note
	description: "[
		Generic OpenID Module supporting authentication using different providers.
		]"
	date: "$Date$"
	revision: "$Revision$"

class
	CMS_OPENID_MODULE

inherit
	CMS_AUTH_MODULE_I
		rename
			module_api as openid_api
		redefine
			make,
			filters,
			setup_hooks,
			initialize,
			install,
			openid_api
		end

	CMS_HOOK_BLOCK

	SHARED_EXECUTION_ENVIRONMENT
		export
			{NONE} all
		end

	REFACTORING_HELPER

create
	make

feature {NONE} -- Initialization

	make
			-- Create current module
		do
			Precursor
			version := "1.0"
			description := "Openid module"

			create root_dir.make_current
			cache_duration := 0
		end

feature -- Access

	name: STRING = "openid"
			-- <Precursor>

feature {CMS_API} -- Module Initialization			

	initialize (a_api: CMS_API)
			-- <Precursor>
		local
			l_openid_api: like openid_api
			l_openid_storage: CMS_OPENID_STORAGE_I
		do
			Precursor (a_api)

				-- Storage initialization
			if attached a_api.storage.as_sql_storage as l_storage_sql then
				create {CMS_OPENID_STORAGE_SQL} l_openid_storage.make (l_storage_sql)
			else
				-- FIXME: in case of NULL storage, should Current be disabled?
				create {CMS_OPENID_STORAGE_NULL} l_openid_storage
			end

				-- API initialization
			create l_openid_api.make_with_storage (a_api, l_openid_storage)
			openid_api := l_openid_api
		ensure then
			user_opend_api_set: openid_api /= Void
		end

feature {CMS_API} -- Module management

	install (api: CMS_API)
		do
				-- Schema
			if attached api.storage.as_sql_storage as l_sql_storage then
					--| Schema
				l_sql_storage.sql_execute_file_script (api.module_resource_location (Current, (create {PATH}.make_from_string ("scripts")).extended ("openid_consumers.sql")), Void)

				if l_sql_storage.has_error then
					api.logger.put_error ("Could not initialize database for module [" + name + "]", generating_type)
				else
						-- TODO workaround.
					l_sql_storage.sql_execute_file_script (api.module_resource_location (Current, (create {PATH}.make_from_string ("scripts")).extended ("openid_consumers_initialize.sql")), Void)

						-- TODO workaround, until we have an admin module
					if l_sql_storage.has_error then
						api.logger.put_error ("Could not initialize openid consumer table for module [" + name + "]", generating_type)
					else
						l_sql_storage.sql_execute_file_script (api.module_resource_location (Current, (create {PATH}.make_from_string ("scripts")).extended ("openid_items.sql")),Void)
						if l_sql_storage.has_error then
							api.logger.put_error ("Could not initialize openid items for module [" + name + "]", generating_type)
						else
							Precursor {CMS_AUTH_MODULE_I}(api) -- Mark it installed.
						end
					end
				end
			end
		end

feature {CMS_API} -- Access: API

	openid_api: detachable CMS_OPENID_API
			-- <Precursor>		

feature -- Filters

	filters (a_api: CMS_API): detachable LIST [WSF_FILTER]
			-- Possibly list of Filter's module.
		do
			if attached openid_api as l_openid_api then
				create {ARRAYED_LIST [WSF_FILTER]} Result.make (1)
				Result.extend (create {CMS_OPENID_FILTER}.make (a_api, l_openid_api))
			end
		end

feature -- Access: docs

	root_dir: PATH

	cache_duration: INTEGER
			-- Caching duration
			--|  0: disable
			--| -1: cache always valie
			--| nb: cache expires after nb seconds.

	cache_disabled: BOOLEAN
		do
			Result := cache_duration = 0
		end

feature -- Access: auth strategy

	login_title: STRING = "OpenID"
			-- Module specific login title.

	login_location: STRING = "account/auth/roc-openid-login"

	logout_location: STRING = "account/auth/roc-openid-logout"

	is_authenticating (a_response: CMS_RESPONSE): BOOLEAN
			-- <Precursor>
		do
			if
				a_response.is_authenticated and then
				attached openid_api as l_openid_api and then
				attached {WSF_STRING} a_response.request.cookie (l_openid_api.session_token)
			then
				Result := True
			end
		end

feature -- Router

	setup_router (a_router: WSF_ROUTER; a_api: CMS_API)
			-- <Precursor>
		do
			if attached openid_api as l_openid_api then
				a_router.handle ("/" + login_location,
						create {WSF_URI_AGENT_HANDLER}.make (agent handle_login (a_api, ?, ?)),
						a_router.methods_get_post)
				a_router.handle ("/" + logout_location,
						create {WSF_URI_AGENT_HANDLER}.make (agent handle_logout (a_api, l_openid_api, ?, ?)),
						a_router.methods_get_post)
				a_router.handle ("/account/auth/login-with-openid/{" + openid_consumer_path_parameter + "}",
						create {WSF_URI_TEMPLATE_AGENT_HANDLER}.make (agent handle_login_with_openid (a_api, l_openid_api, ?, ?)),
						a_router.methods_get_post)
				a_router.handle ("/account/auth/openid-callback",
						create {WSF_URI_AGENT_HANDLER}.make (agent handle_callback_openid (a_api, l_openid_api, ?, ?)),
						a_router.methods_get_post)
			end
		end

	openid_consumer_path_parameter: STRING = "consumer"
			-- Consumer path parameter name.

feature -- Hooks configuration

	setup_hooks (a_hooks: CMS_HOOK_CORE_MANAGER)
			-- Module hooks configuration.
		do
			Precursor (a_hooks)
			a_hooks.subscribe_to_block_hook (Current)
		end

feature -- Hooks

	block_list: ITERABLE [like {CMS_BLOCK}.name]
		do
			Result := <<"login">>
		end

	get_block_view (a_block_id: READABLE_STRING_8; a_response: CMS_RESPONSE)
		do
			if
				a_block_id.is_case_insensitive_equal_general ("login") and then
				a_response.location.starts_with (login_location)
			then
				get_block_view_login (a_block_id, a_response)
			end
		end

	handle_login (api: CMS_API; req: WSF_REQUEST; res: WSF_RESPONSE)
		local
			r: CMS_RESPONSE
			o: OPENID_CONSUMER
			s: STRING
		do
			create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
			if api.user_is_authenticated then
				r.add_error_message ("You are already signed in!")
			elseif req.is_get_request_method then
				r.set_value ("Login", "optional_content_type")


			elseif req.is_post_request_method then
				create s.make_empty
				if attached req.string_item ("openid") as p_openid then
					s.append ("Check openID: " + p_openid)
					create o.make (req.absolute_script_url ("/account/auth/login-with-openid"))
					o.ask_email (True)
					o.ask_all_info (False)
					if attached o.auth_url (p_openid) as l_url then
						r.set_redirection (l_url)
					else
						s.append (" Failure")
						r.set_status_code ({HTTP_CONSTANTS}.bad_request)
						r.values.force (s, "error")
					end
				end
			end
			r.execute
		end

	handle_logout (api: CMS_API; a_openid_api: CMS_OPENID_API; req: WSF_REQUEST; res: WSF_RESPONSE)
		local
			r: CMS_RESPONSE
			l_cookie: WSF_COOKIE
		do
			if
				attached {CMS_USER} api.user as l_user and then
				attached {WSF_STRING} req.cookie (a_openid_api.session_token) as l_cookie_token
			then
					-- Logout OAuth
				create l_cookie.make (a_openid_api.session_token, l_cookie_token.value)
				l_cookie.set_path ("/")
				l_cookie.set_max_age (-1)
				res.add_cookie (l_cookie)
				api.unset_current_user (req)
				create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
				r.set_status_code ({HTTP_CONSTANTS}.found)
				r.set_redirection (req.absolute_script_url (""))
				r.execute
			else
				-- FIXME: missing implementation!
			end
		end

feature {NONE} -- Block views

	get_block_view_login (a_block_id: READABLE_STRING_8; a_response: CMS_RESPONSE)
		local
			vals: CMS_VALUE_TABLE
		do
			if attached smarty_template_block (Current, a_block_id, a_response.api) as l_tpl_block then
				create vals.make (1)
					-- add the variable to the block
				a_response.api.hooks.invoke_value_table_alter (vals, a_response)
				across
					vals as ic
				loop
					l_tpl_block.set_value (ic.item, ic.key)
				end
				if
					attached openid_api as l_openid_api and then
					attached l_openid_api.openid_consumers as l_list
				then
					l_tpl_block.set_value (l_list, "openid_consumers")
				end

				a_response.add_block (l_tpl_block, "content")
			else
				debug ("cms")
					a_response.add_warning_message ("Error with block [" + a_block_id + "]")
				end
			end
		end


feature -- Openid Login

	handle_login_with_openid (api: CMS_API; a_openid_api: CMS_OPENID_API; req: WSF_REQUEST; res: WSF_RESPONSE)
		local
			r: CMS_RESPONSE
			b: STRING
			o: OPENID_CONSUMER
		do
			if
				attached {WSF_STRING} req.path_parameter (openid_consumer_path_parameter) as p_openid and then
				attached {CMS_OPENID_CONSUMER} a_openid_api.openid_consumer_by_name (p_openid.value) as l_oc
			then
				create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
				create b.make_empty
				b.append ("Check openID: " + p_openid.value)
				create o.make (req.absolute_script_url ("/account/auth/openid-callback"))
				o.ask_email (True)
				o.ask_all_info (False)
				if attached o.auth_url (l_oc.endpoint) as l_url then
					r.set_redirection (l_url)
				else
					b.append ("Failure")
				end
				r.execute
			else
				create {BAD_REQUEST_ERROR_CMS_RESPONSE} r.make (req, res, api)
				r.set_main_content ("Bad request")
				r.execute
			end
		end

	handle_callback_openid (api: CMS_API; a_openid_api: CMS_OPENID_API; req: WSF_REQUEST; res: WSF_RESPONSE)
		local
			r: CMS_RESPONSE
			l_user_api: CMS_USER_API
			l_user: CMS_USER
			l_roles: LIST [CMS_USER_ROLE]
			l_cookie: WSF_COOKIE
			es: CMS_AUTHENTICATION_EMAIL_SERVICE
			b: STRING
			o: OPENID_CONSUMER
			v: OPENID_CONSUMER_VALIDATION
		do
			create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
			create b.make_empty
			if attached req.string_item ("openid.mode") as l_openid_mode then
				create o.make (req.absolute_script_url ("/"))
				o.ask_email (True)
				o.ask_nickname (False)
				create v.make_from_items (o, req.items_as_string_items)
				v.validate
				if v.is_valid then
					if attached v.identity as l_identity and then
					    attached v.email_attribute as l_email
					then
						l_user_api := api.user_api
						if attached l_user_api.user_by_email (l_email) as p_user then
								-- User with email exist
							if attached a_openid_api.user_openid_by_userid_identity (p_user.id, l_identity)	then
									-- Update openid entry?
							else
									-- create a oauth entry
								a_openid_api.new_user_openid (l_identity,p_user)
							end
							create l_cookie.make (a_openid_api.session_token, l_identity)
							l_cookie.set_max_age (a_openid_api.session_max_age)
							l_cookie.set_path ("/")
							res.add_cookie (l_cookie)
							api.record_user_login (p_user)
						else

							create {ARRAYED_LIST [CMS_USER_ROLE]} l_roles.make (1)
							l_roles.force (l_user_api.authenticated_user_role)

								-- Create a new user and oauth entry
							create l_user.make (l_email)
							l_user.set_email (l_email)
							l_user.set_password (new_token) -- generate a random password.
							l_user.set_roles (l_roles)
							l_user.mark_active
							l_user_api.new_user (l_user)

								-- Add oauth entry
							a_openid_api.new_user_openid (l_identity, l_user )
							create l_cookie.make (a_openid_api.session_token, l_identity)
							l_cookie.set_max_age (a_openid_api.session_max_age)
							l_cookie.set_path ("/")
							res.add_cookie (l_cookie)

									-- Send Email
							create es.make (create {CMS_AUTHENTICATION_EMAIL_SERVICE_PARAMETERS}.make (api))
							write_debug_log (generator + ".handle_callback_openid: send_contact_welcome_email")
							es.send_contact_welcome_email (l_email, l_user, req.absolute_script_url (""))
						end
					end
					r.set_redirection (r.front_page_url)
					r.execute
				else
					b.append ("User authentication failed!!")
				end
			end
		end

feature {NONE} -- Token Generation

	new_token: STRING
			-- Generate a new token activation token
		local
			l_token: STRING
			l_security: SECURITY_PROVIDER
			l_encode: URL_ENCODER
		do
			create l_security
			l_token := l_security.token
			create l_encode
			from until l_token.same_string (l_encode.encoded_string (l_token)) loop
				-- Loop ensure that we have a security token that does not contain characters that need encoding.
			    -- We cannot simply to an encode-decode because the email sent to the user will contain an encoded token
				-- but the user will need to use an unencoded token if activation has to be done manually.
				l_token := l_security.token
			end
			Result := l_token
		end

note
	copyright: "Copyright (c) 1984-2013, Eiffel Software and others"
	license: "Eiffel Forum License v2 (see http://www.eiffel.com/licensing/forum.txt)"
	source: "[
			Eiffel Software
			5949 Hollister Ave., Goleta, CA 93117 USA
			Telephone 805-685-1006, Fax 805-685-6869
			Website http://www.eiffel.com
			Customer support http://support.eiffel.com
		]"
end