<?php namespace Feather\Components\Auth;

use Auth;
use Route;
use Session;
use InvalidArgumentException;
use Feather\Components\Foundation\Component;

class Authorizer extends Component {

	/**
	 * The current logged in user.
	 * 
	 * @var mixed
	 */
	public $user;

	/**
	 * Bootstrap the authenticator.
	 * 
	 * @return void
	 */
	public function bootstrap()
	{
		Auth::extend('feather', function()
		{
			return new Driver;
		});

		// Override the Laravel authentication driver for this run only.
		$this->feather['config']->set('laravel: auth.driver', 'feather');

		$this->user = $this->user();

		// Depending on the authenticator being used their may be a response thrown back that
		// interupts the normal response of Feather.
		$authenticator = $this->feather['config']->get('feather: db.auth.driver');

		if(!$this->online() and ($response = $this->feather['gear']->first("auth: bootstrap {$authenticator}")))
		{
			Route::filter('feather::before', function() use ($response)
			{
				return $response;
			});
		}

		$this->feather['gear']->fire('auth: started');
	}

	/**
	 * Access control prevents users without specific permissions from accessing certain parts
	 * of Feather. Actions can have rules defined in the configuration file. This method will
	 * check a user to see if they have the correct permissions to perform the given action.
	 * 
	 * @param  string  $action
	 * @param  object  $resource
	 * @return bool
	 */
	public function can($action, $resource = null)
	{
		if(!str_contains($action, ': '))
		{
			throw new InvalidArgumentException("Invalid action [{$action}] supplied to ACL.");
		}

		list($verb, $action) = explode(': ', $action);

		// To make things look lovely when writing actions we'll replace any spaces with underscores
		// as that's how role permissions are stored in the database.
		$action = str_replace(' ', '_', $action);

		foreach($this->user->roles as $role)
		{
			if($role->{"{$verb}_{$action}"})
			{
				// If we have a valid resource then we'll need to see if we have a rule in the configuration
				// for this action. If there is no rule then there is further checking that needs to be done
				// on the resource.
				if(!is_null($resource))
				{
					if($this->feather['config']->has("feather: auth.rules.{$verb}.{$action}"))
					{
						$resolver = $this->feather['config']->get("feather: auth.rules.{$verb}.{$action}");

						return $resolver($resource);
					}

					continue;
				}
				
				// If there was no valid resource then the action was simply a role based action. We
				// can return true here because the user has the correct permissions for this action.
				return true;
			}
		}

		// If we have a resource and it's an instance of Place then we need to perform a couple extra
		// permission checks on it.
		if($resource instanceof \Feather\Core\Place)
		{
			// Some places are not postable, make sure we aren't trying to start a discussion
			// in a non-postable place.
			if(in_array($verb, array('start')) and !$resource->postable)
			{
				return false;
			}

			foreach($resource->permissions as $permission)
			{
				if(array_key_exists($permission->role_id, $this->user->roles))
				{
					if($permission->{"{$verb}_{$action}"})
					{
						return true;
					}
				}
			}
		}

		// Regardless, we need to run through the authentication rules in the configuration file.
		else
		{
			if($this->feather['config']->has("feather: auth.rules.{$verb}.{$action}"))
			{
				$resolver = $this->feather['config']->get("feather: auth.rules.{$verb}.{$action}");

				return $resolver($resource);
			}
		}

		// Sorry chum, but you can't do that!
		return false;
	}

	/**
	 * The complete opposite of above, determines if a user is not able to perform an action.
	 * 
	 * @param  string  $action
	 * @param  object  $resource
	 * @return bool
	 */
	public function cannot($action, $resource = null)
	{
		return !$this->can($action, $resource);
	}

	/**
	 * Determines if a user is a given role or roles.
	 * 
	 * @param  array  $roles
	 * @return bool
	 */
	public function is($roles)
	{
		if(!is_array($roles))
		{
			$roles = array($roles);
		}

		// If the role has an aliased name then make sure we grab the correct name of
		// the role from the aliases array.
		$aliases = $this->feather['config']->get('feather: auth.aliases');

		foreach($roles as $key => $role)
		{
			if(array_key_exists(strtolower($role), $aliases))
			{
				$roles[$key] = $aliases[strtolower($role)];
			}
		}

		foreach($this->user->roles as $role)
		{
			if(in_array(strtolower($role->name), $roles))
			{
				return true;
			}

			// Because some roles can be granted a super moderator permission, if we
			// are checking that a user is a moderator we'll also check that the role
			// is a super moderator.
			if(in_array('moderator', $roles) and $role->super_moderator)
			{
				return true;
			}
		}

		return false;
	}

	/**
	 * Determines if a user is not a given role or roles.
	 * 
	 * @param  array  $roles
	 * @return bool
	 */
	public function not($roles)
	{
		return !$this->is($roles);
	}

	/**
	 * Determines if a user is online.
	 * 
	 * @return bool
	 */
	public function online()
	{
		return !$this->is('guest');
	}

	/**
	 * Determines if a user is offline.
	 * 
	 * @return bool
	 */
	public function offline()
	{
		return !$this->online();
	}

	/**
	 * Determines if a user has activated their account.
	 * 
	 * @return bool
	 */
	public function activated()
	{
		return (bool) $this->user->activated;
	}

	/**
	 * Logs a user out and flushes the session.
	 * 
	 * @return void
	 */
	public function logout()
	{
		Session::flush();

		Auth::logout();
	}

	/**
	 * Route methods that are uncallable through to Laravel's Auth class. This provids a clean
	 * interface for accessing methods on that class.
	 * 
	 * @param  string  $method
	 * @param  array   $parameters
	 * @return mixed
	 */
	public function __call($method, $parameters)
	{
		return call_user_func_array(array('Auth', $method), $parameters);
	}

}