import re
import warnings

from webob.compat import (
    escape,
    string_types,
    text_,
    text_type,
    )

from webob.headers import _trans_key

def html_escape(s):
    """HTML-escape a string or object

    This converts any non-string objects passed into it to strings
    (actually, using ``unicode()``).  All values returned are
    non-unicode strings (using ``&#num;`` entities for all non-ASCII
    characters).

    None is treated specially, and returns the empty string.
    """
    if s is None:
        return ''
    __html__ = getattr(s, '__html__', None)
    if __html__ is not None and callable(__html__):
        return s.__html__()
    if not isinstance(s, string_types):
        __unicode__ = getattr(s, '__unicode__', None)
        if __unicode__ is not None and callable(__unicode__):
            s = s.__unicode__()
        else:
            s = str(s)
    s = escape(s, True)
    if isinstance(s, text_type):
        s = s.encode('ascii', 'xmlcharrefreplace')
    return text_(s)


# RFC 3986 section 3.1: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
_URI_SCHEME_RE = re.compile(r"^[A-Za-z][A-Za-z0-9+\-.]*$")


def _split_uri_reference(uri):
    """Split a URI reference into its five components.

    Returns a ``(scheme, authority, path, query, fragment)`` tuple,
    following the grammar from RFC 3986 (see appendix B). Components that
    are not present in the reference are ``None``. The path is always
    present, but may be the empty string.

    Unlike ``urllib.parse.urlsplit()``, no characters are ever removed
    from the reference: ASCII tab/CR/LF and leading or trailing C0
    control and space characters are treated like any other character.
    """
    scheme = authority = query = fragment = None

    rest, sep, token = uri.partition("#")

    if sep:
        fragment = token

    rest, sep, token = rest.partition("?")

    if sep:
        query = token

    token, sep, candidate = rest.partition(":")

    if sep and _URI_SCHEME_RE.match(token):
        scheme = token
        rest = candidate

    if rest.startswith("//"):
        end = rest.find("/", 2)

        if end == -1:
            authority, rest = rest[2:], ""
        else:
            authority, rest = rest[2:end], rest[end:]

    return scheme, authority, rest, query, fragment


def _remove_dot_segments(path):
    """Remove ``.`` and ``..`` segments from a path (RFC 3986 5.2.4)."""
    output = []

    while path:
        if path.startswith("../"):
            path = path[3:]
        elif path.startswith("./"):
            path = path[2:]
        elif path.startswith("/./"):
            path = "/" + path[3:]
        elif path == "/.":
            path = "/"
        elif path.startswith("/../"):
            path = "/" + path[4:]

            if output:
                output.pop()
        elif path == "/..":
            path = "/"

            if output:
                output.pop()
        elif path in (".", ".."):
            path = ""
        else:
            end = path.find("/", 1) if path.startswith("/") else path.find("/")

            if end == -1:
                output.append(path)
                path = ""
            else:
                output.append(path[:end])
                path = path[end:]

    return "".join(output)


def _merge_paths(base_authority, base_path, path):
    """Merge a relative-path reference with the base path (RFC 3986 5.2.3)."""

    if base_authority is not None and base_path == "":
        return "/" + path

    if "/" in base_path:
        return base_path[: base_path.rfind("/") + 1] + path

    return path


def urljoin(base, url):
    """Resolve a URI reference relative to a base URI (RFC 3986 section 5).

    A replacement for ``urllib.parse.urljoin()``. The standard library
    implementation follows the WHATWG URL living standard (on Python
    3.10+) by removing ASCII tab, CR, and LF anywhere in the URL and
    stripping leading and trailing C0 control and space characters
    before parsing. Those transformations can silently turn an otherwise
    harmless relative reference such as ``" //evil.example"`` into a
    protocol-relative or absolute URL, which has repeatedly led to open
    redirect issues when normalizing the ``Location`` header (see
    CVE-2024-42353/GHSA-mg3v-6m49-jhp3, GHSA-fh3h-vg37-cc95, and
    GHSA-6hx8-3wjj-gr8g).

    This implementation resolves the reference exactly as given,
    character for character, with no whitespace removal whatsoever.
    """

    # Mirror urllib.parse.urljoin()'s short-circuits for degenerate input
    # (such as a reference of None or the empty string), which callers of
    # Request.relative_url() may rely on.

    if not base:
        return url

    if not url:
        return base

    b_scheme, b_authority, b_path, b_query, b_fragment = _split_uri_reference(base)
    r_scheme, r_authority, r_path, r_query, r_fragment = _split_uri_reference(url)

    # Like urllib.parse.urljoin(), use the non-strict variant of the
    # resolution algorithm (RFC 3986 5.2.2): a reference whose scheme
    # matches the base scheme is treated as a relative reference.

    if (
        r_scheme is not None
        and b_scheme is not None
        and r_scheme.lower() == b_scheme.lower()
    ):
        r_scheme = None

    if r_scheme is not None:
        scheme = r_scheme
        authority = r_authority
        path = _remove_dot_segments(r_path)
        query = r_query
    elif r_authority is not None:
        scheme = b_scheme
        authority = r_authority
        path = _remove_dot_segments(r_path)
        query = r_query
    elif r_path == "":
        scheme = b_scheme
        authority = b_authority
        path = b_path
        query = r_query if r_query is not None else b_query
    else:
        scheme = b_scheme
        authority = b_authority

        if r_path.startswith("/"):
            path = _remove_dot_segments(r_path)
        else:
            path = _remove_dot_segments(_merge_paths(b_authority, b_path, r_path))
        query = r_query
    fragment = r_fragment

    # Recompose the components (RFC 3986 5.3)
    result = []

    if scheme is not None:
        result.append(scheme + ":")

    if authority is not None:
        result.append("//" + authority)
    result.append(path)

    if query is not None:
        result.append("?" + query)

    if fragment is not None:
        result.append("#" + fragment)

    return "".join(result)


def header_docstring(header, rfc_section):
    if header.isupper():
        header = _trans_key(header)
    major_section = rfc_section.split('.')[0]
    link = 'http://www.w3.org/Protocols/rfc2616/rfc2616-sec%s.html#sec%s' % (
        major_section, rfc_section)
    return "Gets and sets the ``%s`` header (`HTTP spec section %s <%s>`_)." % (
        header, rfc_section, link)


def warn_deprecation(text, version, stacklevel):
    # version specifies when to start raising exceptions instead of warnings
    if version in ('1.2', '1.3', '1.4', '1.5', '1.6', '1.7'):
        raise DeprecationWarning(text)
    else:
        cls = DeprecationWarning
    warnings.warn(text, cls, stacklevel=stacklevel + 1)

status_reasons = {
    # Status Codes
    # Informational
    100: 'Continue',
    101: 'Switching Protocols',
    102: 'Processing',

    # Successful
    200: 'OK',
    201: 'Created',
    202: 'Accepted',
    203: 'Non-Authoritative Information',
    204: 'No Content',
    205: 'Reset Content',
    206: 'Partial Content',
    207: 'Multi Status',
    226: 'IM Used',

    # Redirection
    300: 'Multiple Choices',
    301: 'Moved Permanently',
    302: 'Found',
    303: 'See Other',
    304: 'Not Modified',
    305: 'Use Proxy',
    307: 'Temporary Redirect',
    308: 'Permanent Redirect',

    # Client Error
    400: 'Bad Request',
    401: 'Unauthorized',
    402: 'Payment Required',
    403: 'Forbidden',
    404: 'Not Found',
    405: 'Method Not Allowed',
    406: 'Not Acceptable',
    407: 'Proxy Authentication Required',
    408: 'Request Timeout',
    409: 'Conflict',
    410: 'Gone',
    411: 'Length Required',
    412: 'Precondition Failed',
    413: 'Request Entity Too Large',
    414: 'Request URI Too Long',
    415: 'Unsupported Media Type',
    416: 'Requested Range Not Satisfiable',
    417: 'Expectation Failed',
    418: "I'm a teapot",
    422: 'Unprocessable Entity',
    423: 'Locked',
    424: 'Failed Dependency',
    426: 'Upgrade Required',
    428: 'Precondition Required',
    429: 'Too Many Requests',
    451: 'Unavailable for Legal Reasons',
    431: 'Request Header Fields Too Large',

    # Server Error
    500: 'Internal Server Error',
    501: 'Not Implemented',
    502: 'Bad Gateway',
    503: 'Service Unavailable',
    504: 'Gateway Timeout',
    505: 'HTTP Version Not Supported',
    507: 'Insufficient Storage',
    510: 'Not Extended',
    511: 'Network Authentication Required',
}

# generic class responses as per RFC2616
status_generic_reasons = {
    1: 'Continue',
    2: 'Success',
    3: 'Multiple Choices',
    4: 'Unknown Client Error',
    5: 'Unknown Server Error',
}

try:
    # py3.3+ have native comparison support
    from hmac import compare_digest
except ImportError: # pragma: nocover (Python 2.7.7 backported this)
    compare_digest = None

def strings_differ(string1, string2, compare_digest=compare_digest):
    """Check whether two strings differ while avoiding timing attacks.

    This function returns True if the given strings differ and False
    if they are equal.  It's careful not to leak information about *where*
    they differ as a result of its running time, which can be very important
    to avoid certain timing-related crypto attacks:

        http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf

    .. versionchanged:: 1.5
       Support :func:`hmac.compare_digest` if it is available (Python 2.7.7+
       and Python 3.3+).

    """
    len_eq = len(string1) == len(string2)
    if len_eq:
        invalid_bits = 0
        left = string1
    else:
        invalid_bits = 1
        left = string2
    right = string2

    if compare_digest is not None:
        invalid_bits += not compare_digest(left, right)
    else:
        for a, b in zip(left, right):
            invalid_bits += a != b
    return invalid_bits != 0