def evolve(root):
    former_id = None # Create lazily, in case we don't need it

    profiles = find_profiles(root)
    search = ICatalogSearch(root)
    catalog = find_catalog(root)
    creators = catalog['creator']._fwd_index.keys()
    modifiers = catalog['modified_by']._fwd_index.keys()
    userids = set(creators) | set(modifiers)
    for userid in userids:
        if userid not in profiles:
            if former_id is None:
                former_id = make_unique_name(profiles, 'formeruser')

                print "Creating profile for former user content:", former_id
                former_profile = create_content(
                    IProfile, firstname='Former', lastname='User'
                )
                profiles[former_id] = former_profile

            count, docids, resolver = search(creator=userid)
            for docid in docids:
                doc = resolver(docid)
                print "Updating 'creator' for", resource_path(doc)
                doc.creator = former_id


            count, docids, resolver = search(modified_by=userid)
            for docid in docids:
                doc = resolver(docid)
                print "Updating 'modified_by' for", resource_path(doc)
                doc.modified_by = former_id

def mothball_community(community):
    catalog = find_catalog(community)
    tags = find_tags(community)
    def get_docid(doc):
        return catalog.document_map.docid_for_address(resource_path(doc))

    # Unindex all documents, remove top level tools
    # Make copy of items so we're not mutating a BTree while traversing it
    for name, tool in list(community.items()):
        if name == 'members':
            # We probably want to hang on to historical membership data
            continue
        for doc in postorder(tool):  # includes tool in traversal
            log.info("Removing %s", resource_path(doc))
            docid = get_docid(doc)
            tags.delete(docid)
            catalog.unindex_doc(docid)
        del community[name]

    log.info("Removing tags")
    docid = get_docid(community)
    tags.delete(docid)
    catalog.unindex_doc(docid)

    community.description = 'This community has been archived.'
    community.text = render('templates/archived_community_text.pt', {
        'settings': get_current_registry().settings})
    community.archive_status = 'archived'
    community.default_tool = None
    log.info("Finished removing content: %s", resource_path(community))

def evolve(root):
    former_id = 'formeruser'

    profiles = find_profiles(root)
    search = ICatalogSearch(root)
    catalog = find_catalog(root)
    creators = catalog['creator']._fwd_index.keys()
    modifiers = catalog['modified_by']._fwd_index.keys()
    userids = set(creators) | set(modifiers)
    for userid in userids:
        if userid not in profiles:
            if former_id not in profiles:
                workflow = get_workflow(IProfile, 'security')
                former_id = make_unique_name(profiles, 'formeruser')

                print "Creating profile for former user content:", former_id
                former_profile = create_content(
                    IProfile, firstname='Former', lastname='User'
                )
                profiles[former_id] = former_profile
                workflow.initialize(former_profile)
                workflow.transition_to_state(former_profile, None, 'inactive')

            count, docids, resolver = search(creator=userid)
            for docid in docids:
                doc = resolver(docid)
                print "Updating 'creator' for", resource_path(doc)
                doc.creator = former_id


            count, docids, resolver = search(modified_by=userid)
            for docid in docids:
                doc = resolver(docid)
                print "Updating 'modified_by' for", resource_path(doc)
                doc.modified_by = former_id

    def test_create(self, context, registry, log):
        from pyramid.traversal import resource_path
        self._tempfd, filename = mkstemp()
        with open(filename, 'w') as f:
            f.write(json.dumps([
                {'name': 'Alice', 'email': '[email protected]',
                 'initial-password': 'weakpassword1', 'roles': ['contributor'],
                 'groups': ['gods']},
                {'name': 'Bob', 'email': '[email protected]',
                 'initial-password': 'weakpassword2', 'roles': [], 'groups': ['moderators-xyz']}
            ]))
        locator = self._get_user_locator(context, registry)

        moderators_xyz_group = testing.DummyResource(roles=['moderator'], name='moderators-xyz')
        context['principals']['groups']['moderators-xyz'] = moderators_xyz_group
        self.call_fut(context, registry, filename)

        god_group = context['principals']['groups']['gods']
        alice = locator.get_user_by_login('Alice')
        assert alice.active
        alice = locator.get_user_by_login('Alice')
        alice_user_id = resource_path(alice)
        default_group = context['principals']['groups']['authenticated']
        groups = locator.get_groups(alice_user_id)
        assert groups == [default_group, god_group]
        bob = locator.get_user_by_login('Bob')
        bob_user_id = resource_path(bob)
        bob.group_ids = ['/principals/groups/authenticated', '/principals/groups/moderators-xyz']

def evolve(context):
    """
    Upgrades required for new Image Drawer functionality.
    """
    # Add IImage marker to instances of ICommunityFile which are images.
    catalog = find_catalog(context)
    search = ICatalogSearch(context)
    cnt, docids, resolver = search(interfaces=[ICommunityFile])
    for docid in docids:
        obj = resolver(docid)
        if obj is None:
            continue  # Work around catalog bug
        obj._init_image()
        if obj.is_image:
            print "Image: %s" % resource_path(obj)
            catalog.reindex_doc(obj.docid, obj)

    # Convert WikiPages to Folders so they can contain attachments
    cnt, docids, resolver = search(interfaces=[IWikiPage])
    for docid in docids:
        obj = resolver(docid)
        if obj is None:
            continue # Work around catalog bug
        print "Convert wiki page to folder: %s" % resource_path(obj)
        Folder.__init__(obj)
        catalog.reindex_doc(obj.docid, obj)

    def test_create(self, context, registry, log):
        from adhocracy_core.interfaces import DEFAULT_USER_GROUP_NAME
        from pyramid.traversal import resource_path
        from adhocracy_core.interfaces import DEFAULT_USER_GROUP_NAME
        self._tempfd, filename = mkstemp()
        with open(filename, 'w') as f:
            f.write(json.dumps([
                {'name': 'Alice', 'email': '[email protected]',
                 'initial-password': 'weakpassword1', 'roles': ['contributor'],
                 'groups': ['gods']},
                {'name': 'Bob', 'email': '[email protected]',
                 'initial-password': 'weakpassword2', 'roles': [], 'groups': []}
            ]))
        locator = self._get_user_locator(context, registry)

        self.call_fut(context, registry, filename)

        god_group = context['principals']['groups']['gods']
        alice = locator.get_user_by_login('Alice')
        assert alice.active
        alice = locator.get_user_by_login('Alice')
        alice_user_id = resource_path(alice)
        groups = locator.get_groups(alice_user_id)
        assert groups == [god_group]
        bob = locator.get_user_by_login('Bob')
        default_group = context['principals']['groups'][DEFAULT_USER_GROUP_NAME]
        bob_user_id = resource_path(bob)
        groups = locator.get_groups(bob_user_id)
        assert groups == [default_group]

def item_index_data(context, request):
    uuid = str(context.uuid)
    properties = context.upgrade_properties()
    links = context.links(properties)
    unique_keys = context.unique_keys(properties)

    principals_allowed = {}
    for permission in ('view', 'edit', 'audit'):
        p = principals_allowed_by_permission(context, permission)
        if p is Everyone:
            p = [Everyone]
        principals_allowed[permission] = sorted(p)

    path = resource_path(context)
    paths = {path}
    collection = context.collection

    if collection.unique_key in unique_keys:
        paths.update(
            resource_path(collection, key)
            for key in unique_keys[collection.unique_key])

    for base in (collection, request.root):
        for key_name in ('accession', 'alias'):
            if key_name not in unique_keys:
                continue
            paths.add(resource_path(base, uuid))
            paths.update(
                resource_path(base, key)
                for key in unique_keys[key_name])

    path = path + '/'
    embedded = request.embed(path, '@@embedded')
    object = request.embed(path, '@@object')
    audit = request.embed(path, '@@audit')['audit']

    document = {
        'audit': audit,
        'embedded': embedded,
        'embedded_uuids': sorted(request._embedded_uuids),
        'item_type': context.item_type,
        'linked_uuids': sorted(request._linked_uuids),
        'links': links,
        'object': object,
        'paths': sorted(paths),
        'principals_allowed': principals_allowed,
        'properties': properties,
        'propsheets': {
            name: context.propsheets[name]
            for name in context.propsheets.keys() if name != ''
        },
        'tid': context.tid,
        'unique_keys': unique_keys,
        'uuid': uuid,
    }

    return document

def objectReplaced(event):
    """Tell the redirection storage that an object replaced
    """
    old_object = event.old_object
    new_object = event.new_object
    if old_object is not None and new_object is not None:
        storage = get_storage(new_object)
        if storage is not None:
            old_path = resource_path(old_object)
            new_path = resource_path(new_object)
            storage.add(old_path, new_path)

 def _set_local_role_creator(self,
                             resource: IResource,
                             creator: IResource,
                             anonymized_creator: IResource,
                             registry: Registry
                             ):
     if creator and not anonymized_creator:
         userid = resource_path(creator)
         add_local_roles(resource, {userid: {'role:creator'}}, registry)
     elif creator and anonymized_creator:
         userid = resource_path(anonymized_creator)
         set_anonymized_creator(resource, userid)

def delete_user(request):
    schema = formutils.CSRFSchema().bind(request=request)

    is_self = request.context == request.user

    form = deform.Form(
            schema,
            buttons=[
                deform.Button(
                    name='yes',
                    css_class='btn-danger',
                    ),
                deform.Button(
                    name='no',
                    )],
            formid='deleteuser',
            )

    try:
        if 'no' in request.POST:
            return HTTPFound(location = resource_path(request.context))
        elif 'yes' in request.POST:
            controls = request.POST.items()
            form.validate(controls)

            db.delete(request.context)
            db.commit()

            request.session.flash('User deleted successfully!', queue='success')

            if is_self:
                return HTTPFound(location = resource_path(userregister))
            else:
                return HTTPFound(location = resource_path(userlist))

    except ValueError as e:
        if e.message == "Bad CSRF token":
            request.session.flash('Warning: Bad CSRF token, another site may be trying to control your session!', queue='error')
            formutils.error(form)
        else:
            raise e

    except deform.ValidationFailure:
        if form['csrf'].error is not None:
            request.session.flash('Warning: Bad CSRF token, another site may be trying to control your session!', queue='error')

    css_resources, js_resources = formutils.resources(form)

    return {'form': form,
            'css_resources': css_resources,
            'js_resources': js_resources,
            }

def objectMoved(event):
    """Tell the redirection storage that an object moved
    """
    moved_object = event.obj

    if event.old_parent is not None and \
       event.new_parent is not None and event.old_name is not None:
        storage = get_storage(moved_object)
        if storage is not None:
            old_path = "%s/%s" % (resource_path(event.old_parent),
                                  event.old_name)
            new_path = resource_path(moved_object)
            storage.add(old_path, new_path)

def index_object(catalog, obj):
    """ Index an object and add metadata. """
    #Check if object already exists
    if catalog.document_map.docid_for_address(resource_path(obj)) is not None:
        reindex_object(catalog, obj)
        return
    obj_id = catalog.document_map.add(resource_path(obj))
    catalog.index_doc(obj_id, obj)
    #Add metadata
    if ICatalogMetadataEnabled.providedBy(obj):
        metadata = getAdapter(obj, ICatalogMetadata)()
        metadata['docid'] = obj_id
        catalog.document_map.add_metadata(obj_id, metadata)

 def add(self, activity: Activity) -> None:
     """Serialize `activity` and store in audit log."""
     kwargs = {'object_path': resource_path(activity.object),
               'type': activity.type,
               }
     if activity.subject:
         kwargs['subject_path'] = resource_path(activity.subject)
     if activity.target:
         kwargs['target_path'] = resource_path(activity.target)
     if activity.sheet_data:
         kwargs['sheet_data'] = activity.sheet_data
     entry = SerializedActivity()._replace(**kwargs)
     self[activity.published] = entry

def item_index_data(context, request):
    uuid = str(context.uuid)
    properties = context.upgrade_properties()
    links = context.links(properties)
    unique_keys = context.unique_keys(properties)

    principals_allowed = {}
    for permission in ("view", "edit", "audit"):
        p = principals_allowed_by_permission(context, permission)
        if p is Everyone:
            p = [Everyone]
        principals_allowed[permission] = sorted(p)

    path = resource_path(context)
    paths = {path}
    collection = context.collection

    if collection.unique_key in unique_keys:
        paths.update(resource_path(collection, key) for key in unique_keys[collection.unique_key])

    for base in (collection, request.root):
        for key_name in ("accession", "alias"):
            if key_name not in unique_keys:
                continue
            paths.add(resource_path(base, uuid))
            paths.update(resource_path(base, key) for key in unique_keys[key_name])

    path = path + "/"
    embedded = request.embed(path, "@@embedded")
    object = request.embed(path, "@@object")
    audit = request.embed(path, "@@audit")["audit"]

    document = {
        "audit": audit,
        "embedded": embedded,
        "embedded_uuids": sorted(request._embedded_uuids),
        "item_type": context.type_info.item_type,
        "linked_uuids": sorted(request._linked_uuids),
        "links": links,
        "object": object,
        "paths": sorted(paths),
        "principals_allowed": principals_allowed,
        "properties": properties,
        "propsheets": {name: context.propsheets[name] for name in context.propsheets.keys() if name != ""},
        "tid": context.tid,
        "unique_keys": unique_keys,
        "uuid": uuid,
    }

    return document

def _reindex_es():
    is_blacklisted = get_is_blacklisted()
    print "Start reindex"
    request = get_current_request()
    es_client = get_client(request)
    for obj in Content.query.all():
        if not is_blacklisted(obj):
            print "OK. Type: %s. Path: %s" % (obj.type_info.name,
                                              resource_path(obj))
            es_client.index_object(obj, immediate=True)
        else:
            print "BLACKLISTED. Type: %s. Path: %s" % (obj.type_info.name,
                                                       resource_path(obj))
    print "End reindex"

 def __repr__(self):
     return "<{0} {1} => {2} at {3}>".format(
         self.__class__.__name__,
         self.principal_name,
         self.group_name,
         resource_path(self.node),
     )

def purge_varnish_after_commit_hook(success: bool, registry: Registry,
                                    request: IRequest):
    """Send PURGE requests for all changed resources to Varnish."""
    varnish_url = registry.settings.get('adhocracy.varnish_url')
    if not (success and varnish_url):
        return
    changelog_metadata = registry.changelog.values()
    errcount = 0
    for meta in changelog_metadata:
        events = extract_events_from_changelog_metadata(meta)
        if events == []:
            continue
        path = resource_path(meta.resource)
        url = varnish_url + request.script_name + path
        for event in events:
            headers = {'X-Purge-Host': request.host}
            headers['X-Purge-Regex'] = '/?\??[^/]*'
            try:
                resp = requests.request('PURGE', url, headers=headers)
                if resp.status_code != 200:
                    logger.warning(
                        'Varnish responded %s to purge request for %s',
                        resp.status_code, path)
            except RequestException as err:
                logger.error(
                    'Couldn\'t send purge request for %s to Varnish: %s',
                    path, exception_to_str(err))
                errcount += 1
                if errcount >= 3:  # pragma: no cover
                    logger.error('Giving up on purge requests')
                    return

 def __init__(self, context, request):
     self.context = context
     self.request = request
     self.username = authenticated_userid(request)
     self.path = resource_path(context)
     self.catalog = find_catalog(context)
     self.tags = find_tags(context)

    def get_columns(self, subobject):
        columns = self.get_default_columns(subobject)
        owner = getattr(subobject, 'owner', None)
        if owner is not None:
            owner = owner.__name__
        resource = getattr(subobject, 'resource', None)
        if resource is not None:
            resource = resource_path(resource)
        expires = getattr(subobject, 'expires', None)
        if expires is not None:
            expires = expires()
        if expires is not None:
            tz = self.request.user.timezone
            expires = expires.replace(tzinfo=None) # in case it's not naive
            expires = tz.localize(expires).strftime('%Y-%m-%d %H:%M:%S %Z')
        
        columns.extend((
            {'name':_('Owner'),
             'value':owner,
             },
            {'name':_('Resource'),
             'value':resource,
             },
            {'name':_('Expires'),
             'value':expires,
             },
            ))

        return columns

def _login_user(request: IRequest) -> dict:
    """Set cookies and return a data for token header authentication."""
    user = request.validated['user']
    userid = resource_path(user)
    headers = remember(request, userid)
    cstruct = _get_api_auth_data(headers, request, user)
    return cstruct