setup: don't constrain docutils version

Docutils maintains stable interface, and seems to be developed
at slow enough pace, so we can drop the upped version restriction.

auth: change default LDAP to LDAPS on port 636 - insecure authentication is kind of pointless

This will only change the default value for new systems. Existing installations
will keep using whatever value they have in the database.

hg: support Mercurial 4.1

There doesn't see to be any significant API changes.

auth: simplify the double invoked auth classes used for permission checking

Also avoid storing request state in the Has Permission instances. The instances
er temporary and only used once and there is thus not real problem, but it is
simpler and cleaner this way.

controllers: avoid setting request state in controller instances - set it in the thread global request variable

In TurboGears, controllers are singletons and we should avoid using instance
variables for any volatile data. Instead, use the "global thread local" request
context.

With everything in request, some use of c is dropped.

Note: kallithea/controllers/api/__init__.py still use instance variables that
will cause problems with TurboGears.

controllers: avoid setting constants as controller instance variables in __before__

Setting constants in __before__ is a weird pattern and we can do fine without doing it.
That makes it more clear that there is no state in the controller instances.

Real constants can just be set at the module level.

Some values depend on configuration and can thus probably not be set as
constants at module import time but could perhaps be set in __init__. But
reading configuration directly when needed will probably be just as good.

lib: move jsonify from utils to base

Suggested by Mads Kiilerich.

The jsonify method is the only thing in utils that directly uses pylons.
Move it to base where it fits better and we can use existing global imports.

admin: better handling of rescan/delete and invalidate at the same time (Issue #252)

It would try to invalidate deleted repositories before rescan would delete them.

Instead, scan first, then invalidate.

Also, handle VCS error from invalidation and report success as a flash message.

git: clarify that non-bare git repos not are supported (Issue #254)

Non-bare repos must have a branch checked out ... and then you can't push to
the branch.

mails: make title in header boxes slightly bolder

In my opinion, the top headers in the new mail styling seemed a bit "thin"
compared to the other headers.

template: drop spurious commit id on gravatar

The div had literally 'commit-id="${cs.raw_id}"'!

model: remove docstring code example

This type of code examples are not present in other files.
It is unclear whether this example is still accurate.
And it is equally unclear whether they provide real value compared to 'real'
code.

Remove it.

tests: replace yield_fixtures with plain fixtures

yield_fixtures and fixtures are the same since pytest-3.0, but the name
yield_fixture is now deprecated.

datatables: fix repo group sorting of repo name, last change and tip - indices were off by one

'orderData: 0' would be interpreted as false - thus we use the
'orderData: [0,]' syntax.

datatables: use more robust filter function for filtering repository names

This way it does not depend on a class attribute and it is more clear what it
does.

template: use Bootstrap tooltips and popover instead of handmade tooltips

Based on work from Andrew Shadura <andrew@shadura.me>.

Further modified by Mads Kiilerich.

show_changeset_tooltip is merged into tooltip_activate.

style: fix the CSS selector referring to the notification box

The notification box is shown by a CSS rule with this selector:

.dropdown.open .dropdown-menu

However, since 8bd7a63, the selector :nav.navbar #quick li #quick_login"
no longer refers to the same element.

To make the notification box work correctly, refer to it using its
class name, .dropdown-menu.

template: use Bootstrap compatible navbar markup

Based on work from Andrew Shadura <andrew@shadura.me>.

Further modified by Mads Kiilerich.

templates: use bootstrap for progress bars

Based on work form Andrew Shadura <andrew@shadura.me>.

Further modified by Mads Kiilerich.

templates: fix aria markup from 24a0c176a63d

The markup in base.html is a bit misleading. The "quick login" drop down menu
is not just the quick login box but also the "current user info" box.

When the user is logged in, the "real" quick login box isn't shown and the drop
menu's aria-describedby="quick_login_h" thus becomes an invalid reference.

To fix the reference, also call the user info for quick_login_h - that is
approximately correct.

style: use panel, panel-heading, panel-title, panel-body and settings

This imply lots of tweaking of header handling and panel spacing.

Not converted yet: codeblock code-header code-body.

Based on work by Dominik Ruf.

style: Boostrap-ish markup of footers

Based on work by Dominik Ruf.

style: apply Bootstrap-compatible table.table class, now when the conflicting div.table styling is gone

Based on work by Dominik Ruf.

style: rename div.table to Bootstrap .panel-body

Based on work by Dominik Ruf.

style: introduce pull-left and pull-right in more places

Based on work by Dominik Ruf.

style: introduce text-nowrap and avoid using direct white-space: nowrap

Based on work by Dominik Ruf.

style: refactor panel headings - use pull-left and pull-right and introduce clearfix like Bootstrap

Based on work by Dominik Ruf.

style: drop unnecessary <ul> markup

Based on work by Dominik Ruf.

style: introduce h2 h3 h4 h5 for emphasis and drop some explicit styling

Based on work by Dominik Ruf.

style: template markup changes for changeset.html, preparing for Bootstrap

Based on work by Dominik Ruf.

style: drop dead 'fields' class references

The last references to the class do not match anything essential, and all css
styles can thus also be removed.

Based on work by Dominik Ruf.

templates: use valid ids for input fields in hook settings so labels can reference them correctly

h.text will generate safe ids based on the name ... but these ids are not
available in the template for referencing from <label for=...>.

Instead, generate safe ids for the input fields.

templates: form inside h5 is not valid html

Make journal.html do the same as admin.html does.

templates: textarea doesn't have a size attribute - drop it!

We could use the rows attribute ... but so far it has worked without ...

templates: drop id="body" on body - it wasn't used and caused duplicate IDs

There are lots of
<div id="body" class="codeblock">
where the body id perhaps also could be dropped.

templates: replace invalid metatag attributes with data attributes

(We could also use plain classes ... but stick to the plan ...)

DataTables: update to 1.10.13 and add files for Bootstrap

cp ../DataTables/media/css/jquery.dataTables.css kallithea/public/css/jquery.dataTables.css
cp ../DataTables/media/js/jquery.dataTables.min.js kallithea/public/js/jquery.dataTables.min.js

Also add a couple of files that will be used for Bootstrap:

cp ../DataTables/media/css/dataTables.bootstrap.css kallithea/public/less/3rd-party/dataTables.bootstrap.css
cp ../DataTables/media/js/dataTables.bootstrap.js kallithea/public/js/dataTables.bootstrap.js

style: copy mergely.css to the location the Bootstrap port expects it

Minimize the Bootstrap diff while keeping the old references working without
having to expose the new css location directly.

hg: return 400 Bad Request for hg commands that not are commands

Avoid throwing bare Exceptions which requires framework specific testing.
Instead, return a reasonable http error code and make the test more framework
independent.

The "helpful" message will just be a description of the http exception and not
sent to the client.

cleanup: use standard NotImplementedError for abstract methods

From the Python docs on NotImplementedError:

In user defined base classes, abstract methods should raise this
exception when they require derived classes to override the method.

auth: add support for "Bearer" auth scheme (API key variant)

This allows the API key to be passed in a header instead of the query
string, reducing the risk of accidental API key leaks:

Authorization: Bearer <api key>

The Bearer authorization scheme is standardized in RFC 6750, though
used here outside the full OAuth 2.0 authorization framework. (Full
OAuth can still be added later without breaking existing users.)

auth: track API key used for authentication in AuthUser

This allows us to define only once how an API key is passed to the app.
We might e.g. allow API keys to be passed in an HTTP header; with this
change, we only need to update the code in one place.

Also change the code to verify up front that the API key resolved to a
valid and active user, so LoginRequired doesn't need to do that.

Also return plain 403 Forbidden for bad API keys instead of redirecting
to the login form, which makes more sense for non-interactive clients
(the typical users of API keys).

auth: add AuthUser.is_anonymous, along with some exposition

This reveals the name of the NotAnonymous decorator to be misleading,
an unfortunate detail only documented here, but which must be properly
resolved in a later changeset.

Note that NotAnonymous behaves as advertised as long as it is used
together with LoginRequired, which is always the case in the current
code, so there's no actual security issue here, the code is just weird,
hard to read and fragile.

---

Some thoughts on cleaning this up in a future changeset: As it turns
out, every controller (except the login page!) should be LoginRequired
decorated (since it doesn't actually block anonymous users, as long as
anonymous access is enabled in the Kallithea config). Thus the most
obvious solution would be to move the LoginRequired functionality into
BaseController (with an override for LoginController), and delete the
decorator entirely. However, LoginRequired does one other thing: it
carries information about whether API access is enabled for individual
controller methods ("@LoginRequired(api_key=True)"), and also performs
the check for this, something which is not easily moved into the base
controller class, since the base controller doesn't know which method is
about to be called. Possibly that can be determined by poking Pylons,
but such code is likely to break with the upcoming TurboGears 2 move.
Thus such cleanup is probably better revisited after the switch to TG2.

auth: perform basic HTTP security checks already in BaseController

There's no reason to postpone these to a LoginRequired decorated
controller function. This way, they run unconditionally for all
subclasses of BaseController (so everything except JSON-RPC and
VCS controllers).

compare: remove old Dulwich hack

We no longer support Dulwich 0.9.9, so don't need the workaround.

test: bump pytest minimum version

Recent test case changes broke compatibility with pytest < 3.0.

FYI, the ~= version spec is a shorthand (PEP 440) used here to select
"3.0 or any later 3.* release". We could probably use this more often.

style: don't apply this text field styling to buttons

These recently introduced style rules were a bit too broad.

middleware: drop gzipper middleware

It added unfortunate buffering, was only enabled for static_files=true, and
isn't available for TurboGears2.

If necessary, it is better to configure the web server to provide it.

settings: fix saving of visual settings of page size

After 19f15cde2cdb it was no longer to save page_size because formfill didn't
match. Back out a part of that changeset.

style: fix pull request styling

My recent changes broke it. Add some band aid to help it. The pull request page
might not be a perfect fit for Bootstrap forms, but that is a better
approximation than nothing.

tests: give test_pullrequests a test_context in addition to the usual app_fixture

test_pullrequests has unit-ish tests that invoke library functions directly ...
but these happen to require localization initialized. For TG2 we only have
localization initialized when we have a test_context. Thus, additionally wrap
these tests in a test_context.

tests: avoid test_pullrequests keeping dead sqlalchemy repository instance around outside transaction

The previous behaviour happened to work but is fragile when things change -
such as migrating to TG2.

validators: remove unneeded M/StateObj classes

The M class is actually a wrapper around formencode.api.Validator.message,
inserting a translator into the 'state' object. Setting a translator into
the state object is indeed what is mentioned in the formencode docs.

But, if you work this way, the custom state should be set both for custom
validators, as well as for validators that are simple wrappers around
formencode's default validators (for example wrappers that just set a custom
message string). And the latter is what Kallithea is currently _not_ doing.

Also, when using formencode.api.Validator.message correctly, you should not
use the translator function _ on your validator strings manually.

Remove the inconsistency in Kallithea validators as follows:
- remove M and StateObj classes
- replace the usage of M by direct calls to self.message (which is now no
longer in charge of translating but simply of mapping a keyword onto the
right message)
- translation will be done by explicit _ calls at Kallithea side, so that
formencode directly receives translated strings.

forms: wrap LoginForm inside function like other forms

All forms except LoginForm are wrapped inside a function. The original
purpose of this wrapping seems to be the ability to pass parameters to tweak
the form.

But, this also has another desired effect: translation of strings
wrapped with _ is no longer attempted when reading the class definition, but
only when the function is instantiated. In the former case, it is not
guaranteed that a translator is actually available because we are not
running in standard application context.

Align LoginForm with the others.

style: tweak markup for API key admin

The labels were odd - this gives a better starting point for a good Bootstrap UI.

TODO after Bootstrap: Don't use a label as header for the "Add" section.

style: consistently use label markup wrapping around input elements

The 'for="..."' markup is error prone.

style: add missing 'form-control' markup

Based on work by Dominik Ruf.

style: introduce Bootstrap compatible form-inline markup

Based on work by Dominik Ruf.

style: drop 'textarea' class inside 'form-group'

Temporarily, just apply styling to div inside form-group. Also, 'radios' is gone.

Based on work by Dominik Ruf.

style: drop 'select' class inside 'form-group'

Temporarily, just apply styling to div inside form-group. Also, 'radios' is gone.

Based on work by Dominik Ruf.