Synnefo

# Copyright 2011, 2012, 2013 GRNET S.A. All rights reserved.

#

# Redistribution and use in source and binary forms, with or

# without modification, are permitted provided that the following

# conditions are met:

#

#   1. Redistributions of source code must retain the above

#      copyright notice, this list of conditions and the following

#      disclaimer.

#

#   2. Redistributions in binary form must reproduce the above

#      copyright notice, this list of conditions and the following

#      disclaimer in the documentation and/or other materials

#      provided with the distribution.

#

# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS

# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR

# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF

# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED

# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN

# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

# POSSIBILITY OF SUCH DAMAGE.

#

# The views and conclusions contained in the software and

# documentation are those of the authors and should not be

# interpreted as representing official policies, either expressed

# or implied, of GRNET S.A.

import hashlib

import uuid

import logging

import json

import math

import copy

from datetime import datetime, timedelta

import base64

from urllib import quote

from random import randint

import os

from django.db import models, IntegrityError, transaction

from django.contrib.auth.models import User, UserManager, Group, Permission

from django.utils.translation import ugettext as _

from django.db.models.signals import pre_save, post_save

from django.contrib.contenttypes.models import ContentType

from django.db.models import Q, Max

from django.core.urlresolvers import reverse

from django.utils.http import int_to_base36

from django.contrib.auth.tokens import default_token_generator

from django.conf import settings

from django.utils.importlib import import_module

from django.utils.safestring import mark_safe

from synnefo.lib.utils import dict_merge

from astakos.im import settings as astakos_settings

from astakos.im import auth_providers as auth

import astakos.im.messages as astakos_messages

from snf_django.lib.db.managers import ForUpdateManager

from synnefo.lib.ordereddict import OrderedDict

from snf_django.lib.db.fields import intDecimalField

from synnefo.util.text import uenc, udec

from astakos.im import presentation

logger = logging.getLogger(__name__)

DEFAULT_CONTENT_TYPE = None

_content_type = None

def get_content_type():

    global _content_type

    if _content_type is not None:

        return _content_type

    try:

        content_type = ContentType.objects.get(app_label='im',

                                               model='astakosuser')

    except:

        content_type = DEFAULT_CONTENT_TYPE

    _content_type = content_type

    return content_type

inf = float('inf')

def generate_token():

    s = os.urandom(32)

    return base64.urlsafe_b64encode(s).rstrip('=')

class Component(models.Model):

    name = models.CharField(_('Name'), max_length=255, unique=True,

                            db_index=True)

    url = models.CharField(_('Component url'), max_length=1024, null=True,

                           help_text=_("URL the component is accessible from"))

    auth_token = models.CharField(_('Authentication Token'), max_length=64,

                                  null=True, blank=True, unique=True)

    auth_token_created = models.DateTimeField(_('Token creation date'),

                                              null=True)

    auth_token_expires = models.DateTimeField(_('Token expiration date'),

                                              null=True)

    def renew_token(self, expiration_date=None):

        for i in range(10):

            new_token = generate_token()

            count = Component.objects.filter(auth_token=new_token).count()

            if count == 0:

                break

            continue

        else:

            raise ValueError('Could not generate a token')

        self.auth_token = new_token

        self.auth_token_created = datetime.now()

        if expiration_date:

            self.auth_token_expires = expiration_date

        else:

            self.auth_token_expires = None

        msg = 'Token renewed for component %s' % self.name

        logger.log(astakos_settings.LOGGING_LEVEL, msg)

    def __str__(self):

        return self.name

    @classmethod

    def catalog(cls, orderfor=None):

        catalog = {}

        components = list(cls.objects.all())

        default_metadata = presentation.COMPONENTS

        metadata = {}

        for component in components:

            d = {'url': component.url,

                 'name': component.name}

            if component.name in default_metadata:

                metadata[component.name] = default_metadata.get(component.name)

                metadata[component.name].update(d)

            else:

                metadata[component.name] = d

        def component_by_order(s):

            return s[1].get('order')

        def component_by_dashboard_order(s):

            return s[1].get('dashboard').get('order')

        metadata = dict_merge(metadata,

                              astakos_settings.COMPONENTS_META)

        for component, info in metadata.iteritems():

            default_meta = presentation.component_defaults(component)

            base_meta = metadata.get(component, {})

            settings_meta = astakos_settings.COMPONENTS_META.get(component, {})

            component_meta = dict_merge(default_meta, base_meta)

            meta = dict_merge(component_meta, settings_meta)

            catalog[component] = meta

        order_key = component_by_order

        if orderfor == 'dashboard':

            order_key = component_by_dashboard_order

        ordered_catalog = OrderedDict(sorted(catalog.iteritems(),

                                             key=order_key))

        return ordered_catalog

_presentation_data = {}

def get_presentation(resource):

    global _presentation_data

    resource_presentation = _presentation_data.get(resource, {})

    if not resource_presentation:

        resources_presentation = presentation.RESOURCES.get('resources', {})

        resource_presentation = resources_presentation.get(resource, {})

        _presentation_data[resource] = resource_presentation

    return resource_presentation

class Service(models.Model):

    component = models.ForeignKey(Component)

    name = models.CharField(max_length=255, unique=True)

    type = models.CharField(max_length=255)

class Endpoint(models.Model):

    service = models.ForeignKey(Service, related_name='endpoints')

class EndpointData(models.Model):

    endpoint = models.ForeignKey(Endpoint, related_name='data')

    key = models.CharField(max_length=255)

    value = models.CharField(max_length=1024)

    class Meta:

        unique_together = (('endpoint', 'key'),)

class Resource(models.Model):

    name = models.CharField(_('Name'), max_length=255, unique=True)

    desc = models.TextField(_('Description'), null=True)

    service_type = models.CharField(_('Type'), max_length=255)

    service_origin = models.CharField(max_length=255, db_index=True)

    unit = models.CharField(_('Unit'), null=True, max_length=255)

    uplimit = intDecimalField(default=0)

    allow_in_projects = models.BooleanField(default=True)

    objects = ForUpdateManager()

    def __str__(self):

        return self.name

    def full_name(self):

        return str(self)

    def get_info(self):

        return {'service': self.service_origin,

                'description': self.desc,

                'unit': self.unit,

                'allow_in_projects': self.allow_in_projects,

                }

    @property

    def group(self):

        default = self.name

        return get_presentation(str(self)).get('group', default)

    @property

    def help_text(self):

        default = "%s resource" % self.name

        return get_presentation(str(self)).get('help_text', default)

    @property

    def help_text_input_each(self):

        default = "%s resource" % self.name

        return get_presentation(str(self)).get('help_text_input_each', default)

    @property

    def is_abbreviation(self):

        return get_presentation(str(self)).get('is_abbreviation', False)

    @property

    def report_desc(self):

        default = "%s resource" % self.name

        return get_presentation(str(self)).get('report_desc', default)

    @property

    def placeholder(self):

        return get_presentation(str(self)).get('placeholder', self.unit)

    @property

    def verbose_name(self):

        return get_presentation(str(self)).get('verbose_name', self.name)

    @property

    def display_name(self):

        name = self.verbose_name

        if self.is_abbreviation:

            name = name.upper()

        return name

    @property

    def pluralized_display_name(self):

        if not self.unit:

            return '%ss' % self.display_name

        return self.display_name

def get_resource_names():

    _RESOURCE_NAMES = []

    resources = Resource.objects.select_related('service').all()

    _RESOURCE_NAMES = [resource.full_name() for resource in resources]

    return _RESOURCE_NAMES

class AstakosUserManager(UserManager):

    def get_auth_provider_user(self, provider, **kwargs):

        """

        Retrieve AstakosUser instance associated with the specified third party

        id.

        """

        kwargs = dict(map(lambda x: ('auth_providers__%s' % x[0], x[1]),

                          kwargs.iteritems()))

        return self.get(auth_providers__module=provider, **kwargs)

    def get_by_email(self, email):

        return self.get(email=email)

    def get_by_identifier(self, email_or_username, **kwargs):

        try:

            return self.get(email__iexact=email_or_username, **kwargs)

        except AstakosUser.DoesNotExist:

            return self.get(username__iexact=email_or_username, **kwargs)

    def user_exists(self, email_or_username, **kwargs):

        qemail = Q(email__iexact=email_or_username)

        qusername = Q(username__iexact=email_or_username)

        qextra = Q(**kwargs)

        return self.filter((qemail | qusername) & qextra).exists()

    def verified_user_exists(self, email_or_username):

        return self.user_exists(email_or_username, email_verified=True)

    def verified(self):

        return self.filter(email_verified=True)

    def uuid_catalog(self, l=None):

        """

        Returns a uuid to username mapping for the uuids appearing in l.

        If l is None returns the mapping for all existing users.

        """

        q = self.filter(uuid__in=l) if l is not None else self

        return dict(q.values_list('uuid', 'username'))

    def displayname_catalog(self, l=None):

        """

        Returns a username to uuid mapping for the usernames appearing in l.

        If l is None returns the mapping for all existing users.

        """

        if l is not None:

            lmap = dict((x.lower(), x) for x in l)

            q = self.filter(username__in=lmap.keys())

            values = ((lmap[n], u)

                      for n, u in q.values_list('username', 'uuid'))

        else:

            q = self

            values = self.values_list('username', 'uuid')

        return dict(values)

class AstakosUser(User):

    """

    Extends ``django.contrib.auth.models.User`` by defining additional fields.

    """

    affiliation = models.CharField(_('Affiliation'), max_length=255,

                                   blank=True, null=True)

    #for invitations

    user_level = astakos_settings.DEFAULT_USER_LEVEL

    level = models.IntegerField(_('Inviter level'), default=user_level)

    invitations = models.IntegerField(

        _('Invitations left'),

        default=astakos_settings.INVITATIONS_PER_LEVEL.get(user_level, 0))

    auth_token = models.CharField(

        _('Authentication Token'),

        max_length=64,

        unique=True,

        null=True,

        blank=True,

        help_text=_('Renew your authentication '

                    'token. Make sure to set the new '

                    'token in any client you may be '

                    'using, to preserve its '

                    'functionality.'))

    auth_token_created = models.DateTimeField(_('Token creation date'),

                                              null=True)

    auth_token_expires = models.DateTimeField(

        _('Token expiration date'), null=True)

    updated = models.DateTimeField(_('Update date'))

    # Arbitrary text to identify the reason user got deactivated.

    # To be used as a reference from administrators.

    deactivated_reason = models.TextField(

        _('Reason the user was disabled for'),

        default=None, null=True)

    deactivated_at = models.DateTimeField(_('User deactivated at'), null=True,

                                          blank=True)

    has_credits = models.BooleanField(_('Has credits?'), default=False)

    # this is set to True when user profile gets updated for the first time

    is_verified = models.BooleanField(_('Is verified?'), default=False)

    # user email is verified

    email_verified = models.BooleanField(_('Email verified?'), default=False)

    # unique string used in user email verification url

    verification_code = models.CharField(max_length=255, null=True,

                                         blank=False, unique=True)

    # date user email verified

    verified_at = models.DateTimeField(_('User verified email at'), null=True,

                                       blank=True)

    # email verification notice was sent to the user at this time

    activation_sent = models.DateTimeField(_('Activation sent date'),

                                           null=True, blank=True)

    # user got rejected during moderation process

    is_rejected = models.BooleanField(_('Account rejected'),

                                      default=False)

    # reason user got rejected

    rejected_reason = models.TextField(_('User rejected reason'), null=True,

                                       blank=True)

    # moderation status

    moderated = models.BooleanField(_('User moderated'), default=False)

    # date user moderated (either accepted or rejected)

    moderated_at = models.DateTimeField(_('Date moderated'), default=None,

                                        blank=True, null=True)

    # a snapshot of user instance the time got moderated

    moderated_data = models.TextField(null=True, default=None, blank=True)

    # a string which identifies how the user got moderated

    accepted_policy = models.CharField(_('Accepted policy'), max_length=255,

                                       default=None, null=True, blank=True)

    # the email used to accept the user

    accepted_email = models.EmailField(null=True, default=None, blank=True)

    has_signed_terms = models.BooleanField(_('I agree with the terms'),

                                           default=False)

    date_signed_terms = models.DateTimeField(_('Signed terms date'),

                                             null=True, blank=True)

    # permanent unique user identifier

    uuid = models.CharField(max_length=255, null=True, blank=False,

                            unique=True)

    policy = models.ManyToManyField(

        Resource, null=True, through='AstakosUserQuota')

    disturbed_quota = models.BooleanField(_('Needs quotaholder syncing'),

                                          default=False, db_index=True)

    objects = AstakosUserManager()

    forupdate = ForUpdateManager()

    def __init__(self, *args, **kwargs):

        super(AstakosUser, self).__init__(*args, **kwargs)

        if not self.id:

            self.is_active = False

    @property

    def realname(self):

        return '%s %s' % (self.first_name, self.last_name)

    @property

    def log_display(self):

        """

        Should be used in all logger.* calls that refer to a user so that

        user display is consistent across log entries.

        """

        return '%s::%s' % (self.uuid, self.email)

    @realname.setter

    def realname(self, value):

        parts = value.split(' ')

        if len(parts) == 2:

            self.first_name = parts[0]

            self.last_name = parts[1]

        else:

            self.last_name = parts[0]

    def add_permission(self, pname):

        if self.has_perm(pname):

            return

        p, created = Permission.objects.get_or_create(

            codename=pname,

            name=pname.capitalize(),

            content_type=get_content_type())

        self.user_permissions.add(p)

    def remove_permission(self, pname):

        if self.has_perm(pname):

            return

        p = Permission.objects.get(codename=pname,

                                   content_type=get_content_type())

        self.user_permissions.remove(p)

    def add_group(self, gname):

        group, _ = Group.objects.get_or_create(name=gname)

        self.groups.add(group)

    def is_project_admin(self, application_id=None):

        return self.uuid in astakos_settings.PROJECT_ADMINS

    @property

    def invitation(self):

        try:

            return Invitation.objects.get(username=self.email)

        except Invitation.DoesNotExist:

            return None

    @property

    def policies(self):

        return self.astakosuserquota_set.select_related().all()

    def get_resource_policy(self, resource):

        resource = Resource.objects.get(name=resource)

        default_capacity = resource.uplimit

        try:

            policy = AstakosUserQuota.objects.get(user=self, resource=resource)

            return policy, default_capacity

        except AstakosUserQuota.DoesNotExist:

            return None, default_capacity

    def update_uuid(self):

        while not self.uuid:

            uuid_val = str(uuid.uuid4())

            try:

                AstakosUser.objects.get(uuid=uuid_val)

            except AstakosUser.DoesNotExist, e:

                self.uuid = uuid_val

        return self.uuid

    def save(self, update_timestamps=True, **kwargs):

        if update_timestamps:

            if not self.id:

                self.date_joined = datetime.now()

            self.updated = datetime.now()

        self.update_uuid()

        if not self.verification_code:

            self.renew_verification_code()

        # username currently matches email

        if self.username != self.email.lower():

            self.username = self.email.lower()

        super(AstakosUser, self).save(**kwargs)

    def renew_verification_code(self):

        self.verification_code = str(uuid.uuid4())

        logger.info("Verification code renewed for %s" % self.log_display)

    def renew_token(self, flush_sessions=False, current_key=None):

        for i in range(10):

            new_token = generate_token()

            count = AstakosUser.objects.filter(auth_token=new_token).count()

            if count == 0:

                break

            continue

        else:

            raise ValueError('Could not generate a token')

        self.auth_token = new_token

        self.auth_token_created = datetime.now()

        self.auth_token_expires = self.auth_token_created + \

            timedelta(hours=astakos_settings.AUTH_TOKEN_DURATION)

        if flush_sessions:

            self.flush_sessions(current_key)

        msg = 'Token renewed for %s' % self.log_display

        logger.log(astakos_settings.LOGGING_LEVEL, msg)

    def token_expired(self):

        return self.auth_token_expires < datetime.now()

    def flush_sessions(self, current_key=None):

        q = self.sessions

        if current_key:

            q = q.exclude(session_key=current_key)

        keys = q.values_list('session_key', flat=True)

        if keys:

            msg = 'Flushing sessions: %s' % ','.join(keys)

            logger.log(astakos_settings.LOGGING_LEVEL, msg, [])

        engine = import_module(settings.SESSION_ENGINE)

        for k in keys:

            s = engine.SessionStore(k)

            s.flush()

    def __unicode__(self):

        return '%s (%s)' % (self.realname, self.email)

    def conflicting_email(self):

        q = AstakosUser.objects.exclude(username=self.username)

        q = q.filter(email__iexact=self.email)

        if q.count() != 0:

            return True

        return False

    def email_change_is_pending(self):

        return self.emailchanges.count() > 0

    @property

    def status_display(self):

        msg = ""

        append = None

        if self.is_active:

            msg = "Accepted/Active"

        if self.is_rejected:

            msg = "Rejected"

            if self.rejected_reason:

                msg += " (%s)" % self.rejected_reason

        if not self.email_verified:

            msg = "Pending email verification"

        if not self.moderated:

            msg = "Pending moderation"

        if not self.is_active and self.email_verified:

            msg = "Accepted/Inactive"

            if self.deactivated_reason:

                msg += " (%s)" % (self.deactivated_reason)

        if self.moderated and not self.is_rejected:

            if self.accepted_policy == 'manual':

                msg += " (manually accepted)"

            else:

                msg += " (accepted policy: %s)" % \

                    self.accepted_policy

        return msg

    @property

    def signed_terms(self):

        term = get_latest_terms()

        if not term:

            return True

        if not self.has_signed_terms:

            return False

        if not self.date_signed_terms:

            return False

        if self.date_signed_terms < term.date:

            self.has_signed_terms = False

            self.date_signed_terms = None

            self.save()

            return False

        return True

    def set_invitations_level(self):

        """

        Update user invitation level

        """

        level = self.invitation.inviter.level + 1

        self.level = level

        self.invitations = astakos_settings.INVITATIONS_PER_LEVEL.get(level, 0)

    def can_change_password(self):

        return self.has_auth_provider('local', auth_backend='astakos')

    def can_change_email(self):

        if not self.has_auth_provider('local'):

            return True

        local = self.get_auth_provider('local')._instance

        return local.auth_backend == 'astakos'

    # Auth providers related methods

    def get_auth_provider(self, module=None, identifier=None, **filters):

        if not module:

            return self.auth_providers.active()[0].settings

        params = {'module': module}

        if identifier:

            params['identifier'] = identifier

        params.update(filters)

        return self.auth_providers.active().get(**params).settings

    def has_auth_provider(self, provider, **kwargs):

        return bool(self.auth_providers.active().filter(module=provider,

                                                        **kwargs).count())

    def get_required_providers(self, **kwargs):

        return auth.REQUIRED_PROVIDERS.keys()

    def missing_required_providers(self):

        required = self.get_required_providers()

        missing = []

        for provider in required:

            if not self.has_auth_provider(provider):

                missing.append(auth.get_provider(provider, self))

        return missing

    def get_available_auth_providers(self, **filters):

        """

        Returns a list of providers available for add by the user.

        """

        modules = astakos_settings.IM_MODULES

        providers = []

        for p in modules:

            providers.append(auth.get_provider(p, self))

        available = []

        for p in providers:

            if p.get_add_policy:

                available.append(p)

        return available

    def get_disabled_auth_providers(self, **filters):

        providers = self.get_auth_providers(**filters)

        disabled = []

        for p in providers:

            if not p.get_login_policy:

                disabled.append(p)

        return disabled

    def get_enabled_auth_providers(self, **filters):

        providers = self.get_auth_providers(**filters)

        enabled = []

        for p in providers:

            if p.get_login_policy:

                enabled.append(p)

        return enabled

    def get_auth_providers(self, **filters):

        providers = []

        for provider in self.auth_providers.active(**filters):

            if provider.settings.module_enabled:

                providers.append(provider.settings)

        modules = astakos_settings.IM_MODULES

        def key(p):

            if not p.module in modules:

                return 100

            return modules.index(p.module)

        providers = sorted(providers, key=key)

        return providers

    # URL methods

    @property

    def auth_providers_display(self):

        return ",".join(["%s:%s" % (p.module, p.get_username_msg) for p in

                         self.get_enabled_auth_providers()])

    def add_auth_provider(self, module='local', identifier=None, **params):

        provider = auth.get_provider(module, self, identifier, **params)

        provider.add_to_user()

    def get_resend_activation_url(self):

        return reverse('send_activation', kwargs={'user_id': self.pk})

    def get_activation_url(self, nxt=False):

        url = "%s?auth=%s" % (reverse('astakos.im.views.activate'),

                              quote(self.verification_code))

        if nxt:

            url += "&next=%s" % quote(nxt)

        return url

    def get_password_reset_url(self, token_generator=default_token_generator):

        return reverse('astakos.im.views.target.local.password_reset_confirm',

                       kwargs={'uidb36': int_to_base36(self.id),

                               'token': token_generator.make_token(self)})

    def get_inactive_message(self, provider_module, identifier=None):

        provider = self.get_auth_provider(provider_module, identifier)

        msg_extra = ''

        message = ''

        msg_inactive = provider.get_account_inactive_msg

        msg_pending = provider.get_pending_activation_msg

        msg_pending_help = _(astakos_messages.ACCOUNT_PENDING_ACTIVATION_HELP)

        #msg_resend_prompt = _(astakos_messages.ACCOUNT_RESEND_ACTIVATION)

        msg_pending_mod = provider.get_pending_moderation_msg

        msg_rejected = _(astakos_messages.ACCOUNT_REJECTED)

        msg_resend = _(astakos_messages.ACCOUNT_RESEND_ACTIVATION)

        if not self.email_verified:

            message = msg_pending

            url = self.get_resend_activation_url()

            msg_extra = msg_pending_help + \

                u' ' + \

                '<a href="%s">%s?</a>' % (url, msg_resend)

        else:

            if not self.moderated:

                message = msg_pending_mod

            else:

                if self.is_rejected:

                    message = msg_rejected

                else:

                    message = msg_inactive

        return mark_safe(message + u' ' + msg_extra)

    def owns_application(self, application):

        return application.owner == self

    def owns_project(self, project):

        return project.application.owner == self

    def is_associated(self, project):

        try:

            m = ProjectMembership.objects.get(person=self, project=project)

            return m.state in ProjectMembership.ASSOCIATED_STATES

        except ProjectMembership.DoesNotExist:

            return False

    def get_membership(self, project):

        try:

            return ProjectMembership.objects.get(

                project=project,

                person=self)

        except ProjectMembership.DoesNotExist:

            return None

    def membership_display(self, project):

        m = self.get_membership(project)

        if m is None:

            return _('Not a member')

        else:

            return m.user_friendly_state_display()

    def non_owner_can_view(self, maybe_project):

        if self.is_project_admin():

            return True

        if maybe_project is None:

            return False

        project = maybe_project

        if self.is_associated(project):

            return True

        if project.is_deactivated():

            return False

        return True

class AstakosUserAuthProviderManager(models.Manager):

    def active(self, **filters):

        return self.filter(active=True, **filters)

    def remove_unverified_providers(self, provider, **filters):

        try:

            existing = self.filter(module=provider, user__email_verified=False,

                                   **filters)

            for p in existing:

                p.user.delete()

        except:

            pass

    def unverified(self, provider, **filters):

        try:

            return self.get(module=provider, user__email_verified=False,

                            **filters).settings

        except AstakosUserAuthProvider.DoesNotExist:

            return None

    def verified(self, provider, **filters):

        try:

            return self.get(module=provider, user__email_verified=True,

                            **filters).settings

        except AstakosUserAuthProvider.DoesNotExist:

            return None

class AuthProviderPolicyProfileManager(models.Manager):

    def active(self):

        return self.filter(active=True)

    def for_user(self, user, provider):

        policies = {}

        exclusive_q1 = Q(provider=provider) & Q(is_exclusive=False)

        exclusive_q2 = ~Q(provider=provider) & Q(is_exclusive=True)

        exclusive_q = exclusive_q1 | exclusive_q2

        for profile in user.authpolicy_profiles.active().filter(exclusive_q):

            policies.update(profile.policies)

        user_groups = user.groups.all().values('pk')

        for profile in self.active().filter(groups__in=user_groups).filter(

                exclusive_q):

            policies.update(profile.policies)

        return policies

    def add_policy(self, name, provider, group_or_user, exclusive=False,

                   **policies):

        is_group = isinstance(group_or_user, Group)

        profile, created = self.get_or_create(name=name, provider=provider,

                                              is_exclusive=exclusive)

        profile.is_exclusive = exclusive

        profile.save()

        if is_group:

            profile.groups.add(group_or_user)

        else:

            profile.users.add(group_or_user)

        profile.set_policies(policies)

        profile.save()

        return profile

class AuthProviderPolicyProfile(models.Model):

    name = models.CharField(_('Name'), max_length=255, blank=False,

                            null=False, db_index=True)

    provider = models.CharField(_('Provider'), max_length=255, blank=False,

                                null=False)

    # apply policies to all providers excluding the one set in provider field

    is_exclusive = models.BooleanField(default=False)

    policy_add = models.NullBooleanField(null=True, default=None)

    policy_remove = models.NullBooleanField(null=True, default=None)

    policy_create = models.NullBooleanField(null=True, default=None)

    policy_login = models.NullBooleanField(null=True, default=None)

    policy_limit = models.IntegerField(null=True, default=None)

    policy_required = models.NullBooleanField(null=True, default=None)

    policy_automoderate = models.NullBooleanField(null=True, default=None)

    policy_switch = models.NullBooleanField(null=True, default=None)

    POLICY_FIELDS = ('add', 'remove', 'create', 'login', 'limit', 'required',

                     'automoderate')

    priority = models.IntegerField(null=False, default=1)

    groups = models.ManyToManyField(Group, related_name='authpolicy_profiles')

    users = models.ManyToManyField(AstakosUser,

                                   related_name='authpolicy_profiles')

    active = models.BooleanField(default=True)

    objects = AuthProviderPolicyProfileManager()

    class Meta:

        ordering = ['priority']

    @property

    def policies(self):

        policies = {}

        for pkey in self.POLICY_FIELDS:

            value = getattr(self, 'policy_%s' % pkey, None)

            if value is None:

                continue

            policies[pkey] = value

        return policies

    def set_policies(self, policies_dict):

        for key, value in policies_dict.iteritems():

            if key in self.POLICY_FIELDS:

                setattr(self, 'policy_%s' % key, value)

        return self.policies

class AstakosUserAuthProvider(models.Model):

    """

    Available user authentication methods.

    """

    affiliation = models.CharField(_('Affiliation'), max_length=255,

                                   blank=True, null=True, default=None)

    user = models.ForeignKey(AstakosUser, related_name='auth_providers')

    module = models.CharField(_('Provider'), max_length=255, blank=False,

                              default='local')

    identifier = models.CharField(_('Third-party identifier'),

                                  max_length=255, null=True,

                                  blank=True)

    active = models.BooleanField(default=True)

    auth_backend = models.CharField(_('Backend'), max_length=255, blank=False,

                                    default='astakos')

    info_data = models.TextField(default="", null=True, blank=True)

    created = models.DateTimeField('Creation date', auto_now_add=True)

    objects = AstakosUserAuthProviderManager()

    class Meta:

        unique_together = (('identifier', 'module', 'user'), )

        ordering = ('module', 'created')

    def __init__(self, *args, **kwargs):

        super(AstakosUserAuthProvider, self).__init__(*args, **kwargs)

        try:

            self.info = json.loads(self.info_data)

            if not self.info:

                self.info = {}

        except Exception, e:

            self.info = {}

        for key, value in self.info.iteritems():

            setattr(self, 'info_%s' % key, value)

    @property

    def settings(self):

        extra_data = {}

        info_data = {}

        if self.info_data:

            info_data = json.loads(self.info_data)

        extra_data['info'] = info_data

        for key in ['active', 'auth_backend', 'created', 'pk', 'affiliation']:

            extra_data[key] = getattr(self, key)

        extra_data['instance'] = self

        return auth.get_provider(self.module, self.user,

                                 self.identifier, **extra_data)

    def __repr__(self):

        return '<AstakosUserAuthProvider %s:%s>' % (

            self.module, self.identifier)

    def __unicode__(self):

        if self.identifier:

            return "%s:%s" % (self.module, self.identifier)

        if self.auth_backend:

            return "%s:%s" % (self.module, self.auth_backend)

        return self.module

    def save(self, *args, **kwargs):

        self.info_data = json.dumps(self.info)

        return super(AstakosUserAuthProvider, self).save(*args, **kwargs)

class ExtendedManager(models.Manager):

    def _update_or_create(self, **kwargs):

        assert kwargs, \

            'update_or_create() must be passed at least one keyword argument'

        obj, created = self.get_or_create(**kwargs)

        defaults = kwargs.pop('defaults', {})

        if created:

            return obj, True, False

        else:

            try:

                params = dict(

                    [(k, v) for k, v in kwargs.items() if '__' not in k])

                params.update(defaults)

                for attr, val in params.items():

                    if hasattr(obj, attr):

                        setattr(obj, attr, val)

                sid = transaction.savepoint()

                obj.save(force_update=True)

                transaction.savepoint_commit(sid)

                return obj, False, True

            except IntegrityError, e:

                transaction.savepoint_rollback(sid)

                try:

                    return self.get(**kwargs), False, False

                except self.model.DoesNotExist:

                    raise e

    update_or_create = _update_or_create

class AstakosUserQuota(models.Model):

    objects = ExtendedManager()

    capacity = intDecimalField()

    resource = models.ForeignKey(Resource)

    user = models.ForeignKey(AstakosUser)

    class Meta:

        unique_together = ("resource", "user")

class ApprovalTerms(models.Model):

    """

    Model for approval terms

    """

    date = models.DateTimeField(

        _('Issue date'), db_index=True, auto_now_add=True)

    location = models.CharField(_('Terms location'), max_length=255)

class Invitation(models.Model):

    """

    Model for registring invitations

    """

    inviter = models.ForeignKey(AstakosUser, related_name='invitations_sent',

                                null=True)

    realname = models.CharField(_('Real name'), max_length=255)

    username = models.CharField(_('Unique ID'), max_length=255, unique=True)

    code = models.BigIntegerField(_('Invitation code'), db_index=True)

    is_consumed = models.BooleanField(_('Consumed?'), default=False)

    created = models.DateTimeField(_('Creation date'), auto_now_add=True)

    consumed = models.DateTimeField(_('Consumption date'),

                                    null=True, blank=True)

    def __init__(self, *args, **kwargs):

        super(Invitation, self).__init__(*args, **kwargs)

        if not self.id:

            self.code = _generate_invitation_code()

    def consume(self):

        self.is_consumed = True

        self.consumed = datetime.now()

        self.save()

    def __unicode__(self):

        return '%s -> %s [%d]' % (self.inviter, self.username, self.code)

class EmailChangeManager(models.Manager):

    @transaction.commit_on_success

    def change_email(self, activation_key):

        """

        Validate an activation key and change the corresponding

        ``User`` if valid.

        If the key is valid and has not expired, return the ``User``

        after activating.

        If the key is not valid or has expired, return ``None``.

        If the key is valid but the ``User`` is already active,

        return ``None``.

        After successful email change the activation record is deleted.

        Throws ValueError if there is already

        """