<?php
/**
 * Copyright 2012-2026 ShopeX (https://www.shopex.cn)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
/**
 * ============================
 * @Author:   yaokangming
 * @Version:  1.0
 * @DateTime: 2021/4/6 15:05:23
 * @describe:
 * loginUrl 后跳转地址 http://oms-nestle/index.php?ctl=passport&act=accountCode
 * ============================
 */
class erpapi_account_request_user extends erpapi_account_request_abstract {

    private static function claimDefinition($k)
    {
        $definition = [
            'logout_redirect_uri'   => 'redirect_uri',
            'userinfo_uname'        => 'username',
            'userinfo_name'         => 'displayname',
            'userinfo_mobile'       => 'mobile',
            'userinfo_uid'          => 'uid',
        ];

        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        switch (strtolower($oidcInfo['oidctype'])) {
            case 'ciam':
                $definition['logout_redirect_uri'] = 'post_logout_redirect_uri';
                $definition['userinfo_uname']      = 'phone_number';
                $definition['userinfo_name']       = 'name';
                $definition['userinfo_mobile']     = 'phone_number';
                $definition['userinfo_uid']        = 'sub';
                break;
                
            case 'okta':
                $definition['userinfo_uname']      = 'preferred_username';
                $definition['userinfo_name']       = 'name';
                // $definition['userinfo_mobile']     = 'phone_number';
                $definition['userinfo_uid']        = 'sub';
                $definition['userinfo_search']     = 'email';
                break;
        }


        return (string) $definition[$k];
    }

    /**
     * loginUrl
     * @param mixed $sdf sdf
     * @return mixed 返回值
     */

    public function loginUrl($sdf) {
        $oidc = app::get('ome')->getConf('pam.passport.oidc.enable');
        if($oidc != 'true') {
            return $this->error('未开启oidc', 100);
        }
        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        if(!$oidcInfo['client_id']) {
            return $this->error('need client_id', 100);
        }
        if(!$oidcInfo['authorization']) {
            return $this->error('need authorization', 100);
        }
        $params = ['client_id'=>$oidcInfo['client_id'], 'response_type'=>'code', 'scope' => 'openid', 'state'=>time()];

        if($oidcInfo['redirect']) {
            $params['redirect_uri'] = $oidcInfo['redirect'];
        }

        if (in_array(strtolower($oidcInfo['oidctype']), ['ciam', 'okta'])) {
            $params['scope'] = 'openid phone profile';
        }

        $url = $oidcInfo['authorization'] . '?' . http_build_query($params);
        if($oidcInfo['to_out'] == 'true') {
            header('Location:' . $url);exit();
        }
        return $this->succ('成功', 0, $url);
    }

    /**
     * loginOutUrl
     * @param mixed $sdf sdf
     * @return mixed 返回值
     */
    public function loginOutUrl($sdf) {
        $oidc = app::get('ome')->getConf('pam.passport.oidc.enable');
        if($oidc != 'true') {
            return $this->error('未开启oidc', 100);
        }
        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        if(!$oidcInfo['client_id']) {
            return $this->error('need client_id', 100);
        }
        if(!$oidcInfo['endsession']) {
            return $this->error('need endsession', 100);
        }
        $params = ['client_id'=>$oidcInfo['client_id'], 'response_type'=>'code', 'scope' => 'openid'];

        $redirectUriField = self::claimDefinition('logout_redirect_uri');
        if($oidcInfo['redirect']) {
            $params[$redirectUriField] = $oidcInfo['redirect'];
        }

        if ($redirectUriField == 'post_logout_redirect_uri') {
            $params['id_token_hint'] = $_SESSION['id_token'];
            
            if (!$params['id_token_hint']){
                return $this->error('need id_token', 100);
            }
        }

        if (in_array(strtolower($oidcInfo['oidctype']), ['ciam', 'okta'])) {
            $params['scope'] = 'openid phone profile';
        }

        $url = $oidcInfo['endsession'] . '?' . http_build_query($params);

        return $this->succ('成功', 0, $url);
    }

    /**
     * login
     * @param mixed $sdf sdf
     * @return mixed 返回值
     */
    public function login($sdf) {
        $tokenRs = $this->getToken($sdf);
        if($tokenRs['rsp'] != 'succ') {
            return $tokenRs;
        }
        $info = $this->getInfo($tokenRs['data']);
        if($info['rsp'] != 'succ') {
            return $info;
        }
        $permission = $this->getPermission($tokenRs['data']);
        if($permission['rsp'] != 'succ') {
            return $permission;
        }
        return ['rsp'=>'succ'];
    }

    /**
     * 获取Token
     * @param mixed $sdf sdf
     * @return mixed 返回结果
     */
    public function getToken($sdf) {
        $title = '获取token';
        $method = 'token';
        $params = ['grant_type'=>'authorization_code', 'code'=>$sdf['code']];
        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        if($oidcInfo['redirect']) {
            $params['redirect_uri'] = $oidcInfo['redirect'];
        }
        $result= $this->__caller->call($method,$params,array(),$title,500,$sdf['code']);
        $data = @json_decode($result['data'], 1);
        if($data['access_token']) {
            return ['rsp'=>'succ', 'data'=>$data];
        }
        return ['rsp'=>'fail', 'msg'=>'获取token失败'];
    }

    /**
     * refreshToken
     * @param mixed $sdf sdf
     * @return mixed 返回值
     */
    public function refreshToken($sdf) {
        $title = '刷新token';
        $method = 'token';
        $params = ['grant_type'=>'refresh_token', 'refresh_token'=>$sdf['refresh_token']];
        $result= $this->__caller->call($method,$params,array(),$title,500,$sdf['access_token']);
        $data = @json_decode($result['data'], 1);
        if($data['access_token']) {
            $data['refresh'] = 1;
            return $this->getInfo($data);
        }
        return ['rsp'=>'fail', 'msg'=>'刷新token失败'];
    }

    /**
     * 获取Info
     * @param mixed $sdf sdf
     * @return mixed 返回结果
     */
    public function getInfo($sdf) {
        $title = '获取用户信息';
        $method = 'userinfo';
        $result= $this->__callerGet($method,['access_token'=>$sdf['access_token']], $title);
        $data = @json_decode($result['data'], 1);
        if($data['code']) {
            if($data['code'] == '110' && !$sdf['refresh']) {
                return $this->refreshToken($sdf);
            }
            return ['rsp'=>'fail', 'msg'=>$data['msg']];
        }
        $data = $data['data'] ? : $data;

        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        $unamefield  = self::claimDefinition('userinfo_uname');
        $searchfield = self::claimDefinition('userinfo_search');

        if(empty($data['username'])) {
            if($data[$unamefield]) {
                $data['username'] = $data[self::claimDefinition('userinfo_uname')];
                $data['nickname'] = $data[self::claimDefinition('userinfo_name')];
                $data['mobile']   = $data[self::claimDefinition('userinfo_mobile')];
            }
            
            if (!$data['username'] && $sdf['id_token']) {
                $jwt = $sdf['id_token'];
                $header = base64_decode(strtr(substr($jwt, 0, strpos($jwt, '.')), '-_', '+/'));
                $idToken = base64_decode(strtr(substr($jwt, strpos($jwt, '.') + 1, strpos($jwt, '.', strpos($jwt, '.') + 1) - strpos($jwt, '.') - 1), '-_', '+/'));
                
                if ($idToken[$unamefield]) {
                    $data['username'] = $idToken[$unamefield];
                }
            }
            
            if (!$data['username'] && $sdf['access_token']) {
                $jwt = $sdf['access_token'];
                $header = base64_decode(strtr(substr($jwt, 0, strpos($jwt, '.')), '-_', '+/'));
                $idToken = base64_decode(strtr(substr($jwt, strpos($jwt, '.') + 1, strpos($jwt, '.', strpos($jwt, '.') + 1) - strpos($jwt, '.') - 1), '-_', '+/'));
                
                if ($idToken[$unamefield]) {
                    $data['username'] = $idToken[$unamefield];
                }
            }
        }

        if(empty($data['username'])) {
            return ['rsp'=>'fail', 'msg'=>'缺失用户名:'.json_encode($result).json_encode($idToken)];
        }

        $data['uid'] = $data[self::claimDefinition('userinfo_uid')];

        $pamMdl  = app::get('pam')->model('account');
        $authMdl = app::get('pam')->model('auth');
        $userMdl = app::get('desktop')->model('users');

        // 判断管理员是否存在
        if (in_array(strtolower($oidcInfo['oidctype']), ['ciam','okta'])) {
           $login_name = $data['username'];
           
           if ($searchfield){
                $user = $userMdl->db_dump([$searchfield => $login_name], 'user_id');
                
                if ($user){
                    $account = $pamMdl->db_dump($user['user_id']);
                    
                    $login_name = $account['login_name'];
                }
           } else {
               $account = $pamMdl->db_dump(['login_name' => $login_name]);
           }
           
            if (!$account) {
                return ['rsp'=>'fail', 'msg'=>'账号【'.$data['username'].'】不存在，请联系管理员！'];
            }

            if (!$authMdl->db_dump(['module_uid'=>$data['uid']], 'auth_id,account_id')) {
                $authInData = [
                    'account_id' => $account['account_id'],
                    'module_uid' => $data['uid'],
                    'module'     => 'account',
                    'data'       => json_encode($data)
                ];
                $authMdl->insert($authInData);
            }
        }

        $isSuper    = $login_name == trim($oidcInfo['super_account']) ? 1 : 0;
        $session_id = kernel::single('base_session')->sess_id();

        $accountType = pam_account::get_account_type('desktop');
        if($old = $authMdl->db_dump(['module_uid'=>$data['uid']], 'auth_id,account_id')) {
            $_SESSION['account'][$accountType]  = $old['account_id'];
            $_SESSION['id_token']               = $sdf['id_token'];
            $_SESSION['login_trust']            = true;

            $user = $userMdl->db_dump($old['account_id'], 'session_id');

            //注销同账号,其它电脑上登录的session_id
            if ('false' !== app::get('ome')->getConf('desktop.account.equal.restrict')
                && $user['session_id']
                && $user['session_id'] != $session_id
            ) {
                kernel::single('base_session')->deleteSessionId($user['session_id']);
            }

            $userMdl->update(['super'=>$isSuper, 'session_id' => $session_id],['user_id'=>$old['account_id']]);
            return ['rsp'=>'succ'];
        }

        $inData = [
            'pam_account'   => [
                'login_name'        => $data['username'],
                'account_type'      => $accountType,
                'login_password'    => pam_encrypt::get_encrypted_password(time().uniqid(),$accountType)
            ],
            'name'          => $data['nickname'],
            'status'        => 1,
            'mobile'        => (string) $data['mobile'],
            'super'         => $isSuper,
            'session_id'    => $session_id,
        ];

        $userMdl->save($inData);
        $authInData = [
            'account_id' => $inData['pam_account']['account_id'],
            'module_uid' => $data['uid'],
            'module'     => 'account',
            'data'       => json_encode($data)
        ];
        $authMdl->insert($authInData);
        $_SESSION['account'][$accountType]  = $inData['pam_account']['account_id'];
        $_SESSION['id_token']               = $sdf['id_token'];
        $_SESSION['login_trust']            = true;

        return ['rsp'=>'succ'];
    }

    /**
     * 获取Permission
     * @param mixed $sdf sdf
     * @return mixed 返回结果
     */
    public function getPermission($sdf) {
        $title = '获取用户权限';
        $method = 'permission';
        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        if(!$oidcInfo[$method]) {
            return ['rsp'=>'succ'];
        }
        $result= $this->__callerGet($method,['access_token'=>$sdf['access_token']]);
        $data = @json_decode($result['data'], 1);
        if($data['code']) {
            return ['rsp'=>'fail', 'msg'=>$data['msg']];
        }
        $accountType = pam_account::get_account_type('desktop');
        $userId = $_SESSION['account'][$accountType];
        $operationOpsObj = app::get('ome')->model('operation_ops');
        $operationOpsObj->delete(array('op_id' => $userId));
        app::get('ome')->model('branch_ops')->delete(array('op_id' => $userId));
        $permission = [];
        foreach ($data['data'] as $v) {
            $tmpPer = $this->getUserPermission($v);
            $permission = array_merge($permission, $tmpPer);
        }
        $_SESSION['account']['user_permission'] = $permission;
        return ['rsp'=>'succ'];
    }

    protected function getUserPermission($v) {
        $per = [];
        $accountType = pam_account::get_account_type('desktop');
        $userId = $_SESSION['account'][$accountType];
        if($v['extId'] == 'operation_organization') {
            $operationOpsObj = app::get('ome')->model('operation_ops');
            foreach ($v['children'] as $vv) {
                //保存现有
                $addOperPer = array(
                    'org_id' => $vv['path'],
                    'op_id'  => $userId,
                );
                $operationOpsObj->insert($addOperPer);
            }
            return $per;
        }
        if($v['extId'] == 'branch') {
            foreach ($v['children'] as $vv) {
                $t_data = array('branch_id' => $vv['path'], 'op_id' => $userId);
                app::get('ome')->model('branch_ops')->save($t_data);
            }
            return $per;
        }
        if($v['children']) {
            foreach ($v['children'] as $vv) {
                $temPer = $this->getUserPermission($vv);
                $per = array_merge($per, $temPer);
            }
        }
        if($v['path']) {
            $per[] = $v['path'];
        }
        return $per;
    }

    protected function __callerGet($method,$params, $title = '') {
        $headers = array(
            'Connection' => 10,
        );
        // 应用级参数
        $query_params = $this->__configObj->get_query_params($method, $params);

        if ($query_params['headers']) {
            $headers = array_merge($headers, (array) $query_params['headers']);
            unset($query_params['headers']);
        }
        $url = $this->__configObj->get_url($method, $query_params, 0);
        $response = kernel::single('base_httpclient')->set_timeout(500)->get($url, $headers);
        
        // 记日志
        $apilogModel = app::get('ome')->model('api_log');
        $log_id = $apilogModel->gen_id();
        $logsdf = [
            'log_id'        => $log_id,
            'task_name'     => $title ?: $method,
            'status'        => 'success',
            'worker'        => $method,
            'params'        => json_encode($params),
            'response'      => is_array($response) ? json_encode($response) : $response,
            'api_type'      => 'request',
            'original_bn'   => $method,
        ];
        $apilogModel->insert($logsdf);

        return ['rsp'=>'succ', 'data'=>$response];
    }

    /**
     * syncPermission
     * @param mixed $sdf sdf
     * @return mixed 返回值
     */
    public function syncPermission($sdf) {
        $title = '同步权限';
        $method = 'syncpermission';
        $oidcInfo = app::get('ome')->getConf('pam.passport.oidc.info');
        if(!$oidcInfo[$method]) {
            return ['rsp'=>'succ'];
        }
        $data =[];
        foreach ($sdf as $v) {
            $data[] = $this->getOnePermission($v);
        }
        $params = ['data'=>json_encode($data, JSON_UNESCAPED_UNICODE)];
        $result= $this->__caller->call($method,$params,array(),$title,500,'syncPermission');
        $data = @json_decode($result['data'], 1);
        if($data['code']) {
            return ['rsp'=>'fail', 'data'=>'同步权限失败'];
        }
        return ['rsp'=>'fail', 'msg'=>'获取token失败'];
    }

    protected function getOnePermission($v) {
        $children = [];
        if($v['permissions']) {
            foreach ($v['permissions'] as $vv) {
                $children[] = $this->getOnePermission($vv);
            }
        }
        $tmpData = [
            "aliasName"=> $v['workground'] ? : $v['menu_title'],
            "children"=> $children,
            "createdAt"=> "",
            "id"=> ($v['menu_type'] ? $v['menu_type'].'-' : '').$v['menu_id'],
            "isDeleted"=> 0,
            "name"=> $v['menu_title'],
            "num"=> count($children),
            "path"=> $v['permission'] ? : (string)$v['addon'],
            "updatedAt"=> ""
        ];
        return $tmpData;
    }
}