permissions.i

<?php

/*
 * File containing functions to help validate permissions. Permissions are both the ability to see/use
 * a given feature, as well as if the user has reached a certain limit. Limits can be a total, monthly,
 * daily amount or count.
 *
 *
 *
 * There are three entry points:
 *    1. Get the access rights for the user - Perm_AccessRights,
 *    2. Get the limit amounts (in case wanting Transaction limit on client) - Perm_GetValidationAmounts,
 *    3. With the current operation will the user surpass the limit - Perm_CheckLimits.
 *
 * NOTE: $permInputs are included in all entry points to provide a variable list of
 *        function-dependant parameters.
 *    ["feature"] - (required) the feature permission being accessed
 *    ["amount"] - The amount for the current function being checked
 *    ["account"] - The account being used in the current function being checked
 *
 * NOTE: UserId is included in the environment
 *
 */

// permission types (aka feature codes)
define( "FEATURE_ALERTS", "ALERT" );
define( "FEATURE_BASIC", "BASIC" );
define( "FEATURE_BILLPAY", "BILLPAY" );
define( "FEATURE_MOBILE_BILLPAY", "MBILLPAY" );
define( "FEATURE_MOBILE_RDC", "MRDC" );
define( "FEATURE_ONLINE_LOAN_APP", "ONLINEAPP" );
define( "FEATURE_PFM", "PFM" );
define( "FEATURE_RDC", "RDC" );
define( "FEATURE_SECURE_MSG", "SECUREMSG" );
define( "FEATURE_SMS", "SMS" );
define( "FEATURE_STOP", "STOP" );
define( "FEATURE_DOWNLOAD_HISTORY", "TRNDOWN" );
define( "FEATURE_EXTERNAL_TRANSFERS", "TRNEXT" );
define( "FEATURE_WIRE_TRANSFERS", "TRNWIRE" );
define( "FEATURE_M2M_TRANSFERS", "TRNM2M" );

define( "FEATURE_TRANSFERS", "TRN" );
define( "FEATURE_SCHEDULED_TRANSFERS", "TRNSCHED" );
define( "FEATURE_ESTATEMENTS", "ESTMT" );
define( "FEATURE_ACH_PAYMENTS", "ACHPMT" );
define( "FEATURE_ACH_COLLECTIONS", "ACHCOL" );
define( "FEATURE_PAYROLL", "ACHPYRL" );

// Error codes, for easier lookup
// ** USER ERRORS
define( "PERM_ERROR_AMOUNT_EXCEED_TRANSACTION",  1200 );
define( "PERM_ERROR_AMOUNT_EXCEED_DAILY",        1201 );
define( "PERM_ERROR_AMOUNT_EXCEED_ACCT_PER_DAY", 1202 );
define( "PERM_ERROR_AMOUNT_EXCEED_MONTHLY",      1203 );
define( "PERM_ERROR_COUNT_EXCEED_DAILY",         1204 );
define( "PERM_ERROR_COUNT_EXCEED_ACCT_PER_DAY",  1205 );
define( "PERM_ERROR_COUNT_EXCEED_MONTHLY",       1206 );
define( "PERM_ERROR_ALERT_EXCEED_LIMIT",         1207 );

// ** GROUP PERM ERRORS
define( "PERM_ERROR_GROUP_AMOUNT_EXCEED_TRANSACTION",  1208 );
define( "PERM_ERROR_GROUP_AMOUNT_EXCEED_DAILY",        1209 );
define( "PERM_ERROR_GROUP_AMOUNT_EXCEED_ACCT_PER_DAY", 1210 );
define( "PERM_ERROR_GROUP_AMOUNT_EXCEED_MONTHLY",      1211 );
define( "PERM_ERROR_GROUP_COUNT_EXCEED_DAILY",         1212 );
define( "PERM_ERROR_GROUP_COUNT_EXCEED_ACCT_PER_DAY",  1213 );
define( "PERM_ERROR_GROUP_COUNT_EXCEED_MONTHLY",       1214 );

define( "PERM_ERROR_GETTING_LIMITS",             1250 );
define( "PERM_ERROR_COUNTING_ALERTS",            1251 );


/**
 * Get the access rights. Return all the rights in case the caller needs to use them in
 * several places.
 *
 * @param integer $pDbh           -- Current database handle
 * @param array $pHBEnv           -- Current HB_ENV values
 * @param array $permInputs       -- An array with information specific to the given perm
 *                                --  feature
 * @return The access rights for the user.
 */
function Perm_AccessRights( $pDbh, $pHBEnv, $pPermInputs ) {
  try {
    $rights = privPermGetFeatureRights( $pDbh, $pHBEnv, $pPermInputs["feature"] );
  } catch (Exception $ex) {
    $logInfo = array( "message" => $ex->getMessage(), "code" => $ex->getCode() );

    $rights = false;
  }

  return $rights;
} // end Perm_AccessAllowed


/**
 *  Does the user have ACCESS to the member account?
 *
 *  This is identified by the looking in the <client>memberacctrights table for the user and member account
 *
 *  @param integer $pDbh    -- Current database handle
 *  @param array $pHBEnv    -- Current Environment Array
 *  @param integer $pUserId -- User Id
 *  @param string $pMbrAcct -- Account number we are looking for
 *
 *  @return boolean         -- Does the user have ACCESS rights to the specified member account
 */
function Perm_MemberAccess($pDbh, $pHBEnv, $pUserId, $pMbrAcct) {

  $retVal = false;

  try {

    // * Query the memberacctrights for the user's ACCESS ability
    $SQL = "SELECT allowed
            FROM " . prep_save($pHBEnv['Cu'], 10) . "memberacctrights as mar
            WHERE user_id = " . intval($pUserId) . "
              AND accountnumber = '" . prep_save($pMbrAcct, 12) . "'
              AND whichright = 'ACCESS' ";

    $accessRS = db_query( $SQL, $pDbh );
    $accessRow = db_fetch_assoc( $accessRS);

    if (HCU_array_key_exists('allowed', $accessRow)) {
      $retVal = ($accessRow['allowed'] === 't');
    }

  } catch (Exception $ex) {
    $retVal = false;
  }


  return $retVal;
}


/**
 * Check if confirmation is required for the given feature.
 *
 * @param integer $pDbh           -- Current database handle
 * @param array $pHBEnv           -- Current HB_ENV values
 * @param array $permInputs       -- An array with information specific to the given perm
 *                                                         feature
 * @return The confirmation required limitation for the user.
 */
function Perm_CheckConfirmReq( $pDbh, $pHBEnv, $pPermInputs ) {
  try {
    $required = privPermCheckConfirmReq( $pDbh, $pHBEnv, $pPermInputs["feature"] );
  } catch (Exception $ex) {
    $logInfo = array( "message" => $ex->getMessage(), "code" => $ex->getCode() );

    $required = false;
  }

  return $required;
} // end Perm_AccessAllowed


/**
 * Check if the user has reached the limit amount for the given feature.
 *
 * @param integer $pDbh           -- Current database handle
 * @param array $pHBEnv           -- Current HB_ENV values
 * @param array $permInputs       -- An array with information specific to the given perm
 *                                --  feature, amount, account, accounttype
 * @return  True if under the limit; structure with error information if error or over limit.
 */
function Perm_CheckLimits( $pDbh, $pHBEnv, $pPermInputs ) {

  try {
    $feature = $pPermInputs["feature"];

    $amounts = privPermGetAllowedLimits( $pDbh, $pHBEnv, $feature );
    if ( $amounts === false ) {
      // something failed
      throw new exception("Error getting allowed limits", PERM_ERROR_GETTING_LIMITS);
    }

    // these all use the transaction table
    /** **************
     * USER LIMITS
     */

    // handle the transaction limit special
    if ( $pPermInputs["amount"] > $amounts["amount_per_transaction"] ) {
      throw new exception("Exceeds amount per transaction limit", PERM_ERROR_AMOUNT_EXCEED_TRANSACTION);
    }

    // get the historical amounts for current user
    $currentAmounts = privPermGetCurrentActivity( $pDbh, $pHBEnv, $feature );

    // need to test all limits
    // amount_per_day
    if ( ($currentAmounts["amount"]["day"] + $pPermInputs["amount"]) > $amounts["amount_per_day"] ) {
      throw new exception("Exceeds daily amount", PERM_ERROR_AMOUNT_EXCEED_DAILY);
    }

    // amount_per_account_per_day
    $accountNumber = trim( $pPermInputs["account"] );
    $accountType = trim( $pPermInputs["accounttype"] );

    $accountAmount = isset( $currentAmounts["amount"]["account"]["$accountNumber|$accountType"] ) ? $currentAmounts["amount"]["account"]["$accountNumber|$accountType"] : 0;
    if ( ($accountAmount + $pPermInputs["amount"]) > $amounts["amount_per_account_per_day"] ) {
      throw new exception("Exceeds daily amount for selected account", PERM_ERROR_AMOUNT_EXCEED_ACCT_PER_DAY);
    }

    // amount_per_month
    if ( ($currentAmounts["amount"]["month"] + $pPermInputs["amount"]) > $amounts["amount_per_month"] ) {
      throw new exception("Exceeds monthly amount", PERM_ERROR_AMOUNT_EXCEED_MONTHLY);
    }

    // count_per_day
    if ( $currentAmounts["count"]["day"] >= $amounts["count_per_day"] ) {
      throw new exception("Exceeds daily count", PERM_ERROR_COUNT_EXCEED_DAILY);
    }

    // count_per_account_per_day
    $countAmount = isset( $currentAmounts["count"]["account"]["$accountNumber|$accountType"] ) ? $currentAmounts["count"]["account"]["$accountNumber|$accountType"] : 0;
    if ( $countAmount >= $amounts["count_per_account_per_day"] ) {
      throw new exception("Exceeds daily count for selected account", PERM_ERROR_COUNT_EXCEED_ACCT_PER_DAY);
    }

    // count_per_month
    if ( $currentAmounts["count"]["month"] >= $amounts["count_per_month"] ) {
      throw new exception("Exceeds monthly count", PERM_ERROR_COUNT_EXCEED_MONTHLY);
    }

    /** **************
     * EVALUATE GROUP LIMITS
     * ************** */

    /**
     *  Rules:
     *
     *  Only evaluate the group limits, if there is more than 1 user in group
     *      This is because the user limits will have already been the most stringent policies
     *
     *  ONLY evaluatge an item if the allowed value is LESS than the DEFAULT MAX AMOUNT
     *
     *
     */
    $groupUserCount = privGetGroupUserCount($pDbh, $pHBEnv, array("Uid" => $pHBEnv['Uid']));
    /* MORE THAN ONE USER IN GROUP ? */
    if ($groupUserCount > 1) {
      /** GET GROUP LIMITS */
      $groupLimits = HCU_array_key_value("group", $amounts);

      /** GET GROUP ACTIVITY **/
      $groupActivityAmounts = privPermGetCurrentActivity( $pDbh, $pHBEnv, $feature, "GROUP" );


      /** EVALUATE GROUP AMOUNT / DAY **/
      if ( ($groupActivityAmounts["amount"]["day"] + $pPermInputs["amount"]) > floatval(HCU_array_key_value("amount_per_day", $groupLimits)) ) {
        throw new exception("Exceeds daily group amount", PERM_ERROR_GROUP_AMOUNT_EXCEED_DAILY);
      }

      /** EVALUATE GROUP AMOUNT / ACCT / DAY **/
      $accountAmount = floatval(HCU_array_key_value("$accountNumber|$accountType", $groupActivityAmounts["amount"]["account"]));
      if ( ($accountAmount + $pPermInputs["amount"]) > floatval(HCU_array_key_value("amount_per_account_per_day", $groupLimits)) ) {
        throw new exception("Exceeds daily group amount for selected account", PERM_ERROR_GROUP_AMOUNT_EXCEED_ACCT_PER_DAY);
      }

      /** EVALUATE GROUP AMOUNT / MONTH **/
      if ( ($groupActivityAmounts["amount"]["month"] + $pPermInputs["amount"]) > floatval(HCU_array_key_value("amount_per_month", $groupLimits)) ) {
        throw new exception("Exceeds monthly group amount", PERM_ERROR_GROUP_AMOUNT_EXCEED_MONTHLY);
      }
      /** EVALUATE GROUP COUNT / DAY **/
      if ( $groupActivityAmounts["count"]["day"] >= intval(HCU_array_key_value("count_per_day", $groupLimits)) ) {
        throw new exception("Exceeds daily group count", PERM_ERROR_GROUP_COUNT_EXCEED_DAILY);
      }

      /** EVALUATE GROUP COUNT / ACCT / Day **/
      $countAmount = intval(HCU_array_key_value("$accountNumber|$accountType", $groupActivityAmounts["count"]["account"]));
      if ( $countAmount >= intval(HCU_array_key_value("count_per_account_per_day", $groupLimits)) ) {
        throw new exception("Exceeds daily group count for selected account", PERM_ERROR_GROUP_COUNT_EXCEED_ACCT_PER_DAY);
      }

      /** EVALUATE GROUP COUNT / MONTH **/
      if ( $groupActivityAmounts["count"]["month"] >= intval(HCU_array_key_value("count_per_month", $groupLimits)) ) {
        throw new exception("Exceeds monthly group count", PERM_ERROR_GROUP_COUNT_EXCEED_MONTHLY);
      }

    }   // ** END GROUP LIMITS CHECK
    // yay!
    $success = array();
    $success["status"]["code"] = "000";
  } catch (Exception $ex) {
    // log the error
    $logInfo = array( "message" => $ex->getMessage(), "code" => $ex->getCode() );

    // return the error
    $success = array();
    $success["status"]["code"] = $ex->getCode();
    $success["status"]["severity"] = "ERROR";
    $success["status"]["error"] = $ex->getMessage();
  }

  return $success;
} // end Perm_CheckLimits

/**
 * Get the allowed amount(s) so the caller can validate on client. Usually just the
 *  transaction amount is desired.
 *
 * @param integer $pDbh           -- Current database handle
 * @param array $pHBEnv           -- Current HB_ENV values
 * @param array $permInputs       -- An array with information specific to the given perm
 *                                --  feature
 * @param array $pAmounts         -- returns an array with the amounts in it
 * @return  True if successful; false if not.
 */
function Perm_GetValidationLimits( $pDbh, $pHBEnv, $pPermInputs ) {
  try {
    $amounts = privPermGetAllowedLimits( $pDbh, $pHBEnv, $pPermInputs["feature"] );
  } catch (Exception $ex) {
    $logInfo = array( "message" => $ex->getMessage(), "code" => $ex->getCode() );

    $amounts = false;
  }

  return $amounts;
} // end Perm_GetValidationAmounts

/**
 * Get ALL Feature Access rights for the user (uid) in question
 *
 * @param integer   $pDbh       -- Current database handle
 * @param array     $pHBEnv     -- Current HB_ENV Values
 * @param array     $permInputs -- Permission input values
 *                                  Uid -- User in question (optional - defaults to HB_ENV['Uid'])
 * @return array
 *                  status -
 *                       code - {000 (pass), 999 (fail)}
 *                  data - this is the data structure of a valid list.  it should be broken out as such
 *                          [feature_code][create]
 *                                        [access] -- (NOT YET IMPLEMENTED IN DB)
 *                                        [confirm]
 *                                        [decline]
 *                                        [report]
 */
function Perm_FeatureAccessList($pDbh, $pHBEnv, $permInputs=null) {

  $retVal = Array("status" => Array("code"=>"000", "error"=>""), "data"=>Array());

  try {
    // ** Validate the userid is being passed in successfully

    if (is_null($permInputs) || !HCU_array_key_exists('Uid', $permInputs)) {
      // *Default to the HB_ENV Uid
      $userId = $pHBEnv["Uid"];
    } else {
      $userId = HCU_array_key_value("Uid", $permInputs);
    }


    if (intval($userId) > 0) {
      $modList = Array("Uid" => $userId);

      $userAccessList = privPermGetAllFeatureRights($pDbh, $pHBEnv, $modList);
      if ($userAccessList['status']['code'] != '000') {
        // ** throw an error - problem retrieving data
        throw new Exception ("Unable to retrieve access list");
      }

      if (!HCU_array_key_exists("data", $userAccessList)) {
        throw new Exception ("Unable to retrieve access list");
      }

      // ** We have a good list -- RETURN as ['data']
      $retVal['data'] = $userAccessList['data'];
    } else {
      // ** Throw up an error - the userId was NOT correct
      throw new Exception("Invalid User Id");
    }


  } catch (Exception $ex) {
    $retVal['status']['code'] = '999';
    $retVal['status']['error'] = $ex->getMessage();
    $retVal['data'] = Array();  // ** Clear data array

  }

  return $retVal;
}// end Perm_FeatureAccessList


/**
 *  Get the Permission Error Description related to the error Code
 *
 * @param class  $pMc          - The localization Language class
 * @param string $pPermErrCode - The Permission Error Code, these are defined at top of this script
 *                              - if not present then it will return default "perm" limit error
 * @param integer $pDispFor    - The constant used by $pMc for displaying the value
 *                                default - HCU_DISPLAY_AS_HTML
 *
 * @return string              - Localication Error
 */
function Perm_GetLimitErrDesc($pMc, $pPermErrCode='', $pDispFor=HCU_DISPLAY_AS_HTML) {

  $retStr = $pMc->msg('Perm Limit - Request over authorized limit', $pDispFor);

  switch ($pPermErrCode) {
// Error codes, for easier lookup
    /** START USER LIMIT ERRORS **/
    case 1200:
      /** "PERM_ERROR_AMOUNT_EXCEED_TRANSACTION" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Transaction', $pDispFor);
      break;
    case 1201:
      /** "PERM_ERROR_AMOUNT_EXCEED_DAILY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Daily', $pDispFor);
      break;
    case 1202:
      /** "PERM_ERROR_AMOUNT_EXCEED_ACCT_PER_DAY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Account Per Day', $pDispFor);
      break;
    case 1203:
      /** "PERM_ERROR_AMOUNT_EXCEED_MONTHLY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Monthly', $pDispFor);
      break;
    case 1204:
      /** "PERM_ERROR_COUNT_EXCEED_DAILY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Daily', $pDispFor);
      break;
    case 1205:
      /** "PERM_ERROR_COUNT_EXCEED_ACCT_PER_DAY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Account Per Day', $pDispFor);
      break;
    case 1206:
      /** "PERM_ERROR_COUNT_EXCEED_MONTHLY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Monthly', $pDispFor);
      break;
    case 1207:
      /** "PERM_ERROR_ALERT_EXCEED_LIMIT" **/
      $retStr = $pMc->msg('Perm Limit - Exceeds Alert Limit', $pDispFor);
      break;
    /** END USER LIMIT ERRORS **/



    /** START GROUP LIMIT ERRORS **/
    case 1208:
      /** "PERM_ERROR_GROUP_AMOUNT_EXCEED_TRANSACTION" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Group Transaction', $pDispFor);
      break;
    case 1209:
      /** "PERM_ERROR_GROUP_AMOUNT_EXCEED_DAILY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Group Daily', $pDispFor);
      break;
    case 1210:
      /** "PERM_ERROR_GROUP_AMOUNT_EXCEED_ACCT_PER_DAY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Group Account Per Day', $pDispFor);
      break;
    case 1211:
      /** "PERM_ERROR_GROUP_AMOUNT_EXCEED_MONTHLY" **/
      $retStr = $pMc->msg('Perm Limit - Amount Exceeds Group Monthly', $pDispFor);
      break;
    case 1212:
      /** "PERM_ERROR_GROUP_COUNT_EXCEED_DAILY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Group Daily', $pDispFor);
      break;
    case 1213:
      /** "PERM_ERROR_GROUP_COUNT_EXCEED_ACCT_PER_DAY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Group Account Per Day', $pDispFor);
      break;
    case 1214:
      /** "PERM_ERROR_GROUP_COUNT_EXCEED_MONTHLY" **/
      $retStr = $pMc->msg('Perm Limit - Count Exceeds Group Monthly', $pDispFor);
      break;

    /** END GROUP LIMIT ERRORS **/

    case 1250:
      /** "PERM_ERROR_GETTING_LIMITS" **/
      $retStr = $pMc->msg('Perm Limit - Error Getting Limits', $pDispFor);
      break;
    case 1251:
      /** "PERM_ERROR_COUNTING_ALERTS" **/
      $retStr = $pMc->msg('Perm Limit - Error Getting Alerts', $pDispFor);
      break;
  }

  return $retStr;
}
/**
 * Get ALL Feature Access rights FROM the db for the user (uid) in question
 *   and set as needed
 *
 * @param integer   $pDbh       -- Current database handle
 * @param array     $pHBEnv     -- Current HB_ENV Values
 * @param array     $permInputs -- Permission input values
 *                                  Uid -- User in question
 * @return array
 *                  status -
 *                       code - {000 (pass), 999 (fail)}
 *                  data - this is the data structure of a valid list.  it should be broken out as such
 *                  for each [uid]
 *                               [feature_code][create]
 *                                             [access] -- (NOT YET IMPLEMENTED IN DB)
 *                                             [confirm]
 *                                             [decline]
 *                                             [report]
 */
function privPermGetAllFeatureRights($pDbh, $pHBEnv, $permInputs) {
  $retVal = Array("status"=>Array("code"=>"000", "error"=>""), "data"=>Array());

  $retData = Array();
  try {

    if (HCU_array_key_exists('Uid', $permInputs)) {
      $lUid = intval(HCU_array_key_value('Uid', $permInputs));
    } else {
      throw new Exception("Invalid User");
    }
    /*
     *  ***
     *  What I'm trying to do:::
     *  This list needs to include ALL features in a particular user rights inheritance
     *    At the top there is the cu_profilerights  - All users are under a profile which joins a profile with features
     *    Next is the cu_profile                    - This is joined to ensure we are looking at profile list for the desired CU
     *    Next is the <cucode>group                 - By default a group will have access to all features in a group -- There limits may be different
     *    Next is the <cucode>user                  - This is used only a joining mechanism between a group and userrights
     *    Last is the <cucode>userrights            - This is the table I am looking for -  If a value is explicitly set to false, then maintain that value
     *                                                                                   - If a value is null on account of the record not existing then this is also true
     *
     */

    $SQL = "SELECT cu_u.user_id,
                   cu_pr.feature_code,
                   deny_create as create,
                   deny_access as access,
                   deny_confirm as confirm,
                   deny_decline as decline,
                   deny_report as report
            FROM cu_profilerights cu_pr
            JOIN cu_profile as cu_p on cu_p.profile_id = cu_pr.profile_id
            LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "group as cu_g on cu_g.profile_id = cu_pr.profile_id
            LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "user as cu_u on cu_u.group_id = cu_g.group_id
            LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "userrights as cu_ur on cu_ur.user_id = cu_u.user_id
                                                          AND cu_ur.feature_code = cu_pr.feature_code
            WHERE cu_p.cu = '" . prep_save($pHBEnv['Cu'], 10) . "'
              AND cu_u.user_id = {$lUid}
            ORDER BY cu_u.user_id, cu_pr.feature_code; ";


    $accessRS = db_query( $SQL, $pDbh );
    $accessRows = db_fetch_all( $accessRS);
    // ** ALL rows are returned -- Loop through them and create the returned data array
    for ($idx = 0; $idx < count($accessRows); $idx++) {
      // *** Single out the row
      $accessRow = $accessRows[$idx];
      /*
       *  When the deny_* fields are true, this is the ONLY time the user has NO access
       *  Therefore I am negating the value to determine if they have permission
       */

    $access= !($accessRow["access"] === 't');
    $fromAdmin= isset( $pHBEnv["Ca"] ) && ($pHBEnv["Ca"] != "");
    $retData[trim($accessRow['feature_code'])] = array( "access" => $access,
                     "create" => $fromAdmin ? false : !($accessRow["create"] === 't'),
                     "confirm" => !($accessRow["confirm"] === 't'),
                     "decline" => !($accessRow["decline"] === 't'),
                     "report" => !($accessRow["report"] === 't'),
                     "readonly" => $fromAdmin && $access);

    }
    $retVal['data'] = Array(intval($pHBEnv['Uid']) => $retData);

  } catch (Exception $ex) {
    // ** Error found -- throw back .
    $retVal['status']['code'] = '999';
    $retVal['status']['error'] = $ex->getMessage();
    $retVal['data'] = Array();
  }



  return $retVal;
}

// Check if the user can access this feature.
// NOTE: the feature_create right is also being used for access rights.
// NOTE: implied right is TRUE
/*
 * Removed use of COALESCE -- because false/null both mean the feature is allowed I will simply make comparisons against the value 't'
 */
function privPermGetFeatureRights( $pDbh, $pHBEnv, $pFeature ) {

  try {
    $SQL = "
      SELECT
        deny_create AS create,
        deny_access AS access,
        deny_confirm AS confirm,
        deny_decline AS decline,
        deny_report AS report
      FROM cu_profilerights cu_pr
        JOIN cu_profile cu_p ON cu_p.profile_id = cu_pr.profile_id
        LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "group as cu_g on cu_g.profile_id = cu_pr.profile_id
        LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "user as cu_u on cu_u.group_id = cu_g.group_id
        LEFT JOIN " . prep_save($pHBEnv['Cu'], 10) . "userrights as cu_ur on cu_ur.user_id = cu_u.user_id
          AND cu_ur.feature_code = cu_pr.feature_code
      WHERE cu_p.cu = '" . prep_save($pHBEnv['Cu'], 10) . "'
        AND cu_u.user_id = {$pHBEnv["Uid"]}
        AND cu_pr.feature_code = '{$pFeature}'
      ORDER BY cu_u.user_id, cu_pr.feature_code;";

    $accessRS = db_query( $SQL, $pDbh );
    $accessRows = db_num_rows($accessRS);
    if ($accessRows > 0) {
      $accessRow = db_fetch_array( $accessRS, 0 );

      // for now "access" uses the "create" flag
      $access= !($accessRow["access"] === 't');
      $fromAdmin= HCU_array_key_value('Ca', $pHBEnv) != "";
      $return = array(
        "access" => $access,
        "create" => $fromAdmin ? false : !($accessRow["create"] === 't'),
        "confirm" => !($accessRow["confirm"] === 't'),
        "decline" => !($accessRow["decline"] === 't'),
        "report" => !($accessRow["report"] === 't'),
        "readonly" => $fromAdmin && $access);
    } else {
      $return = array(
        "access" => false,
        "create" => false,
        "confirm" => false,
        "decline" => false,
        "report" => false,
        "readonly" => false
      );
    }
  } catch (Exception $ex) {
    $return = false;
  }

  return ($return);
} // end privPermGetFeatureRights


// Get the total activity (OUTGOING) for the given month. Then go through and get the breakdown.
// NOTE: just want out-going but since it is broken down by feature it is only called for outgoing.
/**
 *
 *
 *  @param string $pType - Defaults to USER. Other option is GROUP
 *                            This will determine if we are getting the activity for specific user or group
 *
 *  return array
 */
function privPermGetCurrentActivity( $pDbh, $pHBEnv, $pFeature, $pType="USER") {

  /* **
   *   MWS 9/26/2018
   *   NOTE: for TRNEXT the micro deposit gets included as part of the overall count / amount for the
   *         daily and monthly totals.  It does not count towards the account/day because the aggregate
   *         key is [|].  At this time we are looking at fixing this possible discrepancy.  
   */

  try {
    $lUid = intval(HCU_array_key_value("Uid", $pHBEnv));
    // NOTE: postgres uses yyyy-mm-dd for the dates, and that is in sort order
    // set the date range for the month for easy comparison
    $firstOfMonth = date( "Y-m-01" );
    $firstOfNextMonth = date( "Y-m-d", strtotime( "first day of next month" ) );

    if ($pType == 'GROUP') {
      $SQL = "
        WITH dtl AS (
          SELECT transhdr_id, sum(amount) AS amount,
            min(transdata::json->>'acct_source') AS acct_source,
            min(transdata::json->>'acct_dest') AS acct_dest
          FROM {$pHBEnv["Cu"]}transdtl GROUP BY 1
        )
        SELECT
          date(hdr.posted_date) AS date, dtl.amount,
          CASE WHEN LEFT(hdr.transactioncode, 1) = '2' THEN split_part(dtl.acct_dest, '|', 2) ELSE split_part(dtl.acct_source, '|', 2) END AS accountnumber,
          CASE WHEN LEFT(hdr.transactioncode, 1) = '2' THEN split_part(dtl.acct_dest, '|', 3) ELSE split_part(dtl.acct_source, '|', 3) END AS accounttype
        FROM {$pHBEnv["Cu"]}transhdr AS hdr
        INNER JOIN dtl ON hdr.id = dtl.transhdr_id
        JOIN {$pHBEnv["Cu"]}user AS cur_user ON cur_user.user_id = {$lUid}
        JOIN {$pHBEnv["Cu"]}user AS group_user ON group_user.group_id = cur_user.group_id
        WHERE hdr.posted_by = group_user.user_id
          AND hdr.feature_code = '$pFeature'
          AND posted_date >= '$firstOfMonth'
          AND posted_date < '$firstOfNextMonth' ";
    } else {
      $SQL = "
        WITH dtl AS (
          SELECT transhdr_id, sum(amount) AS amount,
            min(transdata::json->>'acct_source') AS acct_source,
            min(transdata::json->>'acct_dest') AS acct_dest from {$pHBEnv["Cu"]}transdtl
          GROUP BY 1
        )
        SELECT
          date(hdr.posted_date) AS date, dtl.amount,
          CASE WHEN LEFT(hdr.transactioncode, 1) = '2' THEN split_part(dtl.acct_dest, '|', 2) ELSE split_part(dtl.acct_source, '|', 2) END AS accountnumber,
          CASE WHEN LEFT(hdr.transactioncode, 1) = '2' THEN split_part(dtl.acct_dest, '|', 3) ELSE split_part(dtl.acct_source, '|', 3) END AS accounttype
        FROM {$pHBEnv["Cu"]}transhdr hdr
        INNER JOIN dtl ON hdr.id = dtl.transhdr_id
        WHERE hdr.posted_by = {$lUid}
          AND hdr.feature_code = '$pFeature'
          AND posted_date >= '$firstOfMonth'
          AND posted_date < '$firstOfNextMonth' ";
    }

    $rs = db_query( $SQL, $pDbh );

    // initialize the values
    $return = array( "amount" => array( "day" => 0,
                                        "month" => 0,
                                        "account" => array() ),
                     "count" => array( "day" => 0,
                                       "month" => 0,
                                       "account" => array() ) );

    // set the date for today for easy comparison
    $today = date( "Y-m-d" );

    // cycle through the rows
    $row = 0;
    while ( $transRow = db_fetch_array( $rs, $row++ ) ) {
      // add the amount
      $thisAmount = $transRow["amount"];
      if ( $transRow["date"] == $today ) {
        $return["amount"]["day"] += $thisAmount;
        $return["count"]["day"]++;

        // also break up by account
        $accountNumber = trim( $transRow["accountnumber"] );
        $accountType = trim( $transRow["accounttype"] );
        if ( isset( $return["amount"]["account"]["$accountNumber|$accountType"] ) ) {
          $return["amount"]["account"]["$accountNumber|$accountType"] += $thisAmount;
        } else {
          // first time
          $return["amount"]["account"]["$accountNumber|$accountType"] = $thisAmount;
        }
        if ( isset( $return["count"]["account"]["$accountNumber|$accountType"] ) ) {
          $return["count"]["account"]["$accountNumber|$accountType"]++;
        } else {
          // first time
          $return["count"]["account"]["$accountNumber|$accountType"] = 1;
        }

      }

      // all of them go into the monthly amount
      $return["amount"]["month"] += $thisAmount;
      $return["count"]["month"]++;
    }
  } catch (Exception $ex) {
    $return = false;
  }

  return $return;
} // end privPermGetCurrentActivity

// Check all three rights tables to get the allowed amounts and counts.
function privPermGetAllowedLimits( $pDbh, $pHBEnv, $pFeature ) {

  // get the default maximum definition
  $maxAmount = FEATURE_LIMIT_MAX_AMOUNT;
  $maxCount = FEATURE_LIMIT_MAX_COUNT;

  try {
    // NOTE: profilerights is always present for allowed features but grouprights and
    //       userrights may not be.
    // NOTE: treating "confirm_required" as a limit that cannot be esclated by a lower right
    $SQL = "SELECT COALESCE( u.amount_per_transaction, $maxAmount) as u_apt,
                   COALESCE( u.amount_per_day, $maxAmount) as u_apd,
                   COALESCE( u.amount_per_month, $maxAmount) as u_apm,
                   COALESCE( u.amount_per_account_per_day, $maxAmount) as u_apapd,
                   COALESCE( g.amount_per_transaction, $maxAmount) as g_apt,
                   COALESCE( g.amount_per_day, $maxAmount) as g_apd,
                   COALESCE( g.amount_per_month, $maxAmount) as g_apm,
                   COALESCE( g.amount_per_account_per_day, $maxAmount) as g_apapd,
                   COALESCE( p.amount_per_transaction, $maxAmount) as p_apt,
                   COALESCE( p.amount_per_day, $maxAmount) as p_apd,
                   COALESCE( p.amount_per_month, $maxAmount) as p_apm,
                   COALESCE( p.amount_per_account_per_day, $maxAmount) as p_apapd,
                   COALESCE( u.count_per_day, $maxCount) as u_cpd,
                   COALESCE( u.count_per_month, $maxCount) as u_cpm,
                   COALESCE( u.count_per_account_per_day, $maxCount) as u_cpapd,
                   COALESCE( g.count_per_day, $maxCount) as g_cpd,
                   COALESCE( g.count_per_month, $maxCount) as g_cpm,
                   COALESCE( g.count_per_account_per_day, $maxCount) as g_cpapd,
                   COALESCE( p.count_per_day, $maxCount) as p_cpd,
                   COALESCE( p.count_per_month, $maxCount) as p_cpm,
                   COALESCE( p.count_per_account_per_day, $maxCount) as p_cpapd,
                   COALESCE( u.confirm_required, false) as u_cr,
                   COALESCE( g.confirm_required, false) as g_cr,
                   COALESCE( p.confirm_required, false) as p_cr
            FROM {$pHBEnv["Cu"]}user usr
            INNER JOIN {$pHBEnv["Cu"]}group grp ON grp.group_id = usr.group_id
            INNER JOIN cu_profilerights p ON p.profile_id = grp.profile_id
              AND p.feature_code = '$pFeature'
            LEFT JOIN {$pHBEnv["Cu"]}grouprights g ON g.group_id = usr.group_id
              AND g.feature_code = '$pFeature'
            LEFT JOIN {$pHBEnv["Cu"]}userrights u ON u.user_id = usr.user_id
              AND u.feature_code = '$pFeature'
            WHERE usr.user_id = {$pHBEnv["Uid"]}";

    // should just be one row
    $rs = db_query( $SQL, $pDbh );
    $amountsRow = db_fetch_array( $rs, 0 );

    // Now put it into a usable format, using the max each, for the user check and also
    // return the group amounts for the group check.
    $apt = min( min( $amountsRow["u_apt"], $amountsRow["g_apt"] ), $amountsRow["p_apt"] );
    $apd = min( min( $amountsRow["u_apd"], $amountsRow["g_apd"] ), $amountsRow["p_apd"] );
    $apm = min( min( $amountsRow["u_apm"], $amountsRow["g_apm"] ), $amountsRow["p_apm"] );
    $apapd = min( min( $amountsRow["u_apapd"], $amountsRow["g_apapd"] ), $amountsRow["p_apapd"] );

    $cpd = min( min( $amountsRow["u_cpd"], $amountsRow["g_cpd"] ), $amountsRow["p_cpd"] );
    $cpm = min( min( $amountsRow["u_cpm"], $amountsRow["g_cpm"] ), $amountsRow["p_cpm"] );
    $cpapd = min( min( $amountsRow["u_cpapd"], $amountsRow["g_cpapd"] ), $amountsRow["p_cpapd"] );

    // ** Determine Group Limits -- Minimum of Profile / Group Rights
    $gapt = min( $amountsRow["g_apt"], $amountsRow["p_apt"] );             // Amount / Transaction
    $gapd = min( $amountsRow["g_apd"], $amountsRow["p_apd"] );             // Amount / Day
    $gapm = min( $amountsRow["g_apm"] , $amountsRow["p_apm"] );            // Amount / Month
    $gapapd = min( $amountsRow["g_apapd"], $amountsRow["p_apapd"] );       // Amount Per Account / Day

    $gcpd = min( $amountsRow["g_cpd"], $amountsRow["p_cpd"] );              // Count / Day
    $gcpm = min( $amountsRow["g_cpm"], $amountsRow["p_cpm"] );              // Count / Month
    $gcpapd = min( $amountsRow["g_cpapd"], $amountsRow["p_cpapd"] );        // Count Per Account / Day

    // if higher level set to true then doesn't matter what lower level needs
    $cr = ($amountsRow["u_cr"] == 't') || ($amountsRow["g_cr"] == 't') || ($amountsRow["p_cr"] == 't') ? true : false;

    $return = array( "amount_per_transaction" => $apt,
                     "amount_per_day" => $apd,
                     "amount_per_month" => $apm,
                     "amount_per_account_per_day" => $apapd,
                     "count_per_day" => $cpd,
                     "count_per_month" => $cpm,
                     "count_per_account_per_day" => $cpapd,
                     "group" => array( "amount_per_transaction" => $gapt,
                                       "amount_per_day" => $gapd,
                                       "amount_per_month" => $gapm,
                                       "amount_per_account_per_day" => $gapapd,
                                       "count_per_day" => $gcpd,
                                       "count_per_month" => $gcpm,
                                       "count_per_account_per_day" => $gcpapd
                                      ),
                     "confirm_required" => $cr
                    );

  } catch (Exception $ex) {
    $return = false;
  }

  return $return;
} // end privPermGetAllowedLimits

// Get the number of alerts (any type) for the user
function privGetCurrentAlertCount( $pDbh, $pHBEnv ) {
  try {
    $SQL = "SELECT count(*) as count FROM cu_alerts WHERE cu = '{$pHBEnv["Cu"]}' AND user_id = {$pHBEnv["Uid"]}";

    $rs = db_query( $SQL, $pDbh );
    $countRow = db_fetch_array( $rs, 0 );

    $result = $countRow["count"];
  } catch (Exception $ex) {
    $result = false;
  }

  return $result;
} // end privGetCurrentAlertCount

// Check all three rights tables to determine if confirmation is required.
function privPermCheckConfirmReq( $pDbh, $pHBEnv, $pFeature ) {
  try {
    // Special case for single user in group (no confirmation required)
    $SQL = "SELECT count( u.*) as user_count
            FROM {$pHBEnv["Cu"]}user usr
            INNER JOIN {$pHBEnv["Cu"]}user u ON u.group_id = usr.group_id
            WHERE usr.user_id = {$pHBEnv["Uid"]}";
    $rs = db_query( $SQL, $pDbh );
    $countRow = db_fetch_array( $rs, 0 );

    if ( $countRow["user_count"] == 1 ) {
      $cr = false;
    } else {
      // NOTE: profilerights is always present for allowed features but grouprights and
      //       userrights may not be.
      // NOTE: treating "confirm_required" as a limit that cannot be esclated by a lower right
      // NOTE: special case of single user in group = no confirmation required
      $SQL = "SELECT COALESCE( u.confirm_required, false) as u_cr,
                     COALESCE( g.confirm_required, false) as g_cr,
                     COALESCE( p.confirm_required, false) as p_cr
              FROM {$pHBEnv["Cu"]}user usr
              INNER JOIN {$pHBEnv["Cu"]}group grp ON grp.group_id = usr.group_id
              INNER JOIN cu_profilerights p ON p.profile_id = grp.profile_id
                AND p.feature_code = '$pFeature'
              LEFT JOIN {$pHBEnv["Cu"]}grouprights g ON g.group_id = usr.group_id
                AND g.feature_code = '$pFeature'
              LEFT JOIN {$pHBEnv["Cu"]}userrights u ON u.user_id = usr.user_id
                AND u.feature_code = '$pFeature'
              WHERE usr.user_id = {$pHBEnv["Uid"]}";

      // should just be one row
      $rs = db_query( $SQL, $pDbh );
      $confirmRow = db_fetch_array( $rs, 0 );

     // if higher level set to true then doesn't matter what lower level needs
      $cr = ($confirmRow["u_cr"] == 't') || ($confirmRow["g_cr"] == 't') || ($confirmRow["p_cr"] == 't') ? true : false;
  }

    $return = $cr;

  } catch (Exception $ex) {
    // any error would mean don't get rights
    $return = false;
  }

  return $return;
} // end privPermCheckConfirmReq


/**
 *  Return the number of users in the group for the requested user
 *
 *  @param integer $pDbh        - The current database handle
 *  @param array   $pHBEnv      - Current Environment array
 *  @param array   $permInputs  - Array for parameters to be passed in
 *                                  Uid -- Required - this is the requested user id
 *
 *  @return mixed
 *              false -- if error encountered
 *              0     -- user group or user not found
 *              > 0   -- Number of users in the group
 */
function privGetGroupUserCount($pDbh, $pHBEnv, $permInputs) {

  $retVal = 0;
  try {

    if (HCU_array_key_exists('Uid', $permInputs)) {
      $lUid = intval(HCU_array_key_value('Uid', $permInputs));
    } else {
      throw new Exception("Invalid User");
    }


    // ** Create the query to count the number of users for {group} of the user in question
    $sql = "SELECT count(group_user.user_id) as user_count
            FROM {$pHBEnv["Cu"]}user as cur_user
            JOIN {$pHBEnv["Cu"]}user as group_user on group_user.group_id = cur_user.group_id
            WHERE cur_user.user_id = {$lUid} ";

    $rs = db_query( $sql, $pDbh );

    if ($rs) {
      $countRow = db_fetch_array( $rs );
      $retVal = intval($countRow['user_count']);
    } else {
      throw new Exception("Group User Count sql failed");
    }

  } catch (Exception $ex) {
    $retVal = false;
  }

  return $retVal;
} // end privGetGroupUserCount