#!/usr/bin/python2.5

#

# Copyright 2008 the Melange authors.

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#   http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

"""Access control helper.

The functions in this module can be used to check access control

related requirements. When the specified required conditions are not

met, an exception is raised. This exception contains a views that

either prompts for authentication, or informs the user that they

do not meet the required criteria.

"""

__authors__ = [

  '"Todd Larsen" <tlarsen@google.com>',

  '"Sverre Rabbelier" <sverre@rabbelier.nl>',

  '"Lennard de Rijk" <ljvderijk@gmail.com>',

  '"Pawel Solyga" <pawel.solyga@gmail.com>',

  ]

from google.appengine.api import users

from django.core import urlresolvers

from django.utils.translation import ugettext

from soc.logic import accounts

from soc.logic import dicts

from soc.logic.models.club_admin import logic as club_admin_logic

from soc.logic.models.host import logic as host_logic

from soc.logic.models.notification import logic as notification_logic

from soc.logic.models.request import logic as request_logic

from soc.logic.models.site import logic as site_logic

from soc.logic.models.user import logic as user_logic

from soc.views import helper

from soc.views import out_of_band

from soc.views.helper import redirects

DEF_NO_USER_LOGIN_MSG_FMT = ugettext(

  'Please create <a href="/user/edit">User Profile</a>'

  ' in order to view this page.')

DEF_AGREE_TO_TOS_MSG_FMT = ugettext(

  'You must agree to the <a href="%(tos_link)s">site-wide Terms of'

  ' Service</a> in your <a href="/user/edit">User Profile</a>'

  ' in order to view this page.')

DEF_DEV_LOGOUT_LOGIN_MSG_FMT = ugettext(

  'Please <a href="%%(sign_out)s">sign out</a>'

  ' and <a href="%%(sign_in)s">sign in</a>'

  ' again as %(role)s to view this page.')

DEF_PAGE_DENIED_MSG = ugettext(

  'Access to this page has been restricted')

DEF_LOGOUT_MSG_FMT = ugettext(

    'Please <a href="%(sign_out)s">sign out</a> in order to view this page')

  """Runs all the defined checks for the specified type.

  Args:

    access_type: the type of request (such as 'list' or 'edit')

    rights: a dictionary containing access check functions

  Rights usage: 

    The rights dictionary is used to check if the current user is allowed 

    to view the page specified. The functions defined in this dictionary 

    value are called.

  """

  # Call each access checker

  for check in rights['any_access']:

  if access_type not in rights:

    for check in rights['unspecified']:

      # No checks defined, so do the 'generic' checks and bail out

    return

  for check in rights[access_type]:

  """Never raises an alternate HTTP response.  (an access no-op, basically).

  Args:

  """

  return

  """Always raises an alternate HTTP response.

  Args:

  Raises:

    always raises AccessViolationResponse if called

  """

  import soc.views.helper.responses

  context['title'] = 'Access denied'

  raise out_of_band.AccessViolation(DEF_PAGE_DENIED_MSG, context=context)

  """Raises an alternate HTTP response if Google Account is not logged in.

  Args:

  Raises:

    AccessViolationResponse:

    * if no Google Account is even logged in

  """

  if users.get_current_user():

    return

  raise out_of_band.LoginRequest()

  """Raises an alternate HTTP response if Google Account is logged in.

  Args:

  Raises:

    AccessViolationResponse:

    * if a Google Account is currently logged in

  """

  if not users.get_current_user():

    return

  raise out_of_band.LoginRequest(message_fmt=DEF_LOGOUT_MSG_FMT)

  """Raises an alternate HTTP response if Google Account has no User entity.

  Args:

  Raises:

    AccessViolationResponse:

    * if no User exists for the logged-in Google Account, or

    * if no Google Account is logged in at all

  """

  if user:

    return

  raise out_of_band.LoginRequest(message_fmt=DEF_NO_USER_LOGIN_MSG_FMT)

  """Raises an alternate HTTP response if User has not agreed to site-wide ToS.

  Args:

  Raises:

    AccessViolationResponse:

    * if User has not agreed to the site-wide ToS, or

    * if no User exists for the logged-in Google Account, or

    * if no Google Account is logged in at all

  """

  user = user_logic.getForCurrentAccount()

  if user_logic.agreesToSiteToS(user):

    return

  # Would not reach this point of site-wide ToS did not exist, since

  # agreesToSiteToS() call above always returns True if no ToS is in effect.

  login_msg_fmt = DEF_AGREE_TO_TOS_MSG_FMT % {

      'tos_link': redirects.getToSRedirect(site_logic.getSingleton())}

  raise out_of_band.LoginRequest(message_fmt=login_msg_fmt)

  """Raises an alternate HTTP response if Google Account is not a Developer.

  Args:

  Raises:

    AccessViolationResponse:

    * if User is not a Developer, or

    * if no User exists for the logged-in Google Account, or

    * if no Google Account is logged in at all

  """

  if accounts.isDeveloper(account=users.get_current_user()):

    return

  login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

      'role': 'a Site Developer '}

  raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

def checkCanCreateFromRequest(role_name):

  """Raises an alternate HTTP response if the specified request does not exist

     or if it's state is not group_accepted. 

  """

    user_entity = user_logic.getForCurrentAccount()

    if user_entity.link_id != kwargs['link_id']:

    fields = {'link_id': kwargs['link_id'],

        'scope_path': kwargs['scope_path'],

        'role': role_name}

    request_entity = request_logic.getFromFieldsOr404(**fields)

    if request_entity.state != 'group_accepted':

      # TODO tell the user that this request has not been accepted yet

    return

  return wrapper

def checkCanProcessRequest(role_name):

  """Raises an alternate HTTP response if the specified request does not exist

     or if it's state is completed or denied. 

  """

    fields = {'link_id': kwargs['link_id'],

        'scope_path': kwargs['scope_path'],

        'role': role_name}

    request_entity = request_logic.getFromFieldsOr404(**fields)

    if request_entity.state in ['completed', 'denied']:

      # TODO tell the user that this request has been processed

    return

  return wrapper

  """Raises an alternate HTTP response if the specified request does not exist

     or if it's state is not group_accepted.

  """

  user_entity = user_logic.getForCurrentAccount()

  if user_entity.link_id != kwargs['link_id']:

    # not the current user's request

  fields = {'link_id': kwargs['link_id'],

            'scope_path': kwargs['scope_path'],

            'role': kwargs['role']}

  request_entity = request_logic.getForFields(fields, unique=True)

  if not request_entity:

    # TODO return 404

  if request_entity.state != 'group_accepted':

  return

  """Raises an alternate HTTP response if Google Account has no Host entity.

  Args:

    request: a Django HTTP request

  Raises:

    AccessViolationResponse:

    * if User is not already a Host, or

    * if User has not agreed to the site-wide ToS, or

    * if no User exists for the logged-in Google Account, or

    * if the user is not even logged in

  """

  try:

    # if the current user is invited to create a host profile we allow access

    return

  except out_of_band.Error:

    pass

  fields = {'user': user,

            'state': 'active'}

  host = host_logic.getForFields(fields, unique=True)

  if host:

    return

  login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

      'role': 'a Program Administrator '}

  raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

  """Raises an alternate HTTP response if Google Account has no Host entity

     for the specified program.

  Args:

    request: a Django HTTP request

  Raises:

    AccessViolationResponse:

    * if User is not already a Host for the specified program, or

    * if User has not agreed to the site-wide ToS, or

    * if no User exists for the logged-in Google Account, or

    * if the user is not even logged in

  """

  fields = {'user': user,

            'scope_path': kwargs['scope_path'],

            'state': 'active'}

  host = host_logic.getForFields(fields, unique=True)

  if host:

    return

  login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

      'role': 'a Program Administrator '}

  raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

  """Returns an alternate HTTP response if Google Account has no Club Admin

     entity for the specified club.

  Args:

   Raises:

     AccessViolationResponse: if the required authorization is not met

  Returns:

    None if Club Admin exists for the specified club, or a subclass of

    django.http.HttpResponse which contains the alternate response

    should be returned by the calling view.

  """

  try:

    # if the current user is invited to create a host profile we allow access

    return

  except out_of_band.Error:

    pass

  user = user_logic.getForCurrentAccount()

  if kwargs.get('scope_path'):

    scope_path = kwargs['scope_path']

  else:

    scope_path = kwargs['link_id']

  fields = {'user': user,

            'scope_path': scope_path,

            'state': 'active'}

  club_admin_entity = club_admin_logic.getForFields(fields, unique=True)

  if club_admin_entity:

    return

  login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

      'role': 'a Club Admin for this Club'}

  raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

def checkIsApplicationAccepted(app_logic):

  """Returns an alternate HTTP response if Google Account has no Club App

     entity for the specified Club.

  Args:

   Raises:

     AccessViolationResponse: if the required authorization is not met

  Returns:

    None if Club App  exists for the specified program, or a subclass

    of django.http.HttpResponse which contains the alternate response

    should be returned by the calling view.

  """

    try:

      # if the current user is a developer we allow access

      return

    except out_of_band.Error:

      pass

    user = user_logic.getForCurrentAccount()

    properties = {

        'applicant': user,

        'status': 'accepted'

        }

    application = app_logic.logic.getForFields(properties, unique=True)

    if application:

      return

    # TODO(srabbelier) Make this give a proper error message

  return wrapper