vcs: invalidate repo caches _after_ a push finishes

Caches were invalidated right after creating the result iterator, before
actually applying the change. Caches would thus be refreshed too early and soon
be outdated.

This bug was especially seen causing errors with missing revisions when
creating PRs right after pushing.

docs: cleanup of casing, markup and spacing of headings

Mostly stuff found and fixed by Søren, extracted here to separate things.

Other uses of title casing might be debatable, but here it was just a few
documentation headings that clearly were inconsistent with the majority.

spelling: use "email" consistently

The common English spelling is "email", not "e-mail" (and was indeed
also the most common, but not only, variant in the Kallithea UI).

http://grammarist.com/style/e-mail-email/

tests: add regex version of checkSessionFlash

This is needed to match more complex messages.

spelling: unify messages for repository locking

Normalize phrasing and capitalization of repository locking messages.
This also avoids the piecing together of sentence fragments in a way
that can cause i18n headaches.

misc: remove alt-text from Gravatar images

The alternative text should convey the same information as the image,
something which the text "gravatar" does not. (In a context where the
gravatar is used on its own, the username could be a useful alt-text
- and title-text - but it's not apparent that this is ever the case.)

pullrequests: require extra confirmation before deleting a PR with comments

Make sure we don't lose any valueable data. A PR without comments doesn't have
much value.

docs: improve documentation of beaker session configuration

beaker.session.auto is dropped; it defaults to false and there is no reason to
ever set it true for Kallithea.

beaker.session.cookie_path and secure are dropped; like cookie_domain, they
should automatically be set to the right value.
* * *
beaker.session.cookie_expires MUST have the default value of True to provide the default value of 'browser session lifetime' when not enabling 'remember' in the login box. The cookie life is hardcoded to 365 days when remember is selected.

cleanup: fix some risky variable redefinitions

Found with pyflakes.

cleanup: remove unused imports

Found with pyflakes.

db: better handling of decoding of changeset_cache values from the database

Do some validation of the data to prevent that incorrect data cause weird
failures when they are used later on.

comments: move spacing around status radio buttons to css

Convenient when we add more radio buttons.

comments: fix warning when unloading page with unsaved comments

e87baa8f1c5b broke the existing check. Instead, only set the
comment-inline-form class when it actually is an inline form and use that class
for finding comments.

comments: browser display of context around url #targets should only be used for diff comments

24d01c64c5f3 had the unintended side-effect of not only highlighting the linked
line in file view but also the spacing above it. For now, instead of changing
the markup, restrict the fancy #target offsets to comments.

tox.ini: declare 1.8 as minimum tox version

Older tox versions will fail with
tox.ConfigError: ConfigError: substitution key '26,27' not found

Older tox versions will apparently not understand minversion anyway, but
at least it states the intent ...

js: refactor AutoComplete functions to pass jQuery results around until DOM elements are passed to YUI

A small step forward that enables other refactorings.

pullrequests: avoid unnecessary scroll-bar on short lists of available updates with Chrome

The surrounding div will apparently take size after the content but miss that
there also is 1 pixel border ... and when drawing it realizes that there isn't
enough space and it adds scroll bars anyway.

Work around that by giving the surrounding box 1 pixel padding.

graphs: set initial canvas size to 0

The canvas will be set to the right size when the page has loaded. Until the
page has been loaded, Chrome has been seen to set the canvas to be so wide that
it would cover other visible links, thus preventing navigating away from the
page before it has been fully loaded.

This will make sure the canvas never takes up more space than intended.

comments: bind comment-bubble click handler to table and use sub selector

Avoid jQuery looping over all lines and binding comment-bubble click handler to
every line on page load.

Avoids 'Maximum call stack size exceeded' when loading a huge diff in Chrome.

helpers: drop incorrect % escaping in fancy_file_stats

% should not be escaped when not doing % formatting.

setup: reintroduce nosetests support that was removed in Pylons after 1.0.0

Use workaround from https://github.com/Pylons/pylons/issues/13 .

setup: drop unused simplejson dependency

c796b6bdd532 removed the use of it but didn't drop the dependency.

cleanup: make module self-naming consistent

The self naming is quite pointless ... but at least make it right.

cleanup: consistently use 'except ... as ...:'

Use the Python 2.6+ syntax instead of the old confusing 'except ..., ...'
syntax.

kallithea_config: properly handle Unicode characters in .ini template

template.ini.mako declares itself as UTF-8, but actually putting unicode in the
file made kallithea_config.py fail with UnicodeEncodeError.

Fix by making sure the template is read as UTF-8.

vcs: remove pointless stream reopening / seeking in hg fill_archive

test_archival started failing after 8e72e78a7d9e refactored the controller to
pass a stream created by fdopen.

The failure was in code that doesn't make any difference anyway - just kill it.

i18n: updated translation for Belarusian

Currently translated at 86.5% (965 of 1115 strings)

i18n: updated translation for German

Currently translated at 65.6% (733 of 1116 strings)

i18n: updated translation for French

Currently translated at 65.5% (732 of 1116 strings)

e-mail: add documentation about configuration settings

Document e-mail related configuration settings in the documentation
(overview) and the .ini file itself (technical details and example
settings).

e-mail: add some default values and some examples to .ini file as comments

This includes a replacement of @localhost examples to @example.com, to
indicate that real addresses should normally be used.

comments: when linking to specific comments, make the browser show a bit of the context of the comment

Make the link targets have an invisible pre: that goes 100px above the target.

comments: previous/next links should only be to first comment for a given line

Before, each comment had its own link to previous/next comment - also if it was
right before/after in the same thread. Comments right before/after in the same
thread are however easy to navigate to with scrolling or arrow keys or
pageup/down. Navigating to the next thread could take a lot of clicks to cycle
through every single comment ever made.

Instead, just show the link at the top of each thread and let the links
navigate between threads.

This also make long threads use less vertical space.

One downside of this change is that it for long threads takes a bit more work
to get from the last comment in a thread to the next thread.

comments: rework/rewrite javascript for inline comment handling

There shouldn't be any functional changes here, but the focus has been on doing
the right thing instead of looking at how it was before.

Incremental cleanup did not seem feasible. I think this is more readable and
maintainable than before ... at least for me.

Existing snippets has been reused when reimplementing. The new implementation
focus on being as simple as possible and well-structured. jQuery and data
attributes are used instead of custom implementations. Some existing functions
have been modified or renamed, others have been removed when they no longer
were needed.

mercurial: support Mercurial 3.5

test_archive failed without the hgcompat workaround.

pylons: support Pylons 1.0.2

Pylons 1.0.2 requires webob>=1.1.1 and Pylons 1.0.0 seemed to have problems
with later versions so stick the minimum version for now.

e-mail: properly handle no recipients when there is no email_to set

When the configuration file does not contain a value for email_to, and no
recipients are specified in a call to send_email, recipients would be set to
[None, admins]
which causes an error when logging this list as ' '.join(recipients).

e-mail: revive dead code that checks for unspecified recipients

Commit 609e06b6c52f6a8ea9581372805c4bbb60db81a1 introduced dead code:
in the beginning of send_email an assert verifies that recipients is of type
'list', so checking it for None later is useless and that branch can never
be reached.

Instead of removing the dead code, revive it and add a test case.

e-mail: add trivial test case

Add a first trivial e-mail test, new tests to be added in subsequent
commits.

privacy: don't tell users what is the reason for a failed login

Makes it harder for strangers to probe the instance for presence of
certain users. This can make it harder to break in, as it is now
harder to tell is a username or a password are wrong, so bruteforcing
should probably take a bit longer if you don't know what exactly are
you doing.

auth: make sure that users only can manage their own primary data if self registration is enabled

With the UI showing exactly which fields are used and which are ignored, there
is no reason to show the 'External Source of Record' warning.

css: match on the readonly-ness instead of explicitly setting 'disabled' class on input elements

Note: the 'disabled' class is 'readonly' and different from the html/css
'disabled' concept.

users: cleanup of handling of the extern_type and extern_name fields in html forms

Note: There is controller support for editing extern_type and extern_name but no UI.

users: avoid unnecessary handling of c.extern_type and c.extern_name when editing users

It is user data as anything else.

tests: basic tests that the pam and crowd auth modules can be enabled

Will at least give a minimal check for syntax errors ...

auth: turn dead AuthUser code into assertion

The result of db.User.get_dict never contains the keys 'api_keys' or
'permissions'. The keys returned by get_dict are 1) all the User table
columns, 2) the keys explicitly defined in User.__json__, and 3) the
keys defined in User.get_api_data, none of which include the two
blacklisted keys.

'api_keys' would be returned if __json__ called get_api_data with
argument details=True; but currently that is not the case.

In case there's a reason why these two keys must never appear in an
AuthUser object, the check has not been removed entirely; instead, it's
been turned into an assertion. This way, it will be noticed if __json__
is later modified to request detailed API data, for instance.

auth: move UserModel.fill_data to AuthUser

Because the method is only used by AuthUser, and also because it's an
awful thing to do (copying a large but ill-defined set of attributes
from one object to another), and we don't want usage to spread.

auth: construct AuthUser from either user_id or db.User object

If the caller already has the database User object, there's no reason
for AuthUser to look it up again.

The `api_key` lookup functionality is dropped, because 1) it's only
used in one place, and 2) it's simple enough for the caller to do the
lookup itself.

The `user_id` lookup functionality is kept, because 1) it's frequently
used, and 2) far from a simple `User.get(id)` lookup, it has a complex
interaction with UserModel. (That cleanup will have to wait for another
day.)

All calls of the form `AuthUser(user_id=x.user_id)` can be replaced with
`AuthUser(dbuser=x)`, assuming `x` is a db.User. However, verifying that
assumption requires a manual audit of every call site, since `x` might
also be another `AuthUser` object, for instance. Therefore, only the
most obvious call sites have been fixed here.

auth: fold AuthUser._propagate_data into constructor

This simplifies both the program and data flow.

auth: refactor user lookup in AuthUser constructor for clarity

First, note that `fill_data` checks that the specified `db.User` is
`active` before copying anything, and returns False if not.

Now, previously when calling e.g. `AuthUser(user_id=anonymous_user_id)`,
`_propagate_data` would explicitly refuse to look up the anonymous
user, but then fall back to the anonymous user anyway (if `active`),
or use None values (if not `active`).

Given the same situation, the new code simply looks up the anonymous
user like it would any other user, and copies data using `fill_data`.
If the anonymous user is not `active`, we fall back to the existing
code path and behave as before (that is, use None values).

auth: remove username from AuthUser session cookie

There's no reason to store the username when we store the user ID. We
have load the user from database anyway under all circumstances, to
verify e.g. that the user is (still) active.

This does not impact application code, but does impact a number of test
cases which explicitly checks the username stored in the session.

auth: remove username lookup support from AuthUser constructor

The previous changeset means that there are no more callers using the
`username` argument to AuthUser.__init__; it can be removed.

auth: remove redundant AuthUser constructor arguments

AuthUser looks up the user based on the first of `user_id`, `api_key`
and `username` that is not None *and* does not refer to the default
(anonymous) user. In practice, the arguments always refer to the same
user, so there's no point in specifying more than one of them.

auth: have fill_data take User object, not lookup key

Simplify the UserModel.fill_data interface by passing the actual db.User
object instead of a key by which it can be looked up. This also saves a
lookup in case the db.User is already loaded (which for now is only the
case in one place, but that'll change in the following changesets).

Also enhance fill_data docstring.

UserModel: remove methods that are redundant with db.User

UserModel().get_by_api_key is exactly equivalent to User.get_by_api_key.

UserModel's get_by_username and get_by_email are not exactly identical
to their db.User counterparts, due to a difference in the order of
optional arguments. Fortunately, these optional arguments are never
used.

auth: remove redundant hashlib imports

hashlib is already imported at the top of the module (regardless of OS).