<?php
use \Luracast\Restler\iAuthenticate;
use \Luracast\Restler\Resources;
use \Luracast\Restler\Defaults;
use \Luracast\Restler\User;

class AccessControl implements iAuthenticate
{
    public static $requires = '';
    public static $role = '';

    public function __isAllowed()
    {   

        $userClass = Defaults::$userIdentifierClass;

        $accessToken = md5($_GET['api_key'] . ADMIN_PASSWORD_SALT);
        $keyCheck = R::find( "accesstoken", "token = :accesstoken AND expire_at >= NOW();", [':accesstoken' => $accessToken]);

 // verify the access token
        if (!($keyCheck)) {
                $userClass::setCacheIdentifier($_GET['api_key']);
                return false;
        }

        $user_id = R::exportAll($keyCheck)[0]['admin_id'];

        $userDetails = R::getRow( 'SELECT admin.id, role.id, admin.role_id, role.name as role_name FROM admin LEFT JOIN role ON admin.role_id = role.id where admin.id = :id ', [':id' => $user_id ]);
        static::$role = $userDetails['role_name'];
        $userClass::setCacheIdentifier(static::$role);
        User::setUniqueIdentifier($user_id);

        Resources::$accessControlFunction = 'AccessControl::verifyAccess';


        if(is_array(static::$requires)){
            return in_array(static::$role,static::$requires);
        }else{
            return static::$role == static::$requires;
        }



    }

    public function __getWWWAuthenticateString()
    {
        return 'Query name="api_key"';
    }

     /**
     * @access private
     */
    public static function verifyAccess(array $m)
    {
        $requires =
            isset($m['class']['AccessControl']['properties']['requires'])
                ? $m['class']['AccessControl']['properties']['requires']
                : false;


        if(is_array($requires)){
            return in_array(static::$role,$requires);
        }else{
            return static::$role == $requires;
        }

    }
}