package API::Command::Authenticate;
use strict;
use warnings;

use Apache2::Const qw(OK FORBIDDEN HTTP_OK HTTP_UNAUTHORIZED HTTP_NOT_FOUND HTTP_BAD_REQUEST);

use lib '/app/tools/appuser/lib';
use AppUser::DB::Item::User;

use lib '/app/tools/api/lib';
use API::Response;
use API::Session;


use base 'API::Command';

sub area { return "user"; }
sub cmd  { return "authenticate"; }

sub execute {
    my ($self) = @_;

    # Check if the the username and password are valid; if so
    # generate (or refresh) a session and return it

    my $username = $self->getInputParam("username");
    my $password = $self->getInputParam("password");

    return $self->createResponse(
        status => HTTP_UNAUTHORIZED,
        data => { msg => "username and password are required" }
    ) if( '' eq $username || '' eq $password );


    my $valid = 1;
    my $userObj =  AppUser::DB::Item::User->Lookup( email => $username );
    if ( defined $userObj && $userObj->user_id ) {
        if ( !$userObj->disabled ) {
            if ( !AppUser::DB::Item::User->HasPassword( $userObj->user_id, $password ) ) {
                $valid = 0;
                return $self->createResponse(
                    status => HTTP_UNAUTHORIZED,
                    data => { msg => "login denied" }
                );
            }
        } else {
            return $self->createResponse(
                status => HTTP_UNAUTHORIZED,
                data => { msg => "user disabled" }
            );
        }
    } else {
        return $self->createResponse(
            status => HTTP_UNAUTHORIZED,
            data => { msg => "bad username" }
        );
    }

    # user is valid, let's generate a session

    my $cookie_val = API::Session->_genSessionCookie( $userObj->user_id );

    if ( !defined $cookie_val ) {
        return $self->createResponse(
            status => HTTP_BAD_REQUEST,
            data => { msg => "Unable to generate session" }
        );

    }

    return $self->createResponse(
        status => HTTP_OK,
        data => { session => "$cookie_val", userid => 0 + $userObj->user_id }
    );

}

1;