authomatic: should not be a global object anymore

backend/src/appenlight/__init__.py

@@ -1,288 +1,245 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # App Enlight Enterprise Edition, including its added features, Support
 # services, and proprietary license terms, please see
 # https://rhodecode.com/licenses/
 
 import datetime
 import logging
 import pyelasticsearch
 import redis
 import os
 from pkg_resources import iter_entry_points
 
 import appenlight.lib.jinja2_filters as jinja2_filters
 import appenlight.lib.encryption as encryption
 
-from authomatic.providers import oauth2, oauth1
-from authomatic import Authomatic
 from pyramid.config import PHASE3_CONFIG
 from pyramid.authentication import AuthTktAuthenticationPolicy
 from pyramid.authorization import ACLAuthorizationPolicy
 from pyramid_mailer.mailer import Mailer
 from pyramid.renderers import JSON
 from pyramid_redis_sessions import session_factory_from_settings
 from pyramid.settings import asbool, aslist
 from pyramid.security import AllPermissionsList
 from pyramid_authstack import AuthenticationStackPolicy
 from redlock import Redlock
 from sqlalchemy import engine_from_config
 
 from appenlight.celery import configure_celery
 from appenlight.lib.configurator import CythonCompatConfigurator
 from appenlight.lib import cache_regions
 from appenlight.lib.ext_json import json
 from appenlight.security import groupfinder, AuthTokenAuthenticationPolicy
 
 json_renderer = JSON(serializer=json.dumps, indent=4)
 
 log = logging.getLogger(__name__)
 
 
 def datetime_adapter(obj, request):
     return obj.isoformat()
 
 
 def all_permissions_adapter(obj, request):
     return '__all_permissions__'
 
 
 json_renderer.add_adapter(datetime.datetime, datetime_adapter)
 json_renderer.add_adapter(AllPermissionsList, all_permissions_adapter)
 
 
 def main(global_config, **settings):
     """ This function returns a Pyramid WSGI application.
     """
     auth_tkt_policy = AuthTktAuthenticationPolicy(
         settings['authtkt.secret'],
         hashalg='sha512',
         callback=groupfinder,
         max_age=2592000,
         secure=asbool(settings.get('authtkt.secure', 'false')))
     auth_token_policy = AuthTokenAuthenticationPolicy(
         callback=groupfinder
     )
     authorization_policy = ACLAuthorizationPolicy()
     authentication_policy = AuthenticationStackPolicy()
     authentication_policy.add_policy('auth_tkt', auth_tkt_policy)
     authentication_policy.add_policy('auth_token', auth_token_policy)
     # set crypto key
     encryption.ENCRYPTION_SECRET = settings.get('encryption_secret')
     # import this later so encyption key can be monkeypatched
     from appenlight.models import DBSession, register_datastores
     # update config with cometd info
     settings['cometd_servers'] = {'server': settings['cometd.server'],
                                   'secret': settings['cometd.secret']}
 
     # Create the Pyramid Configurator.
     settings['_mail_url'] = settings['mailing.app_url']
     config = CythonCompatConfigurator(
         settings=settings,
         authentication_policy=authentication_policy,
         authorization_policy=authorization_policy,
         root_factory='appenlight.security.RootFactory',
         default_permission='view')
     config.set_default_csrf_options(require_csrf=True, header='X-XSRF-TOKEN')
     config.add_view_deriver('appenlight.predicates.csrf_view',
                             name='csrf_view')
 
     # later, when config is available
     dogpile_config = {'url': settings['redis.url'],
                       "redis_expiration_time": 86400,
                       "redis_distributed_lock": True}
     cache_regions.regions = cache_regions.CacheRegions(dogpile_config)
     config.registry.cache_regions = cache_regions.regions
     engine = engine_from_config(settings, 'sqlalchemy.',
                                 json_serializer=json.dumps)
     DBSession.configure(bind=engine)
 
     # json rederer that serializes datetime
     config.add_renderer('json', json_renderer)
     config.set_request_property('appenlight.lib.request.es_conn', 'es_conn')
     config.set_request_property('appenlight.lib.request.get_user', 'user',
                                 reify=True)
     config.set_request_property('appenlight.lib.request.get_csrf_token',
                                 'csrf_token', reify=True)
     config.set_request_property('appenlight.lib.request.safe_json_body',
                                 'safe_json_body', reify=True)
     config.set_request_property('appenlight.lib.request.unsafe_json_body',
                                 'unsafe_json_body', reify=True)
     config.add_request_method('appenlight.lib.request.add_flash_to_headers',
                               'add_flash_to_headers')
+    config.add_request_method('appenlight.lib.request.get_authomatic',
+                              'authomatic', reify=True)
 
     config.include('pyramid_redis_sessions')
     config.include('pyramid_tm')
     config.include('pyramid_jinja2')
     config.include('appenlight_client.ext.pyramid_tween')
     config.include('ziggurat_foundations.ext.pyramid.sign_in')
     es_server_list = aslist(settings['elasticsearch.nodes'])
     redis_url = settings['redis.url']
     log.warning('Elasticsearch server list: {}'.format(es_server_list))
     log.warning('Redis server: {}'.format(redis_url))
     config.registry.es_conn = pyelasticsearch.ElasticSearch(es_server_list)
     config.registry.redis_conn = redis.StrictRedis.from_url(redis_url)
 
     config.registry.redis_lockmgr = Redlock([settings['redis.redlock.url'], ],
                                             retry_count=0, retry_delay=0)
     # mailer
     config.registry.mailer = Mailer.from_settings(settings)
 
     # Configure sessions
     session_factory = session_factory_from_settings(settings)
     config.set_session_factory(session_factory)
 
     # Configure renderers and event subscribers
     config.add_jinja2_extension('jinja2.ext.loopcontrols')
     config.add_jinja2_search_path('appenlight:templates')
     # event subscribers
     config.add_subscriber("appenlight.subscribers.application_created",
                           "pyramid.events.ApplicationCreated")
     config.add_subscriber("appenlight.subscribers.add_renderer_globals",
                           "pyramid.events.BeforeRender")
     config.add_subscriber('appenlight.subscribers.new_request',
                           'pyramid.events.NewRequest')
     config.add_view_predicate('context_type_class',
                               'appenlight.predicates.contextTypeClass')
 
     register_datastores(es_conn=config.registry.es_conn,
                         redis_conn=config.registry.redis_conn,
                         redis_lockmgr=config.registry.redis_lockmgr)
 
     # base stuff and scan
 
     # need to ensure webassets exists otherwise config.override_asset()
     # throws exception
     if not os.path.exists(settings['webassets.dir']):
         os.mkdir(settings['webassets.dir'])
     config.add_static_view(path='appenlight:webassets',
                            name='static', cache_max_age=3600)
     config.override_asset(to_override='appenlight:webassets/',
                           override_with=settings['webassets.dir'])
 
     config.include('appenlight.views')
     config.include('appenlight.views.admin')
     config.scan(ignore=['appenlight.migrations',
                         'appenlight.scripts',
                         'appenlight.tests'])
 
-    # authomatic social auth
-    authomatic_conf = {
-        # callback http://yourapp.com/social_auth/twitter
-        'twitter': {
-            'class_': oauth1.Twitter,
-            'consumer_key': settings.get('authomatic.pr.twitter.key', 'X'),
-            'consumer_secret': settings.get('authomatic.pr.twitter.secret',
-                                            'X'),
-        },
-        # callback http://yourapp.com/social_auth/facebook
-        'facebook': {
-            'class_': oauth2.Facebook,
-            'consumer_key': settings.get('authomatic.pr.facebook.app_id', 'X'),
-            'consumer_secret': settings.get('authomatic.pr.facebook.secret',
-                                            'X'),
-            'scope': ['email'],
-        },
-        # callback http://yourapp.com/social_auth/google
-        'google': {
-            'class_': oauth2.Google,
-            'consumer_key': settings.get('authomatic.pr.google.key', 'X'),
-            'consumer_secret': settings.get(
-                'authomatic.pr.google.secret', 'X'),
-            'scope': ['profile', 'email'],
-        },
-        'github': {
-            'class_': oauth2.GitHub,
-            'consumer_key': settings.get('authomatic.pr.github.key', 'X'),
-            'consumer_secret': settings.get(
-                'authomatic.pr.github.secret', 'X'),
-            'scope': ['repo', 'public_repo', 'user:email'],
-            'access_headers': {'User-Agent': 'AppEnlight'},
-        },
-        'bitbucket': {
-            'class_': oauth1.Bitbucket,
-            'consumer_key': settings.get('authomatic.pr.bitbucket.key', 'X'),
-            'consumer_secret': settings.get(
-                'authomatic.pr.bitbucket.secret', 'X')
-        }
-    }
-    config.registry.authomatic = Authomatic(
-        config=authomatic_conf, secret=settings['authomatic.secret'])
-
     # resource type information
     config.registry.resource_types = ['resource', 'application']
 
     # plugin information
     config.registry.appenlight_plugins = {}
 
     def register_appenlight_plugin(config, plugin_name, plugin_config):
         def register():
             log.warning('Registering plugin: {}'.format(plugin_name))
             if plugin_name not in config.registry.appenlight_plugins:
                 config.registry.appenlight_plugins[plugin_name] = {
                     'javascript': None,
                     'static': None,
                     'css': None,
                     'top_nav': None,
                     'celery_tasks': None,
                     'celery_beats': None,
                     'fulltext_indexer': None,
                     'sqlalchemy_migrations': None,
                     'default_values_setter': None,
                     'resource_types': [],
                     'url_gen': None
                 }
             config.registry.appenlight_plugins[plugin_name].update(
                 plugin_config)
             # inform AE what kind of resource types we have available
             # so we can avoid failing when a plugin is removed but data
             # is still present in the db
             if plugin_config.get('resource_types'):
                 config.registry.resource_types.extend(
                     plugin_config['resource_types'])
 
         config.action('appenlight_plugin={}'.format(plugin_name), register)
 
     config.add_directive('register_appenlight_plugin',
                          register_appenlight_plugin)
 
     for entry_point in iter_entry_points(group='appenlight.plugins'):
         plugin = entry_point.load()
         plugin.includeme(config)
 
     # include other appenlight plugins explictly if needed
     includes = aslist(settings.get('appenlight.includes', []))
     for inc in includes:
         config.include(inc)
 
     # run this after everything registers in configurator
 
     def pre_commit():
         jinja_env = config.get_jinja2_environment()
         jinja_env.filters['tojson'] = json.dumps
         jinja_env.filters['toJSONUnsafe'] = jinja2_filters.toJSONUnsafe
 
     config.action(None, pre_commit, order=PHASE3_CONFIG + 999)
 
     def wrap_config_celery():
         configure_celery(config.registry)
 
     config.action(None, wrap_config_celery, order=PHASE3_CONFIG + 999)
 
     app = config.make_wsgi_app()
     return app

backend/src/appenlight/lib/request.py

@@ -1,89 +1,140 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # App Enlight Enterprise Edition, including its added features, Support
 # services, and proprietary license terms, please see
 # https://rhodecode.com/licenses/
 
-import appenlight.lib.helpers as helpers
 import json
+
 from pyramid.security import unauthenticated_userid
+
+import appenlight.lib.helpers as helpers
+
+from authomatic.providers import oauth2, oauth1
+from authomatic import Authomatic
 from appenlight.models.user import User
 
 
 class CSRFException(Exception):
     pass
 
 
 class JSONException(Exception):
     pass
 
 
 def get_csrf_token(request):
     return request.session.get_csrf_token()
 
 
 def safe_json_body(request):
     """
     Returns None if json body is missing or erroneous
     """
     try:
         return request.json_body
     except ValueError:
         return None
 
 
 def unsafe_json_body(request):
     """
     Throws JSONException if json can't deserialize
     """
     try:
         return request.json_body
     except ValueError:
         raise JSONException('Incorrect JSON')
 
 
 def get_user(request):
     if not request.path_info.startswith('/static'):
         user_id = unauthenticated_userid(request)
         try:
             user_id = int(user_id)
         except Exception:
             return None
 
         if user_id:
             user = User.by_id(user_id)
             if user:
                 request.environ['appenlight.username'] = '%d:%s' % (
                     user_id, user.user_name)
             return user
         else:
             return None
 
 
 def es_conn(request):
     return request.registry.es_conn
 
 
 def add_flash_to_headers(request, clear=True):
     """
     Adds pending flash messages to response, if clear is true clears out the
     flash queue
     """
     flash_msgs = helpers.get_type_formatted_flash(request)
     request.response.headers['x-flash-messages'] = json.dumps(flash_msgs)
     helpers.clear_flash(request)
+
+
+def get_authomatic(request):
+    settings = request.registry.settings
+    # authomatic social auth
+    authomatic_conf = {
+        # callback http://yourapp.com/social_auth/twitter
+        'twitter': {
+            'class_': oauth1.Twitter,
+            'consumer_key': settings.get('authomatic.pr.twitter.key', ''),
+            'consumer_secret': settings.get('authomatic.pr.twitter.secret',
+                                            ''),
+        },
+        # callback http://yourapp.com/social_auth/facebook
+        'facebook': {
+            'class_': oauth2.Facebook,
+            'consumer_key': settings.get('authomatic.pr.facebook.app_id', 'X'),
+            'consumer_secret': settings.get('authomatic.pr.facebook.secret',
+                                            ''),
+            'scope': ['email'],
+        },
+        # callback http://yourapp.com/social_auth/google
+        'google': {
+            'class_': oauth2.Google,
+            'consumer_key': settings.get('authomatic.pr.google.key', ''),
+            'consumer_secret': settings.get(
+                'authomatic.pr.google.secret', ''),
+            'scope': ['profile', 'email'],
+        },
+        'github': {
+            'class_': oauth2.GitHub,
+            'consumer_key': settings.get('authomatic.pr.github.key', ''),
+            'consumer_secret': settings.get(
+                'authomatic.pr.github.secret', ''),
+            'scope': ['repo', 'public_repo', 'user:email'],
+            'access_headers': {'User-Agent': 'AppEnlight'},
+        },
+        'bitbucket': {
+            'class_': oauth1.Bitbucket,
+            'consumer_key': settings.get('authomatic.pr.bitbucket.key', ''),
+            'consumer_secret': settings.get(
+                'authomatic.pr.bitbucket.secret', '')
+        }
+    }
+    return Authomatic(
+        config=authomatic_conf, secret=settings['authomatic.secret'])

backend/src/appenlight/views/user.py

@@ -1,678 +1,678 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # App Enlight Enterprise Edition, including its added features, Support
 # services, and proprietary license terms, please see
 # https://rhodecode.com/licenses/
 
 import colander
 import datetime
 import json
 import logging
 import uuid
 import pyramid.security as security
 import appenlight.lib.helpers as h
 
 from authomatic.adapters import WebObAdapter
 from pyramid.view import view_config
 from pyramid.httpexceptions import HTTPFound, HTTPUnprocessableEntity
 from pyramid.httpexceptions import HTTPNotFound, HTTPBadRequest
 from pyramid.security import NO_PERMISSION_REQUIRED
 from ziggurat_foundations.models.services.external_identity import \
     ExternalIdentityService
 
 from appenlight.lib import generate_random_string
 from appenlight.lib.social import handle_social_data
 from appenlight.lib.utils import cometd_request, add_cors_headers, \
     permission_tuple_to_dict
 from appenlight.models import DBSession
 from appenlight.models.alert_channels.email import EmailAlertChannel
 from appenlight.models.alert_channel_action import AlertChannelAction
 from appenlight.models.services.alert_channel import AlertChannelService
 from appenlight.models.services.alert_channel_action import \
     AlertChannelActionService
 from appenlight.models.auth_token import AuthToken
 from appenlight.models.report import REPORT_TYPE_MATRIX
 from appenlight.models.user import User
 from appenlight.models.services.user import UserService
 from appenlight.subscribers import _
 from appenlight.validators import build_rule_schema
 from appenlight import forms
 from webob.multidict import MultiDict
 
 log = logging.getLogger(__name__)
 
 
 @view_config(route_name='users_no_id', renderer='json',
              request_method="GET", permission='root_administration')
 def users_list(request):
     """
     Returns users list
     """
     props = ['user_name', 'id', 'first_name', 'last_name', 'email',
              'last_login_date', 'status']
     users = UserService.all()
     users_dicts = []
     for user in users:
         u_dict = user.get_dict(include_keys=props)
         u_dict['gravatar_url'] = user.gravatar_url(s=20)
         users_dicts.append(u_dict)
     return users_dicts
 
 
 @view_config(route_name='users_no_id', renderer='json',
              request_method="POST", permission='root_administration')
 def users_create(request):
     """
     Returns users list
     """
     form = forms.UserCreateForm(MultiDict(request.safe_json_body or {}),
                                 csrf_context=request)
     if form.validate():
         log.info('registering user')
         user = User()
         # insert new user here
         DBSession.add(user)
         form.populate_obj(user)
         user.regenerate_security_code()
         user.set_password(user.user_password)
         user.status = 1 if form.status.data else 0
         request.session.flash(_('User created'))
         DBSession.flush()
         return user.get_dict(exclude_keys=['security_code_date', 'notes',
                                            'security_code', 'user_password'])
     else:
         return HTTPUnprocessableEntity(body=form.errors_json)
 
 
 @view_config(route_name='users', renderer='json',
              request_method="GET", permission='root_administration')
 @view_config(route_name='users', renderer='json',
              request_method="PATCH", permission='root_administration')
 def users_update(request):
     """
     Updates user object
     """
     user = User.by_id(request.matchdict.get('user_id'))
     if not user:
         return HTTPNotFound()
     post_data = request.safe_json_body or {}
     if request.method == 'PATCH':
         form = forms.UserUpdateForm(MultiDict(post_data),
                                     csrf_context=request)
         if form.validate():
             form.populate_obj(user, ignore_none=True)
             if form.user_password.data:
                 user.set_password(user.user_password)
             if form.status.data:
                 user.status = 1
             else:
                 user.status = 0
         else:
             return HTTPUnprocessableEntity(body=form.errors_json)
     return user.get_dict(exclude_keys=['security_code_date', 'notes',
                                        'security_code', 'user_password'])
 
 
 @view_config(route_name='users_property',
              match_param='key=resource_permissions',
              renderer='json', permission='authenticated')
 def users_resource_permissions_list(request):
     """
     Get list of permissions assigned to specific resources
     """
     user = User.by_id(request.matchdict.get('user_id'))
     if not user:
         return HTTPNotFound()
     return [permission_tuple_to_dict(perm) for perm in
             user.resources_with_possible_perms()]
 
 
 @view_config(route_name='users', renderer='json',
              request_method="DELETE", permission='root_administration')
 def users_DELETE(request):
     """
     Removes a user permanently from db - makes a check to see if after the
     operation there will be at least one admin left
     """
     msg = _('There needs to be at least one administrator in the system')
     user = User.by_id(request.matchdict.get('user_id'))
     if user:
         users = User.users_for_perms(['root_administration']).all()
         if len(users) < 2 and user.id == users[0].id:
             request.session.flash(msg, 'warning')
         else:
             DBSession.delete(user)
             request.session.flash(_('User removed'))
             return True
     request.response.status = 422
     return False
 
 
 @view_config(route_name='users_self', renderer='json',
              request_method="GET", permission='authenticated')
 @view_config(route_name='users_self', renderer='json',
              request_method="PATCH", permission='authenticated')
 def users_self(request):
     """
     Updates user personal information
     """
 
     if request.method == 'PATCH':
         form = forms.gen_user_profile_form()(
             MultiDict(request.unsafe_json_body),
             csrf_context=request)
         if form.validate():
             form.populate_obj(request.user)
             request.session.flash(_('Your profile got updated.'))
         else:
             return HTTPUnprocessableEntity(body=form.errors_json)
     return request.user.get_dict(exclude_keys=['security_code_date', 'notes',
                                                'security_code',
                                                'user_password'])
 
 
 @view_config(route_name='users_self_property',
              match_param='key=external_identities', renderer='json',
              request_method='GET', permission='authenticated')
 def users_external_identies(request):
     user = request.user
     identities = [{'provider': ident.provider_name,
                    'id': ident.external_user_name} for ident
                   in user.external_identities.all()]
     return identities
 
 
 @view_config(route_name='users_self_property',
              match_param='key=external_identities', renderer='json',
              request_method='DELETE', permission='authenticated')
 def users_external_identies_DELETE(request):
     """
     Unbinds external identities(google,twitter etc.) from user account
     """
     user = request.user
     for identity in user.external_identities.all():
         log.info('found identity %s' % identity)
         if (identity.provider_name == request.params.get('provider') and
                     identity.external_user_name == request.params.get('id')):
             log.info('remove identity %s' % identity)
             DBSession.delete(identity)
             return True
     return False
 
 
 @view_config(route_name='users_self_property',
              match_param='key=password', renderer='json',
              request_method='PATCH', permission='authenticated')
 def users_password(request):
     """
     Sets new password for user account
     """
     user = request.user
     form = forms.ChangePasswordForm(MultiDict(request.unsafe_json_body),
                                     csrf_context=request)
     form.old_password.user = user
     if form.validate():
         user.regenerate_security_code()
         user.set_password(form.new_password.data)
         msg = 'Your password got updated. ' \
               'Next time log in with your new credentials.'
         request.session.flash(_(msg))
         return True
     else:
         return HTTPUnprocessableEntity(body=form.errors_json)
     return False
 
 
 @view_config(route_name='users_self_property', match_param='key=websocket',
              renderer='json', permission='authenticated')
 def users_websocket(request):
     """
     Handle authorization of users trying to connect
     """
     # handle preflight request
     user = request.user
     if request.method == 'OPTIONS':
         res = request.response.body('OK')
         add_cors_headers(res)
         return res
     applications = user.resources_with_perms(
         ['view'], resource_types=['application'])
     channels = ['app_%s' % app.resource_id for app in applications]
     payload = {"username": user.user_name,
                "conn_id": str(uuid.uuid4()),
                "channels": channels
                }
     settings = request.registry.settings
     response = cometd_request(
         settings['cometd.secret'], '/connect', payload,
         servers=[request.registry.settings['cometd_servers']],
         throw_exceptions=True)
     return payload
 
 
 @view_config(route_name='users_self_property', request_method="GET",
              match_param='key=alert_channels', renderer='json',
              permission='authenticated')
 def alert_channels(request):
     """
     Lists all available alert channels
     """
     user = request.user
     return [c.get_dict(extended_info=True) for c in user.alert_channels]
 
 
 @view_config(route_name='users_self_property', match_param='key=alert_actions',
              request_method="GET", renderer='json', permission='authenticated')
 def alert_actions(request):
     """
     Lists all available alert channels
     """
     user = request.user
     return [r.get_dict(extended_info=True) for r in user.alert_actions]
 
 
 @view_config(route_name='users_self_property', renderer='json',
              match_param='key=alert_channels_rules', request_method='POST',
              permission='authenticated')
 def alert_channels_rule_POST(request):
     """
     Creates new notification rule for specific alert channel
     """
     user = request.user
     alert_action = AlertChannelAction(owner_id=request.user.id,
                                       type='report')
     DBSession.add(alert_action)
     DBSession.flush()
     return alert_action.get_dict()
 
 
 @view_config(route_name='users_self_property', permission='authenticated',
              match_param='key=alert_channels_rules',
              renderer='json', request_method='DELETE')
 def alert_channels_rule_DELETE(request):
     """
     Removes specific alert channel rule
     """
     user = request.user
     rule_action = AlertChannelActionService.by_owner_id_and_pkey(
         user.id,
         request.GET.get('pkey'))
     if rule_action:
         DBSession.delete(rule_action)
         return True
     return HTTPNotFound()
 
 
 @view_config(route_name='users_self_property', permission='authenticated',
              match_param='key=alert_channels_rules',
              renderer='json', request_method='PATCH')
 def alert_channels_rule_PATCH(request):
     """
     Removes specific alert channel rule
     """
     user = request.user
     json_body = request.unsafe_json_body
 
     schema = build_rule_schema(json_body['rule'], REPORT_TYPE_MATRIX)
     try:
         schema.deserialize(json_body['rule'])
     except colander.Invalid as exc:
         return HTTPUnprocessableEntity(body=json.dumps(exc.asdict()))
 
     rule_action = AlertChannelActionService.by_owner_id_and_pkey(
         user.id,
         request.GET.get('pkey'))
 
     if rule_action:
         rule_action.rule = json_body['rule']
         rule_action.resource_id = json_body['resource_id']
         rule_action.action = json_body['action']
         return rule_action.get_dict()
     return HTTPNotFound()
 
 
 @view_config(route_name='users_self_property', permission='authenticated',
              match_param='key=alert_channels',
              renderer='json', request_method='PATCH')
 def alert_channels_PATCH(request):
     user = request.user
     channel_name = request.GET.get('channel_name')
     channel_value = request.GET.get('channel_value')
     # iterate over channels
     channel = None
     for channel in user.alert_channels:
         if (channel.channel_name == channel_name and
                     channel.channel_value == channel_value):
             break
     if not channel:
         return HTTPNotFound()
 
     allowed_keys = ['daily_digest', 'send_alerts']
     for k, v in request.unsafe_json_body.items():
         if k in allowed_keys:
             setattr(channel, k, v)
         else:
             return HTTPBadRequest()
     return channel.get_dict()
 
 
 @view_config(route_name='users_self_property', permission='authenticated',
              match_param='key=alert_channels',
              request_method="POST", renderer='json')
 def alert_channels_POST(request):
     """
     Creates a new email alert channel for user, sends a validation email
     """
     user = request.user
     form = forms.EmailChannelCreateForm(MultiDict(request.unsafe_json_body),
                                         csrf_context=request)
     if not form.validate():
         return HTTPUnprocessableEntity(body=form.errors_json)
 
     email = form.email.data.strip()
     channel = EmailAlertChannel()
     channel.channel_name = 'email'
     channel.channel_value = email
     security_code = generate_random_string(10)
     channel.channel_json_conf = {'security_code': security_code}
     user.alert_channels.append(channel)
 
     email_vars = {'user': user,
                   'email': email,
                   'request': request,
                   'security_code': security_code,
                   'email_title': "App Enlight :: "
                                  "Please authorize your email"}
 
     UserService.send_email(request, recipients=[email],
                            variables=email_vars,
                            template='/email_templates/authorize_email.jinja2')
     request.session.flash(_('Your alert channel was '
                             'added to the system.'))
     request.session.flash(
         _('You need to authorize your email channel, a message was '
           'sent containing necessary information.'),
         'warning')
     DBSession.flush()
     channel.get_dict()
 
 
 @view_config(route_name='section_view',
              match_param=['section=user_section',
                           'view=alert_channels_authorize'],
              renderer='string', permission='authenticated')
 def alert_channels_authorize(request):
     """
     Performs alert channel authorization based on auth code sent in email
     """
     user = request.user
     for channel in user.alert_channels:
         security_code = request.params.get('security_code', '')
         if channel.channel_json_conf['security_code'] == security_code:
             channel.channel_validated = True
             request.session.flash(_('Your email was authorized.'))
     return HTTPFound(location=request.route_url('/'))
 
 
 @view_config(route_name='users_self_property', request_method="DELETE",
              match_param='key=alert_channels', renderer='json',
              permission='authenticated')
 def alert_channel_DELETE(request):
     """
     Removes alert channel from users channel
     """
     user = request.user
     channel = None
     for chan in user.alert_channels:
         if (chan.channel_name == request.params.get('channel_name') and
                 chan.channel_value == request.params.get('channel_value')):
             channel = chan
             break
     if channel:
         user.alert_channels.remove(channel)
         request.session.flash(_('Your channel was removed.'))
         return True
     return False
 
 
 @view_config(route_name='users_self_property', permission='authenticated',
              match_param='key=alert_channels_actions_binds',
              renderer='json', request_method="POST")
 def alert_channels_actions_binds_POST(request):
     """
     Adds alert action to users channels
     """
     user = request.user
     json_body = request.unsafe_json_body
     channel = AlertChannelService.by_owner_id_and_pkey(
         user.id,
         json_body.get('channel_pkey'))
 
     rule_action = AlertChannelActionService.by_owner_id_and_pkey(
         user.id,
         json_body.get('action_pkey'))
 
     if channel and rule_action:
         if channel.pkey not in [c.pkey for c in rule_action.channels]:
             rule_action.channels.append(channel)
             return rule_action.get_dict(extended_info=True)
     return HTTPUnprocessableEntity()
 
 
 @view_config(route_name='users_self_property', request_method="DELETE",
              match_param='key=alert_channels_actions_binds',
              renderer='json', permission='authenticated')
 def alert_channels_actions_binds_DELETE(request):
     """
     Removes alert action from users channels
     """
     user = request.user
     channel = AlertChannelService.by_owner_id_and_pkey(
         user.id,
         request.GET.get('channel_pkey'))
 
     rule_action = AlertChannelActionService.by_owner_id_and_pkey(
         user.id,
         request.GET.get('action_pkey'))
 
     if channel and rule_action:
         if channel.pkey in [c.pkey for c in rule_action.channels]:
             rule_action.channels.remove(channel)
             return rule_action.get_dict(extended_info=True)
     return HTTPUnprocessableEntity()
 
 
 @view_config(route_name='social_auth_abort',
              renderer='string', permission=NO_PERMISSION_REQUIRED)
 def oauth_abort(request):
     """
     Handles problems with authorization via velruse
     """
 
 
 @view_config(route_name='social_auth', permission=NO_PERMISSION_REQUIRED)
 def social_auth(request):
     # Get the internal provider name URL variable.
     provider_name = request.matchdict.get('provider')
 
     # Start the login procedure.
     adapter = WebObAdapter(request, request.response)
-    result = request.registry.authomatic.login(adapter, provider_name)
+    result = request.authomatic.login(adapter, provider_name)
     if result:
         if result.error:
             return handle_auth_error(request, result)
         elif result.user:
             return handle_auth_success(request, result)
     return request.response
 
 
 def handle_auth_error(request, result):
     # Login procedure finished with an error.
     request.session.pop('zigg.social_auth', None)
     request.session.flash(_('Something went wrong when we tried to '
                             'authorize you via external provider. '
                             'Please try again.'), 'warning')
 
     return HTTPFound(location=request.route_url('/'))
 
 
 def handle_auth_success(request, result):
     # Hooray, we have the user!
     # OAuth 2.0 and OAuth 1.0a provide only limited user data on login,
     # We need to update the user to get more info.
     if result.user:
         result.user.update()
 
     social_data = {
         'user': {'data': result.user.data},
         'credentials': result.user.credentials
     }
     # normalize data
     social_data['user']['id'] = result.user.id
     user_name = result.user.username or ''
     # use email name as username for google
     if (social_data['credentials'].provider_name == 'google' and
             result.user.email):
         user_name = result.user.email
     social_data['user']['user_name'] = user_name
     social_data['user']['email'] = result.user.email or ''
 
     request.session['zigg.social_auth'] = social_data
     # user is logged so bind his external identity with account
     if request.user:
         handle_social_data(request, request.user, social_data)
         request.session.pop('zigg.social_auth', None)
         return HTTPFound(location=request.route_url('/'))
     else:
         user = ExternalIdentityService.user_by_external_id_and_provider(
             social_data['user']['id'],
             social_data['credentials'].provider_name
         )
         # fix legacy accounts with wrong google ID
         if not user and social_data['credentials'].provider_name == 'google':
             user = ExternalIdentityService.user_by_external_id_and_provider(
                 social_data['user']['email'],
                 social_data['credentials'].provider_name)
 
         # user tokens are already found in our db
         if user:
             handle_social_data(request, user, social_data)
             headers = security.remember(request, user.id)
             request.session.pop('zigg.social_auth', None)
             return HTTPFound(location=request.route_url('/'), headers=headers)
         else:
             msg = 'You need to finish registration ' \
                   'process to bind your external identity to your account ' \
                   'or sign in to existing account'
             request.session.flash(msg)
             return HTTPFound(location=request.route_url('register'))
 
 
 @view_config(route_name='section_view', permission='authenticated',
              match_param=['section=users_section', 'view=search_users'],
              renderer='json')
 def search_users(request):
     """
     Returns a list of users for autocomplete
     """
     user = request.user
     items_returned = []
     like_condition = request.params.get('user_name', '') + '%'
     # first append used if email is passed
     found_user = User.by_email(request.params.get('user_name', ''))
     if found_user:
         name = '{} {}'.format(found_user.first_name, found_user.last_name)
         items_returned.append({'user': found_user.user_name, 'name': name})
     for found_user in User.user_names_like(like_condition).limit(20):
         name = '{} {}'.format(found_user.first_name, found_user.last_name)
         items_returned.append({'user': found_user.user_name, 'name': name})
     return items_returned
 
 
 @view_config(route_name='users_self_property', match_param='key=auth_tokens',
              request_method="GET", renderer='json', permission='authenticated')
 @view_config(route_name='users_property', match_param='key=auth_tokens',
              request_method="GET", renderer='json', permission='authenticated')
 def auth_tokens_list(request):
     """
     Lists all available alert channels
     """
     if request.matched_route.name == 'users_self_property':
         user = request.user
     else:
         user = User.by_id(request.matchdict.get('user_id'))
         if not user:
             return HTTPNotFound()
     return [c.get_dict() for c in user.auth_tokens]
 
 
 @view_config(route_name='users_self_property', match_param='key=auth_tokens',
              request_method="POST", renderer='json',
              permission='authenticated')
 @view_config(route_name='users_property', match_param='key=auth_tokens',
              request_method="POST", renderer='json',
              permission='authenticated')
 def auth_tokens_POST(request):
     """
     Lists all available alert channels
     """
     if request.matched_route.name == 'users_self_property':
         user = request.user
     else:
         user = User.by_id(request.matchdict.get('user_id'))
         if not user:
             return HTTPNotFound()
 
     req_data = request.safe_json_body or {}
     if not req_data.get('expires'):
         req_data.pop('expires', None)
     form = forms.AuthTokenCreateForm(MultiDict(req_data), csrf_context=request)
     if not form.validate():
         return HTTPUnprocessableEntity(body=form.errors_json)
     token = AuthToken()
     form.populate_obj(token)
     if token.expires:
         interval = h.time_deltas.get(token.expires)['delta']
         token.expires = datetime.datetime.utcnow() + interval
     user.auth_tokens.append(token)
     DBSession.flush()
     return token.get_dict()
 
 
 @view_config(route_name='users_self_property', match_param='key=auth_tokens',
              request_method="DELETE", renderer='json',
              permission='authenticated')
 @view_config(route_name='users_property', match_param='key=auth_tokens',
              request_method="DELETE", renderer='json',
              permission='authenticated')
 def auth_tokens_DELETE(request):
     """
     Lists all available alert channels
     """
     if request.matched_route.name == 'users_self_property':
         user = request.user
     else:
         user = User.by_id(request.matchdict.get('user_id'))
         if not user:
             return HTTPNotFound()
 
     for token in user.auth_tokens:
         if token.token == request.params.get('token'):
             user.auth_tokens.remove(token)
             return True
     return False