Synnefo

# Copyright 2011-2012 GRNET S.A. All rights reserved.

#

# Redistribution and use in source and binary forms, with or

# without modification, are permitted provided that the following

# conditions are met:

#

#   1. Redistributions of source code must retain the above

#      copyright notice, this list of conditions and the following

#      disclaimer.

#

#   2. Redistributions in binary form must reproduce the above

#      copyright notice, this list of conditions and the following

#      disclaimer in the documentation and/or other materials

#      provided with the distribution.

#

# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS

# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR

# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED

# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN

# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

# POSSIBILITY OF SUCH DAMAGE.

#

# The views and conclusions contained in the software and

# documentation are those of the authors and should not be

# interpreted as representing official policies, either expressed

# or implied, of GRNET S.A.

import hashlib

import uuid

import logging

import json

import math

from time import asctime

from datetime import datetime, timedelta

from base64 import b64encode

from urlparse import urlparse

from urllib import quote

from random import randint

from collections import defaultdict, namedtuple

from django.db import models, IntegrityError, transaction

from django.contrib.auth.models import User, UserManager, Group, Permission

from django.utils.translation import ugettext as _

from django.core.exceptions import ValidationError

from django.db.models.signals import (

    pre_save, post_save, post_syncdb, post_delete)

from django.contrib.contenttypes.models import ContentType

from django.dispatch import Signal

from django.db.models import Q

from django.core.urlresolvers import reverse

from django.utils.http import int_to_base36

from django.contrib.auth.tokens import default_token_generator

from django.conf import settings

from django.utils.importlib import import_module

from django.utils.safestring import mark_safe

from django.core.validators import email_re

from django.core.exceptions import PermissionDenied, ObjectDoesNotExist

from astakos.im.settings import (

    DEFAULT_USER_LEVEL, INVITATIONS_PER_LEVEL,

    AUTH_TOKEN_DURATION, EMAILCHANGE_ACTIVATION_DAYS, LOGGING_LEVEL,

    SITENAME, SERVICES, MODERATION_ENABLED, RESOURCES_PRESENTATION_DATA,

    PROJECT_MEMBER_JOIN_POLICIES, PROJECT_MEMBER_LEAVE_POLICIES, PROJECT_ADMINS)

from astakos.im import settings as astakos_settings

from astakos.im.endpoints.qh import (

    register_users, send_quotas, qh_check_users, qh_get_quota_limits,

    register_services, register_resources, qh_add_quota, QuotaLimits,

    qh_query_serials, qh_ack_serials,

    QuotaValues, add_quota_values)

from astakos.im import auth_providers

import astakos.im.messages as astakos_messages

from astakos.im.lock import with_lock

from .managers import ForUpdateManager

from synnefo.lib.quotaholder.api import QH_PRACTICALLY_INFINITE

from synnefo.lib.db.intdecimalfield import intDecimalField

logger = logging.getLogger(__name__)

DEFAULT_CONTENT_TYPE = None

_content_type = None

def get_content_type():

    global _content_type

    if _content_type is not None:

        return _content_type

    try:

        content_type = ContentType.objects.get(app_label='im', model='astakosuser')

    except:

        content_type = DEFAULT_CONTENT_TYPE

    _content_type = content_type

    return content_type

RESOURCE_SEPARATOR = '.'

inf = float('inf')

class Service(models.Model):

    name = models.CharField(_('Name'), max_length=255, unique=True, db_index=True)

    url = models.FilePathField()

    icon = models.FilePathField(blank=True)

    auth_token = models.CharField(_('Authentication Token'), max_length=32,

                                  null=True, blank=True)

    auth_token_created = models.DateTimeField(_('Token creation date'), null=True)

    auth_token_expires = models.DateTimeField(

        _('Token expiration date'), null=True)

    order = models.PositiveIntegerField(default=0)

    class Meta:

        ordering = ('order', )

    def renew_token(self, expiration_date=None):

        md5 = hashlib.md5()

        md5.update(self.name.encode('ascii', 'ignore'))

        md5.update(self.url.encode('ascii', 'ignore'))

        md5.update(asctime())

        self.auth_token = b64encode(md5.digest())

        self.auth_token_created = datetime.now()

        if expiration_date:

            self.auth_token_expires = expiration_date

        else:

            self.auth_token_expires = None

    def __str__(self):

        return self.name

    @property

    def resources(self):

        return self.resource_set.all()

    @resources.setter

    def resources(self, resources):

        for s in resources:

            self.resource_set.create(**s)

class ResourceMetadata(models.Model):

    key = models.CharField(_('Name'), max_length=255, unique=True, db_index=True)

    value = models.CharField(_('Value'), max_length=255)

_presentation_data = {}

def get_presentation(resource):

    global _presentation_data

    presentation = _presentation_data.get(resource, {})

    if not presentation:

        resource_presentation = RESOURCES_PRESENTATION_DATA.get('resources', {})

        presentation = resource_presentation.get(resource, {})

        _presentation_data[resource] = presentation

    return presentation

class Resource(models.Model):

    name = models.CharField(_('Name'), max_length=255)

    meta = models.ManyToManyField(ResourceMetadata)

    service = models.ForeignKey(Service)

    desc = models.TextField(_('Description'), null=True)

    unit = models.CharField(_('Name'), null=True, max_length=255)

    group = models.CharField(_('Group'), null=True, max_length=255)

    uplimit = intDecimalField(default=0)

    class Meta:

        unique_together = ("service", "name")

    def __str__(self):

        return '%s%s%s' % (self.service, RESOURCE_SEPARATOR, self.name)

    def full_name(self):

        return str(self)

    @property

    def help_text(self):

        return get_presentation(str(self)).get('help_text', '')

    @property

    def help_text_input_each(self):

        return get_presentation(str(self)).get('help_text_input_each', '')

    @property

    def is_abbreviation(self):

        return get_presentation(str(self)).get('is_abbreviation', False)

    @property

    def report_desc(self):

        return get_presentation(str(self)).get('report_desc', '')

    @property

    def placeholder(self):

        return get_presentation(str(self)).get('placeholder', '')

    @property

    def verbose_name(self):

        return get_presentation(str(self)).get('verbose_name', '')

    @property

    def display_name(self):

        name = self.verbose_name

        if self.is_abbreviation:

            name = name.upper()

        return name

    @property

    def pluralized_display_name(self):

        if not self.unit:

            return '%ss' % self.display_name

        return self.display_name

def load_service_resources():

    ss = []

    rs = []

    counter = 0

    for service_name, data in sorted(SERVICES.iteritems()):

        url = data.get('url')

        order = data.get('order', counter)

        counter = order + 1

        resources = data.get('resources') or ()

        service, created = Service.objects.get_or_create(

            name=service_name,

            defaults={'url': url, 'order': order}

        )

        if not created:

            service.url = url

            service.save()

        ss.append(service)

        for resource in resources:

            try:

                resource_name = resource.pop('name', '')

                r, created = Resource.objects.get_or_create(

                        service=service, name=resource_name,

                        defaults=resource)

                if not created:

                    r.desc = resource['desc']

                    r.unit = resource.get('unit', None)

                    r.group = resource['group']

                    r.uplimit = resource['uplimit']

                    r.save()

                rs.append(r)

            except Exception, e:

                print "Cannot create resource ", resource_name

                import traceback; traceback.print_exc()

                continue

    register_services(ss)

    register_resources(rs)

def _quota_values(capacity):

    return QuotaValues(

        quantity = 0,

        capacity = capacity,

        import_limit = QH_PRACTICALLY_INFINITE,

        export_limit = QH_PRACTICALLY_INFINITE)

def get_default_quota():

    _DEFAULT_QUOTA = {}

    resources = Resource.objects.all()

    for resource in resources:

        capacity = resource.uplimit

        limits = _quota_values(capacity)

        _DEFAULT_QUOTA[resource.full_name()] = limits

    return _DEFAULT_QUOTA

def get_resource_names():

    _RESOURCE_NAMES = []

    resources = Resource.objects.all()

    _RESOURCE_NAMES = [resource.full_name() for resource in resources]

    return _RESOURCE_NAMES

class AstakosUserManager(UserManager):

    def get_auth_provider_user(self, provider, **kwargs):

        """

        Retrieve AstakosUser instance associated with the specified third party

        id.

        """

        kwargs = dict(map(lambda x: ('auth_providers__%s' % x[0], x[1]),

                          kwargs.iteritems()))

        return self.get(auth_providers__module=provider, **kwargs)

    def get_by_email(self, email):

        return self.get(email=email)

    def get_by_identifier(self, email_or_username, **kwargs):

        try:

            return self.get(email__iexact=email_or_username, **kwargs)

        except AstakosUser.DoesNotExist:

            return self.get(username__iexact=email_or_username, **kwargs)

    def user_exists(self, email_or_username, **kwargs):

        qemail = Q(email__iexact=email_or_username)

        qusername = Q(username__iexact=email_or_username)

        qextra = Q(**kwargs)

        return self.filter((qemail | qusername) & qextra).exists()

    def verified_user_exists(self, email_or_username):

        return self.user_exists(email_or_username, email_verified=True)

    def verified(self):

        return self.filter(email_verified=True)

    def verified(self):

        return self.filter(email_verified=True)

    def uuid_catalog(self, l=None):

        """

        Returns a uuid to username mapping for the uuids appearing in l.

        If l is None returns the mapping for all existing users.

        """

        q = self.filter(uuid__in=l) if l != None else self

        return dict(q.values_list('uuid', 'username'))

    def displayname_catalog(self, l=None):

        """

        Returns a username to uuid mapping for the usernames appearing in l.

        If l is None returns the mapping for all existing users.

        """

        if l is not None:

            lmap = dict((x.lower(), x) for x in l)

            q = self.filter(username__in=lmap.keys())

            values = ((lmap[n], u) for n, u in q.values_list('username', 'uuid'))

        else:

            q = self

            values = self.values_list('username', 'uuid')

        return dict(values)

class AstakosUser(User):

    """

    Extends ``django.contrib.auth.models.User`` by defining additional fields.

    """

    affiliation = models.CharField(_('Affiliation'), max_length=255, blank=True,

                                   null=True)

    # DEPRECATED FIELDS: provider, third_party_identifier moved in

    #                    AstakosUserProvider model.

    provider = models.CharField(_('Provider'), max_length=255, blank=True,

                                null=True)

    # ex. screen_name for twitter, eppn for shibboleth

    third_party_identifier = models.CharField(_('Third-party identifier'),

                                              max_length=255, null=True,

                                              blank=True)

    #for invitations

    user_level = DEFAULT_USER_LEVEL

    level = models.IntegerField(_('Inviter level'), default=user_level)

    invitations = models.IntegerField(

        _('Invitations left'), default=INVITATIONS_PER_LEVEL.get(user_level, 0))

    auth_token = models.CharField(_('Authentication Token'), max_length=32,

                  null=True, blank=True, help_text=_('Renew authentication token'))

    auth_token_created = models.DateTimeField(_('Token creation date'), null=True)

    auth_token_expires = models.DateTimeField(

        _('Token expiration date'), null=True)

    updated = models.DateTimeField(_('Update date'))

    is_verified = models.BooleanField(_('Is verified?'), default=False)

    email_verified = models.BooleanField(_('Email verified?'), default=False)

    has_credits = models.BooleanField(_('Has credits?'), default=False)

    has_signed_terms = models.BooleanField(

        _('I agree with the terms'), default=False)

    date_signed_terms = models.DateTimeField(

        _('Signed terms date'), null=True, blank=True)

    activation_sent = models.DateTimeField(

        _('Activation sent data'), null=True, blank=True)

    policy = models.ManyToManyField(

        Resource, null=True, through='AstakosUserQuota')

    uuid = models.CharField(max_length=255, null=True, blank=False, unique=True)

    __has_signed_terms = False

    disturbed_quota = models.BooleanField(_('Needs quotaholder syncing'),

                                           default=False, db_index=True)

    objects = AstakosUserManager()

    def __init__(self, *args, **kwargs):

        super(AstakosUser, self).__init__(*args, **kwargs)

        self.__has_signed_terms = self.has_signed_terms

        if not self.id:

            self.is_active = False

    @property

    def realname(self):

        return '%s %s' % (self.first_name, self.last_name)

    @realname.setter

    def realname(self, value):

        parts = value.split(' ')

        if len(parts) == 2:

            self.first_name = parts[0]

            self.last_name = parts[1]

        else:

            self.last_name = parts[0]

    def add_permission(self, pname):

        if self.has_perm(pname):

            return

        p, created = Permission.objects.get_or_create(

                                    codename=pname,

                                    name=pname.capitalize(),

                                    content_type=get_content_type())

        self.user_permissions.add(p)

    def remove_permission(self, pname):

        if self.has_perm(pname):

            return

        p = Permission.objects.get(codename=pname,

                                   content_type=get_content_type())

        self.user_permissions.remove(p)

    def is_project_admin(self, application_id=None):

        return self.uuid in PROJECT_ADMINS

    @property

    def invitation(self):

        try:

            return Invitation.objects.get(username=self.email)

        except Invitation.DoesNotExist:

            return None

    def initial_quotas(self):

        quotas = dict(get_default_quota())

        for user_quota in self.policies:

            resource = user_quota.resource.full_name()

            quotas[resource] = user_quota.quota_values()

        return quotas

    def all_quotas(self):

        quotas = self.initial_quotas()

        objects = self.projectmembership_set.select_related()

        memberships = objects.filter(is_active=True)

        for membership in memberships:

            application = membership.application

            if application is None:

                m = _("missing application for active membership %s"

                      % (membership,))

                raise AssertionError(m)

            grants = application.projectresourcegrant_set.all()

            for grant in grants:

                resource = grant.resource.full_name()

                prev = quotas.get(resource, 0)

                new = add_quota_values(prev, grant.member_quota_values())

                quotas[resource] = new

        return quotas

    @property

    def policies(self):

        return self.astakosuserquota_set.select_related().all()

    @policies.setter

    def policies(self, policies):

        for p in policies:

            p.setdefault('resource', '')

            p.setdefault('capacity', 0)

            p.setdefault('quantity', 0)

            p.setdefault('import_limit', 0)

            p.setdefault('export_limit', 0)

            p.setdefault('update', True)

            self.add_resource_policy(**p)

    def add_resource_policy(

            self, resource, capacity, quantity, import_limit,

            export_limit, update=True):

        """Raises ObjectDoesNotExist, IntegrityError"""

        s, sep, r = resource.partition(RESOURCE_SEPARATOR)

        resource = Resource.objects.get(service__name=s, name=r)

        if update:

            AstakosUserQuota.objects.update_or_create(

                user=self, resource=resource, defaults={

                    'capacity':capacity,

                    'quantity': quantity,

                    'import_limit':import_limit,

                    'export_limit':export_limit})

        else:

            q = self.astakosuserquota_set

            q.create(

                resource=resource, capacity=capacity, quanity=quantity,

                import_limit=import_limit, export_limit=export_limit)

    def remove_resource_policy(self, service, resource):

        """Raises ObjectDoesNotExist, IntegrityError"""

        resource = Resource.objects.get(service__name=service, name=resource)

        q = self.policies.get(resource=resource).delete()

    def update_uuid(self):

        while not self.uuid:

            uuid_val =  str(uuid.uuid4())

            try:

                AstakosUser.objects.get(uuid=uuid_val)

            except AstakosUser.DoesNotExist, e:

                self.uuid = uuid_val

        return self.uuid

    def save(self, update_timestamps=True, **kwargs):

        if update_timestamps:

            if not self.id:

                self.date_joined = datetime.now()

            self.updated = datetime.now()

        # update date_signed_terms if necessary

        if self.__has_signed_terms != self.has_signed_terms:

            self.date_signed_terms = datetime.now()

        self.update_uuid()

        if self.username != self.email.lower():

            # set username

            self.username = self.email.lower()

        super(AstakosUser, self).save(**kwargs)

    def renew_token(self, flush_sessions=False, current_key=None):

        md5 = hashlib.md5()

        md5.update(settings.SECRET_KEY)

        md5.update(self.username)

        md5.update(self.realname.encode('ascii', 'ignore'))

        md5.update(asctime())

        self.auth_token = b64encode(md5.digest())

        self.auth_token_created = datetime.now()

        self.auth_token_expires = self.auth_token_created + \

                                  timedelta(hours=AUTH_TOKEN_DURATION)

        if flush_sessions:

            self.flush_sessions(current_key)

        msg = 'Token renewed for %s' % self.email

        logger.log(LOGGING_LEVEL, msg)

    def flush_sessions(self, current_key=None):

        q = self.sessions

        if current_key:

            q = q.exclude(session_key=current_key)

        keys = q.values_list('session_key', flat=True)

        if keys:

            msg = 'Flushing sessions: %s' % ','.join(keys)

            logger.log(LOGGING_LEVEL, msg, [])

        engine = import_module(settings.SESSION_ENGINE)

        for k in keys:

            s = engine.SessionStore(k)

            s.flush()

    def __unicode__(self):

        return '%s (%s)' % (self.realname, self.email)

    def conflicting_email(self):

        q = AstakosUser.objects.exclude(username=self.username)

        q = q.filter(email__iexact=self.email)

        if q.count() != 0:

            return True

        return False

    def email_change_is_pending(self):

        return self.emailchanges.count() > 0

    @property

    def signed_terms(self):

        term = get_latest_terms()

        if not term:

            return True

        if not self.has_signed_terms:

            return False

        if not self.date_signed_terms:

            return False

        if self.date_signed_terms < term.date:

            self.has_signed_terms = False

            self.date_signed_terms = None

            self.save()

            return False

        return True

    def set_invitations_level(self):

        """

        Update user invitation level

        """

        level = self.invitation.inviter.level + 1

        self.level = level

        self.invitations = INVITATIONS_PER_LEVEL.get(level, 0)

    def can_login_with_auth_provider(self, provider):

        if not self.has_auth_provider(provider):

            return False

        else:

            return auth_providers.get_provider(provider).is_available_for_login()

    def can_add_auth_provider(self, provider, include_unverified=False, **kwargs):

        provider_settings = auth_providers.get_provider(provider)

        if not provider_settings.is_available_for_add():

            return False

        if self.has_auth_provider(provider) and \

           provider_settings.one_per_user:

            return False

        if 'provider_info' in kwargs:

            kwargs.pop('provider_info')

        if 'identifier' in kwargs:

            try:

                # provider with specified params already exist

                if not include_unverified:

                    kwargs['user__email_verified'] = True

                existing_user = AstakosUser.objects.get_auth_provider_user(provider,

                                                                   **kwargs)

            except AstakosUser.DoesNotExist:

                return True

            else:

                return False

        return True

    def can_remove_auth_provider(self, module):

        provider = auth_providers.get_provider(module)

        existing = self.get_active_auth_providers()

        existing_for_provider = self.get_active_auth_providers(module=module)

        if len(existing) <= 1:

            return False

        if len(existing_for_provider) == 1 and provider.is_required():

            return False

        return provider.is_available_for_remove()

    def can_change_password(self):

        return self.has_auth_provider('local', auth_backend='astakos')

    def can_change_email(self):

        non_astakos_local = self.get_auth_providers().filter(module='local')

        non_astakos_local = non_astakos_local.exclude(auth_backend='astakos')

        return non_astakos_local.count() == 0

    def has_required_auth_providers(self):

        required = auth_providers.REQUIRED_PROVIDERS

        for provider in required:

            if not self.has_auth_provider(provider):

                return False

        return True

    def has_auth_provider(self, provider, **kwargs):

        return bool(self.get_auth_providers().filter(module=provider,

                                               **kwargs).count())

    def add_auth_provider(self, provider, **kwargs):

        info_data = ''

        if 'provider_info' in kwargs:

            info_data = kwargs.pop('provider_info')

            if isinstance(info_data, dict):

                info_data = json.dumps(info_data)

        if self.can_add_auth_provider(provider, **kwargs):

            if 'identifier' in kwargs:

                # clean up third party pending for activation users of the same

                # identifier

                AstakosUserAuthProvider.objects.remove_unverified_providers(provider,

                                                                **kwargs)

            self.auth_providers.create(module=provider, active=True,

                                       info_data=info_data,

                                       **kwargs)

        else:

            raise Exception('Cannot add provider')

    def add_pending_auth_provider(self, pending):

        """

        Convert PendingThirdPartyUser object to AstakosUserAuthProvider entry for

        the current user.

        """

        if not isinstance(pending, PendingThirdPartyUser):

            pending = PendingThirdPartyUser.objects.get(token=pending)

        provider = self.add_auth_provider(pending.provider,

                               identifier=pending.third_party_identifier,

                                affiliation=pending.affiliation,

                                          provider_info=pending.info)

        if email_re.match(pending.email or '') and pending.email != self.email:

            self.additionalmail_set.get_or_create(email=pending.email)

        pending.delete()

        return provider

    def remove_auth_provider(self, provider, **kwargs):

        self.get_auth_providers().get(module=provider, **kwargs).delete()

    # user urls

    def get_resend_activation_url(self):

        return reverse('send_activation', kwargs={'user_id': self.pk})

    def get_provider_remove_url(self, module, **kwargs):

        return reverse('remove_auth_provider', kwargs={

            'pk': self.get_auth_providers().get(module=module, **kwargs).pk})

    def get_activation_url(self, nxt=False):

        url = "%s?auth=%s" % (reverse('astakos.im.views.activate'),

                                 quote(self.auth_token))

        if nxt:

            url += "&next=%s" % quote(nxt)

        return url

    def get_password_reset_url(self, token_generator=default_token_generator):

        return reverse('django.contrib.auth.views.password_reset_confirm',

                          kwargs={'uidb36':int_to_base36(self.id),

                                  'token':token_generator.make_token(self)})

    def get_auth_providers(self):

        return self.auth_providers

    def get_available_auth_providers(self):

        """

        Returns a list of providers available for user to connect to.

        """

        providers = []

        for module, provider_settings in auth_providers.PROVIDERS.iteritems():

            if self.can_add_auth_provider(module):

                providers.append(provider_settings(self))

        modules = astakos_settings.IM_MODULES

        def key(p):

            if not p.module in modules:

                return 100

            return modules.index(p.module)

        providers = sorted(providers, key=key)

        return providers

    def get_active_auth_providers(self, **filters):

        providers = []

        for provider in self.get_auth_providers().active(**filters):

            if auth_providers.get_provider(provider.module).is_available_for_login():

                providers.append(provider)

        modules = astakos_settings.IM_MODULES

        def key(p):

            if not p.module in modules:

                return 100

            return modules.index(p.module)

        providers = sorted(providers, key=key)

        return providers

    @property

    def auth_providers_display(self):

        return ",".join(map(lambda x:unicode(x), self.get_auth_providers().active()))

    def get_inactive_message(self):

        msg_extra = ''

        message = ''

        if self.activation_sent:

            if self.email_verified:

                message = _(astakos_messages.ACCOUNT_INACTIVE)

            else:

                message = _(astakos_messages.ACCOUNT_PENDING_ACTIVATION)

                if astakos_settings.MODERATION_ENABLED:

                    msg_extra = _(astakos_messages.ACCOUNT_PENDING_ACTIVATION_HELP)

                else:

                    url = self.get_resend_activation_url()

                    msg_extra = mark_safe(_(astakos_messages.ACCOUNT_PENDING_ACTIVATION_HELP) + \

                                u' ' + \

                                _('<a href="%s">%s?</a>') % (url,

                                _(astakos_messages.ACCOUNT_RESEND_ACTIVATION_PROMPT)))

        else:

            if astakos_settings.MODERATION_ENABLED:

                message = _(astakos_messages.ACCOUNT_PENDING_MODERATION)

            else:

                message = astakos_messages.ACCOUNT_PENDING_ACTIVATION

                url = self.get_resend_activation_url()

                msg_extra = mark_safe(_('<a href="%s">%s?</a>') % (url,

                            _(astakos_messages.ACCOUNT_RESEND_ACTIVATION_PROMPT)))

        return mark_safe(message + u' '+ msg_extra)

    def owns_application(self, application):

        return application.owner == self

    def owns_project(self, project):

        return project.application.owner == self

    def is_associated(self, project):

        try:

            m = ProjectMembership.objects.get(person=self, project=project)

            return m.state in ProjectMembership.ASSOCIATED_STATES

        except ProjectMembership.DoesNotExist:

            return False

    def get_membership(self, project):

        try:

            return ProjectMembership.objects.get(

                project=project,

                person=self)

        except ProjectMembership.DoesNotExist:

            return None

    def membership_display(self, project):

        m = self.get_membership(project)

        if m is None:

            return _('Not a member')

        else:

            return m.user_friendly_state_display()

    def non_owner_can_view(self, maybe_project):

        if self.is_project_admin():

            return True

        if maybe_project is None:

            return False

        project = maybe_project

        if self.is_associated(project):

            return True

        if project.is_deactivated():

            return False

        return True

class AstakosUserAuthProviderManager(models.Manager):

    def active(self, **filters):

        return self.filter(active=True, **filters)

    def remove_unverified_providers(self, provider, **filters):

        try:

            existing = self.filter(module=provider, user__email_verified=False, **filters)

            for p in existing:

                p.user.delete()

        except:

            pass

class AstakosUserAuthProvider(models.Model):

    """

    Available user authentication methods.

    """

    affiliation = models.CharField(_('Affiliation'), max_length=255, blank=True,

                                   null=True, default=None)

    user = models.ForeignKey(AstakosUser, related_name='auth_providers')

    module = models.CharField(_('Provider'), max_length=255, blank=False,

                                default='local')

    identifier = models.CharField(_('Third-party identifier'),

                                              max_length=255, null=True,

                                              blank=True)

    active = models.BooleanField(default=True)

    auth_backend = models.CharField(_('Backend'), max_length=255, blank=False,

                                   default='astakos')

    info_data = models.TextField(default="", null=True, blank=True)

    created = models.DateTimeField('Creation date', auto_now_add=True)

    objects = AstakosUserAuthProviderManager()

    class Meta:

        unique_together = (('identifier', 'module', 'user'), )

        ordering = ('module', 'created')

    def __init__(self, *args, **kwargs):

        super(AstakosUserAuthProvider, self).__init__(*args, **kwargs)

        try:

            self.info = json.loads(self.info_data)

            if not self.info:

                self.info = {}

        except Exception, e:

            self.info = {}

        for key,value in self.info.iteritems():

            setattr(self, 'info_%s' % key, value)

    @property

    def settings(self):

        return auth_providers.get_provider(self.module)

    @property

    def details_display(self):

        try:

            params = self.user.__dict__

            params.update(self.__dict__)

            return self.settings.get_details_tpl_display % params

        except:

            return ''

    @property

    def title_display(self):

        title_tpl = self.settings.get_title_display

        try:

            if self.settings.get_user_title_display:

                title_tpl = self.settings.get_user_title_display

        except Exception, e:

            pass

        try:

          return title_tpl % self.__dict__

        except:

          return self.settings.get_title_display % self.__dict__

    def can_remove(self):

        return self.user.can_remove_auth_provider(self.module)

    def delete(self, *args, **kwargs):

        ret = super(AstakosUserAuthProvider, self).delete(*args, **kwargs)

        if self.module == 'local':

            self.user.set_unusable_password()

            self.user.save()

        return ret

    def __repr__(self):

        return '<AstakosUserAuthProvider %s:%s>' % (self.module, self.identifier)

    def __unicode__(self):

        if self.identifier:

            return "%s:%s" % (self.module, self.identifier)

        if self.auth_backend:

            return "%s:%s" % (self.module, self.auth_backend)

        return self.module

    def save(self, *args, **kwargs):

        self.info_data = json.dumps(self.info)

        return super(AstakosUserAuthProvider, self).save(*args, **kwargs)

class ExtendedManager(models.Manager):

    def _update_or_create(self, **kwargs):

        assert kwargs, \

            'update_or_create() must be passed at least one keyword argument'

        obj, created = self.get_or_create(**kwargs)

        defaults = kwargs.pop('defaults', {})

        if created:

            return obj, True, False

        else:

            try:

                params = dict(

                    [(k, v) for k, v in kwargs.items() if '__' not in k])

                params.update(defaults)

                for attr, val in params.items():

                    if hasattr(obj, attr):

                        setattr(obj, attr, val)

                sid = transaction.savepoint()

                obj.save(force_update=True)

                transaction.savepoint_commit(sid)

                return obj, False, True

            except IntegrityError, e:

                transaction.savepoint_rollback(sid)

                try:

                    return self.get(**kwargs), False, False

                except self.model.DoesNotExist:

                    raise e

    update_or_create = _update_or_create

class AstakosUserQuota(models.Model):

    objects = ExtendedManager()

    capacity = intDecimalField()

    quantity = intDecimalField(default=0)

    export_limit = intDecimalField(default=QH_PRACTICALLY_INFINITE)

    import_limit = intDecimalField(default=QH_PRACTICALLY_INFINITE)

    resource = models.ForeignKey(Resource)

    user = models.ForeignKey(AstakosUser)

    class Meta:

        unique_together = ("resource", "user")

    def quota_values(self):

        return QuotaValues(

            quantity = self.quantity,

            capacity = self.capacity,

            import_limit = self.import_limit,

            export_limit = self.export_limit)

class ApprovalTerms(models.Model):

    """

    Model for approval terms

    """

    date = models.DateTimeField(

        _('Issue date'), db_index=True, auto_now_add=True)

    location = models.CharField(_('Terms location'), max_length=255)

class Invitation(models.Model):

    """

    Model for registring invitations

    """

    inviter = models.ForeignKey(AstakosUser, related_name='invitations_sent',

                                null=True)

    realname = models.CharField(_('Real name'), max_length=255)

    username = models.CharField(_('Unique ID'), max_length=255, unique=True)

    code = models.BigIntegerField(_('Invitation code'), db_index=True)

    is_consumed = models.BooleanField(_('Consumed?'), default=False)

    created = models.DateTimeField(_('Creation date'), auto_now_add=True)

    consumed = models.DateTimeField(_('Consumption date'), null=True, blank=True)

    def __init__(self, *args, **kwargs):

        super(Invitation, self).__init__(*args, **kwargs)

        if not self.id:

            self.code = _generate_invitation_code()

    def consume(self):

        self.is_consumed = True

        self.consumed = datetime.now()

        self.save()

    def __unicode__(self):

        return '%s -> %s [%d]' % (self.inviter, self.username, self.code)

class EmailChangeManager(models.Manager):

    @transaction.commit_on_success

    def change_email(self, activation_key):

        """

        Validate an activation key and change the corresponding

        ``User`` if valid.

        If the key is valid and has not expired, return the ``User``

        after activating.

        If the key is not valid or has expired, return ``None``.

        If the key is valid but the ``User`` is already active,

        return ``None``.

        After successful email change the activation record is deleted.

        Throws ValueError if there is already

        """

        try:

            email_change = self.model.objects.get(

                activation_key=activation_key)

            if email_change.activation_key_expired():

                email_change.delete()

                raise EmailChange.DoesNotExist

            # is there an active user with this address?

            try:

                AstakosUser.objects.get(email__iexact=email_change.new_email_address)

            except AstakosUser.DoesNotExist:

                pass

            else:

                raise ValueError(_('The new email address is reserved.'))

            # update user

            user = AstakosUser.objects.get(pk=email_change.user_id)

            old_email = user.email

            user.email = email_change.new_email_address

            user.save()

            email_change.delete()

            msg = "User %d changed email from %s to %s" % (user.pk, old_email,

                                                          user.email)

            logger.log(LOGGING_LEVEL, msg)

            return user

        except EmailChange.DoesNotExist:

            raise ValueError(_('Invalid activation key.'))

class EmailChange(models.Model):

    new_email_address = models.EmailField(

        _(u'new e-mail address'),

        help_text=_('Provide a new email address. Until you verify the new '

                    'address by following the activation link that will be '

                    'sent to it, your old email address will remain active.'))

    user = models.ForeignKey(

        AstakosUser, unique=True, related_name='emailchanges')

    requested_at = models.DateTimeField(auto_now_add=True)

    activation_key = models.CharField(

        max_length=40, unique=True, db_index=True)

    objects = EmailChangeManager()

    def get_url(self):

        return reverse('email_change_confirm',

                      kwargs={'activation_key': self.activation_key})

    def activation_key_expired(self):

        expiration_date = timedelta(days=EMAILCHANGE_ACTIVATION_DAYS)

        return self.requested_at + expiration_date < datetime.now()

class AdditionalMail(models.Model):

    """

    Model for registring invitations

    """

    owner = models.ForeignKey(AstakosUser)

    email = models.EmailField()

def _generate_invitation_code():

    while True: