<?php

/**
 * Joomla! External authentication script
 * @author usantisteban <usantisteban@othercode.es>
 * @copyright Copyright (C) 2005 - 2017 Open Source Matters, Inc. All rights reserved.
 * @license GNU General Public License version 2 or later; see LICENSE.txt
 */

if (version_compare(PHP_VERSION, '5.3.1', '<')) {
    die('Your host needs to use PHP 5.3.1 or higher to run this version of Joomla!');
}

define('_JEXEC', 1);
define('JPATH_BASE', __DIR__);

require_once JPATH_BASE . '/includes/defines.php';
require_once JPATH_BASE . '/includes/framework.php';
require_once JPATH_BASE . '/libraries/joomla/factory.php';

try {


    $input = JFactory::getApplication('site')->input;
    $configuration = JFactory::getConfig();


    $secret = $input->post->get('secret', null, 'string');

    if ($secret !== $configuration->get('secret')) {
        throw new \Exception('Forbidden', 403);
    }

    $username = $input->post->get('username', null, 'string');
    $password = $input->post->get('password', null, 'string');

    if (!isset($username) || !isset($password)) {
        throw new \Exception('Bad request', 400);
    }

    $db = JFactory::getDbo();
    $query = $db->getQuery(true);
    $query->select('id, password')
        ->from('#__users')
        ->where('username=' . $db->quote($username));
    $db->setQuery($query);
    $result = $db->loadObject();

    header('Content-type: application/json');

    if (JUserHelper::verifyPassword($password, $result->password, $result->id) === true) {

        print json_encode($response = array(
            'code' => 200,
            'message' => 'Authenticate OK!',
            'data' => JUser::getInstance($result->id)
        ), JSON_PRETTY_PRINT);

    } else {
        throw new \Exception('Authenticate fail!', 401);
    }


} catch (\Exception $e) {

    print json_encode($response = array(
        'code' => $e->getCode(),
        'message' => $e->getMessage(),
        'data' => false
    ), JSON_PRETTY_PRINT);

}