def manage_user(access_token, user_data):
    """Manage the user after signin"""
    # We have to store the oauth_token in the session to get the USER fields

    user = user_repo.get_by(google_user_id=user_data['id'])

    # user never signed on
    if user is None:
        google_token = dict(oauth_token=access_token)
        info = dict(google_token=google_token)
        name = username_from_full_name(user_data['name'])
        user = user_repo.get_by_name(name)

        email = user_repo.get_by(email_addr=user_data['email'])

        if ((user is None) and (email is None)):
            user = User(fullname=user_data['name'],
                        name=name,
                        email_addr=user_data['email'],
                        google_user_id=user_data['id'],
                        info=info)
            user_repo.save(user)
            if newsletter.is_initialized():
                newsletter.subscribe_user(user)
            return user
        else:
            return None
    else:
        # Update the name to fit with new paradigm to avoid UTF8 problems
        if type(user.name) == unicode or ' ' in user.name:
            user.name = username_from_full_name(user.name)
            user_repo.update(user)
        return user

def manage_user(access_token, user_data):
    """Manage the user after signin"""
    user = user_repo.get_by(facebook_user_id=user_data['id'])

    if user is None:
        facebook_token = dict(oauth_token=access_token)
        info = dict(facebook_token=facebook_token)
        name = username_from_full_name(user_data['name'])
        user_exists = user_repo.get_by_name(name) is not None
        # NOTE: Sometimes users at Facebook validate their accounts without
        # registering an e-mail (see this http://stackoverflow.com/a/17809808)
        email_exists = (user_data.get('email') is not None and
                        user_repo.get_by(email_addr=user_data['email']) is not None)

        if not user_exists and not email_exists:
            if not user_data.get('email'):
                user_data['email'] = name
            user = User(fullname=user_data['name'],
                        name=name,
                        email_addr=user_data['email'],
                        facebook_user_id=user_data['id'],
                        info=info)
            user_repo.save(user)
            if newsletter.is_initialized() and user.email_addr != name:
                newsletter.subscribe_user(user)
            return user
        else:
            return None
    else:
        return user

def manage_user(access_token, user_data, next_url):
    """Manage the user after signin"""
    user = user_repo.get_by(facebook_user_id=user_data['id'])

    if user is None:
        facebook_token = dict(oauth_token=access_token)
        info = dict(facebook_token=facebook_token)
        user = user_repo.get_by_name(user_data['username'])
        # NOTE: Sometimes users at Facebook validate their accounts without
        # registering an e-mail (see this http://stackoverflow.com/a/17809808)
        email = None
        if user_data.get('email'):
            email = user_repo.get_by(email_addr=user_data['email'])

        if user is None and email is None:
            if not user_data.get('email'):
                user_data['email'] = "None"
            user = User(fullname=user_data['name'],
                   name=user_data['username'],
                   email_addr=user_data['email'],
                   facebook_user_id=user_data['id'],
                   info=info)
            user_repo.save(user)
            return user
        else:
            return None
    else:
        return user

def manage_user(access_token, user_data, next_url):
    """Manage the user after signin"""
    # We have to store the oauth_token in the session to get the USER fields

    user = user_repo.get_by(google_user_id=user_data['id'])

    # user never signed on
    if user is None:
        google_token = dict(oauth_token=access_token)
        info = dict(google_token=google_token)
        name = user_data['name'].encode('ascii', 'ignore').lower().replace(" ", "")
        user = user_repo.get_by_name(name)

        email = user_repo.get_by(email_addr=user_data['email'])

        if ((user is None) and (email is None)):
            user = User(fullname=user_data['name'],
                   name=user_data['name'].encode('ascii', 'ignore')
                                         .lower().replace(" ", ""),
                   email_addr=user_data['email'],
                   google_user_id=user_data['id'],
                   info=info)
            user_repo.save(user)
            return user
        else:
            return None
    else:
        # Update the name to fit with new paradigm to avoid UTF8 problems
        if type(user.name) == unicode or ' ' in user.name:
            user.name = user.name.encode('ascii', 'ignore').lower().replace(" ", "")
            user_repo.update(user)
        return user

def manage_user(access_token, user_data):
    """Manage the user after signin"""
    # Twitter API does not provide a way
    # to get the e-mail so we will ask for it
    # only the first time
    twitter_token = dict(oauth_token=access_token["oauth_token"], oauth_token_secret=access_token["oauth_token_secret"])
    info = dict(twitter_token=twitter_token)

    user = user_repo.get_by(twitter_user_id=user_data["user_id"])

    if user is not None:
        user.info["twitter_token"] = twitter_token
        user_repo.save(user)
        return user

    user = user_repo.get_by_name(user_data["screen_name"])
    if user is not None:
        return None

    user = User(
        fullname=user_data["screen_name"],
        name=user_data["screen_name"],
        email_addr=user_data["screen_name"],
        twitter_user_id=user_data["user_id"],
        info=info,
    )
    user_repo.save(user)
    return user

def manage_user_login(user, user_data, next_url):
    """Manage user login."""
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data['email'])
        if user is not None:
            msg, method = get_user_signup_method(user)
            flash(msg, 'info')
            if method == 'local':
                return redirect(url_for('account.forgot_password'))
            else:
                return redirect(url_for('account.signin'))
        else:
            return redirect(url_for('account.signin'))
    else:
        first_login = False
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        request_email = False
        if (user.email_addr == "None"):
            request_email = True
        if request_email:
            if first_login:  # pragma: no cover
                flash("This is your first login, please add a valid e-mail")
            else:
                flash("Please update your e-mail address in your profile page")
            return redirect(url_for('account.update_profile', name=user.name))
        if (user.email_addr != "None" and user.newsletter_prompted is False
                and newsletter.app):
            return redirect(url_for('account.newsletter_subscribe', next=next_url))
        return redirect(next_url)

 def test_webhook_handler_owner_pro(self):
     """Test WEBHOOK view works for pro owner."""
     # Admin/owner
     self.register()
     self.signout()
     # User
     self.register(name="Iser")
     owner = user_repo.get_by(name="Iser")
     owner.pro = True
     user_repo.save(owner)
     project = ProjectFactory.create(owner=owner)
     url = "/project/%s/webhook" % project.short_name
     res = self.app.get(url)
     assert res.status_code == 200, res.status_code
     assert "Created" in res.data
     assert "Payload" in res.data
     url = "/project/%s/webhook?failed=true" % project.short_name
     res = self.app.get(url)
     assert res.status_code == 200, res.status_code
     assert "Created" in res.data
     assert "Payload" in res.data
     url = "/project/%s/webhook?all=true" % project.short_name
     res = self.app.get(url)
     assert res.status_code == 200, res.status_code
     assert "Created" in res.data
     assert "Payload" in res.data

def forgot_password():
    """
    Request a forgotten password for a user.

    Returns a Jinja2 template.

    """
    form = ForgotPasswordForm(request.body)
    if form.validate_on_submit():
        user = user_repo.get_by(email_addr=form.email_addr.data)
        if user and user.email_addr:
            msg = dict(subject='Account Recovery',
                       recipients=[user.email_addr])
            if user.twitter_user_id:
                msg['body'] = render_template(
                    '/account/email/forgot_password_openid.md',
                    user=user, account_name='Twitter')
                msg['html'] = render_template(
                    '/account/email/forgot_password_openid.html',
                    user=user, account_name='Twitter')
            elif user.facebook_user_id:
                msg['body'] = render_template(
                    '/account/email/forgot_password_openid.md',
                    user=user, account_name='Facebook')
                msg['html'] = render_template(
                    '/account/email/forgot_password_openid.html',
                    user=user, account_name='Facebook')
            elif user.google_user_id:
                msg['body'] = render_template(
                    '/account/email/forgot_password_openid.md',
                    user=user, account_name='Google')
                msg['html'] = render_template(
                    '/account/email/forgot_password_openid.html',
                    user=user, account_name='Google')
            else:
                userdict = {'user': user.name, 'password': user.passwd_hash}
                key = signer.dumps(userdict, salt='password-reset')
                recovery_url = url_for_app_type('.reset_password',
                                                key=key, _external=True)
                msg['body'] = render_template(
                    '/account/email/forgot_password.md',
                    user=user, recovery_url=recovery_url)
                msg['html'] = render_template(
                    '/account/email/forgot_password.html',
                    user=user, recovery_url=recovery_url)
            mail_queue.enqueue(send_mail, msg)
            flash(gettext("We've sent you an email with account "
                          "recovery instructions!"),
                  'success')
        else:
            flash(gettext("We don't have this email in our records. "
                          "You may have signed up with a different "
                          "email or used Twitter, Facebook, or "
                          "Google to sign-in"), 'error')
    if request.method == 'POST' and not form.validate():
        flash(gettext('Something went wrong, please correct the errors on the '
              'form'), 'error')
    data = dict(template='/account/password_forgot.html',
                form=form)
    return handle_content_type(data)

def manage_user(access_token, user_data):
    """Manage the user after signin"""
    # Twitter API does not provide a way
    # to get the e-mail so we will ask for it
    # only the first time
    info = dict(twitter_token=access_token)

    user = user_repo.get_by(twitter_user_id=user_data['user_id'])

    if user is not None:
        user.info['twitter_token'] = access_token
        user_repo.save(user)
        return user

    user = user_repo.get_by_name(user_data['screen_name'])
    if user is not None:
        return None

    user = User(fullname=user_data['screen_name'],
                name=user_data['screen_name'],
                email_addr=user_data['screen_name'],
                twitter_user_id=user_data['user_id'],
                info=info)
    user_repo.save(user)
    return user

def manage_user_login(user, user_data, next_url):
    """Manage user login."""
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data.get('email'))
        if user is not None:
            msg, method = get_user_signup_method(user)
            flash(msg, 'info')
            if method == 'local':
                return redirect(url_for('account.forgot_password'))
            else:
                return redirect(url_for('account.signin'))
        else:
            return redirect(url_for('account.signin'))
    else:
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        request_email = (user.email_addr == user.name)
        if request_email:
            flash("Please update your e-mail address in your profile page")
            return redirect(url_for('account.update_profile', name=user.name))
        if (not request_email and user.newsletter_prompted is False
                and newsletter.is_initialized()):
            return redirect(url_for('account.newsletter_subscribe', next=next_url))
        return redirect(next_url)

def manage_user_login(user, user_data, next_url):
    """Manage user login."""
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data.get('email'))
        if user is not None:
            msg, method = get_user_signup_method(user)
            flash(msg, 'info')
            if method == 'local':
                return redirect(url_for_app_type('account.forgot_password',
                                                 _hash_last_flash=True))
            else:
                return redirect(url_for_app_type('account.signin',
                                                 _hash_last_flash=True))
        else:
            return redirect(url_for_app_type('account.signin',
                                             _hash_last_flash=True))
    else:
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        if ((user.email_addr != user.name) and user.newsletter_prompted is False
                and newsletter.is_initialized()):
            return redirect(url_for_app_type('account.newsletter_subscribe',
                                             next=next_url,
                                             _hash_last_flash=True))
        return redirect(next_url)

 def test_webhook_handler_owner_non_pro(self):
     """Test WEBHOOK view works for non pro owner."""
     # Admin
     self.register()
     self.signout()
     # User
     self.register(name="Iser")
     owner = user_repo.get_by(name="Iser")
     project = ProjectFactory.create(owner=owner)
     url = "/project/%s/webhook" % project.short_name
     res = self.app.get(url)
     assert res.status_code == 403, res.status_code

def set_gravatar(name):
    """Set gravatar for a user."""
    user = user_repo.get_by(name=name)
    if not user:
        abort(404)

    ensure_authorized_to('update', user)

    gravatar.set(user)
    flash(gettext('Your avatar has been updated! It may \
                  take some minutes to refresh...'), 'success')

    return redirect(url_for('account.update_profile', name=user.name))

 def test_signin_existing(self, ldap_mock, create_mock):
     """Test signin logs in an LDAP existing PYBOSSA user."""
     user = UserFactory.create(name='cn', email_addr='cn', ldap='cn')
     with patch.dict(self.flask_app.config, {'LDAP_HOST': '127.0.0.1'}):
         url = '/account/signin'
         payload = {'email': 'cn', 'password': 'password'}
         ldap_mock.bind_user.return_value = True
         ldap_mock.get_object_details.return_value = self.ldap_user
         res = self.app.post(url, data=json.dumps(payload),
                             content_type='application/json')
         user = user_repo.get_by(ldap='cn')
         data = json.loads(res.data)
         assert data['next'] == '/', data
         assert create_mock.called is False

def signin():
    """
    Signin method for PyBossa users.

    Returns a Jinja2 template with the result of signing process.

    """
    form = LoginForm(request.form)
    if request.method == 'POST' and form.validate():
        password = form.password.data
        email = form.email.data
        user = user_repo.get_by(email_addr=email)
        if user and user.check_password(password):
            login_user(user, remember=True)
            msg_1 = gettext("Welcome back") + " " + user.fullname
            flash(msg_1, 'success')
            if user.newsletter_prompted is False and newsletter.app:
                return redirect(url_for('account.newsletter_subscribe',
                                        next=request.args.get('next')))
            return redirect(request.args.get("next") or url_for("home.home"))
        elif user:
            msg, method = get_user_signup_method(user)
            if method == 'local':
                msg = gettext("Ooops, Incorrect email/password")
                flash(msg, 'error')
            else:
                flash(msg, 'info')
        else:
            msg = gettext("Ooops, we didn't find you in the system, \
                          did you sign in?")
            flash(msg, 'info')

    if request.method == 'POST' and not form.validate():
        flash(gettext('Please correct the errors'), 'error')
    auth = {'twitter': False, 'facebook': False, 'google': False}
    if current_user.is_anonymous():
        # If Twitter is enabled in config, show the Twitter Sign in button
        if ('twitter' in current_app.blueprints): # pragma: no cover
            auth['twitter'] = True
        if ('facebook' in current_app.blueprints): # pragma: no cover
            auth['facebook'] = True
        if ('google' in current_app.blueprints): # pragma: no cover
            auth['google'] = True
        return render_template('account/signin.html',
                               title="Sign in",
                               form=form, auth=auth,
                               next=request.args.get('next'))
    else:
        # User already signed in, so redirect to home page
        return redirect(url_for("home.home"))

def oauth_authorized(resp):  # pragma: no cover
    #print "OAUTH authorized method called"
    next_url = url_for('home.home')

    if resp is None or request.args.get('error'):
        flash(u'You denied the request to sign in.', 'error')
        flash(u'Reason: ' + request.args['error'], 'error')
        if request.args.get('error'):
                return redirect(url_for('account.signin'))
        return redirect(next_url)

    headers = {'Authorization': ' '.join(['OAuth', resp['access_token']])}
    url = 'https://www.googleapis.com/oauth2/v1/userinfo'
    try:
        r = requests.get(url, headers=headers)
    except requests.exceptions.http_error:
        # Unauthorized - bad token
        if r.status_code == 401:
            return redirect(url_for('account.signin'))
        return r.content

    access_token = resp['access_token']
    session['oauth_token'] = access_token
    import json
    user_data = json.loads(r.content)
    user = manage_user(access_token, user_data, next_url)
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data['email'])
        if user is None:
            name = user_data['name'].encode('ascii', 'ignore').lower().replace(' ', '')
            user = user_repo.get_by_name(name)

        msg, method = get_user_signup_method(user)
        flash(msg, 'info')
        if method == 'local':
            return redirect(url_for('account.forgot_password'))
        else:
            return redirect(url_for('account.signin'))
    else:
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        return redirect(next_url)

def manage_user_login(user, user_data, next_url):
    """Manage user login."""
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data["email"])
        if user is None:
            name = username_from_full_name(user_data["name"])
            user = user_repo.get_by_name(name)

        msg, method = get_user_signup_method(user)
        flash(msg, "info")
        if method == "local":
            return redirect(url_for("account.forgot_password"))
        else:
            return redirect(url_for("account.signin"))
    else:
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, "success")
        if user.newsletter_prompted is False and newsletter.is_initialized():
            return redirect(url_for("account.newsletter_subscribe", next=next_url))
        return redirect(next_url)

def oauth_authorized(resp):  # pragma: no cover
    next_url = request.args.get('next') or url_for('home.home')
    if resp is None:
        flash(u'You denied the request to sign in.', 'error')
        flash(u'Reason: ' + request.args['error_reason'] +
              ' ' + request.args['error_description'], 'error')
        return redirect(next_url)

    # We have to store the oauth_token in the session to get the USER fields
    access_token = resp['access_token']
    session['oauth_token'] = (resp['access_token'], '')
    user_data = facebook.oauth.get('/me').data

    user = manage_user(access_token, user_data, next_url)
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data['email'])
        if user is not None:
            msg, method = get_user_signup_method(user)
            flash(msg, 'info')
            if method == 'local':
                return redirect(url_for('account.forgot_password'))
            else:
                return redirect(url_for('account.signin'))
        else:
            return redirect(url_for('account.signin'))
    else:
        first_login = False
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        request_email = False
        if (user.email_addr == "None"):
            request_email = True
        if request_email:
            if first_login:
                flash("This is your first login, please add a valid e-mail")
            else:
                flash("Please update your e-mail address in your profile page")
            return redirect(url_for('account.update_profile', name=user.name))
        return redirect(next_url)

def manage_user_login(user, user_data, next_url):
    """Manage user login."""
    if user is None:
        # Give a hint for the user
        user = user_repo.get_by(email_addr=user_data['email'])
        if user is None:
            name = user_data['name'].encode('ascii', 'ignore').lower().replace(' ', '')
            user = user_repo.get_by_name(name)

        msg, method = get_user_signup_method(user)
        flash(msg, 'info')
        if method == 'local':
            return redirect(url_for('account.forgot_password'))
        else:
            return redirect(url_for('account.signin'))
    else:
        login_user(user, remember=True)
        flash("Welcome back %s" % user.fullname, 'success')
        if user.newsletter_prompted is False and newsletter.app:
            return redirect(url_for('account.newsletter_subscribe',
                                    next=next_url))
        return redirect(next_url)

    def test_signin_create(self, ldap_mock):
        """Test signin creates a PYBOSSA user."""
        with patch.dict(self.flask_app.config, {'LDAP_HOST': '127.0.0.1'}):
            url = '/account/signin'
            payload = {'email': 'cn', 'password': 'password'}
            ldap_mock.bind_user.return_value = True
            ldap_mock.get_object_details.return_value = self.ldap_user
            res = self.app.post(url, data=json.dumps(payload),
                                content_type='application/json')
            user = user_repo.get_by(ldap='cn')
            data = json.loads(res.data)
            assert data['status'] == SUCCESS, data
            assert data['next'] == '/', data
            assert user.name == self.ldap_user['uid'][0], user
            assert user.email_addr == self.ldap_user['cn'][0], user

            ldap_mock.bind_user.return_value = False
            res = self.app.post(url, data=json.dumps(payload),
                                content_type='application/json')
            data = json.loads(res.data)
            msg = 'User LDAP credentials are wrong.'
            assert data['flash'] == msg, data
            assert data['status'] == 'info', data