aAccessControl.data

<?php

/**
 * function DeleteSubAccounts($pEnv, $accountnumber, $subaccounts)
 * This deletes one or more subaccounts.
 *
 * @param $pEnv -- the environment
 * @param $accountnumber -- the account number to delete sub accounts for
 * @param $subaccounts -- the subaccounts to delete
 *
 * @return $error -- array of errors (0 or more)
 * @return $code -- 0 if successful, nonzero otherwise
 * @return $showAddNewAccount -- if new account option should be shown
 */
function DeleteSubAccounts($pEnv, $accountnumber, $subaccounts) {
    $showAddNewAccount = false;

    try {
        $dbh = $pEnv["dbh"];
        $userId = $pEnv["userId"];
        $Cu = $pEnv["Cu"];
        $Cn = $pEnv["Cn"];
        $allowZeroes = $pEnv["allowZeroes"];
        $disallowMultipleAccounts = $pEnv["disallowMultipleAccounts"];

        // If don't allow leading zeroes, strip out the leading zeroes.
        if (!$allowZeroes) {
            $accountnumber = preg_replace('/^0+/', '', trim($accountnumber));
        }

        if ($subaccounts == "") {
            throw new exception("Subaccounts are required.", 1);
        }
        $subaccounts = hcu_JsonDecode($subaccounts);
        if (!is_array($subaccounts)) {
            throw new exception("Subaccounts are required.", 2);
        }
        $forDeletion = array();
        foreach($subaccounts as $subaccount) {
            if (!HCU_array_key_exists("accounttype", $subaccount) || !HCU_array_key_exists("certnumber", $subaccount)
                || !HCU_array_key_exists("recordtype", $subaccount)) {
                throw new exception("Subaccounts are malformed.", 3);
            }
            $subaccount["_action"] = "delete";
            $subaccount["user_id"] = $userId;
            $subaccount["accountnumber"] = $accountnumber;
            $accountDelete[] = $subaccount;
        }

        $datatable = "useraccounts";
        $forDeletion = array($datatable => $accountDelete);

        $sql = "select email from cuadminusers
            where user_name = '" . prep_save($Cn, 50) . "'
            and cu = '" . prep_save($Cu, 10) . "'";
        $sth = db_query($sql, $dbh);
        if (!$sth) {
            throw new exception("email query failed.", 4);
        }
        $email = db_fetch_row($sth)[0];

        $context = "admin";
        $script = "userSupportAccessControl.prg";
        $addr = trim($_SERVER["REMOTE_ADDR"]);
        $vars = array("cu" => $Cu);

        if (!db_work ($dbh, HOMECU_WORK_BEGIN)) {
            throw new exception("begin query failed.", 6);
        }

        // deleting from useraccounts table
        $results = DataUserTableUpdate($dbh, $vars, null, $forDeletion, $userId, "ACCESS_DEL", $context,
                                       $script, "A", "Primary User Access Delete", $Cn, $email, $addr);
        if ($results === false) {
            throw new exception("Deleting from useraccounts table failed.", 105);
        }


        // deleting from cu_alerts table
        $forDeletion = array();
        // $alertDelete = array();
        $alerts = array();
        $datatable = "cu_alerts";
        //remove unneeded array value for cu_alert deletion
        foreach($accountDelete as $subKey => $subArray) {
            if (HCU_array_key_exists('recordtype', $subArray)) {
                unset($accountDelete[$subKey]['recordtype']);
            }
            $accountType = HCU_array_key_value('accounttype', $accountDelete[$subKey]);
            $certNumber = HCU_array_key_value('certnumber', $accountDelete[$subKey]);
            // look up ids of any alert records
            $alertSql = "select id
            from cu_alerts where user_id = '" . prep_save(intval($userId)) . "'
            AND accountnumber = '" . prep_save($accountnumber, 12) . "'
            AND  accounttype = '" . prep_save($accountType, 25) . "'
            AND  certnumber = " . prep_save(intval($certNumber)) . " ";
            $sth = db_query($alertSql, $dbh);

            if (!$sth) {
                throw new exception("cu_alerts query failed.", 107);
            }
            if (db_num_rows($sth) > 0) {
                while ($result = db_fetch_row($sth)) {
                    $alerts['id'] = $result[0];
                    $alerts["_action"] = "delete";
                    $alertDelete[] = $alerts;
                }
            }
        }

        if (isset($alertDelete)) {
            $forDeletion = array($datatable => $alertDelete);
            $results = DataUserTableUpdate($dbh, $vars, null, $forDeletion, $userId, "ACCESS_DEL", $context,
                                           $script, "A", "Primary User Access Delete", $Cn, $email, $addr);
            if ($results === false) {
                throw new exception("Deleting from alerts table failed.", 105);
            }
        }

        // deleting from cu_scheduledtxn table
        $forDeletion = array();
        $sched = array();
        $datatable = "cu_scheduledtxn";

        //remove unneeded array value for cu_scheduledtxn deletion
        foreach($accountDelete as $subKey => $subArray) {
            $accountType = HCU_array_key_value('accounttype', $accountDelete[$subKey]);
            // look up ids of any alert records
            $schedSql = "select id, txn_data from cu_scheduledtxn
                where user_id = '" . prep_save(intval($userId)) . "'
                AND CU = '" . prep_save($Cu, 10) . "' ";
            $sth = db_query($schedSql, $dbh);

            if (!$sth) {
                throw new exception("cu_scheduledtxn query failed.", 107);
            }
            $row = 0;
            if (db_num_rows($sth) > 0) {
                while ($result = db_fetch_assoc($sth, $row++)) {
                    $txnData = HCU_JsonDecode( $result["txn_data"], false );
                    if ($txnData['txn']['frommember'] == $accountnumber && $txnData['txn']['fromsuffix'] == $accountType ) {
                        $sched['id'] = $result['id'];
                        $sched["_action"] = "delete";
                        $schedDelete[] = $sched;
                    }
                }
            }
        }

        if (isset($schedDelete)) {
            $forDeletion = array($datatable => $schedDelete);
            $results = DataUserTableUpdate($dbh, $vars, null, $forDeletion, $userId, "ACCESS_DEL", $context, $script,
                                           "A", "Primary User Access Delete", $Cn, $email, $addr);
            if ($results === false) {
                throw new exception("Deleting from scheduledtxn table failed.", 105);
            }
        }

        $sql = "select 'FOUND' from ${Cu}useraccounts
            where user_id = " . prep_save(intval($userId)) . "
            and accountnumber = '" . prep_save($accountnumber, 12) . "'";
        $sth = db_query($sql, $dbh);

        if (!$sth) {
            throw new exception("found query failed.", 107);
        }

        if (db_num_rows($sth) == 0) {

            if ($disallowMultipleAccounts) {
                // This means that there are no accounts anymore.  So show add button.
                $sql = "select 'FOUND' from ${Cu}useraccounts where user_id = " . prep_save(intval($userId));
                $sth = db_query($sql, $dbh);

                if (!$sth) {
                    throw new exception("found query failed.", 110);
                }

                $showAddNewAccount = db_num_rows($sth) == 0;
            }
            $sql = "delete from ${Cu}memberacctrights
                where user_id = " . prep_save(intval($userId)) . "
                and accountnumber = '" . prep_save($accountnumber, 12) . "'";
            $sth = db_query($sql, $dbh);
            if (!$sth) {
                throw new exception("acct rights delete failed.", 108);
            }
        }

        if (!db_work($dbh, HOMECU_WORK_COMMIT)) {
            throw new exception("commit work failed.", 109);
        }

    } catch(exception $e) {
        if ($e->getCode() >= 100) {
            db_work($dbh, HOMECU_WORK_ROLLBACK); // Got greater problems if this fails.
        }

        return array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return array("error" => array(), "code" => 0, "showAddNewAccount" => $showAddNewAccount);
}

/**
 * function GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber)
 * This function will get subaccount data for an account by querying what is already in the table for the primary user.
 *
 * @param $dbh -- the database connection
 * @param $Cu -- the credit union
 * @param $userId -- the user id
 * @param $accountnumber -- the account number
 *
 * @return $code -- either 666 or 101
 * @return $errors -- array of zero or more errors
 * @return $data -- like is in the spoof accounts function and the real one.)
 */
function GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber) {
    try {
        $subquery = "select x.certnumber || trim(recordtype) || trim(x.accountnumber) || trim(x.accounttype) as key, trim(x.accountnumber),
                    trim(x.accounttype), x.certnumber, x.display_name, x.recordtype as type
                    from ${Cu}useraccounts x
                    inner join (
                        select b.user_id from ${Cu}user a
                        inner join ${Cu}user b on a.user_id = $userId and a.group_id = b.group_id and b.is_group_primary limit 1) y
                    on x.user_id = y.user_id where trim(x.accountnumber) = '" . prep_save($accountnumber, 12) . "'";

        $sql = "select ua.accountnumber, ua.accounttype, ua.certnumber, ab.deposittype, ua.type, coalesce(ab.description, ua.display_name) as description,
                ab.may_deposit, ab.may_withdraw
                from (
                     select certnumber || 'D' || trim(accountnumber) || trim(accounttype) as key,
                     trim(description), may_deposit, may_withdraw, '' as deposittype, 'D' as type, trim(accounttype)
                     from ${Cu}accountbalance where accountnumber = '" . prep_save($accountnumber, 12) . "'
                     union all
                     select '0' || 'T' || trim(accountnumber) || trim(accounttype) || '#' || trim(tomember) as key,
                     trim(description), true, false, deposittype, 'T', trim(accounttype)
                     from ${Cu}crossaccounts where accountnumber = '" . prep_save($accountnumber, 12) . "' and deposittype <> 'L'
                     union all
                     select '0' || 'L' || trim(accountnumber) || trim(loannumber) as key,
                     trim(description), may_payment, may_addon, '', 'L', trim(loannumber)
                     from ${Cu}loanbalance where accountnumber = '" . prep_save($accountnumber, 12) . "'
                     union all
                     select '0' || 'P' || trim(accountnumber) || trim(accounttype) || '#' || trim(tomember) as key,
                     trim(description), false, false, deposittype, 'P', trim(accounttype)
                     from ${Cu}crossaccounts where accountnumber = '" . prep_save($accountnumber, 12) . "' and deposittype = 'L'
                ) as ab(key, description, may_deposit, may_withdraw, deposittype, type, accounttype)
            right join ($subquery and recordtype in ('D', 'T', 'L', 'P')) as ua(key, accountnumber, accounttype, certnumber, display_name)
            on ab.key = ua.key order by ab.accounttype";
        $sth = db_query($sql, $dbh);

        if (!$sth) {
            throw new exception("Deposit query failed.", 1);
        }

        $depositList = array();
        $loanList = array();
        $xacList = array();
        for($i = 0; $row = db_fetch_assoc($sth, $i); $i++) {
            // Need to use true or false for may_payment and may_addon because that is what the actual live function is doing.
            $row["may_deposit"] = HCU_array_key_exists("may_deposit", $row) && isset($row["may_deposit"]) ? trim($row["may_deposit"]) == "t" : true;
            $row["may_withdraw"] = HCU_array_key_exists("may_withdraw", $row) && isset($row["may_withdraw"]) ? trim($row["may_withdraw"]) == "t" : true;

            switch($row["type"]) {
                case "D":
                    $depositList[] = $row;
                    break;
                case "L":
                    $row ["loannumber"] = $row ["accounttype"];
                    $loanList[] = $row;
                    break;
                case "T":
                case "P":
                    $explode = explode("#", $row["accounttype"]);
                    $row["accounttype"] = $explode[0];
                    $row["tomember"] = $explode[1];
                    $xacList[] = $row;
                    break;
            }
        }
    } catch(exception $e) {
        return array("code" => "666");
    }
    return array("code" => "000", "data" => array("accounts" => array("deposit" => $depositList, "loan" => $loanList, "xa" => $xacList)));
}

/**
 * function GetAccountFromCore($SYSENV, $accountnumber, $isPrimary)
 * This will get data from the data (if the user is primary; otherwise, it will get the data from the primary user of the group.)
 *
 * @param $SYSENV -- the environment
 * @param $accountnumber -- the account number
 * @param $isPrimary -- if the user is the primary user for the group
 *
 * @return $error -- array of errors (0 or more)
 * @return $code -- 0 if successful, nonzero otherwise
 * @return $accountInfo -- the account information
 * @return $subaccountInfo -- the subaccount information
 */
function GetAccountFromCore($SYSENV, $accountnumber, $isPrimary) {
    // TODO: remove this and spoof logic when have batch working correctly
    $live = $SYSENV["live"];
    $logger = $SYSENV["logger"];
    $dbh = $SYSENV["dbh"];
    $Cu = $SYSENV["Cu"];
    $allowZeroes = $SYSENV["allowZeroes"];
    $userId = $SYSENV["userId"];

    try {

        // If don't allow leading zeroes, strip out the leading zeroes.
        if (!$allowZeroes) {
            $accountnumber = preg_replace('/^0+/', '', trim($accountnumber));
        }

        // Go get the data.

        if ( $live == "Y" ) {
            $SYSENV['SYSENV']['logger'] = $logger;  // ** Required for the lower level functions as they expect the information to be in the "SYSENV" structure
            $SYSENV['SYSENV']['devmode'] = $SYSENV['devmode'];
            $fullData = $isPrimary ? FindMemberAccounts($SYSENV, array("member" => $accountnumber, "email" => "")) :
                GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber);
            // if no data with MIR packet, try finding without MIR
            if ($fullData["code"] == "001" || $fullData["code"] == "999") {
                $fullData = $isPrimary ? FindMemberAccountsWoMIR($dbh, $Cu, $accountnumber) : GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber);
            }
        } else {
            $fullData = $isPrimary ? SpoofFindMemberAccounts($dbh, $Cu, $accountnumber) : GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber);
            if ($fullData["code"] == "001" || $fullData["code"] == "999") {
                $fullData = $isPrimary ? FindMemberAccountsWoMIR($dbh, $Cu, $accountnumber) : GetPrimaryMemberAccounts($dbh, $Cu, $userId, $accountnumber);
            }
        }

        switch ($fullData["code"]) {
            case "001":
                throw new exception("No data was found.", 1);
                break;
            case "999":
                throw new exception($fullData["error"], 2);
                break;
            case "101":     // TODO: remove this when batch is working; this comes from Spoof function.
            case "102":     // The correct case with data, but no MIR
                break;
            case "000":
                break; // The correct case with data.
            default:
                throw new exception("There was an internal problem.", 3);
                break;
        }


        // I don't care about this data if it isn't a primary user.
        // Data is not shown anywhere otherwise.
        // Only shown if primary user and mir data is present
        if ($isPrimary) {
            if ( isset($fullData["data"]["mir"]) ) {
                $accountInfo = $fullData["data"]["mir"];

                $homePhone = !HCU_array_key_exists("homephone", $accountInfo) ? "" : trim($accountInfo["homephone"]);
                $cellPhone = !HCU_array_key_exists("cellphone", $accountInfo) ? "" : trim($accountInfo["cellphone"]);
                $first = !HCU_array_key_exists("firstname", $accountInfo) ? "" : trim($accountInfo["firstname"]);
                $sec = !HCU_array_key_exists("middlename", $accountInfo) ? "" : trim($accountInfo["middlename"]);
                $third = !HCU_array_key_exists("lastname", $accountInfo) ? "" : trim($accountInfo["lastname"]);
                $dob = !HCU_array_key_exists("dob", $accountInfo) ? "" : trim($accountInfo["dob"]);
                // At this point, DOB should be mm/dd/yyyy.  Add a simple test to make sure that that is true.

                if ($dob != "" && !DateTime::createFromFormat("m/d/Y", $dob)) {
                // I suppose that the core could not have the DOB information and that would be fine.
                    throw new exception("DOB is invalid.", 5);
                }

                $theAccountInfo = array(array("accountnumber" => $accountnumber, "name" => trim("$first $sec $third"), "birthday" => $dob,
                    "primaryPhone" => $homePhone != "" ? $homePhone : $cellPhone));
            } else {
                $theAccountInfo = array(array("accountnumber" => $accountnumber, "name" => "", "birthday" => "",
                    "primaryPhone" => ""));
            }

        } else {
            $theAccountInfo = "";
        }

        // Will need to put subaccountInfo in one dataSource.  Add a flag for deposit or the other thing.  Also, get them to have the same columns.
        $theSubaccountInfo = array();
        $kendoId = 1;

        // Add check to exclude subaccounts ALREADY added to the user.  Will remove this later using the kendoId.
        $alreadyExistsCheck = array();

        $subaccountInfo = $fullData["data"]["accounts"];
        if (HCU_array_key_exists("deposit", $subaccountInfo)) {
            foreach($subaccountInfo["deposit"] as $thisRow) {
                $thisRow["kendoId"] = $kendoId;
                $thisRow["recordtype"] = "D";
                $thisRow["isDeposit"] = true;

                $canDeposit = !HCU_array_key_exists("may_deposit", $thisRow) ? false : $thisRow["may_deposit"];
                $canWithdraw = !HCU_array_key_exists("may_withdraw", $thisRow) ? false : $thisRow["may_withdraw"];
                $thisRow["canIntDeposit"] = $canDeposit;
                $thisRow["canExtDeposit"] = $canDeposit;
                $thisRow["canIntWithdraw"] = $canWithdraw;
                $thisRow["canExtWithdraw"] = $canWithdraw;

                // Also add sort here.
                $strposAt = strpos($thisRow["accounttype"], "@");
                $permType = 0;
                $permAccount = "000";
                if ($strposAt !== false) {
                    $permType = 1;
                    $permAccount = substr($thisRow["accounttype"], $strposAt + 1);
                }
                $thisRow["perm_account_sort"] = $permAccount;
                $thisRow["perm_type_sort"] = $permType;

                unset($thisRow["may_deposit"]);
                unset($thisRow["may_withdraw"]);
                unset($thisRow["may_payment"]);
                unset($thisRow["deposittype"]); // Find no use for this here.
                $theSubaccountInfo[] = $thisRow;

                $alreadyExistsCheck[] = "('" . prep_save($thisRow["accounttype"], 25) . "',
                    " . prep_save(intval($thisRow["certnumber"])) . ", 'D', $kendoId)";
                $kendoId++;
            }
        }
        if (HCU_array_key_exists("loan", $subaccountInfo)) {
            foreach($subaccountInfo["loan"] as $thisRow) {
                $thisRow["kendoId"] = $kendoId;
                $thisRow["recordtype"] = "L";
                $thisRow["isDeposit"] = false;
                $thisRow["accounttype"] = $thisRow["loannumber"];
                $thisRow["certnumber"] = 0;

                $canDeposit = !HCU_array_key_exists("may_payment", $thisRow) ? false : $thisRow["may_payment"];
                $canWithdraw = !HCU_array_key_exists("may_addon", $thisRow) ? false : $thisRow["may_addon"];
                $thisRow["canIntDeposit"] = $canDeposit;
                $thisRow["canExtDeposit"] = $canDeposit;
                $thisRow["canIntWithdraw"] = $canWithdraw;
                $thisRow["canExtWithdraw"] = $canWithdraw;

                // Also add sort here.
                $strposAt = strpos($thisRow["accounttype"], "@");
                $permType = 0;
                $permAccount = "000";
                if ($strposAt !== false) {
                    $permType = 1;
                    $permAccount = substr($thisRow["accounttype"], $strposAt + 1);
                }
                $thisRow["perm_account_sort"] = $permAccount;
                $thisRow["perm_type_sort"] = $permType;

                unset($thisRow["may_payment"]);
                unset($thisRow["deposittype"]); // Find no use for this here.
                unset($thisRow["may_addon"]);
                unset($thisRow["loannumber"]);
                $theSubaccountInfo[] = $thisRow;

                $alreadyExistsCheck[] = "('" . prep_save($thisRow["accounttype"], 25) . "',
                    " . prep_save(intval($thisRow["certnumber"])) . ", 'L', $kendoId)";
                $kendoId++;
            }
        }
        /* DO NOT PROCESS XAC if the CU is setup with 'Create Access Control records from XAC' on Home Banking Screen
         *   under this situation we will not be adding the XAC records to useraccounts - The admin may need to add them as separate accounts
         *   Otherwise, if the user is setup with "ACCESS" rights they will get the Cross Accounts as separate Accounts under Access Control
         *   the next time they access the Transfer screen.
         */
        if (HCU_array_key_exists("xa", $subaccountInfo) && (GetFlagsetValue("CU3_CREATE_ACCESS_CONTROL_FROM_XAC") & $flagset3) == 0 ) {
            foreach($subaccountInfo["xa"] as $thisRow) {
                $isDeposit = $thisRow["deposittype"] !== "L";

                // The only available option is the first column: internal deposit/payment.
                $thisRow["kendoId"] = $kendoId;
                $thisRow["isDeposit"] = $isDeposit;
                $thisRow["canIntDeposit"] = true;
                $thisRow["canExtDeposit"] = false;
                $thisRow["canIntWithdraw"] = false;
                $thisRow["canExtWithdraw"] = false;

                $thisRow["certnumber"] = 0;
                $thisRow["accounttype"] .= "#" . $thisRow["tomember"];
                $thisRow["recordtype"] = $isDeposit ? "T" : "P";

                // Also add sort here.
                $thisRow["perm_account_sort"] = $thisRow["tomember"];
                $thisRow["perm_type_sort"] = 2;

                $theSubaccountInfo[] = $thisRow;

                $alreadyExistsCheck[] = "('" . prep_save($thisRow["accounttype"], 25) . "',
                    " . intval($thisRow["certnumber"]) . ", '" . $thisRow["recordtype"] . "', $kendoId)";
                $kendoId++;
            }
        }

        if (count($alreadyExistsCheck) > 0) {
            $weedOutThese = array();
            $sql = "select t.kendoid from ${Cu}useraccounts ua
                    inner join (values " . implode(",", $alreadyExistsCheck) . ") as t(accounttype, certnumber, recordtype, kendoid)
                    on ua.accounttype = t.accounttype and ua.certnumber = t.certnumber and ua.recordtype = t.recordtype
                    and ua.user_id = " . prep_save(intval($userId)) . " and ua.accountnumber = '" . prep_save($accountnumber, 12) . "'";
            $sth = db_query($sql, $dbh);

            if (!$sth) {
                throw new exception("check query failed.", 4);
            }
            for($i = 0; $row = db_fetch_row($sth, $i); $i++) {
                $weedOutThese[] = intval($row[0]);
            }

            $theOfficialSubaccountInfo = array();
            foreach($theSubaccountInfo as $info) {
                if (!in_array($info["kendoId"], $weedOutThese)) {
                    $theOfficialSubaccountInfo[] = $info;
                }
            }
        } else {
            $theOfficialSubaccountInfo = $theSubaccountInfo;
        }

    } catch(exception $e) {
        return array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return array("error" => array(), "code" => 0, "accountInfo" => $theAccountInfo, "subaccountInfo" => $theOfficialSubaccountInfo);
}

/**
 * function CreateSubaccounts($pEnv, $subaccounts, $accountnumber, $latestKendoid)
 * This will create the subaccounts after the account is found and one or more subaccounts are selected.
 *
 * @param $pEnv -- the environment
 * @param $subaccounts -- an JSON encoded string from the subaccount grid.
 * @param $accountnumber -- the account number
 * @param $latestKendoid -- the latest kendoId
 *
 * @return $error -- zero count or the first error found
 * @return $code -- zero if successful
 * @return $newAccounts -- if it is needed to add another account, then it will show up here.
 * Needed to refresh the grids.
 * @return $accountEncryption -- the payload needed for the account link
 * (if primary account is changed)
 * @return $newSubaccounts -- All subaccounts added
 * @return $setPrimaryAccount -- if the primary account was changed
 * @return $primaryAccount -- the primary account if changed
 * @return $dontShowAddNewAccount -- if true, hide the add new account button
 * @return array("error" => zero or the first error found, "code" => zero if successful
 */
function CreateSubaccounts($pEnv, $subaccounts, $accountnumber, $latestKendoid) {
    $dontShowAddNewAccount = false;

    try {

        $allowZeroes = $pEnv["allowZeroes"];
        $dbh = $pEnv["dbh"];
        $userId = $pEnv["userId"];
        $Cn = $pEnv["Cn"];
        $Cu = $pEnv["Cu"];
        $disallowMultipleAccounts = $pEnv["disallowMultipleAccounts"];

        // If don't allow leading zeroes, strip out the leading zeroes.
        if (!$allowZeroes) {
            $accountnumber = preg_replace('/^0+/', '', trim($accountnumber));
        } else {
            $accountnumber = trim($accountnumber);
        }

        if (preg_match('/\D/', $accountnumber) === 1) {
            throw new exception("Account number must be a number.", 28);
        }
        if ($subaccounts == "") {
            throw new exception("No subaccounts found.", 1);
        }
        $subaccounts = hcu_JsonDecode($subaccounts);
        if (!is_array($subaccounts) || count($subaccounts) == 0) {
            throw new exception("No subaccounts found.", 2);
        }

        // Check if primary user and account record isn't already created.
        // this cose was moveabove the foreach loop to get the isGroupPrimary variable
        // the variable is no used to set the $newsubAccounts permissions based in this variable
        // permissions are set to the value of the isGroupPrimary field.
        $sql = "select u.is_group_primary, ma.accountnumber is null, mar.user_id is null
        from ${Cu}user u
        left join ${Cu}memberacct ma on trim(ma.accountnumber) = '" . prep_save($accountnumber, 12) . "'
        left join ${Cu}memberacctrights mar on u.user_id = mar.user_id and mar.whichright = 'ACCESS'
        and trim(mar.accountnumber) = '" . prep_save($accountnumber, 12) . "'
        where u.user_id = " . prep_save(intval($userId));
        $sth = db_query($sql, $dbh);
        if (!$sth) {
            throw new exception("Primary check query failed.", 8);
        }
        $row = db_fetch_row($sth);
        $isPrimaryUser = trim($row[0]) == "t";
        $createMa = $isPrimaryUser && trim($row[1]) == "t";
        $createAccess = $isPrimaryUser && trim($row[2]) == "t";

        if ($disallowMultipleAccounts) {
            $sql = "select accountnumber, count(*) as count
                from ${Cu}useraccounts
                where user_id = " . prep_save(intval($userId)) . "
                group by accountnumber";
            $sth = db_query($sql, $dbh);
            if (!$sth) {
                throw new exception("Found query failed.", 29);
            }
            $results = db_fetch_all($sth);
            $hasThisAccount = false;
            $hasOtherAccounts = false;
            if ($results !== false) {
                foreach($results as $result) {
                    trim($result["accountnumber"]) == $accountnumber ? $hasThisAccount = $hasThisAccount || $result["count"] > 0
                    : $hasOtherAccounts = $hasOtherAccounts || $result["count"] > 0;
                }
            }

            if ($hasOtherAccounts) {
                throw new exception ("Cannot add multiple accounts.", 30);
            }
        }

        // grab the highest display_order value for current subaccounts
        // this will be used to set the display order for the new/updated
        // subaccounts.
        $sql = "select max(display_order) from {$Cu}useraccounts where user_id = 1";
        $sth = db_query($sql, $dbh);
        if (!$sth) {
            throw new exception("display order query failed.", 9);
        }
        $row = db_fetch_row($sth);
        $displayOrder = intval($row[0]);

        $createRecords = array();
        $memberRecords = array();
        $newSubaccounts = array();
        $kendoid = $latestKendoid;
        foreach($subaccounts as $subaccount) {
            // increment display order to new records
            // only increment if the max is greater than 0
            if ($displayOrder > 0) {
                $displayOrder ++;
            }

            if (!HCU_array_key_exists("recordtype", $subaccount) || !HCU_array_key_exists("accounttype", $subaccount)
                || !HCU_array_key_exists("certnumber", $subaccount)) {
                throw new exception("Missing a required field.", 4);
            }

            if (!in_array($subaccount["recordtype"], array("D", "L", "T", "P"))) {
                throw new exception("Recordtype is unrecognized.", 13);
            }

            $isCrossAccount = in_array($subaccount["recordtype"], array("T", "P"));

            $dontIntRestrictDeposit = HCU_array_key_exists("canIntDeposit", $subaccount) ? $subaccount["canIntDeposit"] : ($isPrimaryUser ? false : true);
            $dontExtRestrictDeposit = HCU_array_key_exists("canExtDeposit", $subaccount) ? $subaccount["canExtDeposit"] : ($isPrimaryUser ? false : true);
            $dontIntRestrictWithdraw = HCU_array_key_exists("canExtWithdraw", $subaccount) ? $subaccount["canIntWithdraw"] : ($isPrimaryUser ? false : true);
            $dontExtRestrictWithdraw = HCU_array_key_exists("canExtWithdraw", $subaccount) ? $subaccount["canExtWithdraw"] : ($isPrimaryUser ? false : true);
            $canIntDeposit = $isPrimaryUser ? $dontIntRestrictDeposit : false;
            $canExtDeposit = $isPrimaryUser ? $dontExtRestrictDeposit : false;
            $canIntWithdraw = $isPrimaryUser ? $dontIntRestrictWithdraw : false;
            $canExtWithdraw = $isPrimaryUser ? $dontExtRestrictWithdraw : false;

            $canView = $isPrimaryUser && !$isCrossAccount;

            // If Loan accounts, do not allow external transfers
            if ($subaccount["recordtype"] == 'L') {
                $canExtWithdraw = false;
                $dontExtRestrictWithdraw = false;
            }

            // default the permissions based on this user is a group primary owner
            $createRecords[] = array(
                "_action" => "create", "user_id" => $userId,
                "accountnumber" => $accountnumber, "accounttype" => $subaccount["accounttype"],
                "certnumber" => intval($subaccount["certnumber"]), "display_name" => "",
                "ext_deposit" => $canExtDeposit, "ext_withdraw" => $canExtWithdraw,
                "int_deposit" => $canIntDeposit, "int_withdraw" => $canIntWithdraw,
                "view_transactions" => $canView, "view_balances" => $canView,
                "recordtype" => $subaccount["recordtype"],
                "display_order" => $displayOrder);

            // Add new sort variables
            $permAccount = "000";
            $permType = 0;
            $strposAt = strpos($subaccount["accounttype"], "@");
            $strposHash = strpos($subaccount["accounttype"], "#");
            if ( $strposAt !== false) {
                $permAccount = substr($subaccount["accounttype"], $strposAt + 1);
                $permType = 1;
            } else if ( $strposHash !== false) {
                $permAccount = substr($subaccount["accounttype"], $strposHash + 1);
                $permType = 2;
            }

            // For adding to the subaccount grid after being added.
            $newSubaccounts[] = array(
                "accountnumber" => $accountnumber,
                "accounttype" => $subaccount["accounttype"],
                "certnumber" => intval($subaccount["certnumber"]),
                "display_name" => "",
                "description" => $subaccount["description"],
                "ext_deposit" => $canExtDeposit,
                "ext_withdraw" => $canExtWithdraw,
                "restrictExtDeposit" => !$dontExtRestrictDeposit,
                "restrictIntDeposit" => !$dontIntRestrictDeposit,
                "int_deposit" => $canIntDeposit,
                "int_withdraw" => $canIntWithdraw,
                "restrictExtWithdraw" => !$dontExtRestrictWithdraw,
                "restrictIntWithdraw" => !$dontIntRestrictWithdraw,
                "view_transactions" => $canView,
                "view_balances" => $canView,
                "restrictViewBalances" => $isCrossAccount,
                "restrictViewTransactions" => $isCrossAccount || !$canView,
                "recordtype" => $subaccount["recordtype"],
                "recordTypeFilter" => in_array($subaccount["recordtype"], array("D", "T")) ? "D" : "L",
                "display_order" => $displayOrder,
                "perm_account_sort" => $permAccount,
                "perm_type_sort" => $permType,
                "kendoid" => $kendoid ++);
        }
        $createRecords = array("useraccounts" => $createRecords);

        $sql = "select email from cuadminusers
            where user_name = '" . prep_save($Cn, 50) . "' and cu = '" . prep_save($Cu, 10) . "'";
        $sth = db_query($sql, $dbh);
        if (!$sth) {
            throw new exception("email query failed.", 5);
        }
        $email = db_fetch_row($sth)[0];

        $context = "admin";
        $script = "userSupportAccessControl.prg";
        $addr = trim($_SERVER["REMOTE_ADDR"]);
        $vars = array("cu" => $Cu);

        $newAccounts = array();

        if (!db_work($dbh, HOMECU_WORK_BEGIN)) {
            throw new exception("begin work query failed!", 10);
        }

        $results = DataUserTableUpdate($dbh, $vars, null, $createRecords, $userId, "UA_ADD", $context, $script,
                                       "A", "User Accounts Add", $Cn, $email, $addr);

        if ($results === false) {
            throw new exception("Adding failed.", 106);
        }

        $dontShowAddNewAccount = $disallowMultipleAccounts && !$hasThisAccount;
        // When one or more subaccounts are added, check to see if this is in a new account.  If it is, remove button.

        // This will only need to be added for the primary user.
        if ($createMa) {
            $memberRecords = array("memberacct" => array(array("_action" => "create", "accountnumber" => $accountnumber, "primary_user" => $userId)));
            $results = DataUserTableUpdate($dbh, $vars, null, $memberRecords, $userId, "UM_ADD",
                                           $context, $script, "A", "User Member Add", $Cn, $email, $addr);
            if ($results === false) {
                throw new exception("Adding failed.", 107);
            }
        }

        if ($createAccess) {
            $official = array("memberacctrights" => array(
                array("_action" => "create", "accountnumber" => $accountnumber, "user_id" => $userId, "whichright" => "ACCESS"),
                array("_action" => "create", "accountnumber" => $accountnumber, "user_id" => $userId, "whichright" => "RDC", "platform" => '["D","A"]'),
                array("_action" => "create", "accountnumber" => $accountnumber, "user_id" => $userId, "whichright" => "BP", "platform" => '["D","A"]'),
                array("_action" => "create", "accountnumber" => $accountnumber, "user_id" => $userId, "whichright" => "ES", "platform" => '["D","A"]')
                ));

            $results = DataUserTableUpdate($dbh, $vars, null, $official, $userId, "ACCESS_ADD", $context, $script,
                                           "A", "Primary User Access Add", $Cn, $email, $addr);
            if ( $results === false) {
                throw new exception("Adding failed.", 109);
            }

            $newAccounts[] = array("accountnumber" => $accountnumber, "access" => true, "bpApp" => true, "bpDsk" => true, "esApp" => true, "esDsk" => true,
                "rdcApp" => true, "rdcDsk" => true);
        }

        if (!db_work($dbh, HOMECU_WORK_COMMIT)) {
            throw new exception("commit query failed.", 111);
        }
    } catch(exception $e) {
        if ($e->getCode() >= 100) {
            db_work($dbh, HOMECU_WORK_ROLLBACK);
        }
        return array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return array("error" => array(), "code" => 0, "newAccounts" => $newAccounts, "newSubaccounts" => $newSubaccounts, "latestKendoid" => $latestKendoid,
    "dontShowAddNewAccount" => $dontShowAddNewAccount);
}

/**
 * function ExpandSettings(&$row, $key)
 * Expands the settings from what is in the database to what is needed for the grid.
 *
 * @param $row -- the row to expand
 * @param $key -- the key to expand
 */
function ExpandSettings(&$row, $key) {
    if ($row[$key] != null) {
        $decoded = hcu_JsonDecode($row[$key]);
        if (!is_array($decoded)) {
            throw new exception("$key not formatted correctly.", 2);
        }

        $row["${key}Dsk"] = in_array("D", $decoded);
        $row["${key}App"] = in_array("A", $decoded);
        unset($row[$key]);
    } else {
        $row["${key}Dsk"] = false;
        $row["${key}App"] = false;
    }

    unset($row[$key]);
}

/**
 * function ReadAccessControl($pEnv)
 * This function reads the access control for the userId.
 *
 * @param $pEnv -- the environment
 *
 * @return $error -- empty array or the first error encountered
 * @return $code -- nonzero if there is an error
 * @return $accountData -- All accounts found that the user has access to
 * @return $subaccountData -- All subaccounts found that the user has access to
 * @return $isPrimary -- whether the user is primary
 * @return $dontShowAddNewAccount -- if true, hide the butto
 */
function ReadAccessControl($pEnv) {
    try {

        $dbh = $pEnv["dbh"];
        $Cu = $pEnv["Cu"];
        $Cn = $pEnv["Cn"];
        $userId = $pEnv["userId"];
        $allowZeroes = $pEnv["allowZeroes"];
        $disallowMultipleAccounts = $pEnv["disallowMultipleAccounts"];

        // Get account list.  HAVE to get that from the primary user.
        $sql = "select mm.accountnumber, pu.user_id from
        (select p.user_id, p.group_id from ${Cu}user p
        inner join ${Cu}user u on p.group_id = u.group_id and p.is_group_primary and u.user_id = " . prep_save(intval($userId)) . " limit 1) as pu
        left join (select distinct trim(accountnumber), user_id from ${Cu}useraccounts) as mm(accountnumber, user_id) on pu.user_id = mm.user_id";

        $sth = db_query($sql, $dbh);

        if (!$sth) {
            throw new exception("Access control list failed.", 3);
        }
        $isPrimary = false;

        $accounts = array();
        $first = true;

        for($i = 0; $row = db_fetch_assoc($sth, $i); $i++) {
            if ($first) {
                $isPrimary = $row["user_id"] == $userId;
                $first = false;
            }
            if (!is_null($row["accountnumber"])) {
                $accountnumber = $row["accountnumber"];
                if (!$allowZeroes) {
                    $accountnumber = preg_replace('/^0+/', '', trim($accountnumber));
                }
                $accounts[] = trim(prep_save($accountnumber, 12));
            }
        }

        $dontShowAddNewAccount = $disallowMultipleAccounts && count($accounts) > 0;

        $accountData = array();
        $newAccountData = array();
        $subaccountData = array();
        if (count($accounts) > 0) {
            // Then once the list of the accounts is retrieved from the primary user, then the rights are retrieved from the actual user.
            $sql = "with rghts as (select trim(accountnumber) as accountnumber, whichright, platform, allowed
                from ${Cu}memberacctrights where user_id = $userId
                and whichright in ('ACCESS', 'RDC', 'BP', 'ES'))
            select ma.accountnumber, access.allowed as access, rdc.platform as rdc, bp.platform as bp,
            es.platform as es from (values ('" . implode("'),('", $accounts) . "')) as ma(accountnumber)
            inner join ${Cu}user u on u.user_id = " . prep_save(intval($userId)) . "
            left join rghts access on ma.accountnumber = trim(access.accountnumber) and access.whichright = 'ACCESS'
            left join rghts rdc on ma.accountnumber = rdc.accountnumber and rdc.whichright = 'RDC'
            left join rghts bp on ma.accountnumber = bp.accountnumber and bp.whichright = 'BP'
            left join rghts es on ma.accountnumber = es.accountnumber and es.whichright = 'ES'";

            $sth = db_query($sql, $dbh);

            if (!$sth) {
                throw new exception("Right query failed.", 1);
            }

            $accounts = array();
            for($i = 0; $row = db_fetch_assoc($sth, $i); $i++) {
                $row["access"] = $row["access"] == "t";
                ExpandSettings($row, "rdc");
                ExpandSettings($row, "bp");
                ExpandSettings($row, "es");
                $accountData[] = $row;
                $accounts[] = trim(prep_save($row["accountnumber"], 12));
            }

            // Then once the list of the accounts is retrieved from the primary user, then the rights for the subaccounts are retrieved from the actual user.
            $subqueryUA = "select accountnumber, display_name, ext_withdraw, display_order, view_balances, trim(accounttype) as accounttype, certnumber,
                           trim(recordtype) as recordtype, view_transactions, int_deposit, int_withdraw, ext_deposit,
                           certnumber || trim(recordtype) || trim(accountnumber) || trim(accounttype) as key,
                           case when position('@' in accounttype) <> 0 then 1
                           when position('#' in accounttype) <> 0 then 2
                           else 0 end as perm_type_sort,
                           case when position('@' in accounttype) <> 0 then split_part(accounttype, '@', 2)
                           when position('#' in accounttype) <> 0 then split_part(accounttype, '#', 2)
                           else '000' end as perm_account_sort
                           from ${Cu}useraccounts
                           where trim(accountnumber) in ('" . implode("','", $accounts) . "') and user_id = $userId and trim(recordtype) in ('D', 'L', 'T', 'P')";

            $subqueryALXB = "select certnumber || 'D' || trim(accountnumber) || trim(accounttype), trim(description),
                             may_deposit, may_withdraw
                             from ${Cu}accountbalance
                             union all
                             select '0' || 'T' || trim(accountnumber) || trim(accounttype) || '#' || trim(tomember) as key,
                             trim(description), true, false
                             from ${Cu}crossaccounts where deposittype <> 'L'
                             union all
                             select '0' || 'L' || trim(accountnumber) || trim(loannumber) as key,
                             trim(description), may_payment, may_addon
                             from ${Cu}loanbalance
                             union all
                             select '0' || 'P' || trim(accountnumber) || trim(accounttype) || '#' || trim(tomember) as key,
                             trim(description), false, false
                             from ${Cu}crossaccounts where deposittype = 'L'";

            $sql = "select ua.*, alxb.description, alxb.key as rec_exists, alxb.allow_deposit, alxb.allow_withdraw
                from ($subqueryUA) as ua
                left join ($subqueryALXB) as alxb(key, description, allow_deposit, allow_withdraw) on ua.key = alxb.key
                order by ua.accountnumber, ua.perm_account_sort, ua.perm_type_sort, ua.display_order";

            $sth = db_query($sql, $dbh);

            if (!$sth) {
                throw new exception("Sub-account query failed.", 2);
            }

            $usedAccounts = array();
            $correctLimit = array(); // If there is a balance record and the permissions are greater than what is in the database, correct it on page load.
            $kendoid = 1;
            for($i = 0; $row = db_fetch_assoc($sth, $i); $i++) {
                $row["kendoid"] = $kendoid++;
                $row["view_balances"] = is_null($row["view_balances"]) ? false : trim($row["view_balances"]) == "t";
                $row["view_transactions"] = is_null($row["view_transactions"]) ? false : trim($row["view_transactions"]) == "t";
                $row["int_deposit"] = is_null($row["int_deposit"]) ? false : trim($row["int_deposit"]) == "t";
                $row["int_withdraw"] = is_null($row["int_withdraw"]) ? false : trim($row["int_withdraw"]) == "t";
                $row["ext_deposit"] = is_null($row["ext_deposit"]) ? false : trim($row["ext_deposit"]) == "t";
                $row["ext_withdraw"] = is_null($row["ext_withdraw"]) ? false : trim($row["ext_withdraw"]) == "t";

                $row["description"] = isset($row["description"]) ? trim($row["description"]) : "";
                $row["display_name"] = isset($row["display_name"]) ? trim($row["display_name"]) : "";
                $row["display_name"] = $row["display_name"] == "" || $row["display_name"] == $row["description"] ? "" : $row["display_name"];
                $row["accountnumber"] = isset($row["accountnumber"]) ? trim($row["accountnumber"]) : "";

                // Set the defaults for the permissions.  Otherwise, it shows as "undefined" in the grid.  "Undefined" in the grid works but this is clearer.
                $row["restrictViewBalances"] = false;
                $row["restrictViewTransactions"] = !$row["view_balances"];
                $row["restrictIntDeposit"] = false;
                $row["restrictExtDeposit"] = false;
                $row["restrictIntWithdraw"] = false;
                $row["restrictExtWithdraw"] = false;

                // If I have "corrections" for the other columns, then probably need them for these columns as well.
                if ($row["restrictViewTransactions"] && $row["view_transactions"]) {
                    $correctLimitRow["view_transactions"] = false;
                    $row["ext_withdraw"] = false;
                }

                if ($row["restrictViewBalances"] && $row["view_balances"]) {
                    $correctLimitRow["view_balances"] = false;
                    $row["view_balances"] = false;
                }

                // If Loan accounts, do not allow external transfers
                if (in_array($row["recordtype"], array("L"))) {
                    $row["restrictExtWithdraw"] = true;
                }

                // If Cross Accounts, only the int_deposit is available, otherwise follow allow_deposit, allow_withdraw.
                // This is outside of the rec_exists for the case when a cross account is added to admin but the user hasn't logged in yet.
                // (Cross account record doesn't exist.)
                // In this case, the restrictions still need to prevent changing.  The only information needed to do this is the recordtype.
                if (in_array($row["recordtype"], array("T", "P"))) {
                    $row["restrictIntDeposit"] = false;
                    $row["restrictExtDeposit"] = true;
                    $row["restrictIntWithdraw"] = true;
                    $row["restrictExtWithdraw"] = true;
                    $row["restrictViewBalances"] = true;
                    $row["restrictViewTransactions"] = true;

                    // View History and View Balances should always be false for Cross Accounts.
                    // If they are found true, then we need to correct the row like it is done for D and L.
                    if ($row["view_balances"]) {
                        $correctLimitRow["view_balances"] = false;
                        $row["view_balances"] = false;
                    }

                    if ($row["view_transactions"]) {
                        $correctLimitRow["view_transactions"] = false;
                        $row["view_transactions"] = false;
                    }
                }

                if (isset($row["rec_exists"])) {
                    if (in_array($row["recordtype"], array("D", "L"))) {
                        $restrictDeposit = !isset($row["allow_deposit"]) ? false : trim($row["allow_deposit"]) != "t";
                        $restrictWithdraw = !isset($row["allow_withdraw"]) ? false : trim($row["allow_withdraw"]) != "t";
                        $row["restrictIntDeposit"] = $restrictDeposit;
                        $row["restrictExtDeposit"] = $restrictDeposit;
                        $row["restrictIntWithdraw"] = $restrictWithdraw;
                        $row["restrictExtWithdraw"] = $restrictWithdraw;
                    }

                    // If Loan accounts, do not allow external transfers
                    if (in_array($row["recordtype"], array("L"))) {
                        $row["restrictExtWithdraw"] = true;
                    }

                    $correctLimitRowA = array("user_id" => $userId, "accountnumber" => $row["accountnumber"], "accounttype" => $row["accounttype"],
                                              "certnumber" => $row["certnumber"], "recordtype" => $row["recordtype"], "_action" => "update");

                    $correctLimitRow = array();
                    if ($row["restrictIntDeposit"] && $row["int_deposit"]) {
                        $correctLimitRow["int_deposit"] = false;
                        $row["int_deposit"] = false;
                    }

                    if ($row["restrictExtDeposit"] && $row["ext_deposit"]) {
                        $correctLimitRow["ext_deposit"] = false;
                        $row["ext_deposit"] = false;
                    }

                    if ($row["restrictIntWithdraw"] && $row["int_withdraw"]) {
                        $correctLimitRow["int_withdraw"] = false;
                        $row["int_withdraw"] = false;
                    }

                    if ($row["restrictExtWithdraw"] && $row["ext_withdraw"]) {
                        $correctLimitRow["ext_withdraw"] = false;
                        $row["ext_withdraw"] = false;
                    }

                    if (count($correctLimitRow) > 0) {
                        $correctLimit[] = array_merge($correctLimitRowA, $correctLimitRow);
                    }
                }


                // Actual grid doesn't (at this time) care if record is a cross account or not.
                $row["recordTypeFilter"] = $row["recordtype"] == "T" ? "D" : ($row["recordtype"] == "P" ? "L" : $row["recordtype"]);

                // Remove unused columns.
                unset($row["rec_exists"]);
                unset($row["key"]);

                $subaccountData[] = $row;

            }

            if (count($correctLimit) > 0) {
                $sql = "select email from cuadminusers where user_name = '" . prep_save($Cn, 50) . "' and cu = '" . prep_save($Cu, 10) . "'";
                $sth = db_query($sql, $dbh);
                if (!$sth) {
                    throw new exception("email query failed.", 4);
                }
                $email = db_fetch_row($sth)[0];

                $context = "admin";
                $script = "userSupportAccessControl.prg";
                $addr = trim($_SERVER["REMOTE_ADDR"]);
                $vars = array("cu" => $Cu);

                $results = DataUserTableUpdate($dbh, $vars, null, array("useraccounts" => $correctLimit), $userId, "USERA_UPD",
                                               $context, $script, "A", "Correct Restrictions", $Cn, $email, $addr);

                if ($results === false) {
                    throw new exception("Correct query failed.", 3);
                }
            }
        }

        $returnArray = array("error" => array(), "code" => 0, "accountData" => $accountData, "subaccountData" => $subaccountData, "isPrimary" => $isPrimary,
                             "latestKendoid" => isset($kendoid) ? $kendoid : 1, "dontShowAddNewAccount" => $dontShowAddNewAccount);
    } catch(exception $e) {
        $returnArray = array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return $returnArray;
}

/**
 * function SaveAccountsAndSubaccounts($pEnv, $accounts, $subaccounts)
 * This will save everything.
 * It was two separate data calls but it turns out that it is hard to coordinate separate data calls.
 *
 * @param $pEnv -- the environment
 * @param $accounts -- the accounts to save (from the grid.  The ones that are changed)
 * @param $subaccounts -- the subaccounts to save (from the grid.  The ones that are changed)
 *
 * @return $error -- an empty array or the first error found
 * @return $code -- nonzero if there is at least one error
 */
function SaveAccountsAndSubaccounts($pEnv, $accounts, $subaccounts) {
    try {
        $dbh = $pEnv["dbh"];
        $Cu = $pEnv["Cu"];
        $Cn = $pEnv["Cn"];
        $userId = $pEnv["userId"];

        $full = array();
        $platforms = array();
        $codes = array();
        $accounts = $accounts == null ? "" : trim($accounts);
        if ($accounts != "" && $accounts != "[]") {
            $accounts = hcu_JsonDecode($accounts);
            if (!is_array($accounts) || count($accounts) == 0) {
                throw new exception("Accounts aren't encoded correctly.", 1);
            }
            foreach($accounts as $account) {
                if (!isset($account["accountnumber"])) {
                    throw new exception("Account requires a number.", 2);
                }
                if (isset($account["access"])) {
                    $sql = "select 'FOUND' from ${Cu}memberacctrights
                            where user_id = " . prep_save(intval($userId)) . " and accountnumber = '" . prep_save($account["accountnumber"], 12) . "'
                            and whichright = 'ACCESS'";
                    $sth = db_query($sql, $dbh);
                    if (!$sth) {
                        throw new exception ("Found SQL failed.", 13);
                    }
                    $action = db_num_rows($sth) > 0 ? "update" : "create";
                    $full[] = array("_action" => $action, "whichright" => "ACCESS", "user_id" => $userId, "accountnumber" => $account["accountnumber"],
                                    "allowed" => $account["access"]);
                }
                ProcessSettings($account, "es",  $platforms, $codes);
                ProcessSettings($account, "rdc", $platforms, $codes);
                ProcessSettings($account, "bp",  $platforms, $codes);
            }

            if (count($codes) > 0) {
                $sql = "select v.code, v.accountnumber, mar.user_id as exists
                        from  (values " . implode(",", $codes) . ") as v (code, accountnumber)
                        left join ${Cu}memberacctrights mar on v.code = mar.whichright
                        and v.accountnumber = mar.accountnumber and mar.user_id = " . prep_save(intval($userId));
                $sth = db_query($sql, $dbh);
                if (!$sth) {
                    throw new exception("Verify SQL failed.", 3);
                }

                for($i = 0; $row = db_fetch_assoc($sth, $i); $i++) {
                    $exists = $row["exists"] != null && trim($row["exists"]) != "";
                    $accountnumber = $row["accountnumber"] == null ? "" : trim($row["accountnumber"]);
                    $code = $row["code"] == null ? "" : trim($row["code"]);
                    $platform = $platforms[$accountnumber][$code];
                    $record = array("whichright" => $code, "user_id" => $userId, "accountnumber" => $accountnumber, "platform" => HCU_JsonEncode($platform));
                    if (!$exists) {
                        if (count($platform) > 0) {
                            $record["_action"] = "create";
                            $full[] = $record;
                        }
                    } else {
                        if (count($platform) == 0) {
                            $record["_action"] = "delete";
                            unset($record["platform"]);
                            $full[] = $record;
                        } else {
                            $record["_action"] = "update";
                            $full[] = $record;
                        }
                    }
                }
            }
        }

        $subUpdates = array();
        $subaccounts = is_null($subaccounts) ? "" : trim($subaccounts);
        if ($subaccounts != "" && $subaccounts != "[]") {
            $subaccounts = hcu_JsonDecode($subaccounts);
            if (!is_array($subaccounts) || count($subaccounts) == 0) {
                throw new exception("Sub-account not formed correctly.", 8);
            }
            foreach($subaccounts as $row) {
                if (!isset($row["accounttype"]) || !isset($row["certnumber"]) || !isset($row["recordtype"]) || !isset($row["accountnumber"])) {
                    throw new exception("Sub-account not formed correctly.", 9);
                }
                $row["_action"] = "update";
                $row["user_id"] = $userId;
                $subUpdates[] = $row;
            }
        }

        if (count($full) > 0 || count($subUpdates) > 0) {
            $sql = "select email from cuadminusers where user_name = '" . prep_save($Cn, 50) . "' and cu = '" . prep_save($Cu, 10) . "'";
            $sth = db_query($sql, $dbh);
            if (!$sth) {
                throw new exception("email query failed.", 4);
            }
            $email = db_fetch_row($sth)[0];

            $context = "admin";
            $script = "userSupportAccessControl.prg";
            $addr = trim($_SERVER["REMOTE_ADDR"]);
            $vars = array("cu" => $Cu);

            if (!db_work($dbh, HOMECU_WORK_BEGIN)) {
                throw new exception("Work begin query failed.", 12);
            }

            if (count($full) > 0) {
                $official = array("memberacctrights" => $full);
                $results = DataUserTableUpdate($dbh, $vars, null, $official, $userId, "MAR_CHG", $context, $script,
                                               "A", "Member Account Rights Change", $Cn, $email, $addr);
                if ( $results === false) {
                    throw new exception("change failed.", 107);
                }
            }

            if (count($subUpdates) > 0) {
                $official = array("useraccounts" => $subUpdates);

                $results = DataUserTableUpdate($dbh, $vars, null, $official, $userId, "UA_UPDATE", $context, $script,
                                               "A", "User Accounts Update", $Cn, $email, $addr);
                if ( $results === false) {
                    throw new exception("Sub Updating failed.", 110);
                }
            }

            if (!db_work($dbh, HOMECU_WORK_COMMIT)) {
                throw new exception("Work commit query failed.", 112);
            }
        }
    } catch(exception $e) {
        if ($e->getCode() >= 100) {
            db_work($dbh, HOMECU_WORK_ROLLBACK);
        }
        return array("error" => array($e->getMessage()), "code" => $e->getCode());
    }
    return array("error" => array(), "code" => 0);
}

/**
 * function processSettings($account, $setting, &$platforms, &$codes)
 * Convert grid values to what is in the database
 *
 * @param $account -- the account to process
 * @param $setting -- the control
 * @param $platforms -- build this array of "D", "A" per account and control.
 * @param $codes -- build this array for checking the database for existence.
 */
function ProcessSettings($account, $setting, &$platforms, &$codes) {
    $setting = trim($setting);
    if (HCU_array_key_exists("${setting}Dsk", $account) && HCU_array_key_exists("${setting}App", $account)) {
        $platform = array();
        $account["${setting}Dsk"] && $platform[] = "D";
        $account["${setting}App"] && $platform[] = "A";

        $code = strtoupper($setting);
        $accountnumber = trim($account["accountnumber"]);
        if (!isset($platforms[$accountnumber])) {
            $platforms[$accountnumber] = array();
        }
        $platforms[$accountnumber][$code] = $platform;
        $codes[] = "('$code', '" . prep_save($accountnumber, 12) . "')";
    }
}