MoneyDesk3.prg

<?php

# MoneyDesktop data feed using MDX 5 specifications
#
#
# CU : Client Code
#
# note that request will include either userkey (indicating SSO)
# or login/password (indicating aggregated access)
#
# login : login id, or possibly cu:member
# password : password for aggregated account
# userkey : token for SSO access (replaces both login and password)
# start_date : Start date, default to 30days past
# page : selected page of possible pagination. We always use page=1 of 1
#

$serviceMinimal = true;
$serviceShowInfo = false;
$serviceLoadMenu = false;
$serviceShowMenu = false;

// ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
// hcuService will be returning a status object: e.g. ["homecuErrors":{[{"message":"message1"}...{"message":"messageN"}}]
require_once(dirname(__FILE__) . '/../library/hcuService.i');
require_once(dirname(__FILE__) . '/../library/hcuDispFunctions.i');
require_once('hcuAuthShared.i');
require_once('MDesk_API.i');
require_once('cutrusted.i');
require_once('LogSSO.i');

/*
 * Force logging
 */
//$logSessionData = file_get_contents('php://input');
//$logheaders = apache_request_headers();
//$logReqPathArr = explode("/", $_SERVER['PATH_INFO']);
//$logCU = HCU_array_key_value(1, $logReqPathArr);
//$logEnd = end($logReqPathArr);
//
//$logParms = array("Cu" => $logCU, // credit union
//    "memberId" => '', // member id
//    "SSOVendor" => 'MDX',
//    "userIP" => $_SERVER['REMOTE_ADDR'], // user's ip address
//    "dbConn" => $dbh);      // get the environment info passed in
//$logParms["token"] = '';                // the id used across all communications in session
//$logParms["txnId"] = time();               // the id for this transaction
//$logParms["logPoint"] = "MDX $logEnd";   // this action in a readable form
//$logParms["request"] = "HEADERS: " . json_encode($logheaders) . "\n\n";               // the request
//$logParms["request"] .= "PATH: {$_SERVER['PATH_INFO']}\n";
//$logParms["request"] .= "INPUT: $logSessionData";               // the request
//$logParms["reply"] = '';            // the response
//LogSSOActivity($logParms);
/*
 * End Force logging
 */

//  setIncludeFiles(false,true,'bootstrap',true);
# php 5 import variables
#
//require("dms_imp_val.i");
$inPost = array();
$varOk = array(
    "start_date" => array('filter' => FILTER_SANITIZE_STRING),
    "page" => array('filter' => FILTER_SANITIZE_STRING)
);

HCU_ImportVars($inPost, "", $varOk);

$encoding = 'UTF-8';
$SENDAS = 'XML'; #set a sane default - can be overridden in trusted detail -
# but need a value in case of early error.
# consider trusted detail settings for these ?
$client_source_override = 'MDX'; # unique for Mx

function trim_item(&$item, $key) {
    $item = trim($item);
}

try {
    array_walk_recursive($inPost, 'trim_item');

    $mxReqPathArr = explode("/", $_SERVER['PATH_INFO']);

    $CU = HCU_array_key_value(1, $mxReqPathArr);
    # look a little closer at that CU value --
    # ctype_alnum ensures not empty / null, and contains only letters / digits
    if (!ctype_alnum($CU)) {
        throw new Exception("Invalid Request ", 9401); # empty ORG
    }

    if (!hcu_checkService($dbh, "MDESK")) {
        $omsg = hcu_checkServiceMsg($dbh, "MDESK");
        throw new Exception("$omsg", 9503);
    }

    # cutrusted_read will fall back to master if detail not found
    $mxTrusted = cutrusted_read($dbh, array('Cu' => $CU, 'trustedid' => 'MDesk3'));

    if ($mxTrusted['status']['Response'] == 'false') {
        throw new Exception("Client not configured for remote Mx access", 9500); # missing trusted detail
    }
    if (HCU_array_key_exists('data', $mxTrusted)) {
        $mxParms = $mxTrusted['data'];
    } else {
        throw new Exception("Client not configured for remote Mx access", 9500); # missing trusted detail parms
    }
    # previous hcu_checkService looks for all MDesk services down at server level
    # now look for MDesk service down for this particular client
    if (HCU_array_key_value('mxSvsDown', $mxParms)) {
        $omsg = (HCU_array_key_value('mxDownMsg', $mxParms) ? $mxParms['mxDownMsg'] : 'Service temporarily unavailable. Please try again later');
        throw new Exception("$omsg", 9503);
    }

    # mdTokenKey used to hash Mx user key
    $mdtokenkey = HCU_array_key_value('mdTokenKey', $mxParms);

    if (empty($mdtokenkey)) {
        throw new Exception("Client misconfigured for remote Mx access", 9500); # missing trusted detail parms (keys)
    }

    # revisit this code - trying to ensure ipWhiteList is array for array merge, even if it is empty
    $ipWhiteList = ( HCU_array_key_exists('ipWhiteList', $mxParms) ? HCU_array_key_value('ipWhiteList', $mxParms) : '' );
    # strip anything other than digits, hyphens, dots, and the commas
    $ipWhiteList = preg_replace('/[^0-9-\.\/,]/', '', $ipWhiteList);

    if (!empty($ipWhiteList)) {
        # split into array
        $ipArray = explode(',', $ipWhiteList);
    } else {
        $ipArray = array();
    }

    # add HomeCU addresses to array
    $ipallow = array_merge(array('199.184.207', # allow DMS/Homecu also
        '192.168.169',
        '172.16.0.0/12', # 172.16.0.0 – 172.31.255.255 for Docker
        '174.129.8.163', #(www6)
        '174.129.23.225', #(www5)
        '107.21.119.104', #(www3)
        '107.20.248.233', #(www0 / devel)
        '34.214.70.112', #(my.homecu.net / alpha.homecu.io)
        '34.214.139.200', #(my.homecu.net / alpha.homecu.io)
        '34.214.230.179', #(my.homecu.net / alpha.homecu.io)
        '209.161.7.186', # (DMS DSL Line)
        '184.73.202.7' # (monitor)
        ), $ipArray);
    $IPPass = false;
    $IPCaller = $_SERVER['REMOTE_ADDR'];
    $IPPass = whitelist($IPCaller, $ipallow);

    if ($IPPass == false) {
        throw new Exception("Unauthorized Access {$_SERVER['REMOTE_ADDR']}", 9403); # IP whitelist fail
    }

    # default to production mode
    $testing = ( HCU_array_key_exists('testing', $mxParms) ? HCU_array_key_value('testing', $mxParms) : 0 );

    if ($testing) {
        # HCU-issued sharekey used by trusted vendor for hashing CRED2/CRED3
        # maybe not needed for MDX5?
        $mdkey = HCU_array_key_value('mdTestKey', $mxParms);
        $mdAPI_key = HCU_array_key_value('testAPIKey', $mxParms);
        $mdData_URL = HCU_array_key_value('testServerURL', $mxParms);
        $mxHMACKey = HCU_array_key_value('testHMACKey', $mxParms);
    } else {
        # HCU-issued sharekey used by trusted vendor for hashing CRED2/CRED3
        # maybe not needed for MDX5?
        $mdkey = HCU_array_key_value('mdShareKey', $mxParms);
        $mdAPI_key = HCU_array_key_value('APIKey', $mxParms);
        $mdData_URL = HCU_array_key_value('ServerURL', $mxParms);
        $mxHMACKey = HCU_array_key_value('HMACKey', $mxParms);
    }

    if (empty($mdkey)) {
        throw new Exception("Client misconfigured for remote authentication", 9500); # missing trusted detail parms (keys)
    }

    if (empty($mxHMACKey)) {
        throw new Exception("Client misconfigured for remote Mx access", 9500); # missing trusted detail parms (keys)
    }

    $mxRestOpt = end($mxReqPathArr);
    if ($mxRestOpt == 'sessions') {
        $mxSessionData = file_get_contents('php://input');
    } else {
        $mxSessionData = ''; # 'accounts' & 'transactions' are GET - no body
    }
    $headers = apache_request_headers();
    $validRequest = mxValidRequest($headers, $mxHMACKey, $mxRestOpt, $mxSessionData);

    if (HCU_array_key_value('status', $validRequest)) {
        $reason = HCU_array_key_value('message', $validRequest);
        throw new Exception("Invalid Request", 9412);
    }

    $mdExtendable = ( HCU_array_key_exists('mdExtendable', $mxParms) ? HCU_array_key_value('mdExtendable', $mxParms) : 0 );
    if ($mdExtendable && ( empty($mdAPI_key) || empty($mdData_URL) )) {
        throw new Exception("Client misconfigured for extendable token", 9500); # missing trusted detail parms (URL &/or API key)
    }

    $SENDAS = ( HCU_array_key_exists('resultsAs', $mxParms) ? HCU_array_key_value('resultsAs', $mxParms) : 'XML' );
    $client_key_TTL = ( HCU_array_key_exists('mdTokenTTL', $mxParms) ? HCU_array_key_value('mdTokenTTL', $mxParms) : 1800 );

    # start building a stub HB_ENV
    $HB_ENV['Cu'] = $CU;
    $HB_ENV['platform'] = $client_source_override;
    $HB_ENV['client_key_TTL'] = $client_key_TTL;
    $UPDAWARE = 0; # Mx cannot update security -
    # set a 'No Activate' flag so we don't try to add live users w/pin
    # this could be a trusted detail also, but in this case Mx
    # cannot 1st-time activate, so force the setting
    $HB_ENV['NoActivation'] = 1;

    if (!in_array($mxRestOpt, array('sessions', 'accounts', 'transactions'))) {
        throw new Exception('Invalid Request', 9404);
    }

    if ($mxRestOpt == 'accounts' || $mxRestOpt == 'transactions') {
        $mxSessionKey = HCU_array_key_value('MDX-Session-Key', $headers);
        if (empty($mxSessionKey)) {
            throw new Exception("No Session Key", 9401);
        }
        $mxBundle = openMxKey($CU, $mxSessionKey);
        if (empty($mxBundle)) {
            throw new Exception("Invalid Session Key (empty)", 9401);
        }
        if (HCU_array_key_value('kt', $mxBundle) != 'A') {
            throw new Exception("Invalid Session Key (type)", 9401);
        }
        if (HCU_array_key_value('ttl', $mxBundle) < time()) {
            throw new Exception("Expired Session Key", 9401);
        }
#                   # build UserKey
        $login = HCU_array_key_value('u', $mxBundle);
        if (empty($login)) {
            throw new Exception("Invalid Session Key (user)", 9401);
        }

        Load_HB_ENVc($dbh, $CU, $login, $HB_ENV); # user_name / member number problem USERNAME
        # make sure we found somebody
        if (!HCU_array_key_value('rowfound', $HB_ENV)) {
            throw new Exception("Invalid User", 9404);
        }

        $userrec = GetUserbyName($dbh, $CU, $login);
        if (!HCU_array_key_value('rowfound', $userrec)) {
            throw new Exception("Invalid Session Key (user)", 9401);
        }

        mdesk_setLogging($dbh, $CU, $login, $mxParms);

        $mfadate = HCU_array_key_value('mfadate', $userrec);
        if (HCU_array_key_value('cd', $mxBundle) < $mfadate) {
            throw new Exception("Invalid Session Key (old cred)", 9401);
        }
    }

    if ($mxRestOpt == 'sessions') {
        $mxSessionKey = HCU_array_key_value('MDX-Session-Key', $headers);
        if (!empty($mxSessionKey)) {
            $mxBundle = openMxKey($CU, $mxSessionKey);
            if (empty($mxBundle)) {
                throw new Exception("Invalid Session Key (empty)", 9401);
            }
            if (HCU_array_key_value('kt', $mxBundle) != 'S') {
                throw new Exception("Invalid Session Key (type)", 9401);
            }
            if (HCU_array_key_value('ttl', $mxBundle) < time()) {
                throw new Exception("Expired Session Key", 9401);
            }
            #                   # build UserKey
            $login = HCU_array_key_value('u', $mxBundle);
            if (empty($login)) {
                throw new Exception("Invalid Session Key (user)", 9401);
            }
            Load_HB_ENVc($dbh, $CU, $login, $HB_ENV); # user_name / member number problem USERNAME
            # make sure we found somebody
            if (!HCU_array_key_value('rowfound', $HB_ENV)) {
                throw new Exception("Invalid User", 9404);
            }

            $userrec = GetUserbyName($dbh, $CU, $login);
            if (!HCU_array_key_value('rowfound', $userrec)) {
                throw new Exception("Invalid Session Key (user)", 9401);
            }

            mdesk_setLogging($dbh, $CU, $login, $mxParms);
        } else {
            # initial sessions request / no session key
            #  populate $login
            #
            # parse body xml in mxSessionData to get parameters to test
            $sessionXML = simplexml_load_string($mxSessionData, 'SimpleXMLElement', LIBXML_NOCDATA);
            $sessionJSON = json_encode($sessionXML);
            $sessionArray = json_decode($sessionJSON, true);


            $session = HCU_array_key_value('session', $sessionArray);

            if (HCU_array_key_value('userkey', $session)) {
                # got a userkey, validate it

                $ckKey = CheckV94key($CU, HCU_array_key_value('userkey', $session), $mdtokenkey, 'S');
                # if userkey check fails
                if (HCU_array_key_value('Code', $ckKey['Status']) > 0) {
                    $status = HCU_array_key_value('Message', $ckKey['Status']);
                    $code = HCU_array_key_value('Code', $ckKey['Status']);
                    # be careful what you add to status message -
                    # unescaped characters will cause XML parse error on error output
//                    $HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " ckKey: " . json_encode($ckKey));
                    throw new Exception("Invalid Credentials (userkey) {$status}", 9401);
                }
                # set $login from userkey content
                $apptokarr = HCU_array_key_value('data', $ckKey);
                $login = HCU_array_key_value('A', $apptokarr);

                $userrec = GetUserbyName($dbh, $CU, $login);
                if (!HCU_array_key_value('rowfound', $userrec)) {
                    throw new Exception("Invalid User", 9404);
                }

                mdesk_setLogging($dbh, $CU, $login, $mxParms);

                $ckarr = array();
                $cktoken = MakeV94Dkey($CU, $login, $userrec, $client_key_TTL, $mdtokenkey, 'S');
                parse_str(urldecode($cktoken), $ckarr);
                if (HCU_array_key_value('P', $ckarr) !== HCU_array_key_value('P', $apptokarr)) {
                    throw new Exception("Invalid Credentials (authentication required)", 9401);
                }
                if ($mdExtendable) {
                    # if configured to do so and the userkey is more than 15 min old
                    # extend the userkey stored at Mx
                    $ckExp = HCU_array_key_value('E', $ckarr);
                    $tkExp = HCU_array_key_value('E', $apptokarr);
                    if ($ckExp - $tkExp > 900) {
                        # if the new token would expire more than 15min later than the current one, set a new one
                        mdesk_setLogging($dbh, $CU, $login, $mxParms);
                        $mxUpdated = mdesk_sync($mdData_URL, $mdAPI_key, $CU, $HB_ENV['Uid'], $HB_ENV['Cn'], $HB_ENV['Ml'], $cktoken, $mxParms);
                        if (HCU_array_key_value('code', $mxUpdated) > 0) {
                            $status = HCU_array_key_value('status', $mxUpdated);
                            $code = HCU_array_key_value('code', $mxUpdated);
                            throw new Exception("Error ({$status} {$code}). Unable to connect to MoneyDesktop.", 9500);
                        }
                    }
                }
            } else {
                # no userkey -  check login and password
                $login = HCU_array_key_value('login', $session);
                $userpass = HCU_array_key_value('password', $session);

                if (empty($login) || preg_match("/[\\\`,\"\s;]/", $login) || empty($userpass)) { # user_name / member number problem MEMBERACCT
                    throw new Exception("Invalid Credentials", 9400); # Member Bad Characters or empty passwd
                }

                mdesk_setLogging($dbh, $CU, $login, $mxParms);

                # strip leading zeroes, unless configured not to do so
                if (!(preg_match("/\D/", $login)) && !HCU_array_key_value('preserveZeros', $mxParms)) {
                    $login = preg_replace("/^0*/", "", $login);
                }
            }
        }
        # parse body xml in mxSessionData to get parameters to test
        $sessionXML = simplexml_load_string($mxSessionData, 'SimpleXMLElement', LIBXML_NOCDATA);
        $sessionJSON = json_encode($sessionXML);
        $sessionArray = json_decode($sessionJSON, true);


        $session = HCU_array_key_value('session', $sessionArray);

        if (HCU_array_key_value('login', $session) || HCU_array_key_value('password', $session)) {
            # if got login and password?
            $login = HCU_array_key_value('login', $session);
            $userpass = HCU_array_key_value('password', $session);

            if (empty($login) || preg_match("/[\\\`,\"\s;]/", $login) || empty($userpass)) { # user_name / member number problem MEMBERACCT
                throw new Exception("Invalid Credentials", 9400); # Member Bad Characters or empty passwd
            }
            # strip leading zeroes, unless configured not to do so
            if (!(preg_match("/\D/", $login)) && !HCU_array_key_value('preserveZeros', $mxParms)) {
                $login = preg_replace("/^0*/", "", $login);
            }
            Load_HB_ENVc($dbh, $CU, $login, $HB_ENV); # user_name / member number problem USERNAME
            # make sure we found somebody
            if (!HCU_array_key_value('rowfound', $HB_ENV)) {
                throw new Exception("Invalid User", 9404);
            }
            # removed this part of the test - failed because the hash doesn't start with $1$ anymore
            # and ... ancient news that older crypt only tested first 8 char of passwd and would get
            # false match.  MD5 cured that (hence the $1$ test), and we have long since moved on
            #  && ( preg_match('/^\$1\$/', $HB_ENV['password']) || strlen($userpass) < 9)

            if (!(trim($userpass) > '' && password_verify($userpass, $HB_ENV['password']) )) {
                LogFail($dbh, $HB_ENV, array('ORG' => $CU), GetUserFlagsValue('MEM_LOGIN_FAILED_PWD'));
                throw new Exception("Authentication Failed (password)", 9401); # password
            }
            $userrec = GetUserByName($dbh, $CU, $login); # user_name / member number problem USERNAME
            # make sure we found somebody
            if (!HCU_array_key_value('rowfound', $userrec)) {
                throw new Exception("Invalid User", 9404);
            }

            # if locked, throw error 4011 Locked Account
            if ($userrec['lockedacct']) {
                throw new Exception('Member Account Locked', 9401); # locked
            }
            if (($userrec['forceupdate'] && ($UPDAWARE & $userrec['forceupdate']) < $userrec['forceupdate'] ) ||
                empty($userrec['email'])) {
                throw new Exception('Member Account Access Blocked', 9401); # Blocked waiting for required security updates
            }

            # password ok, if 2-factor, send MFA challenge or fall thru to send data

            if (HCU_array_key_value('cver', $HB_ENV) == 'F') {
                # if cu using MFA
                # build MFA-pending key
                $mxBundle = array(
                    'u' => $login,
                    'p' => $password, # really?
                    'kt' => 'S',
                    'ttl' => time() + 600, # session key, 10 minutes to complete
                    'cd' => time());        # show MFA change date as now
                $SessionKey = createMxKey($CU, $mxBundle);
                if (empty($SessionKey)) {
                    throw new Exception("Key Creation Failed", 9500);
                }

                # send challenge
                $data_reply = Mx5_challenge($dbh, $HB_ENV, $MC);
                if (HCU_array_key_value('Status', $data_reply) !== 'Success') {
                    throw new Exception("Building Challenge " . $data_reply['Status'], 9500); # email
                }
                $reply_arr = HCU_array_key_value('data', $data_reply);
                $reply_arr['session']['key'] = $SessionKey;
            } else {
                # login/password validated, and not 2-factor
                # build UserKey with TTL lifespan to store at Mx
//                $PCHANGE = strtotime($HB_ENV['pwchange']);
                $userrec = GetUserbyName($dbh, $CU, $HB_ENV['Cn']);
                if (!HCU_array_key_value('rowfound', $userrec)) {
                    throw new Exception("Invalid User", 9404);
                }
                $mxtoken = MakeV94Dkey($CU, $HB_ENV['Cn'], $userrec, $client_key_TTL, $mdtokenkey, 'S');

// # got here via login/userpass no MFA, which means member is aggregating.
// # do not make Mx user / member records.  But DO return a userkey?
//                $mxUpdated = mdesk_sync($mdData_URL, $mdAPI_key, $CU, $HB_ENV['Uid'], $HB_ENV['Cn'], $HB_ENV['Ml'], $mxtoken, $parms);
//                if (HCU_array_key_value('code', $mxUpdated) > 0) {
//                    $status = HCU_array_key_value('status', $mxUpdated);
//                    $code = HCU_array_key_value('code', $mxUpdated);
//                    throw new Exception("Error ({$status} {$code}). Unable to connect to MoneyDesktop", 9500);
//                }
                # track login
                LogPass($dbh, $HB_ENV);
                # and build a 10-minute session key
                $mxBundle = array(
                    'u' => $login,
                    'kt' => 'A',
                    'ttl' => time() + 600, # session key, 10 minutes
                    'cd' => time());
                $SessionKey = createMxKey($CU, $mxBundle);
                if (empty($SessionKey)) {
                    throw new Exception("Session Key Creation Failed", 9500);
                }

                $reply_arr = array('session' => array('key' => $SessionKey, 'mxToken' => $mxtoken));
            }
        } elseif (HCU_array_key_exists('challenges', $session) && is_array($session['challenges'])) {
            # elseif got MFA?
            # validate
            # if invalid, throw error 9401
            # build UserKey
            # update Mx
            # end
            # we have challenge responses - pack them into a list for validation
            $challresp = array();
            foreach ($session['challenges']['challenge'] as $chalkey => $chalinfo) {
                $challresp[$chalinfo['id']] = $chalinfo['answer'];
            }
            /*
             * <mdx version='5.0'>
              <session>
              <key>UNIQUE_KEY_FOR_THIS_SESSION</key>
              <challenges>
              <challenge>
              <id>UNIQUE_IDENTIFIER_FOR_THIS_CHALLENGE</id>
              <answer><![CDATA[answer]]></answer>
              </challenge>
              <challenge>
              <id>UNIQUE_IDENTIFIER_FOR_THIS_CHALLENGE</id>
              <answer><![CDATA[answer]]></question>
              </challenge>
              <!-- additional challenge questions -->
              </challenges>
              </session>
              </mdx>
             */
            if (!HCU_array_key_value('MFA_E', $challresp) || !isValidEmail(HCU_array_key_value('MFA_E', $challresp), $userrec)) {
                LogFail($dbh, $HB_ENV, array('ORG' => $CU), GetUserFlagsValue('MEM_LOGIN_FAILED_EMAIL'));
                throw new Exception("MFA Failed (EML)", 9401); # email
            }
            # and now check the challenge responses
            /*
             * passing a temp array so I can turn off the '1 random' setting.
             * Require all challenge responses from Mx
             */

            $tmpEnv = array();
            $tmpEnv['mfaquest'] = $HB_ENV['mfaquest'];
            $tmpEnv['Fset2'] = 0; # turn off '1 random'
            list($qfail, $qreason) = MFQ_response($tmpEnv, $challresp);

            if ($qfail) {
                LogFail($dbh, $HB_ENV, array('ORG' => $CU), $failreason, GetUserFlagsValue('MEM_LOGIN_FAILED_QST'));
                throw new Exception("MFA Failed (Challenge)", 9401); # email
            }
            # challenge passed, build a UserKey to store at Mx
//            $PCHANGE = strtotime($HB_ENV['pwchange']);
            $userrec = GetUserbyName($dbh, $CU, $HB_ENV['Cn']);
            if (!HCU_array_key_value('rowfound', $userrec)) {
                throw new Exception("Invalid User", 9404);
            }
            $mxtoken = MakeV94Dkey($CU, $HB_ENV['Cn'], $userrec, $client_key_TTL, $mdtokenkey, 'S');

// # got here via login/userpass/MFA, which means member is aggregating.
// # do not make Mx user / member records.  But DO return a userkey?
//            $mxUpdated = mdesk_sync($mdData_URL, $mdAPI_key, $CU, $HB_ENV['Uid'], $HB_ENV['Cn'], $HB_ENV['Ml'], $mxtoken, $parms);
//            if (HCU_array_key_value('code', $mxUpdated) > 0) {
//                $status = HCU_array_key_value('status', $mxUpdated);
//                $code = HCU_array_key_value('code', $mxUpdated);
//                throw new Exception("Error ({$status} {$code}). Unable to connect to MoneyDesktop", 9500);
//            }
            # track login
            LogPass($dbh, $HB_ENV);

            # and build a 10-minute authenticated session key
            $mxBundle = array(
                'u' => $login,
                'kt' => 'A',
                'ttl' => time() + 600, # session key, 10 minutes
                'cd' => $userrec['mfadate']);
            $SessionKey = createMxKey($CU, $mxBundle);
            if (empty($SessionKey)) {
                throw new Exception("Session Key Creation Failed", 9500);
            }

//            $reply_arr = array('session' => array('key' => $SessionKey, 'mxToken' => $mxtoken));
            $reply_arr = array('session' => array('key' => $SessionKey));
        } elseif (HCU_array_key_exists('userkey', $session)) {
            # elseif got userkey?
            # if invalid throw error 9401
            # if extendable && foreground
            # update Mx
            # AuthMode=SSO w/Userkey
            // see if original userkey or the session ticket
            $userkey = HCU_array_key_value('userkey', $session);
            $apptokarr = array();
            parse_str(urldecode($userkey), $apptokarr);

            // see if original UserKey
            if (HCU_array_key_exists('E', $apptokarr) && HCU_array_key_exists('H', $apptokarr)) {
                $login = $apptokarr['A'];
                $HMethod = (HCU_array_key_exists('P', $apptokarr) ? 'S' : 'M');
                $keycheck = CheckV94key($CU, $userkey, $mdtokenkey, $HMethod);

                if ($keycheck['Status']['Message'] !== 'Success') {
                    throw new Exception($keycheck['Status']['Message'], 9401);
                }
            } else {
                throw new Exception("Invalid Userkey Credentials Corrupt", 9401);
            }
            # and build a 10-minute authenticated session key
            $mxBundle = array(
                'u' => $login,
                'kt' => 'A',
                'ttl' => time() + 600, # session key, 10 minutes
                'cd' => time()); # used $userrec['mfadate'] but userrec undefined here?
            $SessionKey = createMxKey($CU, $mxBundle);
            if (empty($SessionKey)) {
                throw new Exception("Session Key Creation Failed", 9500);
            }
            $reply_arr = array('session' => array('key' => $SessionKey));
            $mxSessionKey = $SessionKey; # so logging gets the right value
            $mxParms["environment"]["reply"] = "$SessionKey";
        } else {
            # throw error 4102 no userkey and no credentials
            throw new Exception("Invalid Userkey Credentials Missing ", 9401);
        }
    }
    if ($mxRestOpt == 'accounts') {
        # checking key, loading HB_ENV & userrec occurs at top
        # return account data
        #GET /accounts
        $HB_ENV['HideCert'] = HCU_array_key_value('HideCert', $mxParms);
        $data_reply = Mx5_accts($dbh, $HB_ENV);
        # check for errors
        if (HCU_array_key_value('Status', $data_reply) !== 'Success') {
            throw new Exception("Retrieving Accounts " . $data_reply['Status'], 9500); # email
        }
        $reply_arr = HCU_array_key_value('data', $data_reply);
        if (HCU_array_key_value('hashlist', $data_reply) && is_array($data_reply['hashlist']) ) {
            $mxParms["environment"]["reply"] = '';
            foreach($data_reply['hashlist'] as $hash => $acct) {
                $mxParms["environment"]["reply"] .= "$hash : {$acct['acct']} \n";
            }
        }
    }
    if ($mxRestOpt == 'transactions') {
        # checking key, loading HB_ENV & userrec occurs at top
        # validate keyacctid
        # return transaction data
        #GET /client-id/accounts/:account_id/transactions?start_date=YYYY-MM-DD&page=n
        # parse to get $account_id and $start date, set $end_date
        # tie the array index to 'accounts' +1 in case the path changes?
        # account_id should be encrypted or something to hide it
        # and then un-hide it here before calling for history
        $account_id = $mxReqPathArr[3];
        $HB_ENV['HideCert'] = HCU_array_key_value('HideCert', $mxParms);
        $hcuList = Mx5_accts($HB_ENV['dbh'], $HB_ENV);
//                    $HB_ENV["SYSENV"]["logger"]->info(" id: {$account_id} " . print_r($hcuList,true));

        if (HCU_array_key_exists('hashlist', $hcuList) &&
            HCU_array_key_exists($account_id, $hcuList['hashlist'])) {
            $KEYACCTID = $hcuList['hashlist'][$account_id]['acct']; # gets C|666665|12
            $KEYACCTPOS = $hcuList['hashlist'][$account_id]['pos']; # gets numeric idx
            $mxParms["environment"]["reply"] = "$account_id : $KEYACCTID ";
//         $HB_ENV["SYSENV"]["logger"]->info(" id: {$KEYACCTID}  pos: {$KEYACCTPOS}");
        } else {
            throw new Exception("Requested account not found", 9404); # email
        }
        $varOk = array(
            "start_date" => array('filter' => FILTER_SANITIZE_STRING),
            "end_date" => array('filter' => FILTER_SANITIZE_STRING),
            "page" => array('filter' => FILTER_SANITIZE_NUMBER_INT));

        HCU_ImportVars($mxPosted, "", $varOk);
        $start_date = HCU_array_key_value('start_date', $mxPosted);
        $end_date = HCU_array_key_value('end_date', $mxPosted);
        $dflt_end = date("Y-m-d", time() + (4 * 24 * 60 * 60)); # + 4 days
        $end_date = (empty($end_date) ? $dflt_end : $end_date);
        $page = HCU_array_key_value('page', $mxPosted);
        $page = (empty($page) ? 1 : $page);

        $balinfo = $hcuList['data'][$KEYACCTPOS]['account'];
//        $HB_ENV["SYSENV"]["logger"]->info(print_r($balinfo,true));

        switch (substr($KEYACCTID, 0, 1)) {
            case 'D':
                # test for locked / unviewable
//                    $reply_arr = Mx5_dpTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                $data_reply = Mx5_dpTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                break;
            case 'L':
                # test for locked / unviewable
                # test for info from 3rd party, treat as unviewable
//                    $reply_arr = Mx5_lnTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                $data_reply = Mx5_lnTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                break;
            case 'C':
                # test for locked / unviewable
                # test for info from 3rd party, treat as unviewable
//                    $reply_arr = Mx5_ccTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                $data_reply = Mx5_ccTrans($dbh, $HB_ENV, $KEYACCTID, $balinfo, $start_date, $end_date);
                break;
            default:
                throw new Exception("Invalid account requested", 9404); # email
                break;
        }
        # check for errors
        if (HCU_array_key_value('Status', $data_reply) !== 'Success') {
            throw new Exception("Retrieving Transactions " . $data_reply['Status'], 9500); # email
        }

        $reply_arr = HCU_array_key_value('data', $data_reply);
        if (HCU_array_key_exists('account',$reply_arr) && HCU_array_key_exists('transactions', $reply_arr['account'])) {
            # transactions array has 1 entry even if there are no actual transactions
            $trancount = (integer) count($reply_arr['account']['transactions']) -1;
            $mxParms["environment"]["reply"] .= "\n[$start_date - $end_date $trancount transactions]";
        }
    }
    /*
     * logging here?
     *
     */
        if ($mxParms["logging"] == "enabled") {
        $logParms = $mxParms["environment"];      // get the environment info passed in

        $logSessionData = file_get_contents('php://input');
        $logheaders = apache_request_headers();
        $logReqPathArr = explode("/", $_SERVER['PATH_INFO']);
        $logEnd = end($logReqPathArr);

        $logParms["token"] = $mxSessionKey;     // MDX session key, or a substr of it?
        $logParms["txnId"] = time();            // the id for this transaction
        $logParms["logPoint"] = "MDX $logEnd";  // this action in a readable form
        $logParms["request"] = "HEADERS: " . json_encode($logheaders) . "\n\n";
        $logParms["request"] .= "PATH: {$_SERVER['PATH_INFO']}\n";
        $logParms["request"] .= "INPUT: $logSessionData";

        LogSSOActivity($logParms);
    }
    /*
     *
     */

    send_response($reply_arr, 200, $SENDAS);
#========== END of PROCESSING ============

    /*
     * may need to move the apache_note after the sql, and use both user_name and alias.
     * check cuauth to see about urlencoding alias
     */
    apache_note('user_name', "{$CU}:{$login}"); # user_name / member number problem Which one does Odyssey get?
} catch (Exception $ex) {
    $httpcode = $ex->getCode();
    $httpcode -= 9000;
    $reply_arr = array('error' =>
        array('code' => $ex->getCode(), 'message' => $ex->getMessage() . " (" . $ex->getLine() . ")"));
    send_response($reply_arr, $httpcode, $SENDAS);
}

function send_response($reply_arr, $httpcode, $sendas = 'XML') {
    if (!$httpcode) {
        $httpcode = 200; # if code not set, default to 200 OK
    }
    http_response_code($httpcode);

    switch ($sendas) {
        case 'JSON':
            $xmlResp = HCU_JsonEncode($reply_arr);
            header("Content-Type: application/json");
//            header("Content-disposition: inline; filename=\"{$HB_ENV['Cu']}_txns.json\"");
            break;
        case 'XML':
        default:
            $attrs = array('version' => '5.0');
            $xmlResp = Format_AppFeed(assocArrayToXML($reply_arr, 'mdx', $attrs));
//            $xmlResp = assocArrayToXML($reply_arr, 'mdx', $attrs);
            break;
    }
    header("Content-Type: application/vnd.moneydesktop.mdx.v5+xml");
    header("Content-length: " . strlen($xmlResp));
    print $xmlResp;

    /*
     * Force logging
     */
//    if ($httpcode != 200) {
//$logSessionData = file_get_contents('php://input');
//$logheaders = apache_request_headers();
//$logReqPathArr = explode("/", $_SERVER['PATH_INFO']);
//$logCU = HCU_array_key_value(1, $logReqPathArr);
//$logEnd = end($logReqPathArr);
//
//$logParms = array("Cu" => $logCU, // credit union
//    "memberId" => '', // member id
//    "SSOVendor" => 'MDX',
//    "userIP" => $_SERVER['REMOTE_ADDR'], // user's ip address
//    "dbConn" => $GLOBALS['dbh']);      // get the environment info passed in
//$logParms["token"] = '';                // the id used across all communications in session
//$logParms["txnId"] = time();               // the id for this transaction
//$logParms["logPoint"] = "MDX $logEnd Error";   // this action in a readable form
//$logParms["request"] = "HEADERS: " . json_encode($logheaders) . "\n\n";               // the request
//$logParms["request"] .= "PATH: {$_SERVER['PATH_INFO']}\n";
//$logParms["request"] .= "INPUT: $logSessionData";               // the request
//$logParms["reply"] = "HTTP Code: $httpcode\n";            // the response
//$logParms["reply"] .= "\nContent-Type: application/vnd.moneydesktop.mdx.v5+xml";
//$logParms["reply"] .= "\nContent-length: " . strlen($xmlResp);
//$logParms["reply"] .= "$xmlResp\n";
//LogSSOActivity($logParms);
//    }
    /*
     * End Force logging
     */

    exit;
}

function sqlmdy($date) {

    if (strtolower($date) == "now" || strtolower($date) == "today") {
        $date = date("Y-m-d");
    }
    # only allow 0-9 and dash(-) or slash (/)
    # also allow dot (.) for milliseconds
    if (preg_match("/[^0-9\-\/\.]/", $date)) {
        return false;
    }
    if (preg_match("/[-\/]/", $date)) {
        list ($yy, $mm, $dd) = preg_split("/[-\/\.]/", $date);
    } else {
        $yy = substr($date, 0, 4);
        $mm = substr($date, 4, 2);
        $dd = substr($date, 6, 2);
    }
    $mm = sprintf("%02d", intval($mm));
    $dd = sprintf("%02d", intval($dd));
    if (strlen($yy) > 0 && strlen($yy) < 4) {
        $yy = ($yy < 70 ? 2000 + $yy : 1900 + $yy);
    }
    $yy = sprintf("%04d", intval($yy));
    if (checkdate($mm, $dd, $yy)) {
        return "${yy}${mm}${dd}";
    } else {
        return false;
    }
}

/**
 *
 * @param string $IPCaller ip address of calling client
 * @param array $ipWhiteList array of acceptable ip addresses, possible cidr
 * @return boolean IPCaller found acceptable or not?
 */
function whitelist($IPCaller, $ipWhiteList) {
    $IPPass = false;

    foreach ($ipWhiteList as $value) {
        if (strpos($value, '/')) {
            if (cidr_match($IPCaller, $value)) {
                $IPPass = true;
                break;
            }
        } elseif (substr($IPCaller, 0, strlen(trim($value))) == trim($value)) {
            $IPPass = true;
            break;
        }
    }
    return $IPPass;
}

/**
 *
 * @param string $ip ip address of calling client
 * @param string $range cidr address from allowed list
 * @return integer 1 if ip addr falls in given range, else 0
 */
function cidr_match($ip, $range) {
    list ($subnet, $bits) = explode('/', $range);
    $ip = ip2long($ip);
    $subnet = ip2long($subnet);
    $mask = -1 << (32 - $bits);
    $subnet &= $mask; # nb: in case the supplied subnet wasn't correctly aligned
    $lownetwork = $subnet & $mask;
    $highbroadcast = $subnet | (~$mask & 0xFFFFFFFF);

    $pass = ($ip > $lownetwork && $ip < $highbroadcast ? 1 : 0);
    #return ($ip & $mask) == $subnet;

    return $pass;
}

/**
 *
 * @param string $data XML string to be formatted
 * @return string XML 'pretty' with indents
 */
function Format_AppFeed($data) {

    $dom = new DOMDocument();

    $dom->preserveWhiteSpace = false;
    $dom->formatOutput = true;

    $dom->loadXML($data);
    $out = $dom->saveXML();

    $out = str_replace('<?xml version="1.0"?>', '', $out);

    return ($out);
}

/**
 *
 * @param type $dbh
 * @param type $HB_ENV
 * @param type $start_date
 * @param type $end_date
 * @param type $KEYACCTID
 * @return array
 * @throws Exception
 */
function Mx5_accts($dbh, $HB_ENV) {

    try {
        $balances = Get_Balances($dbh, $HB_ENV);

        $reply_arr = array();
        $reply_idx = 0;

        if (HCU_array_key_exists('dp', $balances) && count($balances['dp'])) {

# for each $balances['dp'], print list
            foreach ($balances['dp'] as $balkey => $balinfo) {
                if (HCU_array_key_value('trust', $balinfo) == 'transfer') {
                    # cross-account transfer only, don't send to Mx
                    continue;
                }
                $desc = htmlspecialchars($balinfo['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $displaydesc = htmlspecialchars($balinfo['displaydesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $atype = ($balinfo['certnumber'] == "0" || $HB_ENV['HideCert'] ? $balinfo['accounttype'] : "{$balinfo['accounttype']}_{$balinfo['certnumber']}");
                $atype = ($balinfo['accountnumber'] . '-' . $atype);
                $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);

                switch ($balinfo['deposittype']) {
                    case "Y":
                        $acttype = "CHECKING";
                        break;
                    case "N":
                    case "S":
                    default:
                        $acttype = "SAVINGS";
                        break;
                }
                $hash = sha1("{$HB_ENV['Cu']}{$balkey}");

                $itm_arr = array(
                    #'bid' => $balkey,
                    'id' => $hash,
                    'type' => $acttype,
                    'name' => $balinfo['displaydesc'],
                    'balance' => $balinfo['currentbal'],
                    'account_number' => $atype,
                    'currency_code' => 'USD');
                if (HCU_array_key_value('Fset', $HB_ENV) & GetFlagsetValue('CU_SHOWAVAILABLE')) {
                    $itm_arr['available_balance'] = $balinfo['availablebal'];
                } else {
                    # available_balance is required @ Mx. Populate w/currentbal if we aren't showing it
                    $itm_arr['available_balance'] = $balinfo['currentbal'];
                }
//<mdx version="5.0">
//  <accounts>
//    <account>
//      <id>84943189431</id>
//      <type>CHECKING</type>
//      <name><![CDATA[Premium Checking]]></name>
//      <balance>1972.38</balance>
//      <available_balance>1972.38</available_balance>
//      <account_number>12345-678<account_number>
//      <currency_code>USD</currency_code>
//      <!-- additional MDX account fields as desired-->
//    </account>
//    <!-- additional <account> elements as needed -->
//  </accounts>
//</mdx>
                $reply_arr['accounts'][]['account'] = $itm_arr;
                $reply_arr['hashlist'][$hash] = array('acct' => $balkey, 'pos' => $reply_idx);
                $reply_idx++;
            }
        }


#
# If CU2_SPEC18, try to get credit card loans
        if (HCU_array_key_value('Fset2', $HB_ENV) & GetFlagsetValue('CU2_SPEC18')) {

            if (HCU_array_key_exists('cc', $balances) && count($balances['cc'])) {

                foreach ($balances['cc'] as $balkey => $balinfo) {
                    if (HCU_array_key_value('trust', $balinfo) == 'transfer') {
                        # cross-account transfer only, don't send to Mx
                        continue;
                    }

                    $nextduedate = $balinfo['nextduedate'];
                    $creditlimit = $balinfo['creditlimit'];

                    $desc = $balinfo['description'];
                    $desc = htmlspecialchars("$desc", ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    $displaydesc = $balinfo['displaydesc'];
                    $displaydesc = htmlspecialchars("$displaydesc", ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    $loan = $balinfo['loan'];
                    $atype = ($balinfo['accountnumber'] . '-' . $loan);
                    $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    $balance = $balinfo['currentbal'];
                    $creditlimit = $balinfo['creditlimit'];
                    $available = $creditlimit - $balance;
                    $balance = sprintf("%.2f", $balance * -1);
                    $available = ($available < 0 ? "" : $available);
                    $cur_avail = (HCU_array_key_value('Fset2', $HB_ENV) & GetFlagsetValue('CU2_CALL_CCAVAIL') ? "Call" : $available);

                    $hash = sha1("{$HB_ENV['Cu']}{$balkey}");

                    $itm_arr = array(
                        #'id' => $balkey,
                        'id' => $hash,
                        'type' => 'CREDIT_CARD',
                        'name' => $balinfo['displaydesc'],
                        'balance' => $balinfo['currentbal'],
                        'account_number' => $atype,
                        'currency_code' => 'USD');

                    if ($cur_avail > 0) {
                        $itm_arr['available_balance'] = $cur_avail;
                    }
                    $reply_arr['accounts'][]['account'] = $itm_arr;
                    $reply_arr['hashlist'][$hash] = array('acct' => $balkey, 'pos' => $reply_idx);
                    $reply_idx++;
                }
            }
        }

# try to get loans
        if (count($balances['ln'])) {

            foreach ($balances['ln'] as $balkey => $balinfo) {
                if (HCU_array_key_value('trust', $balinfo) == 'transfer') {
                    # cross-account transfer only, don't send to Mx
                    continue;
                }
//    $HB_ENV["SYSENV"]["logger"]->info(__LINE__ . " From Get_Balances: " . json_encode(array('desc' => $balinfo['description'],'displaydesc' => $balinfo['displaydesc'])));

                $balance = $balinfo['currentbal'];
                $loan = $balinfo['loan'];
                $atype = ($balinfo['accountnumber'] . '-' . $loan);
                $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $desc = htmlspecialchars($balinfo['description'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $displaydesc = htmlspecialchars($balinfo['displaydesc'], ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $payoff = HCU_array_key_value('payoff', $balinfo);
                $nextduedate = $balinfo['nextduedate'];
                $creditlimit = $balinfo['creditlimit'];

                $hash = sha1("{$HB_ENV['Cu']}{$balkey}");

                $itm_arr = array(
                    #'id' => $balkey,
                    'id' => $hash,
                    'type' => 'LOAN',
                    'name' => $balinfo['displaydesc'],
                    'balance' => $balinfo['currentbal'],
                    'account_number' => $atype,
                    'currency_code' => 'USD');

                $reply_arr['accounts'][]['account'] = $itm_arr;
                $reply_arr['hashlist'][$hash] = array('acct' => $balkey, 'pos' => $reply_idx);
                $reply_idx++;
            }
        }
        # returning hashlist under data returned it to caller script as data - ick!
        # also caused the Format_AppFeed function to throw an error due to invalid XML content
        # so bump it up as a peer to data - can still use to validate w/o exposing list
        $result = array('Status' => 'Success', 'data' => $reply_arr['accounts'], 'hashlist' => $reply_arr['hashlist']);
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . htmlspecialchars($e->getMessage(), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'data' => $reply_arr);
    }

    return $result;
}

// end Mx5_accts
function Mx5_dpTrans($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend) {
    try {

        $reply_arr = array('account' => array(
                'id' => $balinfo['id'],
                'transactions' => array('@attributes' => array('start_date' => $sqlstart, '3' => 'three', 'pages' => 1, 'page' => 1))));

        $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);

        if (HCU_array_key_exists($balkey, $history) && is_array($history[$balkey])) {

            $atype = $balinfo['account_number'];
//                $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES);
            foreach ($history[$balkey] as $tnum => $detl) {
# process the list
                $itm_arr = array();

                $tranamount = $detl['amount'];
                $tranamount = str_replace(",", "", str_replace("$", "", $tranamount));
                $tranamount = sprintf("%.2f", $tranamount);
                $check = (HCU_array_key_exists('checkno', $detl) ? $detl['checkno'] : 0);
                $trandesc = $detl['description'];
                if ($trandesc < " " && $check != 0) {
                    $trandesc = "CHK";
                }
                $trandesc = (preg_replace("/<BR>/", " ", $trandesc));
                $trandesc = (preg_replace("/&nbsp;/", " ", $trandesc));
//                $trandesc = htmlspecialchars($trandesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                $trandesc = (trim($trandesc) == '' ? '.' : $trandesc);

                if ($tranamount < 0) {
                    $trntype = 'DEBIT';
                } else {
                    $trntype = 'CREDIT';
                }
                $itm_arr['id'] = "{$atype}-{$detl['traceno']}";
                $itm_arr['type'] = $trntype;
                $itm_arr['amount'] = $tranamount;
                $itm_arr['description'] = array("@cdata" => $trandesc);
                $itm_arr['status'] = 'POSTED';
                $itm_arr['transacted_on'] = date('Y-m-d', strtotime($detl['date']));
                $itm_arr['posted_on'] = date('Y-m-d', strtotime($detl['date']));
                if ($balinfo['type'] == 'CHECKING' and $check != 0) {
                    $itm_arr['check_number'] = $check;
                }
                $reply_arr['account']['transactions'][]['transaction'] = $itm_arr;
            }
        }

        $result = array('Status' => 'Success', 'data' => $reply_arr);
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . htmlspecialchars($e->getMessage(), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'data' => $reply_arr);
    }
    return $result;
}

function Mx5_ccTrans($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend) {
    try {

        $hisinfo = HCU_array_key_value('hisinfo', $balinfo);
        $incchist = (empty($hisinfo) || trim(strtoupper($hisinfo)) == 'HOMECU' ? 1 : 0);

        $reply_arr = array('account' => array(
                'id' => $balinfo['id'],
                #<transactions start_date="2013-06-07" pages="5" page="1">
                #'transactions' => 'start_date="' . $sqlstart . ' pages="1" page="1"'));
                'transactions' => array('@attributes' => array('start_date' => $sqlstart, 'pages' => 1, 'page' => 1))));

        if ($incchist) {
            $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);
            if (HCU_array_key_exists($balkey, $history) && is_array($history[$balkey])) {

                $atype = $balinfo['account_number'];
//                $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES);
                foreach ($history[$balkey] as $tnum => $detl) {

                    $itm_arr = array();

                    $principle = (HCU_array_key_exists('principal', $detl) ? $detl['principal'] : 0);
                    /*
                     * As clarified by Jeff Heuer of MoneyDesktop 7/9/2018
                     * A debit should always have a negative amount and a credit should always have a positive amount
                     * in OFX data feeds. If you send it with TRNTYPE of DEBIT then the amount should be negative. If
                     * you send it with TRNTYPE of CREDIT then the amount should be positive. That is true across all
                     * account types (checking, savings, credit cards, loans, etc.). A DEBIT always means money out of
                     * the user's pocket (something that subtracts from their net worth). A CREDIT adds to their net worth.
                     *
                     * But the data coming from CUSA core for CCU has the sign opposite of that, which Gary confirmed is
                     * correct from the CU perspective.  So I am flipping the sign to satisfy MoneyDesktop / CCU.  At this
                     * time it appears CCU is our only client who is both 1) using MoneyDesktop and 2) showing credit card
                     * transaction history on the books of the cu and included in the data feed from the core (CUSA) to HomeCU.
                     *
                     * Note: checked existing clients with cc history on their books - seems consistent that they get to us
                     * with the signs opposite what MoneyDesktop expects - so maybe not as big a deal as I feared
                     * So toggle the sign before deciding DEBIT / CREDIT
                     */
                    $principle = $principle * -1;
                    if ($principle < 0) {
                        $trntype = "DEBIT";
                    } else {
                        $trntype = "CREDIT";
                    }

                    $totalpay = $detl['totalpay'];
                    $trdesc = $detl['description'];
//                    $trdesc = htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
                    $trdesc = (trim($trdesc) == '' ? '.' : $trdesc);

                    $itm_arr['id'] = "{$atype}-{$detl['traceno']}";
                    $itm_arr['type'] = $trntype;
                    $itm_arr['amount'] = $totalpay;
                    $itm_arr['description'] = array("@cdata" => $trdesc);
                    $itm_arr['status'] = 'POSTED';
                    $itm_arr['transacted_on'] = date('Y-m-d', strtotime($detl['date']));
                    $itm_arr['posted_on'] = date('Y-m-d', strtotime($detl['date']));

                    $reply_arr['account']['transactions'][]['transaction'] = $itm_arr;
                }
            }
        }
        $result = array('Status' => 'Success', 'data' => $reply_arr);
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . htmlspecialchars($e->getMessage(), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'data' => $reply_arr);
    }
    return $result;
}

function Mx5_lnTrans($dbh, $HB_ENV, $balkey, $balinfo, $sqlstart, $sqlend) {
    try {
        $reply_arr = array('account' => array(
                'id' => $balinfo['id'],
                #<transactions start_date="2013-06-07" pages="5" page="1">
                #'transactions' => 'start_date="' . $sqlstart . ' pages="1" page="1"'));
                'transactions' => array('@attributes' => array('start_date' => $sqlstart, 'pages' => 1, 'page' => 1))));

        $hisinfo = HCU_array_key_value('hisinfo', $balinfo);
        $incchist = (empty($hisinfo) || trim(strtoupper($hisinfo)) == 'HOMECU' ? 1 : 0);

        if ($incchist) {
            $history = Get_History($dbh, $HB_ENV, $balkey, $sqlstart, $sqlend);
            if (HCU_array_key_exists($balkey, $history) && is_array($history[$balkey])) {

                $atype = $balinfo['account_number'];
//                $atype = htmlspecialchars(trim($atype), ENT_NOQUOTES);
                foreach ($history[$balkey] as $tnum => $detl) {
                    $itm_arr = array();

                    $principle = (HCU_array_key_exists('principal', $detl) ? $detl['principal'] : 0);
                    $interest = (HCU_array_key_exists('interest', $detl) ? $detl['interest'] : 0);
                    $totalpay = (HCU_array_key_exists('totalpay', $detl) ? $detl['totalpay'] : 0);
                    $traceno = (HCU_array_key_exists('traceno', $detl) ? $detl['traceno'] : 0);
                    $trdesc = (HCU_array_key_exists('description', $detl) ? $detl['description'] : '');
                    $trdesc = (trim($trdesc) == '' ? '.' : $trdesc);

                    # OFX set them this way -
                    if ($principle < 0) {
                        $trntype = "PAYMENT";
                    } else {
                        $trntype = "ADVANCE";
                    }
                    # for MDX - CREDIT increases member net worth
                    if ($principle < 0) {
                        $trntype = "CREDIT";
                    } else {
                        $trntype = "DEBIT";
                    }

//                    $trdesc = htmlentities($trdesc, ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE);
# transaction data row
//                if (($HB_ENV['Fset'] & GetFlagsetValue('CU_SHOWLNTXNSPLIT')) == GetFlagsetValue('CU_SHOWLNTXNSPLIT')) {
//                    $itm_arr['TRNAMT'] = $totalpay;
//                    $itm_arr['LOANTRNAMT'] = array('PRINAMT' => $principle, 'INTAMT' => $interest);
//                } else {
//                    $itm_arr['TRNAMT'] = $principle;
//                }

                    $itm_arr['id'] = "{$atype}-{$detl['traceno']}";
                    $itm_arr['type'] = $trntype;
                    $itm_arr['amount'] = $totalpay;
                    $itm_arr['description'] = array("@cdata" => $trdesc);
                    $itm_arr['status'] = 'POSTED';
                    $itm_arr['transacted_on'] = date('Y-m-d', strtotime($detl['date']));
                    $itm_arr['posted_on'] = date('Y-m-d', strtotime($detl['date']));

                    $reply_arr['account']['transactions'][]['transaction'] = $itm_arr;
                }
            }
        }
        $result = array('Status' => 'Success', 'data' => $reply_arr);
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . htmlspecialchars($e->getMessage(), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'data' => $reply_arr);
    }
    return $result;
}

function Mx5_challenge($dbh, $HB_ENV, $MC) {
    /*
     * <mdx version='5.0'>
      <session>
      <key>UNIQUE_KEY_FOR_THIS_SESSION</key> # key will be added after return
      <challenges>
      <challenge>
      <id>UNIQUE_IDENTIFIER_FOR_THIS_CHALLENGE</id>
      <question><![CDATA[What is your mother's maiden name?]]></question>
      </challenge>
      <challenge>
      <id>UNIQUE_IDENTIFIER_FOR_THIS_CHALLENGE</id>
      <question><![CDATA[What city were you born in?]]></question>
      </challenge>
      <!-- additional challenge questions -->
      </challenges>
      </session>
      </mdx>

     */
    try {
        # for backward compatibility at Mx
        # this MFA_send_chall sends MFA_E and all MFA_Q settings
        # regardless of '1 random' settings
        /*
         * Turn off the '1 random' setting - Mx doesn't support it
         */

        $HB_ENV['flagset2'] = $HB_ENV['flagset2'] & (~ GetFlagsetValue('CU2_RANDOM_CHAL'));  # turn off '1 random'

        $MemberChallengeQuestions_ary = GetChallengeQuestions("CHALLENGE", $dbh, $HB_ENV, $MC, $HB_ENV['Cn']);

        $reply_arr = array('session' => array('challenges' => array()));

# force 'What email' as first challenge question
        $itm_arr = array('challenge' => array(
                'id' => 'MFA_E',
                'question' => array("@cdata" => 'What email address is saved with this account?')));

        $reply_arr['session']['challenges'][] = $itm_arr;

# and now add mfa questions, if any were found
        if (count($MemberChallengeQuestions_ary)) {
            foreach ((array) $MemberChallengeQuestions_ary as $chakey => $mfaitem) {
                $itm_arr = array('challenge' => array(
                        'id' => "MFA_{$mfaitem['cqid']}",
                        'question' => array("@cdata" => "{$mfaitem['display']}")));

                $reply_arr['session']['challenges'][] = $itm_arr;
            }
        }

        $result = array('Status' => 'Success', 'data' => $reply_arr);
    } catch (Exception $e) {
        $result = array('Status' => 'Failed ' . htmlspecialchars($e->getMessage(), ENT_NOQUOTES | ENT_XML1, 'UTF-8', FALSE), 'data' => $reply_arr);
    }

    return $result;
}