def media_confirm_delete(request, media):

    form = user_forms.ConfirmDeleteForm(request.form)

    if request.method == 'POST' and form.validate():
        if form.confirm.data is True:
            username = media.get_uploader.username
            # Delete MediaEntry and all related files, comments etc.
            media.delete()
            messages.add_message(
                request, messages.SUCCESS, _('You deleted the media.'))

            return redirect(request, "mediagoblin.user_pages.user_home",
                user=username)
        else:
            messages.add_message(
                request, messages.ERROR,
                _("The media was not deleted because you didn't check that you were sure."))
            return redirect_obj(request, media)

    if ((request.user.is_admin and
         request.user.id != media.uploader)):
        messages.add_message(
            request, messages.WARNING,
            _("You are about to delete another user's media. "
              "Proceed with caution."))

    return render_to_response(
        request,
        'mediagoblin/user_pages/media_confirm_delete.html',
        {'media': media,
         'form': form})

def media_post_comment(request, media):
    """
    recieves POST from a MediaEntry() comment form, saves the comment.
    """
    if not request.method == 'POST':
        raise MethodNotAllowed()

    comment = request.db.MediaComment()
    comment.media_entry = media.id
    comment.author = request.user.id
    comment.content = six.text_type(request.form['comment_content'])

    # Show error message if commenting is disabled.
    if not mg_globals.app_config['allow_comments']:
        messages.add_message(
            request,
            messages.ERROR,
            _("Sorry, comments are disabled."))
    elif not comment.content.strip():
        messages.add_message(
            request,
            messages.ERROR,
            _("Oops, your comment was empty."))
    else:
        create_activity("post", comment, comment.author, target=media)
        add_comment_subscription(request.user, media)
        comment.save()

        messages.add_message(
            request, messages.SUCCESS,
            _('Your comment has been posted!'))
        trigger_notification(comment, media, request)

    return redirect_obj(request, media)

def change_pass(request):
    form = auth_forms.ChangePassForm(request.form)
    user = request.user

    if request.method == 'POST' and form.validate():

        if not tools.bcrypt_check_password(
                form.old_password.data, user.pw_hash):
            form.old_password.errors.append(
                _('Wrong password'))

            return render_to_response(
                request,
                'mediagoblin/plugins/recaptcha/change_pass.html',
                {'form': form,
                 'user': user})

        # Password matches
        user.pw_hash = tools.bcrypt_gen_password_hash(
            form.new_password.data)
        user.save()

        messages.add_message(
            request, messages.SUCCESS,
            _('Your password was changed successfully'))

        return redirect(request, 'mediagoblin.edit.account')

    return render_to_response(
        request,
        'mediagoblin/plugins/recaptcha/change_pass.html',
        {'form': form,
         'user': user})

def create_featured_media_textbox():
    """
    This script searches through the database of which media is featured and
    returns a string of each entry in the proper format for use in the
    /mod/feature-media/ page. This string will be used as the default text in
    the textbox on that page.
    """

    primaries = FeaturedMedia.query.order_by(
        FeaturedMedia.order.asc()).filter(
        FeaturedMedia.display_type == u'primary').all()
    secondaries = FeaturedMedia.query.order_by(
        FeaturedMedia.order.asc()).filter(
        FeaturedMedia.display_type == u'secondary').all()
    tertiaries = FeaturedMedia.query.order_by(
        FeaturedMedia.order.asc()).filter(
        FeaturedMedia.display_type == u'tertiary').all()
    output_text = u''
    for display_type, feature_list in [
            (_(u'Primary'),primaries),
            (_(u'Secondary'),secondaries),
            (_(u'Tertiary'),tertiaries)]:
        output_text += _(
            u"""-----------{display_type}-Features---------------------------
""").format(display_type=display_type)
        for feature in feature_list:
            media_entry = feature.media_entry
            output_text += u'/u/{uploader_username}/m/{media_slug}/\n'.format(
                uploader_username = media_entry.get_actor.username,
                media_slug = media_entry.slug)


    return output_text

def deauthorize_applications(request):
    """ Deauthroize OAuth applications """
    if request.method == 'POST' and "application" in request.form:
        token = request.form["application"]
        access_token = AccessToken.query.filter_by(token=token).first()
        if access_token is None:
            messages.add_message(
                request,
                messages.ERROR,
                _("Unknown application, not able to deauthorize")
            )
        else:
            access_token.delete()
            messages.add_message(
                request,
                messages.SUCCESS,
                _("Application has been deauthorized")
            )

    access_tokens = AccessToken.query.filter_by(user=request.user.id)
    applications = [(a.get_requesttoken, a) for a in access_tokens]

    return render_to_response(
        request,
        'mediagoblin/edit/deauthorize_applications.html',
        {'applications': applications}
    )

def add(request):
    if request.method == 'GET':
        return redirect(request, 'mediagoblin.plugins.persona.edit')

    email = _get_response(request)

    if email:
        query = PersonaUserEmails.query.filter_by(
            persona_email=email
        ).first()
    user_exists = query.user if query else None

    if user_exists:
        messages.add_message(
            request,
            messages.WARNING,
            _('Sorry, an account is already registered with that Persona'
              ' email address.'))
        return redirect(request, 'mediagoblin.plugins.persona.edit')

    else:
        # Save the Persona Email to the user
        new_entry = PersonaUserEmails()
        new_entry.persona_email = email
        new_entry.user_id = request.user.id
        new_entry.save()

        messages.add_message(
            request,
            messages.SUCCESS,
            _('Your Persona email address was saved successfully.'))

        return redirect(request, 'mediagoblin.edit.account')

def normalize_user_or_email_field(allow_email=True, allow_user=True):
    """
    Check if we were passed a field that matches a username and/or email
    pattern.

    This is useful for fields that can take either a username or email
    address. Use the parameters if you want to only allow a username for
    instance"""
    message = _(u'Invalid User name or email address.')
    nomail_msg = _(u"This field does not take email addresses.")
    nouser_msg = _(u"This field requires an email address.")

    def _normalize_field(form, field):
        email = u'@' in field.data
        if email:  # normalize email address casing
            if not allow_email:
                raise wtforms.ValidationError(nomail_msg)
            wtforms.validators.Email()(form, field)
            field.data = normalize_email(field.data)
        else:  # lower case user names
            if not allow_user:
                raise wtforms.ValidationError(nouser_msg)
            wtforms.validators.Length(min=3, max=30)(form, field)
            wtforms.validators.Regexp(r'^[-_\w]+$')(form, field)
            field.data = field.data.lower()
        if field.data is None:  # should not happen, but be cautious anyway
            raise wtforms.ValidationError(message)
    return _normalize_field

def edit_account(request):
    user = request.user
    form = forms.EditAccountForm(
        request.form,
        wants_comment_notification=user.wants_comment_notification,
        license_preference=user.license_preference,
    )

    if request.method == "POST":
        form_validated = form.validate()

        if form_validated and form.wants_comment_notification.validate(form):
            user.wants_comment_notification = form.wants_comment_notification.data

        if form_validated and form.new_password.data or form.old_password.data:
            password_matches = auth_lib.bcrypt_check_password(form.old_password.data, user.pw_hash)
            if password_matches:
                # the entire form validates and the password matches
                user.pw_hash = auth_lib.bcrypt_gen_password_hash(form.new_password.data)
            else:
                form.old_password.errors.append(_("Wrong password"))

        if form_validated and form.license_preference.validate(form):
            user.license_preference = form.license_preference.data

        if form_validated and not form.errors:
            user.save()
            messages.add_message(request, messages.SUCCESS, _("Account settings saved"))
            return redirect(request, "mediagoblin.user_pages.user_home", user=user.username)

    return render_to_response(request, "mediagoblin/edit/edit_account.html", {"user": user, "form": form})

def verify_email(request):
    """
    Email verification view

    validates GET parameters against database and unlocks the user account, if
    you are lucky :)
    """
    # If we don't have userid and token parameters, we can't do anything; 404
    if not 'userid' in request.GET or not 'token' in request.GET:
        return render_404(request)

    user = request.db.User.find_one(
        {'_id': ObjectId(unicode(request.GET['userid']))})

    if user and user.verification_key == unicode(request.GET['token']):
        user.status = u'active'
        user.email_verified = True
        user.verification_key = None

        user.save()

        messages.add_message(
            request,
            messages.SUCCESS,
            _("Your email address has been verified. "
              "You may now login, edit your profile, and submit images!"))
    else:
        messages.add_message(
            request,
            messages.ERROR,
            _('The verification key or user id is incorrect'))

    return redirect(
        request, 'mediagoblin.user_pages.user_home',
        user=user.username)

def edit_profile(request, url_user=None):
    # admins may edit any user profile
    if request.user.username != url_user.username:
        if not request.user.is_admin:
            raise Forbidden(_("You can only edit your own profile."))

        # No need to warn again if admin just submitted an edited profile
        if request.method != "POST":
            messages.add_message(
                request, messages.WARNING, _("You are editing a user's profile. Proceed with caution.")
            )

    user = url_user

    form = forms.EditProfileForm(request.form, url=user.url, bio=user.bio)

    if request.method == "POST" and form.validate():
        user.url = unicode(form.url.data)
        user.bio = unicode(form.bio.data)

        user.save()

        messages.add_message(request, messages.SUCCESS, _("Profile changes saved"))
        return redirect(request, "mediagoblin.user_pages.user_home", user=user.username)

    return render_to_response(request, "mediagoblin/edit/edit_profile.html", {"user": user, "form": form})

def verify_email(request):
    """
    Email verification view for changing email address
    """
    # If no token, we can't do anything
    if not "token" in request.GET:
        return render_404(request)

    # Catch error if token is faked or expired
    token = None
    try:
        token = get_timed_signer_url("mail_verification_token").loads(request.GET["token"], max_age=10 * 24 * 3600)
    except BadSignature:
        messages.add_message(request, messages.ERROR, _("The verification key or user id is incorrect."))

        return redirect(request, "index")

    user = User.query.filter_by(id=int(token["user"])).first()

    if user:
        user.email = token["email"]
        user.save()

        messages.add_message(request, messages.SUCCESS, _("Your email address has been verified."))

    else:
        messages.add_message(request, messages.ERROR, _("The verification key or user id is incorrect."))

    return redirect(request, "mediagoblin.user_pages.user_home", user=user.username)

def forgot_password(request):
    """
    Forgot password view

    Sends an email with an url to renew forgotten password.
    Use GET querystring parameter 'username' to pre-populate the input field
    """
    fp_form = auth_forms.ForgotPassForm(request.form,
                                   username=request.args.get('username'))

    if not (request.method == 'POST' and fp_form.validate()):
        # Either GET request, or invalid form submitted. Display the template
        return render_to_response(request,
            'mediagoblin/plugins/recaptcha/forgot_password.html',
            {'fp_form': fp_form})

    # If we are here: method == POST and form is valid. username casing
    # has been sanitized. Store if a user was found by email. We should
    # not reveal if the operation was successful then as we don't want to
    # leak if an email address exists in the system.
    found_by_email = '@' in fp_form.username.data

    if found_by_email:
        user = User.query.filter_by(
            email=fp_form.username.data).first()
        # Don't reveal success in case the lookup happened by email address.
        success_message = _("If that email address (case sensitive!) is "
                            "registered an email has been sent with "
                            "instructions on how to change your password.")

    else:  # found by username
        user = User.query.filter_by(
            username=fp_form.username.data).first()

        if user is None:
            messages.add_message(request,
                                 messages.WARNING,
                                 _("Couldn't find someone with that username."))
            return redirect(request, 'mediagoblin.auth.forgot_password')

        success_message = _("An email has been sent with instructions "
                            "on how to change your password.")

    if user and user.has_privilege(u'active') is False:
        # Don't send reminder because user is inactive or has no verified email
        messages.add_message(request,
            messages.WARNING,
            _("Could not send password recovery email as your username is in"
              "active or your account's email address has not been verified."))

        return redirect(request, 'mediagoblin.user_pages.user_home',
                        user=user.username)

    # SUCCESS. Send reminder and return to login page
    if user:
        email_debug_message(request)
        tools.send_fp_verification_email(user, request)

    messages.add_message(request, messages.INFO, success_message)
    return redirect(request, 'mediagoblin.auth.login')

def resend_activation(request):
    """
    The reactivation view

    Resend the activation email.
    """

    if request.user is None:
        messages.add_message(
            request,
            messages.ERROR,
            _('You must be logged in so we know who to send the email to!'))

        return redirect(request, 'mediagoblin.auth.login')

    if request.user.has_privilege(u'active'):
        messages.add_message(
            request,
            messages.ERROR,
            _("You've already verified your email address!"))

        return redirect(request, "mediagoblin.user_pages.user_home", user=request.user.username)

    email_debug_message(request)
    send_verification_email(request.user, request)

    messages.add_message(
        request,
        messages.INFO,
        _('Resent your verification email.'))
    return redirect(
        request, 'mediagoblin.user_pages.user_home',
        user=request.user.username)

def _finish_verification(request):
    """
    Complete OpenID Verification Process.

    If the verification failed, will return false, otherwise, will return
    the response
    """
    c = consumer.Consumer(request.session, SQLAlchemyOpenIDStore())

    # Check the response from the provider
    response = c.complete(request.args, request.base_url)
    if response.status == consumer.FAILURE:
        messages.add_message(
            request,
            messages.WARNING,
            _('Verification of %s failed: %s' %
                (response.getDisplayIdentifier(), response.message)))

    elif response.status == consumer.SUCCESS:
        # Verification was successfull
        return response

    elif response.status == consumer.CANCEL:
        # Verification canceled
        messages.add_message(
            request,
            messages.WARNING,
            _('Verification cancelled'))

    return False

def media_post_comment(request, media):
    """
    recieves POST from a MediaEntry() comment form, saves the comment.
    """
    assert request.method == 'POST'

    comment = request.db.MediaComment()
    comment.media_entry = media.id
    comment.author = request.user.id
    comment.content = unicode(request.form['comment_content'])

    if not comment.content.strip():
        messages.add_message(
            request,
            messages.ERROR,
            _("Oops, your comment was empty."))
    else:
        comment.save()

        messages.add_message(
            request, messages.SUCCESS,
            _('Your comment has been posted!'))

        media_uploader = media.get_uploader
        #don't send email if you comment on your own post
        if (comment.author != media_uploader and
            media_uploader.wants_comment_notification):
            send_comment_email(media_uploader, comment, media, request)

    return redirect(request, location=media.url_for_self(request.urlgen))

def media_confirm_delete(request, media):

    form = user_forms.ConfirmDeleteForm(request.form)

    if request.method == "POST" and form.validate():
        if form.confirm.data is True:
            username = media.get_uploader.username
            # Delete MediaEntry and all related files, comments etc.
            media.delete()
            messages.add_message(request, messages.SUCCESS, _("You deleted the media."))

            location = media.url_to_next(request.urlgen)
            if not location:
                location = media.url_to_prev(request.urlgen)
            if not location:
                location = request.urlgen("mediagoblin.user_pages.user_home", user=username)
            return redirect(request, location=location)
        else:
            messages.add_message(
                request, messages.ERROR, _("The media was not deleted because you didn't check that you were sure.")
            )
            return redirect_obj(request, media)

    if request.user.is_admin and request.user.id != media.uploader:
        messages.add_message(
            request, messages.WARNING, _("You are about to delete another user's media. " "Proceed with caution.")
        )

    return render_to_response(
        request, "mediagoblin/user_pages/media_confirm_delete.html", {"media": media, "form": form}
    )

def media_confirm_delete(request, media):

    form = user_forms.ConfirmDeleteForm(request.form)

    if request.method == 'POST' and form.validate():
        if form.confirm.data is True:
            username = media.get_uploader.username

            # Delete all the associated comments
            for comment in media.get_comments():
                comment.delete()

            # Delete all files on the public storage
            try:
                delete_media_files(media)
            except OSError, error:
                _log.error('No such files from the user "{1}"'
                           ' to delete: {0}'.format(str(error), username))
                messages.add_message(request, messages.ERROR,
                                     _('Some of the files with this entry seem'
                                       ' to be missing.  Deleting anyway.'))

            media.delete()
            messages.add_message(
                request, messages.SUCCESS, _('You deleted the media.'))

            return redirect(request, "mediagoblin.user_pages.user_home",
                user=username)
        else:
            messages.add_message(
                request, messages.ERROR,
                _("The media was not deleted because you didn't check that you were sure."))
            return redirect(request,
                            location=media.url_for_self(request.urlgen))

def media_post_comment(request, media):
    """
    recieves POST from a MediaEntry() comment form, saves the comment.
    """
    if not request.method == "POST":
        raise MethodNotAllowed()

    comment = request.db.MediaComment()
    comment.media_entry = media.id
    comment.author = request.user.id
    print request.form["comment_content"]
    comment.content = unicode(request.form["comment_content"])

    # Show error message if commenting is disabled.
    if not mg_globals.app_config["allow_comments"]:
        messages.add_message(request, messages.ERROR, _("Sorry, comments are disabled."))
    elif not comment.content.strip():
        messages.add_message(request, messages.ERROR, _("Oops, your comment was empty."))
    else:
        comment.save()

        messages.add_message(request, messages.SUCCESS, _("Your comment has been posted!"))

        trigger_notification(comment, media, request)

        add_comment_subscription(request.user, media)

    return redirect_obj(request, media)

def register(request):
    """The registration view.

    Note that usernames will always be lowercased. Email domains are lowercased while
    the first part remains case-sensitive.
    """
    # Redirects to indexpage if registrations are disabled
    if not mg_globals.app_config["allow_registration"]:
        messages.add_message(
            request,
            messages.WARNING,
            _('Sorry, registration is disabled on this instance.'))
        return redirect(request, "index")

    register_form = auth_forms.RegistrationForm(request.form)

    if request.method == 'POST' and register_form.validate():
        # TODO: Make sure the user doesn't exist already
        users_with_username = User.query.filter_by(username=register_form.data['username']).count()
        users_with_email = User.query.filter_by(email=register_form.data['email']).count()

        extra_validation_passes = True

        if users_with_username:
            register_form.username.errors.append(
                _(u'Sorry, a user with that name already exists.'))
            extra_validation_passes = False
        if users_with_email:
            register_form.email.errors.append(
                _(u'Sorry, a user with that email address already exists.'))
            extra_validation_passes = False

        if extra_validation_passes:
            # Create the user
            user = User()
            user.username = register_form.data['username']
            user.email = register_form.data['email']
            user.pw_hash = auth_lib.bcrypt_gen_password_hash(
                register_form.password.data)
            user.verification_key = unicode(uuid.uuid4())
            user.save()

            # log the user in
            request.session['user_id'] = unicode(user.id)
            request.session.save()

            # send verification email
            email_debug_message(request)
            send_verification_email(user, request)

            # redirect the user to their homepage... there will be a
            # message waiting for them to verify their email
            return redirect(
                request, 'mediagoblin.user_pages.user_home',
                user=user.username)

    return render_to_response(
        request,
        'mediagoblin/auth/register.html',
        {'register_form': register_form})

def forgot_password(request):
    """
    Forgot password view

    Sends an email with an url to renew forgotten password
    """
    fp_form = auth_forms.ForgotPassForm(request.form,
                                        username=request.GET.get('username'))

    if request.method == 'POST' and fp_form.validate():

        # '$or' not available till mongodb 1.5.3
        user = request.db.User.find_one(
            {'username': request.form['username']})
        if not user:
            user = request.db.User.find_one(
                {'email': request.form['username']})

        if user:
            if user.email_verified and user.status == 'active':
                user.fp_verification_key = unicode(uuid.uuid4())
                user.fp_token_expire = datetime.datetime.now() + \
                                          datetime.timedelta(days=10)
                user.save()

                send_fp_verification_email(user, request)

                messages.add_message(
                    request,
                    messages.INFO,
                    _("An email has been sent with instructions on how to "
                      "change your password."))
                email_debug_message(request)

            else:
                # special case... we can't send the email because the
                # username is inactive / hasn't verified their email
                messages.add_message(
                    request,
                    messages.WARNING,
                    _("Could not send password recovery email as "
                      "your username is inactive or your account's "
                      "email address has not been verified."))

                return redirect(
                    request, 'mediagoblin.user_pages.user_home',
                    user=user.username)
            return redirect(request, 'mediagoblin.auth.login')
        else:
            messages.add_message(
                request,
                messages.WARNING,
                _("Couldn't find someone with that username or email."))
            return redirect(request, 'mediagoblin.auth.forgot_password')

    return render_to_response(
        request,
        'mediagoblin/auth/forgot_password.html',
        {'fp_form': fp_form})