builds: Load all builds with the group

[pbs.git] / src / buildservice / users.py

#!/usr/bin/python3

import asyncio
import base64
import binascii
import cryptography.hazmat.backends
import cryptography.hazmat.primitives.asymmetric.ec
import cryptography.hazmat.primitives.asymmetric.utils
import cryptography.hazmat.primitives.ciphers
import cryptography.hazmat.primitives.ciphers.aead
import cryptography.hazmat.primitives.hashes
import cryptography.hazmat.primitives.kdf.hkdf
import cryptography.hazmat.primitives.serialization
import datetime
import email.utils
import functools
import json
import ldap
import logging
import os
import pickle
import struct
import threading
import time
import urllib.parse

import tornado.locale

import sqlalchemy
from sqlalchemy import BigInteger, Boolean, Column, DateTime, ForeignKey, Integer
from sqlalchemy import Interval, LargeBinary, Text, UUID

from . import base
from . import bugtracker
from . import builds
from . import database
from . import httpclient
from . import jobs
from . import packages
from . import repos
from . import uploads

from .decorators import *

DEFAULT_STORAGE_QUOTA = 256 * 1024 * 1024 # 256 MiB

# Setup logging
log = logging.getLogger("pbs.users")

# A list of LDAP attributes that we fetch
LDAP_ATTRS = (
	# UID
	"uid",

	# Common Name
	"cn",

	# First & Last Name
	"givenName", "sn",

	# Email Addresses
	"mail",
	"mailAlternateAddress",
)

class QuotaExceededError(Exception):
	pass

class Users(base.Object):
	def init(self):
		# Initialize thread-local storage
		self.local = threading.local()

	@property
	def ldap(self):
		if not hasattr(self.local, "ldap"):
			# Fetch the LDAP URI
			ldap_uri = self.backend.config.get("ldap", "uri")

			log.debug("Connecting to %s..." % ldap_uri)

			# Establish LDAP connection
			self.local.ldap = ldap.initialize(ldap_uri)

		return self.local.ldap

	async def __aiter__(self):
		users = await self._get_users("""
			SELECT
				*
			FROM
				users
			WHERE
				deleted_at IS NULL
			ORDER BY
				name
			""",
		)

		return aiter(users)

	def _ldap_query(self, query, attrlist=None, limit=0, search_base=None):
		search_base = self.backend.config.get("ldap", "base")

		log.debug("Performing LDAP query (%s): %s" % (search_base, query))

		t = time.time()

		# Ask for up to 512 results being returned at a time
		page_control = ldap.controls.SimplePagedResultsControl(True, size=512, cookie="")

		results = []
		pages = 0

		# Perform the search
		while True:
			response = self.ldap.search_ext(search_base,
				ldap.SCOPE_SUBTREE, query, attrlist=attrlist, sizelimit=limit,
				serverctrls=[page_control],
			)

			# Fetch all results
			type, data, rmsgid, serverctrls = self.ldap.result3(response)

			# Append to local copy
			results += data
			pages += 1

			controls = [c for c in serverctrls
				if c.controlType == ldap.controls.SimplePagedResultsControl.controlType]

			if not controls:
				break

			# Set the cookie for more results
			page_control.cookie = controls[0].cookie

			# There are no more results
			if not page_control.cookie:
				break

			# Log time it took to perform the query
			log.debug("Query took %.2fms (%s page(s))" % ((time.time() - t) * 1000.0, pages))

		# Return all attributes (without the DN)
		return [attrs for dn, attrs in results]

	def _ldap_get(self, *args, **kwargs):
		results = self._ldap_query(*args, **kwargs)

		# No result
		if not results:
			return {}

		# Too many results?
		elif len(results) > 1:
			raise OverflowError("Too many results returned for ldap_get()")

		return results[0]

	async def create(self, name, notify=False, storage_quota=None):
		"""
			Creates a new user
		"""
		# Set default for storage quota
		if storage_quota is None:
			storage_quota = DEFAULT_STORAGE_QUOTA

		# Insert into database
		user = await self.db.insert(
			User,
			name          = name,
			storage_quota = storage_quota,
		)

		log.debug("Created user %s" % user)

		# Send a welcome email
		if notify:
			await user._send_welcome_email()

		return user

	async def get_by_name(self, name):
		"""
			Fetch a user by its username
		"""
		stmt = (
			sqlalchemy
			.select(User)
			.where(
				User.deleted_at == None,
				User.name == name,
			)
		)

		# Fetch the user from the database
		user = await self.db.fetch_one(stmt)
		if user:
			return user

		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot use get_by_name test mode")
			return

		# Search in LDAP
		res = self._ldap_get(
			"(&"
				"(objectClass=person)"
				"(uid=%s)"
			")" % name,
			attrlist=("uid",),
		)
		if not res:
			return

		# Fetch the UID
		uid = res.get("uid")[0].decode()

		# Create a new user
		return await self.create(uid)

	async def get_by_email(self, mail):
		# Strip any excess stuff from the email address
		name, mail = email.utils.parseaddr(mail)

		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot use get_by_email in test mode")
			return

		# Search in LDAP
		try:
			res = self._ldap_get(
				"(&"
					"(objectClass=person)"
					"(|"
						"(mail=%s)"
						"(mailAlternateAddress=%s)"
					")"
				")" % (mail, mail),
				attrlist=("uid",),
			)

		except OverflowError as e:
			raise OverflowError("Too many results for search for %s" % mail) from e

		# No results
		if not res:
			return

		# Fetch the UID
		uid = res.get("uid")[0].decode()

		return await self.get_by_name(uid)

	async def _search_by_email(self, mails, include_missing=True):
		"""
			Takes a list of email addresses and returns all users that could be found
		"""
		users = []

		for mail in mails:
			user = await self.get_by_email(mail)

			# Include the search string if no user could be found
			if not user and include_missing:
				user = mail

			# Skip any duplicates
			if user in users:
				continue

			users.append(user)

		return users

	async def search(self, q, limit=None):
		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot search for users in test mode")
			return []

		# Search for an exact match
		user = await self.get_by_name(q)
		if user:
			return [user]

		res = self._ldap_query(
			"(&"
				"(objectClass=person)"
				"(|"
					"(uid=%s)"
					"(cn=*%s*)"
					"(mail=%s)"
					"(mailAlternateAddress=%s)"
				")"
			")" % (q, q, q, q),
			attrlist=("uid",),
			limit=limit,
		)

		# Fetch users
		stmt = (
			sqlalchemy
			.select(User)
			.where(
				User.deleted_at == None,
				User.name in [row.get("uid")[0].decode() for row in res],
			)
			.order_by(
				User.name,
			)
		)

		# Return as list
		return await self.db.fetch_as_list(stmt)

	@functools.cached_property
	def build_counts(self):
		"""
			Returns a CTE that maps the user ID and the total number of builds
		"""
		return (
			sqlalchemy
			.select(
				# User ID
				builds.Build.owner_id.label("user_id"),

				# Count all builds
				sqlalchemy.func.count(
					builds.Build.id
				).label("count"),
			)
			.where(
				builds.Build.owner_id != None,
				builds.Build.test == False,
			)
			.group_by(
				builds.Build.owner_id,
			)
			.cte("build_counts")
		)

	async def get_top(self, limit=50):
		"""
			Returns the top users (with the most builds)
		"""
		stmt = (
			sqlalchemy
			.select(User)
			.join(
				self.build_counts,
				self.build_counts.c.user_id == User.id,
			)
			.where(
				User.deleted_at == None,
			)
			.order_by(
				self.build_counts.c.count.desc(),
			)
			.limit(50)
		)

		# Run the query
		return await self.db.fetch_as_list(stmt)

	@functools.cached_property
	def build_times(self):
		"""
			This is a CTE to easily access a user's consumed build time in the last 24 hours
		"""
		return (
			sqlalchemy

			.select(
				# Fetch the user by its ID
				User.id.label("user_id"),

				# Sum up the total build time
				sqlalchemy.func.sum(
					sqlalchemy.func.coalesce(
						jobs.Job.finished_at,
						sqlalchemy.func.current_timestamp()
					)
					- jobs.Job.started_at,
				).label("used_build_time"),
			)

			# Join builds & jobs
			.join(
				builds.Build,
				builds.Build.owner_id == User.id,
			)
			.join(
				jobs.Job,
				jobs.Job.build_id == builds.Build.id,
			)

			# Filter out some things
			.where(
				User.deleted_at == None,
				User.daily_build_quota != None,

				# Jobs must have been started
				jobs.Job.started_at != None,

				sqlalchemy.or_(
					jobs.Job.finished_at == None,
					jobs.Job.finished_at >=
						sqlalchemy.func.current_timestamp() - datetime.timedelta(hours=24),
				),
			)

			# Group by user
			.group_by(
				User.id,
			)

			# Make this into a CTE
			.cte("user_build_times")
		)

	@functools.cached_property
	def exceeded_quotas(self):
		return (
			sqlalchemy

			.select(
				User.id,
				self.build_times.c.used_build_time,
			)
			.where(
				#User.daily_build_quota != None,
				self.build_times.c.used_build_time >= User.daily_build_quota,
			)

			# Make this into a CTE
			.cte("user_exceeded_quotas")
		)

	# Push Notifications

	@property
	def vapid_public_key(self):
		"""
			The public part of the VAPID key
		"""
		return self.backend.config.get("vapid", "public-key")

	@property
	def vapid_private_key(self):
		"""
			The private part of the VAPID key
		"""
		return self.backend.config.get("vapid", "private-key")

	@functools.cache
	def get_application_server_key(self):
		"""
			Generates the key that we are sending to the client
		"""
		lines = []

		for line in self.vapid_public_key.splitlines():
			if line.startswith("-"):
				continue

			lines.append(line)

		# Join everything together
		key = "".join(lines)

		# Decode the key
		key = base64.b64decode(key)

		# Only take the last bit
		key = key[-65:]

		# Encode the key URL-safe
		key = base64.urlsafe_b64encode(key).strip(b"=")

		# Return as string
		return key.decode()


class User(database.Base, database.BackendMixin, database.SoftDeleteMixin):
	__tablename__ = "users"

	def __str__(self):
		return self.realname or self.name

	def __hash__(self):
		return hash(self.id)

	def __lt__(self, other):
		if isinstance(other, self.__class__):
			return self.name < other.name

		elif isinstance(other, str):
			return self.name < other

		return NotImplemented

	def to_json(self):
		return {
			"name"     : self.name,
		}

	# ID

	id = Column(Integer, primary_key=True)

	# Name

	name = Column(Text, nullable=False)

	# Link

	@property
	def link(self):
		return "/users/%s" % self.name

	async def delete(self):
		await self._set_attribute("deleted", True)

		# Destroy all sessions
		for session in self.sessions:
			session.destroy()

	# Fetch any attributes from LDAP

	@functools.cached_property
	def attrs(self):
		# Use the stored attributes (only used in the test environment)
		#if self.data._attrs:
		#	return pickle.loads(self.data._attrs)
		#
		return self.backend.users._ldap_get("(uid=%s)" % self.name, attrlist=LDAP_ATTRS)

	def _get_attrs(self, key):
		return [v.decode() for v in self.attrs.get(key, [])]

	def _get_attr(self, key):
		for value in self._get_attrs(key):
			return value

	# Realname

	@property
	def realname(self):
		return self._get_attr("cn") or ""

	@property
	def email(self):
		"""
			The primary email address
		"""
		return self._get_attr("mail")

	@property
	def email_to(self):
		"""
			The name/email address of the user in MIME format
		"""
		return email.utils.formataddr((
			self.realname or self.name,
			self.email or "invalid@invalid.tld",
		))

	async def send_email(self, *args, **kwargs):
		return await self.backend.messages.send_template(
			*args,
			recipient=self,
			locale=self.locale,
			**kwargs,
		)

	async def _send_welcome_email(self):
		"""
			Sends a welcome email to the user
		"""
		await self.send_email("users/messages/welcome.txt")

	# Admin

	admin = Column(Boolean, nullable=False, default=False)

	# Admin?

	def is_admin(self):
		return self.admin is True

	# Locale

	@property
	def locale(self):
		return tornado.locale.get()

	# Avatar

	def avatar(self, size=512):
		"""
			Returns a URL to the avatar the user has uploaded
		"""
		return "https://people.ipfire.org/users/%s.jpg?size=%s" % (self.name, size)

	# Permissions

	def has_perm(self, user):
		"""
			Check, if the given user has the right to perform administrative
			operations on this user.
		"""
		# Anonymous people have no permission
		if user is None:
			return False

		# Admins always have permission
		if user.is_admin():
			return True

		# Users can edit themselves
		if user == self:
			return True

		# No permission
		return False

	# Sessions

	sessions = sqlalchemy.orm.relationship("Session", back_populates="user")

	# Bugzilla API Key

	bugzilla_api_key = Column(Text)

	# Bugzilla

	async def connect_to_bugzilla(self, api_key):
		bz = bugtracker.Bugzilla(self.backend, api_key)

		# Does the API key match with this user?
		if not self.email == await bz.whoami():
			raise ValueError("The API key does not belong to %s" % self)

		# Store the API key
		self.bugzilla_api_key = api_key

	@functools.cached_property
	def bugzilla(self):
		"""
			Connection to Bugzilla as this user
		"""
		if self.bugzilla_api_key:
			return bugtracker.Bugzilla(self.backend, self.bugzilla_api_key)

	# Build Quota

	daily_build_quota = Column(Interval)

	# Build Times

	async def get_used_daily_build_quota(self):
		# Fetch the build time from the CTE
		stmt = (
			sqlalchemy
			.select(
				self.backend.users.build_times.c.used_build_time,
			)
			.where(
				self.backend.users.build_times.c.user_id == self.id,
			)
		)

		# Fetch the result
		return await self.db.select_one(stmt, "used_build_time") or datetime.timedelta(0)

	async def has_exceeded_build_quota(self):
		if not self.daily_build_quota:
			return False

		return await self.get_used_daily_build_quota() >= self.daily_build_quota

	# Storage Quota

	storage_quota = Column(BigInteger)

	async def has_exceeded_storage_quota(self, size=None):
		"""
			Returns True if this user has exceeded their quota
		"""
		# Skip quota check if this user has no quota
		if not self.storage_quota:
			return

		return await self.get_disk_usage() + (size or 0) >= self.storage_quota

	async def check_storage_quota(self, size=None):
		"""
			Determines the user's disk usage
			and raises an exception when the user is over quota.
		"""
		# Raise QuotaExceededError if this user is over quota
		if self.has_exceeded_storage_quota(size=size):
			raise QuotaExceededError

	async def get_disk_usage(self):
		"""
			Returns the total disk usage of this user
		"""
		source_packages = sqlalchemy.orm.aliased(packages.Package)
		binary_packages = sqlalchemy.orm.aliased(packages.Package)

		# Uploads
		upload_disk_usage = (
			sqlalchemy
			.select(
				uploads.Upload.size
			)
			.where(
				uploads.Upload.user == self,
				uploads.Upload.expires_at > sqlalchemy.func.current_timestamp(),
			)
		)

		# Source Packages
		source_package_disk_usage = (
			sqlalchemy
			.select(
				source_packages.filesize
			)
			.select_from(
				builds.Build,
			)
			.join(
				source_packages,
				source_packages.id == builds.Build.pkg_id,
			)
			.where(
				# All objects must exist
				source_packages.deleted_at == None,
				builds.Build.deleted_at == None,

				# Don't consider test builds
				builds.Build.test == False,

				# The build must be owned by the user
				builds.Build.owner == self,
			)
		)

		# Binary Packages
		binary_package_disk_usage = (
			sqlalchemy
			.select(
				binary_packages.filesize,
			)
			.select_from(
				builds.Build,
			)
			.join(
				jobs.Job,
				jobs.Job.build_id == builds.Build.id,
			)
			.join(
				jobs.JobPackage,
				jobs.JobPackage.job_id == jobs.Job.id,
			)
			.join(
				binary_packages,
				binary_packages.id == jobs.JobPackage.pkg_id,
			)
			.where(
				# All objects must exist
				binary_packages.deleted_at == None,
				builds.Build.deleted_at == None,
				jobs.Job.deleted_at == None,

				# Don't consider test builds
				builds.Build.test == False,

				# The build must be owned by the user
				builds.Build.owner == self,
			)
		)

		# Build Logs
		build_log_disk_usage = (
			sqlalchemy
			.select(
				jobs.Job.log_size
			)
			.select_from(
				builds.Build,
			)
			.join(
				jobs.Job,
				jobs.Job.build_id == builds.Build.id,
			)
			.where(
				# All objects must exist
				builds.Build.deleted_at == None,
				jobs.Job.deleted_at == None,

				# Don't consider test builds
				builds.Build.test == False,

				# The build must be owned by the user
				builds.Build.owner == self,
			)
		)

		# Pull everything together
		disk_usage = (
			sqlalchemy
			.union_all(
				upload_disk_usage,
				source_package_disk_usage,
				binary_package_disk_usage,
				build_log_disk_usage,
			)
			.cte("disk_usage")
		)

		# Add it all up
		stmt = (
			sqlalchemy
			.select(
				sqlalchemy.func.sum(
					disk_usage.c.size
				).label("disk_usage"),
			)
		)

		# Run the query
		return await self.db.select_one(stmt, "disk_usage") or 0

	# Stats

	async def get_total_builds(self):
		stmt = (
			sqlalchemy
			.select(
				self.backend.users.build_counts.c.count.label("count"),
			)
			.select_from(self.backend.users.build_counts)
			.where(
				self.backend.users.build_counts.c.user_id == self.id,
			)
		)

		# Run the query
		return await self.db.select_one(stmt, "count") or 0

	async def get_total_build_time(self):
		"""
			Returns the total build time
		"""
		stmt = (
			sqlalchemy
			.select(
				sqlalchemy.func.sum(
					sqlalchemy.func.coalesce(
						jobs.Job.finished_at,
						sqlalchemy.func.current_timestamp()
					)
					- jobs.Job.started_at,
				).label("total_build_time")
			)
			.join(
				builds.Build,
				builds.Build.id == jobs.Job.build_id,
			)
			.where(
				jobs.Job.started_at != None,
				builds.Build.owner == self,
			)
		)

		return await self.db.select_one(stmt, "total_build_time")

	# Custom repositories

	async def get_repos(self, distro=None):
		"""
			Returns all custom repositories
		"""
		stmt = (
			sqlalchemy
			.select(repos.Repo)
			.where(
				repos.Repo.deleted_at == None,
				repos.Repo.owner == self,
			)
			.order_by(
				repos.Repo.name,
			)
		)

		# Filter by distribution
		if distro:
			stmt = stmt.where(
				repos.Repo.distro == distro,
			)

		return await self.db.fetch_as_list(stmt)

	async def get_repo(self, distro, slug=None):
		"""
			Fetches a single repository
		"""
		# Return the "home" repository if slug is empty
		if slug is None:
			slug = self.name

		stmt = (
			sqlalchemy
			.select(repos.Repo)
			.where(
				repos.Repo.deleted_at == None,
				repos.Repo.owner == self,
				repos.Repo.distro == distro,
				repos.Repo.slug == slug,
			)
		)

		return await self.db.fetch_one(stmt)

	# Uploads

	def get_uploads(self):
		"""
			Returns all uploads that belong to this user
		"""
		stmt = (
			sqlalchemy
			.select(uploads.Upload)
			.where(
				uploads.Upload.user == self,
				uploads.Upload.expires_at > sqlalchemy.func.current_timestamp(),
			)
			.order_by(
				uploads.Upload.created_at.desc(),
			)
		)

		return self.db.fetch(stmt)

	# Push Subscriptions

	async def is_subscribed(self):
		"""
			Returns True if the user is subscribed.
		"""
		subscriptions = await self.get_subscriptions()

		return True if subscriptions else False

	async def get_subscriptions(self):
		"""
			Fetches all current subscriptions
		"""
		stmt = (
			sqlalchemy
			.select(
				UserPushSubscription,
			)
			.where(
				UserPushSubscription.user == self,
			)
			.order_by(
				UserPushSubscription.created_at.asc(),
			)
		)

		return await self.db.fetch_as_list(stmt)

	async def subscribe(self, endpoint, p256dh, auth, user_agent=None):
		"""
			Creates a new subscription for this user
		"""
		_ = self.locale.translate

		# Decode p256dh
		if not isinstance(p256dh, bytes):
			p256dh = base64.urlsafe_b64decode(p256dh + "==")

		# Decode auth
		if not isinstance(auth, bytes):
			auth = base64.urlsafe_b64decode(auth + "==")

		# Insert into the database
		subscription = await self.db.insert(
			UserPushSubscription,
			user       = self,
			user_agent = user_agent,
			endpoint   = endpoint,
			p256dh     = p256dh,
			auth       = auth,
		)

		# Log action
		log.info("%s subscribed to push notifications" % self)

		# Send a message
		await subscription.send(
			_("Hello, %s!") % self,
			_("You have successfully subscribed to push notifications."),
		)

		return subscription

	async def send_push_message(self, *args, **kwargs):
		"""
			Sends a message to all active subscriptions
		"""
		subscriptions = await self.get_subscriptions()

		# Return early if there are no subscriptions
		if not subscriptions:
			return False

		# Send the message to all subscriptions
		for subscription in subscriptions:
			await subscription.send(*args, **kwargs)

		return True


class UserPushSubscription(database.Base, database.BackendMixin):
	__tablename__ = "user_push_subscriptions"

	# ID

	id = Column(Integer, primary_key=True)

	# User ID

	user_id = Column(Integer, ForeignKey("users.id"), nullable=False)

	# User

	user = sqlalchemy.orm.relationship("User", lazy="joined", innerjoin=True)

	# UUID

	uuid = Column(UUID, unique=True, nullable=False,
		server_default=sqlalchemy.func.gen_random_uuid())

	# Created At

	created_at = Column(DateTime(timezone=False), nullable=False,
		server_default=sqlalchemy.func.current_timestamp())

	# User Agent

	user_agent = Column(Text)

	# Endpoint

	endpoint = Column(Text, nullable=False)

	# P256DH

	p256dh = Column(LargeBinary, nullable=False)

	# Auth

	auth = Column(LargeBinary, nullable=False)

	@property
	def vapid_private_key(self):
		return cryptography.hazmat.primitives.serialization.load_pem_private_key(
			self.backend.users.vapid_private_key.encode(),
			password=None,
			backend=cryptography.hazmat.backends.default_backend(),
		)

	@property
	def vapid_public_key(self):
		return self.vapid_private_key.public_key()

	async def send(self, title, body, ttl=None):
		"""
			Sends a message to the user using the push service
		"""
		message = {
			"title" : title,
			"body"  : body,
		}

		# Convert dict() to JSON
		message = json.dumps(message)

		# Encrypt the message
		message = self._encrypt(message)

		# Create a signature
		signature = self._sign()

		# Encode the public key
		crypto_key = self.b64encode(
			self.vapid_public_key.public_bytes(
                cryptography.hazmat.primitives.serialization.Encoding.X962,
                cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
            )
		).decode()

		# Form request headers
		headers = {
			"Authorization"    : "WebPush %s" % signature,
			"Crypto-Key"       : "p256ecdsa=%s" % crypto_key,

			"Content-Type"      : "application/octet-stream",
			"Content-Encoding"  : "aes128gcm",
			"TTL"               : "%s" % (ttl or 0),
		}

		# Send the request
		try:
			await self.backend.httpclient.fetch(self.endpoint, method="POST",
				headers=headers, body=message)

		except httpclient.HTTPError as e:
			# 410 - Gone
			# The subscription is no longer valid
			if e.code == 410:
				# Let's just delete ourselves
				await self.delete()
				return

			# Raise everything else
			raise e

	async def delete(self):
		"""
			Deletes this subscription
		"""
		# Immediately delete it
		await self.db.delete(self)

	def _sign(self):
		elements = []

		for element in (self._jwt_info, self._jwt_data):
			# Format the dictionary
			element = json.dumps(element, separators=(',', ':'), sort_keys=True)

			# Encode to bytes
			element = element.encode()

			# Encode URL-safe in base64 and remove any padding
			element = self.b64encode(element)

			elements.append(element)

		# Concatenate
		token = b".".join(elements)

		log.debug("String to sign: %s" % token)

		# Create the signature
		signature = self.vapid_private_key.sign(
			token,
			cryptography.hazmat.primitives.asymmetric.ec.ECDSA(
				cryptography.hazmat.primitives.hashes.SHA256(),
			),
		)

		# Decode the signature
		r, s = cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature(signature)

		# Encode the signature in base64
		signature = self.b64encode(
			self._num_to_bytes(r, 32) + self._num_to_bytes(s, 32),
		)

		# Put everything together
		signature = b"%s.%s" % (token, signature)
		signature = signature.decode()

		log.debug("Created signature: %s" % signature)

		return signature

	_jwt_info = {
		"typ" : "JWT",
		"alg" : "ES256",
	}

	@property
	def _jwt_data(self):
		# Parse the URL
		url = urllib.parse.urlparse(self.endpoint)

		# Let the signature expire after 12 hours
		expires = time.time() + (12 * 3600)

		return {
			"aud" : "%s://%s" % (url.scheme, url.netloc),
			"exp" : int(expires),
			"sub" : "mailto:info@ipfire.org",
		}

	@staticmethod
	def _num_to_bytes(n, pad_to):
		"""
			Returns the byte representation of an integer, in big-endian order.
		"""
		h = "%x" % n

		r = binascii.unhexlify("0" * (len(h) % 2) + h)
		return b"\x00" * (pad_to - len(r)) + r

	@staticmethod
	def _serialize_key(key):
		if isinstance(key, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
			return key.private_bytes(
				cryptography.hazmat.primitives.serialization.Encoding.DER,
				cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8,
				cryptography.hazmat.primitives.serialization.NoEncryption(),
			)

		return key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

	@staticmethod
	def b64encode(data):
		return base64.urlsafe_b64encode(data).strip(b"=")

	def _encrypt(self, message):
		"""
			This is an absolutely ugly monster of a function which will sign the message
		"""
		headers = {}

		# Encode everything as bytes
		if not isinstance(message, bytes):
			message = message.encode()

		# Generate some salt
		salt = os.urandom(16)

		record_size = 4096
		chunk_size = record_size - 17

		# The client's public key
		p256dh = cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point(
			cryptography.hazmat.primitives.asymmetric.ec.SECP256R1(), bytes(self.p256dh),
		)

		# Generate an ephemeral server key
		server_private_key = cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
			cryptography.hazmat.primitives.asymmetric.ec.SECP256R1,
			cryptography.hazmat.backends.default_backend(),
		)
		server_public_key = server_private_key.public_key()

		context = b"WebPush: info\x00"

		# Serialize the client's public key
		context += p256dh.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Serialize the server's public key
		context += server_public_key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Perform key derivation with ECDH
		secret = server_private_key.exchange(
			cryptography.hazmat.primitives.asymmetric.ec.ECDH(), p256dh,
		)

		# Derive more stuff
		hkdf_auth = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=32,
			salt=self.auth,
			info=context,
			backend=cryptography.hazmat.backends.default_backend(),
		)
		secret = hkdf_auth.derive(secret)

		# Derive the signing key
		hkdf_key = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=16,
			salt=salt,
			info=b"Content-Encoding: aes128gcm\x00",
			backend=cryptography.hazmat.backends.default_backend(),
		)
		encryption_key = hkdf_key.derive(secret)

		# Derive a nonce
		hkdf_nonce = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=12,
			salt=salt,
			info=b"Content-Encoding: nonce\x00",
			backend=cryptography.hazmat.backends.default_backend(),
		)
		nonce = hkdf_nonce.derive(secret)

		result = b""
		chunks = 0

		while True:
			# Fetch a chunk
			chunk, message = message[:chunk_size], message[chunk_size:]
			if not chunk:
				break

			# Is this the last chunk?
			last = not message

			# Encrypt the chunk
			result += self._encrypt_chunk(encryption_key, nonce, chunks, chunk, last)

			# Kepp counting...
			chunks += 1

		# Fetch the public key
		key_id = server_public_key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Join the entire message together
		message = [
			salt,
			struct.pack("!L", record_size),
			struct.pack("!B", len(key_id)),
			key_id,
			result,
		]

		return b"".join(message)

	def _encrypt_chunk(self, key, nonce, counter, chunk, last=False):
		"""
			Encrypts one chunk
		"""
		# Make the IV
		iv = self._make_iv(nonce, counter)

		log.debug("Encrypting chunk %s: length = %s" % (counter + 1, len(chunk)))

		if last:
			chunk += b"\x02"
		else:
			chunk += b"\x01"

		# Setup AES GCM
		cipher = cryptography.hazmat.primitives.ciphers.Cipher(
			cryptography.hazmat.primitives.ciphers.algorithms.AES128(key),
			cryptography.hazmat.primitives.ciphers.modes.GCM(iv),
			backend=cryptography.hazmat.backends.default_backend(),
		)

		# Get the encryptor
		encryptor = cipher.encryptor()

		# Encrypt the chunk
		chunk = encryptor.update(chunk)

		# Finalize this round
		chunk += encryptor.finalize() + encryptor.tag

		return chunk

	@staticmethod
	def _make_iv(base, counter):
		mask, = struct.unpack("!Q", base[4:])

		return base[:4] + struct.pack("!Q", counter ^ mask)