<?php

 /**
  * UserIdentity represents the data needed to identity a user.
  * It contains the authentication method that checks if the provided
  * data can identity the user.
  */
 class UserIdentity extends CUserIdentity
     {

     private $_id;
     private $_role;


     /**
      * Authenticates a user using the User data model.
      * @return boolean whether authentication succeeds.
      * The input
      *  $is_reqested_from_client: identify whether the client application (POS) or the web application has requested this method
      */
     public function authenticate($is_reqested_from_client=false)
     {
         $settings_array = Setting::getSettingsArray();
         $authentication_method = isset($settings_array["authentication_method"]) ? $settings_array["authentication_method"] : "";

         if (($authentication_method == "LDAP") || ($authentication_method == "Both"))
         {
             //Check the user try login by email and password or username and password(LDAP Authantication)
             if ( ! filter_var($this->username, FILTER_VALIDATE_EMAIL))
             {
                 //LDAP Authentication
                 //Getting Information for this username and check if this LDAP user have record at system
                 $user = User::model()->active()->findByAttributes(array('username' => $this->username));
                 if ($user === null)
                 {
                     $this->errorCode = self::ERROR_USERNAME_INVALID;
                 }
                 else
                 {
                     //Test Binding by email and password to check if there is LDAP User or not
                     // If the authentication requested is initiated by the server (i.e. not from client), then the POS Admin are not permitted to access the web application
                     if ( ! $is_reqested_from_client && $user->role == "POS Admin")
                     {
                         $this->errorCode = self::ERROR_USERNAME_INVALID;
                     }
                     else
                     {
						 //var_dump($user->email);
                         $binding_result = LDAP::bind($user->email, $this->password);
                         if ($binding_result)
                         {
                             $this->_id = $user->id;
                             $this->errorCode = self::ERROR_NONE;
                             //Add log for the log in operation
                             $log = new Log;
                             $log->user_id = $user->id;
                             $this->_role = $user->role;
                             $log->date_time = date("Y-m-d H:i:s");
                             $log->action = 'Log In';
                             $log->save();
                         }
                         else
                         {
                             $this->errorCode = self::ERROR_USERNAME_INVALID;
                         }
                     }
                 }
                 return ! $this->errorCode;
             }
         }



         if (($authentication_method == "System") || ($authentication_method == "Both"))
         {
             if (filter_var($this->username, FILTER_VALIDATE_EMAIL))
             {
                 //System Authentication
                 $user = User::model()->active()->findByAttributes(array('email' => $this->username));
                 if ($user === null)
                 {
                     $this->errorCode = self::ERROR_USERNAME_INVALID;
                 }
                 else
                 {
                     // If the authentication requested is initiated by the server (i.e. not from client), then the POS Admin are not permitted to access the web application
                     if ( ! $is_reqested_from_client && $user->role == "POS Admin")
                     {
                         $this->errorCode = self::ERROR_USERNAME_INVALID;
                     }
                     else
                     {
                         // Password maching
                         if ($user->password !== $user->encrypt($this->username . $this->password))
                         {
                             $this->errorCode = self::ERROR_PASSWORD_INVALID;
                         }
                         else
                         {
                             $this->_id = $user->id;
                             $this->_role = $user->role;
                             $this->errorCode = self::ERROR_NONE;
                             //Add log for the log in operation
                             $log = new Log;
                             $log->user_id = $user->id;
                             $log->date_time = date("Y-m-d H:i:s");
                             $log->action = 'Log In';
                             $log->save();
                         }
                     }
                 }
                 return ! $this->errorCode;
             }
         }

         // when Authentication Method is Neither or LDAP and username is email
         $this->errorCode = self::ERROR_USERNAME_INVALID;
         return ! $this->errorCode;
     }


     public function getId()
     {
         return $this->_id;
     }


     public function getRole()
     {
         return $this->_role;
     }
     }