# GNU MediaGoblin -- federated, autonomous media hosting
# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
from ldap3 import Server, Connection, SUBTREE
from ldap3.core.exceptions import LDAPException
import logging

import six

from mediagoblin.tools import pluginapi

_log = logging.getLogger(__name__)


class LDAP(object):
    def __init__(self):
        self.ldap_settings = pluginapi.get_config('mediagoblin.plugins.ldap')

    def _connect(self, server):
        _log.info('Connecting to {0}.'.format(server['LDAP_SERVER_URI']))
        self.server = Server(server['LDAP_SERVER_URI'])

        if 'LDAP_START_TLS' in server and server['LDAP_START_TLS'] == 'true':
            _log.info('Initiating TLS')
            self.server.start_tls()

    def _manager_auth(self, settings, username, password):
        conn = Connection(self.server,
                settings['LDAP_BIND_DN'],
                settings['LDAP_BIND_PW'],
                auto_bind=True)
        found = conn.search(
                search_base=settings['LDAP_SEARCH_BASE'],
                search_filter=settings['LDAP_SEARCH_FILTER'].format(username=username),
                search_scope=SUBTREE,
                attributes=[settings['EMAIL_SEARCH_FIELD']])
        if (not found) or len(conn.entries) > 1:
            return False, None

        user = conn.entries[0]
        user_dn = user.entry_dn
        try:
            email = user.entry_attributes_as_dict[settings['EMAIL_SEARCH_FIELD']][0]
        except KeyError:
            email = None

        Connection(self.server, user_dn, password, auto_bind=True)

        return username, email

    def _direct_auth(self, settings, username, password):
        user_dn = settings['LDAP_USER_DN_TEMPLATE'].format(username=username)
        conn = Connection(self.server, user_dn, password, auto_bind=True)
        email_found = conn.search(
                search_base=settings['LDAP_SEARCH_BASE'],
                search_filter='uid={0}'.format(username),
                search_scope=SUBTREE,
                attributes=[settings['EMAIL_SEARCH_FIELD']])

        if email_found:
            try:
                email = conn.entries[0].entry_attributes_as_dict[settings['EMAIL_SEARCH_FIELD']][0]
            except KeyError:
                email = None

        return username, email

    def login(self, username, password):
        for k, v in six.iteritems(self.ldap_settings):
            try:
                self._connect(v)

                if 'LDAP_BIND_DN' in v:
                    return self._manager_auth(v, username, password)
                else:
                    return self._direct_auth(v, username, password)

            except LDAPException as e:
                _log.info(e)

        return False, None