anonymous access is enabled and if so, it returns default user as logged

    in

    """

    def __init__(self, user_id=None, api_key=None, username=None):

        self.user_id = user_id

        self.api_key = None

        self.username = username

        self.name = ''

        self.lastname = ''

        self.email = ''

        self.is_authenticated = False

        self.admin = False

        self.permissions = {}

        self._api_key = api_key

        self.propagate_data()

    def propagate_data(self):

        user_model = UserModel()

        self.anonymous_user = User.get_by_username('default')

        is_user_loaded = False

        if self._api_key and self._api_key != self.anonymous_user.api_key:

            #try go get user by api key

            log.debug('Auth User lookup by API KEY %s', self._api_key)

            is_user_loaded = user_model.fill_data(self, api_key=self._api_key)

        elif self.user_id is not None \

            and self.user_id != self.anonymous_user.user_id:

            log.debug('Auth User lookup by USER ID %s', self.user_id)

            is_user_loaded = user_model.fill_data(self, user_id=self.user_id)

        elif self.username:

            log.debug('Auth User lookup by USER NAME %s', self.username)

                for k, v in dbuser.get_dict().items():

                    setattr(self, k, v)

                self.set_authenticated()

                is_user_loaded = True

        if not is_user_loaded:

            if self.anonymous_user.active is True:

                user_model.fill_data(self,

                                     user_id=self.anonymous_user.user_id)

                #then we set this user is logged in

                self.is_authenticated = True

            else:

                self.user_id = None

                self.username = None

                self.is_authenticated = False

        if not self.username:

            self.username = 'None'

        log.debug('Auth User is now %s', self)

        user_model.fill_perms(self)

    @property

    def is_admin(self):

        return self.admin

    @property

    def full_contact(self):

        return '%s %s <%s>' % (self.name, self.lastname, self.email)

    def __repr__(self):

        return "<AuthUser('id:%s:%s|%s')>" % (self.user_id, self.username,

                                              self.is_authenticated)

    def set_authenticated(self, authenticated=True):

        if self.user_id != self.anonymous_user.user_id:

            self.is_authenticated = authenticated

def set_available_permissions(config):

    """This function will propagate pylons globals with all available defined

    permission given in db. We don't want to check each time from db for new

    permissions since adding a new permission also requires application restart

    ie. to decorate new views with the newly created permission

    :param config: current pylons config instance

    """

    log.info('getting information about all available permissions')

    try:

        sa = meta.Session()

        all_perms = sa.query(Permission).all()

    except:

        pass

    finally:

        meta.Session.remove()

    config['available_permissions'] = [x.permission_name for x in all_perms]

#==============================================================================

# CHECK DECORATORS

#==============================================================================

class LoginRequired(object):

    """

    Must be logged in to execute this function else

    redirect to login page

    :param api_access: if enabled this checks only for valid auth token

        and grants access based on valid token

    """

    def __init__(self, api_access=False):

        self.api_access = api_access

    def __call__(self, func):

        return decorator(self.__wrapper, func)

    def __wrapper(self, func, *fargs, **fkwargs):

        cls = fargs[0]

        user = cls.rhodecode_user

        api_access_ok = False

        if self.api_access:

            log.debug('Checking API KEY access for %s', cls)

            if user.api_key == request.GET.get('api_key'):

                api_access_ok = True

            else:

                log.debug("API KEY token not valid")

        log.debug('Checking if %s is authenticated @ %s', user.username, cls)

        if user.is_authenticated or api_access_ok:

            log.debug('user %s is authenticated', user.username)

            return func(*fargs, **fkwargs)

        else:

            log.warn('user %s NOT authenticated', user.username)

            p = url.current()

            log.debug('redirecting to login page with %s', p)

            '<a class="show_more" id="_%s" href="#more">%s</a> '

            '%s</span>')

            if not feed:

                cs_links.append(html_tmpl % (_('and'), uniq_id, _('%s more') \

                                        % (len(revs) - revs_limit),

                                        _('revisions')))

            if not feed:

                html_tmpl = '<span id="%s" style="display:none"> %s </span>'

            else:

                html_tmpl = '<span id="%s"> %s </span>'

            cs_links.append(html_tmpl % (uniq_id, ', '.join([link_to(rev,

                url('changeset_home',

                repo_name=repo_name, revision=rev),

                title=message(rev), class_='tooltip')

                for rev in revs[revs_limit:revs_top_limit]])))

        if len(revs) > 1:

            cs_links.append(compare_view)

        return ''.join(cs_links)

    def get_fork_name():

        repo_name = action_params

        return _('fork name ') + str(link_to(action_params, url('summary_home',

                                          repo_name=repo_name,)))

    action_map = {'user_deleted_repo':(_('[deleted] repository'), None),

           'user_created_repo':(_('[created] repository'), None),

           'user_forked_repo':(_('[forked] repository'), get_fork_name),

           'user_updated_repo':(_('[updated] repository'), None),

           'admin_deleted_repo':(_('[delete] repository'), None),

           'admin_created_repo':(_('[created] repository'), None),

           'admin_forked_repo':(_('[forked] repository'), None),

           'admin_updated_repo':(_('[updated] repository'), None),

           'push':(_('[pushed] into'), get_cs_links),

           'push_local':(_('[committed via RhodeCode] into'), get_cs_links),

           'push_remote':(_('[pulled from remote] into'), get_cs_links),

           'pull':(_('[pulled] from'), None),

           'started_following_repo':(_('[started following] repository'), None),

           'stopped_following_repo':(_('[stopped following] repository'), None),

            }

    action_str = action_map.get(action, action)

    if feed:

        action = action_str[0].replace('[', '').replace(']', '')

    else:

        action = action_str[0].replace('[', '<span class="journal_highlight">')\

                   .replace(']', '</span>')

    action_params_func = lambda :""

    if callable(action_str[1]):

        action_params_func = action_str[1]

    return [literal(action), action_params_func]

def action_parser_icon(user_log):

    action = user_log.action

    action_params = None

    x = action.split(':')

    if len(x) > 1:

        action, action_params = x

    tmpl = """<img src="%s%s" alt="%s"/>"""

    map = {'user_deleted_repo':'database_delete.png',

           'user_created_repo':'database_add.png',

           'user_forked_repo':'arrow_divide.png',

           'user_updated_repo':'database_edit.png',

           'admin_deleted_repo':'database_delete.png',

           'admin_created_repo':'database_add.png',

           'admin_forked_repo':'arrow_divide.png',

           'admin_updated_repo':'database_edit.png',

           'push':'script_add.png',

           'push_local':'script_edit.png',

           'push_remote':'connect.png',

           'pull':'down_16.png',

           'started_following_repo':'heart_add.png',

           'stopped_following_repo':'heart_delete.png',

            }

    return literal(tmpl % ((url('/images/icons/')),

                           map.get(action, action), action))

#==============================================================================

# PERMS

#==============================================================================

from rhodecode.lib.auth import HasPermissionAny, HasPermissionAll, \

HasRepoPermissionAny, HasRepoPermissionAll

#==============================================================================

# GRAVATAR URL

#==============================================================================

def gravatar_url(email_address, size=30):

    if not str2bool(config['app_conf'].get('use_gravatar')) or \

        email_address == 'anonymous@rhodecode.org':

        return url("/images/user%s.png" % size)

    ssl_enabled = 'https' == request.environ.get('wsgi.url_scheme')

    default = 'identicon'

    baseurl_nossl = "http://www.gravatar.com/avatar/"

    baseurl_ssl = "https://secure.gravatar.com/avatar/"

    baseurl = baseurl_ssl if ssl_enabled else baseurl_nossl

    if isinstance(email_address, unicode):

        #hashlib crashes on unicode items

        email_address = safe_str(email_address)

    # construct the url

    gravatar_url = baseurl + hashlib.md5(email_address.lower()).hexdigest() + "?"

    gravatar_url += urllib.urlencode({'d':default, 's':str(size)})

    return gravatar_url

#==============================================================================

# REPO PAGER, PAGER FOR REPOSITORY

#==============================================================================

class RepoPage(Page):

    def __init__(self, collection, page=1, items_per_page=20,

        item_count=None, url=None, branch_name=None, **kwargs):

        """Create a "RepoPage" instance. special pager for paging

        repository

        """

        self._url_generator = url

        # Safe the kwargs class-wide so they can be used in the pager() method

        self.kwargs = kwargs

        # Save a reference to the collection

        self.original_collection = collection

        self.collection = collection

        # The self.page is the number of the current page.

        # The first page has the number 1!

        try:

            self.page = int(page) # make it int() if we get it as a string

        except (ValueError, TypeError):

            self.page = 1

        self.items_per_page = items_per_page

        # Unless the user tells us how many items the collections has

        # we calculate that ourselves.

        if item_count is not None:

            self.item_count = item_count

        else:

            self.item_count = len(self.collection)

        # Compute the number of the first and last available page

        if self.item_count > 0:

            self.first_page = 1

            self.page_count = int(math.ceil(float(self.item_count) /

                                            self.items_per_page))

            self.last_page = self.first_page + self.page_count - 1

            # Make sure that the requested page number is the range of valid pages

            if self.page > self.last_page:

                self.page = self.last_page

            elif self.page < self.first_page:

                self.page = self.first_page

            # Note: the number of items on this page can be less than

            #       items_per_page if the last page is not full

            self.first_item = max(0, (self.item_count) - (self.page *

                                                          items_per_page))

            self.last_item = ((self.item_count - 1) - items_per_page *

                              (self.page - 1))

            iterator = self.collection.get_changesets(start=self.first_item,

                                                      end=self.last_item,

                                                      reverse=True,

                                                      branch_name=branch_name)

            self.items = list(iterator)

            # Links to previous and next page

            if self.page > self.first_page:

                self.previous_page = self.page - 1

            else:

                self.previous_page = None

            if self.page < self.last_page:

                self.next_page = self.page + 1

            else:

                self.next_page = None

        # No items available

        else:

            self.first_page = None

# -*- coding: utf-8 -*-

"""

    rhodecode.model.user

    ~~~~~~~~~~~~~~~~~~~~

    users model for RhodeCode

    :created_on: Apr 9, 2010

    :author: marcink

    :copyright: (C) 2009-2011 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import traceback

from pylons.i18n.translation import _

from rhodecode.lib import safe_unicode

from rhodecode.model import BaseModel

from rhodecode.model.caching_query import FromCache

from rhodecode.model.db import User, RepoToPerm, Repository, Permission, \

    UserToPerm, UsersGroupRepoToPerm, UsersGroupToPerm, UsersGroupMember

from rhodecode.lib.exceptions import DefaultUserException, \

    UserOwnsReposException

from sqlalchemy.exc import DatabaseError

from rhodecode.lib import generate_api_key

from sqlalchemy.orm import joinedload

log = logging.getLogger(__name__)

PERM_WEIGHTS = {'repository.none': 0,

                'repository.read': 1,

                'repository.write': 3,

                'repository.admin': 3}

class UserModel(BaseModel):

    def get(self, user_id, cache=False):

        user = self.sa.query(User)

        if cache:

            user = user.options(FromCache("sql_cache_short",

                                          "get_user_%s" % user_id))

        return user.get(user_id)

    def get_by_username(self, username, cache=False, case_insensitive=False):

        if case_insensitive:

            user = self.sa.query(User).filter(User.username.ilike(username))

        else:

            user = self.sa.query(User)\

                .filter(User.username == username)

        if cache:

            user = user.options(FromCache("sql_cache_short",

                                          "get_user_%s" % username))

        return user.scalar()

    def get_by_api_key(self, api_key, cache=False):

        user = self.sa.query(User)\

                .filter(User.api_key == api_key)

        if cache:

            user = user.options(FromCache("sql_cache_short",

                                          "get_user_%s" % api_key))

        return user.scalar()

    def create(self, form_data):

        try:

            new_user = User()

            for k, v in form_data.items():

                setattr(new_user, k, v)

            new_user.api_key = generate_api_key(form_data['username'])

            self.sa.add(new_user)

            self.sa.commit()

            return new_user

        except:

            log.error(traceback.format_exc())

            self.sa.rollback()

            raise

    def create_ldap(self, username, password, user_dn, attrs):

        """

        Checks if user is in database, if not creates this user marked

        as ldap user

        :param username:

        :param password:

        :param user_dn:

        :param attrs:

        """

        from rhodecode.lib.auth import get_crypt_password

        log.debug('Checking for such ldap account in RhodeCode database')

        if self.get_by_username(username, case_insensitive=True) is None:

            try:

                new_user = User()

                # add ldap account always lowercase

                new_user.username = username.lower()

                new_user.password = get_crypt_password(password)

                new_user.api_key = generate_api_key(username)

                new_user.email = attrs['email']

                new_user.active = True

                new_user.ldap_dn = safe_unicode(user_dn)

                new_user.name = attrs['name']

                new_user.lastname = attrs['lastname']

                self.sa.add(new_user)

                self.sa.commit()

                return True

            except (DatabaseError,):

                log.error(traceback.format_exc())

                self.sa.rollback()

                raise

        log.debug('this %s user exists skipping creation of ldap account',

                  username)

        return False

    def create_registration(self, form_data):

        from rhodecode.lib.celerylib import tasks, run_task

        try:

            new_user = User()

            for k, v in form_data.items():

                if k != 'admin':

                    setattr(new_user, k, v)

            self.sa.add(new_user)

            self.sa.commit()

            body = ('New user registration\n'

                    'username: %s\n'

                    'email: %s\n')

            body = body % (form_data['username'], form_data['email'])

            run_task(tasks.send_email, None,

                     _('[RhodeCode] New User registration'),

                     body)

        except:

            log.error(traceback.format_exc())

            self.sa.rollback()

            raise

    def update(self, user_id, form_data):

        try:

            user = self.get(user_id, cache=False)

            if user.username == 'default':

                raise DefaultUserException(

                                _("You can't Edit this user since it's"

                                  " crucial for entire application"))

            for k, v in form_data.items():

                if k == 'new_password' and v != '':

                    user.password = v

                    user.api_key = generate_api_key(user.username)

                else:

                    setattr(user, k, v)

            self.sa.add(user)

            self.sa.commit()

        except:

            log.error(traceback.format_exc())

            self.sa.rollback()

            raise

    def update_my_account(self, user_id, form_data):

        try:

            user = self.get(user_id, cache=False)

            if user.username == 'default':

                raise DefaultUserException(

                                _("You can't Edit this user since it's"

                                  " crucial for entire application"))

            for k, v in form_data.items():

                if k == 'new_password' and v != '':

                    user.password = v

                    user.api_key = generate_api_key(user.username)

                else:

                    if k not in ['admin', 'active']:

                        setattr(user, k, v)