import base64
import binascii

from webob.exc import HTTPUnauthorized
from zope.interface import implementer

from repoze.who.interfaces import IIdentifier
from repoze.who.interfaces import IChallenger
from repoze.who._helpers import AUTHORIZATION
from repoze.who._helpers import must_decode

@implementer(IIdentifier, IChallenger)
class BasicAuthPlugin(object):

    def __init__(self, realm):
        self.realm = realm

    # IIdentifier
    def identify(self, environ):
        authorization = AUTHORIZATION(environ)
        if type(authorization) != type(b''):
            # this header *must* be base64-encoded ASCII
            authorization = authorization.encode('ascii')
        try:
            authmeth, auth = authorization.split(b' ', 1)
        except ValueError: # not enough values to unpack
            return None
        if authmeth.lower() == b'basic':
            try:
                auth = auth.strip()
                auth = base64.decodebytes(auth)
            except binascii.Error: # can't decode
                return None
            try:
                login, password = auth.split(b':', 1)
            except ValueError: # not enough values to unpack
                return None
            auth = {'login': must_decode(login),
                    'password': must_decode(password)}
            return auth

        return None

    # IIdentifier
    def remember(self, environ, identity):
        # we need to do nothing here; the browser remembers the basic
        # auth info as a result of the user typing it in.
        pass

    def _get_wwwauth(self):
        head = [('WWW-Authenticate', 'Basic realm="%s"' % self.realm)]
        return head

    # IIdentifier
    def forget(self, environ, identity):
        return self._get_wwwauth()

    # IChallenger
    def challenge(self, environ, status, app_headers, forget_headers):
        head = self._get_wwwauth()
        if head[0] not in forget_headers:
            head = head + forget_headers
        return HTTPUnauthorized(headers=head)

    def __repr__(self):
        return '<%s %s>' % (self.__class__.__name__,
                            id(self)) #pragma NO COVERAGE

def make_plugin(realm='basic'):
    plugin = BasicAuthPlugin(realm)
    return plugin

