from pyramid.view import (
    view_config,
)

from pyramid.httpexceptions import (
    HTTPBadRequest,
    HTTPFound,
    HTTPSeeOther,
    HTTPNotFound,
)

from ..models import (
    Site,
    Page,
    PageSection,
    Gallery,
    DBSession,
    )

from pyramid.security import (
    authenticated_userid,
)

@view_config(route_name='site_pages', request_method='POST')
def site_pages(request):
    site = Site.get_from_key_and_user_id(request.matchdict['site_key'], authenticated_userid(request))

    if 'page_name' in request.POST and len(request.POST['page_name'].strip()) > 0:
        page = Page(name=request.POST['page_name'].strip(), site=site)
        DBSession.add(page)

        page_section = PageSection(type='undecided', page=page)
        DBSession.add(page_section)
        DBSession.flush()

        return HTTPSeeOther(location=request.route_url('site_page', site_key=site.key, page_id=page.id))

    return HTTPFound(location=request.route_url('site', site_key=site.key))

@view_config(route_name='site_pages', request_method='GET', renderer='kimochi:templates/site_pages.mako')
def site_pages_list(request):
    site = Site.get_from_key_and_user_id(request.matchdict['site_key'], authenticated_userid(request))

    if site.pages:
        return HTTPFound(location=request.route_url('site_page', site_key=site.key, page_id=site.pages[0].id))

    return {
        'site': site,
    }


@view_config(route_name='site_page', renderer='kimochi:templates/site_page.mako')
def site_page(request):
    site = Site.get_from_key_and_user_id(request.matchdict['site_key'], authenticated_userid(request))
    page = Page.get_for_site_id_and_page_id(site.id, request.matchdict['page_id'])

    if not page:
        return HTTPFound(location=request.route_url('site', site_key=site.key))

    if request.POST and 'page_section_id' in request.POST:
        page_section = page.get_page_section(request.POST['page_section_id'])

        if not page_section:
            return HTTPNotFound()

        if 'section_type' in request.POST and PageSection.is_valid_type(request.POST['section_type']):
            page_section.type = request.POST['section_type']

        if 'section_content' in request.POST:
            page_section.content = request.POST['section_content']

        if 'section_gallery_id' in request.POST:
            gallery = Gallery.get_from_site_id_and_gallery_id(site.id, request.POST['section_gallery_id'])

            if not gallery:
                return HTTPBadRequest()

            page_section.gallery = gallery

    if request.POST and 'command' in request.POST:
        if request.POST['command'] == 'toggle_published':
            page.published = not page.published

            return HTTPSeeOther(
                location=request.current_route_url()
            )

        elif request.POST['command'] == 'page_section_create':
            page_section = PageSection(page=page, type='gallery')

            DBSession.add(page_section)
            DBSession.flush()

            return HTTPSeeOther(
                location=request.route_url('site_page', site_key=site.key, page_id=page.id) + '#page-section-' + str(page_section.id)
            )

    return {
        'site': site,
        'page': page,
    }
@@ -365,18 +365,35 @@
 d='POST'
+, check_csrf=True
 )%0A
-
 def site
@@ -1419,17 +1419,16 @@
 %0A    %7D%0A%0A
-%0A
 @view_co
@@ -1455,16 +1455,39 @@
 e_page',
+ request_method='POST',
  rendere
@@ -1518,24 +1518,41 @@
 e_page.mako'
+, check_csrf=True
 )%0Adef site_p
@@ -1554,16 +1554,23 @@
 ite_page
+_update
 (request
@@ -1864,33 +1864,16 @@
 %0A    if 
-request.POST and 
 'page_se
@@ -2591,16 +2591,186 @@
 allery%0A%0A
+        return HTTPSeeOther(%0A            location=request.route_url('site_page', site_key=site.key, page_id=page.id) + '#page-section-' + str(page_section.id)%0A        )%0A%0A
     if r
@@ -3380,32 +3380,32 @@
 age_section.id)%0A
-
             )%0A%0A 
@@ -3457,16 +3457,373 @@
 ge': page,%0A    %7D
+%0A%0A@view_config(route_name='site_page', renderer='kimochi:templates/site_page.mako')%0Adef site_page(request):%0A    site = Site.get_from_key_and_user_id(request.matchdict%5B'site_key'%5D, authenticated_userid(request))%0A    page = Page.get_for_site_id_and_page_id(site.id, request.matchdict%5B'page_id'%5D)%0A%0A    return %7B%0A        'site': site,%0A        'page': page,%0A    %7D

Add CSRF checks and rework POST handler into own view predicate