#!/usr/local/bin/perl -T
use strict;
use lib '/dept/phys/software/Perl5/lib';
use lib '/dept/phys/software/Perl5/lib/site_perl';
use lib '/group/pcs/software/FakeCAS';
use PNCE::FakeCAS;
use Template;

#Setting this will force debug regardless of ticket
my $DEBUG=0;
$DEBUG=1;

my $template_config = 
{  	POST_CHOMP => 1,
	INCLUDE_PATH => [@INC],
	COMPILE_DIR => "/tmp/compile-dir.$<",
	PROCESS => ['WRAPPER.tt'],
};

my $fakecas = new PNCE::FakeCAS;
my $cgi = $fakecas->cgi;

my $service = $cgi->param('service');
my $renew = $cgi->param('renew') || 0;
my $gateway = $cgi->param('gateway') || 0;
my $username = $cgi->param('username');
my $warn = $cgi->param('warn') || 0;
my $debug = $cgi->param('debug') || 0;

sub debug(@)
{	my @args = @_;
	if ($debug || $DEBUG)
	{	my $now = localtime;
		my $header = "$now FakeCAS-debug:";
		my $str = join '', @args;
		warn("$header $str\n");
	}
}

sub display_template($;$)
#Displays named template, passing the vars in $vars.  The var fakecas=>$fakecas
#will be added to the var list unless fakecas key present.
{ 	my $template = shift;
	my $vars = shift || {};
	$vars->{fakecas} = $fakecas unless exists $vars->{fakecas};

	my $ttobj = new Template $template_config;
	my $res = $ttobj->process($template,$vars);
	unless ( $res )
	{	warn("Error processing template: " .  $ttobj->error);
	}

	exit 0;
}

my $flags = { warn=>$warn, debug=>$debug };

my $ip = $ENV{REMOTE_ADDR};

debug("login called by $ip, ", 
	$service?"for service $service":"no service given");
debug("Mode is gateway=$gateway, renew=$renew");
if ( $gateway && $renew )
{	$gateway = 0;
	debug("Set gateway=0 as renew is set");
}
debug("username is $username");

#Check for a valid username, if so assume that we just filled out the login
#form.
if ( $username )
{	if ( $fakecas->valid_username($username) )
	{	#Have a valid username, thats enough authentication for us
		my $tgt = $fakecas->create_tgt_for_user($username, %$flags);
		$flags->{forced} = 1;
		my $st = $fakecas->create_st_for_user($username,%$flags);
		debug("username present, generated TGT $tgt, ST $st");
		if ( $service )
		{	debug("Redirecting to $service with ticket $st");
			$fakecas->do_redirect($service,$tgt,$st);
			die "Should not reach here";
		} else
		{	debug("No service, displaying successful login page");
			display_template('login_successful.tt',
				{ 	username=>$username, 
					tgt=>$tgt,
				}
				);
			die "Should not reach here";
		}
	} else
	{	$username = '';
	}
}

#See if we have a TGT
my $tgt = $fakecas->get_cookie;
($username, $flags) = $fakecas->parse_tgt($tgt);
if ( $username && $fakecas->valid_username($username) && $flags 
	&& ref($flags) eq 'HASH' )
{	#Valid TGT
	$warn = $flags->{warn} || 0;
	$debug = $flags->{debug} || 0;
	debug("login called, using TGT $tgt");
	debug("=login called by $ip, ", 
		$service?"for service $service":"no service given");
	debug("=Mode is gateway=$gateway, renew=$renew");

	if ( $renew )
	{	debug("Ignoring TGT since renew is set");
	} else
	{	#We're logged in
		if ( $service )
		{   my $st = $fakecas->create_st_for_user($username,%$flags);
		    if ($warn)
		    {	#Warn user of use of TGT to generate new ST
			display_template('tgt_warning.tt',
				{ 	username=>$username, 
					tgt=>$tgt,
					st=>$st,
					service=>$service,
				}
				);
			die "Should not reach here";
		    } else
		    {	#Just redirect
			$fakecas->do_redirect($service,$tgt,$st);
			die "Should not reach here";
		    }
		} else
		{	#No service to redirect to, let user know already auth
			display_template('already_logged_in.tt',
				{	username=>$username,
					tgt=>$tgt,
				} );
			die "Should not reach here";
		}
	}
} else
{	debug("Ignoring invalid tgt $tgt");
}

if ( $gateway )
{	if ( $service )
	{	#Do redirect without ST
		$fakecas->do_redirect($service,undef, undef);
		die "Should not reach here";
	} else
	{	$fakecas->fatal_error("Received gateway request but no service",
			"Can't gateway without a service");
		die "Should not reach here";
	}
}

display_template('login_form.tt', { service=>$service });
die "Should not reach here";
