def record_add(self):
        zonename = self.request.matchdict['zonename']
        zonefile = settings.zones[zonename]
        zone = Zone(zonename, zonefile)

        schema = Record(validator=record_validator)
        form = deform.Form(schema, buttons=('submit',))

        response = {"zonename": zonename,
                    "recordname": "new"}
        response["form"] = form.render()

        if 'submit' in self.request.POST:
            controls = self.request.POST.items()
            try:
                data = form.validate(controls)
            except deform.ValidationFailure, e:
                response['form'] = e.render()
                return response
            if not name_is_protected(zonename, data['name']):
                zone.add_record(**data)
                response = HTTPFound()
                response.location = self.request.route_url('record',
                                                            zonename=zonename,
                                                            recordname=data['name'])
                return response
            else:
                return HTTPForbidden()

 def skip_persona_selection(self):
     # set cookie and redirect
     response = HTTPFound(location=get_redirect_url(self.request))
     response.set_cookie(
         PERSONA_COOKIE_NAME, value=PERSONA_SKIP_COOKIE_VALUE,
         max_age=ONE_YEAR)
     return response

def account_verify_email(request):
    login_store = request.find_service(name="redis_login")

    try:
        user_id = int(request.GET["user_id"].strip())
        email_address = request.GET["email_address"].strip()
        token = request.GET["token"].strip()
    except (KeyError, ValueError):
        raise HTTPNotFound
    stored_token = login_store.get("verify_email:%s:%s" % (user_id, email_address))
    if not user_id or not email_address or not token or not stored_token:
        raise HTTPNotFound

    stored_token = stored_token.decode("utf-8")

    if not stored_token == token:
        raise HTTPNotFound

    try:
        db = request.find_service(name="db")
        user = db.query(User).filter(User.id == user_id).one()
    except NoResultFound:
        raise HTTPNotFound

    user.email = email_address

    response = HTTPFound(request.route_path("account", _query={"saved": "email_address"}))

    if not request.user or request.user.id != user.id:
        new_session_id = str(uuid4())
        login_store.set("session:" + new_session_id, user.id)
        response.set_cookie("cherubplay", new_session_id, 31536000)

    return response

    def record_edit(self):
        zonename = self.request.matchdict['zonename']
        recordname = self.request.matchdict['recordname']
        zonefile = settings.zones[zonename]
        zone = Zone(zonename, zonefile)
        protected = name_is_protected(zonename, recordname)
        response = {"zonename": zonename,
                    "recordname": recordname}

        if self.request.POST and protected:
            return HTTPForbidden("You can not modify this domain name")

        elif protected:
            response['protected'] = protected
            response['record'] = zone.get_record(recordname)
            return response

        schema = Record(validator=record_validator)
        form = deform.Form(schema, buttons=('submit',))

        if self.request.POST:
            controls = self.request.POST.items()
            try:
                data = form.validate(controls)
            except deform.ValidationFailure, e:
                response['form'] = e.render()
                return response
            else:
                zone.add_record(**data)
                response = HTTPFound()
                response.location = self.request.route_url('record',
                                                            zonename=zonename,
                                                            recordname=data['name'])
                return response

    def login(self):
        hubclient = self.request.registry.hubclient
        response = HTTPFound()

        # redeem ticket to get user data
        ticket = self.request.GET.get('ticket', None)
        if ticket and hubclient:
            try:
                user = hubclient.get_user(
                    ticket, self.request.route_url('redirect_to_login'))
                self.request.session[USER_DATA_SESSION_KEY] = user.data
                user_id = user.get('uuid')
                headers = remember(self.request, user_id)
                response.headerlist.extend(headers)

            except HubClientException:
                # TODO: what to do when ticket is invalid?
                pass

        redirect_url = self.request.GET.get('url', None)
        if not (redirect_url and same_origin(
                redirect_url, self.request.current_route_url())):
            redirect_url = self.request.route_url(route_name='home')
        response.location = redirect_url

        return response

    def __call__(self):
        """Log the user out by deleting cookies and redirecting to CAS logout.
        """
        if security.authenticated_userid(self.request):
            # Return to this view once we've logged out.
            here = self.request.route_url(self.request.matched_route.name)
            here += '?return=' + self.request.referrer
            response = HTTPFound(location=here)

            # Drop the current session for the user. Copy the session to the
            # new response so the cookies get cleared.
            response.session = self.request.session
            response.session.invalidate()

            # Forget the user's login cookie
            forget_headers = security.forget(self.request)
            response.headerlist.extend(forget_headers)
            return response
        else:
            # Once cookies are gone, sign out. Either SSO or redirection.
            route = self.request.registry.settings[RETURN_ROUTE]
            # Go back to the original page, or the default
            return_url = self.request.params.get('return',
                                                 self.request.route_url(route))

            sso_url = self.request.registry.settings[SSO_URL]
            logout_url = (sso_url + '?url=' + return_url) if \
                self.request.registry.settings[ENABLE_SLO] else return_url

            return HTTPFound(location=logout_url)

 def handle_get(self):
     request = self.request
     view = request.view_name
     subpath = request.subpath
     if not view:
         route = self.request.matched_route.name
         if route == 'home':
             self.response = HTTPFound('/frontdoor')
             return
         raise HTTPNotFound()
     elif view in ['login', 'logout']:
         # This breaks GET has no side effects
         if view == 'logout':
             return self.handle_logout({})
         self.response = HTTPFound('/frontdoor')
         return
     elif view == 'frontdoor':
         if not len(subpath):
             template = 'trumpet:templates/webview-app.mako'
             settings = self.get_app_settings()
             basecolor = settings['default.css.basecolor']
             env = dict(appname='frontdoor', basecolor=basecolor)
             content = render(template, env)
             self.response = Response(body=content)
             self.response.encode_content()
         else:
             assetpath = 'trumpet:static/apps/frontdoor'
             asset = os.path.join(assetpath, *subpath)
             self.response = static_asset_response(request, asset)
     else:
         self.response = HTTPNotFound()

    def item_add(self):
        groupname = self.request.matchdict['groupname']
        groupfile = self.files[groupname]
        group = self.backend(groupname, groupfile)

        schema = group.get_add_schema()
        form = deform.Form(schema, buttons=('submit',))

        response = {"groupname": groupname,
                    "itemname": "new"}
        response["form"] = form.render()

        if 'submit' in self.request.POST and self.request.POST['submit'] == 'submit':
            controls = self.request.POST.items()
            try:
                data = form.validate(controls)
            except deform.ValidationFailure, e:
                response['form'] = e.render()
                return response

            if data['name'] not in self.protected_names[groupname]:
                group.add_item(data)
                response = HTTPFound()
                response.location = self.request.route_url('item',
                                                            groupname=groupname,
                                                            itemname=data['name'])
                return response
            else:
                return HTTPForbidden()

def lang(request):
    # Set language
    code = request.matchdict['code']
    # TODO redirect where we came_from
    response = HTTPFound(location='/')
    response.set_cookie('lang', value=code, max_age=31536000) # max_age = year
    return response

def fbauth(request):
    code = request.params['code']
    fb_user = User.fb_user(code)
    user_id = str(fb_user.id)
    response = HTTPFound(location="/")
    response.set_cookie('user_id', value=user_id, max_age=31536000)
    return response

def logout(request):
    next = request.params.get('next') or request.route_url('index')
    if not authenticated_userid(request):
        return HTTPFound(location=request.route_url('login'))
    headers = forget(request)
    response = HTTPFound(location=next, headers=headers)
    response.set_cookie('csrf_token', value=None)
    return response

def logout_view(request):
    """
        The logout view
    """
    loc = request.route_url('index')
    headers = forget(request)
    response = HTTPFound(location=loc, headers=headers)
    response.delete_cookie("remember_me")
    return response

    def logout(self):
        response = HTTPFound(headers=forget(self.request))

        if self.request.referrer and same_origin(
                self.request.referrer, self.request.current_route_url()):
            response.location = self.request.referrer
        else:
            response.location = self.request.route_url(route_name='home')

        return response

def login(request):
    username = request.params.get('username', None)
    password = request.params.get('password', None)
    session = DBSession()
    user = session.query(User).filter(User.username==username).first()
    if user is not None and user.password == password:
        response = HTTPFound('/')
        # totally insecure, TODO in workshop: use auth token or something
        response.set_cookie('user_id', str(user.id), max_age=timedelta(30))
        return response
    return {'username': username}

    def do_logout(self, request, location):
        """ do the logout """
        # convenient method to set Cache-Control and Expires headers
        request.response.cache_expires = 0

        headers = forget(request)
        response = HTTPFound(location=location, headers=headers)
        response.delete_cookie('cis_account', path="/")
        response.cache_control = 'no-cache'

        request.session.pop_flash('token')
        return response

    def auth(self):
        self.twitter = Twython(APP_KEY, APP_SECRET)
        auth = self.twitter.get_authentication_tokens(callback_url=CALLBACK_URL)
        OAUTH_TOKEN = auth['oauth_token']
        OAUTH_TOKEN_SECRET = auth['oauth_token_secret']
        auth_url = auth['auth_url']

        # set cookies and redirect
        response = HTTPFound(location=auth_url)
        response.set_cookie('oauth_token', OAUTH_TOKEN, max_age=86400)
        response.set_cookie('oauth_token_secret', OAUTH_TOKEN_SECRET, max_age=86400)
        return response

def change_profile(request, profile):
    """
    Sets a cookie for the given profile and deletes any location set in the
    cookies.
    Returns a response which directs to the map view.
    """
    response = HTTPFound(location=request.route_url('map_view'))
    response.set_cookie('_PROFILE_', profile, timedelta(days=90))

    if '_LOCATION_' in request.cookies:
        response.delete_cookie('_LOCATION_')

    return response

 def logout(self, request):
     request_cookie = request.cookies.get('signed')
     if not request_cookie:
         return {}
     cookie = signed_deserialize(request_cookie, SECRET)
     cookie_csrf = cookie.get('csrf')
     if request.method == 'POST':
         csrf = request.POST.get('csrf')
         if csrf == cookie_csrf:
             response = HTTPFound(request.route_url('admin.index'))
             response.delete_cookie('signed')
             return response
     return dict(csrf=cookie_csrf)

    def item_delete(self):
        groupname = self.request.matchdict['groupname']
        itemname = self.request.matchdict['itemname']
        groupfile = self.files[groupname]
        group = self.backend(groupname, groupfile)
        if itemname in self.protected_names[groupname]:
            raise HTTPForbidden("You can not modify this domain name")

        group.del_item(itemname)
        response = HTTPFound()
        response.location = self.request.route_url('groupview',
                                                    groupname=groupname)
        return response

    def record_delete(self):
        zonename = self.request.matchdict['zonename']
        recordname = self.request.matchdict['recordname']
        zonefile = settings.zones[zonename]
        zone = Zone(zonename, zonefile)
        if name_is_protected(zonename, recordname):
            raise HTTPForbidden("You can not modify this domain name")

        zone.del_record(recordname)
        response = HTTPFound()
        response.location = self.request.route_url('zoneview',
                                                    zonename=zonename)
        return response