include Utils::Encryption

class User < ActiveRecord::Base

	has_and_belongs_to_many :roles
	has_one :activation_key, :dependent => :destroy

	#-------------------------------------------------------------------------------
	# Custom Exceptions
	#-------------------------------------------------------------------------------

	class PasswordInvalid < Exception; end

	#-------------------------------------------------------------------------------
	# Validations
	#-------------------------------------------------------------------------------

	attr_accessible :first_name, :last_name, :email, :email_confirmation, :password, :password_confirmation

	validates_presence_of :first_name, :last_name, :on => :create
	validates_length_of   :first_name, :last_name, :on => :create, :maximum => 32
	validates_format_of   :first_name, :last_name, :on => :create, :with => /^[A-Z][a-z]*[-]?[a-z]*$/

	validates_presence_of :email, :if => :validate_email?
	validates_as_email    :email, :if => :validate_email?

	validates_presence_of :password, :if => :validate_password?
	validates_length_of   :password, :if => :validate_password?, :minimum => 8
	validates_as_password :password, :if => :validate_password?

	#-------------------------------------------------------------------------------
	# Validation Helpers
	#-------------------------------------------------------------------------------

	protected

	def validate_email?
		return new_record? || !email.nil?
	end

	def validate_password?
		return new_record? || !password.nil?
	end

	#-------------------------------------------------------------------------------
	# Authentication
	#-------------------------------------------------------------------------------

	public

	def self.authenticate(email, password)
		user = find_by_email_and_enabled(email, true) or raise ActiveRecord::RecordNotFound
		user.valid_password?(password) or raise User::PasswordInvalid
		user.update_timestamp_for(:authenticated_at)
		return user
	end

	def valid_password?(password)
		return encrypted_password == encrypt_password(password)
	end

	def has_role?(role)
		return roles.find_by_name(role) ? true : false
	end

	protected

	def password
		return @password
	end

	def password=(password)
		@password = password

		self.salt = create_salt() if new_record?
		self.encrypted_password = encrypt_password(password) unless password.blank?
	end

	def encrypt_password(password)
		return Digest::SHA512.hexdigest("#{salt}#{password}")
	end

	def flush_password
		@password = nil
		@password_confirmation = nil
	end

	#-------------------------------------------------------------------------------
	# Activation
	#-------------------------------------------------------------------------------

	public

	def self.activate(key)
		user = key.user
		user.enabled = true
		#user.activation_key.destroy()
		user.update_timestamp_for(:activated_at)
		return user
	end

	def public_activation_key
		return activation_key.public_key unless enabled? or activation_key.nil?
	end

	def enable
		return update_attribute(:enabled, true) unless user.enabled?
	end

	def disable
		return update_attribute(:enabled, false) if user.enabled?
	end

	#-------------------------------------------------------------------------------
	# Password Reset
	#-------------------------------------------------------------------------------

	def self.forgot_password(email, remote_ip)
		user = find_by_email_and_enabled(email, true) or raise ActiveRecord::RecordNotFound
		user.enabled = false
		user.create_activation_key()
		return user
	end

	def self.reset_password(key, params)
		user = key.user
		user.update_attributes(params.slice(:password, :password_confirmation))
		user.enabled = true
		#user.activation_key.destroy()
		#user.update_timestamp_for(:reset_at)
		#return user
	end

	#-------------------------------------------------------------------------------
	# Miscellaneous Helpers
	#-------------------------------------------------------------------------------

	public

	def update_timestamp_for(attr)
		self.class.record_timestamps = false
		update_attribute(attr, Time.now)
		self.class.record_timestamps = true
	end

	def full_name
		return "#{first_name} #{last_name}"
	end

	#-------------------------------------------------------------------------------
	# Lifecycle Callbacks
	#-------------------------------------------------------------------------------

	protected

	def before_create
		self.roles << Role.find_by_name("User")
	end

	def after_create
		self.create_activation_key()
	end

	def after_save
		flush_password()
	end

	def before_destroy
		if system?
			errors.add_to_base("Woops! Can't destroy a System Account")
			return false
		end
	end

end