<?php

class App_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
{

    const AUTHORIZATION_HEADER = 'Authorization';
    const MONGO_DB_NAME = 'MongoDBName';

    const AUTH_TYPE_SECRET_ID = 'SECRET';

    protected $_acl;
    protected $_aclRestV1;
    protected $_role;
    protected $_auth;
    protected $_genericModel;
    protected $_configs;
    protected $_ipManager;

    public function __construct()
    {
        $this->_genericModel = new Application_Model_Generic();
        $this->_auth = Zend_Auth::getInstance();
        $this->_acl = new App_Model_Acl_Acl();
        $this->_aclRestV1 = new App_Model_Acl_AclRestV1();

        $this->_role = !$this->_auth->hasIdentity() ? 'unregistered' : $this->_auth->getIdentity()->role;
        $this->_configs = new App_Service_ConfigManager();
        $this->_ipManager = new App_Service_IpManager();

    }

    public function preDispatch(Zend_Controller_Request_Abstract $request)
    {

        //Gestione degli accessi separati per i vari moduli
        /**
         * V1 = Web Service di tipo REST per interfacciarsi verso lesterno [Accesso Tramite TOKEN]
         * DEFAULT | AUTH: Accesso normale del sito
         * ADMIN: Accesso solo per l'utente admin
         */

        switch ($request->getModuleName()) {
            //Il modulo default e auth non hanno bisogno di autenticazione quindi imposto user come 'unregistered' e vado avanti
            case'default':
            case'auth':
                $this->_role = 'unregistered';
                if (!$this->_acl->isAllowed($this->_role, $request->getModuleName())) {
                    $this->denyAccess();
                }
                return;
            case 'admin':
            case 'user':
            case 'monitoring':
                if (!$this->_acl->isAllowed($this->_role, $request->getModuleName())) {
                    $this->_auth->clearIdentity();
                    $this->_redirectLogin($request);
                }
                return;
            case'v1':
                //controllo se il web services non è offline
                if ($this->_configs->get('interrutore_webservices_v1') == 'off' && !$this->_ipManager->allowedIp()) {
                    $this->_redirectOffline($request);
                }

                //controllo il web services ad accesso libero
                $this->_role = 'unregistered';
                if (!$this->_aclRestV1->isAllowed(trim($this->_role), $request->getControllerName())) {
                    //Se il controller non è abilitato all'accesso libero allora procedo con l'autenticazione server v1 tramite token
                    $this->accessoV1($request, $request->getHeader(self::AUTHORIZATION_HEADER));
                } else {
                    if (Zend_Registry::get('ENABLE_MONGODB')) {
                        // controllo se settare il parametro per il nome DB nel caso non sono autenticato utilizzo un db mongo di default
                        $mongoDbName = $request->getHeader(self::MONGO_DB_NAME);
                        if ($mongoDbName) {
                            $mongoDbName = $this->_ipManager->getMongoDbName($mongoDbName);
                            $this->setMongoDbRegistryName($mongoDbName);
                        }
                    }
                }

                break;
            default:
                break;
        }

        //Controllo i permessi prima sul modulo e poi sul controller in caso sia un webservices
        if (!$this->_acl->isAllowed(trim($this->_role), $request->getModuleName())) {
            $this->denyAccess();
        } else {
            switch ($request->getModuleName()) {
                case'v1':
                    if (!$this->_aclRestV1->isAllowed(trim($this->_role), $request->getControllerName()))
                        $this->denyAccess();
                    break;
            }
        }

    }

    private function accessoV1(Zend_Controller_Request_Abstract $request, $token)
    {
        if (!$token) return $this->_redirectNoAuth($request);

        //Controllo che nell'autorization header sia contenuto anche il metodo di autorizazzione lo scompongo e ottendo il codice
        $authorizationHeaderParts = explode(' ', $token);
        if (count($authorizationHeaderParts) > 1) {
            $type = strtoupper($authorizationHeaderParts[0]);
            $token = $authorizationHeaderParts[1];
        } else {
            $token = $authorizationHeaderParts[0];
        }

        $user = null;
        switch ($type) {
            case self::AUTH_TYPE_SECRET_ID:
                $user = $this->authenticateV1SecretToken($token);
                break;
            default:
                $user = $this->authenticateV1($token);
                break;
        }

        // Salvo il token nel registry
        Zend_Registry::set('TOKEN', $token);

        if ($user != null)
            $this->_role = $user['role'];
        else
            $this->_redirectTokenScaduto($request);

        if (!$user['stato']) {
            $this->_redirectDeactiveUserState($request);
        }

        if (Zend_Registry::get('ENABLE_MONGODB')) {
            $mongoDbName = $this->_ipManager->getMongoDbName($user['NomeDB']);
            if ($user['role'] === 'admin') {
                $mongoDbName = $request->getHeader(self::MONGO_DB_NAME);
                if (!$mongoDbName) {
                    $mongoDbName = $this->_ipManager->getMongoAdminDbName();
                } else {
                    $mongoDbName = $this->_ipManager->getMongoDbName($mongoDbName);
                }
            }

            $this->setMongoDbRegistryName($mongoDbName);
        }

    }

    private function setMongoDbRegistryName($mongoDbName)
    {
        if (Zend_Registry::isRegistered(App_Model_Mongo_Adapter::MONGO_DB_ADAPTER_REG_NAME))
            Zend_Registry::get(App_Model_Mongo_Adapter::MONGO_DB_ADAPTER_REG_NAME)->setDbname($mongoDbName);
        else
            Zend_Registry::set(App_Model_Mongo_Adapter::MONGO_DB_NAME, $mongoDbName);
    }

    private function authenticateV1($token)
    {
        $user = $this->_genericModel->getByColumnName('Users', 'token', $token, '=', true);
        if (!$user) {
            return null;
        }

        //Aggiornamento del campo UltimoAccesso
        $this->_genericModel->update('Users', $user['id'], array('UltimoAccesso' => date('Y-m-d H:i:s')));

        return $user;
    }

    private function authenticateV1SecretToken($token)
    {
        $user = $this->_genericModel->getByColumnName('Users', 'secret_token', $token, '=', true);
        if (!$user) {
            return null;
        }

        //Aggiornamento del campo UltimoAccesso
        $this->_genericModel->update('Users', $user['id'], array('UltimoAccesso' => date('Y-m-d H:i:s')));

        return $user;
    }

    public function denyAccess()
    {
        $this->_request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'L\'utente non ha i permessi per accedere alla risorsa.');
    }

    protected function _invalidCredential()
    {
        $this->_request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'Username e/o password errati.');
    }

    protected function _redirectInvalidRequest(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        $request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'Invalid authentication header.');
    }

    protected function _redirectNoAuth(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        $request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'Authentication header not found');
    }

    protected function _redirectUrlScaduto(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        $request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'Url Scaduto');
    }

    protected function _redirectTokenScaduto(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        throw new App_Controller_Errors_WebServiceError(utf8_encode("Accesso Scaduto"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_SESSION_EXPIRED);
    }

    protected function _redirectOffline(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        $request->setModuleName('default')
            ->setControllerName('error')
            ->setActionName('invalid')
            ->setParam('message', 'Il web services è offline');
    }

    protected function _redirectDeactiveUserState(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        throw new App_Controller_Errors_WebServiceError(utf8_encode("Account Api Disattivato"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_SESSION_EXPIRED);
    }

    protected function _redirectNoMongoDBName(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        throw new App_Controller_Errors_WebServiceError(utf8_encode("Nomd DB Mongo non specificato"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_GENERIC_ERROR);
    }

    protected function _redirectLogin(\Zend_Controller_Request_Abstract $request)
    {
        // Forward the request to the noauth error page.
        $request->setParam('section', $request->getModuleName())
            ->setModuleName('default')
            ->setControllerName('index')
            ->setActionName('login');
    }

}