<?php

class AUTHORIZATION
{
    public static function validateTimestamp()
    {
        $CI =& get_instance();
        $headersData = getallheaders();
        
        if (!array_key_exists("Token",$headersData))
        {
            set_status_header(REST_CONTROLLER::HTTP_OK,"OK");
            $response['status']=false;
            $response['error']="Token required!";
            echo json_encode($response);
            exit;
        }
        else{
            $token = self::validateToken($headersData['Token']);
            if($token != false && (now() - $token->exp < ($CI->config->item('token_timeout') * 60))){
               set_status_header(200,"OK");
               return true;
           }
          else if($token == false){
               set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
               $response['status']=false;
               $response['error']="Invalid token!";
			   log_message('error','Invalid token!');
               echo json_encode($response);
               exit;
           }
           
           else{
				set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
               $response['status'] = false;
			   $response['message'] = 'Token Experied';
			   log_message('error','Token Experied');
                echo json_encode($response);
               exit;
   
           }
        }
    }

    public static function validateToken($token)
    {
       
        return JWT::decode($token);
    }

    public static function generateToken($data)
    {
        $CI =& get_instance();
        return JWT::encode($data, $CI->config->item('jwt_key'));
    }

    //check authorization user or not

    public static function checkAuthorizationUser($routingName){
        $CI =& get_instance();
        $headersData = getallheaders();	
		//print_r($headersData);

    $role_permission_array = array();    
		if(array_key_exists($CI->uri->uri_string, $CI->config->item('api_user_auth_info')))
    {
      $role_permission_array = $CI->config->item('api_user_auth_info')[$CI->uri->uri_string];
    }
  //   print_r($role_permission_array);
		// die();
		
		if( $routingName == ROUTE_LOGIN_X || $routingName == ROUTE_LOGIN_Y)
		  {
			return true; 
		  }
        if (!array_key_exists("Authorization",$headersData) OR $headersData['Authorization']!=$CI->config->item('authorization_key'))
        {
            set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
            $response['status']=false;
             $response['error']="Access denied!";
			       log_message('error','Access denied!');
             echo json_encode($response);
             exit;  
        }
	else if(isset($headersData['mode']))
		  {
			  if($headersData['mode'] == '0777')
			  {
				return true;
			  }
			  else
			  {
				$validateToken = self::validateTimestamp();
				return $validateToken;  
			  }
		  }
        //For all route name except  contant route
        else if($routingName!=ROUTE_LOGIN){
            $validateToken = self::validateTimestamp();
           
            // Check role base arry for current user have permission to access requested API
            if(count($role_permission_array))
            {
              if(array_key_exists("Token",$headersData))
              {
                 $token_payload = json_decode(json_encode(JWT::decode($headersData['Token'])), true);
                // print_r($token_payload);die();

                 //check role info existing in token paylod
                 if(array_key_exists('custom:role_id',$token_payload))
                 {
                   if(in_array($token_payload['custom:role_id'],$role_permission_array)){ return $validateToken; }
                   else { 
                        set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
                        $response['status']=false;
                        $response['error']="Unauthorized Role Access";
                        log_message('error','Unauthorized Role Access');
                        echo json_encode($response);
                        exit;  
                   }
                 }
                 else
                 {
                     set_status_header(REST_CONTROLLER::HTTP_UNAUTHORIZED,"Unauthorized");
                     $response['status']=false;
                     $response['error']="Could not Identify Role!";
                     log_message('error','Could not Identify Role');
                     echo json_encode($response);
                     exit;  
                 }
              }
             
            } // end of role based authorization logic


            return $validateToken;
        }
         else{
            return true;
          }
		  
		  
    }
	
}