#!/usr/bin/env python
# -*- coding: UTF-8 -*-

#  Licensed to the Apache Software Foundation (ASF) under one
#  or more contributor license agreements.  See the NOTICE file
#  distributed with this work for additional information
#  regarding copyright ownership.  The ASF licenses this file
#  to you under the Apache License, Version 2.0 (the
#  "License"); you may not use this file except in compliance
#  with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing,
#  software distributed under the License is distributed on an
#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
#  KIND, either express or implied.  See the License for the
#  specific language governing permissions and limitations
#  under the License.
from itertools import groupby
import os

from trac.core import Component, implements, ExtensionPoint
from trac.perm import PermissionSystem
from tracopt.perm.authz_policy import AuthzPolicy
from whoosh import query

from multiproduct.env import ProductEnvironment

from bhsearch.api import (IDocIndexPreprocessor, IndexFields,
                          IQueryPreprocessor, ISearchParticipant)
from bhsearch.utils import get_product, instance_for_every_env, is_enabled


class SecurityPreprocessor(Component):
    participants = ExtensionPoint(ISearchParticipant)

    def __init__(self):
        self._required_permissions = {}
        for participant in self.participants:
            permission = participant.get_required_permission()
            doc_type = participant.get_participant_type()
            self._required_permissions[doc_type] = permission

    def check_permission(self, doc, context):
        product, doctype, id = doc['product'], doc['type'], doc['id']
        username = context.req.authname
        env = self.env
        if product:
            env = ProductEnvironment(self.env, product)
        perm = PermissionSystem(env)
        action = self._required_permissions[doctype]
        return perm.check_permission(action, username, id)

    def update_security_filter(self, query_parameters, allowed=(), denied=()):
        security_filter = self.create_security_filter(query_parameters)
        security_filter.allowed.extend(allowed)
        security_filter.denied.extend(denied)

    def create_security_filter(self, query_parameters):
        security_filter = self.find_security_filter(query_parameters['filter'])
        if not security_filter:
            security_filter = SecurityFilter()
            if query_parameters['filter']:
                query_parameters['filter'] = query.And([query_parameters['filter'],
                                                        security_filter])
            else:
                query_parameters['filter'] = security_filter
        return security_filter

    def find_security_filter(self, existing_query):
        queue = [existing_query]
        while queue:
            token = queue.pop(0)
            if isinstance(token, SecurityFilter):
                return token
            if isinstance(token, query.CompoundQuery):
                queue.extend(token.subqueries)


class DefaultSecurityPreprocessor(SecurityPreprocessor):
    implements(IDocIndexPreprocessor, IQueryPreprocessor)

    # IDocIndexPreprocessor methods
    def pre_process(self, doc):
        permission = self._required_permissions[doc[IndexFields.TYPE]]
        doc[IndexFields.REQUIRED_PERMISSION] = permission

    # IQueryPreprocessor methods
    def query_pre_process(self, query_parameters, context=None):
        if context is None:
            return

        def allowed_documents():
            #todo: add special case handling for trac_admin and product_owner
            for product, perm in self._get_all_user_permissions(context):
                if product:
                    prod_term = query.Term(IndexFields.PRODUCT, product)
                else:
                    prod_term = query.Not(query.Every(IndexFields.PRODUCT))
                perm_term = query.Term(IndexFields.REQUIRED_PERMISSION, perm)
                yield query.And([prod_term, perm_term])

        self.update_security_filter(query_parameters,
                                    allowed=allowed_documents())

    def _get_all_user_permissions(self, context):
        username = context.req.authname
        permissions = []
        for perm in instance_for_every_env(self.env, PermissionSystem):
            prefix = get_product(perm.env).prefix
            for action in self._required_permissions.itervalues():
                if perm.check_permission(action, username):
                    permissions.append((prefix, action))
        return permissions


class AuthzSecurityPreprocessor(SecurityPreprocessor):
    implements(IQueryPreprocessor)

    def __init__(self):
        SecurityPreprocessor.__init__(self)
        ps = PermissionSystem(self.env)
        self.enabled = (is_enabled(self.env, AuthzPolicy)
                        and any(isinstance(policy, AuthzPolicy)
                                for policy in ps.policies))

    # IQueryPreprocessor methods
    def query_pre_process(self, query_parameters, context=None):
        if not self.enabled:
            return

        permissions = self.get_user_permissions(context.req.authname)
        allowed_docs, denied_docs = [], []
        for product, doc_type, doc_id, perm, denied in permissions:
            term_spec = []
            if product:
                term_spec.append(query.Term(IndexFields.PRODUCT, product))
            else:
                term_spec.append(query.Not(query.Every(IndexFields.PRODUCT)))

            if doc_type != '*':
                term_spec.append(query.Term(IndexFields.TYPE, doc_type))
            if doc_id != '*':
                term_spec.append(query.Term(IndexFields.ID, doc_id))
            term_spec.append(query.Term(IndexFields.REQUIRED_PERMISSION, perm))
            term_spec = query.And(term_spec)
            if denied:
                denied_docs.append(term_spec)
            else:
                allowed_docs.append(term_spec)
        self.update_security_filter(query_parameters, allowed_docs, denied_docs)

    def get_user_permissions(self, username):
        for policy in instance_for_every_env(self.env, AuthzPolicy):
            product = get_product(policy.env).prefix
            self.refresh_config(policy)

            for doc_type, doc_id, perm, denied in self.get_relevant_permissions(policy, username):
                yield product, doc_type, doc_id, perm, denied

    def get_relevant_permissions(self, policy, username):
        ps = PermissionSystem(self.env)
        relevant_permissions = set(self._required_permissions.itervalues())
        user_permissions = self.get_all_user_permissions(policy, username)
        for doc_type, doc_id, permissions in user_permissions:
            for deny, perms in groupby(permissions,
                                       key=lambda p: p.startswith('!')):
                if deny:
                    for p in ps.expand_actions([p[1:] for p in perms]):
                        if p in relevant_permissions:
                            yield doc_type, doc_id, p, True
                else:
                    for p in ps.expand_actions(perms):
                        if p in relevant_permissions:
                            yield doc_type, doc_id, p, False

    def get_all_user_permissions(self, policy, username):
        relevant_users = self.get_relevant_users(username)
        for doc_type, doc_id, section in self.get_all_permissions(policy):
            for who, permissions in section.iteritems():
                if who in relevant_users or \
                        who in policy.groups_by_user.get(username, []):
                    if isinstance(permissions, basestring):
                        permissions = [permissions]
                    yield doc_type, doc_id, permissions

    def get_all_permissions(self, policy):
        for section_name in policy.authz.sections:
            if section_name == 'groups':
                continue
            if '/' in section_name:
                continue  # advanced permissions are not supported at the moment

            type_id = section_name.split('@', 1)[0]
            if ':' in type_id:
                doc_type, doc_id = type_id.split(':')
            else:
                doc_type, doc_id = '**'
            yield doc_type, doc_id, policy.authz[section_name]

    def get_relevant_users(self, username):
        if username and username != 'anonymous':
            return ['*', 'authenticated', username]
        else:
            return ['*', 'anonymous']

    def refresh_config(self, policy):
        if (
            policy.authz_file and not policy.authz_mtime
            or os.path.getmtime(policy.get_authz_file()) > policy.authz_mtime
        ):
            policy.parse_authz()


class SecurityFilter(query.AndNot):
    def __init__(self, allowed=(), denied=()):
        self.allowed = list(allowed)
        self.denied = list(denied)
        super(SecurityFilter, self).__init__(self.allowed, self.denied)

    _subqueries = ()
    @property
    def subqueries(self):
        self.finalize()
        return self._subqueries

    @subqueries.setter
    def subqueries(self, value):
        pass

    def finalize(self):
        self._subqueries = []
        if self.allowed:
            self.a = query.Or(self.allowed)
        else:
            self.a = query.NullQuery
        if self.denied:
            self.b = query.Or(self.denied)
        else:
            self.b = query.NullQuery
        self._subqueries = (self.a, self.b)

    def __repr__(self):
        r = "%s(allow=%r, deny=%r)" % (self.__class__.__name__,
                                       self.a, self.b)
        return r