def _handle_avatar_update(user, avatar_form):
    if avatar_form.validate_on_submit():
        _file = request.files['avatar']
        coordinates = (avatar_form.x1.data, avatar_form.y1.data,
                       avatar_form.x2.data, avatar_form.y2.data)
        prefix = time.time()
        _file.filename = "%s_avatar.png" % prefix
        container = "user_%s" % user.id
        uploader.upload_file(_file,
                             container=container,
                             coordinates=coordinates)
        # Delete previous avatar from storage
        if user.info.get('avatar'):
            uploader.delete_file(user.info['avatar'], container)
        upload_method = current_app.config.get('UPLOAD_METHOD')
        avatar_url = get_avatar_url(upload_method,
                                    _file.filename, container)
        user.info['avatar'] = _file.filename
        user.info['container'] = container
        user.info['avatar_url'] = avatar_url
        user_repo.update(user)
        cached_users.delete_user_summary(user.name)
        flash(gettext('Your avatar has been updated! It may \
                      take some minutes to refresh...'), 'success')
        return True
    else:
        flash("You have to provide an image file to update your avatar", "error")
        return False

def newsletter_subscribe():
    """
    Register method for subscribing user to PyBossa newsletter.

    Returns a Jinja2 template

    """
    # Save that we've prompted the user to sign up in the newsletter
    if newsletter.is_initialized() and current_user.is_authenticated():
        next_url = request.args.get('next') or url_for('home.home')
        user = user_repo.get(current_user.id)
        if current_user.newsletter_prompted is False:
            user.newsletter_prompted = True
            user_repo.update(user)
        if request.args.get('subscribe') == 'True':
            newsletter.subscribe_user(user)
            flash("You are subscribed to our newsletter!")
            return redirect(next_url)
        elif request.args.get('subscribe') == 'False':
            return redirect(next_url)
        else:
            return render_template('account/newsletter.html',
                                   title=gettext("Subscribe to our Newsletter"),
                                   next=next_url)
    else:
        return abort(404)

def manage_user(access_token, user_data):
    """Manage the user after signin"""
    # We have to store the oauth_token in the session to get the USER fields

    user = user_repo.get_by(google_user_id=user_data['id'])

    # user never signed on
    if user is None:
        google_token = dict(oauth_token=access_token)
        info = dict(google_token=google_token)
        name = username_from_full_name(user_data['name'])
        user = user_repo.get_by_name(name)

        email = user_repo.get_by(email_addr=user_data['email'])

        if ((user is None) and (email is None)):
            user = User(fullname=user_data['name'],
                        name=name,
                        email_addr=user_data['email'],
                        google_user_id=user_data['id'],
                        info=info)
            user_repo.save(user)
            if newsletter.is_initialized():
                newsletter.subscribe_user(user)
            return user
        else:
            return None
    else:
        # Update the name to fit with new paradigm to avoid UTF8 problems
        if type(user.name) == unicode or ' ' in user.name:
            user.name = username_from_full_name(user.name)
            user_repo.update(user)
        return user

def _update_user_with_valid_email(user, email_addr):
    user.valid_email = True
    user.confirmation_email_sent = False
    user.email_addr = email_addr
    user_repo.update(user)
    flash(gettext('Your email has been validated.'))
    return _sign_in_user(user)

def reset_password():
    """
    Reset password method.

    Returns a Jinja2 template.

    """
    key = request.args.get('key')
    if key is None:
        abort(403)
    userdict = {}
    try:
        timeout = current_app.config.get('ACCOUNT_LINK_EXPIRATION', 3600)
        userdict = signer.loads(key, max_age=timeout, salt='password-reset')
    except BadData:
        abort(403)
    username = userdict.get('user')
    if not username or not userdict.get('password'):
        abort(403)
    user = user_repo.get_by_name(username)
    if user.passwd_hash != userdict.get('password'):
        abort(403)
    form = ChangePasswordForm(request.form)
    if form.validate_on_submit():
        user.set_password(form.new_password.data)
        user_repo.update(user)
        flash(gettext('You reset your password successfully!'), 'success')
        return _sign_in_user(user)
    if request.method == 'POST' and not form.validate():
        flash(gettext('Please correct the errors'), 'error')
    return render_template('/account/password_reset.html', form=form)

def manage_user(access_token, user_data, next_url):
    """Manage the user after signin"""
    # We have to store the oauth_token in the session to get the USER fields

    user = user_repo.get_by(google_user_id=user_data['id'])

    # user never signed on
    if user is None:
        google_token = dict(oauth_token=access_token)
        info = dict(google_token=google_token)
        name = user_data['name'].encode('ascii', 'ignore').lower().replace(" ", "")
        user = user_repo.get_by_name(name)

        email = user_repo.get_by(email_addr=user_data['email'])

        if ((user is None) and (email is None)):
            user = User(fullname=user_data['name'],
                   name=user_data['name'].encode('ascii', 'ignore')
                                         .lower().replace(" ", ""),
                   email_addr=user_data['email'],
                   google_user_id=user_data['id'],
                   info=info)
            user_repo.save(user)
            return user
        else:
            return None
    else:
        # Update the name to fit with new paradigm to avoid UTF8 problems
        if type(user.name) == unicode or ' ' in user.name:
            user.name = user.name.encode('ascii', 'ignore').lower().replace(" ", "")
            user_repo.update(user)
        return user

    def set(self, user, update_repo=True):
        """Set a Gravatar for a user.

        Parameters
        ----------
        user : User
            The PyBossa user.
        update_repo : bool, optional
            True to save changes, False otherwise (the default is True).
        """
        url = self._get_url(user)

        now = time.time()
        filename = secure_filename('{0}_avatar.png'.format(now))
        container = 'user_{0}'.format(user.id)

        self._download(filename, container, url)

        if not user.info:  # pragma: no cover
            user.info = dict()

        user.info['avatar'] = filename
        user.info['container'] = container

        if update_repo:
            user_repo.update(user)
            cached_users.delete_user_summary(user.name)

def _handle_external_services_update(user, update_form):
    del update_form.locale
    del update_form.email_addr
    del update_form.fullname
    del update_form.name
    if update_form.validate():
        user.ckan_api = update_form.ckan_api.data or None
        user_repo.update(user)
        cached_users.delete_user_summary(user.name)
        flash(gettext('Your profile has been updated!'), 'success')
    else:
        flash(gettext('Please correct the errors'), 'error')

def _handle_password_update(user, password_form):
    if password_form.validate_on_submit():
        user = user_repo.get(user.id)
        if user.check_password(password_form.current_password.data):
            user.set_password(password_form.new_password.data)
            user_repo.update(user)
            flash(gettext('Yay, you changed your password succesfully!'),
                  'success')
        else:
            msg = gettext("Your current password doesn't match the "
                          "one in our records")
            flash(msg, 'error')
    else:
        flash(gettext('Please correct the errors'), 'error')

    def test_get_non_contrib_users_returns_unsubscribed_jobs(self):
        """Test JOB get non contrib users returns a list of jobs."""

        TaskRunFactory.create()
        user = user_repo.get(1)
        user.subscribed = False
        user_repo.update(user)

        jobs_generator = get_non_contributors_users_jobs()
        jobs = []
        for job in jobs_generator:
            jobs.append(job)

        msg = "There should be zero jobs."
        assert len(jobs) == 0,  msg

 def test_manage_user_login_with_newsletter_no_email(self, redirect,
                                                     url_for_app_type,
                                                     flash,
                                                     login_user,
                                                     newsletter):
     """Test TWITTER manage_user_login without email with newsletter works."""
     newsletter.app = True
     next_url = '/spa/account/profile/update'
     user = UserFactory.create(name='john', email_addr='john')
     user_data = dict(id=user.id, screen_name=user.name)
     user.email_addr = user.name
     user_repo.update(user)
     manage_user_login(user, user_data, next_url)
     login_user.assert_called_once_with(user, remember=True)
     redirect.assert_called_once_with(next_url)

 def test_manage_user_login_without_user(self, redirect,
                                         url_for_app_type,
                                         flash,
                                         login_user,
                                         newsletter):
     """Test TWITTER manage_user_login without user with newsletter works."""
     newsletter.app = True
     next_url = '/'
     user = UserFactory.create(info={'google_token': 'k'})
     user_data = dict(id=user.id, screen_name=user.name)
     user.email_addr = user.name
     user_repo.update(user)
     manage_user_login(None, user_data, next_url)
     assert login_user.called is False
     url_for_app_type.assert_called_once_with('account.signin')

 def test_manage_user_login_without_user_local(self, redirect,
                                               url_for,
                                               flash,
                                               login_user,
                                               newsletter):
     """Test TWITTER manage_user_login without user with newsletter works."""
     newsletter.app = True
     next_url = '/'
     user = UserFactory.create()
     user_data = dict(id=user.id, screen_name=user.name)
     user.email_addr = user.name
     user_repo.update(user)
     manage_user_login(None, user_data, next_url)
     assert login_user.called is False
     url_for.assert_called_once_with('account.forgot_password')

    def test_get_inactive_users_returns_jobs_unsubscribed(self):
        """Test JOB get inactive users returns an empty list of jobs."""

        tr = TaskRunFactory.create(finish_time="2010-07-07T17:23:45.714210")
        user = user_repo.get(tr.user_id)
        user.subscribed = False
        user_repo.update(user)

        jobs_generator = get_inactive_users_jobs()
        jobs = []
        for job in jobs_generator:
            jobs.append(job)

        msg = "There should be zero jobs."
        assert len(jobs) == 0,  msg

def _handle_profile_update(user, update_form):
    acc_conf_dis = current_app.config.get('ACCOUNT_CONFIRMATION_DISABLED')
    if update_form.validate_on_submit():
        user.id = update_form.id.data
        user.fullname = update_form.fullname.data
        user.name = update_form.name.data
        account, domain = update_form.email_addr.data.split('@')
        if (user.email_addr != update_form.email_addr.data and
                acc_conf_dis is False and
                domain not in current_app.config.get('SPAM')):
            user.valid_email = False
            user.newsletter_prompted = False
            account = dict(fullname=update_form.fullname.data,
                           name=update_form.name.data,
                           email_addr=update_form.email_addr.data)
            confirm_url = get_email_confirmation_url(account)
            subject = ('You have updated your email in %s! Verify it'
                       % current_app.config.get('BRAND'))
            msg = dict(subject=subject,
                       recipients=[update_form.email_addr.data],
                       body=render_template(
                           '/account/email/validate_email.md',
                           user=account, confirm_url=confirm_url))
            msg['html'] = markdown(msg['body'])
            mail_queue.enqueue(send_mail, msg)
            user.confirmation_email_sent = True
            fls = gettext('An email has been sent to verify your \
                          new email: %s. Once you verify it, it will \
                          be updated.' % account['email_addr'])
            flash(fls, 'info')
            return True
        if acc_conf_dis is False and domain in current_app.config.get('SPAM'):
            fls = gettext('Use a valid email account')
            flash(fls, 'info')
            return False
        if acc_conf_dis:
            user.email_addr = update_form.email_addr.data
        user.privacy_mode = fuzzyboolean(update_form.privacy_mode.data)
        user.restrict = fuzzyboolean(update_form.restrict.data)
        user.locale = update_form.locale.data
        user.subscribed = fuzzyboolean(update_form.subscribed.data)
        user_repo.update(user)
        cached_users.delete_user_summary(user.name)
        flash(gettext('Your profile has been updated!'), 'success')
        return True
    else:
        flash(gettext('Please correct the errors'), 'error')
        return False

def add_admin(user_id=None):
    """Add admin flag for user_id."""
    try:
        if user_id:
            user = user_repo.get(user_id)
            if user:
                ensure_authorized_to('update', user)
                user.admin = True
                user_repo.update(user)
                return redirect(url_for(".users"))
            else:
                msg = "User not found"
                return format_error(msg, 404)
    except Exception as e:  # pragma: no cover
        current_app.logger.error(e)
        return abort(500)

def reset_api_key(name):
    """
    Reset API-KEY for user.

    Returns a Jinja2 template.

    """
    user = user_repo.get_by_name(name)
    if not user:
        return abort(404)
    ensure_authorized_to('update', user)
    user.api_key = model.make_uuid()
    user_repo.update(user)
    cached_users.delete_user_summary(user.name)
    msg = gettext('New API-KEY generated')
    flash(msg, 'success')
    return redirect(url_for('account.profile', name=name))

def reset_api_key(name):
    """
    Reset API-KEY for user.

    Returns a Jinja2 template.

    """
    user = user_repo.get_by_name(name)
    if not user:
        return abort(404)
    require.user.update(user)
    title = ("User: %s · Settings"
             "- Reset API KEY") % current_user.fullname
    user.api_key = model.make_uuid()
    user_repo.update(user)
    cached_users.delete_user_summary(user.name)
    msg = gettext('New API-KEY generated')
    flash(msg, 'success')
    return redirect(url_for('account.profile', name=name))

def del_admin(user_id=None):
    """Del admin flag for user_id."""
    try:
        if user_id:
            user = user_repo.get(user_id)
            if user:
                ensure_authorized_to('update', user)
                user.admin = False
                user_repo.update(user)
                return redirect(url_for('.users'))
            else:
                msg = "User.id not found"
                return format_error(msg, 404)
        else:  # pragma: no cover
            msg = "User.id is missing for method del_admin"
            return format_error(msg, 415)
    except Exception as e:  # pragma: no cover
        current_app.logger.error(e)
        return abort(500)

def reset_api_key(name):
    """
    Reset API-KEY for user.

    Returns a Jinja2 template.

    """
    if request.method == 'POST':
        user = user_repo.get_by_name(name)
        if not user:
            return abort(404)
        ensure_authorized_to('update', user)
        user.api_key = model.make_uuid()
        user_repo.update(user)
        cached_users.delete_user_summary(user.name)
        msg = gettext('New API-KEY generated')
        flash(msg, 'success')
        return redirect_content_type(url_for('account.profile', name=name))
    else:
        csrf = dict(form=dict(csrf=generate_csrf()))
        return jsonify(csrf)