# -*- coding: utf-8 -*-

"""
    identity.config
    ~~~~~~~~~~~~~~~~~~~
    Default configuration of Flask-Identity

    :author: solardiax <solardiax@hotmail.com>
    :copyright: (c) 2020 by DreamEx Works.
    :license: MIT, see LICENSE for more details.
"""

import pkg_resources
from datetime import timedelta

default_config = {
    #: Specifies the view to redirect to if a user attempts to access a URL/endpoint that they do
    #: not have permission to access. If this value is ``None``, the user is presented with a default
    #: HTTP 401 response.
    #: Default: ``None``.
    "UNAUTHORIZED_VIEW": None,

    #: Specifies the view to redirect to if a user attempts to access a URL/endpoint that they do
    #: not have authentication to access. If this value is ``None``, the user is presented with a default
    #: HTTP 403 response.
    #: Default: ``None``.
    "UNAUTHENTICATED_VIEW": None,

    #: Specifies the default view to redirect to after a user logs in. This value can be set to a URL
    #: or an endpoint name.
    #: Default: ``"/"``.
    "POST_LOGIN_VIEW": "/",

    #: Specifies the default view to redirect to after a user logs out. This value can be set to a URL
    #: or an endpoint name.
    #: Default: ``"/"``.
    "POST_LOGOUT_VIEW": "/",

    #: The name used to store user token in request & session.
    #: Default: ``"token"``.
    "IDENTITY_TOKEN_NAME": "token",

    #: Specifies whether should remember user when logging in.
    #: Default: ``False``.
    "REMEMBER_ME": False,

    #: The page the user is attempting to access is stored in the session
    #: or an url parameter when redirecting to the login view; This can be either
    #: ``"session"`` (the default) or ``"request"``.
    #: Default: ``"request"``.
    "NEXT_STORE": "request",

    #: The key to store the source url when redirecting to the login view.
    #: The key will be used as url parameter in request or key in session.
    #: Default: ``"_next"``.
    "NEXT_KEY": "_next",

    #: Specifies the HMAC salt. This is required for all schemes that
    #: are configured for double hashing. A good salt can be generated using:
    #: ``secrets.SystemRandom().getrandbits(128)``.
    #: Defaults to ``None``.
    "HASH_SALT": None,

    #: The salt used to encrypt session, request or cookie token.
    #: If this value is ``None`` (the default), then will use ``SECRET_KEY`` as salt
    #: to encrypt token.
    #: Strongly recommend set it to a different value for more security.
    #: Default: ``None``.
    "TOKEN_SALT": None,

    #: The default time before the token expires.
    #: It's also used as the duration for "remember me" cookie.
    #: Default: ``365 days``.
    "TOKEN_DURATION": timedelta(days=365),

    #: The custom identity data store to use. This can be either ``"pony" | "sqlalchemy" | "mongoengine"``,
    #: or a custom class implement from ``IdentityStore`` and ``Store``.
    #: Default: ``None``
    "DATASTORE_ADAPTER": "None",

    #: The identity field used to lookup user from ``DataStore``.
    #: The field must be defined in ``UserMixin`` based user class.
    #: Default: ``"username"``.
    "DATASTORE_IDENTITY_FIELD": "username",

    #: The identity field used to store unique token in ``DataStore``.
    #: This will immediately render outstanding auth tokens invalid.
    #: Default: ``"uniquifier"``.
    "DATASTORE_UNIQUE_TOKEN_FIELD": "uniquifier",

    #: Specifies if Flask-Identity should track basic user login statistics.
    #: If set to ``True``, ensure your models have the required fields/attributes
    #: and make sure to commit changes after calling ``login_user``.
    #: Be sure to use `ProxyFix <http://flask.pocoo.org/docs/0.10/deploying/wsgi-standalone/#proxy-setups>`_
    #: if you are using a proxy.
    #: Defaults to ``False``
    "TRACKABLE": False,

    #: The form field used to mark whether enable "remember me".
    #: Default: ``"remember"``
    "FORM_REMEBER_FIELD": "remember",

    #: The form field used to store the identity login for lookup in `Datastore` with `IDENTITY_FIELD`.
    #: Default: ``"username"``
    "FORM_IDENTITY_FIELD": "username",

    #: The form field used to store the url parameter when redirecting to the login view.
    #: Default: ``"next"``
    "FORM_NEXT_FIELD": "next",

    #: The name of the "remember me" cookie.
    #: Default: ``"remember_me"``.
    "COOKIE_NAME": "remember_me",

    #: The session key to store cookie remember duration.
    #: It will be used when user login in.
    #: Default: ``"remember_seconds"``.
    "COOKIE_DURATION_SESSION_KEY": "remember_seconds",

    #: The key to store "remember" stats in session.
    #: Default: ``"remember"``.
    "COOKIE_SESSION_STATE_KEY": "remember",

    #: Whether the "remember me" cookie requires "Secure" attribute.
    #: Default: ``None``.
    "COOKIE_SECURE": None,

    #: The default domain name of the "remember me" cookie.
    #: Default: ``None``.
    "COOKIE_DOMAIN": None,

    #: The default path of the "remember me" cookie.
    #: Default: ``"/"``.
    "COOKIE_PATH": "/",

    #: Whether the "remember me" cookie uses HttpOnly or not.
    #: Default: ``False``.
    "COOKIE_HTTPONLY": False,

    #: Whether the "remember me" cookie will be refreshed by each request.
    #: Default: ``False``.
    "COOKIE_REFRESH_EACH_REQUEST": False,

    #: The mode to use session protection in.
    #: This can be either ``"basic"`` (the default) or ``"strong"``, or ``None`` to disable it.
    #: Default: ``"basic"``.
    "SESSION_PROTECTION": "basic",

    #: The key to store "fresh" stats in session.
    #: Default: ``"_fresh"``.
    "SESSION_FRESH_KEY": "_fresh",

    #: The key to store session identity in session.
    #: Default: ``"_sid"``.
    "SESSION_ID_KEY": "_sid",

    #: The key to pass the token in HTTP request header.
    #: Default: ``"X-Identity-Auth"``.
    "REQUEST_TOKEN_AUTHENTICATION_HEADER": "X-Identity-Auth",

    #: The parameter key to pass the token in HTTP request url.
    #: Default: ``"iauth"``.
    "REQUEST_TOKEN_AUTHENTICATION_ARG": "iauth",

    #: Specifies whether use build-in blueprint for user login and logout.
    #: Default: ``True``.
    "BLUEPRINT_ENABLED": True,

    #: Specifies the name for the build-in blueprint.
    #: Default: ``"identity"``.
    "BLUEPRINT_NAME": "identity",

    #: Specifies the url prefix for the build-in blueprint.
    #: Default: ``"/identity"``.
    "BLUEPRINT_URL_PREFIX": "/identity",

    #: Specifies the subdomain for the build-in blueprint.
    #: Default: ``None``.
    "BLUEPRINT_SUBDOMAIN": None,

    #: Specifies the templates folder for the build-in blueprint.
    #: Default: ``"templates"``.
    "BLUEPRINT_TEMPLATE_FOLDER": "templates",

    #: Specifies the "login" url for the build-in blueprint.
    #: Default: ``"/login"``.
    "BLUEPRINT_LOGIN_URL": "/login",

    #: Specifies the http method for the "login" url of the build-in blueprint.
    #: Default: ``["GET", "POST"]``.
    "BLUEPRINT_LOGIN_METHODS": ["GET", "POST"],

    #: Specifies the "logout" url for the build-in blueprint.
    #: Default: ``"/logout"``.
    "BLUEPRINT_LOGOUT_URL": "/logout",

    #: Specifies the http method for the "logout" url of the build-in blueprint.
    #: Default: ``["GET", "POST"]``.
    "BLUEPRINT_LOGOUT_METHODS": ["GET", "POST"],

    #: Specifies the template name for the "login" of the build-in blueprint.
    #: Default: ``"user_login.html"``.
    "BLUEPRINT_LOGIN_USER_TEMPLATE": "user_login.html",

    #: List of accepted password hashes.
    #: See `Passlib CryptContext docs on Constructor Keyword ``"schemes"``
    #: Example: ``["bcrypt", "argon2"]``
    #:      Creates new hashes with "bcrypt" and verifies existing hashes with "bcrypt" and "argon2".
    "HASH_SCHEMES": [
        "bcrypt",
        "argon2",
        "des_crypt",
        "pbkdf2_sha256",
        "pbkdf2_sha512",
        "sha256_crypt",
        "sha512_crypt",
        # And always last one...
        "plaintext",
    ],
    #: Dictionary of CryptContext keywords and hash options.
    #: See `Passlib CryptContext docs on Constructor Keywords`
    #: and `Passlib CryptContext docs on Algorithm Options`
    #: Example: ``dict(bcrypt__rounds=12, argon2__time_cost=2, argon2__memory_cost=512)``.
    #: Default: ``dict()``
    "HASH_OPTIONS": dict(),

    #: A set of HTTP methods which are exempt from `login_required`.
    #: Default: ``"OPTIONS"``.
    "EXEMPT_METHODS": ["OPTIONS"],

    #: Specifies the name for domain used for translations.
    #: Default: ``"flask_identity"``.
    "I18N_DOMAIN": "flask_identity",

    #: Specifies the directory containing the MO files used for translations.
    #: Default: ``[PATH_LIB]/flask_identity/translations``.
    "I18N_DIRNAME": pkg_resources.resource_filename("flask_identity", "translations"),

    #: Flask-WTF: Set to `False` to disable all CSRF protection.
    #: Default is ``True``
    "WTF_CSRF_ENABLED": True,

    #: Flask-WTF: When using the CSRF protection extension, this controls whether every view is protected by default.
    #: Default: ``True``
    "WTF_CSRF_CHECK_DEFAULT": True,

    #: Flask-WTF: Random data for generating secure tokens. If this is not set then SECRET_KEY is used.
    #: Default: ``None``
    "WTF_CSRF_SECRET_KEY": None,

    #: Flask-WTF: HTTP methods to protect from CSRF.
    #: Default is ``{"POST", "PUT", "PATCH", "DELETE"}``
    "WTF_CSRF_METHODS": {"POST", "PUT", "PATCH", "DELETE"},

    #: Flask-WTF: Name of the form field and session key that holds the CSRF token.
    #: Default: ``"csrf_token"``
    "WTF_CSRF_FIELD_NAME": "csrf_token",

    #: Flask-WTF: HTTP headers to search for CSRF token when it is not provided in the form.
    #: Default: ``["X-CSRFToken", "X-CSRF-Token"]``
    "WTF_CSRF_HEADERS": ["X-CSRFToken", "X-CSRF-Token"],

    #: Flask-WTF: Max age in seconds for CSRF tokens.
    #: If set to None, the CSRF token is valid for the life of the session.
    #: Default: ``3600``
    "WTF_CSRF_TIME_LIMIT": 3600,

    #: Flask-WTF: Whether to enforce the same origin policy by checking that the referrer matches the host.
    #: Only applies to HTTPS requests.
    #: Default: ``True``
    "WTF_CSRF_SSL_STRICT": True,

    #: Flask-WTF: Set to `False` to disable Flask-Babel I18N support.
    #: Also set to False if you want to use WTForms’s built-in messages directly.
    #: Default: ``True``
    "WTF_I18N_ENABLED": True,

    #: Specifies the endpoint to ignore CSRF check.
    #: Default: ``[]``
    "WTF_CSRF_IGNORE_UNAUTH_ENDPOINTS": []
}
