from __future__ import division # XXX why?

from datetime import datetime

from ldap.ldapobject import ReconnectLDAPObject

from ldapurl import LDAPUrl

from cubicweb import ValidationError, AuthenticationError, Binary

from cubicweb.server import utils

BASE = ldap.SCOPE_BASE

ONELEVEL = ldap.SCOPE_ONELEVEL

SUBTREE = ldap.SCOPE_SUBTREE

LDAP_SCOPES = {'BASE': ldap.SCOPE_BASE,

               'ONELEVEL': ldap.SCOPE_ONELEVEL,

               'SUBTREE': ldap.SCOPE_SUBTREE}

# map ldap protocol to their standard port

PROTO_PORT = {'ldap': 389,

              'ldaps': 636,

              'ldapi': None,

              }

class ConnectionWrapper(object):

    def __init__(self, cnx=None):

        self.cnx = cnx

    def commit(self):

        pass

    def rollback(self):

        pass

    def cursor(self):

        return None # no actual cursor support

    def close(self):

        if hasattr(self.cnx, 'close'):

            self.cnx.close()

class LDAPFeedSource(datafeed.DataFeedSource):

    options = (

        ('auth-mode',

         {'type' : 'choice',

          'default': 'simple',

          'choices': ('simple', 'cram_md5', 'digest_md5', 'gssapi'),

          'help': 'authentication mode used to authenticate user to the ldap.',

          'group': 'ldap-source', 'level': 3,

          }),

        ('auth-realm',

         {'type' : 'string',

          'default': None,

          'help': 'realm to use when using gssapi/kerberos authentication.',

          'group': 'ldap-source', 'level': 3,

          }),

        ('data-cnx-dn',

         {'type' : 'string',

          'default': '',

          'help': 'user dn to use to open data connection to the ldap (eg used \

to respond to rql queries). Leave empty for anonymous bind',

          'group': 'ldap-source', 'level': 1,

          }),

        ('data-cnx-password',

         {'type' : 'string',

          'default': '',

          'help': 'password to use to open data connection to the ldap (eg used to respond to rql queries). Leave empty for anonymous bind.',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-base-dn',

         {'type' : 'string',

          'default': '',

          'help': 'base DN to lookup for users; disable user importation mechanism if unset',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-scope',

         {'type' : 'choice',

          'default': 'ONELEVEL',

          'choices': ('BASE', 'ONELEVEL', 'SUBTREE'),

          'help': 'user search scope (valid values: "BASE", "ONELEVEL", "SUBTREE")',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-classes',

         {'type' : 'csv',

          'default': ('top', 'posixAccount'),

          'help': 'classes of user (with Active Directory, you want to say "user" here)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-filter',

         {'type': 'string',

          'default': '',

          'help': 'additional filters to be set in the ldap query to find valid users',

          'group': 'ldap-source', 'level': 2,

          }),

        ('user-login-attr',

         {'type' : 'string',

          'default': 'uid',

          'help': 'attribute used as login on authentication (with Active Directory, you want to use "sAMAccountName" here)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-default-group',

         {'type' : 'csv',

          'default': ('users',),

          'help': 'name of a group in which ldap users will be by default. \

You can set multiple groups by separating them by a comma.',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-attrs-map',

         {'type' : 'named',

          'default': {'uid': 'login', 'gecos': 'email', 'userPassword': 'upassword'},

          'help': 'map from ldap user attributes to cubicweb attributes (with Active Directory, you want to use sAMAccountName:login,mail:email,givenName:firstname,sn:surname)',

          'group': 'ldap-source', 'level': 1,

          }),

    options = merge_options(datafeed.DataFeedSource.options + options,

    _conn = None

        self.authmode = typedconfig['auth-mode']

        self._authenticate = getattr(self, '_auth_%s' % self.authmode)

        self.cnx_dn = typedconfig['data-cnx-dn']

        self.cnx_pwd = typedconfig['data-cnx-password']

        self.user_base_dn = str(typedconfig['user-base-dn'])

        self.user_base_scope = globals()[typedconfig['user-scope']]

        self.user_login_attr = typedconfig['user-login-attr']

        self.user_default_groups = typedconfig['user-default-group']

        self.user_attrs = {'dn': 'eid', 'modifyTimestamp': 'modification_date'}

        self.user_attrs.update(typedconfig['user-attrs-map'])

        self.user_rev_attrs = dict((v, k) for k, v in self.user_attrs.iteritems())

        self.base_filters = [filter_format('(%s=%s)', ('objectClass', o))

                             for o in typedconfig['user-classes']]

        if typedconfig['user-filter']:

            self.base_filters.append(typedconfig['user-filter'])

        self.group_base_scope = LDAP_SCOPES[typedconfig['group-scope']]

        self._conn = None

    def _entity_update(self, source_entity):

        super(LDAPFeedSource, self)._entity_update(source_entity)

        if self.urls:

            if len(self.urls) > 1:

                raise ValidationError(source_entity.eid, {'url': _('can only have one url')})

            try:

                protocol, hostport = self.urls[0].split('://')

            except ValueError:

                raise ValidationError(source_entity.eid, {'url': _('badly formatted url')})

            if protocol not in PROTO_PORT:

                raise ValidationError(source_entity.eid, {'url': _('unsupported protocol')})

    def connection_info(self):

        assert len(self.urls) == 1, self.urls

        protocol, hostport = self.urls[0].split('://')

        if protocol != 'ldapi' and not ':' in hostport:

            hostport = '%s:%s' % (hostport, PROTO_PORT[protocol])

        return protocol, hostport

    def get_connection(self):

        """open and return a connection to the source"""

        if self._conn is None:

            try:

                self._connect()

            except Exception:

                self.exception('unable to connect to ldap')

        return ConnectionWrapper(self._conn)

    def authenticate(self, session, login, password=None, **kwargs):

        """return CWUser eid for the given login/password if this account is

        defined in this source, else raise `AuthenticationError`

        two queries are needed since passwords are stored crypted, so we have

        to fetch the salt first

        """

        self.info('ldap authenticate %s', login)

        if not password:

            # On Windows + ADAM this would have succeeded (!!!)

            # You get Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON'.

            # we really really don't want that

            raise AuthenticationError()

        searchfilter = [filter_format('(%s=%s)', (self.user_login_attr, login))]

        searchfilter.extend(self.base_filters)

        searchstr = '(&%s)' % ''.join(searchfilter)

        # first search the user

        try:

            user = self._search(session, self.user_base_dn,

                                self.user_base_scope, searchstr)[0]

        except (IndexError, ldap.SERVER_DOWN):

            # no such user

            raise AuthenticationError()

        # check password by establishing a (unused) connection

        try:

            self._connect(user, password)

        except ldap.LDAPError as ex:

            # Something went wrong, most likely bad credentials

            self.info('while trying to authenticate %s: %s', user, ex)

            raise AuthenticationError()

        except Exception:

            self.error('while trying to authenticate %s', user, exc_info=True)

            raise AuthenticationError()

        eid = self.repo.extid2eid(self, user['dn'], 'CWUser', session, {})

        if eid < 0:

            # user has been moved away from this source

            raise AuthenticationError()

        return eid

    def _connect(self, user=None, userpwd=None):

        protocol, hostport = self.connection_info()

        self.info('connecting %s://%s as %s', protocol, hostport,

                  user and user['dn'] or 'anonymous')

        # don't require server certificate when using ldaps (will

        # enable self signed certs)

        ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)

        url = LDAPUrl(urlscheme=protocol, hostport=hostport)

        conn = ReconnectLDAPObject(url.initializeUrl())

        # Set the protocol version - version 3 is preferred

        try:

            conn.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION3)

        except ldap.LDAPError: # Invalid protocol version, fall back safely

            conn.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION2)

        # Deny auto-chasing of referrals to be safe, we handle them instead

        # Required for AD

        try:

           conn.set_option(ldap.OPT_REFERRALS, 0)

        except ldap.LDAPError: # Cannot set referrals, so do nothing

           pass

        #conn.set_option(ldap.OPT_NETWORK_TIMEOUT, conn_timeout)

        #conn.timeout = op_timeout

        # Now bind with the credentials given. Let exceptions propagate out.

        if user is None:

            # no user specified, we want to initialize the 'data' connection,

            assert self._conn is None

            self._conn = conn

            # XXX always use simple bind for data connection

            if not self.cnx_dn:

                conn.simple_bind_s(self.cnx_dn, self.cnx_pwd)

            else:

                self._authenticate(conn, {'dn': self.cnx_dn}, self.cnx_pwd)

        else:

            # user specified, we want to check user/password, no need to return

            # the connection which will be thrown out

            self._authenticate(conn, user, userpwd)

        return conn

    def _auth_simple(self, conn, user, userpwd):

        conn.simple_bind_s(user['dn'], userpwd)

    def _auth_cram_md5(self, conn, user, userpwd):

        from ldap import sasl

        auth_token = sasl.cram_md5(user['dn'], userpwd)

        conn.sasl_interactive_bind_s('', auth_token)

    def _auth_digest_md5(self, conn, user, userpwd):

        from ldap import sasl

        auth_token = sasl.digest_md5(user['dn'], userpwd)

        conn.sasl_interactive_bind_s('', auth_token)

    def _auth_gssapi(self, conn, user, userpwd):

        # print XXX not proper sasl/gssapi

        import kerberos

        if not kerberos.checkPassword(user[self.user_login_attr], userpwd):

            raise Exception('BAD login / mdp')

        #from ldap import sasl

        #conn.sasl_interactive_bind_s('', sasl.gssapi())

    def _search(self, session, base, scope,

                searchstr='(objectClass=*)', attrs=()):

        """make an ldap query"""

        self.debug('ldap search %s %s %s %s %s', self.uri, base, scope,

                   searchstr, list(attrs))

        # XXX for now, we do not have connections set support for LDAP, so

        # this is always self._conn

        cnx = self.get_connection().cnx #session.cnxset.connection(self.uri).cnx

        if cnx is None:

            # cant connect to server

            msg = session._("can't connect to source %s, some data may be missing")

            session.set_shared_data('sources_error', msg % self.uri, txdata=True)

            return []

        try:

            res = cnx.search_s(base, scope, searchstr, attrs)

        except ldap.PARTIAL_RESULTS:

            res = cnx.result(all=0)[1]

        except ldap.NO_SUCH_OBJECT:

            self.info('ldap NO SUCH OBJECT %s %s %s', base, scope, searchstr)

            self._process_no_such_object(session, base)

            return []

        # except ldap.REFERRAL as e:

        #     cnx = self.handle_referral(e)

        #     try:

        #         res = cnx.search_s(base, scope, searchstr, attrs)

        #     except ldap.PARTIAL_RESULTS:

        #         res_type, res = cnx.result(all=0)

        result = []

        for rec_dn, rec_dict in res:

            # When used against Active Directory, "rec_dict" may not be

            # be a dictionary in some cases (instead, it can be a list)

            #

            # An example of a useless "res" entry that can be ignored

            # from AD is