def set_tenant(tenant, scope="request"):
    global context

    if scope == "request":
        context.tenant = tenant
        webapp2.get_request().environ['IN_SESSION'] = False
    else:
        logging.info("**** Storing tenant in session...")
        webapp2.get_request().environ['IN_SESSION'] = True
        sessions.get_store().get_session()['TENANT'] = tenant

 def _get(self, model, id, *extra_filters):
   # TODO(doug) does the model name need to be ascii encoded since types don't support utf-8?
   cls = users if model == "users" else type(model.lower(), (ScopedExpando,), {})
   if id:
     me = False
     if model == "users":
       if id == "me":
         me = True
         id = current_user(required=True)
     key = parse_id(id, model)
     m = key.get()
     if not m:
       if model == "users" and me:
         m = users()
         m.key = key
         setattr(m, "$unsaved", True)
         environ = webapp2.get_request().environ
         for k, v in environ.iteritems():
           if k[:14] == "TAILBONE_USER_" and k != "TAILBONE_USER_ID" and v:
             setattr(m, k[14:].lower(), v)
       else:
         raise AppError("No {} with id {}.".format(model, id))
     return m.to_dict()
   else:
     return query(self, cls, *extra_filters)

def current_user(required=False):
  u = webapp2.get_request().environ.get("TAILBONE_USER_ID")
  if u:
    return ndb.Key("users", u).urlsafe()
  if required:
    raise LoginError("User must be logged in.")
  return None

def is_in_deferred():
    try:
        return webapp2.get_request().headers.get('X-Appengine-Taskname', None) is not None
    except AssertionError:
        # when webapp2.get_requests() returns an assertion error, there is no current request so we must be
        # in a deferred task
        return True

def get_fms_client():
    """
    Returns a soap client object.

    If an object has already been created, we recyle it,
    otherwise, a new one is created and returned.

    """
    app = webapp2.get_app()
    request = webapp2.get_request()

    username = request.registry["session"].get("username")
    password = request.registry["session"].get("password")
    fms_key = "fms_client:{}".format(username)

    # check if we already have the client
    fms_client = app.registry.get(fms_key)
    if not fms_client:
        fms_client = Client(FMS_URL, cache=None)
        fms_client.add_prefix("rsp", "http://response.atms.core.mtrak.digi.com/xsd")
        fms_client.add_prefix("srv", "http://service.atms.core.mtrak.digi.com")
        fms_client.add_prefix("vo", "http://vo.atms.core.mtrak.digi.com/xsd")

        app.registry[fms_key] = fms_client

    fms_client.set_options(soapheaders=(Element("username").setText(username), Element("password").setText(password)))

    return fms_client

    def _new_deferred_run(data):
        try:
            func, args, kwds = pickle.loads(data)
        except Exception as e:
            raise deferred.PermanentTaskFailure(e)
        else:
            try:
                logging.debug('Queue: %s\ndeferred.run(%s.%s%s%s)',
                              get_current_queue(),
                              func.__module__, func.__name__,
                              "".join((",\n             %s" % repr(a) for a in args)),
                              "".join((",\n             %s=%s" % (k, repr(v)) for k, v in kwds.iteritems())))
            except:
                logging.exception('Failed to log the info of this defer (%s)', func)

            try:
                return func(*args, **kwds)
            except deferred.PermanentTaskFailure:
                stop_suppressing()
                raise
            except:
                request = webapp2.get_request()
                if request:
                    execution_count_triggering_error_log = 9
                    execution_count = request.headers.get('X-Appengine-Taskexecutioncount', None)
                    if execution_count and int(execution_count) == execution_count_triggering_error_log:
                        logging.error('This deferred.run already failed %s times!', execution_count, _suppress=False)
                raise

def _create_recovery_email_for_user_id(user_id):
  """ Create a password recovery token for `user` and send an email to the
  User's email address including a link to reset their password. """
  request = webapp2.get_request()
  new_user_recovery_key = users.UserRecovery.create_user_recovery(user_id)
  if new_user_recovery_key:
    query_options = {
      'token': new_user_recovery_key.string_id()
    }
    continue_uri = request.GET.get('continue')
    if continue_uri:
      query_options['continue'] = continue_uri
    reset_url = ''.join([
      request.host_url,
      webapp2.uri_for('loginPasswordReset'),
      '?', urlencode(query_options)
    ])
    user = ndb.Key(users.User, user_id).get()
    sender_email_address = users._email_sender()
    subject = 'Password Reset'
    body = """Reset your password by clicking the link below:

{recovery_link}

You may ignore this email and continue using your current password if you did \
not request this recovery or remember your current password.
""".format(recovery_link=reset_url)
    mail.send_mail(sender_email_address, user.email, subject, body)

def get_device_client():
    '''
    Returns a soap client object.

    If an object has already been created, we recyle it,
    otherwise, a new one is created and returned.

    '''
    app = webapp2.get_app()
    request = webapp2.get_request()

    # check if we already have the client
    username = request.registry['session'].get('username')
    password = request.registry['session'].get('password')
    device_key = 'device_client:{}'.format(username)

    # check if we aleady have the client
    device_client = app.registry.get(device_key)
    if not device_client:
        device_client = Client(DEV_URL, cache=None)
        device_client.add_prefix(
            'rsp', "http://response.devicemanagement.core.mtrak.digi.com/xsd")
        device_client.add_prefix(
            'srv', "http://service.devicemanagement.core.mtrak.digi.com")
        device_client.add_prefix(
            'vo', "http://vo.devicemanagement.core.mtrak.digi.com/xsd")

        app.registry[device_key] = device_client

    device_client.set_options(soapheaders=(
        Element('username').setText(username),
        Element('password').setText(password)))

    return device_client

def get_trace_id_from_webapp2():
    """Get trace_id from webapp2 request headers.

    :rtype: str
    :returns: TraceID in HTTP request headers.
    """
    if webapp2 is None:
        return None

    try:
        # get_request() succeeds if we're in the middle of a webapp2
        # request, or raises an assertion error otherwise:
        # "Request global variable is not set".
        req = webapp2.get_request()
    except AssertionError:
        return None

    header = req.headers.get(_WEBAPP2_TRACE_HEADER)

    if header is None:
        return None

    trace_id = header.split('/', 1)[0]

    return trace_id

def create_security_question(answer1, answer2, answer3,
                             question1, question2, question3, userName):
    """
    Create a new security question.

    """

    lgn_client = get_lgn_client()

    session = webapp2.get_request().registry.get('session')

    userId = session.get('user_id')

    securityQuestionVO = _make_VO('vo', 'SecurityQuestionVO')

    securityQuestionVO.reminderAnswer1 = answer1
    securityQuestionVO.reminderQuestion1 = question1

    securityQuestionVO.reminderAnswer2 = answer2
    securityQuestionVO.reminderQuestion2 = question2

    securityQuestionVO.reminderAnswer3 = answer3
    securityQuestionVO.reminderQuestion3 = question3

    securityQuestionVO.userId = userId
    securityQuestionVO.userName = userName

    response = lgn_client.service.createSecurityQuestion(securityQuestionVO)

    return response

def get_lgn_client():
    '''
    Returns a soap client object.

    If an object has already been created, we recyle it,
    otherwise, a new one is created and returned.

    '''
    app = webapp2.get_app()
    request = webapp2.get_request()

    username = request.registry['session'].get('username')
    password = request.registry['session'].get('password')
    lgn_key = 'lgn_client:{}'.format(username)

    # Check if we already have the client
    lgn_client = app.registry.get(lgn_key)

    if not lgn_client:
        lgn_client = Client(LGN_URL, cache=None)
        lgn_client.add_prefix(
            'srv', "http://service.login.core.mtrak.digi.com")
        lgn_client.add_prefix(
            'vo', "http://vo.login.core.mtrak.digi.com/xsd")

        app.registry[lgn_key] = lgn_client

    lgn_client.set_options(soapheaders=(
        Element('username').setText(username),
        Element('password').setText(password)))

    return lgn_client

  def validate(self):
    request = webapp2.get_request()
    data = json.decode(request.body)

    if not isinstance(data, dict):
      webapp2.abort(403, detail='not a dict')

    for f in self.fields:
      if not f.id in self.validations:
        continue

      try:
        value = data[f.id].strip()
      except KeyError:
        value = ''

      self.field_values[f.id] = value
      for val in self.validations[f.id]:
        val.input = f.id

        if not val.validate(self):
          webapp2.abort(403, 
            detail='validation error, id: %s name: %s value: %s' 
            % (f.id, f.name, value))

    return self.field_values

def reset_password(new_password, answer1, answer2, answer3,
                   question1, question2, question3, userName):
    """
    Reset the password given all of the security questions and answers.

    """

    lgn_client = get_lgn_client()

    session = webapp2.get_request().registry.get('session')

    userId = session.get('user_id')

    securityQuestionVO = _make_VO('vo', 'SecurityQuestionVO')

    securityQuestionVO.newPassword = new_password

    securityQuestionVO.reminderAnswer1 = answer1
    securityQuestionVO.reminderQuestion1 = question1

    securityQuestionVO.reminderAnswer2 = answer2
    securityQuestionVO.reminderQuestion2 = question2

    securityQuestionVO.reminderAnswer3 = answer3
    securityQuestionVO.reminderQuestion3 = question3

    securityQuestionVO.userId = userId
    securityQuestionVO.userName = userName

    response = lgn_client.service.resetPassword(securityQuestionVO)

    return response

def template_values(template_values=dict(), query_options=dict(), user=None):
  """ Return `template_values` plus the default key-value pairs. """
  request = webapp2.get_request()
  continue_uri = request.GET.get('continue')
  if continue_uri:
    query_options['continue'] = continue_uri
    template_values.update(continue_uri=continue_uri)
  logout_query_options = query_options.copy()
  logout_query_options['action'] = 'logout'
  if not user:
    # Only fetch via get_current_user() if `user` kwarg is None
    user = get_current_user()
  if user:
    # Default key-value pairs with logged in user
    template_values.update(user={ 'email': user.email },
      logout_uri=_append_query(
        NDB_USERS_LOGIN_URI, urlencode(logout_query_options)),
      password_change_uri=_append_query(
        NDB_USERS_LOGIN_PASSWORD_CHANGE_URI, urlencode(query_options)),
      password_forgot_uri=_append_query(
        NDB_USERS_LOGIN_PASSWORD_FORGOT_URI, urlencode(query_options))
    )
  else:
    # Default key-value pairs with no user
    template_values.update(
        login_uri=_append_query(
          NDB_USERS_LOGIN_URI, urlencode(query_options)),
        create_uri=_append_query(
          NDB_USERS_LOGIN_CREATE_URI, urlencode(query_options)),
        password_forgot_uri=_append_query(
          NDB_USERS_LOGIN_PASSWORD_FORGOT_URI, urlencode(query_options)),
        password_reset_uri=_append_query(
          NDB_USERS_LOGIN_PASSWORD_RESET_URI, urlencode(query_options))
      )
  return template_values

def generate_csrf_token():
    session = wa2.get_request().registry['session']
    t = session.get('_csrf_token')
    if not t:
        t = utils.newToken()
        session['_csrf_token'] = t
    return t

def _logout_user():
  """ Delete the cookie and terminate the UserSession. """
  request = webapp2.get_request()
  cookie_value = request.cookies.get(NDB_USERS_COOKIE_KEY)
  if cookie_value:
    ndb.Key(users.UserSession, cookie_value).delete()
    request.response.delete_cookie(NDB_USERS_COOKIE_KEY)

def settings():
    """
    Returns the entire settings registry
    """

    # Check local request storage for the completed settings registry
    try:
        request = get_request()
    except AssertionError:
        request = None

    if request and "ferris-settings" in request.registry:
        return request.registry["ferris-settings"]

    # If it's not there, do the normal thing

    settings = {}
    settings.update(_defaults)
    events.fire("build_settings", settings=settings)

    # Try to store it back in the request
    if request:
        request.registry["ferris-settings"] = settings

    return settings

def get_current_queue():
    try:
        import webapp2
        request = webapp2.get_request()
        if request:
            return request.headers.get('X-Appengine-Queuename', None)
    except:
        logging.warn('Failed to get the name of the current queue', exc_info=1)

def get_callback_domain():
    request = webapp2.get_request()
    host = request.host
    if "localhost" in host:
        callback_domain = host
    else:
        callback_domain = CALLBACK_DOMAIN
    return callback_domain

def SetSinglePrivilegedRequest():
  """Allows the current request to act as a privileged user only ONCE.

  This should be called ONLY by handlers that have checked privilege immediately
  before making a query. It will be automatically unset when the next query is
  made.
  """
  request = webapp2.get_request()
  request.registry['single_privileged'] = True