def handle(self, data, address):
        from sentry.utils.auth import parse_auth_header
        from sentry.coreapi import (project_from_auth_vars, decode_and_decompress_data, safely_load_json_string,
                                    validate_data, insert_data_to_database, APIError)
        try:
            try:
                auth_header, data = data.split("\n\n", 1)
            except ValueError:
                raise APIError("missing auth header")
            project = project_from_auth_vars(parse_auth_header(auth_header), data)

            if not data.startswith('{'):
                data = decode_and_decompress_data(data)
            data = safely_load_json_string(data)

            try:
                validate_data(project, data)
            except InvalidTimestamp:
                # Log the error, remove the timestamp, and revalidate
                logger.error('Client %r passed an invalid value for timestamp %r' % (
                    data['timestamp'],
                    client or '<unknown client>',
                ))
                del data['timestamp']
                validate_data(project, data)

            return insert_data_to_database(data)
        except APIError, error:
            logger.error('bad message from %s: %s' % (address, error.msg))
            return error

def handle_sentry(data, address):
    from sentry.exceptions import InvalidData
    from sentry.coreapi import project_from_auth_vars, decode_and_decompress_data, \
        safely_load_json_string, validate_data, insert_data_to_database, APIError
    from sentry.utils.auth import parse_auth_header

    try:
        try:
            auth_header, data = data.split('\n\n', 1)
        except ValueError:
            raise APIError('missing auth header')

        auth_vars = parse_auth_header(auth_header)
        project = project_from_auth_vars(auth_vars, data)

        client = auth_vars.get('sentry_client')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            validate_data(project, data, client)
        except InvalidData, e:
            raise APIError(unicode(e))

        return insert_data_to_database(data)

def store(request):
    try:
        auth_vars = extract_auth_vars(request)
        data = request.raw_post_data

        if auth_vars:
            server_version = auth_vars.get('sentry_version', '1.0')
        else:
            server_version = request.GET.get('version', '1.0')

        if server_version not in ('1.0', '2.0'):
            raise APIError('Client/server version mismatch. Unsupported version: %r' % server_version)

        if auth_vars:
            project = project_from_auth_vars(auth_vars, data)
        elif request.GET.get('api_key') and request.GET.get('project_id') and request.is_secure():
            # ssl requests dont have to have signature verification
            project = project_from_api_key_and_id(request.GET['api_key'], request.GET['project_id'])
        elif request.GET.get('project_id') and request.user.is_authenticated():
            # authenticated users are simply trusted to provide the right id
            project = project_from_id(request)
        else:
            raise APIUnauthorized()

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        validate_data(project, data)

        insert_data_to_database(data)
    except APIError, error:
        return HttpResponse(error.msg, status=error.http_status)

    def post(self, request, project, helper, **kwargs):
        json_body = safely_load_json_string(request.body)
        report_type = self.security_report_type(json_body)
        if report_type is None:
            raise APIError('Unrecognized security report type')
        interface = get_interface(report_type)

        try:
            instance = interface.from_raw(json_body)
        except jsonschema.ValidationError as e:
            raise APIError('Invalid security report: %s' % str(e).splitlines()[0])

        # Do origin check based on the `document-uri` key as explained in `_dispatch`.
        origin = instance.get_origin()
        if not is_valid_origin(origin, project):
            if project:
                tsdb.incr(tsdb.models.project_total_received_cors, project.id)
            raise APIForbidden('Invalid origin')

        data = {
            'interface': interface.path,
            'report': instance,
            'release': request.GET.get('sentry_release'),
            'environment': request.GET.get('sentry_environment'),
        }

        response_or_event_id = self.process(
            request, project=project, helper=helper, data=data, **kwargs
        )
        if isinstance(response_or_event_id, HttpResponse):
            return response_or_event_id
        return HttpResponse(content_type='application/javascript', status=201)

    def post(self, request, project, auth, **kwargs):
        data = request.raw_post_data

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            validate_data(project, data, auth.client)
        except InvalidData, e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

    def process(self, request, project, auth, data, **kwargs):
        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            validate_data(project, data, auth.client)
        except InvalidData, e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

    def process(self, request, project, auth, data, **kwargs):
        event_received.send_robust(ip=request.META['REMOTE_ADDR'], sender=type(self))

        # TODO: improve this API (e.g. make RateLimit act on __ne__)
        rate_limit = safe_execute(app.quotas.is_rate_limited, project=project)
        if isinstance(rate_limit, bool):
            rate_limit = RateLimit(is_limited=rate_limit, retry_after=None)

        if rate_limit is not None and rate_limit.is_limited:
            raise APIRateLimited(rate_limit.retry_after)

        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        content_encoding = request.META.get('HTTP_CONTENT_ENCODING', '')

        if content_encoding == 'gzip':
            data = decompress_gzip(data)
        elif content_encoding == 'deflate':
            data = decompress_deflate(data)
        elif not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData as e:
            raise APIError(u'Invalid data: %s (%s)' % (six.text_type(e), type(e)))

        # mutates data
        manager = EventManager(data)
        data = manager.normalize()

        # insert IP address if not available
        if auth.is_public:
            ensure_has_ip(data, request.META['REMOTE_ADDR'])

        event_id = data['event_id']

        # We filter data immediately before it ever gets into the queue
        inst = SensitiveDataFilter()
        inst.apply(data)

        # mutates data (strips a lot of context if not queued)
        insert_data_to_database(data)

        logger.debug('New event from project %s/%s (id=%s)', project.team.slug, project.slug, event_id)

        return event_id

def _decode_event(data, content_encoding):
    if isinstance(data, six.binary_type):
        if content_encoding == 'gzip':
            data = decompress_gzip(data)
        elif content_encoding == 'deflate':
            data = decompress_deflate(data)
        elif data[0] != b'{':
            data = decode_and_decompress_data(data)
        else:
            data = decode_data(data)
    if isinstance(data, six.text_type):
        data = safely_load_json_string(data)

    return CanonicalKeyDict(data)

    def process(self, request, project, auth, data, **kwargs):
        event_received.send_robust(ip=request.META['REMOTE_ADDR'], sender=type(self))

        rate_limits = [safe_execute(app.quotas.is_rate_limited, project=project)]
        for plugin in plugins.all():
            rate_limit = safe_execute(plugin.is_rate_limited, project=project)
            # We must handle the case of plugins not returning new RateLimit objects
            if isinstance(rate_limit, bool):
                rate_limit = RateLimit(is_limited=rate_limit, retry_after=None)
            rate_limits.append(rate_limit)

        if any(limit.is_limited for limit in rate_limits):
            raise APIRateLimited(max(limit.retry_after for limit in rate_limits))

        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        content_encoding = request.META.get('HTTP_CONTENT_ENCODING', '')

        if content_encoding == 'gzip':
            data = decompress_gzip(data)
        elif content_encoding == 'deflate':
            data = decompress_deflate(data)
        elif not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData as e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

        # mutates data
        Group.objects.normalize_event_data(data)

        # insert IP address if not available
        if auth.is_public:
            ensure_has_ip(data, request.META['REMOTE_ADDR'])

        event_id = data['event_id']

        # mutates data (strips a lot of context if not queued)
        insert_data_to_database(data)

        logger.debug('New event from project %s/%s (id=%s)', project.team.slug, project.slug, event_id)

        return event_id

    def process(self, request, project, auth, data, **kwargs):
        event_received.send(ip=request.META["REMOTE_ADDR"], sender=type(self))

        is_rate_limited = safe_execute(app.quotas.is_rate_limited, project=project)
        for plugin in plugins.all():
            if safe_execute(plugin.is_rate_limited, project=project):
                is_rate_limited = True

        if is_rate_limited:
            raise APIRateLimited

        result = plugins.first("has_perm", request.user, "create_event", project)
        if result is False:
            raise APIForbidden("Creation of this event was blocked")

        content_encoding = request.META.get("HTTP_CONTENT_ENCODING", "")

        if content_encoding == "gzip":
            data = decompress_gzip(data)
        elif content_encoding == "deflate":
            data = decompress_deflate(data)
        elif not data.startswith("{"):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData as e:
            raise APIError(u"Invalid data: %s (%s)" % (unicode(e), type(e)))

        # mutates data
        Group.objects.normalize_event_data(data)

        # insert IP address if not available
        if auth.is_public:
            ensure_has_ip(data, request.META["REMOTE_ADDR"])

        event_id = data["event_id"]

        # mutates data (strips a lot of context if not queued)
        insert_data_to_database(data)

        logger.debug("New event from project %s/%s (id=%s)", project.team.slug, project.slug, event_id)

        return event_id

def handle_sentry(data, address):
    from sentry.coreapi import (
        project_from_auth_vars,
        decode_and_decompress_data,
        safely_load_json_string,
        validate_data,
        insert_data_to_database,
        APIError,
        APIForbidden,
    )
    from sentry.models import Group
    from sentry.exceptions import InvalidData
    from sentry.plugins import plugins
    from sentry.utils.auth import parse_auth_header

    try:
        try:
            auth_header, data = data.split("\n\n", 1)
        except ValueError:
            raise APIError("missing auth header")

        try:
            auth_vars = parse_auth_header(auth_header)
        except (ValueError, IndexError):
            raise APIError("invalid auth header")

        project, user = project_from_auth_vars(auth_vars)

        result = plugins.first("has_perm", user, "create_event", project)
        if result is False:
            raise APIForbidden("Creation of this event was blocked")

        client = auth_vars.get("sentry_client")

        if not data.startswith("{"):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            validate_data(project, data, client)
        except InvalidData, e:
            raise APIError(u"Invalid data: %s (%s)" % (unicode(e), type(e)))

        Group.objects.normalize_event_data(data)

        return insert_data_to_database(data)

    def post(self, request, project, helper, key, **kwargs):
        json_body = safely_load_json_string(request.body)
        report_type = self.security_report_type(json_body)
        if report_type is None:
            track_outcome(
                project.organization_id,
                project.id,
                key.id,
                Outcome.INVALID,
                "security_report_type")
            raise APIError('Unrecognized security report type')
        interface = get_interface(report_type)

        try:
            instance = interface.from_raw(json_body)
        except jsonschema.ValidationError as e:
            track_outcome(
                project.organization_id,
                project.id,
                key.id,
                Outcome.INVALID,
                "security_report")
            raise APIError('Invalid security report: %s' % str(e).splitlines()[0])

        # Do origin check based on the `document-uri` key as explained in `_dispatch`.
        origin = instance.get_origin()
        if not is_valid_origin(origin, project):
            if project:
                track_outcome(
                    project.organization_id,
                    project.id,
                    key.id,
                    Outcome.INVALID,
                    FilterStatKeys.CORS)
            raise APIForbidden('Invalid origin')

        data = {
            'interface': interface.path,
            'report': instance,
            'release': request.GET.get('sentry_release'),
            'environment': request.GET.get('sentry_environment'),
        }

        self.process(request, project=project, helper=helper, data=data, key=key, **kwargs)
        return HttpResponse(content_type='application/javascript', status=201)

    def process(self, request, project, auth, data, **kwargs):
        for plugin in plugins.all():
            if safe_execute(plugin.is_rate_limited, project=project):
                return HttpResponse('Creation of this event was denied due to rate limiting.', content_type='text/plain', status=405)

        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData, e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

    def process(self, request, project, auth, data, **kwargs):
        if safe_execute(app.quotas.is_rate_limited, project=project):
            raise APIRateLimited
        for plugin in plugins.all():
            if safe_execute(plugin.is_rate_limited, project=project):
                raise APIRateLimited

        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData, e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

    def handle(self, data, address):
        from sentry.utils.auth import parse_auth_header
        from sentry.coreapi import (project_from_auth_vars, decode_and_decompress_data, safely_load_json_string,
                                    ensure_valid_project_id, insert_data_to_database, APIError)
        try:
            try:
                auth_header, data = data.split("\n\n", 1)
            except ValueError:
                raise APIError("missing auth header")
            project = project_from_auth_vars(parse_auth_header(auth_header), data)

            if not data.startswith('{'):
                data = decode_and_decompress_data(data)
            data = safely_load_json_string(data)

            ensure_valid_project_id(project, data)

            return insert_data_to_database(data)
        except APIError, error:
            logger.error('bad message from %s: %s' % (address, error.msg))
            return error

    def process(self, request, project, auth, data, **kwargs):
        event_received.send(ip=request.META['REMOTE_ADDR'], sender=type(self))

        is_rate_limited = safe_execute(app.quotas.is_rate_limited, project=project)
        for plugin in plugins.all():
            if safe_execute(plugin.is_rate_limited, project=project):
                is_rate_limited = True

        if is_rate_limited:
                raise APIRateLimited

        result = plugins.first('has_perm', request.user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            # mutates data
            validate_data(project, data, auth.client)
        except InvalidData as e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

        # mutates data
        Group.objects.normalize_event_data(data)

        # insert IP address if not available
        if auth.is_public:
            ensure_has_ip(data, request.META['REMOTE_ADDR'])

        event_id = data['event_id']

        # mutates data (strips a lot of context if not queued)
        insert_data_to_database(data)

        logger.debug('New event from project %s/%s (id=%s)', project.team.slug, project.slug, event_id)

        return event_id

def handle_sentry(data, address):
    from sentry.coreapi import project_from_auth_vars, decode_and_decompress_data, \
        safely_load_json_string, validate_data, insert_data_to_database, APIError, \
        APIForbidden
    from sentry.exceptions import InvalidData
    from sentry.plugins import plugins
    from sentry.utils.auth import parse_auth_header

    try:
        try:
            auth_header, data = data.split('\n\n', 1)
        except ValueError:
            raise APIError('missing auth header')

        try:
            auth_vars = parse_auth_header(auth_header)
        except (ValueError, IndexError):
            raise APIError('invalid auth header')

        project, user = project_from_auth_vars(auth_vars)

        result = plugins.first('has_perm', user, 'create_event', project)
        if result is False:
            raise APIForbidden('Creation of this event was blocked')

        client = auth_vars.get('sentry_client')

        if not data.startswith('{'):
            data = decode_and_decompress_data(data)
        data = safely_load_json_string(data)

        try:
            validate_data(project, data, client)
        except InvalidData, e:
            raise APIError(u'Invalid data: %s (%s)' % (unicode(e), type(e)))

        return insert_data_to_database(data)

def store(request):
    """
    The primary endpoint for storing new events.

    This will validate the client's authentication and data, and if
    successfull pass on the payload to the internal database handler.

    Authentication works in three flavors:

    1. Explicit signed requests

       These are implemented using the documented signed request protocol, and
       require an authentication header which is signed using with the project
       member's secret key.

    2. Explicit trusted requests

       Generally used for communications with client-side platforms (such as
       JavaScript in the browser), they require the GET variables public_key
       and project_id, as well as an HTTP_REFERER to be set from a trusted
       domain.

    3. Implicit trusted requests

       Used by the Sentry core, they are only available from same-domain requests
       and do not require any authentication information. They only require that
       the user be authenticated, and a project_id be sent in the GET variables.

    """
    logger.debug('Inbound %r request from %r', request.method, request.META['REMOTE_ADDR'])
    client = '<unknown client>'
    try:
        if request.method == 'POST':
            auth_vars = extract_auth_vars(request)
            data = request.raw_post_data

            if auth_vars:
                server_version = auth_vars.get('sentry_version', '1.0')
                client = auth_vars.get('sentry_client')
            else:
                server_version = request.GET.get('version', '1.0')
                client = request.META.get('HTTP_USER_AGENT', request.GET.get('client'))

            if server_version not in ('1.0', '2.0'):
                raise APIError('Client/server version mismatch: Unsupported version: %r' % server_version)

            if server_version != '1.0' and not client:
                raise APIError('Client request error: Missing client version identifier.')

            referrer = request.META.get('HTTP_REFERER')

            if auth_vars:
                project = project_from_auth_vars(auth_vars, data)
            elif request.GET.get('api_key') and request.GET.get('project_id'):
                # public requests only need referrer validation for CSRF
                project = project_from_api_key_and_id(request.GET['api_key'], request.GET['project_id'])
                if not ProjectDomain.test(project, referrer):
                    raise APIUnauthorized()
            elif request.GET.get('project_id') and request.user.is_authenticated() and \
                 is_same_domain(request.build_absolute_uri(), referrer):
                # authenticated users are simply trusted to provide the right id
                project = project_from_id(request)
            else:
                raise APIUnauthorized()

            if not data.startswith('{'):
                data = decode_and_decompress_data(data)
            data = safely_load_json_string(data)

            try:
                validate_data(project, data)
            except InvalidTimestamp:
                # Log the error, remove the timestamp, and revalidate
                error_logger.error('Client %r passed an invalid value for timestamp %r' % (
                    data['timestamp'],
                    client or '<unknown client>',
                ))
                del data['timestamp']
                validate_data(project, data)

            insert_data_to_database(data)
    except APIError, error:
        logging.error('Client %r raised API error: %s' % (client, error), exc_info=True)
        response = HttpResponse(unicode(error.msg), status=error.http_status)

def test_safely_load_json_string_valid_payload():
    data = safely_load_json_string('{"foo": "bar"}')
    assert data == {'foo': 'bar'}

def test_safely_load_json_string_invalid_json():
    with pytest.raises(APIError):
        safely_load_json_string('{')