#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

kallithea.lib.annotate

~~~~~~~~~~~~~~~~~~~~~~

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Dec 4, 2011

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import StringIO

from kallithea.lib.vcs.exceptions import VCSError

        # user groups

        for perm in default_user_group_perms:

            u_k = perm.UserUserGroupToPerm.user_group.users_group_name

            p = 'usergroup.admin'

            permissions[UK][u_k] = p

        return permissions

    #==================================================================

    # SET DEFAULTS GLOBAL, REPOS, REPOSITORY GROUPS

    #==================================================================

    uid = user_id

    default_global_perms = UserToPerm.query()\

        .filter(UserToPerm.user_id == default_user_id)\

        .options(joinedload(UserToPerm.permission))

    for perm in default_global_perms:

        permissions[GLOBAL].add(perm.permission.permission_name)

    # defaults for repositories, taken from default user

    for perm in default_repo_perms:

        r_k = perm.UserRepoToPerm.repository.repo_name

        if perm.Repository.private and not (perm.Repository.user_id == uid):

            # disable defaults for private repos,

            self.username = 'None'

        log.debug('Auth User is now %s' % self)

    def get_perms(self, user, explicit=True, algo='higherwin', cache=False):

        """

        Fills user permission attribute with permissions taken from database

        works for permissions given for repositories, and for permissions that

        are granted to groups

        :param user: instance of User object from database

        :param explicit: In case there are permissions both for user and a group

            explicitly override permissions from group, if it's False it will

            make decision based on the algo

        :param algo: algorithm to decide what permission should be choose if

            it's multiple defined, eg user in two different groups. It also

            decides if explicit flag is turned off how to specify the permission

            for case when user is in a group + have defined separate permission

        """

        user_id = user.user_id

        user_is_admin = user.is_admin

        user_inherit_default_permissions = user.inherit_default_permissions

        log.debug('Getting PERMISSION tree')

        "admin": 'True|False defines if user should be Kallithea super admin',

        "active": 'True|False defines active state of user internally for Kallithea',

        "active_from_extern": "True|False\None, active state from the external auth, "

                              "None means use definition from Kallithea extern_type active value"

    }

    @property

    def validators(self):

        """

        Exposes Kallithea validators modules

        """

        # this is a hack to overcome issues with pylons threadlocals and

        class LazyCaller(object):

            def __init__(self, name):

                self.validator_name = name

            def __call__(self, *args, **kwargs):

                from kallithea.model import validators as v

                obj = getattr(v, self.validator_name)

                #log.debug('Initializing lazy formencode object: %s' % obj)

                return LazyFormencode(obj, *args, **kwargs)

        class ProxyGet(object):

            return False

        if user and user.extern_type and user.extern_type != plugin_name:

            log.debug('User %s should authenticate using %s this is %s, skipping'

                      % (user, user.extern_type, plugin_name))

            return False

        return True

    def get_user(self, username=None, **kwargs):

        """

        Helper method for user fetching in plugins, by default it's using

        eg. container auth plugin to fetch user by environ params

        :param username: username if given to fetch from database

        :param kwargs: extra arguments needed for user fetching.

        """

        user = None

        log.debug('Trying to fetch user `%s` from Kallithea database'

                  % (username))

        if username:

            user = User.get_by_username(username)

            if not user:

                log.debug('Fallback to fetch user in case insensitive mode')

        :returns: boolean

        """

        raise NotImplementedError("Not implemented in base class")

    def _authenticate(self, userobj, username, passwd, settings, **kwargs):

        auth = super(KallitheaExternalAuthPlugin, self)._authenticate(

            userobj, username, passwd, settings, **kwargs)

        if auth:

            # maybe plugin will clean the username ?

            # we should use the return value

            username = auth['username']

            # this can prevent from creating users in Kallithea when using

            # external authentication, but if it's inactive user we shouldn't

            # create that user anyway

            if auth['active_from_extern'] is False:

                log.warning("User %s authenticated against %s, but is inactive"

                            % (username, self.__module__))

                return None

            if self.use_fake_password():

                # Randomize the PW because we don't need it, but don't want

                # them blank either

                passwd = PasswordGenerator().gen_password(length=8)

        parts = plugin.split(u'.lib.auth_modules.auth_', 1)

        if len(parts) == 2:

            _module, pn = parts

            if pn == EXTERN_TYPE_INTERNAL:

                pn = "internal"

            plugin = u'kallithea.lib.auth_modules.auth_' + pn

    PLUGIN_CLASS_NAME = "KallitheaAuthPlugin"

    try:

        module = importlib.import_module(plugin)

    except (ImportError, TypeError):

        log.error(traceback.format_exc())

        # TODO: make this more error prone, if by some accident we screw up

        raise

    log.debug("Loaded auth plugin from %s (module:%s, file:%s)"

              % (plugin, module.__name__, module.__file__))

    pluginclass = getattr(module, PLUGIN_CLASS_NAME)

    if not issubclass(pluginclass, KallitheaAuthPluginBase):

        raise TypeError("Authentication class %s.KallitheaAuthPlugin is not "

                        "a subclass of %s" % (plugin, KallitheaAuthPluginBase))

    return pluginclass

def loadplugin(plugin):

    """

    Loads and returns an instantiated authentication plugin.

        see: importplugin

    """

    plugin = importplugin(plugin)()

    if plugin.plugin_settings.im_func != KallitheaAuthPluginBase.plugin_settings.im_func:

        raise TypeError("Authentication class %s.KallitheaAuthPluginBase "

                        "forbidden." % plugin)

    return plugin

def authenticate(username, password, environ=None):

    """

    Authentication function used for access control,

    It tries to authenticate based on enabled authentication modules.

    :param username: username can be empty for container auth

    :param password: password can be empty for container auth

    :param environ: environ headers passed for container auth

                               settings=plugin_settings)

        log.debug('Plugin %s extracted user is `%s`' % (module, user))

        if not plugin.accepts(user):

            log.debug('Plugin %s does not accept user `%s` for authentication'

                      % (module, user))

            continue

        else:

            log.debug('Plugin %s accepted user `%s` for authentication'

                      % (module, user))

        log.info('Authenticating user using %s plugin' % plugin.__module__)

        # _authenticate is a wrapper for .auth() method of plugin.

        # it also maps users to Database and maps the attributes returned

        # from .auth() to Kallithea database. If this function returns data

        # then auth is correct.

        plugin_user = plugin._authenticate(user, username, password,

                                           plugin_settings,

                                           environ=environ or {})

        log.debug('PLUGIN USER DATA: %s' % plugin_user)

        if plugin_user:

            log.debug('Plugin returned proper authentication data')

            return plugin_user

            username = environ.get(header)

            log.debug('extracted %s:%s' % (header, username))

        if username and str2bool(settings.get('clean_username')):

            log.debug('Received username %s from container' % username)

            username = self._clean_username(username)

            log.debug('New cleanup user is: %s' % username)

        return username

    def get_user(self, username=None, **kwargs):

        """

        Helper method for user fetching in plugins, by default it's using

        eg. container auth plugin to fetch user by environ params

        :param username: username if given to fetch

        :param kwargs: extra arguments needed for user fetching.

        """

        environ = kwargs.get('environ') or {}

        settings = kwargs.get('settings') or {}

        username = self._get_username(environ, settings)

        # we got the username, so use default method now

        return super(KallitheaAuthPlugin, self).get_user(username)

    def auth(self, userobj, username, password, settings, **kwargs):

        """

        from REMOTE_USER if this plugin is enabled, if that fails

        it tries to get username from HTTP_X_FORWARDED_USER if fallback header

        is set. clean_username extracts the username from this data if it's

        having @ in it.

        Return None on failure. On success, return a dictionary of the form:

            see: KallitheaAuthPluginBase.auth_func_attrs

        :param userobj:

        :param username:

        :param password:

        :param settings:

            return None

        if not userobj:

            userobj = self.get_user('', environ=environ, settings=settings)

        # we don't care passed username/password for container auth plugins.

        # only way to log in is using environ

        username = None

        if userobj:

            username = getattr(userobj, 'username')

        if not username:

            username = self._get_username(environ, settings)

        # if cannot fetch username, it's a no-go for this plugin to proceed

        if not username:

            return None

        # old attrs fetched from Kallithea database

        admin = getattr(userobj, 'admin', False)

        active = getattr(userobj, 'active', True)

        email = getattr(userobj, 'email', '')

        firstname = getattr(userobj, 'firstname', '')

        lastname = getattr(userobj, 'lastname', '')

        return EXTERN_TYPE_INTERNAL

    def settings(self):

        return []

    def user_activation_state(self):

        def_user_perms = User.get_default_user().AuthUser.permissions['global']

        return 'hg.register.auto_activate' in def_user_perms

    def accepts(self, user, accepts_empty=True):

        """

        Custom accepts for this auth that doesn't accept empty users. We

        """

        return super(KallitheaAuthPlugin, self).accepts(user,

                                                        accepts_empty=False)

    def auth(self, userobj, username, password, settings, **kwargs):

        if not userobj:

            log.debug('userobj was:%s skipping' % (userobj, ))

            return None

        if userobj.extern_type != self.name:

            log.warning("userobj:%s extern_type mismatch got:`%s` expected:`%s`"

                     % (userobj, userobj.extern_type, self.name))

            return None

        self.basepath = self.config['base_path']

        #authenticate this VCS request using authfunc

        self.authenticate = BasicAuth('', auth_modules.authenticate,

                                      config.get('auth_ret_code'))

        self.ip_addr = '0.0.0.0'

    def _handle_request(self, environ, start_response):

        raise NotImplementedError()

    def _get_by_id(self, repo_name):

        """

        Gets a special pattern _<ID> from clone url and tries to replace it

        :param repo_name:

        """

        data = repo_name.split('/')

        if len(data) >= 2:

            from kallithea.lib.utils import get_repo_by_id

            by_id_match = get_repo_by_id(repo_name)

            if by_id_match:

                data[1] = by_id_match

        return '/'.join(data)

    def _invalidate_cache(self, repo_name):

        """

        :param repo_name: full repo name, also a cache key

        """

        ScmModel().mark_for_invalidation(repo_name)

    def _check_permission(self, action, user, repo_name, ip_addr=None):

        """

        Checks permissions using action (push/pull) user and repository

        name

        :param action: push or pull action

        :param user: user instance

def get_cache_region(name, region):

    if region not in beaker.cache.cache_regions:

        raise BeakerException('Cache region `%s` not configured '

            'Check if proper cache settings are in the .ini files' % region)

    kw = beaker.cache.cache_regions[region]

    return beaker.cache.Cache._get_cache(name, kw)

def _get_cache_parameters(query):

    """For a query with cache_region and cache_namespace configured,

    on this query's current criterion and parameter values.

    """

    if not hasattr(query, '_cache_parameters'):

        raise ValueError("This Query does not have caching "

                         "parameters configured.")

    region, namespace, cache_key = query._cache_parameters

    namespace = _namespace_from_query(namespace, query)

    if cache_key is None:

        if not co_day_auth_aggr:

            co_day_auth_aggr[akc(repo.contact)] = {

                "label": akc(repo.contact),

                "data": [0, 1],

                "schema": ["commits"],

            }

        stats = cur_stats if cur_stats else Statistics()

        stats.commit_activity = json.dumps(co_day_auth_aggr)

        stats.commit_activity_combined = json.dumps(overview_data)

        leftovers = len(repo.revisions[last_rev:])

        log.debug('revisions to parse %s' % leftovers)

        if last_rev == 0 or leftovers < parse_limit:

            log.debug('getting code trending stats')

            stats.languages = json.dumps(__get_codes_stats(repo_name))

        try:

            stats.repository = dbrepo

            stats.stat_on_revision = last_cs.revision if last_cs else 0

            DBS.add(stats)

            DBS.commit()

try:

    from io import BytesIO

except ImportError:

    from cStringIO import StringIO as BytesIO

#==============================================================================

# bytes

#==============================================================================

if __py_version__ >= (2, 6):

    _bytes = bytes

else:

    _bytes = str

if __py_version__ >= (2, 6):

    _bytearray = bytearray

else:

    import array

    # no idea if this is correct but all integration tests are passing

    # i think we never use bytearray anyway

    _bytearray = array

#==============================================================================

            default = UserRepoGroupToPerm.query()\

                .filter(UserRepoGroupToPerm.group == g)\

                .filter(UserRepoGroupToPerm.user == def_usr)\

                .scalar()

            if default is None:

                log.debug('missing default permission for group %s adding' % g)

                perm_obj = RepoGroupModel()._create_default_perms(g)

                self.sa.add(perm_obj)

    def reset_permissions(self, username):

        """

        bad permissions, we must clean them up

        :param username:

        """

        default_user = User.get_by_username(username)

        if not default_user:

            return

        u2p = UserToPerm.query()\

            .filter(UserToPerm.user == default_user).all()

        fixed = False

        if len(u2p) != len(Permission.DEFAULT_USER_PERMISSIONS):

                                     firstname='Kallithea', lastname='Admin',

                                     active=True, admin=admin,

                                     extern_type=EXTERN_TYPE_INTERNAL)

    def create_default_user(self):

        log.info('creating default user')

        # create default user for handling default permissions.

        user = UserModel().create_or_update(username=User.DEFAULT_USER,

                                            password=str(uuid.uuid1())[:20],

                                            email='anonymous@kallithea-scm.org',

                                            firstname='Anonymous',

                                            lastname='User')

        if self.cli_args.get('public_access') is False:

            log.info('Public access disabled')

            user.active = False

            Session().add(user)

            Session().commit()

    def create_permissions(self):

        """

        Creates all permissions defined in the system

        """

        # module.(access|create|change|delete)_[name]

        # module.(none|read|write|admin)

        engine = kw.pop('engine', self.table.bind)

        from kallithea.lib.dbmigrate.migrate.changeset.databases.visitor import (get_engine_visitor,

                                                                                 run_single_visitor)

        visitorcallable = get_engine_visitor(engine, visitor_name)

        run_single_visitor(engine, visitorcallable, self, *a, **kw)

    def create(self, *a, **kw):

        """Create the constraint in the database.

        :param engine: the database engine to use. If this is \

        :keyword:`None` the instance's engine will be used

        :type engine: :class:`sqlalchemy.engine.base.Engine`

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        """

        # TODO: set the parent here instead of in __init__

        self.__do_imports('constraintgenerator', *a, **kw)

    def drop(self, *a, **kw):

        """Drop the constraint from the database.

        :param engine: the database engine to use. If this is

          :keyword:`None` the instance's engine will be used

        :param cascade: Issue CASCADE drop if database supports it

        :type engine: :class:`sqlalchemy.engine.base.Engine`

        :type cascade: bool

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        :returns: Instance with cleared columns

        """

        self.cascade = kw.pop('cascade', False)

        self.__do_imports('constraintdropper', *a, **kw)

        # the spirit of Constraint objects is that they

        # are immutable (just like in a DB.  they're only ADDed

        # or DROPped).

        #self.columns.clear()

        return self

            "Firebird does not support renaming tables.")

    def _visit_column_name(self, table, column, delta):

        self.start_alter_table(table)

        col_name = self.preparer.quote(delta.current_name, table.quote)

        new_name = self.preparer.format_column(delta.result_column)

        self.append('ALTER COLUMN %s TO %s' % (col_name, new_name))

    def _visit_column_nullable(self, table, column, delta):

        """Changing NULL is not supported"""

        # TODO: http://www.firebirdfaq.org/faq103/

        raise exceptions.NotSupportedError(

class FBConstraintGenerator(ansisql.ANSIConstraintGenerator):

    """Firebird constraint generator implementation."""

class FBConstraintDropper(ansisql.ANSIConstraintDropper):

    def cascade_constraint(self, constraint):

        """Cascading constraints is not supported"""

        raise exceptions.NotSupportedError(

            "Firebird does not support cascading constraints")

class FBDialect(ansisql.ANSIDialect):

    columngenerator = FBColumnGenerator

    columndropper = FBColumnDropper

    schemachanger = FBSchemaChanger

    constraintgenerator = FBConstraintGenerator

class PGSchemaChanger(ansisql.ANSISchemaChanger):

    """PostgreSQL schema changer implementation."""

    pass

class PGConstraintGenerator(ansisql.ANSIConstraintGenerator):

    """PostgreSQL constraint generator implementation."""

    pass

class PGConstraintDropper(ansisql.ANSIConstraintDropper):

    pass

class PGDialect(ansisql.ANSIDialect):

    columngenerator = PGColumnGenerator

    columndropper = PGColumnDropper

    schemachanger = PGSchemaChanger

    constraintgenerator = PGConstraintGenerator

    constraintdropper = PGConstraintDropper

        :type column: Column instance or string

        """

        if not isinstance(column, sqlalchemy.Column):

            # It's a column name

            column = getattr(self.c, str(column))

        column.create(table=self, *p, **kw)

    def drop_column(self, column, *p, **kw):

        """Drop a column, given its name or definition.

        API to :meth:`ChangesetColumn.drop`

        :type column: Column instance or string

        """

        if not isinstance(column, sqlalchemy.Column):

            # It's a column name

            try:

                column = getattr(self.c, str(column))

            except AttributeError:

                # That column isn't part of the table. We don't need

                # its entire definition to drop the column, just its

                # name, so create a dummy column with the same name.

                column = sqlalchemy.Column(str(column), sqlalchemy.Integer())

        column.drop(table=self, *p, **kw)

    def rename(self, name, connection=None, **kwargs):

        """Rename this table.

        :param name: New name of the table.

        :type name: string

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        """

        engine = self.bind

        self.new_name = name

        visitorcallable = get_engine_visitor(engine, 'schemachanger')

        run_single_visitor(engine, visitorcallable, self, connection, **kwargs)

        # Fix metadata registration

        self.name = name

        self.deregister()

        self._set_parent(self.metadata)

        Assumes the given table exists. ``ALTER TABLE ADD COLUMN``,

        for most databases.

        :param table: Table instance to create on.

        :param index_name: Creates :class:`ChangesetIndex` on this column.

        :param unique_name: Creates :class:\

`~migrate.changeset.constraint.UniqueConstraint` on this column.

        :param primary_key_name: Creates :class:\

`~migrate.changeset.constraint.PrimaryKeyConstraint` on this column.

        :param populate_default: If True, created column will be \

populated with defaults

        :type table: Table instance

        :type index_name: string

        :type unique_name: string

        :type primary_key_name: string

        :type populate_default: bool

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        :returns: self

        """

        self.populate_default = populate_default

        self.index_name = index_name

        self.unique_name = unique_name

        # TODO: reuse existing connection

        if self.populate_default and self.default is not None:

            stmt = table.update().values({self: engine._execute_default(self.default)})

            engine.execute(stmt)

        return self

    def drop(self, table=None, connection=None, **kwargs):

        """Drop this column from the database, leaving its table intact.

        ``ALTER TABLE DROP COLUMN``, for most databases.

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        """

        if table is not None:

            self.table = table

        engine = self.table.bind

        visitorcallable = get_engine_visitor(engine, 'columndropper')

        engine._run_visitor(visitorcallable, self, connection, **kwargs)

        self.remove_from_table(self.table, unset_table=False)

        self.table = None

        return self

    def add_to_table(self, table):

class ChangesetIndex(object):

    """Changeset extensions to SQLAlchemy Indexes."""

    __visit_name__ = 'index'

    def rename(self, name, connection=None, **kwargs):

        """Change the name of an index.

        :param name: New name of the Index.

        :type name: string

        :type connection: :class:`sqlalchemy.engine.base.Connection` instance

        """

        engine = self.table.bind

        self.new_name = name

        visitorcallable = get_engine_visitor(engine, 'schemachanger')

        engine._run_visitor(visitorcallable, self, connection, **kwargs)

        self.name = name

class ChangesetDefaultClause(object):

    """Implements comparison between :class:`DefaultClause` instances"""

        args['engine_arg_executor'] = lambda s, p = '': buf.write(str(s) + p)

        @with_engine

        def go(url, step, **kw):

            engine = kw.pop('engine')

            self.run(engine, step)

            return buf.getvalue()

        return go(url, step, **args)

    def run(self, engine, step):

        """Core method of Script file.

        :param engine: SQLAlchemy Engine

        :param step: Operation to run

        :type engine: string

        :type step: int

        """

        if step > 0:

            op = 'upgrade'

        elif step < 0:

            op = 'downgrade'

        else:

            raise ScriptError("%d is not a valid step" % step)

                    del rargs[0]

                else:

                    self._process_long_opt(rargs, values)

            elif arg[:1] == "-" and len(arg) > 1:

                self._process_short_opts(rargs, values)

            elif self.allow_interspersed_args:

                largs.append(arg)

                del rargs[0]

def main(argv=None, **kwargs):