from __future__ import unicode_literals, absolute_import

import base64
import urllib.parse
import os
import tempfile
import subprocess
import shutil
from http.client import HTTPConnection

import flask
from werkzeug.datastructures import Headers

import pagure.exceptions
import pagure.lib.query
import pagure.lib.login
import pagure.utils


print("proxy loaded")

PROXYPLUGIN = flask.Blueprint("proxyplugin", __name__)
HOST = None
PORT = None


def convert_ssl_to_ssh(sslcert):
  """ Extract RSA key from certificate and represent in in ssh-rsa format
  """
  sslcert = str(sslcert).strip()
  if not sslcert:
    return None
  tmpdirname = tempfile.mkdtemp()

  sslcert_filename = os.path.join(tmpdirname, "ssl.crt")
  rsapem_filename = os.path.join(tmpdirname, "public-rsa.pem")
  with open(sslcert_filename, "w") as stream:
    stream.write(sslcert)

  # extract PEM RSA public key
  cmd = ["/usr/bin/openssl", "x509", "-in", sslcert_filename, "-pubkey", "-noout", "-out", rsapem_filename]
  proc = subprocess.Popen(
    cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE )
  stdout, stderr = proc.communicate()
  if proc.returncode != 0:
    print("openssl STDOUT: %s", stdout)
    print("openssl STDERR: %s", stderr)
    shutil.rmtree(tmpdirname)
    return None

  # make ssh-ras from PEM RSA public key
  cmd = ["/usr/bin/ssh-keygen", "-f", rsapem_filename, "-i", "-mPKCS8"]
  proc = subprocess.Popen(
    cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE )
  stdout, stderr = proc.communicate()
  if proc.returncode != 0:
    print("ssh-keygen STDOUT: %s", stdout)
    print("ssh-keygen STDERR: %s", stderr)
    shutil.rmtree(tmpdirname)
    return None

  shutil.rmtree(tmpdirname)
  sshrsa = stdout.decode("utf-8")

  return sshrsa


@PROXYPLUGIN.route("/repos/<path:_>", methods=["GET", "POST"])
def repos(_):
  """ Proxy to git http backend.
  """
  
  print("repos called")

  env = flask.request.environ
  session = flask.g.session
  if hasattr(flask.g, "fas_user"):
    print("user logged in by cookie")
    return forbidden() # disallow cookie authorization

  # read login and password
  login = None
  password = None
  if 'HTTP_AUTHORIZATION' in env:
    try:
      authtype, credentials = str(env['HTTP_AUTHORIZATION']).split()
      assert authtype.lower() == 'basic'
      login, password = base64.b64decode(credentials).decode('utf8').split(':')
    except Exception:
      print("wrong auth format")
      return unauthorized()
  elif 'PAGURE_SSL_CLIENT_CERT' in env:
    sslcert = str(urllib.parse.unquote(env['PAGURE_SSL_CLIENT_CERT']))

  # verify password
  if login:
    user_obj = pagure.lib.query.search_user(session, username = login)
    if not user_obj or user_obj.token:
      print("wrong user")
      return unauthorized()
    success = False
    try:
      success = pagure.lib.login.check_password(
        password,
        user_obj.password,
        seed = pagure.config.config.get("PASSWORD_SEED", None) )
    except pagure.exceptions.PagureException:
      pass
    if not success:
      print("wrong password")
      return unauthorized()
  elif sslcert:
    #print("received sslcert:", sslcert)
    ssh_rsa = convert_ssl_to_ssh(sslcert)
    if ssh_rsa:
      #print("converted to ssh-rsa:", ssh_rsa)
      ssh_short_key = pagure.lib.query.is_valid_ssh_key(ssh_rsa)
      if ssh_short_key:
        ssh_search_key = ssh_short_key.split(" ")[1]
        #print("ssh-rsa hash:", ssh_search_key)
        key = pagure.lib.query.find_ssh_key(session, ssh_search_key, None)
        if key and key.user and not key.user.token:
          login = key.user.username
          print("login by sslcert:", login, ssh_search_key)

  # read path
  path = env["REQUEST_URI"].split('?')[0].split('/')
  print(path)
  if len(path) < 3 or '.' in path or '..' in path:
    print("bad path")
    return forbidden()
  if path.pop(0) != '':
    print("no leading slash")
    return forbidden()
  if path.pop(0) != 'repos':
    print("not repos")
    return forbidden()
  
  # read reponame
  fork = False
  docs = False
  repouser = None
  namespace = None
  reponame = path.pop(0)
  if reponame == 'docs':
    if len(path) < 1:
      print("bad url format")
      return forbidden()
    docs = True
    reponame = path.pop(0)
  if reponame == 'fork':
    if len(path) < 2:
      print("bad url format")
      return forbidden()
    fork = True
    repouser = path.pop(0)
    reponame = path.pop(0)
  if not reponame.endswith('.git'):
    if not path:
      print("bad url format")
      return forbidden()
    namespace = reponame
    reponame = path.pop(0)
  if not reponame.endswith('.git'):
    print("bad url format")
    return forbidden()
  reponame = reponame[:-4]
  
  # get repo
  repo = pagure.lib.query.get_authorized_project(
    session      = session,
    project_name = reponame,
    user         = repouser,
    namespace    = namespace,
    asuser       = login )
  if not repo:
    print("no repo [%s][%s][%s][%s]" % (str(fork), repouser, namespace, reponame))
    return forbidden() if login else unauthorized()
  
  # check access mode
  method = env["REQUEST_METHOD"]
  getvars = urllib.parse.parse_qs(env["QUERY_STRING"])
  readwrite = env["REQUEST_METHOD"] != 'GET'
  if method == 'GET' and getvars.get('service', list()).count('git-receive-pack'):
    readwrite = True 
  elif method == 'POST' and path and path[0] == 'git-upload-pack':
    readwrite = False
    
  # check write access
  if readwrite:
    print("write [%s]" % str(login))
  if readwrite and (not login or not pagure.utils.is_repo_committer(repo, login, session)):
    print("no write access")
    return forbidden() if login else unauthorized()
  
  print("pass to proxy")
  return httpproxy(HOST, PORT, login)


def badgateway():
  return flask.Response('502  Bad Gateway', status = '502  Bad Gateway')
def forbidden():
  return flask.Response('403 Forbidden', status = '403 Forbidden')
def unauthorized():
  return flask.Response(
    '401 Unauthorized',
    status = '401 Unauthorized',
    headers = Headers([('WWW-Authenticate', 'Basic ream="Authorization area", charset="UTF-8"')]) )


def reader(data, connection = None):
  count = 0
  while True:
    chunk = data.read(4096)
    if not chunk: break
    count += len(chunk)
    yield chunk
  if connection:
    connection.close()
    print('reply done %d' % count)
  else:
    print('query done %d' % count)


def httpproxy(host, port, login):
  assert(host)
  assert(port)
  
  skip_headers = {
    'connection',
    'keep-alive',
    'proxy-authenticate',
    'proxy-authorization',
    'proxy-connection',
    'te',
    'trailers',
    'transfer-encoding',
    'upgrade',
    'authorization',
    'www-authenticate',
    'gzip' }

  env = flask.request.environ
  
  # input method
  method = env["REQUEST_METHOD"]
  print(method)

  # gather input headers
  header_prefix = 'HTTP_'
  proxy_headers = dict()
  for k, v in env.items():
    if k.startswith(header_prefix):
      kk = k[len(header_prefix):].lower().replace('_', '-')
      if not kk in skip_headers:
        proxy_headers[kk] = v
  if 'CONTENT_TYPE' in env and env['CONTENT_TYPE']:
    proxy_headers['content-type'] = env['CONTENT_TYPE']
  try:
    length = int(env['CONTENT_LENGTH'])
    if length: proxy_headers['content-length'] = str(length)
  except Exception:
    pass
  proxy_headers['host'] = host
  if login:
    proxy_headers['pagure-user'] = login
  #print(proxy_headers)

  # input uri
  uri = env["REQUEST_URI"]
  print(uri)

  # input body
  body = reader(env['wsgi.input'])

  connection = None
  try:
    connection = HTTPConnection(host = host, port = port)
    connection.request(
      method,
      uri,
      body = body,
      headers = proxy_headers )
  except Exception as e:
    return badgateway()

  response = connection.getresponse()
  headers = list()
  for k, v in response.getheaders():
    if not k.lower() in skip_headers:
      headers.append( (k, v) )

  return flask.Response(
    reader(response, connection),
    str(response.status) + ' ' + str(response.reason),
    Headers(headers) )