<?php
require_once __DIR__.'/inc/Db.php';
require_once 'function_login_block.php';

defined('HTML_EOL') or define('HTML_EOL', '<br />');

/*
 * Usage:
*
* -authentication
* Sys_user::auth($userid, $pwd, $return_user);
* return true or false
*
* -change password
* Sys_user::changePassword($id, $orginal_password, $new_password, $confirm_password=null);
* return true or false
*
* -check the (SESSION) user is valid
* Sys_user::checkLogin();
* return true or false
*/

class Sys_user {

	/*
	 * Database USER Table defination
	 */
	const TBL_NAME 			= "sys_login";
	const FLD_ID			= "loginid";
	const FLD_USER			= "username";
	const FLD_LOGINNAME		= "loginname";	
	const FLD_PASSWORD		= "loginpw";
	const FLD_ROLE			= "role";
	const FLD_CREATEDATE	= "createdate";
	const FLD_MODIFYDATE	= "lastupdate";
	const FLD_STATUS		= "status";
	const STATUS_ALLOW		= "1"; // allow status=1 to login

	//settings
	static $SHOW_WARNING 	= false;
	static $ENABLE_CALLBACK	= true;

	/*
	 * To be called if authorization is OK
	 */
	protected static function authSuccessCallback($row){
		//put some variables into SESSION
		$_SESSION['loginname']	= $row{self::FLD_LOGINNAME};
		$_SESSION['loginid']	= $row{self::FLD_ID};
		$_SESSION['role']	= $row{self::FLD_ROLE};

		if($_POST['autologin'] == 1)
		{
			//disabled cookie
				
			//$password_hash = md5($row{'cmsloginpw'}); // will result in a 32 characters hash
			//setcookie ($cookie_name, 'usr='.$row{'cmsloginname'}.'&hash='.$password_hash, time() + $cookie_time);
			//insert_login_log($usrid, true);
		}
		insert_login_log($row{self::FLD_USER}, true);

		header("Location: index.php");
		exit;
	}

	/*
	 * To be called if authorization is Failed
	 */
	protected static function authFailCallback(){
		//put a log into System_log table
		global $login_error;
		$login_error = true;
		insert_login_log($usrid, false);
		die_if_login_block();
	}

	/*
	 * Customize procedure to check during authorization
	 * return ture to allow this authorization
	 */
	protected static function whenAuth(){
		//you can add some checking
		//return false to reject the authorization
		return true;
	}

	// --------------  DO NOT MODIFY BELOW --------------------------------------------

	/*
	 * check the loginid has a valid status (usually run in every script)
	 * $loginid - login ID to be checked ($_SESSION['loginname'] if empty)
	 */
	static function checkLogin($loginid=null){

		global $loggin;
		
		if(empty($loginid)){
			$loginid = $_SESSION['loginname'];
		}

		$sql = "SELECT * FROM ".self::TBL_NAME
				." WHERE ".self::FLD_LOGINNAME . " = :loginname "
				." AND ". self::FLD_STATUS." = :status ";
				
		$sql_param = array(
			':loginname' => $loginid,
			':status' => self::STATUS_ALLOW,
		);

		$sth = Db::getDbh()->prepare($sql);
		//echo $sth->getSQL( $sql_param ).HTML_EOL;
		$sth->execute( $sql_param );	
		if( $error = $sth->getError($sql_param) ){
			var_dump($error);
		}
			
		if($row = $sth->fetch()){
			$loggin = 1;
			return true;
		}
		$loggin = false;
		return false;
	}

	//user authenication
	static function auth($userid, $pwd, &$return_user=null){

		$sql = "SELECT * FROM ".self::TBL_NAME."
				WHERE ".self::FLD_LOGINNAME." = :loginname
						AND ".self::FLD_PASSWORD." = :password
						AND ".self::FLD_STATUS." = :status ";
				
		$sql_param = array(
			':loginname' => $userid,
			':password' => Password::hash($pwd),
			':status' => self::STATUS_ALLOW,
		);

		$sth = Db::getDbh()->prepare($sql);
		//echo $sth->getSQL( $sql_param ).HTML_EOL;
		$sth->execute( $sql_param );	
		if( $error = $sth->getError($sql_param) ){
			var_dump($error);
		}
			
		$result=$sth->fetch();
			
		if( $result && $result[self::FLD_PASSWORD]==Password::hash($pwd) ){
			//var_dump($result[self::FLD_PASSWORD], Password::hash($pwd), $result[self::FLD_PASSWORD]==Password::hash($pwd) ); exit;
			$authenticated =  true;
		}else{
			if(self::$SHOW_WARNING) { print "Login Failed <br/>";	}
			$authenticated =  false;
		}
		
		if( $authenticated && !self::whenAuth() ){
			$authenticated =  false;
		}

		if($authenticated){
			$return_user = $result;
			if(self::$ENABLE_CALLBACK) { self::authSuccessCallback($return_user); }
		}else{
			if(self::$SHOW_WARNING) { print "Login Failed <br/>"; }
			if(self::$ENABLE_CALLBACK) { self::authFailCallback(); }
		}
		return $authenticated;
	}

	//change user password
	static function changePassword($id, $orginal_password, $new_password, $confirm_password=null){
		
		$sql = "SELECT * FROM ".self::TBL_NAME." WHERE ".self::FLD_ID." = :id ";
				
		$sql_param = array(
			':id' => $id
		);

		$sth = Db::getDbh()->prepare($sql);
		//echo $sth->getSQL( $sql_param ).HTML_EOL;
		$sth->execute( $sql_param );	
		if( $error = $sth->getError($sql_param) ){
			var_dump($error);
		}
		
		if(!$result = $sth->fetch()){
			if(self::$SHOW_WARNING) {
				print "User not found <br/>";
			}
			return false;			
		}
		
		if($confirm_password && $new_password==$confirm_password){
			if(self::$SHOW_WARNING) { print "Confirm password is incorrect <br/>"; }
			return false;
		}
		if(Password::hash($orginal_password)!=$result[self::FLD_PASSWORD]){
			if(self::$SHOW_WARNING) { print "Original password is incorrect <br/>"; }
			return false;
		}
		
		if($result[self::FLD_ID]){
			$sql = "UPDATE ".self::TBL_NAME
			." SET ".self::FLD_PASSWORD." = :password, "
					.self::FLD_MODIFYDATE." = :date "
			." WHERE ".self::FLD_ID." = :id ";
					
			$sql_param = array(
				':password' => Password::hash($new_password),
				':date' => date("Y-m-d H:i:s"),
				':id' => (int)$result[self::FLD_ID],
			);
	
			$sth = Db::getDbh()->prepare($sql);
			//echo $sth->getSQL( $sql_param ).HTML_EOL;
			$sth->execute( $sql_param );	
			if( $error = $sth->getError($sql_param) ){
				var_dump($error);
				return false;
			}
			return true;		
		}
		return false;
	}
}

/*	
 * Usage:
*
* -hash
* Password::hash($_POST["cmsloginpw"]);
* return hashed password
*
* -strength test
* Password::strength($_REQUEST[$fld_password], $_REQUEST['username'], $msg);
* $msg: variable to store returned error messages
* return true OR false
*
* -include javascript fragment for Jquery validation
* Password::ajax_validate('cmsloginpw', 'ajax_passwordChecker.php', 'cmsloginname')
* $password: password to be validated
* $ajax_checker: validate script
* $loginname: optional username to be compared with the password
* return javascript string
*/
class Password{
	static $SALT1 			= "3ruthaQE";
	static $SALT2 			= "kaheSt6H";
	static $SALT3 			= "sA6wePej";
	static $SALT4 			= "Tha7unaT";	

	static function hash($str){
		$len = strlen($str);
		$len_a = (int)($len/3);
		$len_b = (int)($len/3);
		//$len_c = $len - $a - $b;
		$a = substr($str, 0, $len_a);
		$b = substr($str, $len_a, $len_b);
		$c = substr($str, $len_a+$len_b);				
		//var_dump(self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
		return hash('sha256', self::$SALT1.$c.self::$SALT2.$b.self::$SALT3.$a.self::$SALT4);
	}
	
	static function strength($password, $username='', &$msg=''){
		//ref: http://www.zorched.net/2009/05/08/password-strength-validation-with-regular-expressions/
		//$pattern = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*[\W_])(?=.*[\d]).{8,15}$/";
		//$t1 = preg_match($pattern, $password, $matches);
		$result = true;
		
		$pattern = "/^.{8,15}$/";
		if(!preg_match($pattern, $password, $matches)){
			$msg .= '<li>Must be 8-15 characters long</li>';	
			$result = false;
		}
		$pattern = "/(?=.*[a-z])/";
		if(!preg_match($pattern, $password, $matches)){
			$msg .= '<li>Include a lower case letter</li>';	
			$result = false;
		}
		$pattern = "/(?=.*[A-Z])/";
		if(!preg_match($pattern, $password, $matches)){
			$msg .= '<li>Include an upper case letter</li>';	
			$result = false;
		}
		$pattern = "/(?=.*[\d])/";
		if(!preg_match($pattern, $password, $matches)){
			$msg .= '<li>Include a number</li>';	
			$result = false;
		}
		$pattern = "/(?=.*[\W_])/";
		if(!preg_match($pattern, $password, $matches)){
			$msg .= '<li>Include a special character</li>';	
			$result = false;
		}
		if(stripos($password, $username)!==false){
			$msg .= '<li>Password cannot contain the username</li>';	
			$result = false;			
		}
		if($msg){
			$msg = '<ul class="validerr">'.$msg.'</ul>';	
		}
	
		return $result;
	}	
	
	

	static function ajax_validate($id, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id='', $required=false){
			$s .='
<script>
$(document).ready(function(e) {
	$( "#'.$id.'" ).rules( "add", {
		"required": '.($required?'true':'false').',
		"minlength": 8,
		"maxlength": 15,
			messages: {
				 remote: "Invalid password format"
			},
		"remote": { 
			url: "'.$ajaxChecker.'",
			type: "post",
			data:{
				allowEmpty: "'.($required?'false':'true').'",
				fld: "'.$id.'",
				username: function(){
					return $("#'.$usernameInput_id.'").val();
				}
			},
		}
	});
});
</script>';

		return $s;
	}	
	
	static function html_input($tag_attr, $id, $ajaxChecking=true, $ajaxChecker='ajax_passwordChecker.php', $usernameInput_id=''){
		if(empty($id)){
			$id=rand(1000,999999);
		}			
		$s='<input type="text" '.$tag_attr.' id="'.$id.'" >';
		if($ajaxChecking){//change, blur, keyup
			if($usernameInput_id){
				$usernameInput = ", #".$usernameInput_id;	
			}
			$s .='<script>
					$("#'.$id.$usernameInput.'").on("change, blur, keyup", function(e){
						$.getJSON( "'.$ajaxChecker.'", {
								password: $("#'.$id.'").val(),
								username: $("#'.$usernameInput_id.'").val(),
							},
							function(data) {
								if(data.strength){
									$("#'.$id.'").removeClass("bad").addClass("ok");
								}else{
									$("#'.$id.'").removeClass("ok").addClass("bad");
								}
						});
					});
				 </script>';
		}		
		return $s;
	}


}