def delete(entry_id, inc_page=0):
    if not GroupPermissionAPI.can_write('navigation'):
        return abort(403)

    if inc_page and not GroupPermissionAPI.can_write('page'):
        return abort(403)

    entry = db.session.query(NavigationEntry).filter_by(id=entry_id).first()
    if not entry:
        abort(404)

    if not entry.parent:
        if entry.children.count() > 0:
            flash('Deze item heeft nog subitems.', 'danger')
            return redirect(url_for('navigation.edit', entry_id=entry.id))

    if inc_page:
        if entry.external or entry.activity_list:
            flash('Deze item verwijst niet naar een pagina op deze website.',
                  'danger')
        else:
            path = entry.url.lstrip('/')
            if PageAPI.remove_page(path):
                flash('De pagina is verwijderd.', 'success')
            else:
                flash('De te verwijderen pagina kon niet worden gevonden.',
                      'danger')

    db.session.delete(entry)
    db.session.commit()

    flash('De navigatie-item is verwijderd.', 'success')

    return redirect(url_for('navigation.view'))

def view_list(page=1):
    if not GroupPermissionAPI.can_read('company'):
        return abort(403)

    if request.args.get('search') is not None:
        search = request.args.get('search')

        companies = Company.query.join(Location)\
            .filter(or_(Company.name.like('%' + search + '%'),
                        Location.city.like('%' + search + '%')))\
            .order_by(Company.name).order_by(Company.rank)

        if not GroupPermissionAPI.can_write('company'):
            companies = companies\
                .filter(and_(Company.contract_start_date < datetime.utcnow(),
                             Company.contract_end_date > datetime.utcnow()))\
                .paginate(page, 15, True)
        else:
            for i, company in enumerate(companies):
                print(i, company)
                if company.contract_start_date < datetime\
                        .date(datetime.utcnow()) and \
                        company.contract_end_date < datetime\
                        .date(datetime.utcnow()):
                    companies[i].expired = True
            companies = companies.paginate(page, 15, False)

        return render_template('company/list.htm', companies=companies,
                               search=search, path=FILE_FOLDER)

    if not GroupPermissionAPI.can_write('company'):
        companies = Company.query\
            .filter(and_(Company.contract_start_date < datetime.utcnow(),
                         Company.contract_end_date > datetime.utcnow()))\
            .order_by(Company.name).order_by(Company.rank).paginate(page, 15,
                                                                    True)
    else:
        companies = Company.query.filter().order_by(Company.name)\
            .order_by(Company.rank)
        for i, company in enumerate(companies):
            print(i, company)
            if company.contract_start_date < datetime.date(datetime.utcnow()) \
                    and company.contract_end_date < datetime.date(datetime
                                                                  .utcnow()):
                print(i)
                companies[i].expired = True
        companies = companies.paginate(page, 15, False)
        # todo fix message if inactive

    # companies = Company.query.paginate(page, 15, False)

    return render_template('company/list.htm', companies=companies, search="",
                           path=FILE_FOLDER)

def remove_avatar(user_id=None):
    user = User.query.get(user_id)
    if not GroupPermissionAPI.can_write('user') and\
            (not current_user or current_user.id != user_id):
        return abort(403)
    UserAPI.remove_avatar(user)
    return redirect(url_for('user.view_single', user_id=user_id))

def view():

    page = request.args.get('page_nr', '')

    if not page:
        page = 1
    else:
        page = int(page)

    if not GroupPermissionAPI.can_write('custom_form'):
        return abort(403)

    custom_forms = CustomForm.query.order_by(desc("id"))

    if current_user and current_user.id > 0:
        follows = CustomFormFollower.query\
            .filter(CustomFormFollower.owner_id == current_user.id).all()

        ids = []

        for follow in follows:
            ids.append(follow.form_id)

        followed_forms = CustomForm.query.filter(CustomForm.id.in_(ids)).all()
    else:
        followed_forms = []
        ids = []

    # TODO Custom forms for specific groups (i.e coordinator can only see own
    # forms)
    return render_template('custom_form/overview.htm',
                           custom_forms=custom_forms.paginate(page, 20, False),
                           followed_forms=followed_forms, followed_ids=ids)

def view_single(user_id=None):
    if not GroupPermissionAPI.can_read('user') and\
            (not current_user or current_user.id != user_id):
        return abort(403)

    if not user_id:
        return abort(404)
    user = User.query.get(user_id)
    if not user:
        return abort(404)

    user.avatar = UserAPI.avatar(user)
    user.groups = UserAPI.get_groups_for_user_id(user)

    user.groups_amount = user.groups.count()

    # Get all activity entrees from these forms, order by start_time of
    # activity.
    activities = Activity.query.join(CustomForm).join(CustomFormResult).\
        filter(CustomFormResult.owner_id == user_id and
               CustomForm.id == CustomFormResult.form_id and
               Activity.form_id == CustomForm.id)

    user.activities_amount = activities.count()

    new_activities = activities\
        .filter(Activity.end_time > datetime.datetime.today()).distinct()\
        .order_by(Activity.start_time)
    old_activities = activities\
        .filter(Activity.end_time < datetime.datetime.today()).distinct()\
        .order_by(Activity.start_time.desc())

    return render_template('user/view_single.htm', user=user,
                           new_activities=new_activities,
                           old_activities=old_activities)

    def can_view(entry):
        '''
        Check whether the current user can view the entry, so if not it can be
        removed from the navigation.
        '''
        blueprints = [(name, b.url_prefix) for name, b in
                      application.blueprints.iteritems()]

        if entry.external or entry.activity_list:
            return True

        url = entry.url
        if not url[-1:] == '/':
            path = url
            url += '/'
        else:
            path = url[:-1]

        for blueprint, url_prefix in blueprints:
            if not url_prefix:
                continue

            if url_prefix == url:
                return GroupPermissionAPI.can_read(blueprint)

        page = Page.query.filter_by(path=path).first()
        if not page:
            return True

        return UserAPI.can_read(page)

    def commit_book_to_db(book_id, title, price, isbn, stock):
        """
        Adds a new book to the database

        Returns succes(boolean), message (string). Message is the book.id if
        succes is true, otherwise it contains what exactly went wrong.

        In case of succes the book is entered into the database
        """

        if not GroupPermissionAPI.can_write('booksales'):
            abort(403)

        if book_id == -1:
            book = Book(title, price, isbn, stock)
            db.session.add(book)
            db.session.commit()
            return True, book.id

        book = Book.query.filter(Book.id == book_id).first()
        book.title = title
        book.price = price
        book.isbn = isbn
        book.stock = stock
        db.session.add(book)
        db.session.commit()

        return True, book.id

def edit(company_id=None):
    '''
    FRONTEND
    Create, view or edit a company.
    '''
    if not GroupPermissionAPI.can_read('company'):
        return abort(403)

    # Select company.
    if company_id:
        company = Company.query.get(company_id)
    else:
        company = Company()

    form = CompanyForm(request.form, company)

    # Add locations.
    locations = Location.query.order_by('address').order_by('city')
    form.location_id.choices = \
        [(l.id, l.address + ', ' + l.city) for l in locations]

    # Add contacts.
    # form.contact_id.choices = \
    #       [(c.id, c.name) for c in Contact.query\
    #               .filter_by(location=location).order_by('name')]
    form.contact_id.choices = \
        [(c.id, c.name) for c in Contact.query.filter_by().order_by('name')]

    return render_template('company/edit.htm', company=company, form=form)

    def get_minutes(group_id):
        """
        Load all minutes in the given group
        """
        if not GroupPermissionAPI.can_read('pimpy'):
            abort(403)
        if not current_user:
            flash('Huidige gebruiker niet gevonden', 'danger')
            return redirect(url_for('pimpy.view_minutes'))

        list_items = {}

        if group_id != 'all':
            query = Minute.query.filter(Minute.group_id == group_id).\
                order_by(Minute.minute_date.desc())
            list_items[Group.query.filter(Group.id == group_id).first().name]\
                = query.all()
        # this should be done with a sql in statement, or something, but meh
        else:
            for group in current_user.groups:
                query = Minute.query.filter(Minute.group_id == group.id)
                query = query.order_by(Minute.minute_date.desc())
                list_items[group.name] = query.all()

        return Markup(render_template('pimpy/api/minutes.htm',
                                      list_items=list_items, type='minutes',
                                      group_id=group_id, line_number=-1,
                                      title='PimPy'))

def view():
    if not GroupPermissionAPI.can_read('navigation'):
        return abort(403)

    entries = NavigationAPI.get_entries()

    return render_template('navigation/view.htm', nav_entries=entries)

def has_payed(submit_id=None):
    response = "success"

    if not GroupPermissionAPI.can_write('custom_form'):
        return abort(403)

    # Logged in user
    if not current_user or current_user.id <= 0:
        # Need to be logged in
        return abort(403)

    # Test if user already signed up
    submission = CustomFormResult.query.filter(
        CustomFormResult.id == submit_id
    ).first()

    if not submission:
        response = "Error, submission could not be found"

    # Adjust the "has_payed"
    if submission.has_payed:
        submission.has_payed = False
    else:
        submission.has_payed = True

    db.session.add(submission)
    db.session.commit()

    return response

def update(contact_id=None):
    '''
    Create or edit a contact, backend.
    '''
    if not GroupPermissionAPI.can_write('contact'):
        return abort(403)

    if contact_id:
        contact = Contact.query.get(contact_id)
    else:
        contact = Contact()

    form = ContactForm(request.form, contact)
    if not validate_form(form, ['name', 'email', 'phone_nr', 'location_id']):
        return redirect(url_for('contact.edit', contact_id=contact_id))

    form.populate_obj(contact)
    db.session.add(contact)
    db.session.commit()

    if contact_id:
        flash('Contactpersoon opgeslagen', 'success')
    else:
        contact_id = contact.id
        flash('Contactpersoon aangemaakt', 'success')

    return redirect(url_for('contact.edit', contact_id=contact_id))

def new_submission(challenge_id=None):
    if not GroupPermissionAPI.can_read('challenge'):
        abort(403)

    if request.args.get('challenge_id'):
        challenge_id = request.args.get('challenge_id')
    else:
        return "Error, no 'challenge_id' given"

    if request.args.get('submission'):
        submission = request.args.get('submission')
    else:
        return "Error, no 'submission' given"

    new_submission = ChallengeAPI.create_submission(challenge_id=challenge_id,
                                                    user_id=current_user.id,
                                                    submission=submission,
                                                    image_path=None)

    if new_submission is False:
        return "Question is already submitted"

    challenge = ChallengeAPI.fetch_challenge(challenge_id)

    return ChallengeAPI.validate_question(new_submission, challenge)

def get_ranking():
    if not GroupPermissionAPI.can_read('challenge'):
        abort(403)

    ranking = ChallengeAPI.get_ranking()

    return jsonify(ranking=[user.serialize for user in ranking])

def create():
    if not(GroupPermissionAPI.can_write('group')):
        return abort(403)

    if request.method == 'POST':
        name = request.form['name'].strip()
        valid_form = True

        if not name:
            flash('No group name has been specified.', 'danger')
            valid_form = False
        elif Group.query.filter(Group.name == name).count() > 0:
            flash('The group name that has been specified is in use already.',
                  'danger')
            valid_form = False

        if valid_form:
            group = Group(name)

            db.session.add(group)
            db.session.commit()

            flash('The group has been created.', 'success')

            return redirect(url_for('group.view'))

    return render_template('group/create.htm', title='Create group')

    def get_navigation_menu(group_id, personal, type):
        if not GroupPermissionAPI.can_read('pimpy'):
            abort(403)
        if not current_user:
            flash('Huidige gebruiker niet gevonden!', 'danger')
            return redirect(url_for('pimpy.view_minutes'))

        groups = current_user.groups\
            .filter(Group.name != 'all').order_by(Group.name.asc()).all()

        if not type:
            type = 'minutes'
        endpoint = 'pimpy.view_' + type
        endpoints = {'view_chosentype': endpoint,
                     'view_chosentype_personal': endpoint + '_personal',
                     'view_chosentype_chosenpersonal': endpoint +
                     ('_personal' if personal and type != 'minutes' else ''),
                     'view_tasks': 'pimpy.view_tasks',
                     'view_tasks_personal': 'pimpy.view_tasks_personal',
                     'view_tasks_chosenpersonal': 'pimpy.view_tasks',
                     'view_minutes': 'pimpy.view_minutes'}
        if personal:
            endpoints['view_tasks_chosenpersonal'] += '_personal'

        if not group_id:
            group_id = 'all'
        if group_id != 'all':
            group_id = int(group_id)

        return Markup(render_template('pimpy/api/side_menu.htm', groups=groups,
                                      group_id=group_id, personal=personal,
                                      type=type, endpoints=endpoints,
                                      title='PimPy'))

    def get_list_of_users_from_string(group_id, comma_sep):
        """
        Parses a string which is a list of comma separated user names
        to a list of users, searching only within the group given

        Returns users, message. Users is false if there is something wrong,
        in which case the message is stated in message, otherwise message
        equals "" and users is the list of matched users

        usage:
        get_list_of_users_from_string(group_id, comma_sep)
        where group_id is the group's id
        and comma_sep is a string with comma seperated users.
        """
        if not GroupPermissionAPI.can_read('pimpy'):
            abort(403)

        group = Group.query.filter(Group.id == group_id).first()
        if group is None:
            return False, "Kan groep niet vinden."

        if comma_sep is None:
            return False,
        "Geen komma gescheiden lijst met gebruikers gevonden."

        if not comma_sep:
            return group.users.all(), ''

        comma_sep = map(lambda x: x.lower().strip(), comma_sep.split(','))

        found_users = []

        users = group.users.all()

        user_names = map(lambda x: "%s %s" % (x.first_name.lower().strip(),
                                              x.last_name.lower().strip()),
                         users)
        user_names = [unidecode(x) for x in user_names]

        for comma_sep_user in comma_sep:
            match = extractOne(comma_sep_user, user_names)
            found = False

            if not match:
                return False, \
                    'Kon geen gebruiker vinden voor: %s' % (comma_sep_user)

            for i in range(len(users)):
                # could use a filter here, but meh
                if user_names[i] == match[0]:
                    found_users.append(users[i])
                    found = True
                    break

            if not found:
                return False, \
                    'Kon geen gebruiker vinden voor %s' % (comma_sep_user)

        return found_users, ""

def create_challenge(challenge_id=None):
    if not GroupPermissionAPI.can_write('challenge'):
        abort(403)

    # Gather all arguments
    if request.args.get('parent_id'):
        parent_id = request.args.get('parent_id')
    else:
        return "Error, no 'parent_id' given"

    if request.args.get('name'):
        name = request.args.get('name')
    else:
        return "Error, no 'name' given"

    if request.args.get('description'):
        description = request.args.get('description')
    else:
        return "Error, no 'description' given"

    if request.args.get('type'):
        type = request.args.get('type')
    else:
        return "Error, no 'type' given"

    if request.args.get('start_date'):
        start_date = datetime.datetime.strptime(request.args.get('start_date'),
                                                '%Y-%m-%d').date()
    else:
        return "Error, no 'start_date' given"

    if request.args.get('end_date'):
        end_date = datetime.datetime.strptime(request.args.get('end_date'),
                                              '%Y-%m-%d').date()
    else:
        return "Error, no 'end_date' given"

    if request.args.get('answer'):
        answer = request.args.get('answer')
    else:
        return "Error, no 'answer' given"

    if request.args.get('weight'):
        weight = request.args.get('weight')
    else:
        return "Error, no 'weight' given"

    if request.args.get('hint'):
        hint = request.args.get('hint')
    else:
        return "Error, no 'hint' given"

    # Check if the name of the challenge is unique
    if ChallengeAPI.challenge_exists(name):
        return "Error, challenge with name '" + name + "' already exists"

    return ChallengeAPI.create_challenge(name, description, hint, start_date,
                                         end_date, parent_id, weight, type,
                                         answer)

def fetch_all():
    if not GroupPermissionAPI.can_write('challenge'):
        abort(403)

    challenges = ChallengeAPI.fetch_all_challenges()

    return jsonify(challenges=[challenge.serialize for challenge in
                               challenges])

def reorder():
    if not GroupPermissionAPI.can_write('navigation'):
        return abort(403)

    entries = json.loads(request.form['entries'])
    NavigationAPI.order(entries, None)

    return ""