# copyright 2003-2012 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""abstract class for http request"""

__docformat__ = "restructuredtext en"

import time

import random

import base64

import urllib

from hashlib import sha1 # pylint: disable=E0611

from Cookie import SimpleCookie

from calendar import timegm

from datetime import date, datetime

from urlparse import urlsplit

import httplib

from itertools import count

from warnings import warn

from rql.utils import rqlvar_maker

from logilab.common.decorators import cached

from logilab.common.deprecation import deprecated

from logilab.mtconverter import xml_escape

from cubicweb.dbapi import DBAPIRequest

from cubicweb.uilib import remove_html_tags, js

from cubicweb.utils import SizeConstrainedList, HTMLHead, make_uid

from cubicweb.view import STRICT_DOCTYPE, TRANSITIONAL_DOCTYPE_NOEXT

from cubicweb.web import (INTERNAL_FIELD_VALUE, LOGGER, NothingToEdit,

                          RequestError, StatusResponse)

from cubicweb.web.httpcache import GMTOFFSET, get_validators

from cubicweb.web.http_headers import Headers, Cookie, parseDateTime

_MARKER = object()

def build_cb_uid(seed):

    sha = sha1('%s%s%s' % (time.time(), seed, random.random()))

    return 'cb_%s' % (sha.hexdigest())

def list_form_param(form, param, pop=False):

    """get param from form parameters and return its value as a list,

    skipping internal markers if any

    * if the parameter isn't defined, return an empty list

    * if the parameter is a single (unicode) value, return a list

      containing that value

    * if the parameter is already a list or tuple, just skip internal

      markers

    if pop is True, the parameter is removed from the form dictionary

    """

    if pop:

        try:

            value = form.pop(param)

        except KeyError:

            return []

    else:

        value = form.get(param, ())

    if value is None:

        value = ()

    elif not isinstance(value, (list, tuple)):

        value = [value]

    return [v for v in value if v != INTERNAL_FIELD_VALUE]

class CubicWebRequestBase(DBAPIRequest):

    """abstract HTTP request, should be extended according to the HTTP backend

    Immutable attributes that describe the received query and generic configuration

    """

    ajax_request = False # to be set to True by ajax controllers

    def __init__(self, vreg, https=False, form=None, headers={}):

        """

        :vreg: Vregistry,

        :https: boolean, s this a https request

        :form: Forms value

        """

        super(CubicWebRequestBase, self).__init__(vreg)

        #: (Boolean) Is this an https request.

        self.https = https

        #: User interface property (vary with https) (see :ref:`uiprops`)

        self.uiprops = None

        #: url for serving datadir (vary with https) (see :ref:`resources`)

        self.datadir_url = None

        if https and vreg.config.https_uiprops is not None:

            self.uiprops = vreg.config.https_uiprops

        else:

            self.uiprops = vreg.config.uiprops

        if https and vreg.config.https_datadir_url is not None:

            self.datadir_url = vreg.config.https_datadir_url

        else:

            self.datadir_url = vreg.config.datadir_url

        #: raw html headers that can be added from any view

        self.html_headers = HTMLHead(self)

        #: received headers

        self._headers_in = Headers()

        for k, v in headers.iteritems():

            self._headers_in.addRawHeader(k, v)

        #: form parameters

        self.setup_params(form)

        #: dictionary that may be used to store request data that has to be

        #: shared among various components used to publish the request (views,

        #: controller, application...)

        self.data = {}

        #:  search state: 'normal' or 'linksearch' (eg searching for an object

        #:  to create a relation with another)

        self.search_state = ('normal',)

        #: page id, set by htmlheader template

        self.pageid = None

        self._set_pageid()

        # prepare output header

        #: Header used for the final response

        self.headers_out = Headers()

        #: HTTP status use by the final response

        self.status_out  = 200

    def _set_pageid(self):

        """initialize self.pageid

        if req.form provides a specific pageid, use it, otherwise build a

        new one.

        """

        pid = self.form.get('pageid')

        if pid is None:

            pid = make_uid(id(self))

            self.html_headers.define_var('pageid', pid, override=False)

        self.pageid = pid

    def _get_json_request(self):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        return self.ajax_request

    def _set_json_request(self, value):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        self.ajax_request = value

    json_request = property(_get_json_request, _set_json_request)

    def base_url(self, secure=None):

        """return the root url of the instance

        secure = False -> base-url

        secure = None  -> https-url if req.https

        secure = True  -> https if it exist

        """

        if secure is None:

            secure = self.https

        base_url = None

        if secure:

            base_url = self.vreg.config.get('https-url')

        if base_url is None:

            base_url = super(CubicWebRequestBase, self).base_url()

        return base_url

    @property

    def authmode(self):

        """Authentification mode of the instance

        (see :ref:`WebServerConfig`)"""

        return self.vreg.config['auth-mode']

    # Various variable generator.

    @property

    def varmaker(self):

        """the rql varmaker is exposed both as a property and as the

        set_varmaker function since we've two use cases:

        * accessing the req.varmaker property to get a new variable name

        * calling req.set_varmaker() to ensure a varmaker is set for later ajax

          calls sharing our .pageid

        """

        return self.set_varmaker()

    def next_tabindex(self):

        nextfunc = self.get_page_data('nexttabfunc')

        if nextfunc is None:

            nextfunc = count(1).next

            self.set_page_data('nexttabfunc', nextfunc)

        return nextfunc()

    def set_varmaker(self):

        varmaker = self.get_page_data('rql_varmaker')

        if varmaker is None:

            varmaker = rqlvar_maker()

            self.set_page_data('rql_varmaker', varmaker)

        return varmaker

    def set_session(self, session, user=None):

        """method called by the session handler when the user is authenticated

        or an anonymous connection is open

        """

        super(CubicWebRequestBase, self).set_session(session, user)

        # set request language

        vreg = self.vreg

        if self.user:

            try:

                # 1. user specified language

                lang = vreg.typed_value('ui.language',

                                        self.user.properties['ui.language'])

                self.set_language(lang)

                return

            except KeyError:

                pass

        if vreg.config['language-negociation']:

            # 2. http negociated language

            for lang in self.header_accept_language():

                if lang in self.translations:

                    self.set_language(lang)

                    return

        # 3. default language

        self.set_default_language(vreg)

    # input form parameters management ########################################

    # common form parameters which should be protected against html values

    # XXX can't add 'eid' for instance since it may be multivalued

    # dont put rql as well, if query contains < and > it will be corrupted!

    no_script_form_params = set(('vid',

                                 'etype',

                                 'vtitle', 'title',

                                 '__message',

                                 '__redirectvid', '__redirectrql'))

    def setup_params(self, params):

        """WARNING: we're intentionaly leaving INTERNAL_FIELD_VALUE here

        subclasses should overrides to

        """

        self.form = {}

        if params is None:

            return

        encoding = self.encoding

        for param, val in params.iteritems():

            if isinstance(val, (tuple, list)):

                val = [unicode(x, encoding) for x in val]

                if len(val) == 1:

                    val = val[0]

            elif isinstance(val, str):

                val = unicode(val, encoding)

            if param in self.no_script_form_params and val:

                val = self.no_script_form_param(param, val)

            if param == '_cwmsgid':

                self.set_message_id(val)

            elif param == '__message':

                warn('[3.13] __message in request parameter is deprecated (may '

                     'only be given to .build_url). Seeing this message usualy '

                     'means your application hold some <form> where you should '

                     'replace use of __message hidden input by form.set_message, '

                     'so new _cwmsgid mechanism is properly used',

                     DeprecationWarning)

                self.set_message(val)

            else:

                self.form[param] = val

    def no_script_form_param(self, param, value):

        """ensure there is no script in a user form param

        by default return a cleaned string instead of raising a security

        exception

        this method should be called on every user input (form at least) fields

        that are at some point inserted in a generated html page to protect

        against script kiddies

        """

        # safety belt for strange urls like http://...?vtitle=yo&vtitle=yo

        if isinstance(value, (list, tuple)):

            self.error('no_script_form_param got a list (%s). Who generated the URL ?',

                       repr(value))

            value = value[0]

        return remove_html_tags(value)

    def list_form_param(self, param, form=None, pop=False):

        """get param from form parameters and return its value as a list,

        skipping internal markers if any

        * if the parameter isn't defined, return an empty list

        * if the parameter is a single (unicode) value, return a list

          containing that value

        * if the parameter is already a list or tuple, just skip internal

          markers

        if pop is True, the parameter is removed from the form dictionary

        """

        if form is None:

            form = self.form

        return list_form_param(form, param, pop)

    def reset_headers(self):

        """used by AutomaticWebTest to clear html headers between tests on

        the same resultset

        """

        self.html_headers = HTMLHead(self)

        return self

    # web state helpers #######################################################

    @property

    def message(self):

        try:

            return self.session.data.pop(self._msgid, u'')

        except AttributeError:

            try:

                return self._msg

            except AttributeError:

                return None

    def set_message(self, msg):

        assert isinstance(msg, unicode)

        self._msg = msg

    def set_message_id(self, msgid):

        self._msgid = msgid

    @cached

    def redirect_message_id(self):

        return make_uid()

    def set_redirect_message(self, msg):

        # TODO - this should probably be merged with append_to_redirect_message

        assert isinstance(msg, unicode)

        msgid = self.redirect_message_id()

        self.session.data[msgid] = msg

        return msgid

    def append_to_redirect_message(self, msg):

        msgid = self.redirect_message_id()

        currentmsg = self.session.data.get(msgid)

        if currentmsg is not None:

            currentmsg = u'%s %s' % (currentmsg, msg)

        else:

            currentmsg = msg

        self.session.data[msgid] = currentmsg

        return msgid

    def reset_message(self):

        if hasattr(self, '_msg'):

            del self._msg

        if hasattr(self, '_msgid'):

            del self._msgid

    def update_search_state(self):

        """update the current search state"""

        searchstate = self.form.get('__mode')

        if not searchstate:

            searchstate = self.session.data.get('search_state', 'normal')

        self.set_search_state(searchstate)

    def set_search_state(self, searchstate):

        """set a new search state"""

        if searchstate is None or searchstate == 'normal':

            self.search_state = (searchstate or 'normal',)

        else:

            self.search_state = ('linksearch', searchstate.split(':'))

            assert len(self.search_state[-1]) == 4

        self.session.data['search_state'] = searchstate

    def match_search_state(self, rset):

        """when searching an entity to create a relation, return True if entities in

        the given rset may be used as relation end

        """

        try:

            searchedtype = self.search_state[1][-1]

        except IndexError:

            return False # no searching for association

        for etype in rset.column_types(0):

            if etype != searchedtype:

                return False

        return True

    def update_breadcrumbs(self):

        """stores the last visisted page in session data"""

        searchstate = self.session.data.get('search_state')

        if searchstate == 'normal':

            breadcrumbs = self.session.data.get('breadcrumbs')

            if breadcrumbs is None:

                breadcrumbs = SizeConstrainedList(10)

                self.session.data['breadcrumbs'] = breadcrumbs

                breadcrumbs.append(self.url())