from sqlalchemy.exc import DatabaseError

from kallithea.lib import helpers as h

from kallithea.lib.compat import json, formatted_json

from kallithea.lib.base import BaseController, render

from kallithea.lib.auth import LoginRequired, HasPermissionAllDecorator

from kallithea.lib import auth_modules

from kallithea.model.forms import AuthSettingsForm

from kallithea.model.db import Setting

from kallithea.model.meta import Session

log = logging.getLogger(__name__)

class AuthSettingsController(BaseController):

    @LoginRequired()

    @HasPermissionAllDecorator('hg.admin')

    def __before__(self):

        super(AuthSettingsController, self).__before__()

    def __load_defaults(self):

        c.available_plugins = [

            'kallithea.lib.auth_modules.auth_container',

            'kallithea.lib.auth_modules.auth_ldap',

            'kallithea.lib.auth_modules.auth_crowd',

        ]

        c.enabled_plugins = Setting.get_auth_plugins()

    def index(self, defaults=None, errors=None, prefix_error=False):

        self.__load_defaults()

        _defaults = {}

        # default plugins loaded

        formglobals = {

        }

        formglobals.update(Setting.get_auth_settings())

        formglobals["plugin_settings"] = {}

        formglobals["auth_plugins_shortnames"] = {}

        _defaults["auth_plugins"] = formglobals["auth_plugins"]

        for module in formglobals["auth_plugins"]:

            plugin = auth_modules.loadplugin(module)

            plugin_name = plugin.name

            formglobals["auth_plugins_shortnames"][module] = plugin_name

            formglobals["plugin_settings"][module] = plugin.plugin_settings()

            for v in formglobals["plugin_settings"][module]:

                fullname = ("auth_" + plugin_name + "_" + v["name"])

                if "default" in v:

                    _defaults[fullname] = v["default"]

                # Current values will be the default on the form, if there are any

                setting = Setting.get_by_name(fullname)

                if setting:

                    _defaults[fullname] = setting.app_settings_value

        # we want to show , seperated list of enabled plugins

        _defaults['auth_plugins'] = ','.join(_defaults['auth_plugins'])

        if defaults:

            _defaults.update(defaults)

        # url('my_account')

        c.active = 'profile'

        self.__load_data()

        c.perm_user = AuthUser(user_id=self.authuser.user_id,

                               ip_addr=self.ip_addr)

        c.extern_type = c.user.extern_type

        c.extern_name = c.user.extern_name

        defaults = c.user.get_dict()

        update = False

        if request.POST:

            _form = UserForm(edit=True,

                             old_data={'user_id': self.authuser.user_id,

                                       'email': self.authuser.email})()

            form_result = {}

            try:

                post_data = dict(request.POST)

                post_data['new_password'] = ''

                post_data['password_confirmation'] = ''

                form_result = _form.to_python(post_data)

                # skip updating those attrs for my account

                skip_attrs = ['admin', 'active', 'extern_type', 'extern_name',

                              'new_password', 'password_confirmation']

                #TODO: plugin should define if username can be updated

                    # forbid updating username for external accounts

                    skip_attrs.append('username')

                UserModel().update(self.authuser.user_id, form_result,

                                   skip_attrs=skip_attrs)

                h.flash(_('Your account was updated successfully'),

                        category='success')

                Session().commit()

                update = True

            except formencode.Invalid, errors:

                return htmlfill.render(

                    render('admin/my_account/my_account.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred during update of user %s') \

                        % form_result.get('username'), category='error')

        if update:

            return redirect('my_account')

        return htmlfill.render(

:created_on: Apr 4, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH.

:license: GPLv3, see LICENSE.md for more details.

"""

import logging

import traceback

import formencode

from pylons import response

from formencode import htmlfill

from pylons import request, session, tmpl_context as c, url, config

from pylons.controllers.util import redirect

from pylons.i18n.translation import _

from sqlalchemy.sql.expression import func

import kallithea

from kallithea.lib.exceptions import DefaultUserException, \

    UserOwnsReposException, UserCreationError

from kallithea.lib import helpers as h

from kallithea.lib.auth import LoginRequired, HasPermissionAllDecorator, \

    AuthUser, generate_api_key

from kallithea.lib import auth_modules

from kallithea.lib.base import BaseController, render

from kallithea.model.api_key import ApiKeyModel

from kallithea.model.db import User, UserEmailMap, UserIpMap, UserToPerm

from kallithea.model.forms import UserForm, CustomDefaultPermissionsForm

from kallithea.model.user import UserModel

from kallithea.model.meta import Session

from kallithea.lib.utils import action_logger

from kallithea.lib.compat import json

from kallithea.lib.utils2 import datetime_to_time, str2bool, safe_int

log = logging.getLogger(__name__)

class UsersController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    @LoginRequired()

    @HasPermissionAllDecorator('hg.admin')

    def __before__(self):

        super(UsersController, self).__before__()

        c.available_permissions = config['available_permissions']

                "firstname": user.name,

                "lastname": user.lastname,

                "last_login": h.fmt_date(user.last_login),

                "last_login_raw": datetime_to_time(user.last_login),

                "active": h.boolicon(user.active),

                "admin": h.boolicon(user.admin),

                "extern_type": user.extern_type,

                "extern_name": user.extern_name,

                "action": user_actions(user.user_id, user.username),

            })

        c.data = json.dumps({

            "totalRecords": total_records,

            "startIndex": 0,

            "sort": None,

            "dir": "asc",

            "records": users_data

        })

        return render('admin/users/users.html')

    def create(self):

        """POST /users: Create a new item"""

        # url('users')

        user_model = UserModel()

        user_form = UserForm()()

        try:

            form_result = user_form.to_python(dict(request.POST))

            user_model.create(form_result)

            usr = form_result['username']

            action_logger(self.authuser, 'admin_created_user:%s' % usr,

                          None, self.ip_addr, self.sa)

            h.flash(_('Created user %s') % usr,

                    category='success')

            Session().commit()

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/users/user_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except UserCreationError, e:

            h.flash(e, 'error')

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during creation of user %s') \

                    % request.POST.get('username'), category='error')

        return redirect(url('users'))

    def new(self, format='html'):

        """GET /users/new: Form to create a new item"""

        # url('new_user')

        return render('admin/users/user_add.html')

    def update(self, id):

        """PUT /users/id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('update_user', id=ID),

        #           method='put')

        # url('user', id=ID)

        c.active = 'profile'

        user_model = UserModel()

        c.user = user_model.get(id)

        c.extern_type = c.user.extern_type

        c.extern_name = c.user.extern_name

        c.perm_user = AuthUser(user_id=id, ip_addr=self.ip_addr)

        _form = UserForm(edit=True, old_data={'user_id': id,

                                              'email': c.user.email})()

        form_result = {}

        try:

            form_result = _form.to_python(dict(request.POST))

            skip_attrs = ['extern_type', 'extern_name']

            #TODO: plugin should define if username can be updated

                # forbid updating username for external accounts

                skip_attrs.append('username')

            user_model.update(id, form_result, skip_attrs=skip_attrs)

            usr = form_result['username']

            action_logger(self.authuser, 'admin_updated_user:%s' % usr,

                          None, self.ip_addr, self.sa)

            h.flash(_('User updated successfully'), category='success')

            Session().commit()

        except formencode.Invalid, errors:

            defaults = errors.value

            e = errors.error_dict or {}

            defaults.update({

                'create_repo_perm': user_model.has_perm(id,

                                                        'hg.create.repository'),

                'fork_repo_perm': user_model.has_perm(id, 'hg.fork.repository'),

                '_method': 'put'

            })

            return htmlfill.render(

                render('admin/users/user_edit.html'),

                defaults=defaults,

                errors=e,

                prefix_error=False,

                encoding="UTF-8")

        belonging to user with admin rights.

        :param apiuser: filled automatically from apikey

        :type apiuser: AuthUser

        OUTPUT::

            id : <id_given_in_input>

            result: [<user_object>, ...]

            error:  null

        """

        result = []

        users_list = User.query().order_by(User.username) \

            .filter(User.username != User.DEFAULT_USER) \

            .all()

        for user in users_list:

            result.append(user.get_api_data())

        return result

    @HasPermissionAllDecorator('hg.admin')

    def create_user(self, apiuser, username, email, password=Optional(''),

                    firstname=Optional(''), lastname=Optional(''),

                    active=Optional(True), admin=Optional(False),

        """

        Creates new user. Returns new user object. This command can

        be executed only using api_key belonging to user with admin rights.

        :param apiuser: filled automatically from apikey

        :type apiuser: AuthUser

        :param username: new username

        :type username: str or int

        :param email: email

        :type email: str

        :param password: password

        :type password: Optional(str)

        :param firstname: firstname

        :type firstname: Optional(str)

        :param lastname: lastname

        :type lastname: Optional(str)

        :param active: active

        :type active: Optional(bool)

        :param admin: admin

        :type admin: Optional(bool)

        :param extern_name: name of extern

        :type extern_name: Optional(str)

        :param extern_type: extern_type

        :type extern_type: Optional(str)

                email=auth["email"],

                firstname=auth["firstname"],

                lastname=auth["lastname"],

                active=auth["active"],

                admin=auth["admin"],

                extern_name=auth["extern_name"],

                extern_type=self.name

            )

            Session().flush()

            # enforce user is just in given groups, all of them has to be ones

            # created from plugins. We store this info in _group_data JSON field

            try:

                groups = auth['groups'] or []

                UserGroupModel().enforce_groups(user, groups, self.name)

            except Exception:

                # for any reason group syncing fails, we should proceed with login

                log.error(traceback.format_exc())

            Session().commit()

        return auth

def importplugin(plugin):

    """

    Imports and returns the authentication plugin in the module named by plugin

    RhodeCodeAuthPluginBase subclass on success, raises exceptions on failure.

    raises:

        AttributeError -- no RhodeCodeAuthPlugin class in the module

        TypeError -- if the RhodeCodeAuthPlugin is not a subclass of ours RhodeCodeAuthPluginBase

        ImportError -- if we couldn't import the plugin at all

    """

    log.debug("Importing %s" % plugin)

    PLUGIN_CLASS_NAME = "RhodeCodeAuthPlugin"

    try:

        module = importlib.import_module(plugin)

    except (ImportError, TypeError):

        log.error(traceback.format_exc())

        # TODO: make this more error prone, if by some accident we screw up

        # the plugin name, the crash is preatty bad and hard to recover

        raise

    log.debug("Loaded auth plugin from %s (module:%s, file:%s)"

              % (plugin, module.__name__, module.__file__))

    pluginclass = getattr(module, PLUGIN_CLASS_NAME)

    if not issubclass(pluginclass, RhodeCodeAuthPluginBase):

        raise TypeError("Authentication class %s.RhodeCodeAuthPlugin is not "

                        "a subclass of %s" % (plugin, RhodeCodeAuthPluginBase))

# -*- coding: utf-8 -*-

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RhodeCode authentication plugin for built in internal auth

:created_on: Created on Nov 17, 2012

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH.

:license: GPLv3, see LICENSE.md for more details.

"""

import logging

from kallithea.lib import auth_modules

from kallithea.lib.compat import formatted_json, hybrid_property

from kallithea.model.db import User

log = logging.getLogger(__name__)

class RhodeCodeAuthPlugin(auth_modules.RhodeCodeAuthPluginBase):

    def __init__(self):

        pass

    @hybrid_property

    def name(self):

    def settings(self):

        return []

    def user_activation_state(self):

        def_user_perms = User.get_default_user().AuthUser.permissions['global']

        return 'hg.register.auto_activate' in def_user_perms

    def accepts(self, user, accepts_empty=True):

        """

        Custom accepts for this auth that doesn't accept empty users. We

        know that user exisits in database.

        """

        return super(RhodeCodeAuthPlugin, self).accepts(user,

                                                        accepts_empty=False)

    def auth(self, userobj, username, password, settings, **kwargs):

        if not userobj:

            log.debug('userobj was:%s skipping' % (userobj, ))

            return None

        if userobj.extern_type != self.name:

            log.warn("userobj:%s extern_type mismatch got:`%s` expected:`%s`"

                     % (userobj, userobj.extern_type, self.name))

            return None

        # enable hgsubversion disabled by default

        hgsubversion = Ui()

        hgsubversion.ui_section = 'extensions'

        hgsubversion.ui_key = 'hgsubversion'

        hgsubversion.ui_value = ''

        hgsubversion.ui_active = False

        self.sa.add(hgsubversion)

        # enable hggit disabled by default

        hggit = Ui()

        hggit.ui_section = 'extensions'

        hggit.ui_key = 'hggit'

        hggit.ui_value = ''

        hggit.ui_active = False

        self.sa.add(hggit)

    def create_auth_plugin_options(self, skip_existing=False):

        """

        Create default auth plugin settings, and make it active

        :param skip_existing:

        """

            if skip_existing and Setting.get_by_name(k) != None:

                log.debug('Skipping option %s' % k)

                continue

            setting = Setting(k, v, t)

            self.sa.add(setting)

    def create_default_options(self, skip_existing=False):

        """Creates default settings"""

        for k, v, t in [

            ('default_repo_enable_locking',  False, 'bool'),

            ('default_repo_enable_downloads', False, 'bool'),

            ('default_repo_enable_statistics', False, 'bool'),

            ('default_repo_private', False, 'bool'),

            ('default_repo_type', 'hg', 'unicode')]:

            if skip_existing and Setting.get_by_name(k) is not None:

                log.debug('Skipping option %s' % k)

                continue

            setting = Setting(k, v, t)

            self.sa.add(setting)

    def fixup_groups(self):

        def_usr = User.get_default_user()

            ('show_private_icon', True, 'bool'),

            ('stylify_metatags', False, 'bool'),

            ('dashboard_items', 100, 'int'),

            ('admin_grid_items', 25, 'int'),

            ('show_version', True, 'bool'),

            ('use_gravatar', True, 'bool'),

            ('gravatar_url', User.DEFAULT_GRAVATAR_URL, 'unicode'),

            ('clone_uri_tmpl', Repository.DEFAULT_CLONE_URI, 'unicode'),

            ('update_url', Setting.DEFAULT_UPDATE_URL, 'unicode'),

        ]

        for key, val, type_ in settings:

            sett = Setting(key, val, type_)

            self.sa.add(sett)

        self.create_auth_plugin_options()

        self.create_default_options()

        log.info('created ui config')

    def create_user(self, username, password, email='', admin=False):

        log.info('creating user %s' % username)

        UserModel().create_or_update(username, password, email,

                                     firstname='RhodeCode', lastname='Admin',

                                     active=True, admin=admin,

    def create_default_user(self):

        log.info('creating default user')

        # create default user for handling default permissions.

        user = UserModel().create_or_update(username=User.DEFAULT_USER,

                                            password=str(uuid.uuid1())[:20],

                                            email='anonymous@kallithea-scm.org',

                                            firstname='Anonymous',

                                            lastname='User')

        # based on configuration options activate/deactive this user which

        # controlls anonymous access

        if self.cli_args.get('public_access') is False:

            log.info('Public access disabled')

            user.active = False

            Session().add(user)

            Session().commit()

    def create_permissions(self):

        """

        Creates all permissions defined in the system

        """

        # module.(access|create|change|delete)_[name]

        # module.(none|read|write|admin)

        log.info('creating permissions')

    # issue fixups

    fixups(db_2_0_0, meta.Session)

def downgrade(migrate_engine):

    meta = MetaData()

    meta.bind = migrate_engine

def fixups(models, _SESSION):

    notify('Fixing default created on')

    for usr in models.User.get_all():

        usr.created_on = datetime.datetime.now()

        _SESSION().add(usr)

        _SESSION().commit()

    notify('Migrating LDAP attribute to extern')

    for usr in models.User.get_all():

        ldap_dn = usr.ldap_dn

        if ldap_dn:

            usr.extern_name = ldap_dn

            usr.extern_type = 'ldap'

        else:

        _SESSION().add(usr)

        _SESSION().commit()

from kallithea.lib.dbmigrate.versions import _reset_base, notify

log = logging.getLogger(__name__)

def upgrade(migrate_engine):

    """

    Upgrade operations go here.

    Don't create your own engine; bind migrate_engine to your metadata

    """

    _reset_base(migrate_engine)

    from kallithea.lib.dbmigrate.schema import db_2_0_0

    # issue fixups

    fixups(db_2_0_0, meta.Session)

def downgrade(migrate_engine):

    meta = MetaData()

    meta.bind = migrate_engine

def fixups(models, _SESSION):

    notify('Fixing default auth modules')

    opts = []

    ldap_enabled = str2bool(getattr(

        models.Setting.get_by_name('ldap_active'),

        'app_settings_value', False))

    if ldap_enabled:

        plugins += ',kallithea.lib.auth_modules.auth_ldap'

        opts.append(('auth_ldap_enabled', 'True', 'bool'))

    opts.append(('auth_plugins', plugins, 'list'),)

    for name, default, type_ in opts:

        setting = models.Setting.get_by_name(name)

        if not setting:

            # if we don't have this option create it

            setting = models.Setting(name, default, type_)

        _SESSION().add(setting)

        _SESSION().commit()

    #copy over the LDAP settings

    old_ldap = [('ldap_active', 'false', 'bool'), ('ldap_host', '', 'unicode'),

                ('ldap_port', '389', 'int'), ('ldap_tls_kind', 'PLAIN', 'unicode'),

                ('ldap_tls_reqcert', '', 'unicode'), ('ldap_dn_user', '', 'unicode'),

                ('ldap_dn_pass', '', 'unicode'), ('ldap_base_dn', '', 'unicode'),

                ('ldap_filter', '', 'unicode'), ('ldap_search_scope', '', 'unicode'),

                ('ldap_attr_login', '', 'unicode'), ('ldap_attr_firstname', '', 'unicode'),

                ('ldap_attr_lastname', '', 'unicode'), ('ldap_attr_email', '', 'unicode')]

    for k, v, t in old_ldap:

        old_setting = models.Setting.get_by_name(k)

        name = 'auth_%s' % k

        setting = models.Setting.get_by_name(name)

        if not setting:

            # if we don't have this option create it

from kallithea.model import meta

from kallithea.lib.dbmigrate.versions import _reset_base, notify

log = logging.getLogger(__name__)

def upgrade(migrate_engine):

    """

    Upgrade operations go here.

    Don't create your own engine; bind migrate_engine to your metadata

    """

    _reset_base(migrate_engine)

    from kallithea.lib.dbmigrate.schema import db_2_0_1

    # issue fixups

    fixups(db_2_0_1, meta.Session)

def downgrade(migrate_engine):

    meta = MetaData()

    meta.bind = migrate_engine

def fixups(models, _SESSION):

    for usr in models.User.query().all():

        if not usr.extern_name:

            _SESSION().add(usr)

            _SESSION().commit()

                new_user.api_key = generate_api_key(username)

            # set password only if creating an user or password is changed

            password_change = new_user.password and not check_password(password,

                                                            new_user.password)

            if not edit or password_change:

                reason = 'new password' if edit else 'new user'

                log.debug('Updating password reason=>%s' % (reason,))

                new_user.password = get_crypt_password(password) if password else None

            self.sa.add(new_user)

            if not edit:

                log_create_user(new_user.get_dict(), cur_user)

            return new_user

        except (DatabaseError,):

            log.error(traceback.format_exc())

            raise

    def create_registration(self, form_data):

        from kallithea.model.notification import NotificationModel

        try:

            form_data['admin'] = False

            new_user = self.create(form_data)

            self.sa.add(new_user)

            self.sa.flush()

            # notification to admins

            subject = _('New user registration')

            body = ('New user registration\n'

                    '---------------------\n'

                    '- Username: %s\n'

                    '- Full Name: %s\n'

                    '- Email: %s\n')

            body = body % (new_user.username, new_user.full_name, new_user.email)

            edit_url = url('edit_user', id=new_user.user_id, qualified=True)

            kw = {'registered_user_url': edit_url}

            NotificationModel().create(created_by=new_user, subject=subject,

                                       body=body, recipients=None,

                                       type_=Notification.TYPE_REGISTRATION,

                                       email_kwargs=kw)

        except Exception:

            log.error(traceback.format_exc())

            raise

${h.form(url('my_account'), method='post')}

    <div class="form">

         <div class="field">

           <div class="gravatar_box">

               <div class="gravatar"><img alt="gravatar" src="${h.gravatar_url(c.user.email)}"/></div>

                <p>

                %if c.visual.use_gravatar:

                <strong>${_('Change your avatar at')} <a href="http://gravatar.com">gravatar.com</a></strong>

                <br/>${_('Using')} ${c.user.email}

                %else:

                <strong>${_('Avatars are disabled')}</strong>

                <br/>${c.user.email or _('Missing email, please update your user email address.')}

                    [${_('current IP')}: ${c.perm_user.ip_addr or "?"}]

                %endif

               </p>

           </div>

         </div>

        <% readonly = None %>

        <% disabled = "" %>

        <div class="fields">

                <% readonly = "readonly" %>

                <% disabled = " disabled" %>

                <strong>${_('Your user is in an external Source of Record; some details cannot be managed here')}.</strong>

           %endif

             <div class="field">

                <div class="label">

                    <label for="username">${_('Username')}:</label>

                </div>

                <div class="input">

                  ${h.text('username',class_='medium%s' % disabled, readonly=readonly)}

                  ${h.hidden('extern_name', c.extern_name)}

                  ${h.hidden('extern_type', c.extern_type)}

                </div>

             </div>

             <div class="field">

                <div class="label">

                    <label for="name">${_('First Name')}:</label>

                </div>

                <div class="input">

                    ${h.text('firstname',class_="medium")}

                </div>

             </div>

${h.form(url('update_user', id=c.user.user_id),method='put')}

<div class="form">

        <div class="field">

           <div class="gravatar_box">

               <div class="gravatar"><img alt="gravatar" src="${h.gravatar_url(c.user.email)}"/></div>

                <p>

                %if c.visual.use_gravatar:

                <strong>${_('Change avatar at')} <a href="http://gravatar.com">gravatar.com</a></strong>

                <br/>${_('Using')} ${c.user.email}

                %else:

                <strong>${_('Avatars are disabled')}</strong>

                <br/>${c.user.email or _('Missing email, please update this user email address.')}

                        ##show current ip just if we show ourself

                        %if c.authuser.username == c.user.username:

                            [${_('current IP')}: ${c.perm_user.ip_addr or "?"}]

                        %endif

                %endif

           </div>

        </div>

        <% readonly = None %>

        <% disabled = "" %>

        <div class="fields">

             <div class="field">

               <% readonly = "readonly" %>

               <% disabled = " disabled" %>

               <strong>${_('This user is in an external Source of Record (%s); some details cannot be managed here.' % c.extern_type)}.</strong>

             </div>

            %endif

             <div class="field">

                <div class="label">

                    <label for="username">${_('Username')}:</label>

                </div>

                <div class="input">

                  ${h.text('username',class_='medium%s' % disabled, readonly=readonly)}

                </div>

             </div>

             <div class="field">

                <div class="label">

                    <label for="email">${_('Email')}:</label>

                </div>

                <div class="input">

                    ${h.text('email',class_='medium')}

                </div>