#!/usr/local/bin/python

import sys

import re
import select
from signal import signal, SIGINT, SIGTERM

from cred_printer.server import xmlrpc_handler, server, simpleServer
from cred_printer.service_error import service_error
from cred_printer.util import ssl_context

from xmlrpclib import Binary
from tempfile import NamedTemporaryFile
from string import join

from optparse import OptionParser

import ABAC

class OptParser(OptionParser):
    """
    Option parsing for clients.  Should be self-explanatory.
    """
    def __init__(self):
	OptionParser.__init__(self)
	self.add_option('--port', dest='port', type='int', default=13232,
		help='port to listen on')
	self.add_option('--cert', dest='cert', default=None,
		help='My identity certificate (and key)')


class credential_printer:
    """
    The implementation passed to the server to handle incoming requests.
    Specifically, translate_creds will be called when the translate method is
    invoked on the server.
    """
    def __init__(self):
	"""
	Initialize the method -> function dict.
	"""
	self.xmlrpc_services = { 'translate': self.translate_creds }

    @staticmethod
    def get_cred_data(d):
	"""
	Get the credential data from one of the aprameter dicts
	"""
	return d.get('credential', Binary()).data

    @staticmethod
    def attr_cred_to_string(r):
	"""
	Parse a an ABAC.Credential into a string representation.
	"""
	return "%s <- %s" % (r.head().string(), r.tail().string())

    @staticmethod
    def repl_IDs(s, id_dict):
	"""
	Replace all the keyids in the string with the name they map to in the
	dict.  id_dict maps an ID certificate's keyid to a human-readable name.
	"""
	for k, n in id_dict.items():
	    if re.search(k, s):
		s = re.sub(k, n, s)
	return s

    def make_ID(self, cred):
	"""
	Create a Creddy.ID from the given binary, if possible.  Because
	Creddy.ID doesn't take a binary blob, this writes a temp file and
	creates the ID from that.  If successful, the ID is returned.
	Otherwise None is returned.
	"""
	i = None
	try:
	    i = ABAC.ID_chunk(cred)
	except:
	    pass
	finally:
	    return i

    def split_certs(self, cred_dict):
	"""
	A list of dicts of the form { id: identifier, credential: bits} is
	divided into two such lists, one where the bits are attribute
	certificates and one where they are IDs.  Dicts the ID cert list have
	their 'type', 'str', 'auxstr' fields set to 'identity', the keyid, and
	the common name in the certificate.  The temporary 'chunk' key is set
	to the binary representation fo the credential.  The return value is a
	tuple of ID dicts and attr dicts in that order.
	"""
	ids = [ ]
	attrs = [ ]
	for e in cred_dict:
	    abac_ID = self.make_ID(self.get_cred_data(e))
	    if abac_ID:
		id_name = abac_ID.cert_filename()
		if id_name.endswith('_ID.pem'):
		    id_name = id_name[0:-7]
		e['type'] = 'identity'
		e['str'] = abac_ID.keyid()
		e['auxstr'] = id_name
		e['chunk'] = abac_ID.cert_chunk()
		ids.append(e)
	    else:
		attrs.append(e)

	return (ids, attrs)


    def translate_attr(self, a, c, id_dict):
	"""
	Set the 'str' and 'auxstr' fields in the given attribute dict (a) by
	importing it into a clone of the given context and parsing the result.
	The 'errcode' key is set as well.
	"""
	cc = ABAC.Context(c)
	errcode = cc.load_attribute_chunk(self.get_cred_data(a))
	if errcode == ABAC.ABAC_CERT_SUCCESS:
	    # Success, pull it out and parse it.
	    creds = cc.credentials()
	    # There should only be one credential in the list.  If not, throw
	    # an error
	    if len(creds) == 1:
		a['str'] = self.attr_cred_to_string(creds[0])
		a['auxstr'] = self.repl_IDs(a['str'], id_dict)
		a['type'] = 'attribute'
                # Process the attribute head
                head = creds[0].head()
                a['head'] = dict()
                a['head']['principal'] = head.principal()
                a['head']['role'] = head.role_name()
                a['head']['pretty_principal'] = self.repl_IDs(head.principal(),
                                                              id_dict)
                # Process the attribute tail
                tail = creds[0].tail()
                a['tail'] = dict()
                a['tail']['principal'] = tail.principal()
                a['tail']['pretty_principal'] = self.repl_IDs(tail.principal(),
                                                              id_dict)
                if tail.is_role():
                    a['tail']['role'] = tail.role_name()
                elif tail.is_linking():
                    a['tail']['role'] = tail.role_name()
                    a['tail']['linked_role'] = tail.linked_role()
	    else:
		raise service_error(service_error.server_config, 
			'Multiple credentials in Context!?')
	else:
	    # Fail, clear the keys
	    a['str'] = ''
	    a['auxstr']= ''
	    a['type'] = 'unknown'
	a['errcode'] = errcode


    def translate_creds(self, req, fid):
	"""
	Base translation routine: split the credential dicts into IDs and
	attributes, initialize an ABAC context with all the known IDs, and
	parse out each attribute.  Return a single list of all the modified
	certificate dicts.  The server will encode that and return it or
	convert any service_errors raised into an XMLRPC Fault.
	"""
	ids, attrs = self.split_certs(req[0])
	ctxt = ABAC.Context()
	id_dict = { }	# Used to create auxstrs.  It maps ID cert keyid->CN
	for i in ids:
	    if 'chunk' in i: 
		errcode = ctxt.load_id_chunk(i['chunk'])
		del i['chunk']
	    else: 
		errcode = ABAC.ABAC_CERT_INVALID

	    if errcode == ABAC.ABAC_CERT_SUCCESS:
		id_dict[i['str']] = i['auxstr']
	    i['errcode'] = errcode
	for a in attrs:
	    self.translate_attr(a, ctxt, id_dict)
	return ids + attrs


def shutdown(sig, frame):
    """
    Signal handler.  Set the global active variable false if a terminating
    signal is received.
    """
    global active
    active = False

# Main code

# Parse args
parser = OptParser()
opts, args = parser.parse_args()

if opts.cert:
    # There's a certificate specified, set up as an SSL server.
    try:
	ctx = ssl_context(opts.cert)
    except SSLError, e:
	sys.exit("Cannot load %s: %s" % (opts.cert, e))

    s = server(('localhost', opts.port), xmlrpc_handler, ctx, 
	    credential_printer(), True)
else:
    # No certificate.  Be an open server
    s = simpleServer(('localhost', opts.port), xmlrpc_handler, 
	    credential_printer(), True)

# Catch SIGINT and SIGTERM
signal(SIGINT, shutdown)
signal(SIGTERM, shutdown)

# Do it.
active = True
while active:
    try:
	# When a request comes in handle it.  This extra selecting gives us
	# space to catch terminating signals.
	i, o, e = select.select((s,), (), (), 1.0)
	if s in i: s.handle_request()
    except select.error, e:
	if e[0] == 4: pass
	else: sys.exit("Unexpected error: %s" % e)

sys.exit(0)