# authentic2 - versatile identity manager
# Copyright (C) 2010-2019 Entr'ouvert
#
# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU Affero General Public License as published
# by the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import sys

from django.core.exceptions import ImproperlyConfigured
from django.utils.translation import gettext_lazy as _


class Setting:
    SENTINEL = object()

    def __init__(self, default=SENTINEL, definition='', names=None):
        self.names = names or []
        if isinstance(self.names, str):
            self.names = [self.names]
        self.names = set(self.names)
        self.default = default
        self.definition = definition

    def has_default(self):
        return self.default != self.SENTINEL


class AppSettings:
    def __init__(self, defaults):
        self.defaults = defaults

    @property
    def settings(self):
        if not hasattr(self, '_settings'):
            from django.conf import settings

            self._settings = settings
        return self._settings

    @property
    def REALMS(self):
        realms = {}
        if self.A2_REGISTRATION_REALM:
            realms[self.A2_REGISTRATION_REALM] = self.A2_REGISTRATION_REALM

        def add_realms(new_realms):
            for realm in new_realms:
                if not isinstance(realm, (tuple, list)):
                    realms[realm] = realm
                else:
                    realms[realm[0]] = realm[1]

        from django.contrib.auth import get_backends

        for backend in get_backends():
            if hasattr(backend, 'get_realms'):
                add_realms(backend.get_realms())
        if self.A2_REALMS:
            add_realms(self.A2_REALMS)
        return realms.items()

    @property
    def A2_USER_CAN_RESET_PASSWORD(self):
        if hasattr(self.settings, 'A2_USER_CAN_RESET_PASSWORD'):
            return self.settings.A2_USER_CAN_RESET_PASSWORD
        if hasattr(self.settings, 'A2_CAN_RESET_PASSWORD'):
            return self.settings.A2_CAN_RESET_PASSWORD
        return self.defaults['A2_USER_CAN_RESET_PASSWORD'].default

    def __getattr__(self, key):
        if key not in self.defaults:
            raise AttributeError('unknown key %s' % key)
        if hasattr(self.settings, key):
            return getattr(self.settings, key)
        if self.defaults[key].names:
            for other_key in self.defaults[key].names:
                if hasattr(self.settings, other_key):
                    return getattr(self.settings, other_key)
        if self.defaults[key].has_default():
            return self.defaults[key].default
        raise ImproperlyConfigured(
            'missing setting %s(%s) is mandatory' % (key, self.defaults[key].description)
        )


default_settings = dict(
    ATTRIBUTE_BACKENDS=Setting(
        names=('A2_ATTRIBUTE_BACKENDS',),
        default=(
            'authentic2.attributes_ng.sources.format',
            'authentic2.attributes_ng.sources.function',
            'authentic2.attributes_ng.sources.django_user',
            'authentic2.attributes_ng.sources.ldap',
            'authentic2.attributes_ng.sources.service_roles',
        ),
        definition='List of attribute backend classes or modules',
    ),
    CAFILE=Setting(
        names=('AUTHENTIC2_CAFILE', 'CAFILE'),
        default=None,
        definition='File containing certificate chains as PEM certificates',
    ),
    A2_REGISTRATION_CAN_DELETE_ACCOUNT=Setting(
        default=True, definition='Can user self delete their account and all their data'
    ),
    A2_REGISTRATION_CAN_CHANGE_PASSWORD=Setting(
        default=True, definition='Allow user to change its own password'
    ),
    A2_REGISTRATION_EMAIL_BLACKLIST=Setting(
        default=[], definition='List of forbidden email wildcards, ex.: ^.*@ville.fr$'
    ),
    A2_REGISTRATION_REDIRECT=Setting(
        default=None,
        definition=(
            'Forced redirection after each redirect, NEXT_URL substring is replaced by the original next_url'
            ' passed to /accounts/register/'
        ),
    ),
    A2_PROFILE_CAN_CHANGE_EMAIL=Setting(default=True, definition='Can user self change their email'),
    A2_PROFILE_CAN_EDIT_PROFILE=Setting(default=True, definition='Can user self edit their profile'),
    A2_PROFILE_CAN_MANAGE_FEDERATION=Setting(default=True, definition='Can user manage its federations'),
    A2_PROFILE_CAN_MANAGE_SERVICE_AUTHORIZATIONS=Setting(
        default=True, definition='Allow user to revoke granted services access to its account profile data'
    ),
    A2_PROFILE_DISPLAY_EMPTY_FIELDS=Setting(default=False, definition='Include empty fields in profile view'),
    A2_HOMEPAGE_URL=Setting(default=None, definition='IdP has no homepage, redirect to this one.'),
    A2_USER_CAN_RESET_PASSWORD=Setting(default=None, definition='Allow online reset of passwords'),
    A2_USER_CAN_RESET_PASSWORD_BY_USERNAME=Setting(
        default=False, definition='Allow password reset request by username'
    ),
    A2_EMAIL_IS_UNIQUE=Setting(default=False, definition='Email of users must be unique'),
    A2_REGISTRATION_EMAIL_IS_UNIQUE=Setting(
        default=False, definition='Email of registered accounts must be unique'
    ),
    A2_REGISTRATION_FORM_USERNAME_REGEX=Setting(
        default=r'^[\w.@+-]+$', definition='Regex to validate usernames'
    ),
    A2_REGISTRATION_FORM_USERNAME_HELP_TEXT=Setting(
        default=_('Required. At most 30 characters. Letters, digits, and @/./+/-/_ only.')
    ),
    A2_REGISTRATION_FORM_USERNAME_LABEL=Setting(default=_('Username')),
    A2_REGISTRATION_REALM=Setting(
        default=None, definition='Default realm to assign to self-registrated users'
    ),
    A2_REGISTRATION_GROUPS=Setting(default=(), definition='Default groups for self-registered users'),
    A2_PROFILE_FIELDS=Setting(default=(), definition='Fields to show to the user in the profile page'),
    A2_REGISTRATION_FIELDS=Setting(
        default=(), definition='Fields from the user model that must appear on the registration form'
    ),
    A2_REQUIRED_FIELDS=Setting(default=(), definition='User fields that are required'),
    A2_REGISTRATION_REQUIRED_FIELDS=Setting(
        default=(), definition='Fields from the registration form that must be required'
    ),
    A2_PRE_REGISTRATION_FIELDS=Setting(default=(), definition='User fields to ask with email'),
    A2_REALMS=Setting(default=(), definition='List of realms to search user accounts'),
    A2_USERNAME_REGEX=Setting(default=None, definition='Regex that username must validate'),
    A2_USERNAME_LABEL=Setting(default=None, definition='Alternate username label for the login form'),
    A2_USERNAME_HELP_TEXT=Setting(
        default=None, definition='Help text to explain validation rules of usernames'
    ),
    A2_USERNAME_IS_UNIQUE=Setting(default=True, definition='Check username uniqueness'),
    A2_LOGIN_FORM_OU_SELECTOR_LABEL=Setting(default=None, definition='Label of OU field on login page'),
    A2_REGISTRATION_USERNAME_IS_UNIQUE=Setting(
        default=True, definition='Check username uniqueness on registration'
    ),
    IDP_BACKENDS=(),
    VALID_REFERERS=Setting(default=(), definition='List of prefix to match referers'),
    A2_OPENED_SESSION_COOKIE_NAME=Setting(default='A2_OPENED_SESSION', definition='Authentic session open'),
    A2_OPENED_SESSION_COOKIE_DOMAIN=Setting(default=None),
    A2_OPENED_SESSION_COOKIE_SECURE=Setting(default=False),
    A2_ATTRIBUTE_KINDS=Setting(default=(), definition='List of other attribute kinds'),
    A2_ATTRIBUTE_KIND_PROFILE_IMAGE_SIZE=Setting(
        default=200, definition='Width and height for a profile image'
    ),
    A2_VALIDATE_EMAIL=Setting(
        default=False, definition='Validate user email server by doing an RCPT command'
    ),
    A2_VALIDATE_EMAIL_DOMAIN=Setting(default=True, definition='Validate user email domain'),
    A2_PASSWORD_POLICY_MIN_CLASSES=Setting(
        default=3, definition='Minimum number of characters classes to be present in passwords'
    ),
    A2_PASSWORD_POLICY_MIN_LENGTH=Setting(default=8, definition='Minimum number of characters in a password'),
    A2_PASSWORD_POLICY_REGEX=Setting(default=None, definition='Regular expression for validating passwords'),
    A2_PASSWORD_POLICY_REGEX_ERROR_MSG=Setting(
        default=None,
        definition='Error message to show when the password do not validate the regular expression',
    ),
    A2_PASSWORD_POLICY_CLASS=Setting(
        default='authentic2.passwords.DefaultPasswordChecker',
        definition='path of a class to validate passwords',
    ),
    A2_PASSWORD_POLICY_SHOW_LAST_CHAR=Setting(
        default=False, definition='Show last character in password fields'
    ),
    A2_PASSWORD_POLICY_MIN_STRENGTH=Setting(
        default=None, definition='Minimun password strength on a 0-4 scale'
    ),
    A2_SUGGESTED_EMAIL_DOMAINS=Setting(
        default=[
            'gmail.com',
            'msn.com',
            'hotmail.com',
            'hotmail.fr',
            'wanadoo.fr',
            'yahoo.fr',
            'yahoo.com',
            'laposte.net',
            'free.fr',
            'orange.fr',
            'numericable.fr',
        ],
        definition='List of suggested email domains',
    ),
    A2_LOGIN_FAILURE_COUNT_BEFORE_WARNING=Setting(
        default=0,
        definition=(
            'Failure count before logging a warning to authentic2.user_login_failure. No warning will be send'
            ' if value is 0.'
        ),
    ),
    PUSH_PROFILE_UPDATES=Setting(default=False, definition='Push profile update to linked services'),
    TEMPLATE_VARS=Setting(default={}, definition='Variable to pass to templates'),
    A2_LOGIN_EXPONENTIAL_RETRY_TIMEOUT_FACTOR=Setting(
        default=1.8,
        definition='exponential backoff factor duration as seconds until next try after a login failure',
    ),
    A2_LOGIN_EXPONENTIAL_RETRY_TIMEOUT_DURATION=Setting(
        default=1,
        definition='exponential backoff base factor duration as seconds until next try after a login failure',
    ),
    A2_LOGIN_EXPONENTIAL_RETRY_TIMEOUT_MAX_DURATION=Setting(
        default=3600,
        definition=(
            'maximum exponential backoff maximum duration as seconds until next try after a login failure'
        ),
    ),
    A2_LOGIN_EXPONENTIAL_RETRY_TIMEOUT_MIN_DURATION=Setting(
        default=10,
        definition=(
            'minimum exponential backoff maximum duration as seconds until next try after a login failure'
        ),
    ),
    A2_VERIFY_SSL=Setting(default=True, definition='Verify SSL certificate in HTTP requests'),
    A2_ATTRIBUTE_KIND_TITLE_CHOICES=Setting(default=(), definition='Choices for the title attribute kind'),
    A2_CORS_WHITELIST=Setting(
        default=(), definition='List of origin URL to whitelist, must be scheme://netloc[:port]'
    ),
    A2_EMAIL_CHANGE_TOKEN_LIFETIME=Setting(
        default=7200, definition='Lifetime in seconds of the token sent to verify email adresses'
    ),
    A2_DELETION_REQUEST_LIFETIME=Setting(
        default=48 * 3600, definition='Lifetime in seconds of the user account deletion request'
    ),
    A2_REDIRECT_WHITELIST=Setting(
        default=(), definition='List of origins which are authorized to ask for redirection.'
    ),
    A2_API_USERS_REQUIRED_FIELDS=Setting(
        default=(), definition='List of fields to require on user\'s API, override other settings'
    ),
    A2_USER_FILTER=Setting(
        default={},
        definition='Filters (as in QuerySet.filter() to apply to User queryset before authentication',
    ),
    A2_USER_EXCLUDE=Setting(
        default={},
        definition=(
            'Exclusion filter (as in QuerySet.exclude() to apply to User queryset before authentication'
        ),
    ),
    A2_LOGIN_REDIRECT_AUTHENTICATED_USERS_TO_HOMEPAGE=Setting(
        default=False, definition='Redirect authenticated users to homepage'
    ),
    A2_LOGIN_DISPLAY_A_CANCEL_BUTTON=Setting(
        default=False,
        definition='Display a cancel button.This is only applicable for Liberty single sign on requests',
    ),
    A2_SET_RANDOM_PASSWORD_ON_RESET=Setting(
        default=True,
        definition='Set a random password on request to reset the password from the front-office',
    ),
    A2_ACCOUNTS_URL=Setting(default=None, definition='IdP has no account page, redirect to this one.'),
    A2_CACHE_ENABLED=Setting(default=True, definition='Disable all cache decorators for testing purpose.'),
    A2_ACCEPT_EMAIL_AUTHENTICATION=Setting(default=True, definition='Enable authentication by email'),
    A2_EMAILS_IP_RATELIMIT=Setting(
        default='10/h', definition='Maximum rate of email sendings triggered by the same IP address.'
    ),
    A2_EMAILS_ADDRESS_RATELIMIT=Setting(
        default='3/d', definition='Maximum rate of emails sent to the same email address.'
    ),
    A2_USER_DELETED_KEEP_DATA=Setting(
        default=['email', 'uuid', 'phone'], definition='User data to keep after deletion'
    ),
    A2_USER_DELETED_KEEP_DATA_DAYS=Setting(
        default=365, definition='Number of days to keep data on deleted users'
    ),
    A2_TOKEN_EXISTS_WARNING=Setting(
        default=True, definition='If an active token exists, warn user before generating a new one.'
    ),
    A2_DUPLICATES_THRESHOLD=Setting(
        default=0.7, definition='Trigram similarity threshold for considering user as duplicate.'
    ),
    A2_FTS_THRESHOLD=Setting(default=0.2, definition='Trigram similarity threshold for free text search.'),
    A2_DUPLICATES_BIRTHDATE_BONUS=Setting(
        default=0.3, definition='Bonus in case of birthdate match (no bonus is 0, max is 1).'
    ),
    A2_EMAIL_FORMAT=Setting(
        default='multipart/alternative',
        definition='Send email as "multiplart/alternative" or limit to "text/plain" or "text/html".',
    ),
    A2_CLEAN_UNUSED_ACCOUNTS_MAX_MAIL_PER_PERIOD=Setting(
        default=250,
        definition='Maximum number of mails to send per period',
    ),
)

app_settings = AppSettings(default_settings)
app_settings.__name__ = __name__
sys.modules[__name__] = app_settings