# copyright 2003-2014 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""abstract class for http request"""

__docformat__ = "restructuredtext en"

import time

import random

import base64

from hashlib import sha1 # pylint: disable=E0611

from calendar import timegm

from datetime import date, datetime

from warnings import warn

from io import BytesIO

from six import PY2, binary_type, text_type, string_types

from six.moves import http_client

from six.moves.urllib.parse import urlsplit, quote as urlquote

from six.moves.http_cookies import SimpleCookie

from rql.utils import rqlvar_maker

from logilab.common.decorators import cached

from logilab.common.deprecation import deprecated

from logilab.mtconverter import xml_escape

from cubicweb import AuthenticationError

from cubicweb.req import RequestSessionBase

from cubicweb.uilib import remove_html_tags, js

from cubicweb.utils import SizeConstrainedList, HTMLHead, make_uid

from cubicweb.view import TRANSITIONAL_DOCTYPE_NOEXT

from cubicweb.web import (INTERNAL_FIELD_VALUE, LOGGER, NothingToEdit,

                          RequestError, StatusResponse)

from cubicweb.web.httpcache import get_validators

from cubicweb.web.http_headers import Headers, Cookie, parseDateTime

_MARKER = object()

def build_cb_uid(seed):

    sha = sha1(('%s%s%s' % (time.time(), seed, random.random())).encode('ascii'))

    return 'cb_%s' % (sha.hexdigest())

def list_form_param(form, param, pop=False):

    """get param from form parameters and return its value as a list,

    skipping internal markers if any

    * if the parameter isn't defined, return an empty list

    * if the parameter is a single (unicode) value, return a list

      containing that value

    * if the parameter is already a list or tuple, just skip internal

      markers

    if pop is True, the parameter is removed from the form dictionary

    """

    if pop:

        try:

            value = form.pop(param)

        except KeyError:

            return []

    else:

        value = form.get(param, ())

    if value is None:

        value = ()

    elif not isinstance(value, (list, tuple)):

        value = [value]

    return [v for v in value if v != INTERNAL_FIELD_VALUE]

class Counter(object):

    """A picklable counter object, usable for e.g. page tab index count"""

    __slots__ = ('value',)

    def __init__(self, initialvalue=0):

        self.value = initialvalue

    def __call__(self):

        value = self.value

        self.value += 1

        return value

    def __getstate__(self):

        return {'value': self.value}

    def __setstate__(self, state):

        self.value = state['value']

class _CubicWebRequestBase(RequestSessionBase):

    """abstract HTTP request, should be extended according to the HTTP backend

    Immutable attributes that describe the received query and generic configuration

    """

    ajax_request = False # to be set to True by ajax controllers

    def __init__(self, vreg, https=False, form=None, headers=None):

        """

        :vreg: Vregistry,

        :https: boolean, s this a https request

        :form: Forms value

        :headers: dict, request header

        """

        super(_CubicWebRequestBase, self).__init__(vreg)

        #: (Boolean) Is this an https request.

        self.https = https

        #: User interface property (vary with https) (see :ref:`uiprops`)

        self.uiprops = None

        #: url for serving datadir (vary with https) (see :ref:`resources`)

        self.datadir_url = None

        if https and vreg.config.https_uiprops is not None:

            self.uiprops = vreg.config.https_uiprops

        else:

            self.uiprops = vreg.config.uiprops

        if https and vreg.config.https_datadir_url is not None:

            self.datadir_url = vreg.config.https_datadir_url

        else:

            self.datadir_url = vreg.config.datadir_url

        #: enable UStringIO's write tracing

        self.tracehtml = False

        if vreg.config.debugmode:

            self.tracehtml = bool(form.pop('_cwtracehtml', False))

        #: raw html headers that can be added from any view

        self.html_headers = HTMLHead(self, tracewrites=self.tracehtml)

        #: received headers

        self._headers_in = Headers()

        if headers is not None:

            for k, v in headers.items():

                self._headers_in.addRawHeader(k, v)

        #: form parameters

        self.setup_params(form)

        #: received body

        self.content = BytesIO()

        # prepare output header

        #: Header used for the final response

        self.headers_out = Headers()

        #: HTTP status use by the final response

        self.status_out  = 200

        # set up language based on request headers or site default (we don't

        # have a user yet, and might not get one)

        self.set_user_language(None)

        #: dictionary that may be used to store request data that has to be

        #: shared among various components used to publish the request (views,

        #: controller, application...)

        self.data = {}

        self._search_state = None

        #: page id, set by htmlheader template

        self.pageid = None

        self._set_pageid()

    def _set_pageid(self):

        """initialize self.pageid

        if req.form provides a specific pageid, use it, otherwise build a

        new one.

        """

        pid = self.form.get('pageid')

        if pid is None:

            pid = make_uid(id(self))

            self.html_headers.define_var('pageid', pid, override=False)

        self.pageid = pid

    def _get_json_request(self):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        return self.ajax_request

    def _set_json_request(self, value):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        self.ajax_request = value

    json_request = property(_get_json_request, _set_json_request)

    def _base_url(self, secure=None):

        """return the root url of the instance

        secure = False -> base-url

        secure = None  -> https-url if req.https

        secure = True  -> https if it exist

        """

        if secure is None:

            secure = self.https

        base_url = None

        if secure:

            base_url = self.vreg.config.get('https-url')

        if base_url is None:

            base_url = super(_CubicWebRequestBase, self)._base_url()

        return base_url

    @property

    def authmode(self):

        """Authentification mode of the instance

        (see :ref:`WebServerConfig`)"""

        return self.vreg.config['auth-mode']

    # Various variable generator.

    @property

    def varmaker(self):

        """the rql varmaker is exposed both as a property and as the

        set_varmaker function since we've two use cases:

        * accessing the req.varmaker property to get a new variable name

        * calling req.set_varmaker() to ensure a varmaker is set for later ajax

          calls sharing our .pageid

        """

        return self.set_varmaker()

    def next_tabindex(self):

        nextfunc = self.get_page_data('nexttabfunc')

        if nextfunc is None:

            nextfunc = Counter(1)

            self.set_page_data('nexttabfunc', nextfunc)

        return nextfunc()

    def set_varmaker(self):

        varmaker = self.get_page_data('rql_varmaker')

        if varmaker is None:

            varmaker = rqlvar_maker()

            self.set_page_data('rql_varmaker', varmaker)

        return varmaker

    # input form parameters management ########################################

    # common form parameters which should be protected against html values

    # XXX can't add 'eid' for instance since it may be multivalued

    # dont put rql as well, if query contains < and > it will be corrupted!

    no_script_form_params = set(('vid',

                                 'etype',

                                 'vtitle', 'title',

                                 '__redirectvid', '__redirectrql'))

    def setup_params(self, params):

        subclasses should overrides to

        """

        self.form = {}

        if params is None:

            return

        encoding = self.encoding

        for param, val in params.items():

            if isinstance(val, (tuple, list)):

                if PY2:

                    val = [unicode(x, encoding) for x in val]

                if len(val) == 1:

                    val = val[0]

            elif PY2 and isinstance(val, str):

                val = unicode(val, encoding)

            if param in self.no_script_form_params and val:

                val = self.no_script_form_param(param, val)

            if param == '_cwmsgid':

                self.set_message_id(val)

            else:

                self.form[param] = val

    def no_script_form_param(self, param, value):

        """ensure there is no script in a user form param

        by default return a cleaned string instead of raising a security

        exception

        this method should be called on every user input (form at least) fields

        that are at some point inserted in a generated html page to protect

        against script kiddies

        """

        # safety belt for strange urls like http://...?vtitle=yo&vtitle=yo

        if isinstance(value, (list, tuple)):

            self.error('no_script_form_param got a list (%s). Who generated the URL ?',

                       repr(value))

            value = value[0]

        return remove_html_tags(value)

    def list_form_param(self, param, form=None, pop=False):

        """get param from form parameters and return its value as a list,

        skipping internal markers if any

        * if the parameter isn't defined, return an empty list

        * if the parameter is a single (unicode) value, return a list

          containing that value

        * if the parameter is already a list or tuple, just skip internal

          markers

        if pop is True, the parameter is removed from the form dictionary

        """

        if form is None:

            form = self.form

        return list_form_param(form, param, pop)

    def reset_headers(self):

        """used by AutomaticWebTest to clear html headers between tests on

        the same resultset

        """

        self.html_headers = HTMLHead(self)

        return self

    # web state helpers #######################################################

    @property

    def message(self):

        try:

            return self.session.data.pop(self._msgid, u'')

        except AttributeError:

            try:

                return self._msg

            except AttributeError:

                return None

    def set_message(self, msg):

        assert isinstance(msg, text_type)

        self.reset_message()

        self._msg = msg

    def set_message_id(self, msgid):

        self._msgid = msgid

    @cached

    def redirect_message_id(self):

        return make_uid()

    def set_redirect_message(self, msg):

        # TODO - this should probably be merged with append_to_redirect_message

        assert isinstance(msg, text_type)

        msgid = self.redirect_message_id()

        self.session.data[msgid] = msg

        return msgid

    def append_to_redirect_message(self, msg):

        msgid = self.redirect_message_id()

        currentmsg = self.session.data.get(msgid)

        if currentmsg is not None:

            currentmsg = u'%s %s' % (currentmsg, msg)

        else:

            currentmsg = msg

        self.session.data[msgid] = currentmsg

        return msgid

    def reset_message(self):

        if hasattr(self, '_msg'):

            del self._msg

        if hasattr(self, '_msgid'):

            self.session.data.pop(self._msgid, u'')

            del self._msgid

    def _load_search_state(self, searchstate):

        if searchstate is None or searchstate == 'normal':

            self._search_state = ('normal',)

        else:

            self._search_state = ('linksearch', searchstate.split(':'))

            assert len(self._search_state[-1]) == 4, 'invalid searchstate'

    @property

    def search_state(self):

        """search state: 'normal' or 'linksearch' (i.e. searching for an object

        to create a relation with another)"""

        if self._search_state is None:

            searchstate = self.session.data.get('search_state', 'normal')

            self._load_search_state(searchstate)

        return self._search_state

    @search_state.setter

    def search_state(self, searchstate):

        self._search_state = searchstate

    def update_search_state(self):

        """update the current search state if needed"""

        searchstate = self.form.get('__mode')

        if searchstate:

            self.set_search_state(searchstate)

    def set_search_state(self, searchstate):

        """set a new search state"""

        self.session.data['search_state'] = searchstate

        self._load_search_state(searchstate)

    def match_search_state(self, rset):

        """when searching an entity to create a relation, return True if entities in

        the given rset may be used as relation end

        """

        try:

            searchedtype = self.search_state[1][-1]