"""
.. module: service
    :platform: Unix
    :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more
    :license: Apache, see LICENSE for more details.
.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
"""
import os
import arrow
import string
import random
import hashlib
import datetime
import subprocess

from sqlalchemy import func, or_
from flask import g, current_app

from lemur import database
from lemur.common.services.aws import iam
from lemur.common.services.issuers.manager import get_plugin_by_name

from lemur.certificates.models import Certificate
from lemur.certificates.exceptions import UnableToCreateCSR, \
    UnableToCreatePrivateKey, MissingFiles

from lemur.accounts.models import Account
from lemur.accounts import service as account_service
from lemur.authorities.models import Authority

from lemur.roles.models import Role


def get(cert_id):
    """
    Retrieves certificate by it's ID.

    :param cert_id:
    :return:
    """
    return database.get(Certificate, cert_id)


def get_by_name(name):
    """
    Retrieves certificate by it's Name.

    :param name:
    :return:
    """
    return database.get(Certificate, name, field='name')


def delete(cert_id):
    """
    Delete's a certificate.

    :param cert_id:
    """
    database.delete(get(cert_id))


def disassociate_aws_account(certs, account):
    """
    Removes the account association from a certificate. We treat AWS as a completely
    external service. Certificates are added and removed from this service but a record
    of that certificate is always kept and tracked by Lemur. This allows us to migrate
    certificates to different accounts with ease.

    :param certs:
    :param account:
    """
    account_certs = Certificate.query.filter(Certificate.accounts.any(Account.id == 1)).\
                        filter(~Certificate.body.in_(certs)).all()

    for a_cert in account_certs:
        try:
            a_cert.accounts.remove(account)
        except Exception as e:
            current_app.logger.debug("Skipping {0} account {1} is already disassociated".format(a_cert.name, account.label))
            continue
        database.update(a_cert)


def get_all_certs():
    """
    Retrieves all certificates within Lemur.

    :return:
    """
    return Certificate.query.all()


def find_duplicates(cert_body):
    """
    Finds certificates that already exist within Lemur. We do this by looking for
    certificate bodies that are the same. This is the most reliable way to determine
    if a certificate is already being tracked by Lemur.

    :param cert_body:
    :return:
    """
    return Certificate.query.filter_by(body=cert_body).all()


def update(cert_id, owner, active):
    """
    Updates a certificate.

    :param cert_id:
    :param owner:
    :param active:
    :return:
    """
    cert = get(cert_id)
    cert.owner = owner
    cert.active = active
    return database.update(cert)


def mint(issuer_options):
    """
    Minting is slightly different for each authority.
    Support for multiple authorities is handled by individual plugins.

    :param issuer_options:
    """
    authority = issuer_options['authority']

    issuer = get_plugin_by_name(authority.plugin_name)
    # NOTE if we wanted to support more issuers it might make sense to
    # push CSR creation down to the plugin
    path = create_csr(issuer.get_csr_config(issuer_options))
    challenge, csr, csr_config, private_key = load_ssl_pack(path)

    issuer_options['challenge'] = challenge
    issuer_options['creator'] = g.user.email
    cert_body, cert_chain = issuer.create_certificate(csr, issuer_options)

    cert = save_cert(cert_body, private_key, cert_chain, challenge, csr_config, issuer_options.get('accounts'))
    cert.user = g.user
    cert.authority = authority
    database.update(cert)

    # securely delete pack after saving it to RDS and IAM (if applicable)
    delete_ssl_pack(path)

    return cert, private_key, cert_chain,


def import_certificate(**kwargs):
    """
    Uploads already minted certificates and pulls the required information into Lemur.

    This is to be used for certificates that are reated outside of Lemur but
    should still be tracked.

    Internally this is used to bootstrap Lemur with external
    certificates, and used when certificates are 'discovered' through various discovery
    techniques. was still in aws.

    :param kwargs:
    """
    cert = Certificate(kwargs['public_certificate'])
    cert.owner = kwargs.get('owner', )
    cert.creator = kwargs.get('creator', 'Lemur')

    # NOTE existing certs may not follow our naming standard we will
    # overwrite the generated name with the actual cert name
    if kwargs.get('name'):
        cert.name = kwargs.get('name')

    if kwargs.get('user'):
        cert.user = kwargs.get('user')

    if kwargs.get('account'):
        cert.accounts.append(kwargs.get('account'))

    cert = database.create(cert)
    return cert


def save_cert(cert_body, private_key, cert_chain, challenge, csr_config, accounts):
    """
    Determines if the certificate needs to be uploaded to AWS or other services.

    :param cert_body:
    :param private_key:
    :param cert_chain:
    :param challenge:
    :param csr_config:
    :param account_ids:
    """
    cert = Certificate(cert_body, private_key, challenge, cert_chain, csr_config)
    # if we have an AWS accounts lets upload them
    if accounts:
        for account in accounts:
            account = account_service.get(account['id'])
            iam.upload_cert(account.account_number, cert, private_key, cert_chain)
            cert.accounts.append(account)
    return cert


def upload(**kwargs):
    """
    Allows for pre-made certificates to be imported into Lemur.
    """
    # save this cert the same way we save all of our certs, including uploading
    # to aws if necessary
    cert = save_cert(
        kwargs.get('public_cert'),
        kwargs.get('private_key'),
        kwargs.get('intermediate_cert'),
        None,
        None,
        kwargs.get('accounts')
    )

    cert.owner = kwargs['owner']
    cert = database.create(cert)
    g.user.certificates.append(cert)
    return cert


def create(**kwargs):
    """
    Creates a new certificate.
    """
    cert, private_key, cert_chain = mint(kwargs)

    cert.owner = kwargs['owner']
    database.create(cert)
    g.user.certificates.append(cert)
    database.update(g.user)
    return cert


def render(args):
    """
    Helper function that allows use to render our REST Api.

    :param args:
    :return:
    """
    query = database.session_query(Certificate)

    time_range = args.pop('time_range')
    account_id = args.pop('account_id')
    show = args.pop('show')
    owner = args.pop('owner')
    creator = args.pop('creator')  # TODO we should enabling filtering by owner

    filt = args.pop('filter')

    if filt:
        terms = filt.split(';')
        if 'issuer' in terms:
            # we can't rely on issuer being correct in the cert directly so we combine queries
            sub_query = database.session_query(Authority.id)\
                .filter(Authority.name.ilike('%{0}%'.format(terms[1])))\
                .subquery()

            query = query.filter(
                or_(
                    Certificate.issuer.ilike('%{0}%'.format(terms[1])),
                    Certificate.authority_id.in_(sub_query)
                )
            )
            return database.sort_and_page(query, Certificate, args)

        if 'account' in terms:
            query = query.filter(Certificate.accounts.any(Account.id == terms[1]))
        elif 'active' in filt: # this is really weird but strcmp seems to not work here??
            query = query.filter(Certificate.active == terms[1])
        else:
            query = database.filter(query, Certificate, terms)

    if show:
        sub_query = database.session_query(Role.name).filter(Role.user_id == g.user.id).subquery()
        query = query.filter(
            or_(
                Certificate.user_id == g.user.id,
                Certificate.owner.in_(sub_query)
            )
        )

    if account_id:
        query = query.filter(Certificate.accounts.any(Account.id == account_id))

    if time_range:
        to = arrow.now().replace(weeks=+time_range).format('YYYY-MM-DD')
        now = arrow.now().format('YYYY-MM-DD')
        query = query.filter(Certificate.not_after <= to).filter(Certificate.not_after >= now)

    return database.sort_and_page(query, Certificate, args)


def create_csr(csr_config):
    """
    Given a list of domains create the appropriate csr
    for those domains

    :param csr_config:
    """

    # we create a no colliding file name
    path = create_path(hashlib.md5(csr_config).hexdigest())

    challenge = create_challenge()
    challenge_path = os.path.join(path, 'challenge.txt')

    with open(challenge_path, 'w') as c:
        c.write(challenge)

    csr_path = os.path.join(path, 'csr_config.txt')

    with open(csr_path, 'w') as f:
        f.write(csr_config)

    #TODO use cloudCA to seed a -rand file for each call
    #TODO replace openssl shell calls with cryptograph
    with open('/dev/null', 'w') as devnull:
        code = subprocess.call(['openssl', 'genrsa',
                                '-out', os.path.join(path, 'private.key'), '2048'],
                               stdout=devnull, stderr=devnull)

        if code != 0:
            raise UnableToCreatePrivateKey(code)

    with open('/dev/null', 'w') as devnull:
        code = subprocess.call(['openssl', 'req', '-new', '-sha256', '-nodes',
                                            '-config', csr_path, "-key", os.path.join(path, 'private.key'),
                                            "-out", os.path.join(path, 'request.csr')], stdout=devnull, stderr=devnull)

        if code != 0:
            raise UnableToCreateCSR(code)

    return path


def create_path(domain_hash):
    """

    :param domain_hash:
    :return:
    """
    path = os.path.join('/tmp', domain_hash)

    try:
        os.mkdir(path)
    except OSError as e:
        now = datetime.datetime.now()
        path = os.path.join('/tmp', "{}.{}".format(domain_hash, now.strftime('%s')))
        os.mkdir(path)
        current_app.logger.warning(e)

    current_app.logger.debug("Writing ssl files to: {}".format(path))
    return path


def load_ssl_pack(path):
    """
    Loads the information created by openssl to be used by other functions.

    :param path:
    """
    if len(os.listdir(path)) != 4:
        raise MissingFiles(path)

    with open(os.path.join(path, 'challenge.txt')) as c:
        challenge = c.read()

    with open(os.path.join(path, 'request.csr')) as r:
        csr = r.read()

    with open(os.path.join(path, 'csr_config.txt')) as config:
        csr_config = config.read()

    with open(os.path.join(path, 'private.key')) as key:
        private_key = key.read()

    return (challenge, csr, csr_config, private_key,)


def delete_ssl_pack(path):
    """
    Removes the temporary files associated with CSR creation.

    :param path:
    """
    subprocess.check_call(['srm', '-r', path])


def create_challenge():
    """
    Create a random and strongish csr challenge.
    """
    challenge = ''.join(random.choice(string.ascii_uppercase) for x in range(6))
    challenge += ''.join(random.choice("~!@#$%^&*()_+") for x in range(6))
    challenge += ''.join(random.choice(string.ascii_lowercase) for x in range(6))
    challenge += ''.join(random.choice(string.digits) for x in range(6))
    return challenge


def stats(**kwargs):
    """
    Helper that defines some useful statistics about certifications.

    :param kwargs:
    :return:
    """
    query = database.session_query(Certificate)

    if kwargs.get('active') == 'true':
        query = query.filter(Certificate.elb_listeners.any())

    if kwargs.get('account_id'):
        query = query.filter(Certificate.accounts.any(Account.id == kwargs.get('account_id')))

    if kwargs.get('metric') == 'not_after':
        start = arrow.utcnow()
        end = start.replace(weeks=+32)
        items = database.db.session.query(Certificate.issuer, func.count(Certificate.id))\
            .group_by(Certificate.issuer)\
            .filter(Certificate.not_after <= end.format('YYYY-MM-DD')) \
            .filter(Certificate.not_after >= start.format('YYYY-MM-DD')).all()

    else:
        attr = getattr(Certificate, kwargs.get('metric'))
        query = database.db.session.query(attr, func.count(attr))

        # TODO this could be cleaned up
        if kwargs.get('active') == 'true':
            query = query.filter(Certificate.elb_listeners.any())

        items = query.group_by(attr).all()

    keys = []
    values = []
    for key, count in items:
        keys.append(key)
        values.append(count)

    return {'labels': keys, 'values': values}