# Copyright (c) 2015, XhiveFramework Technologies Pvt. Ltd. and Contributors
# License: MIT. See LICENSE

import xhiveframework
import xhiveframework.utils
from xhiveframework import _
from xhiveframework.auth import LoginManager
from xhiveframework.rate_limiter import rate_limit
from xhiveframework.utils import cint, get_url
from xhiveframework.utils.data import escape_html
from xhiveframework.utils.html_utils import get_icon_html
from xhiveframework.utils.jinja import guess_is_path
from xhiveframework.utils.oauth import get_oauth2_authorize_url, get_oauth_keys, redirect_post_login
from xhiveframework.utils.password import get_decrypted_password
from xhiveframework.website.utils import get_home_page

no_cache = True


def get_context(context):
	redirect_to = xhiveframework.local.request.args.get("redirect-to")

	if xhiveframework.session.user != "Guest":
		if not redirect_to:
			if xhiveframework.session.data.user_type == "Website User":
				redirect_to = get_home_page()
			else:
				redirect_to = "/app"

		if redirect_to != "login":
			xhiveframework.local.flags.redirect_location = redirect_to
			raise xhiveframework.Redirect

	context.no_header = True
	context.for_test = "login.html"
	context["title"] = "Login"
	context["hide_login"] = True  # dont show login link on login page again.
	context["provider_logins"] = []
	context["disable_signup"] = cint(xhiveframework.get_website_settings("disable_signup"))
	context["show_footer_on_login"] = cint(xhiveframework.get_website_settings("show_footer_on_login"))
	context["disable_user_pass_login"] = cint(xhiveframework.get_system_settings("disable_user_pass_login"))
	context["logo"] = xhiveframework.get_website_settings("app_logo") or xhiveframework.get_hooks("app_logo_url")[-1]
	context["app_name"] = (
		xhiveframework.get_website_settings("app_name") or xhiveframework.get_system_settings("app_name") or _("XhiveFramework")
	)

	signup_form_template = xhiveframework.get_hooks("signup_form_template")
	if signup_form_template and len(signup_form_template):
		path = signup_form_template[-1]
		if not guess_is_path(path):
			path = xhiveframework.get_attr(signup_form_template[-1])()
	else:
		path = "xhiveframework/templates/signup.html"

	if path:
		context["signup_form_template"] = xhiveframework.get_template(path).render()

	providers = xhiveframework.get_all(
		"Social Login Key",
		filters={"enable_social_login": 1},
		fields=["name", "client_id", "base_url", "provider_name", "icon"],
		order_by="name",
	)

	for provider in providers:
		client_secret = get_decrypted_password("Social Login Key", provider.name, "client_secret")
		if not client_secret:
			continue

		icon = None
		if provider.icon:
			if provider.provider_name == "Custom":
				icon = get_icon_html(provider.icon, small=True)
			else:
				icon = f"<img src={escape_html(provider.icon)!r} alt={escape_html(provider.provider_name)!r}>"

		if provider.client_id and provider.base_url and get_oauth_keys(provider.name):
			context.provider_logins.append(
				{
					"name": provider.name,
					"provider_name": provider.provider_name,
					"auth_url": get_oauth2_authorize_url(provider.name, redirect_to),
					"icon": icon,
				}
			)
			context["social_login"] = True

	if cint(xhiveframework.db.get_value("LDAP Settings", "LDAP Settings", "enabled")):
		from xhiveframework.integrations.doctype.ldap_settings.ldap_settings import LDAPSettings

		context["ldap_settings"] = LDAPSettings.get_ldap_client_settings()

	login_label = [_("Email")]

	if xhiveframework.utils.cint(xhiveframework.get_system_settings("allow_login_using_mobile_number")):
		login_label.append(_("Mobile"))

	if xhiveframework.utils.cint(xhiveframework.get_system_settings("allow_login_using_user_name")):
		login_label.append(_("Username"))

	context["login_label"] = f" {_('or')} ".join(login_label)

	context["login_with_email_link"] = xhiveframework.get_system_settings("login_with_email_link")

	return context


@xhiveframework.whitelist(allow_guest=True)
def login_via_token(login_token: str):
	sid = xhiveframework.cache.get_value(f"login_token:{login_token}", expires=True)
	if not sid:
		xhiveframework.respond_as_web_page(_("Invalid Request"), _("Invalid Login Token"), http_status_code=417)
		return

	xhiveframework.local.form_dict.sid = sid
	xhiveframework.local.login_manager = LoginManager()

	redirect_post_login(
		desk_user=xhiveframework.db.get_value("User", xhiveframework.session.user, "user_type") == "System User"
	)


@xhiveframework.whitelist(allow_guest=True)
@rate_limit(limit=5, seconds=60 * 60)
def send_login_link(email: str):
	if not xhiveframework.get_system_settings("login_with_email_link"):
		return

	expiry = xhiveframework.get_system_settings("login_with_email_link_expiry") or 10
	link = _generate_temporary_login_link(email, expiry)

	app_name = (
		xhiveframework.get_website_settings("app_name") or xhiveframework.get_system_settings("app_name") or _("XhiveFramework")
	)

	subject = _("Login To {0}").format(app_name)

	xhiveframework.sendmail(
		subject=subject,
		recipients=email,
		template="login_with_email_link",
		args={"link": link, "minutes": expiry, "app_name": app_name},
		now=True,
	)


def _generate_temporary_login_link(email: str, expiry: int):
	assert isinstance(email, str)

	if not xhiveframework.db.exists("User", email):
		xhiveframework.throw(_("User with email address {0} does not exist").format(email), xhiveframework.DoesNotExistError)
	key = xhiveframework.generate_hash()
	xhiveframework.cache.set_value(f"one_time_login_key:{key}", email, expires_in_sec=expiry * 60)

	return get_url(f"/api/method/xhiveframework.www.login.login_via_key?key={key}")


@xhiveframework.whitelist(allow_guest=True, methods=["GET"])
@rate_limit(limit=5, seconds=60 * 60)
def login_via_key(key: str):
	cache_key = f"one_time_login_key:{key}"
	email = xhiveframework.cache.get_value(cache_key)

	if email:
		xhiveframework.cache.delete_value(cache_key)

		xhiveframework.local.login_manager.login_as(email)

		redirect_post_login(
			desk_user=xhiveframework.db.get_value("User", xhiveframework.session.user, "user_type") == "System User"
		)
	else:
		xhiveframework.respond_as_web_page(
			_("Not Permitted"),
			_("The link you trying to login is invalid or expired."),
			http_status_code=403,
			indicator_color="red",
		)
