root/trunk/examples/divan/divan/comments.py @ 201

# -*- coding: utf-8 -*-

from cgi import parse_header
from datetime import datetime
import logging
from urllib import urlencode
from urlparse import urlsplit, urlunsplit

from BeautifulSoup import BeautifulSoup
from diva import app
from diva.forms import Form, TextValidator, ValidationError
from diva.http import abort
from diva.routing import abs_url, path_to, redirect_to
from diva.templating import output, render
from genshi import escape, HTML, ParseError
from genshi.filters import HTMLSanitizer
from httplib2 import Http, HttpLib2Error

from divan import moderation, view
from divan.model import Post, Comment

log = logging.getLogger('divan.comments')


def to_xhtml(text):
    if text is None:
        text = ''
    try:
        from markdown2 import markdown
    except ImportError:
        log.warning('python-markdown2 import failed', exc_info=True)
        return escape(text)
    else:
        return HTML(markdown(text, html4tags=True)) | HTMLSanitizer()


class CommentForm(Form):
    openid_url = TextValidator(required=True)
    resolved_url = TextValidator()
    author = TextValidator()
    content = TextValidator(required=True)

    def validate_openid(self, data):
        openid = normalize_openid(data['openid_url'])
        if openid == data.get('resolved_url'):
            return

        http = Http()
        http.follow_redirects = False
        try:
            log.info('Looking up OpenID URL %r', openid)
            while True: # resolve permanent redirectionss
                resp, body = http.request(openid, method='HEAD', headers={
                    'Host': get_hostname(openid)
                })
                if resp.status != 301:
                    break
                openid = resp['location']
            if resp.status >= 400:
                raise ValidationError(resp.reason)
            log.info('OpenID resolved to URL %r', openid)
        except HttpLib2Error, e:
            raise ValidationError(e.args[0])

        data['openid_url'] = data['resolved_url'] = openid


class AuthenticationError(Exception):
    """Exception raised on errors with OpenID authentication."""


@output('comment.html')
def authenticate(request, response, id):
    comment = Comment.load(app.db, id) or abort(404)
    post = Post.load(app.db, comment.post_id) or abort(404)
    if not post.allow_comments:
        abort(403)
    mode = request.GET['openid.mode']

    if mode == 'id_res':
        log.info('OpenID %r authenticated by %r', comment.openid,
                 comment.openid_server)
        params = {
            'openid.mode': 'check_authentication',
            'openid.sig': request.GET['openid.sig'],
            'openid.signed': request.GET['openid.signed'],
            'openid.assoc_handle': request.GET['openid.assoc_handle'],
        }
        for name in request.GET['openid.signed'].split(','):
            params.setdefault('openid.%s' % name,
                              request.GET['openid.%s' % name])

        http = Http()
        resp, body = http.request(comment.openid_server, method='POST',
                                  body=urlencode(params),
                                  headers={
            'Content-Type': 'application/x-www-form-urlencoded',
            'Host': get_hostname(comment.openid_server)
        })
        result = decode_kvform(body.strip())
        if result['is_valid'] == 'true':
            log.info('OpenID authentication for %r validated by %r',
                     comment.openid, comment.openid_server)
            comment.authenticated = True

            if Comment.is_whitelisted(comment.openid):
                # OpenID of commenter is on the whitelist, no moderation needed
                comment.published = True
                post.num_comments += 1
                app.db.update([comment._data, post._data])
                log.info('Published comment by %r <%s>', comment.author,
                         comment.openid)
                redirect_to('post', *post.path())

            comment.store(app.db)
            moderation.notify(post, comment)
            log.info('Comment by %r <%s> awaiting moderation', comment.author,
                     comment.openid)
            return render('thanks.html', post=post, comment=comment)

        else:
            log.warning('Validation of OpenID authentication for %r by %r '
                        'failed: %r', comment.openid, comment.openid_server,
                        body.strip())

    elif mode == 'cancel':
        del app.db[comment.id]

    redirect_to('post', *post.path())


@output('comment.html')
def comment(request, response, refid):
    post = Post.load(app.db, refid) or abort(404)
    if not post.allow_comments:
        abort(403)
    form = CommentForm()
    preview = None

    if request.method == 'POST':
        if 'cancel' in request.POST:
            return redirect_to(view.post, *post.path())
        if form.validate(request.POST) and 'preview' not in request.POST:
            claimed_id = form['openid_url']
            log.info('Attempting OpenID authentication for %r', claimed_id)
            try:
                provider, local_id, version = resolve_openid(claimed_id)
            except AuthenticationError, e:
                form.errors[None] = [e.args[0]]
            else:
                log.info('OpenID resolved to %r via %r', local_id, provider)

                try:
                    markup = to_xhtml(form['content']).render('xhtml',
                                                              encoding=None)
                except ParseError, e:
                    form.errors['content'] = ['HTML parsing error: %s' % e]
                else:
                    comment = Comment(post_id=post.id, time=datetime.utcnow(),
                                      openid=claimed_id,
                                      openid_server=provider,
                                      openid_identity=local_id,
                                      markup=markup,
                                      **form.data)
                    comment.store(app.db)

                    response.set_cookie('author', comment.author)
                    response.set_cookie('openid', claimed_id)

                    params = {
                        'openid.mode': 'checkid_setup',
                        'openid.identity': local_id,
                        'openid.return_to': abs_url(path_to('authenticate', comment.id))
                    }
                    if version >= 2:
                        params.update({
                            'openid.ns': 'http://specs.openid.net/auth/2.0',
                            'openid.claimed_id': claimed_id,
                            'openid.identity': local_id,
                            'openid.realm': abs_url(path_to('index'))
                        })
                    else:
                        params.update({
                            'openid.trust_root': abs_url(path_to('index'))
                        })

                    return redirect_to(provider, **params)

        try:
            preview = to_xhtml(form['content'])
        except ParseError, e:
            form.errors['content'] = ['HTML parsing error: %s' % e]

    return render(
        errors = form.errors,
        form = form,
        post = post,
        preview = preview
    )


def get_hostname(url):
    """Extract the host name from the given URL, which does not include the
    port for HTTP and HTTPS URLs using the respective default port.
    
    >>> get_hostname('http://me.yahoo.com/')
    'me.yahoo.com'
    >>> get_hostname('http://me.yahoo.com:80/')
    'me.yahoo.com'
    >>> get_hostname('https://me.yahoo.com:443/')
    'me.yahoo.com'
    
    :param url: the URL from which to extract the host name
    :return: the extracted host name
    """
    scheme, netloc, path, query, fragment = list(urlsplit(url))
    if ':' in netloc:
        hostname, port = netloc.split(':')
        if port == '80' and scheme == 'http':
            port = None
        elif port == '443' and scheme == 'https':
            port = None
        return ':'.join(filter(None, [hostname, port]))
    return netloc


def normalize_openid(url):
    """Normalize the given OpenID URL.
    
    >>> normalize_openid('me.yahoo.com')
    'http://me.yahoo.com/'
    >>> normalize_openid('https://me.yahoo.com')
    'https://me.yahoo.com/'
    >>> normalize_openid('https://me.yahoo.com/joe')
    'https://me.yahoo.com/joe'
    
    :param url: the URL to normalize
    :return: the normalized URL
    """
    if '://' not in url:
        url = 'http://%s' % url
    scheme, netloc, path, query, fragment = list(urlsplit(url))
    if not path:
        path = '/'
    return urlunsplit((scheme, netloc, path, query, ''))


def decode_kvform(string):
    """Parse a key-value form encoded string as defined in the OpenID
    specification, and return a dictionary mapping values to keys.
    
    >>> encoded = 'ns:http://specs.openid.net/auth/2.0\\nis_valid:true'
    >>> parsed = decode_kvform(encoded)
    >>> parsed['ns']
    u'http://specs.openid.net/auth/2.0'
    >>> parsed['is_valid']
    u'true'
    
    :param string: the key-value form encoded string
    :return: dictionary mapping values to keys
    """
    if not isinstance(string, unicode):
        string = string.decode('utf-8')
    string = string.strip()
    retval = {}
    for line in string.split('\n'):
        key, value = line.split(':', 1)
        retval[key.strip()] = value.strip()
    return retval


def resolve_openid(url):
    """Resolve the given OpenID URL and return a tuple of the form
    `(provider_url, identity_url, version)`.
    """
    http = Http()
    resp, body = http.request(url, method='GET', headers={
        'Host': get_hostname(url)
    })
    if resp.status != 200:
        raise AuthenticationError('Could not retrieve OpenID URL: %d %s' %
                                  (resp.status, resp.reason))

    mimetype = resp.get('content-type')
    if mimetype:
        mimetype, params = parse_header(mimetype)
    if mimetype not in ('application/xhtml+xml', 'text/html'):
        raise AuthenticationError('Resource for OpenID URL is not an HTML '
                                  'page, but %r' % mimetype)

    soup = BeautifulSoup(body, fromEncoding=params.get('charset'))
    provider_tag = soup.findAll('link', rel='openid2.provider')
    if provider_tag:
        version = 2
    else:
        provider_tag = soup.findAll('link', rel='openid.server')
        if not provider_tag:
            raise AuthenticationError('OpenID HTML resource contains no '
                                      '"openid.server" link')
        version = 1
    provider_url = provider_tag[0]['href']

    if version == 2:
        identity_tag = soup.findAll('link', rel='openid2.local_id')
    else:
        identity_tag = soup.findAll('link', rel='openid.delegate')
    if not identity_tag:
        identity_url = url
    else:
        identity_url = identity_tag[0]['href']

    return provider_url, identity_url, version