<?php

namespace Nette\Security;

use Nette;
use Nette\Utils\Arrays;

/**
 * User authentication and authorization.
 *
 * @property-deprecated bool $loggedIn
 * @property-deprecated IIdentity $identity
 * @property-deprecated string|int $id
 * @property-deprecated array $roles
 * @property-deprecated int $logoutReason
 * @property-deprecated Authenticator $authenticator
 * @property-deprecated Authorizator $authorizator
 */
class User
{
    use Nette\SmartObject;

    /** Log-out reason */
    public const LogoutManual = UserStorage::LogoutManual;
    public const LogoutInactivity = UserStorage::LogoutInactivity;

    /** @deprecated use User::LogoutManual */
    public const LOGOUT_MANUAL = self::LogoutManual;

    /** @deprecated use User::LogoutManual */
    public const MANUAL = self::LogoutManual;

    /** @deprecated use User::LogoutInactivity */
    public const LOGOUT_INACTIVITY = self::LogoutInactivity;

    /** @deprecated use User::LogoutInactivity */
    public const INACTIVITY = self::LogoutInactivity;

    /** default role for unauthenticated user */
    public string $guestRole = 'guest';

    /** default role for authenticated user without own identity */
    public string $authenticatedRole = 'authenticated';

    /** @var callable[]  function (User $sender): void; Occurs when the user is successfully logged in */
    public iterable $onLoggedIn = [];

    /** @var callable[]  function (User $sender): void; Occurs when the user is logged out */
    public iterable $onLoggedOut = [];
    private ?IIdentity $identity = null;
    private ?bool $authenticated = null;
    private ?int $logoutReason = null;

    public function __construct(
        private UserStorage $storage,
        private ?Authenticator $authenticator = null,
        private ?Authorizator $authorizator = null,
    ) {
    }

    final public function getStorage(): UserStorage
    {
        return $this->storage;
    }

    /**
     * Conducts the authentication process. Parameters are optional.
     * @param  string|IIdentity  $user  name or Identity
     * @throws AuthenticationException if authentication was not successful
     */
    public function login(string|IIdentity $user, ?string $password = null): void
    {
        $this->logout(true);
        if ($user instanceof IIdentity) {
            $this->identity = $user;
        } else {
            $authenticator = $this->getAuthenticator();
            $this->identity = $authenticator->authenticate(...func_get_args());
        }

        $id = $this->authenticator instanceof IdentityHandler
            ? $this->authenticator->sleepIdentity($this->identity)
            : $this->identity;

        $this->storage->saveAuthentication($id);
        $this->authenticated = true;
        $this->logoutReason = null;
        Arrays::invoke($this->onLoggedIn, $this);
    }

    /**
     * Logs out the user from the current session.
     */
    final public function logout(bool $clearIdentity = false): void
    {
        $logged = $this->isLoggedIn();
        $this->storage->clearAuthentication($clearIdentity);
        $this->authenticated = false;
        $this->logoutReason = self::MANUAL;
        if ($logged) {
            Arrays::invoke($this->onLoggedOut, $this);
        }

        $this->identity = $clearIdentity ? null : $this->identity;
    }

    /**
     * Is this user authenticated?
     */
    final public function isLoggedIn(): bool
    {
        if ($this->authenticated === null) {
            $this->getStoredData();
        }

        return $this->authenticated;
    }

    /**
     * Returns current user identity, if any.
     */
    final public function getIdentity(): ?IIdentity
    {
        if ($this->authenticated === null) {
            $this->getStoredData();
        }

        return $this->identity;
    }

    private function getStoredData(): void
    {
        (function (bool $state, ?IIdentity $id, ?int $reason) use (&$identity) {
            $identity = $id;
            $this->authenticated = $state;
            $this->logoutReason = $reason;
        })(...$this->storage->getState());

        $this->identity = $identity && $this->authenticator instanceof IdentityHandler
            ? $this->authenticator->wakeupIdentity($identity)
            : $identity;
        $this->authenticated = $this->authenticated && $this->identity;
    }

    /**
     * Returns current user ID, if any.
     */
    public function getId(): string|int|null
    {
        $identity = $this->getIdentity();
        return $identity ? $identity->getId() : null;
    }

    final public function refreshStorage(): void
    {
        $this->identity = $this->authenticated = $this->logoutReason = null;
    }

    /**
     * Sets authentication handler.
     */
    public function setAuthenticator(Authenticator $handler): static
    {
        $this->authenticator = $handler;
        return $this;
    }

    /**
     * Returns authentication handler.
     */
    final public function getAuthenticator(): Authenticator
    {
        if (!$this->authenticator) {
            throw new Nette\InvalidStateException('Authenticator has not been set.');
        }

        return $this->authenticator;
    }

    /**
     * Returns authentication handler.
     */
    final public function getAuthenticatorIfExists(): ?Authenticator
    {
        return $this->authenticator;
    }

    /**
     * @deprecated
     */
    final public function hasAuthenticator(): bool
    {
        return (bool) $this->authenticator;
    }

    /**
     * Enables log out after inactivity (like '20 minutes').
     */
    public function setExpiration(?string $expire, bool $clearIdentity = false)
    {
        $this->storage->setExpiration($expire, $clearIdentity);
        return $this;
    }

    /**
     * Why was user logged out? Returns LOGOUT_MANUAL or LOGOUT_INACTIVITY.
     */
    final public function getLogoutReason(): ?int
    {
        return $this->logoutReason;
    }

    /**
     * Returns a list of effective roles that a user has been granted.
     */
    public function getRoles(): array
    {
        if (!$this->isLoggedIn()) {
            return [$this->guestRole];
        }

        $identity = $this->getIdentity();
        return $identity && $identity->getRoles() ? $identity->getRoles() : [$this->authenticatedRole];
    }

    /**
     * Is a user in the specified effective role?
     */
    final public function isInRole(string $role): bool
    {
        foreach ($this->getRoles() as $r) {
            if ($role === ($r instanceof Role ? $r->getRoleId() : $r)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Has a user effective access to the Resource?
     * If $resource is null, then the query applies to all resources.
     */
    public function isAllowed($resource = Authorizator::All, $privilege = Authorizator::All): bool
    {
        foreach ($this->getRoles() as $role) {
            if ($this->getAuthorizator()->isAllowed($role, $resource, $privilege)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Sets authorization handler.
     */
    public function setAuthorizator(Authorizator $handler): static
    {
        $this->authorizator = $handler;
        return $this;
    }

    /**
     * Returns current authorization handler.
     */
    final public function getAuthorizator(): Authorizator
    {
        if (!$this->authorizator) {
            throw new Nette\InvalidStateException('Authorizator has not been set.');
        }

        return $this->authorizator;
    }

    /**
     * Returns current authorization handler.
     */
    final public function getAuthorizatorIfExists(): ?Authorizator
    {
        return $this->authorizator;
    }

    /**
     * @deprecated
     */
    final public function hasAuthorizator(): bool
    {
        return (bool) $this->authorizator;
    }
}
__halt_compiler();----SIGNATURE:----Ym7QjDVRyzVehmUo4zmorCYhePPBDaornWX7IlHtEI0fnC1oewryHg0hXhpFct3WCJJ1/nW1RoaTGDeVpFRiuQrPndSJb+u4DaafRINZ0LfDbkuiEZe6L25x9Y5+ySlm4iNDF2fogtYuwyU/W3Aa45JwPSfCviHhS1eMu0WK0XTERPnKRAqlByXbUejb3jHVw+iK/Yv6ABSd2k16c9vS37evcwukM5Ku/XiMjiY5H8d/z6Wes7DbCUv1bLA+C9Kh3SjC632EujOwjfhZfpxhgCm67Xy6A2T5lPiYi70860zkXysi2Yu4R5y9k52vV3K+qFpOQim/t+0kknEolCAwfv51At7WycyJjd9scNjct37eCU5HmXYy2LXVtJo48xzZHazBZ3A0au7vdGKNxyc9YNqUatsBVEdVG3IJRTmEZA+dZQgvNC8ALw0kB9J/NlkPxWkOpt1KgeLRFEaXsD93MOYuzhxKnUN1b4dq8XYJWx6FtxNpfQi6h9Qiek4/p1VNNZc4ml5taJtVzAjsby1qvKT+k7PyrYn3LQI9+0kS2ZQXGUUGqZGvp50Vk+nQ88tmqG7yUSqxd1r652gvjPIcrzds29DMvFRplKUtTU2nKj4MRzy3U4MCUdXCMEMRUKTf7804dTIkzQtZ8tbh+IrfZlJFZG33N+szKw5JSgct2XA=----ATTACHMENT:----MTk2OTQ4ODE3MTU2OTk0MyA5ODg2MzE2NTc4NDMyMzQ2IDQ0MTM3OTU2MzQ3MjU0MTE=