#!/usr/local/bin/perl -T
use strict;
use lib '/dept/phys/software/Perl5/lib';
use lib '/dept/phys/software/Perl5/lib/site_perl';
use lib '/group/pcs/software/FakeCAS';
use PNCE::FakeCAS;
use Template;

#Setting this will force debug regardless of ticket
my $DEBUG=0;
$DEBUG=1;

my $template_config = 
{  	POST_CHOMP => 1,
	INCLUDE_PATH => [@INC],
	COMPILE_DIR => "/tmp/compile-dir.$<",
	PROCESS => ['WRAPPER.tt'],
};

my $fakecas = new PNCE::FakeCAS;
my $cgi = $fakecas->cgi;
my $debug = 0;

sub debug(@)
{	my @args = @_;
	if ($debug || $DEBUG)
	{	my $now = localtime;
		my $header = "$now FakeCAS-debug:";
		my $str = join '', @args;
		warn("$header $str\n");
	}
}

sub display_template($;$)
#Displays named template, passing the vars in $vars.  The var fakecas=>$fakecas
#will be added to the var list unless fakecas key present.
#Will also set the vars skip_wrapper and skip_appheader
{	my $template = shift;
	my $vars = shift || {};
	$vars->{fakecas} = $fakecas unless exists $vars->{fakecas};
	$vars->{skip_wrapper} = 1 unless exists $vars->{skip_wrapper};
	$vars->{skip_appheader} = 1 unless exists $vars->{skip_appheader};

	my $ttobj = new Template $template_config;
	my $res = $ttobj->process($template,$vars);
	unless ( $res )
	{	warn("Error processing template: " .  $ttobj->error);
	}

	exit 0;
}

my $service = $cgi->param('service');
my $ticket = $cgi->param('ticket');
my $renew = $cgi->param('renew');
my $ip = $ENV{REMOTE_ADDR};

#See if we have a valid ST
my $errormsg="";
my $errorcode="";
my ($username, $flags) = $fakecas->parse_st($ticket);
if ( $username && $fakecas->valid_username($username) && $flags 
	&& ref($flags) eq 'HASH' )
{	#Valid ST
	$debug = $flags->{debug} || 0;
	debug("validate called by user $username\@$ip, ST $ticket");
	if ( $service )
	{	debug("service is $service");
	} else
	{	#Can't really validate without a service
		my $now = localtime;
		warn "$now FakeCAS::serviceValidate from $username\@$ip, " .
			"ST $ticket, but no service.  Invalidating";
		$errorcode = "INVALID_REQUEST";
		$errormsg = "ticket $ticket; no service given";
		$username = undef;
	}
	my $forced = $flags->{forced} || 0;
	if ( $renew )
	{	if ( $forced )
		{	debug("renew flag set on validate, OK ticket forced");
		} else
		{	debug("renew flag set on validate, " .
				"invalidating non-forced ticket");
			$username = undef;
			$errorcode = "NOT_RENEWED";
			$errormsg = "ticket $ticket was from TGT and renew requested";
		}
	}
} else
{	if ( $ticket )
	{	$errorcode='INVALID_TICKET';
		$errormsg = "ticket $ticket cannot be parsed";
	} else
	{ 	$errorcode = 'INVALID_REQUEST';
		$errormsg = 'No ticket given';
	}
}


debug("Returning CAS2.0 response, username= " . ($username?$username:'*undef*')
	);
display_template('serviceValidate.tt',
	{ 	username=>$username, 
		errorcode=>$errorcode,
		errormsg=>$errormsg,
	});
die "Should not reach here";
