# Copyright 2019 Nokia

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import time
import access_management.db.amdb as amdb
from am_api_base import *
from keystoneauth1 import exceptions
from cmframework.apis import cmclient


class Users(AMApiBase):

    """
    User create operations

    .. :quickref: Users;User create operations

    .. http:post:: /am/v1/users

    **Start User create**

    **Example request**:

    .. sourcecode:: http

        POST am/v1/users HTTP/1.1
        Host: haproxyvip:61200
        Accept: application/json
        {
            "username": "user_1",
            "password": "Passwd_1",
            "email": "test@mail.com",
            "project": "10f8fa2c6efe409d8207517128f03265",
            "description": "desc"
        }

    :> json string username: The created user name.
    :> json string password: The user's password.
    :> json string email: The user's e-mail.
    :> json string project: ID of the project to be set as primary project for the user.
    :> json string description: The user's description.

    **Example response**:

    .. sourcecode:: http

        HTTP/1.1 200 OK
        {
            "code": 0,
            "description": "",
            "data":
            {
                "id": <uuid>
            }
        }

    :> json int code: the status code
    :> json string description: the error description, present if code is non zero
    :> json object data: a dictionary with the created user's id
    :> json string id: The created user's id.

    Users list operations

    .. :quickref: Users;Users list operations

    .. http:get:: /am/v1/users

    **Start Users list**

    **Example request**:

    .. sourcecode:: http

        GET am/v1/users HTTP/1.1
        Host: haproxyvip:61200
        Accept: application/json

    **Example response**:

    .. sourcecode:: http

        HTTP/1.1 200 OK
        {
            "code": 0,
            "description": "",
            "data":
            {
                "0edf341a27544c349b7c37bb76ab25d1":
                {
                    "enabled": true,
                    "id": "0edf341a27544c349b7c37bb76ab25d1",
                    "name": "cinder",
                    "password_expires_at": null
                },
                "32e8859519f94b1ea80f61d53d17e74e":
                {
                    "enabled": true,
                    "id": "32e8859519f94b1ea80f61d53d17e74e",
                    "name": "nova",
                    "password_expires_at": null
                }
            }
        }

    :> json int code: the status code
    :> json string description: the error description, present if code is non zero
    :> json object data: The existing users.
    :> json string enabled: The user's state.
    :> json string id: The user's id.
    :> json string name: The user's name.
    :> json string password_expires_at: The user's password expiration date.

    User delete operations

    .. :quickref: Users;User delete operations

    .. http:delete:: /am/v1/users

    **Start User delete**

    **Example request**:

    .. sourcecode:: http

        DELETE am/v1/users HTTP/1.1
        Host: haproxyvip:61200
        Accept: application/json
        {
            "user": <uuid> or <username>
        }

    :> json string user: The removed user's id or user name.

    **Example response**:

    .. sourcecode:: http

        HTTP/1.1 200 OK
        {
            "code": 0,
            "description": "User deleted!"
        }

    :> json int code: the status code
    :> json string description: the error description, present if code is non zero
    """

    endpoints = ['users']
    parser_arguments = ['username',
                        'password',
                        'email',
                        'user',
                        'project',
                        'description']

    def post(self):
        self.logger.info("Received a user create request!")
        args = self.parse_args()

        if args["email"] is not None:
            if re.match("^[\.a-zA-Z0-9_-]+@[a-zA-Z0-9_-]+\.[a-z]+$", args["email"]) is None:
                self.logger.error("E-mail validation failed!")
                return AMApiBase.embed_data({}, 1, "E-mail validation failed!")

        if self.id_validator(args["username"]):
            self.logger.error("{0} username is invalid, because cannot assign a valid uuid to it.".format(args["username"]))
            return AMApiBase.embed_data({}, 1, "{0} username is invalid, because cannot assign a valid uuid to it.".format(args["username"]))

        if args["project"]:
            projectidstate = self.id_validator(args["project"])
            if projectidstate == False:
                self.logger.error("Project id validation failed")
                return AMApiBase.embed_data({}, 1, "Project id validation failed")

        if re.match("^[a-zA-Z0-9_-]+$", args["username"]) is None:
            self.logger.error("Username validation failed!")
            return AMApiBase.embed_data({}, 1, "Username validation failed!")

        passstate = self.passwd_validator(args["password"])
        if passstate is not None:
            self.logger.error(passstate)
            return AMApiBase.embed_data({}, 1, passstate)

        state, result = self._create_user(args)
        if state:
            self.logger.info("User created!")
            return AMApiBase.embed_data({"id": result}, 0, "")
        else:
            return AMApiBase.embed_data({}, 1, result)

    def get(self):
        self.logger.info("Received a user list request!")
        user_list = {}
        try:
            self.keystone = self.auth_keystone()
            u_list = self.keystone.users.list()
        except Exception as ex:
            self.logger.error("{0}".format(ex))
            return False, "{0}".format(ex)

        for element in u_list:
            user_list.update({element.id : element._info})

        self.logger.info("The user list response done!")
        return AMApiBase.embed_data(user_list, 0, "User list.")

    def delete(self):
        self.logger.info("Received a user delete request!")
        args = self.parse_args()

        state, user_info = self.get_uuid_and_name(args["user"])
        if state:
            token_owner = self.get_uuid_from_token()
            if user_info["id"] == token_owner:
                self.logger.error("The {0} user tried to delete own account!".format(user_info["id"]))
                return AMApiBase.embed_data({}, 1, "You cannot delete your own account!")

            state, message = self._delete_user(user_info)

            if state:
                self.logger.info("User deleted!")
                return AMApiBase.embed_data({}, 0, "User deleted!")
            else:
                self.logger.error(message)
                return AMApiBase.embed_data({}, 1, message)
        else:
            self.logger.error(user_info)
            return AMApiBase.embed_data({}, 1, user_info)

    def _delete_user(self, user_info):
        state, name = self._delete_user_from_db(user_info)
        if state:
            self.logger.info("User removed from the db!")
            try:
                self.keystone.users.delete(user_info["id"])
            except exceptions.http.NotFound as ex:
                self.logger.info("{0} user does not exist in the keystone!".format(user_info["name"]))
                return True, "Done, but this user didn't exist in the keystone!"
            except Exception as ex:
                self.logger.error("{0}".format(ex))
                return False, "{0}".format(ex)
            return True, "Done"
        else:
            return False, name

    def _delete_user_from_db(self, user_info):
        state_open, message_open = self._open_db()
        if state_open:
            try:
                roles = self.db.get_user_roles(user_info["id"])

                for role in roles:
                    if self.db.is_chroot_role(role):
                        self.logger.debug("This user has a chroot role.")
                        for x in range(3):
                            self.remove_chroot_linux_role_handling(user_info["id"], "Chroot", "cloud.chroot")
                            time.sleep(2)
                            if self.check_chroot_linux_state(user_info["name"], "cloud.chroot", "absent"):
                                self.db.delete_user(user_info["id"])
                                return True, user_info["name"]

                    if role == "linux_user":
                        self.logger.debug("This user has a linux_user role!")
                        for x in range(3):
                            self.remove_chroot_linux_role_handling(user_info["id"], "Linux", "cloud.linuxuser")
                            time.sleep(2)
                            if self.check_chroot_linux_state(user_info["name"], "cloud.linuxuser", "absent"):
                                self.db.delete_user(user_info["id"])
                                return True, user_info["name"]

                self.db.delete_user(user_info["id"])
            except amdb.NotAllowedOperation:
                self.logger.error("Deleting service user is not allowed: {0}".format(user_info["name"]))
                return False, "Deleting service user is not allowed: {0}".format(user_info["name"])
            except amdb.NotExist:
                self.logger.info("The {0} user does not exist!".format(user_info["name"]))
                return True, ""
            except Exception as ex:
                self.logger.error("Internal error: {0}".format(ex))
                return False, "Internal error: {0}".format(ex)
            finally:
                state_close, message_close = self._close_db()
                if not state_close:
                    self._close_db()
            return True, user_info["name"]
        else:
            return False, message_open

    def _create_user(self, args):
        roles = []
        ks_member_roleid = self.get_role_id(defaults.KS_MEMBER_NAME)
        if ks_member_roleid is None:
            self.logger.error("Member user role not found!")
            return False, "Member user role not found!"
        else:
            roles.append(ks_member_roleid)
        basic_member_roleid = self.get_role_id(defaults.AM_MEMBER_NAME)
        if basic_member_roleid is None:
            self.logger.error("basic_member user role not found!")
            return False, "basic_member user role not found!"
        else:
            roles.append(basic_member_roleid)

        um_proj_id = self.get_project_id(defaults.PROJECT_NAME)
        if um_proj_id is None:
            self.logger.error("The user management project is not found!")
            return False, "The user management project is not found!"

        if args["email"] is None:
            args["email"] = 'None'
        if args["project"] is None:
            args["project"] = um_proj_id

        try:
            c_user_out = self.keystone.users.create(name=args["username"], password=args["password"], email=args["email"], default_project=args["project"],  description=args["description"])
        except exceptions.http.Conflict as ex:
            self.logger.error("{0}".format(ex))
            return False, "This user exists in the keystone!"
        except Exception as ex:
            self.logger.error("{0}".format(ex))
            return False, "{0}".format(ex)

        ID = c_user_out.id
        state, message = self._add_basic_roles(um_proj_id, ID, roles)
        if not state:
            return False, message
        if args["project"] != um_proj_id:
            state, message = self._add_basic_roles(args["project"], ID, [ks_member_roleid])
            if not state:
                return False, message
        return self._create_user_in_db(ID, args)

    def _add_basic_roles(self, project, ID, roles):
        for role in roles:
            try:
                self.keystone.roles.grant(role, user=ID, project=project)
            except Exception:
                try:
                    self.keystone.roles.grant(role, user=ID, project=project)
                except Exception as ex:
                    self.logger.error("{0}".format(ex))
                    self.keystone.users.delete(ID)
                    return False, "{0}".format(ex)
        return True, "OK"

    def _create_user_in_db(self, ID, args):
        state_open, message_open = self._open_db()
        if state_open:
            try:
                self.db.create_user(ID, args["username"])
                self.db.add_user_role(ID, defaults.AM_MEMBER_NAME)
            except amdb.AlreadyExist as ex1:
                self.logger.error("User already exists in table!")
                try:
                    self.keystone.users.delete(ID)
                    self.db.delete_user(ID)
                except amdb.NotAllowedOperation as ex2:
                    self.logger.error("Internal error: Except1: {0}, Except2: {1}".format(ex1, ex2))
                    return False, "Except1: {0}, Except2: {1}".format(ex1, ex2)
                except Exception as ex3:
                    self.logger.error("Internal error: Except1: {0}, Except2: {1}".format(ex1, ex3))
                    return False, "Except1: {0}, Except2: {1}".format(ex1, ex3)
                return False, "User already exists!"
            except Exception as ex:
                self.logger.error("Internal error: {0}".format(ex))
                try:
                    self.keystone.users.delete(ID)
                except exceptions.http.NotFound as ex:
                    self.logger.error("{0}".format(ex))
                    return False, "This user does not exist in the keystone!"
                except Exception as ex:
                    self.logger.error("{0}".format(ex))
                    return False, "{0}".format(ex)
                return False, "Internal error: {0}".format(ex)
            finally:
                state_close, message_close = self._close_db()
                if not state_close:
                    self._close_db()
            return True, ID
        else:
            return False, message_open

    def remove_chroot_linux_role_handling(self, user_id, user_type, list_name):
        cmc = cmclient.CMClient()
        user_list = cmc.get_property(list_name)
        user_list = json.loads(user_list)
        self.logger.debug("{0} user list before the change: {1}".format(user_type, json.dumps(user_list)))
        if user_list is not None:
            self.logger.debug("The {0} user list exists!".format(user_type))
            username, def_project = self.get_user_from_uuid(user_id)
            self.logger.debug("User name: {0}".format(username))
            for val in user_list:
                if val["name"] == username:
                    val["public_key"] = ""
                    val["state"] = "absent"
                    val["remove"] = "yes"
                    val["password"] = ""
                    break
            self.logger.debug("{0} user list after the change: {1}".format(user_type, json.dumps(user_list)))
            cmc.set_property(list_name, json.dumps(user_list))