# Copyright 2016 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Transport adapter for Requests."""

from __future__ import absolute_import

import functools
import logging

try:
  import requests
except ImportError as caught_exc:  # pragma: NO COVER
  import six
  six.raise_from(
      ImportError('The requests library is not installed, please install the '
                  'requests package to use the requests transport.'),
      caught_exc,
  )
import requests.adapters  # pylint: disable=ungrouped-imports
import requests.exceptions  # pylint: disable=ungrouped-imports
import six  # pylint: disable=ungrouped-imports

from google.auth import exceptions
from google.auth import transport

_LOGGER = logging.getLogger(__name__)


class _Response(transport.Response):
  """Requests transport response adapter.

    Args:
        response (requests.Response): The raw Requests response.
  """

  def __init__(self, response):
    self._response = response

  @property
  def status(self):
    return self._response.status_code

  @property
  def headers(self):
    return self._response.headers

  @property
  def data(self):
    return self._response.content


class Request(transport.Request):
  """Requests request adapter.

    This class is used internally for making requests using various transports
    in a consistent way. If you use :class:`AuthorizedSession` you do not need
    to construct or use this class directly.

    This class can be useful if you want to manually refresh a
    :class:`~google.auth.credentials.Credentials` instance::

        import google.auth.transport.requests
        import requests

        request = google.auth.transport.requests.Request()

        credentials.refresh(request)

    Args:
        session (requests.Session): An instance :class:`requests.Session` used
          to make HTTP requests. If not specified, a session will be created.
    .. automethod:: __call__
  """

  def __init__(self, session=None):
    if not session:
      session = requests.Session()

    self.session = session

  def __call__(self,
               url,
               method='GET',
               body=None,
               headers=None,
               timeout=None,
               **kwargs):
    """Make an HTTP request using requests.

        Args:
            url (str): The URI to be requested.
            method (str): The HTTP method to use for the request. Defaults to
              'GET'.
            body (bytes): The payload / body in HTTP request.
            headers (Mapping[str, str]): Request headers.
            timeout (Optional[int]): The number of seconds to wait for a
              response from the server. If not specified or if None, the
              requests default timeout will be used.
            kwargs: Additional arguments passed through to the underlying
                requests :meth:`~requests.Session.request` method.

        Returns:
            google.auth.transport.Response: The HTTP response.

        Raises:
            google.auth.exceptions.TransportError: If any exception occurred.
        """
    try:
      _LOGGER.debug('Making request: %s %s', method, url)
      response = self.session.request(
          method, url, data=body, headers=headers, timeout=timeout, **kwargs)
      return _Response(response)
    except requests.exceptions.RequestException as caught_exc:
      new_exc = exceptions.TransportError(caught_exc)
      six.raise_from(new_exc, caught_exc)


class AuthorizedSession(requests.Session):
  """A Requests Session class with credentials.

    This class is used to perform requests to API endpoints that require
    authorization::

        from google.auth.transport.requests import AuthorizedSession

        authed_session = AuthorizedSession(credentials)

        response = authed_session.request(
            'GET', 'https://www.googleapis.com/storage/v1/b')

    The underlying :meth:`request` implementation handles adding the
    credentials' headers to the request and refreshing credentials as needed.

    Args:
        credentials (google.auth.credentials.Credentials): The credentials to
          add to the request.
        refresh_status_codes (Sequence[int]): Which HTTP status codes indicate
          that credentials should be refreshed and the request should be
          retried.
        max_refresh_attempts (int): The maximum number of times to attempt to
          refresh the credentials and retry the request.
        refresh_timeout (Optional[int]): The timeout value in seconds for
          credential refresh HTTP requests.
        auth_request (google.auth.transport.requests.Request): (Optional) An
          instance of :class:`~google.auth.transport.requests.Request` used when
          refreshing credentials. If not passed,
            an instance of :class:`~google.auth.transport.requests.Request` is
              created.
  """

  def __init__(self,
               credentials,
               refresh_status_codes=transport.DEFAULT_REFRESH_STATUS_CODES,
               max_refresh_attempts=transport.DEFAULT_MAX_REFRESH_ATTEMPTS,
               refresh_timeout=None,
               auth_request=None):
    super(AuthorizedSession, self).__init__()
    self.credentials = credentials
    self._refresh_status_codes = refresh_status_codes
    self._max_refresh_attempts = max_refresh_attempts
    self._refresh_timeout = refresh_timeout

    if auth_request is None:
      auth_request_session = requests.Session()

      # Using an adapter to make HTTP requests robust to network errors.
      # This adapter retrys HTTP requests when network errors occur
      # and the requests seems safely retryable.
      retry_adapter = requests.adapters.HTTPAdapter(max_retries=3)
      auth_request_session.mount('https://', retry_adapter)

      # Do not pass `self` as the session here, as it can lead to
      # infinite recursion.
      auth_request = Request(auth_request_session)

    # Request instance used by internal methods (for example,
    # credentials.refresh).
    self._auth_request = auth_request

  def request(self, method, url, data=None, headers=None, **kwargs):
    """Implementation of Requests' request."""
    # pylint: disable=arguments-differ
    # Requests has a ton of arguments to request, but only two
    # (method, url) are required. We pass through all of the other
    # arguments to super, so no need to exhaustively list them here.

    # Use a kwarg for this instead of an attribute to maintain
    # thread-safety.
    _credential_refresh_attempt = kwargs.pop('_credential_refresh_attempt', 0)

    # Make a copy of the headers. They will be modified by the credentials
    # and we want to pass the original headers if we recurse.
    request_headers = headers.copy() if headers is not None else {}

    self.credentials.before_request(self._auth_request, method, url,
                                    request_headers)

    response = super(AuthorizedSession, self).request(
        method, url, data=data, headers=request_headers, **kwargs)

    # If the response indicated that the credentials needed to be
    # refreshed, then refresh the credentials and re-attempt the
    # request.
    # A stored token may expire between the time it is retrieved and
    # the time the request is made, so we may need to try twice.
    if (response.status_code in self._refresh_status_codes and
        _credential_refresh_attempt < self._max_refresh_attempts):

      _LOGGER.info(
          'Refreshing credentials due to a %s response. Attempt %s/%s.',
          response.status_code, _credential_refresh_attempt + 1,
          self._max_refresh_attempts)

      auth_request_with_timeout = functools.partial(
          self._auth_request, timeout=self._refresh_timeout)
      self.credentials.refresh(auth_request_with_timeout)

      # Recurse. Pass in the original headers, not our modified set.
      return self.request(
          method,
          url,
          data=data,
          headers=headers,
          _credential_refresh_attempt=_credential_refresh_attempt + 1,
          **kwargs)

    return response
