# copyright 2003-2013 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""classes to define schemas for CubicWeb"""

__docformat__ = "restructuredtext en"

_ = unicode

import re

from os.path import join, basename

from logging import getLogger

from warnings import warn

from logilab.common import tempattr

from logilab.common.decorators import cached, clear_cache, monkeypatch, cachedproperty

from logilab.common.logging_ext import set_log_methods

from logilab.common.deprecation import deprecated, class_moved, moved

from logilab.common.textutils import splitstrip

from logilab.common.graph import get_cycles

from logilab.common.compat import any

from yams import BadSchemaDefinition, buildobjs as ybo

from yams.schema import Schema, ERSchema, EntitySchema, RelationSchema, \

     RelationDefinitionSchema, PermissionMixIn, role_name

from yams.constraints import BaseConstraint, FormatConstraint

from yams.reader import (CONSTRAINTS, PyFileReader, SchemaLoader,

                         obsolete as yobsolete, cleanup_sys_modules)

from rql import parse, nodes, RQLSyntaxError, TypeResolverException

import cubicweb

from cubicweb import ETYPE_NAME_MAP, ValidationError, Unauthorized

try:

    from cubicweb import server

except ImportError:

    # We need to lookup DEBUG from there,

    # however a pure dbapi client may not have it.

    class server(object): pass

    server.DEBUG = False

PURE_VIRTUAL_RTYPES = set(('identity', 'has_text',))

VIRTUAL_RTYPES = set(('eid', 'identity', 'has_text',))

# set of meta-relations available for every entity types

META_RTYPES = set((

    'owned_by', 'created_by', 'is', 'is_instance_of', 'identity',

    'eid', 'creation_date', 'cw_source', 'modification_date', 'has_text', 'cwuri',

    ))

WORKFLOW_RTYPES = set(('custom_workflow', 'in_state', 'wf_info_for'))

WORKFLOW_DEF_RTYPES = set(('workflow_of', 'state_of', 'transition_of',

                           'initial_state', 'default_workflow',

                           'allowed_transition', 'destination_state',

                           'from_state', 'to_state', 'condition',

                           'subworkflow', 'subworkflow_state', 'subworkflow_exit',

                           ))

SYSTEM_RTYPES = set(('in_group', 'require_group',

                     # cwproperty

                     'for_user',

                     )) | WORKFLOW_RTYPES

NO_I18NCONTEXT = META_RTYPES | WORKFLOW_RTYPES

SKIP_COMPOSITE_RELS = [('cw_source', 'subject')]

# set of entity and relation types used to build the schema

SCHEMA_TYPES = set((

    'CWEType', 'CWRType', 'CWAttribute', 'CWRelation',

    'CWConstraint', 'CWConstraintType', 'CWUniqueTogetherConstraint',

    'RQLExpression',

    'specializes',

    'relation_type', 'from_entity', 'to_entity',

    'constrained_by', 'cstrtype',

    'constraint_of', 'relations',

    'read_permission', 'add_permission',

    'delete_permission', 'update_permission',

    ))

WORKFLOW_TYPES = set(('Transition', 'State', 'TrInfo', 'Workflow',

                      'WorkflowTransition', 'BaseTransition',

                      'SubWorkflowExitPoint'))

INTERNAL_TYPES = set(('CWProperty', 'CWCache', 'ExternalUri', 'CWDataImport',

                      'CWSource', 'CWSourceHostConfig', 'CWSourceSchemaConfig'))

_LOGGER = getLogger('cubicweb.schemaloader')

# entity and relation schema created from serialized schema have an eid

ybo.ETYPE_PROPERTIES += ('eid',)

ybo.RTYPE_PROPERTIES += ('eid',)

PUB_SYSTEM_ENTITY_PERMS = {

    'read':   ('managers', 'users', 'guests',),

    'add':    ('managers',),

    'delete': ('managers',),

    'update': ('managers',),

    }

PUB_SYSTEM_REL_PERMS = {

    'read':   ('managers', 'users', 'guests',),

    'add':    ('managers',),

    'delete': ('managers',),

    }

PUB_SYSTEM_ATTR_PERMS = {

    'read':   ('managers', 'users', 'guests',),

    'update': ('managers',),

    }

RO_REL_PERMS = {

    'read':   ('managers', 'users', 'guests',),

    'add':    (),

    'delete': (),

    }

RO_ATTR_PERMS = {

    'read':   ('managers', 'users', 'guests',),

    'update': (),

    }

# XXX same algorithm as in reorder_cubes and probably other place,

# may probably extract a generic function

def order_eschemas(eschemas):

    """return entity schemas ordered such that entity types which specializes an

    other one appears after that one

    """

    graph = {}

    for eschema in eschemas:

        if eschema.specializes():

            graph[eschema] = set((eschema.specializes(),))

        else:

            graph[eschema] = set()

    cycles = get_cycles(graph)

    if cycles:

        cycles = '\n'.join(' -> '.join(cycle) for cycle in cycles)

        raise Exception('cycles in entity schema specialization: %s'

                        % cycles)

    eschemas = []

    while graph:

        # sorted to get predictable results

        for eschema, deps in sorted(graph.items()):

            if not deps:

                eschemas.append(eschema)

                del graph[eschema]

                for deps in graph.itervalues():

                    try:

                        deps.remove(eschema)

                    except KeyError:

                        continue

    return eschemas

def bw_normalize_etype(etype):

    if etype in ETYPE_NAME_MAP:

        msg = '%s has been renamed to %s, please update your code' % (

            etype, ETYPE_NAME_MAP[etype])

        warn(msg, DeprecationWarning, stacklevel=4)

        etype = ETYPE_NAME_MAP[etype]

    return etype

def display_name(req, key, form='', context=None):

    """return a internationalized string for the key (schema entity or relation

    name) in a given form

    """

    assert form in ('', 'plural', 'subject', 'object')

    if form == 'subject':

        form = ''

    if form:

        key = key + '_' + form

    # ensure unicode

    if context is not None:

        return unicode(req.pgettext(context, key))

    else:

        return unicode(req._(key))

# Schema objects definition ###################################################

def ERSchema_display_name(self, req, form='', context=None):

    """return a internationalized string for the entity/relation type name in

    a given form

    """

    return display_name(req, self.type, form, context)

ERSchema.display_name = ERSchema_display_name

@cached

def get_groups(self, action):

    """return the groups authorized to perform <action> on entities of

    this type

    :type action: str

    :param action: the name of a permission

    :rtype: tuple

    :return: names of the groups with the given permission

    """

    assert action in self.ACTIONS, action

    #assert action in self._groups, '%s %s' % (self, action)

    try:

        return frozenset(g for g in self.permissions[action] if isinstance(g, basestring))

    except KeyError:

        return ()

PermissionMixIn.get_groups = get_groups

@cached

def get_rqlexprs(self, action):

    """return the rql expressions representing queries to check the user is allowed

    to perform <action> on entities of this type

    :type action: str

    :param action: the name of a permission

    :rtype: tuple

    :return: the rql expressions with the given permission

    """

    assert action in self.ACTIONS, action

    #assert action in self._rqlexprs, '%s %s' % (self, action)

    try:

        return tuple(g for g in self.permissions[action] if not isinstance(g, basestring))

    except KeyError:

        return ()

PermissionMixIn.get_rqlexprs = get_rqlexprs

orig_set_action_permissions = PermissionMixIn.set_action_permissions

def set_action_permissions(self, action, permissions):

    """set the groups and rql expressions allowing to perform <action> on

    entities of this type

    :type action: str

    :param action: the name of a permission

    :type permissions: tuple

    :param permissions: the groups and rql expressions allowing the given action

    """

    orig_set_action_permissions(self, action, tuple(permissions))

    clear_cache(self, 'get_rqlexprs')

    clear_cache(self, 'get_groups')

PermissionMixIn.set_action_permissions = set_action_permissions

def has_local_role(self, action):

    """return true if the action *may* be granted localy (eg either rql

    expressions or the owners group are used in security definition)

    XXX this method is only there since we don't know well how to deal with

    'add' action checking. Also find a better name would be nice.

    """

    assert action in self.ACTIONS, action

    if self.get_rqlexprs(action):

        return True

    if action in ('update', 'delete'):

        return 'owners' in self.get_groups(action)

    return False

PermissionMixIn.has_local_role = has_local_role

def may_have_permission(self, action, req):

    if action != 'read' and not (self.has_local_role('read') or

                                 self.has_perm(req, 'read')):

        return False

    return self.has_local_role(action) or self.has_perm(req, action)

PermissionMixIn.may_have_permission = may_have_permission

def has_perm(self, _cw, action, **kwargs):

    """return true if the action is granted globaly or localy"""

    try:

        self.check_perm(_cw, action, **kwargs)

        return True

    except Unauthorized:

        return False

PermissionMixIn.has_perm = has_perm

def check_perm(self, _cw, action, **kwargs):

    # NB: _cw may be a server transaction or a request object.

    #

    # check user is in an allowed group, if so that's enough internal

    # transactions should always stop there

    DBG = False

    if server.DEBUG & server.DBG_SEC:

        if action in server._SECURITY_CAPS:

            _self_str = str(self)

            if server._SECURITY_ITEMS:

                if any(item in _self_str for item in server._SECURITY_ITEMS):

                    DBG = True

            else:

                DBG = True

    groups = self.get_groups(action)

    if _cw.user.matching_groups(groups):

        if DBG:

            print 'check_perm: %r %r: user matches %s' % (action, _self_str, groups)

        return

    # if 'owners' in allowed groups, check if the user actually owns this

    # object, if so that's enough

    #

    # NB: give _cw to user.owns since user is not be bound to a transaction on

    # the repository side

    if 'owners' in groups and (

          kwargs.get('creating')

          or ('eid' in kwargs and _cw.user.owns(kwargs['eid']))):

        if DBG:

            print ('check_perm: %r %r: user is owner or creation time' %

                   (action, _self_str))

        return

    # else if there is some rql expressions, check them

    if DBG:

        print ('check_perm: %r %r %s' %

               (action, _self_str, [(rqlexpr, kwargs, rqlexpr.check(_cw, **kwargs))

                                    for rqlexpr in self.get_rqlexprs(action)]))

    if any(rqlexpr.check(_cw, **kwargs)

           for rqlexpr in self.get_rqlexprs(action)):

        return

    raise Unauthorized(action, str(self))

PermissionMixIn.check_perm = check_perm

RelationDefinitionSchema._RPROPERTIES['eid'] = None

# remember rproperties defined at this point. Others will have to be serialized in

# CWAttribute.extra_props

KNOWN_RPROPERTIES = RelationDefinitionSchema.ALL_PROPERTIES()

def rql_expression(self, expression, mainvars=None, eid=None):

    """rql expression factory"""

    if self.rtype.final:

        return ERQLExpression(expression, mainvars, eid)

    return RRQLExpression(expression, mainvars, eid)

RelationDefinitionSchema.rql_expression = rql_expression

orig_check_permission_definitions = RelationDefinitionSchema.check_permission_definitions

def check_permission_definitions(self):

    orig_check_permission_definitions(self)

    schema = self.subject.schema

    for action, groups in self.permissions.iteritems():

        for group_or_rqlexpr in groups:

            if action == 'read' and \

                   isinstance(group_or_rqlexpr, RQLExpression):

                msg = "can't use rql expression for read permission of %s"

                raise BadSchemaDefinition(msg % self)

            if self.final and isinstance(group_or_rqlexpr, RRQLExpression):

                msg = "can't use RRQLExpression on %s, use an ERQLExpression"

                raise BadSchemaDefinition(msg % self)

            if not self.final and isinstance(group_or_rqlexpr, ERQLExpression):

                msg = "can't use ERQLExpression on %s, use a RRQLExpression"

                raise BadSchemaDefinition(msg % self)

RelationDefinitionSchema.check_permission_definitions = check_permission_definitions

class CubicWebEntitySchema(EntitySchema):

    """a entity has a type, a set of subject and or object relations

    the entity schema defines the possible relations for a given type and some

    constraints on those relations

    """

    def __init__(self, schema=None, edef=None, eid=None, **kwargs):

        super(CubicWebEntitySchema, self).__init__(schema, edef, **kwargs)

        if eid is None and edef is not None:

            eid = getattr(edef, 'eid', None)

        self.eid = eid

    def check_permission_definitions(self):

        super(CubicWebEntitySchema, self).check_permission_definitions()

        for groups in self.permissions.itervalues():

            for group_or_rqlexpr in groups:

                if isinstance(group_or_rqlexpr, RRQLExpression):

                    msg = "can't use RRQLExpression on %s, use an ERQLExpression"

                    raise BadSchemaDefinition(msg % self.type)

    def is_subobject(self, strict=False, skiprels=None):

        if skiprels is None:

            skiprels = SKIP_COMPOSITE_RELS

        else:

            skiprels += SKIP_COMPOSITE_RELS

        return super(CubicWebEntitySchema, self).is_subobject(strict,

                                                              skiprels=skiprels)

    def attribute_definitions(self):

        """return an iterator on attribute definitions

        attribute relations are a subset of subject relations where the

        object's type is a final entity

        an attribute definition is a 2-uple :

        * name of the relation