jobs: Update API

[pbs.git] / src / buildservice / users.py

#!/usr/bin/python3

import asyncio
import base64
import binascii
import cryptography.hazmat.backends
import cryptography.hazmat.primitives.asymmetric.ec
import cryptography.hazmat.primitives.asymmetric.utils
import cryptography.hazmat.primitives.ciphers
import cryptography.hazmat.primitives.ciphers.aead
import cryptography.hazmat.primitives.hashes
import cryptography.hazmat.primitives.kdf.hkdf
import cryptography.hazmat.primitives.serialization
import datetime
import email.utils
import json
import ldap
import logging
import os
import pickle
import struct
import threading
import time
import urllib.parse

import tornado.locale

from . import base
from . import bugtracker
from . import httpclient

from .decorators import *

DEFAULT_STORAGE_QUOTA = 256 * 1024 * 1024 # 256 MiB

# Setup logging
log = logging.getLogger("pbs.users")

# A list of LDAP attributes that we fetch
LDAP_ATTRS = (
	# UID
	"uid",

	# Common Name
	"cn",

	# First & Last Name
	"givenName", "sn",

	# Email Addresses
	"mail",
	"mailAlternateAddress",
)

WITH_USED_BUILD_TIME_CTE = """
	user_build_times AS (
		SELECT
			users.id AS user_id,
			SUM(jobs.finished_at - jobs.started_at) AS used
		FROM
			users
		LEFT JOIN
			builds ON users.id = builds.owner_id
		LEFT JOIN
			jobs ON builds.id = jobs.build_id
		WHERE
			users.deleted_at IS NULL
		AND
			users.daily_build_quota IS NOT NULL
		AND
			jobs.started_at IS NOT NULL
		AND
			jobs.finished_at IS NOT NULL
		AND
			jobs.finished_at >= CURRENT_TIMESTAMP - INTERVAL '24 hours'
		GROUP BY
			users.id
	)
"""

WITH_EXCEEDED_QUOTAS_CTE = """
	-- Include used build time
	%s,

	users_with_exceeded_quotas AS (
		SELECT
			*
		FROM
			user_build_times build_times
		LEFT JOIN
			users ON build_times.user_id = users.id
		WHERE
			users.daily_build_quota IS NOT NULL
		AND
			build_times.used >= users.daily_build_quota
	)
""" % WITH_USED_BUILD_TIME_CTE

class QuotaExceededError(Exception):
	pass

class Users(base.Object):
	def init(self):
		# Initialize thread-local storage
		self.local = threading.local()

	@property
	def ldap(self):
		if not hasattr(self.local, "ldap"):
			# Fetch the LDAP URI
			ldap_uri = self.backend.config.get("ldap", "uri")

			log.debug("Connecting to %s..." % ldap_uri)

			# Establish LDAP connection
			self.local.ldap = ldap.initialize(ldap_uri)

		return self.local.ldap

	def _get_user(self, query, *args):
		res = self.db.get(query, *args)

		if res:
			return User(self.backend, res.id, data=res)

	def _get_users(self, query, *args):
		res = self.db.query(query, *args)

		for row in res:
			yield User(self.backend, row.id, data=row)

	def __iter__(self):
		users = self._get_users("""
			SELECT
				*
			FROM
				users
			WHERE
				deleted_at IS NULL
			ORDER BY
				name
			""",
		)

		return iter(users)

	def __len__(self):
		res = self.db.get("""
			SELECT
				COUNT(*) AS count
			FROM
				users
			WHERE
				deleted_at IS NULL
			""",
		)

		return res.count

	def _ldap_query(self, query, attrlist=None, limit=0, search_base=None):
		search_base = self.backend.config.get("ldap", "base")

		log.debug("Performing LDAP query (%s): %s" % (search_base, query))

		t = time.time()

		# Ask for up to 512 results being returned at a time
		page_control = ldap.controls.SimplePagedResultsControl(True, size=512, cookie="")

		results = []
		pages = 0

		# Perform the search
		while True:
			response = self.ldap.search_ext(search_base,
				ldap.SCOPE_SUBTREE, query, attrlist=attrlist, sizelimit=limit,
				serverctrls=[page_control],
			)

			# Fetch all results
			type, data, rmsgid, serverctrls = self.ldap.result3(response)

			# Append to local copy
			results += data
			pages += 1

			controls = [c for c in serverctrls
				if c.controlType == ldap.controls.SimplePagedResultsControl.controlType]

			if not controls:
				break

			# Set the cookie for more results
			page_control.cookie = controls[0].cookie

			# There are no more results
			if not page_control.cookie:
				break

			# Log time it took to perform the query
			log.debug("Query took %.2fms (%s page(s))" % ((time.time() - t) * 1000.0, pages))

		# Return all attributes (without the DN)
		return [attrs for dn, attrs in results]

	def _ldap_get(self, *args, **kwargs):
		results = self._ldap_query(*args, **kwargs)

		# No result
		if not results:
			return {}

		# Too many results?
		elif len(results) > 1:
			raise OverflowError("Too many results returned for ldap_get()")

		return results[0]

	def create(self, name, notify=False, storage_quota=None, _attrs=None):
		"""
			Creates a new user
		"""
		# Pickle any attrs
		if _attrs:
			_attrs = pickle.dumps(_attrs)

		# Set default for storage quota
		if storage_quota is None:
			storage_quota = DEFAULT_STORAGE_QUOTA

		user = self._get_user("""
			INSERT INTO
				users
			(
				name,
				storage_quota,
				_attrs
			)
			VALUES
			(
				%s, %s, %s
			)
			RETURNING
				*
			""", name, storage_quota, _attrs,
		)

		log.debug("Created user %s" % user)

		# Send a welcome email
		if notify:
			user._send_welcome_email()

		return user

	def get_by_id(self, id):
		return self._get_user("SELECT * FROM users \
			WHERE id = %s", id)

	def get_by_name(self, name):
		"""
			Fetch a user by its username
		"""
		# Try to find a local user
		user = self._get_user("""
			SELECT
				*
			FROM
				users
			WHERE
				deleted_at IS NULL
			AND
				name = %s
			""", name,
		)
		if user:
			return user

		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot use get_by_name test mode")
			return

		# Search in LDAP
		res = self._ldap_get(
			"(&"
				"(objectClass=person)"
				"(uid=%s)"
			")" % name,
			attrlist=("uid",),
		)
		if not res:
			return

		# Fetch the UID
		uid = res.get("uid")[0].decode()

		# Create a new user
		return self.create(uid)

	def get_by_email(self, mail):
		# Strip any excess stuff from the email address
		name, mail = email.utils.parseaddr(mail)

		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot use get_by_email in test mode")
			return

		# Search in LDAP
		try:
			res = self._ldap_get(
				"(&"
					"(objectClass=person)"
					"(|"
						"(mail=%s)"
						"(mailAlternateAddress=%s)"
					")"
				")" % (mail, mail),
				attrlist=("uid",),
			)

		except OverflowError as e:
			raise OverflowError("Too many results for search for %s" % mail) from e

		# No results
		if not res:
			return

		# Fetch the UID
		uid = res.get("uid")[0].decode()

		return self.get_by_name(uid)

	def _search_by_email(self, mails, include_missing=True):
		"""
			Takes a list of email addresses and returns all users that could be found
		"""
		users = []

		for mail in mails:
			user = self.get_by_email(mail)

			# Include the search string if no user could be found
			if not user and include_missing:
				user = mail

			# Skip any duplicates
			if user in users:
				continue

			users.append(user)

		return users

	def search(self, q, limit=None):
		# Do nothing in test mode
		if self.backend.test:
			log.warning("Cannot search for users in test mode")
			return []

		res = self._ldap_query(
			"(&"
				"(objectClass=person)"
				"(|"
					"(uid=%s)"
					"(cn=*%s*)"
					"(mail=%s)"
					"(mailAlternateAddress=%s)"
				")"
			")" % (q, q, q, q),
			attrlist=("uid",),
			limit=limit,
		)

		# Fetch users
		users = self._get_users("""
			SELECT
				*
			FROM
				users
			WHERE
				deleted_at IS NULL
			AND
				name = ANY(%s)
			""", [row.get("uid")[0].decode() for row in res],
		)

		return sorted(users)

	# Pakfire

	@property
	def pakfire(self):
		"""
			This is a c
		"""
		user = self.get_by_email("pakfire@ipfire.org")
		if not user:
			raise RuntimeError("Missing Pakfire user")

		return user

	@property
	def top(self):
		"""
			Returns the top users (with the most builds in the last year)
		"""
		users = self._get_users("""
			SELECT
				DISTINCT users.*,
				COUNT(builds.id) AS _sort
			FROM
				users
			LEFT JOIN
				builds ON users.id = builds.owner_id
			WHERE
				builds.test IS FALSE
			GROUP BY
				users.id
			ORDER BY
				_sort DESC
			LIMIT
				30
			""",
		)

		return list(users)

	# Push Notifications

	@property
	def vapid_public_key(self):
		"""
			The public part of the VAPID key
		"""
		return self.settings.get("vapid-public-key")

	@property
	def vapid_private_key(self):
		"""
			The private part of the VAPID key
		"""
		return self.settings.get("vapid-private-key")

	async def generate_vapid_keys(self):
		"""
			Generates the VAPID keys
		"""
		# Do not generate a new key if one exists
		if self.vapid_public_key and self.vapid_private_key:
			return

		with self.db.transaction():
			# Generate the private key
			private_key = await self.backend.command(
				"openssl",
				"ecparam",
				"-name", "prime256v1",
				"-genkey",
				"-noout",
				return_output=True,
			)

			# Generate the public key
			public_key = await self.backend.command(
				"openssl",
				"ec",
				"-pubout",
				input=private_key,
				return_output=True,
			)

			# Store the keys
			self.settings.set("vapid-public-key", public_key)
			self.settings.set("vapid-private-key", private_key)

		log.info("VAPID keys have been successfully generated")

	@property
	def application_server_key(self):
		lines = []

		for line in self.vapid_public_key.splitlines():
			if line.startswith("-"):
				continue

			lines.append(line)

		# Join everything together
		key = "".join(lines)

		# Decode the key
		key = base64.b64decode(key)

		# Only take the last bit
		key = key[-65:]

		# Encode the key URL-safe
		key = base64.urlsafe_b64encode(key).strip(b"=")

		return key


class User(base.DataObject):
	table = "users"

	def __repr__(self):
		return "<%s %s>" % (self.__class__.__name__, self.realname)

	def __str__(self):
		return self.realname or self.name

	def __hash__(self):
		return hash(self.id)

	def __lt__(self, other):
		if isinstance(other, self.__class__):
			return self.name < other.name

		elif isinstance(other, str):
			return self.name < other

		return NotImplemented

	def to_json(self):
		return {
			"name"     : self.name,
		}

	@property
	def name(self):
		return self.data.name

	def delete(self):
		self._set_attribute("deleted", True)

		# Destroy all sessions
		for session in self.sessions:
			session.destroy()

	# Fetch any attributes from LDAP

	@lazy_property
	def attrs(self):
		# Use the stored attributes (only used in the test environment)
		if self.data._attrs:
			return pickle.loads(self.data._attrs)

		return self.backend.users._ldap_get("(uid=%s)" % self.name, attrlist=LDAP_ATTRS)

	def _get_attrs(self, key):
		return [v.decode() for v in self.attrs.get(key, [])]

	def _get_attr(self, key):
		for value in self._get_attrs(key):
			return value

	# Realname

	@property
	def realname(self):
		return self._get_attr("cn") or ""

	@property
	def email(self):
		"""
			The primary email address
		"""
		return self._get_attr("mail")

	@property
	def email_to(self):
		"""
			The name/email address of the user in MIME format
		"""
		return email.utils.formataddr((
			self.realname or self.name,
			self.email or "invalid@invalid.tld",
		))

	def send_email(self, *args, **kwargs):
		return self.backend.messages.send_template(
			*args,
			recipient=self,
			locale=self.locale,
			**kwargs,
		)

	def _send_welcome_email(self):
		"""
			Sends a welcome email to the user
		"""
		self.send_email("users/messages/welcome.txt")

	def is_admin(self):
		return self.data.admin is True

	# Locale

	@property
	def locale(self):
		return tornado.locale.get()

	@property
	def deleted(self):
		return self.data.deleted

	# Avatar

	def avatar(self, size=512):
		"""
			Returns a URL to the avatar the user has uploaded
		"""
		return "https://people.ipfire.org/users/%s.jpg?size=%s" % (self.name, size)

	# Permissions

	def get_perms(self):
		return self.data.perms

	def set_perms(self, perms):
		self._set_attribute("perms", perms or [])

	perms = property(get_perms, set_perms)

	def has_perm(self, user):
		"""
			Check, if the given user has the right to perform administrative
			operations on this user.
		"""
		# Anonymous people have no permission
		if user is None:
			return False

		# Admins always have permission
		if user.is_admin():
			return True

		# Users can edit themselves
		if user == self:
			return True

		# No permission
		return False

	@property
	def sessions(self):
		sessions = self.backend.sessions._get_sessions("""
			SELECT
				*
			FROM
				sessions
			WHERE
				user_id = %s
			AND
				valid_until >= NOW()
			ORDER BY
				created_at
			""", self.id,
		)

		return list(sessions)

	# Bugzilla

	async def connect_to_bugzilla(self, api_key):
		bz = bugtracker.Bugzilla(self.backend, api_key)

		# Does the API key match with this user?
		if not self.email == await bz.whoami():
			raise ValueError("The API key does not belong to %s" % self)

		self._set_attribute("bugzilla_api_key", api_key)

	@lazy_property
	def bugzilla(self):
		"""
			Connection to Bugzilla as this user
		"""
		if self.data.bugzilla_api_key:
			return bugtracker.Bugzilla(self.backend, self.data.bugzilla_api_key)

	# Build Quota

	def get_daily_build_quota(self):
		return self.data.daily_build_quota

	def set_daily_build_quota(self, quota):
		self._set_attribute("daily_build_quota", quota)

	daily_build_quota = property(get_daily_build_quota, set_daily_build_quota)

	@property
	def _build_times(self):
		return self.db.get("""
			WITH %s

			SELECT
				*
			FROM
				user_build_times
			WHERE
				user_build_times.user_id = %%s
			""" % WITH_BUILD_TIMES_CTE, self.id,
		)

	@property
	def used_daily_build_quota(self):
		res = self.db.get("""
			WITH %s

			SELECT
				user_build_times.used AS used
			FROM
				user_build_times
			WHERE
				user_build_times.user_id = %%s
			""" % WITH_USED_BUILD_TIME_CTE, self.id,
		)

		if res:
			return res.used

		return 0

	def has_exceeded_build_quota(self):
		if not self.daily_build_quota:
			return False

		if not self.used_daily_build_quota:
			return False

		return self.used_daily_build_quota >= self.daily_build_quota

	# Storage Quota

	def get_storage_quota(self):
		return self.data.storage_quota

	def set_storage_quota(self, quota):
		self._set_attribute("storage_quota", quota)

	storage_quota = property(get_storage_quota, set_storage_quota)

	def has_exceeded_storage_quota(self, size=None):
		"""
			Returns True if this user has exceeded their quota
		"""
		# Skip quota check if this user has no quota
		if not self.storage_quota:
			return

		return self.disk_usage + (size or 0) >= self.storage_quota

	def check_storage_quota(self, size=None):
		"""
			Determines the user's disk usage
			and raises an exception when the user is over quota.
		"""
		# Raise QuotaExceededError if this user is over quota
		if self.has_exceeded_storage_quota(size=size):
			raise QuotaExceededError

	@lazy_property
	def disk_usage(self):
		"""
			Returns the total disk usage of this user
		"""
		res = self.db.get("""
			WITH objects AS (
				-- Uploads
				SELECT
					uploads.size AS size
				FROM
					uploads
				WHERE
					uploads.user_id = %s
				AND
					uploads.expires_at > CURRENT_TIMESTAMP

				UNION ALL

				-- Source Packages
				SELECT
					packages.filesize AS size
				FROM
					builds
				LEFT JOIN
					packages ON builds.pkg_id = packages.id
				WHERE
					builds.deleted_at IS NULL
				AND
					builds.owner_id = %s
				AND
					builds.test IS FALSE
				AND
					packages.deleted_at IS NULL

				UNION ALL

				-- Binary Packages
				SELECT
					packages.filesize AS size
				FROM
					builds
				LEFT JOIN
					jobs ON builds.id = jobs.build_id
				LEFT JOIN
					job_packages ON jobs.id = job_packages.job_id
				LEFT JOIN
					packages ON job_packages.pkg_id = packages.id
				WHERE
					builds.deleted_at IS NULL
				AND
					builds.owner_id = %s
				AND
					builds.test IS FALSE
				AND
					jobs.deleted_at IS NULL
				AND
					packages.deleted_at IS NULL

				UNION ALL

				-- Build Logs
				SELECT
					jobs.log_size AS size
				FROM
					jobs
				LEFT JOIN
					builds ON builds.id = jobs.build_id
				WHERE
					builds.deleted_at IS NULL
				AND
					jobs.deleted_at IS NULL
				AND
					builds.owner_id = %s
				AND
					jobs.log_size IS NOT NULL
			)

			SELECT
				SUM(size) AS disk_usage
			FROM
				objects
			""", self.id, self.id, self.id, self.id,
		)

		if res:
			return res.disk_usage

		return 0

	# Builds

	def get_builds(self, name=None, limit=None, offset=None):
		"""
			Returns builds by a certain user
		"""
		if name:
			return self.get_builds_by_name(name, limit=limit, offset=offset)

		builds = self.backend.builds._get_builds("""
			SELECT
				*
			FROM
				builds
			WHERE
				deleted_at IS NULL
			AND
				test IS FALSE
			AND
				owner_id = %s
			ORDER BY
				created_at DESC
			LIMIT
				%s
			OFFSET
				%s
			""", self.id, limit, offset,
		)

		return list(builds)

	def get_builds_by_name(self, name, limit=None, offset=None):
		"""
			Fetches all builds matching name
		"""
		builds = self.backend.builds._get_builds("""
			SELECT
				builds.*
			FROM
				builds
			JOIN
				packages ON builds.pkg_id = packages.id
			WHERE
				builds.deleted_at IS NULL
			AND
				builds.test IS FALSE
			AND
				builds.owner_id = %s
			AND
				packages.deleted_at IS NULL
			AND
				packages.name = %s
			LIMIT
				%s
			OFFSET
				%s
			""", self.id, name, limit, offset,
		)

		return list(builds)

	# Stats

	@lazy_property
	def total_builds(self):
		res = self.db.get("""
			SELECT
				COUNT(*) AS builds
			FROM
				builds
			WHERE
				test IS FALSE
			AND
				owner_id = %s
			""", self.id,
		)

		if res:
			return res.builds

		return 0

	@lazy_property
	def total_build_time(self):
		res = self.db.get("""
			SELECT
				SUM(jobs.finished_at - jobs.started_at) AS total_time
			FROM
				jobs
			LEFT JOIN
				builds ON jobs.build_id = builds.id
			WHERE
				jobs.finished_at IS NOT NULL
			AND
				jobs.started_at IS NOT NULL
			AND
				builds.owner_id = %s
			""", self.id,
		)

		if res:
			return res.total_time

	# Custom repositories

	@property
	def repos(self):
		"""
			Returns all custom repositories
		"""
		repos = self.backend.repos._get_repositories("""
			SELECT
				*
			FROM
				repositories
			WHERE
				deleted_at IS NULL
			AND
				owner_id = %s
			ORDER BY
				name""",
			self.id,
		)

		distros = {}

		# Group by distro
		for repo in repos:
			try:
				distros[repo.distro].append(repo)
			except KeyError:
				distros[repo.distro] = [repo]

		return distros

	def get_repo(self, distro, slug):
		# Return the "home" repository if slug is empty
		if not slug:
			slug = self.name

		return self.backend.repos._get_repository("""
			SELECT
				*
			FROM
				repositories
			WHERE
				deleted_at IS NULL
			AND
				owner_id = %s
			AND
				distro_id = %s
			AND
				slug = %s""",
			self.id,
			distro,
			slug,
		)

	@property
	def uploads(self):
		"""
			Returns all uploads that belong to this user
		"""
		uploads = self.backend.uploads._get_uploads("""
			SELECT
				*
			FROM
				uploads
			WHERE
				user_id = %s
			AND
				expires_at > CURRENT_TIMESTAMP
			ORDER BY
				created_at DESC
			""", self.id,
		)

		return list(uploads)

	# Push Subscriptions

	def _get_subscriptions(self, query, *args):
		res = self.db.query(query, *args)

		for row in res:
			yield UserPushSubscription(self.backend, row.id, data=row)

	def _get_subscription(self, query, *args):
		res = self.db.get(query, *args)

		if res:
			return UserPushSubscription(self.backend, res.id, data=res)

	@lazy_property
	def subscriptions(self):
		subscriptions = self._get_subscriptions("""
			SELECT
				*
			FROM
				user_push_subscriptions
			WHERE
				deleted_at IS NULL
			AND
				user_id = %s
			ORDER BY
				created_at
			""", self.id,
		)

		return set(subscriptions)

	async def subscribe(self, endpoint, p256dh, auth, user_agent=None):
		"""
			Creates a new subscription for this user
		"""
		_ = self.locale.translate

		# Decode p256dh
		if not isinstance(p256dh, bytes):
			p256dh = base64.urlsafe_b64decode(p256dh + "==")

		# Decode auth
		if not isinstance(auth, bytes):
			auth = base64.urlsafe_b64decode(auth + "==")

		subscription = self._get_subscription("""
			INSERT INTO
				user_push_subscriptions
			(
				user_id,
				user_agent,
				endpoint,
				p256dh,
				auth
			)
			VALUES
			(
				%s, %s, %s, %s, %s
			)
			RETURNING *
			""", self.id, user_agent, endpoint, p256dh, auth,
		)

		# Send a message
		await subscription.send(
			self._make_message(
				_("Hello, %s!") % self,
				_("You have successfully subscribed to push notifications."),
			),
		)

		return subscription

	async def send_push_message(self, title, body, **kwargs):
		"""
			Sends a message to all active subscriptions
		"""
		# Return False if the user has no subscriptions
		if not self.subscriptions:
			return False

		# Format the message
		message = self._make_message(title, body, **kwargs)

		# Send the message to all subscriptions
		async with asyncio.TaskGroup() as tg:
			for subscription in self.subscriptions:
				tg.create_task(subscription.send(message))

		return True

	def _make_message(self, title, body, **kwargs):
		"""
			Formats a push message with the given attributes and some useful defaults
		"""
		# Format the message as a dictionary
		message = {
			"title" : title,
			"body"  : body,
		} | kwargs

		return message


class UserPushSubscription(base.DataObject):
	table = "user_push_subscriptions"

	@property
	def uuid(self):
		"""
			UUID
		"""
		return self.data.uuid

	@property
	def created_at(self):
		return self.data.created_at

	@property
	def deleted_at(self):
		return self.data.deleted_at

	def delete(self):
		"""
			Deletes this subscription
		"""
		self._set_attribute_now("deleted_at")

	@property
	def endpoint(self):
		return self.data.endpoint

	@lazy_property
	def p256dh(self):
		"""
			The client's public key
		"""
		p = cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point(
			cryptography.hazmat.primitives.asymmetric.ec.SECP256R1(), bytes(self.data.p256dh),
		)

		return p

	@property
	def auth(self):
		return bytes(self.data.auth)

	@property
	def vapid_private_key(self):
		return cryptography.hazmat.primitives.serialization.load_pem_private_key(
			self.backend.users.vapid_private_key.encode(),
			password=None,
			backend=cryptography.hazmat.backends.default_backend(),
		)

	@property
	def vapid_public_key(self):
		return self.vapid_private_key.public_key()

	async def send(self, message, ttl=0):
		"""
			Sends a message to the user using the push service
		"""
		# Convert strings into a message object
		if isinstance(message, str):
			message = {
				"message" : message,
			}

		# Convert dict() to JSON
		if isinstance(message, dict):
			message = json.dumps(message)

		# Encode everything as bytes
		if not isinstance(message, bytes):
			message = message.encode()

		# Encrypt the message
		message = self._encrypt(message)

		# Create a signature
		signature = self._sign()

		# Encode the public key
		crypto_key = self.b64encode(
			self.vapid_public_key.public_bytes(
                cryptography.hazmat.primitives.serialization.Encoding.X962,
                cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
            )
		).decode()

		# Form request headers
		headers = {
			"Authorization"    : "WebPush %s" % signature,
			"Crypto-Key"       : "p256ecdsa=%s" % crypto_key,

			"Content-Type"      : "application/octet-stream",
			"Content-Encoding"  : "aes128gcm",
			"TTL"               : "%s" % (ttl or 0),
		}

		# Send the request
		try:
			await self.backend.httpclient.fetch(self.endpoint, method="POST",
				headers=headers, body=message)

		except httpclient.HTTPError as e:
			# 410 - Gone
			# The subscription is no longer valid
			if e.code == 410:
				# Let's just delete ourselves
				self.delete()
				return

			# Raise everything else
			raise e

	def _sign(self):
		elements = []

		for element in (self._jwt_info, self._jwt_data):
			# Format the dictionary
			element = json.dumps(element, separators=(',', ':'), sort_keys=True)

			# Encode to bytes
			element = element.encode()

			# Encode URL-safe in base64 and remove any padding
			element = self.b64encode(element)

			elements.append(element)

		# Concatenate
		token = b".".join(elements)

		log.debug("String to sign: %s" % token)

		# Create the signature
		signature = self.vapid_private_key.sign(
			token,
			cryptography.hazmat.primitives.asymmetric.ec.ECDSA(
				cryptography.hazmat.primitives.hashes.SHA256(),
			),
		)

		# Decode the signature
		r, s = cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature(signature)

		# Encode the signature in base64
		signature = self.b64encode(
			self._num_to_bytes(r, 32) + self._num_to_bytes(s, 32),
		)

		# Put everything together
		signature = b"%s.%s" % (token, signature)
		signature = signature.decode()

		log.debug("Created signature: %s" % signature)

		return signature

	_jwt_info = {
		"typ" : "JWT",
		"alg" : "ES256",
	}

	@property
	def _jwt_data(self):
		# Parse the URL
		url = urllib.parse.urlparse(self.endpoint)

		# Let the signature expire after 12 hours
		expires = time.time() + (12 * 3600)

		return {
			"aud" : "%s://%s" % (url.scheme, url.netloc),
			"exp" : int(expires),
			"sub" : "mailto:info@ipfire.org",
		}

	@staticmethod
	def _num_to_bytes(n, pad_to):
		"""
			Returns the byte representation of an integer, in big-endian order.
		"""
		h = "%x" % n

		r = binascii.unhexlify("0" * (len(h) % 2) + h)
		return b"\x00" * (pad_to - len(r)) + r

	@staticmethod
	def _serialize_key(key):
		if isinstance(key, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
			return key.private_bytes(
				cryptography.hazmat.primitives.serialization.Encoding.DER,
				cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8,
				cryptography.hazmat.primitives.serialization.NoEncryption(),
			)

		return key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

	@staticmethod
	def b64encode(data):
		return base64.urlsafe_b64encode(data).strip(b"=")

	def _encrypt(self, message):
		"""
			This is an absolutely ugly monster of a function which will sign the message
		"""
		headers = {}

		# Generate some salt
		salt = os.urandom(16)

		record_size = 4096
		chunk_size = record_size - 17

		# Generate an ephemeral server key
		server_private_key = cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
			cryptography.hazmat.primitives.asymmetric.ec.SECP256R1,
			cryptography.hazmat.backends.default_backend(),
		)
		server_public_key = server_private_key.public_key()

		context = b"WebPush: info\x00"

		# Serialize the client's public key
		context += self.p256dh.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Serialize the server's public key
		context += server_public_key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Perform key derivation with ECDH
		secret = server_private_key.exchange(
			cryptography.hazmat.primitives.asymmetric.ec.ECDH(), self.p256dh,
		)

		# Derive more stuff
		hkdf_auth = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=32,
			salt=self.auth,
			info=context,
			backend=cryptography.hazmat.backends.default_backend(),
		)
		secret = hkdf_auth.derive(secret)

		# Derive the signing key
		hkdf_key = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=16,
			salt=salt,
			info=b"Content-Encoding: aes128gcm\x00",
			backend=cryptography.hazmat.backends.default_backend(),
		)
		encryption_key = hkdf_key.derive(secret)

		# Derive a nonce
		hkdf_nonce = cryptography.hazmat.primitives.kdf.hkdf.HKDF(
			algorithm=cryptography.hazmat.primitives.hashes.SHA256(),
			length=12,
			salt=salt,
			info=b"Content-Encoding: nonce\x00",
			backend=cryptography.hazmat.backends.default_backend(),
		)
		nonce = hkdf_nonce.derive(secret)

		result = b""
		chunks = 0

		while True:
			# Fetch a chunk
			chunk, message = message[:chunk_size], message[chunk_size:]
			if not chunk:
				break

			# Is this the last chunk?
			last = not message

			# Encrypt the chunk
			result += self._encrypt_chunk(encryption_key, nonce, chunks, chunk, last)

			# Kepp counting...
			chunks += 1

		# Fetch the public key
		key_id = server_public_key.public_bytes(
			cryptography.hazmat.primitives.serialization.Encoding.X962,
			cryptography.hazmat.primitives.serialization.PublicFormat.UncompressedPoint,
		)

		# Join the entire message together
		message = [
			salt,
			struct.pack("!L", record_size),
			struct.pack("!B", len(key_id)),
			key_id,
			result,
		]

		return b"".join(message)

	def _encrypt_chunk(self, key, nonce, counter, chunk, last=False):
		"""
			Encrypts one chunk
		"""
		# Make the IV
		iv = self._make_iv(nonce, counter)

		log.debug("Encrypting chunk %s: length = %s" % (counter + 1, len(chunk)))

		if last:
			chunk += b"\x02"
		else:
			chunk += b"\x01"

		# Setup AES GCM
		cipher = cryptography.hazmat.primitives.ciphers.Cipher(
			cryptography.hazmat.primitives.ciphers.algorithms.AES128(key),
			cryptography.hazmat.primitives.ciphers.modes.GCM(iv),
			backend=cryptography.hazmat.backends.default_backend(),
		)

		# Get the encryptor
		encryptor = cipher.encryptor()

		# Encrypt the chunk
		chunk = encryptor.update(chunk)

		# Finalize this round
		chunk += encryptor.finalize() + encryptor.tag

		return chunk

	@staticmethod
	def _make_iv(base, counter):
		mask, = struct.unpack("!Q", base[4:])

		return base[:4] + struct.pack("!Q", counter ^ mask)