# copyright 2003-2011 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""abstract class for http request"""

__docformat__ = "restructuredtext en"

import time

import random

import base64

from hashlib import sha1 # pylint: disable=E0611

from Cookie import SimpleCookie

from calendar import timegm

from datetime import date

from urlparse import urlsplit

from itertools import count

from warnings import warn

from rql.utils import rqlvar_maker

from logilab.common.decorators import cached

from logilab.common.deprecation import deprecated

from logilab.mtconverter import xml_escape

from cubicweb.dbapi import DBAPIRequest

from cubicweb.mail import header

from cubicweb.uilib import remove_html_tags, js

from cubicweb.utils import SizeConstrainedList, HTMLHead, make_uid

from cubicweb.view import STRICT_DOCTYPE, TRANSITIONAL_DOCTYPE_NOEXT

from cubicweb.web import (INTERNAL_FIELD_VALUE, LOGGER, NothingToEdit,

                          RequestError, StatusResponse)

from cubicweb.web.httpcache import GMTOFFSET

from cubicweb.web.http_headers import Headers, Cookie

_MARKER = object()

def build_cb_uid(seed):

    sha = sha1('%s%s%s' % (time.time(), seed, random.random()))

    return 'cb_%s' % (sha.hexdigest())

def list_form_param(form, param, pop=False):

    """get param from form parameters and return its value as a list,

    skipping internal markers if any

    * if the parameter isn't defined, return an empty list

    * if the parameter is a single (unicode) value, return a list

      containing that value

    * if the parameter is already a list or tuple, just skip internal

      markers

    if pop is True, the parameter is removed from the form dictionnary

    """

    if pop:

        try:

            value = form.pop(param)

        except KeyError:

            return []

    else:

        value = form.get(param, ())

    if value is None:

        value = ()

    elif not isinstance(value, (list, tuple)):

        value = [value]

    return [v for v in value if v != INTERNAL_FIELD_VALUE]

class CubicWebRequestBase(DBAPIRequest):

    """abstract HTTP request, should be extended according to the HTTP backend"""

    ajax_request = False # to be set to True by ajax controllers

    def __init__(self, vreg, https, form=None):

        super(CubicWebRequestBase, self).__init__(vreg)

        self.https = https

        if https:

            self.uiprops = vreg.config.https_uiprops

            self.datadir_url = vreg.config.https_datadir_url

        else:

            self.uiprops = vreg.config.uiprops

            self.datadir_url = vreg.config.datadir_url

        # raw html headers that can be added from any view

        self.html_headers = HTMLHead(self)

        # form parameters

        self.setup_params(form)

        # dictionnary that may be used to store request data that has to be

        # shared among various components used to publish the request (views,

        # controller, application...)

        self.data = {}

        # search state: 'normal' or 'linksearch' (eg searching for an object

        # to create a relation with another)

        self.search_state = ('normal',)

        # page id, set by htmlheader template

        self.pageid = None

        self._set_pageid()

        # prepare output header

        self.headers_out = Headers()

    def _set_pageid(self):

        """initialize self.pageid

        if req.form provides a specific pageid, use it, otherwise build a

        new one.

        """

        pid = self.form.get('pageid')

        if pid is None:

            pid = make_uid(id(self))

            self.html_headers.define_var('pageid', pid, override=False)

        self.pageid = pid

    def _get_json_request(self):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        return self.ajax_request

    def _set_json_request(self, value):

        warn('[3.15] self._cw.json_request is deprecated, use self._cw.ajax_request instead',

             DeprecationWarning, stacklevel=2)

        self.ajax_request = value

    json_request = property(_get_json_request, _set_json_request)

    @property

    def authmode(self):

        return self.vreg.config['auth-mode']

    @property

    def varmaker(self):

        """the rql varmaker is exposed both as a property and as the

        set_varmaker function since we've two use cases:

        * accessing the req.varmaker property to get a new variable name

        * calling req.set_varmaker() to ensure a varmaker is set for later ajax

          calls sharing our .pageid

        """

        return self.set_varmaker()

    def next_tabindex(self):

        nextfunc = self.get_page_data('nexttabfunc')

        if nextfunc is None:

            nextfunc = count(1).next

            self.set_page_data('nexttabfunc', nextfunc)

        return nextfunc()

    def set_varmaker(self):

        varmaker = self.get_page_data('rql_varmaker')

        if varmaker is None:

            varmaker = rqlvar_maker()

            self.set_page_data('rql_varmaker', varmaker)

        return varmaker

    def set_session(self, session, user=None):

        """method called by the session handler when the user is authenticated

        or an anonymous connection is open

        """

        super(CubicWebRequestBase, self).set_session(session, user)

        # set request language

        vreg = self.vreg

        if self.user:

            try:

                # 1. user specified language

                lang = vreg.typed_value('ui.language',

                                        self.user.properties['ui.language'])

                self.set_language(lang)

                return

            except KeyError:

                pass

        if vreg.config['language-negociation']:

            # 2. http negociated language

            for lang in self.header_accept_language():

                if lang in self.translations:

                    self.set_language(lang)

                    return

        # 3. default language

        self.set_default_language(vreg)

    def set_language(self, lang):

        gettext, self.pgettext = self.translations[lang]

        self._ = self.__ = gettext

        self.lang = lang

        self.debug('request language: %s', lang)

        if self.cnx:

            self.cnx.set_session_props(lang=lang)

    # input form parameters management ########################################

    # common form parameters which should be protected against html values

    # XXX can't add 'eid' for instance since it may be multivalued

    # dont put rql as well, if query contains < and > it will be corrupted!

    no_script_form_params = set(('vid',

                                 'etype',

                                 'vtitle', 'title',

                                 '__message',

                                 '__redirectvid', '__redirectrql'))

    def setup_params(self, params):

        """WARNING: we're intentionaly leaving INTERNAL_FIELD_VALUE here

        subclasses should overrides to

        """

        self.form = {}

        if params is None:

            return

        encoding = self.encoding

        for param, val in params.iteritems():

            if isinstance(val, (tuple, list)):

                val = [unicode(x, encoding) for x in val]

                if len(val) == 1:

                    val = val[0]

            elif isinstance(val, str):

                val = unicode(val, encoding)

            if param in self.no_script_form_params and val:

                val = self.no_script_form_param(param, val)

            if param == '_cwmsgid':

                self.set_message_id(val)

            elif param == '__message':

                warn('[3.13] __message in request parameter is deprecated (may '

                     'only be given to .build_url). Seeing this message usualy '

                     'means your application hold some <form> where you should '

                     'replace use of __message hidden input by form.set_message, '

                     'so new _cwmsgid mechanism is properly used',

                     DeprecationWarning)

                self.set_message(val)

            else:

                self.form[param] = val

    def no_script_form_param(self, param, value):

        """ensure there is no script in a user form param

        by default return a cleaned string instead of raising a security

        exception

        this method should be called on every user input (form at least) fields

        that are at some point inserted in a generated html page to protect

        against script kiddies

        """

        # safety belt for strange urls like http://...?vtitle=yo&vtitle=yo

        if isinstance(value, (list, tuple)):

            self.error('no_script_form_param got a list (%s). Who generated the URL ?',

                       repr(value))

            value = value[0]

        return remove_html_tags(value)

    def list_form_param(self, param, form=None, pop=False):

        """get param from form parameters and return its value as a list,

        skipping internal markers if any

        * if the parameter isn't defined, return an empty list

        * if the parameter is a single (unicode) value, return a list

          containing that value

        * if the parameter is already a list or tuple, just skip internal

          markers

        if pop is True, the parameter is removed from the form dictionnary

        """

        if form is None:

            form = self.form

        return list_form_param(form, param, pop)

    def reset_headers(self):

        """used by AutomaticWebTest to clear html headers between tests on

        the same resultset

        """

        self.html_headers = HTMLHead(self)

        return self

    # web state helpers #######################################################

    @property

    def message(self):

        try:

            return self.session.data.pop(self._msgid, u'')

        except AttributeError:

            try:

                return self._msg

            except AttributeError:

                return None

    def set_message(self, msg):

        assert isinstance(msg, unicode)

        self._msg = msg

    def set_message_id(self, msgid):

        self._msgid = msgid

    @cached

    def redirect_message_id(self):

        return make_uid()

    def set_redirect_message(self, msg):

        # TODO - this should probably be merged with append_to_redirect_message

        assert isinstance(msg, unicode)

        msgid = self.redirect_message_id()

        self.session.data[msgid] = msg

        return msgid

    def append_to_redirect_message(self, msg):

        msgid = self.redirect_message_id()

        currentmsg = self.session.data.get(msgid)

        if currentmsg is not None:

            currentmsg = u'%s %s' % (currentmsg, msg)

        else:

            currentmsg = msg

        self.session.data[msgid] = currentmsg

        return msgid

    def reset_message(self):

        if hasattr(self, '_msg'):

            del self._msg

        if hasattr(self, '_msgid'):

            del self._msgid

    def update_search_state(self):

        """update the current search state"""

        searchstate = self.form.get('__mode')

        if not searchstate and self.cnx:

            searchstate = self.session.data.get('search_state', 'normal')

        self.set_search_state(searchstate)

    def set_search_state(self, searchstate):

        """set a new search state"""

        if searchstate is None or searchstate == 'normal':

            self.search_state = (searchstate or 'normal',)

        else:

            self.search_state = ('linksearch', searchstate.split(':'))

            assert len(self.search_state[-1]) == 4

        if self.cnx:

            self.session.data['search_state'] = searchstate

    def match_search_state(self, rset):

        """when searching an entity to create a relation, return True if entities in

        the given rset may be used as relation end

        """

        try:

            searchedtype = self.search_state[1][-1]

        except IndexError:

            return False # no searching for association

        for etype in rset.column_types(0):

            if etype != searchedtype:

                return False

        return True

    def update_breadcrumbs(self):

        """stores the last visisted page in session data"""

        searchstate = self.session.data.get('search_state')

        if searchstate == 'normal':

            breadcrumbs = self.session.data.get('breadcrumbs')

            if breadcrumbs is None:

                breadcrumbs = SizeConstrainedList(10)

                self.session.data['breadcrumbs'] = breadcrumbs

                breadcrumbs.append(self.url())

            else:

                url = self.url()

                if breadcrumbs and breadcrumbs[-1] != url:

                    breadcrumbs.append(url)

    def last_visited_page(self):

        breadcrumbs = self.session.data.get('breadcrumbs')

        if breadcrumbs:

            return breadcrumbs.pop()

        return self.base_url()

    def user_rql_callback(self, rqlargs, *args, **kwargs):

        """register a user callback to execute some rql query, and return a URL

        to call that callback which can be inserted in an HTML view.

        `rqlargs` should be a tuple containing argument to give to the execute function.

        The first argument following rqlargs must be the message to be

        displayed after the callback is called.

        For other allowed arguments, see :meth:`user_callback` method

        """

        def rqlexec(req, rql, args=None, key=None):

            req.execute(rql, args, key)

        return self.user_callback(rqlexec, rqlargs, *args, **kwargs)

    def user_callback(self, cb, cbargs, *args, **kwargs):

        """register the given user callback and return a URL which can

        be inserted in an HTML view. When the URL is accessed, the

        callback function will be called (as 'cb(req, \*cbargs)', and a

        message will be displayed in the web interface. The third