Login.data

<?php
  header("Access-Control-Allow-Origin: *");
  header("Content-Type: application/json; charset=UTF-8");
  header("Access-Control-Allow-Methods: POST");
  header("Access-Control-Allow-Headers: Content-Type,Access-Control-Allow-Headers, Authorization, X-Requested-With");

  // ** Include the Global Script for Error Handling
  require_once(dirname(__FILE__) . '/../../shared/library/hcuLogError.i');
  require_once(dirname(__FILE__) . '/../../shared/library/hcuCommon.i');
  require_once(dirname(__FILE__) . '/../../shared/library/logging.i');
  require_once(dirname(__FILE__) . '/../../shared/library/hcuEnv.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cu_flagconst.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cu_fun.i');
  require_once(dirname(__FILE__) . '/../../shared/library/errormail.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cu_func.i');
  require_once(dirname(__FILE__) . '/../../shared/library/commonJsFunctions.i');

  require_once(dirname(__FILE__) . '/../../shared/library/db.postgres.i');

  require_once(dirname(__FILE__) . '/../../shared/library/cu_data.i');
  require_once(dirname(__FILE__) . '/../../banking/library/cu_credentials.i');
  require_once(dirname(__FILE__) . "/../../shared/library/hcuTranslate.i");
  require_once(dirname(__FILE__) . '/../../shared/library/dms_imp_val.i');
  require_once(dirname(__FILE__) . '/../../monitor/library/monitorFunctions.i');
  require_once(dirname(__FILE__) . '/../../shared/library/cuDataModel.i');

  // New classes for login
  require_once(dirname(__FILE__) . '/../../banking/library/UserLogin.php');
  require_once(dirname(__FILE__) . '/../../banking/library/UserRepo.php');
  require_once(dirname(__FILE__) . '/../../banking/library/User.php');
  require_once(dirname(__FILE__) . '/../../banking/library/CuAdmin.php');
  require_once(dirname(__FILE__) . '/../../banking/library/CuAdminRepo.php');

  // ** Home Banking Desktop Functions
  require_once(dirname(__FILE__) . '/../../banking/library/hcuDispFunctions.i');
  require_once(dirname(__FILE__) . '/../../shared/library/hcuFunctions.i');

  global $dbh, $logger;

  try {

    $HB_ENV = array();
    $aryReply = array();
    $aryInfo = array();
    $aryResult = array();
    // set up the environment based on environment variables
    $HB_ENV['SYSENV'] = LoadSystemEnv("banking");
    SetEnvStatic($HB_ENV);
    $dbh = GetDBH($HB_ENV['SYSENV']['db']);
    $HB_ENV["dbh"] = $dbh;
    $Cu = $_POST['cu'];
    $HB_ENV['homebankingpath'] = $_POST['homebankingpath'];
    $HB_ENV['Cu'] = $Cu;
    $HB_ENV['chome'] = strtolower($Cu);
    // TO-DO need to address multi-language
    $HB_ENV['Flang'] = "en_US";
    $MC = new hcu_talk_base($HB_ENV['Flang']);
    $HB_ENV["MC"] = $MC;
    $HB_ENV['platform'] = $_POST['platform'];

    if(isset($_POST['action']) && !empty($_POST['action'])) {
      $action = $_POST['action'];
      switch($action) {
          case 'LoginNotices':
            $loginNoticeAry = Get_NoticeInfo($dbh, $HB_ENV, $MC, "D", "loginNotice");
            $aryResult = $loginNoticeAry;
          break;
          case 'LoginPromos':
            $loginPromoAry = Get_NoticeInfo($dbh, $HB_ENV, $MC, "D", "LoginPromo");
            $aryResult = $loginPromoAry;
          break;
          // case 'ChallengeQuestion':
          //   $MemberChallengeQuestions_ary = GetChallengeQuestions("CHALLENGE", $dbh, $HB_ENV, $MC, $HB_ENV['username']);
          //   $aryResult = $MemberChallengeQuestions_ary;

          // break;
          case 'ValidateUser':

            if ($_POST['payload']) {
              $payload = $_POST['payload'];
              // decode payload
              $data = HCU_PayloadDecode($Cu, $payload);
              $username = trim(strval($data['username']));
              $password = trim(strval($data['password']));
            }

            $cuAdminRepo = new CuAdminRepo($dbh, $logger, $Cu);
            $cuAdmin = new CuAdmin($Cu, $cuAdminRepo);
            $userRepo = new UserRepo($dbh, $logger, $Cu);
            $user = new User($username, $Cu, $userRepo);
            $login = new UserLogin($user, $cuAdmin);

            $isValid = $login->ValidateUser($password);
            $isLocked = $login->IsAccountLocked();
            $isValidDevice = $login->IsValidDeviceCookie($Cu);
            $isValidMammothDevice = $login->IsValidMammothDeviceCookie($Cu, $HB_ENV);
            $isMfaMode = $login->IsMFAMode();

            if (!$isValid) {
              // Not valid username/password
              throw new Exception("Invalid Username or Password");
            }

            if ($isLocked) {
              if ($login->new_user) {
                $loginAry['Step'] = 'Setup';
              } else {
              // Account is locked
              // send to reset password
              $resetlink = $HB_ENV['homebankingpath'] . "/hcuResetPwd.prg?cu={$Cu}";
              throw new Exception($MC->combo_msg('Account is Locked Reset', 0, '#link#', "$resetlink"));
              }
            } else if ($isValidDevice || $isValidMammothDevice) {
              // Has valid cookie
              $loginAry['Step'] = 'None';
              // Create Session ticket cookie
              $login->CreateSessionTicket($HB_ENV, $MC, $Cu);
            } else {
              // needs additional authentication
              $loginAry['Step'] = 'MFA';
            }

            $aryInfo = 'Success';
            $aryResult =  $loginAry;

            // update member environment variables - TO-DO
            // log user pass or failure - TO-DO
            // create new member cookie - TO-DO
          break;
          default:

          break;

      }
    }
  } catch (Exception $err) {
    //Return error message
    $aryReply["errors"] = $err->getMessage();
    // if returning error, not replying with data
    $aryResult = array();
    // if returning error, not returning status
    $aryInfo = array();
    //throw new Exception("Error Occurred: " . $err);
  }

  if (count($aryInfo)) {
    $aryReply["info"] = $aryInfo;
  }

  if (count($aryResult)) {
    $aryReply["data"] = $aryResult;
  }

  print json_encode($aryReply);