# copyright 2003-2012 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""cubicweb.server.sources.ldapusers unit and functional tests"""

import os

import shutil

import time

from os.path import join, exists

import subprocess

import tempfile

from logilab.common.testlib import TestCase, unittest_main, mock_object, Tags

from cubicweb import AuthenticationError

from cubicweb.devtools.testlib import CubicWebTC

from cubicweb.devtools.repotest import RQLGeneratorTC

from cubicweb.devtools.httptest import get_available_port

from cubicweb.devtools import get_test_db_handler

from cubicweb.server.sources.ldapuser import GlobTrFunc, UnknownEid, RQL2LDAPFilter

URL = None

def create_slapd_configuration(cls):

    global URL

    slapddir = tempfile.mkdtemp('cw-unittest-ldap')

    config = cls.config

    slapdconf = join(config.apphome, "slapd.conf")

    confin = file(join(config.apphome, "slapd.conf.in")).read()

    confstream = file(slapdconf, 'w')

    confstream.write(confin % {'apphome': config.apphome, 'testdir': slapddir})

    confstream.close()

    # fill ldap server with some data

    ldiffile = join(config.apphome, "ldap_test.ldif")

    config.info('Initing ldap database')

    cmdline = "/usr/sbin/slapadd -f %s -l %s -c" % (slapdconf, ldiffile)

    subprocess.call(cmdline, shell=True)

    #ldapuri = 'ldapi://' + join(basedir, "ldapi").replace('/', '%2f')

    port = get_available_port(xrange(9000, 9100))

    host = 'localhost:%s' % port

    ldapuri = 'ldap://%s' % host

    cmdline = ["/usr/sbin/slapd", "-f",  slapdconf,  "-h",  ldapuri, "-d", "0"]

    config.info('Starting slapd:', ' '.join(cmdline))

    cls.slapd_process = subprocess.Popen(cmdline)

    time.sleep(0.2)

    if cls.slapd_process.poll() is None:

    else:

        raise EnvironmentError('Cannot start slapd with cmdline="%s" (from directory "%s")' %

                               (" ".join(cmdline), os.getcwd()))

    URL = u'ldap://%s' % host

    return slapddir

def terminate_slapd(cls):

    config = cls.config

    if cls.slapd_process and cls.slapd_process.returncode is None:

        config.info('terminating slapd')

        if hasattr(cls.slapd_process, 'terminate'):

            cls.slapd_process.terminate()

        else:

            import os, signal

            os.kill(cls.slapd_process.pid, signal.SIGTERM)

        cls.slapd_process.wait()

        config.info('DONE')

class LDAPTestBase(CubicWebTC):

    loglevel = 'ERROR'

    @classmethod

    def setUpClass(cls):

        from cubicweb.cwctl import init_cmdline_log_threshold

        init_cmdline_log_threshold(cls.config, cls.loglevel)

        cls._tmpdir = create_slapd_configuration(cls)

    @classmethod

    def tearDownClass(cls):

        terminate_slapd(cls)

        try:

            shutil.rmtree(cls._tmpdir)

        except:

            pass

class CheckWrongGroup(LDAPTestBase):

    def test_wrong_group(self):

        self.commit()

        with self.session.repo.internal_session(safe=True) as session:

            source = self.session.execute('CWSource S WHERE S type="ldapfeed"').get_entity(0,0)

            config = source.repo_source.check_config(source)

            # inject a bogus group here, along with at least a valid one

            config['user-default-group'] = ('thisgroupdoesnotexists','users')

            source.repo_source.update_config(source, config)

            session.commit(free_cnxset=False)

            # here we emitted an error log entry

            stats = source.repo_source.pull_data(session, force=True, raise_on_error=True)

            session.commit()

class DeleteStuffFromLDAPFeedSourceTC(LDAPTestBase):

    test_db_id = 'ldap-feed'

    @classmethod

    def pre_setup_database(cls, session, config):

        session.commit()

        with session.repo.internal_session(safe=True) as isession:

            stats = lfsource.pull_data(isession, force=True, raise_on_error=True)

    def _pull(self):

        with self.session.repo.internal_session() as isession:

            stats = lfsource.pull_data(isession, force=True, raise_on_error=True)

            isession.commit()

    def test_a_filter_inactivate(self):

        """ filtered out people should be deactivated, unable to authenticate """

        source = self.session.execute('CWSource S WHERE S type="ldapfeed"').get_entity(0,0)

        config = source.repo_source.check_config(source)

        # filter with adim's phone number

        config['user-filter'] = u'(%s=%s)' % ('telephoneNumber', '109')

        source.repo_source.update_config(source, config)

        self.commit()

        self._pull()

        self.assertRaises(AuthenticationError, self.repo.connect, 'syt', password='syt')

        self.assertEqual(self.execute('Any N WHERE U login "syt", '

                                      'U in_state S, S name N').rows[0][0],

                         'deactivated')

        self.assertEqual(self.execute('Any N WHERE U login "adim", '

                                      'U in_state S, S name N').rows[0][0],

                         'activated')

        # unfilter, syt should be activated again

        config['user-filter'] = u''

        source.repo_source.update_config(source, config)

        self.commit()

        self._pull()

        self.assertEqual(self.execute('Any N WHERE U login "syt", '

                                      'U in_state S, S name N').rows[0][0],

                         'activated')

        self.assertEqual(self.execute('Any N WHERE U login "adim", '

                                      'U in_state S, S name N').rows[0][0],

                         'activated')

    def test_delete(self):

        """ delete syt, pull, check deactivation, repull,

        readd syt, pull, check activation

        """

        deletecmd = ("ldapdelete -H %s 'uid=syt,ou=People,dc=cubicweb,dc=test' "

                     "-v -x -D cn=admin,dc=cubicweb,dc=test -w'cw'" % uri)

        os.system(deletecmd)

        self._pull()

        self.assertRaises(AuthenticationError, self.repo.connect, 'syt', password='syt')

        self.assertEqual(self.execute('Any N WHERE U login "syt", '

                                      'U in_state S, S name N').rows[0][0],

                         'deactivated')

        # check that it doesn't choke

        self._pull()

        # reset the fscking ldap thing

        self.tearDownClass()

        self.setUpClass()

        self._pull()

        self.assertEqual(self.execute('Any N WHERE U login "syt", '

                                      'U in_state S, S name N').rows[0][0],

                         'activated')

        # test reactivating the user isn't enough to authenticate, as the native source

        # refuse to authenticate user from other sources

        os.system(deletecmd)

        self._pull()

        user = self.execute('CWUser U WHERE U login "syt"').get_entity(0, 0)

        user.cw_adapt_to('IWorkflowable').fire_transition('activate')

        self.commit()

        self.assertRaises(AuthenticationError, self.repo.connect, 'syt', password='syt')

class LDAPFeedSourceTC(LDAPTestBase):

    test_db_id = 'ldap-feed'

    @classmethod

    def pre_setup_database(cls, session, config):

        session.commit()

        isession = session.repo.internal_session(safe=True)

        stats = lfsource.pull_data(isession, force=True, raise_on_error=True)

    def setUp(self):

        super(LDAPFeedSourceTC, self).setUp()

        # ldap source url in the database may use a different port as the one

        # just attributed

        lfsource.urls = [URL]

    def assertMetadata(self, entity):

        self.assertTrue(entity.creation_date)

        self.assertTrue(entity.modification_date)

    def test_authenticate(self):

        self.session.set_cnxset()

        # ensure we won't be logged against

        self.assertRaises(AuthenticationError,

                          source.authenticate, self.session, 'toto', 'toto')

        self.assertTrue(source.authenticate(self.session, 'syt', 'syt'))

        self.assertTrue(self.repo.connect('syt', password='syt'))

    def test_base(self):

        # check a known one

        rset = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})

        e = rset.get_entity(0, 0)

        self.assertEqual(e.login, 'syt')

        e.complete()

        self.assertMetadata(e)

        self.assertEqual(e.firstname, None)

        self.assertEqual(e.surname, None)

        self.assertEqual(e.in_group[0].name, 'users')

        self.assertEqual(e.owned_by[0].login, 'syt')

        self.assertEqual(e.created_by, ())

        self.assertEqual(e.primary_email[0].address, 'Sylvain Thenault')

        # email content should be indexed on the user

        rset = self.sexecute('CWUser X WHERE X has_text "thenault"')

        self.assertEqual(rset.rows, [[e.eid]])

    def test_copy_to_system_source(self):

        eid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})[0][0]

        self.sexecute('SET X cw_source S WHERE X eid %(x)s, S name "system"', {'x': eid})

        self.commit()

        source.reset_caches()

        rset = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})

        self.assertEqual(len(rset), 1)

        e = rset.get_entity(0, 0)

        self.assertEqual(e.eid, eid)

        self.assertEqual(e.cw_metainformation(), {'source': {'type': u'native',

                                                             'uri': u'system',

                                                             'use-cwuri-as-url': False},

                                                  'type': 'CWUser',

                                                  'extid': None})

        self.assertEqual(e.cw_source[0].name, 'system')

        self.assertTrue(e.creation_date)

        self.assertTrue(e.modification_date)

        source.pull_data(self.session)

        rset = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})

        self.assertEqual(len(rset), 1)

        self.assertTrue(self.repo.system_source.authenticate(

                self.session, 'syt', password='syt'))

class LDAPUserSourceTC(LDAPFeedSourceTC):

    test_db_id = 'ldap-user'

    tags = CubicWebTC.tags | Tags(('ldap'))

    @classmethod

    def pre_setup_database(cls, session, config):

        session.commit()

        # XXX keep it there

        session.execute('CWUser U')

    def assertMetadata(self, entity):

        self.assertEqual(entity.creation_date, None)

        self.assertEqual(entity.modification_date, None)

    def test_synchronize(self):

        source.synchronize()

    def test_base(self):

        # check a known one

        rset = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})

        e = rset.get_entity(0, 0)

        self.assertEqual(e.login, 'syt')

        e.complete()

        self.assertMetadata(e)

        self.assertEqual(e.firstname, None)

        self.assertEqual(e.surname, None)

        self.assertEqual(e.in_group[0].name, 'users')

        self.assertEqual(e.owned_by[0].login, 'syt')

        self.assertEqual(e.created_by, ())

        self.assertEqual(e.primary_email[0].address, 'Sylvain Thenault')

        # email content should be indexed on the user

        rset = self.sexecute('CWUser X WHERE X has_text "thenault"')

        self.assertEqual(rset.rows, [[e.eid]])

    def test_not(self):

        eid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})[0][0]

        rset = self.sexecute('CWUser X WHERE NOT X eid %s' % eid)

        self.assert_(rset)

        self.assert_(not eid in (r[0] for r in rset))

    def test_multiple(self):

        seid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})[0][0]

        aeid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'adim'})[0][0]

        rset = self.sexecute('CWUser X, Y WHERE X login %(syt)s, Y login %(adim)s',

                            {'syt': 'syt', 'adim': 'adim'})

        self.assertEqual(rset.rows, [[seid, aeid]])

        rset = self.sexecute('Any X,Y,L WHERE X login L, X login %(syt)s, Y login %(adim)s',

                            {'syt': 'syt', 'adim': 'adim'})

        self.assertEqual(rset.rows, [[seid, aeid, 'syt']])

    def test_in(self):

        seid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})[0][0]

        aeid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'adim'})[0][0]

        rset = self.sexecute('Any X,L ORDERBY L WHERE X login IN("%s", "%s"), X login L' % ('syt', 'adim'))

        self.assertEqual(rset.rows, [[aeid, 'adim'], [seid, 'syt']])

    def test_relations(self):

        eid = self.sexecute('CWUser X WHERE X login %(login)s', {'login': 'syt'})[0][0]

        rset = self.sexecute('Any X,E WHERE X is CWUser, X login L, X primary_email E')

        self.assert_(eid in (r[0] for r in rset))

        rset = self.sexecute('Any X,L,E WHERE X is CWUser, X login L, X primary_email E')

        self.assert_('syt' in (r[1] for r in rset))

    def test_count(self):

        nbusers = self.sexecute('Any COUNT(X) WHERE X is CWUser')[0][0]

        # just check this is a possible number

        self.assert_(nbusers > 1, nbusers)

        self.assert_(nbusers < 30, nbusers)

    def test_upper(self):