const express = require('express');
const app = express();
const bodyParser = require('body-parser');

var fs = require('fs');
var mysql = require('mysql');
var axios = require('axios');
var crypto = require('crypto');

var con = mysql.createConnection({
    host: "localhost",
    user: "root",
    password: "projetoDM2018;",
    database: "whatdidihaveDB"
});

app.use(bodyParser.urlencoded({
    extended: false
}));
app.use(bodyParser.json());

// Cliente conecta-se
app.get('/publickey', (request, response) => {
    console.log("Cliente pediu a chave pública.")
    // Recebe a chave pública (pubPem)
    response.json({
        public_key: pubPem
    })
})

app.get('/oauth2token', (request, response) => {
    // Website you wish to allow to connect
    response.setHeader('Access-Control-Allow-Origin', '*');

    // Request methods you wish to allow
    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');

    // Request headers you wish to allow
    response.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');

    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    response.setHeader('Access-Control-Allow-Credentials', true);

    console.log("oauth2token, recebido access_token de um cliente");
    var access_token = request.query.access_token;
    var XMLHttpRequest = require("xmlhttprequest").XMLHttpRequest;
    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'https://graph.microsoft.com/v1.0/me', true);
    xhr.setRequestHeader('Authorization', 'Bearer ' + access_token);
    var trigger = false;
    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4 && xhr.status === 200 && trigger == false) {
            trigger = true;
            // Do something with the response
            var loginData = JSON.parse(JSON.stringify(JSON.parse(xhr.responseText), null, '  '));

            //*************************************
            //User está autenticado pela microsoft.
            var access_token_hashed = crypto.createHash('md5').update(access_token).digest('hex');
            console.log("Utilizador pediu access_token: " + access_token_hashed);
            //// TODO:
            //Talvez ver se é @my.ipleiria.com... (pode não ser preciso, o servidor da microsoft pode so deixar @my.ipleiria.com)

            //Inserir access_token_hashed na base de dados, naquele utilizador
            con.connect(function(err) {
                if (err) throw err;
                con.query("SELECT * FROM users WHERE email = ?", [loginData.mail], function(err, result, fields) {
                    if (err) throw err;
                    console.log(result);

                    var professor = false;
                    if (loginData.jobTitle.trim().toLowerCase() == "professor") {
                        professor = true;
                    }

                    //Data em que o token expira...
                    var date = new Date();
                    var dataValidade = (new Date(date.setTime(date.getTime() + 86400000))).toISOString().substring(0, 19).replace('T', ' ');
                    if (result != null && result.length > 0) {
                        //Utilizador já existe
                        con.query('UPDATE users SET access_token = ?, access_token_expires = ? WHERE email = ?', [access_token_hashed, dataValidade, loginData.mail], function(err, result) {
                            if (err) throw err;
                            console.log("Foi efetuado um login existente...");
                            con.end();
                            response.json({
                                access_token: access_token_hashed,
                                email: loginData.mail,
                                professor: professor,
                                coordenador: result[0].RawDataPacket.coordenador
                            });
                        });
                    } else {
                        //Utilizador ainda não existe
                        con.query('INSERT INTO users (email, access_token, access_token_expires, public_key, professor, coordenador) VALUES(?, ?, ?, "",?,false)', [loginData.mail, access_token_hashed, dataValidade, professor], function(err, result) {
                            if (err) throw err;
                            console.log("Foi efetuado um login novo...");
                            con.end();
                            response.json({
                                access_token: access_token_hashed,
                                email: loginData.mail,
                                professor: professor,
                                coordenador: false //Utilizador novo, não pode ser coordenador
                            });
                        });
                    }
                });
            });

            //*************************************
        } else {
            // TODO: Do something with the error (or non-200 responses)
            // TODO: Disabled because it was replying multiple times in one go...
            /*response.json({
                data: 'ERROR:\n\n' + xhr.responseText
            });*/
        }
    };
    xhr.send();
});

app.get('/logout', (request, response) => {
    // Website you wish to allow to connect
    response.setHeader('Access-Control-Allow-Origin', '*');

    // Request methods you wish to allow
    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');

    // Request headers you wish to allow
    response.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');

    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    response.setHeader('Access-Control-Allow-Credentials', true);

    console.log("logout, recebido access_token de um cliente");

    var access_token = request.query.access_token;

    //Inserir access_token_hashed na base de dados, naquele utilizador
    con.connect(function(err) {
        if (err) throw err;
        con.query("SELECT * FROM users WHERE access_token = ?", [loginData.mail], function(err, result, fields) {
            if (err) throw err;
            console.log(result);
            if (result != null && result.length > 0) {
                //Utilizador já existe
                con.query('UPDATE users SET access_token = "", access_token_expires = NULL WHERE access_token = ?', [access_token], function(err, result) {
                    if (err) throw err;
                    console.log("Foi efetuado um logout.");
                    con.end();
                    response.json({
                        logout: "success"
                    });
                });
            }
        });
    });
});

//TODO função que verifica se o token é válido

//MUDAR NO SERVIDOR PARA  app.listen(80, "0.0.0.0", (err) => {
app.listen(80, "0.0.0.0", (err) => {
    if (err) {
        return console.log('Erro: ', err)
    }

    console.log(`Servidor está à escuta na porta 80`)
})