<?php
	error_reporting(E_ALL ^ E_NOTICE);

	include_once('../include/lucidAuth.functions.php');
	
	if ($_POST['do'] === 'login') {
		$result = authenticateLDAP($_POST['username'], $_POST['password']);
		if ($result['status'] === 'Success') {
			// Save authentication token in database
			$pdoQuery = $pdoDB->prepare('
				INSERT INTO SecureToken (UserId, Value)
				SELECT User.Id, :securetoken
				FROM User
				WHERE User.Username = :qualifiedusername
 			');
			$pdoQuery->execute([
				':securetoken'			=>	$result['token'],
				':qualifiedusername'	=>	$settings->LDAP['Domain'] . '\\' . $_POST['username']
			]);
			// Save authentication token in cookie
			$httpHost = $_SERVER['HTTP_HOST'];
			$cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
				// Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain)
				//   This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
    		return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
			}))[0];
			setcookie('JWT', $result['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain);
            
			// Convert base64 encoded string back from JSON;
			//   forcing it into an associative array (instead of javascript's default StdClass object)
			try {
				$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
			}
			catch (Exception $e) {
				// Since this request is only ever called through an AJAX-request; return JSON object
				echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
				exit;
			}
			$originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php';

			// Since this request is only ever called through an AJAX-request; return JSON object
			echo '{"Result":"Success","Location":"' . $originalUri . '"}' . PHP_EOL;
		} else {
			switch ($result['reason']) {
				case '1':
					echo '{"Result":"Fail","Reason":"Invalid username and/or password"}' . PHP_EOL;
					break;
				default:
					echo '{"Result":"Fail","Reason":"Uncaught error"}' . PHP_EOL;
			}
		}
	} else {
		$stylevar['content']['top'] = '-125px';
		$stylevar['content']['margin-left'] = '-225px';
		$stylevar['content']['height'] = '220px';
		$stylevar['content']['width'] = '450px';

		include_once('../include/lucidAuth.template.php');

		$pageLayout = str_replace('<!--REPL_MAIN-->', $contentLayout['login'], $pageLayout);
		echo $pageLayout;
	}

?>