package AppUser::Login::Command::MFAStorePhoneNumber;

use strict;
use warnings;
use URI::Escape;

use lib '/app/tools/appuser/lib';
use AppUser::Login::MFASMSForm;
use AppUser::DB::Item::User;
use AppUser::DB::Item::UserToken;

use lib '/app/tools/common/lib';
use RSApache::Response::Redirect;
use RSApache::Response::XSLT;
use Common::RSApp;
use Common::MFA::Util;
use RSApache::RSWebApp;
use RSApache::Command;

use base 'RSApache::Command';

sub cmd  { return "spn"; }
sub area { return "login"; }
sub app  { return "rps"; }

use constant kTemplate => '/app/tools/appuser/templates/mfasms.xsl';

sub execute {
    my ($self) = @_;

    my $form;
    my $response;
    my $redirect = uri_unescape( $self->getParam("redirect") );

    my $email    = $self->getParam("Form_Email");
    my $cmd      = $self->getParam("c");
    my $token    = $self->getParam("token");

    if ( $email ) {

        if ( $self->getParam('submit') ) {

            $form = AppUser::Login::MFASMSForm->new();

            if ( $form->assignCGIParams( 'Form', $self->getParams() ) ) {

                my $phone = $form->Phone();

                if ( $phone !~ /\+\d+/ ) {
                    # Phone not in E.164 format?
                    $self->{xml}{Error} = "Invalid phone number";
                } else {

                    # Get the user token
                    my $token   = $form->Token();
                    my $userToken = AppUser::DB::Item::UserToken->Lookup( email => $email );
                    if ( $userToken && $userToken->token eq $token ) {

                        my $user = AppUser::DB::Item::User->Lookup( email => $email );

                        # Store the number
                        $user->mfa_phone( $phone );
                        $user->mfa_type( AppUser::DB::Item::User::kMFATypeSMS );
                        $user->save;

                        # send MFA code to user's SMS number
                        Common::MFA::Util->sendSMSCode( user_id => $user->user_id );

                        my $mfaType = AppUser::DB::Item::User::kMFATypeSMS;
                        my $_email  = uri_escape( $email );
                        my $_phone  = uri_escape( $phone );
                        my $uri     = "/rps/login?c=auth&email=$_email&token=$token&mtype=$mfaType&phone=$_phone";
                        $response = RSApache::Response::Redirect->new($uri);

                        $self->{xml}{Redirect} = $uri;
                    } else {
                        $self->{xml}{BadToken} = 1;
                    }
                }
            }
       
        }

    }


    if ( !$response ) {
        $self->{xml}{Form}         = $form;
        $self->{xml}{Email}        = $self->getParam("email");
        $self->{xml}{DisplayEmail} = $email;
        $self->{xml}{EmailSent}    = 1;

        $response = RSApache::Response::XSLT->new( $self->{xml}, kTemplate );
    }

    return $response;
}

1;