User.php

<?php
  /**
   * Model containing user login information
   */
  require_once('hcuCommon.i');

  class User {
    //constants
    const MEM_UNUSED                    =   0;   // Flag Unused
    const MEM_FORCE_RESET               =   2;   // Force Reset by Admin
    const MEM_LOGIN_FAILED_EMAIL        =   4;   // Login Failed -- Email Incorrect
    const MEM_LOGIN_FAILED_QST          =   8;   // Login Failed -- Challenge Questions
    const MEM_LOGIN_FAILED_PWD          =  16;   // Login Failed -- Password Incorrect
    const MEM_ASKBPAY                   =  32;   // Flag Member for Bill Pay email
    const MEM_LOGIN_FAILED_ALIAS        =  64;   // Login Failed -- Cannot use account # when alias is set
    const MEM_LOGIN_FAILED_SAC          = 128;   // Login Failed -- Secure Access Code incorrect
    const MEM_LOGIN_FAILED_BNDL         = 256;   // APP Login Failed -- MFABUNDLE missing or invalid
    const MEM_LOGIN_FAILED_BNDL_TIMEOUT = 512;   // APP Login Failed -- APP login process took too long
    const MSGTX_TRANSFER    =     1;   // Transfer
    const MSGTX_ES          =     2;   // Estatement
    const MSGTX_WEBCONNECT  =     4;   // WebConnect
    const MSGTX_TMP_SURVEY  =     8;   // temporary (session-long) flag for SurveyPopup SURVEY
    const MSGTX_TMP_XAC_RQ  =    16;   // temporary (session-long) flag to indicate when an XAC packet has been requested
    const MSGTX_TMP_XAX_LD  =    32;   // temporary (session-long) flag to indicate when an XAC packet has been successfully loaded
    const MSGTX_INTUITUPD   =    64;   // IntuitUpdate message
    const MSGTX_TXNDOWN     =   128;   // TxnDownload
    const MSGTX_TMP_MKT     =   256;   // temporary (session-long) flag for SurveyPopup MESSAGE
    const MSGTX_FORCE_EM    =   512;   // 'Force Email Change': when set the member will be prompted for email at login.
    const MSGTX_PASSCHG     =  1024;   // Passchange
    const MSGTX_ONLINEDISC  =  2048;   // Online Deposits disclosure acceptance - used in OnLineDeposits,
    const MSGTX_PROMOHIDE   =  4096;   // Promo don't show me again
    const MSGTX_STICKY      =  8192;   // "Sticky" Promo -- member can't suppress
    const HCUTEMP_FLAGS     = 49464;   // The sum of all session long flags

    private $username;
    private $creditUnion;
    private $userRepo;
    public $data = [];
    private $dirtyFields = [];

    private $allowedProperties = [
      'confidence',
      'cuuser_group_id',
      'email',
      'failedremain',
      'fchange',
      'flog',
      'fremain',
      'llog',
      'mfaquest',
      'msg_tx',
      'passwd',
      'pchange',
      'primary_account',
      'savecqid',
      'user_id',
      'user_name',
      'userflags',
  ];
  private $derivedProperties = [
      'freset',
  ];
  public $isUserLoaded = false;

    /**
     * User constructor.
     * @param string    $username
     * @param String    $cu
     * @param UserRepo  $userRepo
     */
    public function __construct(string $username, string $creditUnion, UserRepo $userRepo) {
      if (!strlen($username) || preg_match("/[\\\`,\"\s;]/", $username)) {
        throw new Exception(static::class . ": invalid username [$username]");
      }

      if (!strlen($creditUnion)) {
        throw new Exception(static::class . ": invalid credit union [$cu]");
      }

      if (!$userRepo instanceof UserRepo) {
          throw new Exception(static::class . ": need instance of UserRepo");
      }
      $this->username = $username;
      $this->creditUnion = $creditUnion;
      $this->userRepo = $userRepo;
      $this->Load();
    }

    /**
     * Magic method returns allowed properties
     * @param string    $propertyName
     * @return mixed|null
     *
     * @throws Exception
     */
    public function __get(string $propertyName) {
      if (in_array($propertyName, array_merge($this->allowedProperties, $this->derivedProperties))) {
          return $this->data[$propertyName] ?? null;
      } else {
        throw new Exception(static::class . ": Property [$propertyName] does not exist.");
      }
    }

    /**
     * Magic method sets allowed properties
     *
     * @param string    $propertyName
     * @param string    $value
     *
     * @throws Exception
     */
    public function __set(string $propertyName, string $value) {
        if (in_array($propertyName, array_merge($this->allowedProperties))) {
          $this->data[$propertyName] = $value;
          $this->dirtyFields[] = $propertyName;
        } else {
          throw new Exception(static::class . ": Property [$propertyName] does not exist.");
        }
    }

    /**
     * Magic method to check for existence of a property. Needed for functions like 'empty'
     *
     * @param String $propertyName
     *
     * @return bool
     */
    public function __isset(String $propertyName) {
      return !empty($this->data[$propertyName]);
    }

    /**
     * Load the user model with data
     *
     * @throws Exception
     */
    private function Load() {
      $this->data = $this->userRepo->Read($this->username);

      if (!$this->data) {
          throw new Exception(static::class . ": Invalid user '$this->username' for credit union {$this->creditUnion}.");
      }
      $this->isUserLoaded = true;
      // Derive further user properties
      $this->data['mfaquest'] = $this->DecodeMFAJson(HCU_JsonDecode($this->data['mfaquest']));
      $this->data['freset'] = $this->userflags & static::MEM_FORCE_RESET;
    }

    /**
     * Convert MFA data into a assoc array with this schema. This structure includes both challenge answer and secure code data.
     *      [
     *          mfacount:       Number of challenge answers
     *          answers:        Assoc array of question ids and answers
     *          challenge:      Active challenge question id. Does not seem to be used anymore
     *          authcode:       Active secure access code
     *          authexpires:    Active Secure access code expiration
     *          mfadate:        Challenge answers save timestamp
     *      ]
     *
     * @param array     $mfaJson    Array of challenge questions from database
     * @return array
     */
    private function DecodeMFAJson(array $mfaJson) {
      return [
          'mfacount'    => HCU_array_key_exists('answers', $mfaJson) ? count($mfaJson['answers']) : 0,
          'answers'     => HCU_array_key_exists('answers', $mfaJson) ?? [],
          'challenge'   => HCU_array_key_exists('challenge', $mfaJson) ? intval($mfaJson['challenge']) : 0,
          'authcode'    => HCU_array_key_exists('authcode', $mfaJson) ? strtolower($mfaJson['authcode']) : null,
          'authexpires' => HCU_array_key_exists('authexpires', $mfaJson) ? intval($mfaJson['authexpires']) : null,
          'mfadate'     => HCU_array_key_exists('mfadate', $mfaJson) ? intval($mfaJson['mfadate']) : 0,
      ];
    }

    private function GetAccounts() {
      // get the possible account numbers
      $sql = "SELECT DISTINCT ua.accountnumber
      FROM {$cu}user u
      INNER JOIN {$cu}useraccounts ua on ua.user_id = u.user_id
      WHERE u.user_name ilike '{$this->user_name}'";

      $rs = db_query( $sql, $pHBEnv["dbh"] );
    }

  }