def setup_module(module):
    """
    clean up the store, establish a registered client
    """
    clean_store()
    module.store = get_store(config)
    environ = {'tiddlyweb.config': config, 'tiddlyweb.store': module.store}
    ensure_bags(config)

    # make an application and store that info
    app = create(name='testapp', owner='appowner1',
            app_url='http://our_test_domain:8001',
            callback_url='http://our_test_domain:8001/_oauth/callback')

    client_id = app.title
    client_secret = app.fields['client_secret']
    store_app(environ, app)

    config['oauth.servers']['testserver']['client_id'] = client_id
    config['oauth.servers']['testserver']['client_secret'] = client_secret

    module.client_id = client_id

    initialize_app(config)

    module.http = Http()

    # we need a user who is going to use the client app
    user = User('cdent')
    user.set_password('cowpig')
    module.store.put(user)

def setup_module(module):
    try:
        shutil.rmtree('store')
    except:
        pass # !!!
    config['server_host'] = {
            'host': 'our_test_domain',
            'port': '8001',
            'scheme': 'http',
            }
    from tiddlyweb.web import serve
    # we have to have a function that returns the callable,
    # Selector just _is_ the callable
    def app_fn():
        return serve.load_app()
    #wsgi_intercept.debuglevel = 1
    httplib2_intercept.install()
    wsgi_intercept.add_wsgi_intercept('our_test_domain', 8001, app_fn)

    environ = {'tiddlyweb.config': config}
    module.store = Store(config['server_store'][0], config['server_store'][1], environ)

    admin = User('admin')
    admin.add_role('ADMIN')
    admin.set_password('spank')
    module.store.put(admin)
    module.admin_authorization = b64encode('admin:spank')
    module.user_authorization = b64encode('cdent:pigdog')

def register_user(environ, start_response):
    username, password, confirmation = [environ['tiddlyweb.query'][param][0] for
            param in ('username', 'password', 'password_confirmation')]

    user = User(username)
    store = environ['tiddlyweb.store']
    try:
        store.get(user)
        available = False
    except NoUserError:
        available = username not in BLACKLIST
    if not available:
        raise HTTP409('username unavailable')

    if not password == confirmation:
        raise HTTP400('passwords do not match')

    _create_wiki(store, username, username, private=True)

    user.set_password(password)
    store.put(user)

    index = Tiddler('index', username)
    index.type = 'text/x-markdown'
    index.text = "Welcome to %s's personal wiki." % username
    store.put(index)

    cookie = make_cookie('tiddlyweb_user', user.usersign,
            path=uri('front page', environ),
            mac_key=environ['tiddlyweb.config']['secret'],
            expires=environ['tiddlyweb.config'].get('cookie_age', None))

    start_response('303 See Other', [('Set-Cookie', cookie),
            ('Location', uri('dashboard', environ).encode('UTF-8'))])
    return ['']

def test_post_new_user():
    http = httplib2.Http()

# XXX simon removed the code that makes this test pass
#     response, content = http.request('http://our_test_domain:8001/users',
#             method='POST',
#             headers={'Content-Type': 'application/json'},
#             body='{"username":"cdent","password":"pigdog"}')
# 
#     assert response['status'] == '403'
#     assert 'insufficient' in content

    response, content = http.request('http://our_test_domain:8001/users',
            method='POST',
            headers={'Content-Type': 'application/json',
                'Authorization': 'Basic %s' % admin_authorization},
            body='{"username":"cdent","password":"pigdog"}')

    assert response['status'] == '201'
    
    user = User('cdent')
    user = store.get(user)
    assert user.check_password('pigdog') is True
    assert user.check_password('slam') is False

    response, content = http.request('http://our_test_domain:8001/users',
            method='POST',
            headers={'Content-Type': 'application/json',
                'Authorization': 'Basic %s' % admin_authorization},
            body='{"username":"cdent","password":"pigdog"}')
    assert response['status'] == '409'
    assert 'User exists' in content

    def _init_store(self, struct):
        """
        creates basic store structure with bags, recipes and users

        (no support for user passwords for security reasons)
        """
        store = get_store(self.init_config)

        bags = struct.get("bags", {})
        for name, data in bags.items():
            desc = data.get("desc")
            bag = Bag(name, desc=desc)
            constraints = data.get("policy", {})
            _set_policy(bag, constraints)
            store.put(bag)

        recipes = struct.get("recipes", {})
        for name, data in recipes.items():  # TODO: DRY
            desc = data.get("desc")
            recipe = Recipe(name, desc=desc)
            recipe.set_recipe(data["recipe"])
            constraints = data.get("policy", {})
            _set_policy(recipe, constraints)
            store.put(recipe)

        users = struct.get("users", {})
        for name, data in users.items():
            note = data.get("note")
            user = User(name, note=note)
            password = data.get("_password")
            if password:
                user.set_password(password)
            for role in data.get("roles", []):
                user.add_role(role)
            store.put(user)

def handle(environ, start_response):
    """
    Handle a posted request for registration.

    If the provided username is blacklisted, ask them to
    log in as someone else. Otherwise send closing
    material with a link to get started.
    """
    pretty_name = environ['tiddlyweb.query'].get('pretty_name', [None])[0]
    target_role = environ['tiddlyweb.config'].get('register_role', 'MEMBER')
    store = environ['tiddlyweb.store']
    username = environ['tiddlyweb.usersign']['name']
    if _blacklisted(environ, username):
        return _send_start(environ, start_response,
                message='That user has been blocked')
    user = User(username)
    try:
        user = store.get(user)
    except NoUserError:
        pass # is cool if they don't exist yet
    user.add_role('%s' % target_role)
    if pretty_name:
        user.note = pretty_name
    store.put(user)
    environ['tiddlyweb.usersign'] = {'name': user.usersign,
            'roles': user.list_roles()}
    return _send_finish(environ, start_response)

def test_put_password():
    http = httplib2.Http()

    response, content = http.request('http://our_test_domain:8001/users/cdent',
            method='PUT',
            headers={'Content-Type': 'application/json'},
            body='{"password":"pigcat"}')

    assert response['status'] == '403'

    response, content = http.request('http://our_test_domain:8001/users/cdent',
            method='PUT',
            headers={'Content-Type': 'application/json',
                'Authorization': 'Basic %s' % user_authorization},
            body='{"password":"pigcat"}')

    assert response['status'] == '204'
    
    user = User('cdent')
    user = store.get(user)
    assert user.check_password('pigcat') is True
    assert user.check_password('pigdog') is False

    response, content = http.request('http://our_test_domain:8001/users/cdent',
            method='PUT',
            headers={'Content-Type': 'application/json',
                'Authorization': 'Basic %s' % admin_authorization},
            body='{"password":"pigcow"}')
    assert response['status'] == '204'
    
    user = User('cdent')
    user = store.get(user)
    assert user.check_password('pigcow') is True
    assert user.check_password('pigcat') is False

def make_user(username, password):
    user = User(username)
    user.set_password(password)
    store.put(user)

    secret_string = sha('%s%s' % (username, config['secret'])).hexdigest()
    return secret_string

def test_no_cookie_sent():
    """
    Test no cookie is sent if one is already present
    """
    store = get_store(config)
    space = 'foo'
    make_fake_space(store, space)
    user = User('foo')
    user.set_password('foobar')
    store.put(user)

    user_cookie = get_auth('foo', 'foobar')
    time = datetime.now().strftime('%Y%m%d%H')
    cookie = 'csrf_token=%s:%s:%s' % (time, user.usersign,
        sha('%s:%s:%s:%s' % (user.usersign,
        time, space, config['secret'])).hexdigest())

    response, _ = http.request('http://foo.0.0.0.0:8080/status',
        method='GET',
        headers={
            'Cookie': 'tiddlyweb_user="%s"; %s' % (user_cookie, cookie)
        })

    cookie = response.get('set-cookie')
    if cookie:
        assert 'csrf_token' not in cookie

 def _validate_and_redirect(self, environ, start_response, username, password, redirect):
     """
     Check a username and password. If valid, send a cookie
     to the client. If it is not, send the form again.
     """
     status = "401 Unauthorized"
     try:
         store = environ["tiddlyweb.store"]
         secret = environ["tiddlyweb.config"]["secret"]
         cookie_age = environ["tiddlyweb.config"].get("cookie_age", None)
         user = User(username)
         user = store.get(user)
         if user.check_password(password):
             uri = "%s%s" % (server_host_url(environ), redirect)
             cookie_header_string = make_cookie(
                 "tiddlyweb_user", user.usersign, mac_key=secret, path=self._cookie_path(environ), expires=cookie_age
             )
             logging.debug("303 to %s", uri)
             start_response("303 Other", [("Set-Cookie", cookie_header_string), ("Location", uri.encode("utf-8"))])
             return [uri]
     except KeyError:
         pass
     except NoUserError:
         pass
     return self._send_cookie_form(environ, start_response, redirect, status, "User or Password no good")

 def _validate_and_redirect(self, environ, start_response, username,
         password, redirect):
     """
     Check a username and password. If valid, send a cookie
     to the client. If it is not, send the form again.
     """
     status = '401 Unauthorized'
     try:
         store = environ['tiddlyweb.store']
         secret = environ['tiddlyweb.config']['secret']
         cookie_age = environ['tiddlyweb.config'].get('cookie_age', None)
         user = User(username)
         user = store.get(user)
         if user.check_password(password):
             uri = '%s%s' % (server_host_url(environ), redirect)
             cookie_header_string = make_cookie('tiddlyweb_user',
                     user.usersign, mac_key=secret,
                     path=self._cookie_path(environ), expires=cookie_age)
             logging.debug('303 to %s', uri)
             start_response('303 Other',
                     [('Set-Cookie', cookie_header_string),
                         ('Content-Type', 'text/plain'),
                         ('Location', uri.encode('utf-8'))])
             return [uri]
     except KeyError:
         pass
     except NoUserError:
         pass
     return self._send_cookie_form(environ, start_response, redirect,
             status, 'User or Password no good')

def handle(environ, start_response):
    """
    Handle a posted request for registration.

    If the provided username is blacklisted, ask them to
    log in as someone else. Otherwise send closing
    material with a link to get started.
    """
    pretty_name = environ["tiddlyweb.query"].get("pretty_name", [None])[0]
    target_role = environ["tiddlyweb.config"].get("register_role", "MEMBER")
    store = environ["tiddlyweb.store"]
    username = environ["tiddlyweb.usersign"]["name"]
    if _blacklisted(environ, username):
        return _send_start(environ, start_response, message="That user has been blocked")
    user = User(username)
    try:
        user = store.get(user)
    except NoUserError:
        pass  # is cool if they don't exist yet
    user.add_role("%s" % target_role)
    if pretty_name:
        user.note = pretty_name
    store.put(user)
    environ["tiddlyweb.usersign"] = {"name": user.usersign, "roles": user.list_roles()}
    return _send_finish(environ, start_response)

def test_cookie_set():
    """
    test that we get a cookie relating to the space we are in
    """
    store = get_store(config)
    hostname = "foo.0.0.0.0:8080"
    user = User(u"f\u00F6o")
    user.set_password("foobar")
    store.put(user)

    user_cookie = get_auth(u"f\u00F6o", "foobar")

    response, content = http.request(
        "http://foo.0.0.0.0:8080/", method="GET", headers={"Cookie": 'tiddlyweb_user="%s"' % user_cookie}
    )

    assert response["status"] == "200", content

    time = datetime.utcnow().strftime("%Y%m%d%H")
    cookie = "csrf_token=%s:%s:%s" % (
        time,
        user.usersign,
        sha("%s:%s:%s:%s" % (user.usersign, time, hostname, config["secret"])).hexdigest(),
    )
    assert response["set-cookie"] == quote(cookie.encode("utf-8"), safe=".!~*'():=")

 def tiddler_get(self, tiddler):
     store = self.main_store
     username = tiddler.title
     user = User(username)
     user = store.get(user)
     tiddler.text = '%s' % user.list_roles()
     return tiddler

 def _validate_and_redirect(self, environ, start_response, username, password, redirect):
     """
     Check a username and password. If valid, send a cookie
     to the client. If it is not, send the form again.
     """
     status = "401 Unauthorized"
     try:
         store = environ["tiddlyweb.store"]
         secret = environ["tiddlyweb.config"]["secret"]
         user = User(username)
         user = store.get(user)
         if user.check_password(password):
             uri = "%s%s" % (server_host_url(environ), redirect)
             cookie = Cookie.SimpleCookie()
             secret_string = sha("%s%s" % (user.usersign, secret)).hexdigest()
             cookie["tiddlyweb_user"] = "%s:%s" % (user.usersign, secret_string)
             cookie["tiddlyweb_user"]["path"] = self._cookie_path(environ)
             logging.debug("303 to %s" % uri)
             start_response("303 Other", [("Set-Cookie", cookie.output(header="")), ("Location", uri)])
             return [uri]
     except KeyError:
         pass
     except NoUserError:
         pass
     return self._send_cookie_form(environ, start_response, redirect, status, "User or Password no good")

def establish_user_auth(config, store, host, username):
    user = User(username)
    mapping_username = 'github-%s' % username
    mapping_tiddler = Tiddler(mapping_username, 'MAPUSER')
    mapping_tiddler.fields['mapped_user'] = username

    try:
        store.delete(user)
    except StoreError:
        pass
    try:
        store.delete(mapping_tiddler)
    except IOError:
        pass

    user.add_role('MEMBER')
    user.note = '{}'
    store.put(user)
    ensure_bag('MAPUSER', store)
    store.put(mapping_tiddler)
    stamp = datetime.utcnow().strftime('%Y%m%d%H')
    csrf = gen_nonce(username, host, stamp, config['secret'])
    cookie = make_cookie('tiddlyweb_user', mapping_username,
            mac_key=config['secret'], httponly=False)

    return cookie, csrf

def test_users():
    userc = User('cdent')
    userc.set_password('foobar')
    userc.add_role('ADMIN')
    userc.note = 'A simple programmer of matter'

    store.put(userc)

    userf = User('FND')
    userf.set_password('I<3whitespace')

    store.put(userf)

    user2 = store.get(User('cdent'))
    assert user2.usersign == userc.usersign
    assert user2.check_password('foobar')
    assert user2.list_roles() == userc.list_roles()
    assert user2.note == userc.note

    users = list(store.list_users())
    assert len(users) == 2
    assert ['FND', 'cdent'] == sorted([user.usersign for user in users])

    store.delete(User('FND'))

    users = list(store.list_users())
    assert len(users) == 1

    py.test.raises(NoUserError, "store.get(User('FND'))")

 def _validate_and_redirect(self, environ, start_response, username, password, redirect):
     """
     Check a username and password. If valid, send a cookie
     to the client. If it is not, send the form again.
     """
     status = '401 Unauthorized'
     try:
         store = environ['tiddlyweb.store']
         secret = environ['tiddlyweb.config']['secret']
         user = User(username)
         store.get(user)
         if user.check_password(password):
             uri = '%s%s' % (server_host_url(environ), redirect)
             import re
             uri = re.sub("/recipes/portal(-.*)?/", "/recipes/portal-"+username+"/", uri)
             # uri = uri.replace("/recipes/portal/",
             # print "USERNAME" + username
             # print "URI" + uri
             cookie = Cookie.SimpleCookie()
             secret_string = sha('%s%s' % (user.usersign, secret)).hexdigest()
             cookie['tiddlyweb_user'] = '%s:%s' % (user.usersign, secret_string)
             cookie['tiddlyweb_user']['path'] = '/'
             start_response('303 See Other', [
                 ('Set-Cookie', cookie.output(header='')),
                 ('Location', uri)
                 ])
             return [uri]
     except KeyError:
         pass
     except NoUserError:
         pass
     return self._send_cookie_form(environ, start_response, redirect, status, 'User or Password no good')

def test_cookie_set():
    """
    test that we get a cookie relating to the space we are in
    """
    store = get_store(config)
    space = 'foo'
    make_fake_space(store, space)
    user = User('foo')
    user.set_password('foobar')
    store.put(user)

    user_cookie = get_auth('foo', 'foobar')

    response, content = http.request('http://foo.0.0.0.0:8080/status',
        method='GET',
        headers={
            'Cookie': 'tiddlyweb_user="%s"' % user_cookie
        })

    assert response['status'] == '200', content

    time = datetime.now().strftime('%Y%m%d%H')
    cookie = 'csrf_token=%s:%s:%s' % (time, user.usersign,
        sha('%s:%s:%s:%s' % (user.usersign,
        time, space, config['secret'])).hexdigest())
    assert response['set-cookie'] == cookie

def test_adduser_with_roles():
    handle(['', u'adduser', u'cdent', u'crunk', u'cow', u'monkey'])
    the_user = User('cdent')
    the_user = store.get(the_user)
    assert the_user.check_password('crunk')
    assert 'cow' in the_user.list_roles()
    assert 'monkey' in the_user.list_roles()