libreqda 1.2.0__py3-none-any.whl

taguette/web/views.py

@@ -0,0 +1,1618 @@
+import asyncio
+from datetime import timedelta, datetime
+from email.message import EmailMessage
+import io
+import itertools
+import json
+import logging
+from markupsafe import Markup
+import prometheus_client
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.orm import aliased
+import time
+import tornado.locale
+from tornado.web import authenticated, HTTPError
+from urllib.parse import urlunparse
+from collections import defaultdict
+import re
+
+from .. import database
+from .. import import_codebook
+from ..utils import _f
+from .. import validate
+from .base import BaseHandler, PromMeasureRequest
+from ..demodata import DEMO_DATA
+
+# For CILogon
+from oauth2client.client import OAuth2WebServerFlow
+import base64
+import requests
+from tornado.escape import url_escape
+
+logger = logging.getLogger(__name__)
+
+PROM_REQUESTS = PromMeasureRequest(
+    count=prometheus_client.Counter(
+        "pages_total",
+        "Page requests",
+        ["name"],
+    ),
+    time=prometheus_client.Histogram(
+        "page_seconds",
+        "Page request time",
+        ["name"],
+    ),
+)
+
+PROM_USER_CONNECTIONS = prometheus_client.Counter(
+    "user_connections_total", "User connection total"
+)
+
+PROM_ACTIVE_SESSIONS = prometheus_client.Gauge(
+    "active_sessions", "Number of currently active user sessions"
+)
+
+PROM_DOWNLOADS = prometheus_client.Counter(
+    "downloads_total", "Download link clicks", ["os"]
+)
+for _os in ('windows', 'macos'):
+    PROM_DOWNLOADS.labels(_os).inc(0)
+
+
+def get_idps(db):
+    idps = [
+        {
+            "entityid": "http://google.com/accounts/o8/id",
+            "name": "Google"
+        },
+        {
+            "entityid": "http://login.microsoftonline.com/"
+                        "common/oauth2/v2.0/authorize",
+            "name": "Microsoft"
+        }
+    ]
+
+    idps_query = (
+        db.query(database.EdugainIdps)
+        .filter(database.EdugainIdps.code == "CAF")
+        .order_by(database.EdugainIdps.e_displayname)
+    ).all()
+    for idp in idps_query:
+        displayname = idp.e_displayname.split(";")
+        if len(displayname) > 1:
+            displayname = displayname[1]
+        else:
+            displayname = displayname[0]
+        displayname = re.sub(r"==[a-z]{2}$", "", displayname)
+        idps.append({"entityid": idp.entityid, "name": displayname})
+
+    return idps
+
+
+class Index(BaseHandler):
+    """Index page, shows welcome message and user's projects."""
+
+    @PROM_REQUESTS.sync("index")
+    def get(self):
+        if self.current_user is not None:
+            if self.get_query_argument("token", None):
+                # Remove the token from the URL
+                return self.redirect(self.reverse_url("index"))
+            user = self.db.query(database.User).get(self.current_user)
+            user_display_name = user.login
+            if user.displayname is not None and user.displayname != "":
+                user_display_name = user.displayname
+
+            is_demo = "false" if len(user.project_memberships) else "true"
+            _ = self.xsrf_token  # Make sure XSRF cookie is set
+            return self.render(
+                "index.html",
+                user=user,
+                user_login=Markup(json.dumps(self.current_user)),
+                user_display_name=user_display_name,
+                projects=[
+                    m.project for m in user.project_memberships
+                    if not m.project.is_archived
+                ],
+                can_create_project=user.role.can_create_project(),
+                can_change_role=user.role.can_change_role(),
+                can_import_project=(
+                    user.role.can_create_project()
+                    and self.application.config["SQLITE3_IMPORT_ENABLED"]
+                ),
+                demo=False,
+                is_demo=Markup(is_demo),
+                is_multiuser=self.application.config["MULTIUSER"],
+                show_credits=self.application.config["SHOW_CREDITS"]
+            )
+        elif not self.application.config["MULTIUSER"]:
+            token = self.get_query_argument("token", None)
+            if (self.application.config.get('UNIX_SOCKET') or
+                    (token and token == self.application.single_user_token)):
+                self.login("admin")
+                return self.redirect(self.reverse_url("index"))
+            elif token:
+                return self.redirect(self.reverse_url("index"))
+            else:
+                return self.render('auth/token_needed.html')
+        return self.render('welcome.html')
+
+    def post(self):
+        language = self.get_body_argument('language')
+        url = self.get_body_argument('url')
+        self.set_cookie('language', language)
+        return self.redirect(url)
+
+    def check_xsrf_cookie(self):
+        pass
+
+    head = get
+
+
+class CookiesPrompt(BaseHandler):
+    @PROM_REQUESTS.sync("cookies_prompt")
+    def get(self):
+        return self.render(
+            "cookies_prompt.html",
+            next=self.get_argument("next", ""),
+        )
+
+    @PROM_REQUESTS.sync("cookies_prompt")
+    def post(self):
+        self.set_cookie("cookies_accepted", "yes", dont_check=True)
+        next_ = self.get_argument("next", "")
+        if not next_:
+            next_ = self.reverse_url("index")
+        return self.redirect(next_)
+
+    def check_xsrf_cookie(self):
+        pass
+
+
+class BrokenBasePath(BaseHandler):
+    def get(self):
+        self.set_header("Content-Type", "text/plain")
+        return self.finish(
+            (
+                "Error: BASE_PATH is set to {0} so you shouldn't be"
+                "reaching this page.\n"
+                "\n"
+                "You might need to fix your reverse proxy's configuration"
+                "or LibreQDA's BASE_PATH setting.\n"
+            ).format(self.application.config["BASE_PATH"])
+        )
+
+
+class Login(BaseHandler):
+    @PROM_REQUESTS.sync("login")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if self.current_user:
+            return self._go_to_next()
+        else:
+            if not self.application.config["ALLOW_EXTERNAL_LOGIN"] or (
+                self.application.config["ALLOW_EXTERNAL_LOGIN_BYPASS"]
+                and self.get_argument("bypass", None) is not None
+            ):
+                return self.render(
+                    "auth/login.html",
+                    register=False,
+                    next=self.get_argument("next", ""),
+                )
+            else:
+                error = self.get_argument("error", "")
+                error_msg = self.get_argument("error_msg", "")
+                return self.render(
+                    "auth/cilogon.login.html",
+                    next=self.get_argument("next", ""),
+                    error=error,
+                    error_msg=error_msg,
+                    idps=get_idps(self.db),
+                    entity_id=self.get_cookie("entity_id", None),
+                )
+
+    @PROM_REQUESTS.async_("login")
+    async def post(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if (
+            self.application.config["ALLOW_EXTERNAL_LOGIN"]
+            and not self.application.config["ALLOW_EXTERNAL_LOGIN_BYPASS"]
+        ):
+            raise HTTPError(404)
+        login = self.get_body_argument("login")
+        try:
+            login = validate.fix_user_login(login)
+        except validate.InvalidFormat:
+            logger.info("Login: invalid login")
+        else:
+            password = self.get_body_argument("password")
+            user = self.db.query(database.User).get(login)
+            if user is None or user.disabled:
+                logger.info("Login: non-existent user")
+            elif not await user.check_password(password):
+                logger.info("Login: invalid password for %r", user.login)
+            else:
+                self.login(user.login)
+                PROM_USER_CONNECTIONS.inc()
+                PROM_ACTIVE_SESSIONS.inc()
+                return self._go_to_next()
+
+        return self.render(
+            "auth/login.html",
+            register=False,
+            next=self.get_argument("next", ""),
+            login_error=self.gettext("Invalid login or password"),
+        )
+
+    def _go_to_next(self):
+        next_ = self.get_argument("next", "")
+        if not next_:
+            next_ = self.reverse_url("index")
+        return self.redirect(next_)
+
+
+class Logout(BaseHandler):
+    @PROM_REQUESTS.sync("logout")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        self.logout()
+        current_value = PROM_ACTIVE_SESSIONS._value._value
+        if current_value > 0:
+            PROM_ACTIVE_SESSIONS.dec()
+        return self.redirect(self.reverse_url("index"))
+
+
+class Register(BaseHandler):
+    @PROM_REQUESTS.sync("register")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if not self.application.config["REGISTRATION_ENABLED"]:
+            raise HTTPError(403)
+        if self.current_user:
+            return self.redirect(self.reverse_url("index"))
+        else:
+            if not self.application.config["ALLOW_EXTERNAL_LOGIN"] or (
+                self.application.config["ALLOW_EXTERNAL_LOGIN_BYPASS"]
+                and self.get_argument("bypass", None) is not None
+            ):
+                return self.render("auth/login.html", register=True)
+            else:
+                return self.render(
+                    "auth/cilogon.login.html",
+                    idps=get_idps(self.db),
+                    entity_id=self.get_cookie("entity_id", None),
+                )
+
+    @PROM_REQUESTS.async_("register")
+    async def post(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if (
+            self.application.config["ALLOW_EXTERNAL_LOGIN"]
+            and not self.application.config["ALLOW_EXTERNAL_LOGIN_BYPASS"]
+        ):
+            raise HTTPError(404)
+        if not self.application.config["REGISTRATION_ENABLED"]:
+            raise HTTPError(403)
+        try:
+            login = self.get_body_argument("login")
+            password1 = self.get_body_argument("password1")
+            password2 = self.get_body_argument("password2")
+            login = validate.fix_user_login(login, new=True)
+            validate.user_password(password1)
+            email = self.get_body_argument("email", "")
+            if email:
+                validate.user_email(email)
+            if password1 != password2:
+                raise validate.InvalidFormat(_f("Passwords do not match"))
+            if self.db.query(database.User).get(login) is not None:
+                raise validate.InvalidFormat(_f("User name is taken"))
+            if (
+                email
+                and self.db.query(database.User)
+                .filter(database.User.email == email)
+                .count()
+                > 0
+            ):
+                raise validate.InvalidFormat(
+                    _f("Email address is already used")
+                )
+            user = database.User(login=login)
+            user.role = "PROJECT_ADMIN"
+            await user.set_password(password1)
+            if email:
+                user.email = email
+            if (
+                self.application.terms_of_service is not None
+                and self.get_body_argument("tos", None) != "accepted"
+            ):
+                raise validate.InvalidFormat(
+                    _f(
+                        "Terms of Service must be accepted",
+                    )
+                )
+            self.db.add(user)
+            self.db.commit()
+            logger.info("User registered: %r", login)
+            self.set_secure_cookie("user", login)
+            return self.redirect(self.reverse_url("index"))
+        except validate.InvalidFormat as e:
+            logger.info("Error validating Register: %r", e)
+            return await self.render(
+                "auth/login.html",
+                register=True,
+                register_error=self.gettext(e.message),
+            )
+
+
+class UserPermissions(BaseHandler):
+    def prepare(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        user = self.db.query(database.User).get(self.current_user)
+        if not user.role.can_change_role():
+            raise HTTPError(403)
+
+    @PROM_REQUESTS.sync("permissions")
+    def get(self):
+        user = self.db.query(database.User).get(self.current_user)
+        members = (
+            self.db.query(database.User).filter(
+                database.User.approved_by_user_login == self.current_user
+            )
+        ).all()
+        members_json = Markup(
+            json.dumps(
+                {
+                    user.login: {"privileges": user.role.name}
+                    for user in members
+                }
+            )
+        )
+        _ = self.xsrf_token  # Make sure XSRF cookie is set
+        return self.render(
+            "permissions.html",
+            members=members_json,
+            user=user,
+            user_login=Markup(json.dumps(self.current_user)),
+        )
+
+
+class Cilogon(BaseHandler):
+    flow_cilogon = None
+
+    def flow_func_cilogon(self):
+        d = {}
+
+        def get_flow():
+            if "FLOW" in d:
+                return d["FLOW"]
+
+            # Notes:
+            # The first in the list of selected_idp will be the
+            # default choice of idp
+            f = OAuth2WebServerFlow(
+                auth_uri=self.application.config["OAUTH_AUTH_URI"],
+                token_uri=self.application.config["OAUTH_TOKEN_URI"],
+                client_id=self.application.config["OAUTH_CLIENT_ID"],
+                client_secret=self.application.config["OAUTH_CLIENT_SECRET"],
+                scope=self.application.config["OAUTH_SCOPE"],
+                redirect_uri=self.application.config["OAUTH_CALLBACK_URL"],
+            )
+            f.params["access_type"] = "offline"  # offline access
+            f.params["include_granted_scopes"] = "true"  # incremental auth
+
+            d["FLOW"] = f
+            return f
+
+        return get_flow
+
+    def login_cilogon(self, entity_id=None, appredirecturl="None"):
+        state_encoded_str = str(
+            base64.b64encode(str(appredirecturl).encode("utf-8")), "utf-8"
+        )
+        auth_uri = self.flow_cilogon().step1_get_authorize_url(
+            state=state_encoded_str
+        )
+        if entity_id is not None:
+            auth_uri += f"&idphint={entity_id}"
+        return self.redirect(auth_uri, status=301)
+
+    @PROM_REQUESTS.sync("cilogon")
+    def get(self):
+        entity_id = self.get_argument("entity_id", '')
+        self.set_cookie("entity_id", entity_id)
+        self.flow_cilogon = self.flow_func_cilogon()
+        self.login_cilogon(entity_id=entity_id)
+
+
+class CilogonCallback(BaseHandler):
+    @PROM_REQUESTS.sync("ci_callback")
+    def get(self):
+        error = self.get_argument("error", None)
+        error_description = self.get_argument("error_description", "")
+        if error:
+            logger.error(
+                f"CILogon : ERROR : {error}, MESSAGE: {error_description}"
+            )
+            error = url_escape(error)
+            error_description = url_escape(error_description)
+            return self.redirect(
+                self.reverse_url("login")
+                + f"?error={error}&error_msg={error_description}"
+            )
+        else:
+            logger.info("CILogon : Success")
+            auth_code = self.get_argument("code", None)
+            self.cilogon_callback(auth_code)
+
+    def get_ci_token(self, params):
+        if self.application.config["OAUTH_TOKEN_METHOD"].lower() == "get":
+            return requests.get(
+                self.application.config["OAUTH_TOKEN_URI"], params=params
+            )
+        else:
+            return requests.post(
+                self.application.config["OAUTH_TOKEN_URI"], params=params
+            )
+
+    def get_ci_user_infos(self, access_token):
+        return requests.get(
+            self.application.config["OAUTH_USERINFO_URI"],
+            params={"access_token": access_token},
+        )
+
+    def cilogon_callback(self, auth_code=""):
+        if not auth_code:
+            login_url = self.reverse_url("login")
+            error_description = url_escape("Invalid authorization code")
+            return self.redirect(
+                f"{login_url}?error=error&error_msg={error_description}"
+            )
+        #######################################################################
+        # Get user informations from CILogon
+        params = {
+            "grant_type": "authorization_code",
+            "code": auth_code,
+            "client_id": self.application.config["OAUTH_CLIENT_ID"],
+            "client_secret": self.application.config["OAUTH_CLIENT_SECRET"],
+            "redirect_uri": self.application.config["OAUTH_CALLBACK_URL"],
+        }
+        error = False
+        cil_user_infos = {}
+
+        tok = self.get_ci_token(params)
+        if tok.status_code == 200:
+            tok = tok.json()
+            r = self.get_ci_user_infos(tok["access_token"])
+            logger.info(r)
+            if r.status_code == 200:
+                cil_user_infos = r.json()
+                logger.info(cil_user_infos)
+            else:
+                error = True
+        else:
+            error = True
+
+        if error:
+            login_url = self.reverse_url("login")
+            error_description = url_escape("Invalid CI Logon response")
+            return self.redirect(
+                f"{login_url}?error=error&error_msg={error_description}"
+            )
+
+        #######################################################################
+        # Set user provenances.
+        # We use local cached list of Edugain IDPs (updated weekly)
+        cil_user_infos["idp"] = cil_user_infos["idp"] \
+            if "idp" in cil_user_infos else ""
+        edugain_idp = (
+            self.db.query(database.EdugainIdps)
+            .filter(database.EdugainIdps.entityid == cil_user_infos["idp"])
+            .first()
+        )
+        cil_user_infos["edugain.code"] = edugain_idp.code \
+            if edugain_idp is not None else ''
+        email = cil_user_infos.get('email', '')
+
+        # Check access rules (whitelist/blacklist) if configured
+        access_rules = self.application.config.get('_access_rules')
+        cil_user_infos["force_role"] = None
+        if access_rules:
+            from ..access_control import check_access, get_role_from_rule
+            result = check_access(access_rules, cil_user_infos)
+            cil_user_infos["force_role"] = (
+                get_role_from_rule(result['matched_rule']))
+            if not result['allowed']:
+                logger.warning(
+                    "Access denied for %s: %s", email, result['reason']
+                )
+                error_msg = url_escape(
+                    "Restricted access. Your email is not authorized."
+                )
+                return self.redirect(
+                    self.reverse_url("login")
+                    + f"?error=error&error_msg={error_msg}"
+                )
+
+        if email:
+            logger.info("OK CILogon provided email")
+        else:
+            logger.error(
+                "LOGIN FAILED : Using CILogon : "
+                "CILogon user email= !!! Email not provided !!!"
+            )
+            logger.error("Dump CILogon information")
+            logger.error(json.dumps(cil_user_infos, indent=3))
+            error_msg = url_escape("No email provided from CI Logon")
+            return self.redirect(
+                self.reverse_url("login")
+                + f"?error=error&error_msg={error_msg}"
+            )
+
+        self.init_session(cil_user_infos)
+
+        # Log information
+        logger.info(
+            f"LOGIN SUCCESS : Using CILogon : email={cil_user_infos['email']}"
+        )
+
+    def init_session(self, user_info):
+        login = user_info["email"].lower()
+        user = self.db.query(database.User).get(login)
+        if user is None:
+            logger.info(
+                f"CILogon Login: User login not found: {login}, "
+                "searching email."
+            )
+            user = (
+                self.db.query(database.User)
+                .filter(database.User.email == login)
+                .first()
+            )
+            if user:
+                logger.info(
+                    f"CILogon Login: Updating user info for existing "
+                    f"user: {user.login} -> {login}."
+                )
+                user.login = login
+                user.displayname = user_info["name"] if "name" in user_info \
+                    else self.generateUserDisplayNameFromEmail(
+                    user_info["email"])
+                user.external = True
+                self.db.commit()
+        if user is None:
+            logger.info(
+                f"CILogon Login: non-existent user, create user {login}"
+            )
+            user = database.User(login=login)
+            user.displayname = user_info["name"] if "name" in user_info \
+                else self.generateUserDisplayNameFromEmail(user_info["email"])
+            user.login = login
+            user.email = login
+            user.external = True
+            user.disabled = False
+            user.role = user_info["force_role"] \
+                if ("force_role" in user_info
+                    and user_info["force_role"] is not None) \
+                else "PROJECT_ADMIN"
+            self.db.add(user)
+            self.db.commit()
+            self.set_secure_cookie("user", login)
+            PROM_USER_CONNECTIONS.inc()
+            PROM_ACTIVE_SESSIONS.inc()
+            return self.redirect(self.reverse_url("index"))
+        else:
+            logger.info("CILogon Login: Logging in..")
+            self.login(user.login)
+            PROM_USER_CONNECTIONS.inc()
+            PROM_ACTIVE_SESSIONS.inc()
+            return self._go_to_next()
+
+    def generateUserDisplayNameFromEmail(self, email):
+        displayname = re.sub(r"[._]", " ", email.split('@', 1)[0])
+        return displayname
+
+    def _go_to_next(self):
+        next_ = self.get_argument("next", "")
+        if not next_:
+            next_ = self.reverse_url("index")
+        return self.redirect(next_)
+
+
+class TermsOfService(BaseHandler):
+    @PROM_REQUESTS.sync("tos")
+    def get(self):
+        if self.application.terms_of_service:
+            return self.render(
+                "tos.html",
+                tos_text=Markup(self.application.terms_of_service),
+            )
+        else:
+            raise HTTPError(404)
+
+
+class Downloads(BaseHandler):
+    @PROM_REQUESTS.sync("downloads")
+    def get(self):
+        from .. import version_check
+        version_check.get_outdated_version()
+        latest_tag = version_check._cache.get('latest')
+        latest_version = None
+        if latest_tag:
+            match = version_check._VERSION_RE.search(latest_tag)
+            if match:
+                latest_version = match.group(1)
+        return self.render(
+            "downloads.html",
+            latest_version=latest_version,
+            windows_url=self.application.config.get('INSTALLER_URL'),
+            macos_url=self.application.config.get('MACOS_INSTALLER_URL'),
+        )
+
+
+class DownloadTracker(BaseHandler):
+    _OS_TO_CONFIG = {
+        'windows': 'INSTALLER_URL',
+        'macos': 'MACOS_INSTALLER_URL',
+    }
+
+    @PROM_REQUESTS.sync("download_track")
+    def get(self, os_name):
+        target = self.application.config.get(
+            self._OS_TO_CONFIG.get(os_name, ''))
+        if not target:
+            raise HTTPError(404)
+        PROM_DOWNLOADS.labels(os_name).inc()
+        return self.redirect(target)
+
+
+class Account(BaseHandler):
+    def get_languages(self):
+        locale_list = [
+            (
+                loc_code,
+                tornado.locale.get(loc_code).name
+                if tornado.locale.get(loc_code).name != "Unknown"
+                else loc_code,
+            )
+            for loc_code in tornado.locale.get_supported_locales()
+        ]
+        # locale_list.append(('en', self.gettext("English")))
+        return locale_list
+
+    @authenticated
+    @PROM_REQUESTS.sync("account")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        user = self.db.query(database.User).get(self.current_user)
+        if not self.application.config['ALLOW_EXTERNAL_LOGIN']:
+            return self.render(
+                "auth/account.html",
+                user=user,
+                current_language=user.language,
+                is_external=self.application.config["ALLOW_EXTERNAL_LOGIN"],
+            )
+        else:
+            return self.render('auth/external_account.html',
+                               user=user,
+                               current_language=user.language)
+
+    @authenticated
+    @PROM_REQUESTS.async_("account")
+    async def post(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        user = self.db.query(database.User).get(self.current_user)
+        try:
+            displayname = self.get_body_argument("displayname", None)
+            email = self.get_body_argument("email", None)
+            language = self.get_body_argument("language", None)
+            hide_code_counts = self.get_body_argument(
+                "hide_code_counts", None,
+            )
+            password1 = self.get_body_argument("password1", None)
+            password2 = self.get_body_argument("password2", None)
+            if displayname is not None:
+                user.displayname = displayname
+            if displayname == "":
+                user.displayname = None
+            if email is not None:
+                if email:
+                    validate.user_email(email)
+                user.email = email.lower() or None
+            if not self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+                if password1 or password2:
+                    validate.user_password(password1)
+                    if password1 != password2:
+                        raise validate.InvalidFormat(
+                            _f("Passwords do not match")
+                        )
+                    await user.set_password(password1)
+            if language not in tornado.locale.get_supported_locales():
+                language = None
+            user.language = language
+            user.hide_code_counts = hide_code_counts is not None
+            self.db.commit()
+            return self.redirect(self.reverse_url("account"))
+        except validate.InvalidFormat as e:
+            logger.info("Error validating Account: %r", e)
+            template = "auth/account.html"
+            if self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+                template = "auth/external_account.html"
+
+            return await self.render(
+                template,
+                user=user,
+                current_language=user.language,
+                error=self.gettext(e.message),
+            )
+
+
+class AskResetPassword(BaseHandler):
+    @PROM_REQUESTS.sync("reset_password")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+            raise HTTPError(404)
+        return self.render("auth/reset_password.html")
+
+    @PROM_REQUESTS.async_("reset_password")
+    async def post(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+            raise HTTPError(404)
+        email = self.get_body_argument("email")
+        user = (
+            self.db.query(database.User)
+            .filter(database.User.email == email)
+            .filter(database.User.disabled == False)  # noqa: E712
+        ).one_or_none()
+        if user is None:
+            return await self.render(
+                "auth/reset_password.html",
+                error=self.gettext(
+                    "This email address is not associated with any user"
+                ),
+            )
+        elif (
+            user.email_sent is None
+            or user.email_sent + timedelta(days=1) < datetime.utcnow()
+        ):
+            # Generate a signed token
+            reset_token = "%s|%s|%s" % (
+                int(time.time()),
+                user.login,
+                user.email,
+            )
+            reset_token = self.create_signed_value("reset_token", reset_token)
+            reset_token = reset_token.decode("utf-8")
+
+            # Reset link
+            path = self.request.path
+            if path.endswith("/reset_password"):
+                path = path[:-15]
+            path = path + "/new_password"
+            reset_link = urlunparse(
+                [
+                    "https",
+                    self.request.host,
+                    path,
+                    "",
+                    "reset_token=" + reset_token,
+                    "",
+                ]
+            )
+
+            msg = EmailMessage()
+            msg["Subject"] = self.gettext("Password reset for Taguette")
+            msg["From"] = self.application.config["EMAIL"]
+            msg["To"] = "{} <{}>".format(user.login, user.email)
+            msg.set_content(
+                self.render_string(
+                    "email_reset_password.txt",
+                    link=reset_link,
+                    login=user.login,
+                )
+            )
+            msg.add_alternative(
+                self.render_string(
+                    "auth/email_reset_password.html",
+                    link=reset_link,
+                    login=user.login,
+                ),
+                subtype="html",
+            )
+
+            logger.warning(
+                "Sending reset password email to %s %s", user.login, user.email
+            )
+            await asyncio.get_event_loop().run_in_executor(
+                None,
+                lambda: self.application.send_mail(msg),
+            )
+            user.email_sent = datetime.utcnow()
+            self.db.commit()
+        else:
+            logger.warning(
+                "NOT Sending reset password email to %s %s (rate limited)",
+                user.login,
+                user.email,
+            )
+        return await self.render(
+            "auth/reset_password.html", message=self.gettext("Email sent!")
+        )
+
+
+class SetNewPassword(BaseHandler):
+    def decode_reset_token(self, reset_token):
+        reset_token_clear = self.get_secure_cookie(
+            "reset_token",
+            reset_token,
+            min_version=2,
+            max_age_days=1,
+        )
+        if reset_token_clear is None:
+            raise HTTPError(403, _f("Invalid token"))
+        ts, login, email = reset_token_clear.decode("utf-8").split("|", 2)
+        user = self.db.query(database.User).get(login)
+        if not user or user.disabled or user.email != email:
+            raise HTTPError(403, _f("No user associated with that token"))
+        if user.password_set_date >= datetime.utcfromtimestamp(int(ts)):
+            # Password has been changed after the reset token was created
+            raise HTTPError(403, _f("Password has already been changed"))
+        return user
+
+    @PROM_REQUESTS.sync("new_password")
+    def get(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+            raise HTTPError(404)
+        reset_token = self.get_query_argument("reset_token")
+        try:
+            self.decode_reset_token(reset_token)
+        except HTTPError as e:
+            self.set_status(403)
+            return self.render(
+                "auth/login.html",
+                register=False,
+                login_error=self.gettext(e.log_message),
+            )
+        return self.render("new_password.html", reset_token=reset_token)
+
+    @PROM_REQUESTS.async_("new_password")
+    async def post(self):
+        if not self.application.config["MULTIUSER"]:
+            raise HTTPError(404)
+        if self.application.config["ALLOW_EXTERNAL_LOGIN"]:
+            raise HTTPError(404)
+        reset_token = self.get_body_argument("reset_token")
+        try:
+            user = self.decode_reset_token(reset_token)
+        except HTTPError as e:
+            self.set_status(403)
+            return await self.render(
+                "auth/login.html",
+                register=False,
+                login_error=self.gettext(e.log_message),
+            )
+        try:
+            password1 = self.get_body_argument("password1")
+            password2 = self.get_body_argument("password2")
+            validate.user_password(password1)
+            if password1 != password2:
+                raise validate.InvalidFormat(_f("Passwords do not match"))
+            logger.info("Password reset: changing password for %r", user.login)
+            await user.set_password(password1)
+            self.db.commit()
+            return self.redirect(self.reverse_url("index"))
+        except validate.InvalidFormat as e:
+            logger.info("Error validating SetNewPassword: %r", e)
+            return await self.render(
+                "new_password.html",
+                reset_token=reset_token,
+                error=self.gettext(e.message),
+            )
+
+
+class BugReport(BaseHandler):
+    def _user_projects(self):
+        if not self.current_user:
+            return []
+        user = self.db.query(database.User).get(self.current_user)
+        projects = [
+            m.project for m in user.project_memberships
+            if not m.project.is_archived
+        ]
+        projects.sort(key=lambda p: (p.name or "").lower())
+        return projects
+
+    @PROM_REQUESTS.sync("bug_report")
+    def get(self):
+        if self.application.config["MULTIUSER"] and not self.current_user:
+            raise HTTPError(404)
+        email = ""
+        if self.current_user:
+            user = self.db.query(database.User).get(self.current_user)
+            email = user.email or ""
+        project_id = self.get_query_argument("project_id", "").strip()
+        return self.render(
+            "bug_report.html",
+            description="",
+            email=email,
+            project_id=project_id,
+            projects=self._user_projects(),
+        )
+
+    @PROM_REQUESTS.async_("bug_report")
+    async def post(self):
+        if self.application.config["MULTIUSER"] and not self.current_user:
+            raise HTTPError(404)
+        description = self.get_body_argument("description")
+        email = self.get_body_argument("email", "")
+        project_id = self.get_body_argument("project_id", "").strip()
+        screenshots = self.request.files.get("screenshot", [])
+        projects = self._user_projects()
+
+        rate_limit_key = self.current_user or self.request.remote_ip
+        history = self.application.bug_reports[rate_limit_key]
+        cutoff = datetime.utcnow() - timedelta(hours=24)
+        history[:] = [sent for sent in history if sent > cutoff]
+        if len(history) >= 10:
+            return await self.render(
+                "bug_report.html",
+                description=description,
+                email=email,
+                project_id=project_id,
+                projects=projects,
+                error=self.gettext(
+                    "You've reached the limit of 10 bug reports per 24"
+                    " hours. Please try again later."
+                ),
+            )
+
+        if not project_id:
+            return await self.render(
+                "bug_report.html",
+                description=description,
+                email=email,
+                project_id=project_id,
+                projects=projects,
+                error=self.gettext("Please provide the project ID"),
+            )
+        if len(screenshots) > 5:
+            return await self.render(
+                "bug_report.html",
+                description=description,
+                email=email,
+                project_id=project_id,
+                projects=projects,
+                error=self.gettext("You can attach at most 5 images"),
+            )
+        for screenshot in screenshots:
+            if not screenshot["content_type"].startswith("image/"):
+                return await self.render(
+                    "bug_report.html",
+                    description=description,
+                    email=email,
+                    project_id=project_id,
+                    projects=projects,
+                    error=self.gettext("Attachments must be images"),
+                )
+            if len(screenshot["body"]) > 15 * 1024 * 1024:
+                return await self.render(
+                    "bug_report.html",
+                    description=description,
+                    email=email,
+                    project_id=project_id,
+                    projects=projects,
+                    error=self.gettext("Each image must be under 15MB"),
+                )
+
+        msg = EmailMessage()
+        msg["Subject"] = self.gettext("Bug report from LibreQDA")
+        msg["From"] = self.application.config["EMAIL"]
+        msg["To"] = (
+            self.application.config.get("BUG_REPORT_EMAIL_TO")
+            or self.application.config["EMAIL"]
+        )
+        if email:
+            msg["Reply-To"] = email
+        msg.set_content(
+            self.render_string(
+                "email_bug_report.txt",
+                description=description,
+                login=self.current_user,
+                email=email,
+                project_id=project_id,
+            )
+        )
+        for screenshot in screenshots:
+            maintype, _, subtype = screenshot["content_type"].partition("/")
+            msg.add_attachment(
+                screenshot["body"],
+                maintype=maintype,
+                subtype=subtype,
+                filename=screenshot["filename"],
+            )
+
+        logger.info("Sending bug report email from %r", self.current_user)
+        try:
+            await asyncio.get_event_loop().run_in_executor(
+                None,
+                lambda: self.application.send_mail(msg),
+            )
+        except Exception:
+            logger.exception("Failed to send bug report email")
+            return await self.render(
+                "bug_report.html",
+                description=description,
+                email=email,
+                project_id=project_id,
+                projects=projects,
+                error=self.gettext(
+                    "Sorry, we couldn't send your report right now."
+                    " Please try again in a few minutes."
+                ),
+            )
+        history.append(datetime.utcnow())
+        return await self.render(
+            "bug_report.html",
+            description="",
+            email=email,
+            project_id="",
+            projects=projects,
+            message=self.gettext(
+                "Your bug report has been sent. Thank you!"
+            ),
+        )
+
+
+class ProjectAdd(BaseHandler):
+    def prepare(self):
+        user = self.db.query(database.User).get(self.current_user)
+        if not user.role.can_create_project():
+            raise HTTPError(403)
+
+    @authenticated
+    @PROM_REQUESTS.sync("new_project")
+    def get(self):
+        return self.render("project_new.html")
+
+    @authenticated
+    @PROM_REQUESTS.sync("new_project")
+    def post(self):
+        name = self.get_body_argument("name", "")
+        description = self.get_body_argument("description", "")
+        try:
+            validate.project_name(name)
+            validate.description(description)
+
+            # Create project
+            project = database.Project(name=name, description=description)
+            self.db.add(project)
+            # Add user as admin
+            membership = database.ProjectMember(
+                project=project,
+                user_login=self.current_user,
+                privileges=database.Privileges.ADMIN,
+            )
+            self.db.add(membership)
+            # Add default tags
+            self.db.add(
+                database.Tag(
+                    project=project,
+                    # TRANSLATORS: Default tag name
+                    path=self.gettext("interesting"),
+                    # TRANSLATORS: Default tag color
+                    color=self.application.tag_default_color,
+                    # TRANSLATORS: Default tag description
+                    description=self.gettext("Further review required"),
+                ),
+            )
+
+            self.db.commit()
+            return self.redirect(self.reverse_url("project", project.id))
+        except validate.InvalidFormat as e:
+            logger.info("Error validating ProjectAdd: %r", e)
+            return self.render(
+                "project_new.html",
+                name=name,
+                description=description,
+                error=self.gettext(e.message),
+            )
+
+    def render(self, template_name, **kwargs):
+        for name in ("name", "description", "error"):
+            kwargs.setdefault(name, "")
+        super(ProjectAdd, self).render(template_name, **kwargs)
+
+
+class ProjectImport(BaseHandler):
+    def prepare(self):
+        user = self.db.query(database.User).get(self.current_user)
+        if (
+            not self.application.config["SQLITE3_IMPORT_ENABLED"]
+            or not user.role.can_create_project()
+        ):
+            raise HTTPError(403)
+
+    @authenticated
+    @PROM_REQUESTS.sync("import_project")
+    def get(self):
+        user = self.db.query(database.User).get(self.current_user)
+        return self.render("project_import.html", user=user)
+
+
+class ProjectDelete(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("delete_project")
+    def get(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_delete_project():
+            self.set_status(403)
+            return self.finish(
+                self.gettext(
+                    "You don't have permission to delete this project",
+                )
+            )
+        doc = aliased(database.Document)
+        highlights = (
+            self.db.query(database.Highlight)
+            .join(doc, database.Highlight.document_id == doc.id)
+            .filter(doc.project_id == project.id)
+        ).count()
+        return self.render(
+            "project_delete.html",
+            project=project,
+            documents=len(project.documents),
+            tags=len(project.tags),
+            highlights=highlights,
+        )
+
+    @authenticated
+    @PROM_REQUESTS.sync("delete_project")
+    def post(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_delete_project():
+            raise HTTPError(403)
+        logger.warning(
+            "Deleting project %d %r user=%r",
+            project.id,
+            project.name,
+            self.current_user,
+        )
+        self.db.delete(project)
+        self.db.commit()
+        return self.redirect(self.reverse_url("index"))
+
+
+class ProjectArchive(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("archive_project")
+    def post(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_delete_project():
+            raise HTTPError(403)
+        logger.info(
+            "Archiving project %d %r user=%r",
+            project.id,
+            project.name,
+            self.current_user,
+        )
+        project.is_archived = True
+        self.db.commit()
+        return self.redirect(self.reverse_url("index"))
+
+
+class ProjectUnarchive(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("unarchive_project")
+    def post(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_delete_project():
+            raise HTTPError(403)
+        logger.info(
+            "Unarchiving project %d %r user=%r",
+            project.id,
+            project.name,
+            self.current_user,
+        )
+        project.is_archived = False
+        self.db.commit()
+        return self.redirect(self.reverse_url("archived_projects"))
+
+
+class ArchivedProjects(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("archived_projects")
+    def get(self):
+        user = self.db.query(database.User).get(self.current_user)
+        projects = [
+            m.project for m in user.project_memberships
+            if m.project.is_archived
+        ]
+        return self.render(
+            "archived_projects.html",
+            user=user,
+            projects=projects,
+        )
+
+
+class ImportCodebook(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("import_codebook")
+    def get(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_import_codebook():
+            self.set_status(403)
+            return self.finish(
+                self.gettext(
+                    "You don't have permission to import a codebook",
+                )
+            )
+        return self.render("project_import_codebook.html", project=project)
+
+    def _show_confirmation_form(self, project, tags, errors=[]):
+        # Load tags from project, to set whether they exist
+        project_tags = set(tag.path for tag in project.tags)
+        for tag in tags:
+            tag["exists"] = tag["path"] in project_tags
+
+        return self.render(
+            "project_import_codebook_confirm.html",
+            project=project,
+            tags=tags,
+            errors=errors,
+        )
+
+    @authenticated
+    @PROM_REQUESTS.sync("import_codebook")
+    def post(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if not privileges.can_import_codebook():
+            self.set_status(403)
+            return self.render(
+                "project_import_codebook.html",
+                project=project,
+                error=self.gettext(
+                    "You don't have permission to import a codebook",
+                ),
+            )
+
+        if "file" in self.request.files and len(self.request.files) >= 1:
+            uploaded_file = self.request.files["file"][0]
+
+            reader = io.BytesIO(uploaded_file.body)
+            try:
+                tags = import_codebook.list_tags(reader)
+            except import_codebook.InvalidCodebook as e:
+                logger.warning(
+                    "Invalid codebook: %s%s",
+                    e.message,
+                    (" (row %d)" % e.row) if e.row is not None else "",
+                )
+                msg = self.gettext(e.message)
+                if e.row is not None:
+                    msg = self.gettext("Row %d: %s") % (e.row, msg)
+                self.set_status(400)
+                return self.render(
+                    "project_import_codebook.html",
+                    project=project,
+                    error=msg,
+                )
+
+            # Disable duplicates
+            seen_paths = set()
+            for tag in tags:
+                tag["enabled"] = tag["path"] not in seen_paths
+                seen_paths.add(tag["path"])
+
+            # Sort by path, keeping the enabled one first
+            tags = sorted(tags, key=lambda t: (t["path"], not t["enabled"]))
+
+            return self._show_confirmation_form(project, tags)
+        elif self.get_body_argument("tag0-path", None):
+            # Accumulate validation errors
+            errors = []
+            # What to insert/update into database
+            replace_tags = {}
+            insert_tags = []
+            # List of tags to show the confirmation form again on conflict
+            tags = []
+
+            for i in itertools.count():
+                path = self.get_body_argument("tag%d-path" % i, None)
+                parent = self.get_body_argument("tag%d-parent" % i, None)
+                color = self.get_body_argument("tag%d-color" % i, "")
+                description = self.get_body_argument(
+                    "tag%d-description" % i,
+                    "",
+                )
+                if path is None:
+                    break
+
+                replace = enabled = True
+                if self.get_body_argument("tag%d-replace" % i, ""):
+                    replace = True
+                elif self.get_body_argument("tag%d-import" % i, ""):
+                    replace = False
+                else:
+                    enabled = False
+
+                try:
+                    validate.tag_path(path)
+                    validate.description(description)
+                    validate.color(color)
+                except validate.InvalidFormat as e:
+                    errors.append(self.gettext(e.message))
+                    continue
+
+                tags.append(
+                    {
+                        "path": path,
+                        "description": description,
+                        "color": color,
+                        "parent": parent,
+                        "enabled": enabled,
+                    }
+                )
+                if not enabled:
+                    continue
+
+                if replace:
+                    replace_tags[path] = {
+                        "description": description,
+                        "parent": parent,
+                        "color": color,
+                    }
+                else:  # Insert
+                    insert_tags.append(
+                        {
+                            "path": path,
+                            "description": description,
+                            "color": color,
+                            "parent": parent,
+                        }
+                    )
+
+            if errors:
+                self.set_status(400)
+                return self.render(
+                    "project_import_codebook_confirm.html",
+                    project=project,
+                    errors=errors,
+                )
+
+            try:
+                changed_tags = []
+
+                # Do updates
+                for tag in project.tags:
+                    try:
+                        tag_update = replace_tags.pop(tag.path)
+                    except KeyError:
+                        pass
+                    else:
+                        tag.description = tag_update["description"]
+                        tag.color = tag_update["color"]
+                        tag_parent = (
+                            self.db.query(database.Tag)
+                            .filter_by(
+                                path=tag_update["parent"],
+                                project_id=project.id,
+                            )
+                            .first()
+                        )
+                        tag.parent_id = tag_parent.id if tag_parent else None
+                        changed_tags.append(tag)
+                if replace_tags:
+                    raise KeyError
+
+                # Do inserts
+                for tag_insert in insert_tags:
+                    tag_parent = (
+                        self.db.query(database.Tag)
+                        .filter_by(
+                            path=tag_insert["parent"], project_id=project.id
+                        )
+                        .first()
+                    )
+                    tag = database.Tag(
+                        project_id=project.id,
+                        path=tag_insert["path"],
+                        description=tag_insert["description"],
+                        color=tag_insert["color"],
+                        parent_id=tag_parent.id if tag_parent else None,
+                    )
+                    self.db.add(tag)
+                    changed_tags.append(tag)
+                self.db.flush()
+                commands = []
+                for tag in changed_tags:
+                    cmd = database.Command.tag_add(
+                        self.current_user,
+                        tag,
+                    )
+                    self.db.add(cmd)
+                    commands.append(cmd)
+                self.db.flush()
+
+                self.db.commit()
+                for cmd in commands:
+                    self.application.notify_project(project.id, cmd)
+                return self.redirect(self.reverse_url("project", project.id))
+            except (IntegrityError, KeyError):
+                logger.warning("Error importing codebook", exc_info=True)
+                self.db.rollback()
+                error = self.gettext(
+                    "Error importing tags, concurrent changes caused a "
+                    + "conflict",
+                )
+                self.set_status(409)
+                return self._show_confirmation_form(
+                    project,
+                    tags,
+                    errors=[error],
+                )
+        else:
+            self.set_status(400)
+            return self.render(
+                "project_import_codebook.html",
+                project=project,
+                error=self.gettext("No file provided"),
+            )
+
+
+class Project(BaseHandler):
+    @authenticated
+    @PROM_REQUESTS.sync("project")
+    def get(self, project_id):
+        project, privileges = self.get_project(project_id)
+        if project.is_archived:
+            return self.redirect(self.reverse_url('archived_projects'))
+        is_demo = self.get_argument("demo", None)
+        demo_highlights_location = []
+        user = self.db.query(database.User).get(self.current_user)
+        if is_demo is not None:
+            is_demo = "true"
+            lang = user.language
+            if lang not in DEMO_DATA.keys():
+                lang = self.application.config["DEFAULT_LANGUAGE"]
+            demo_highlights_location = DEMO_DATA[lang]["tutorial_highlights"]
+        else:
+            is_demo = "false"
+
+        # Group tags by their parent IDs
+        grouped_tags = defaultdict(list)
+
+        for tag in project.tags:
+            tag_parent_id = tag.parent.id if tag.parent else None
+            grouped_tags[tag_parent_id].append(tag)
+
+        # Function to build the tree structure
+        def build_tree(parent_id):
+            children = []
+            for child_tag in grouped_tags[parent_id]:
+                child_id = child_tag.id
+                parent_id = child_tag.parent.id if child_tag.parent else None
+                color = (
+                    child_tag.color
+                    if child_tag.color
+                    else self.application.tag_default_color
+                )
+                child_info = {
+                    "id": child_tag.id,
+                    "path": child_tag.path,
+                    "description": child_tag.description,
+                    "color": color,
+                    "parent": parent_id,
+                    "count": child_tag.highlights_count,
+                    "count_document": child_tag.documents_count,
+                    "children": build_tree(child_id),
+                }
+                children.append(child_info)
+            return children
+
+        # Build the tree for tags with parent_id=None (root level)
+        result_tree = build_tree(None)
+
+        # Convert the result to JSON
+        tags_json = Markup(json.dumps(result_tree, sort_keys=True))
+
+        # Group collections by their parent IDs
+        grouped_collections = defaultdict(list)
+
+        for collection in project.collections:
+            collection_parent_id = (
+                collection.parent.id if collection.parent else None
+            )
+            grouped_collections[collection_parent_id].append(collection)
+
+        # Function to build the collection tree structure
+        def build_collection_tree(parent_id):
+            children = []
+            for child_collection in grouped_collections[parent_id]:
+                child_id = child_collection.id
+                collection_parent_id = (
+                    child_collection.parent.id
+                    if child_collection.parent
+                    else None
+                )
+                child_info = {
+                    "id": child_collection.id,
+                    "name": child_collection.name,
+                    "description": child_collection.description,
+                    "parent": collection_parent_id,
+                    "document_ids": [d.id for d in child_collection.documents],
+                    "children": build_collection_tree(child_id),
+                }
+                children.append(child_info)
+            return children
+
+        # Build the tree for collections with parent_id=None (root level)
+        collections_tree = build_collection_tree(None)
+
+        # Convert the result to JSON
+        collections_json = Markup(json.dumps(collections_tree, sort_keys=True))
+
+        documents_json = Markup(
+            json.dumps(
+                {
+                    str(doc.id): {
+                        "id": doc.id,
+                        "name": doc.name,
+                        "description": doc.description,
+                        "favorite": doc.favorite,
+                        "text_direction": doc.text_direction.name,
+                        "collections": [c.id for c in doc.collections],
+                        "highlights_count": doc.highlights_count,
+                    }
+                    for doc in project.documents
+                },
+                sort_keys=True,
+            )
+        )
+
+        members = (
+            self.db.query(database.ProjectMember).filter(
+                database.ProjectMember.project_id == project_id
+            )
+        ).all()
+        can_import_codebook = privileges.can_import_codebook()
+        can_delete_project = privileges.can_delete_project()
+        members_json = Markup(
+            json.dumps(
+                {
+                    member.user_login: {"privileges": member.privileges.name}
+                    for member in members
+                }
+            )
+        )
+        _ = self.xsrf_token  # Make sure XSRF cookie is set
+        return self.render(
+            "project.html",
+            project=project,
+            last_event=(
+                project.last_event if project.last_event is not None else -1
+            ),
+            collections=collections_json,
+            documents=documents_json,
+            user_login=Markup(json.dumps(self.current_user)),
+            tags=tags_json,
+            members=members_json,
+            can_import_codebook=can_import_codebook,
+            can_delete_project=can_delete_project,
+            is_external_login=self.application.config["ALLOW_EXTERNAL_LOGIN"],
+            is_demo=Markup(is_demo),
+            demo_highlights_location=Markup(demo_highlights_location),
+            user=user,
+        )