package net.sourceforge.jsurveyor.tags;

import java.io.IOException;

import javax.servlet.*;
import javax.servlet.http.HttpSession;
import javax.servlet.jsp.tagext.*;
import net.sourceforge.jsurveyor.*;

/**
 * Custom tag that ensures that a user is logged in before seeing the page and that the user has the correct userType
 * @version 1.0
 * @author Claus Methmann Christensen
 * @author Anders Spliid Hansen
 * @author Esben Iversen Hansen
 * @author Lars H Jensen
 * @author Marcus Overheu
 * @author Thomas Ramdal
 * @author Peter Thomsen
 */
public class LoginTag extends TagSupport {
	/**
	 * Field access
	 */
	private String access = "root";

	/**
	 * Automatically captures the attribute access when using the tag.
	 * @param access String
	 */
	public void setAccess(String access) {
		this.access = access;
	}

	/**
	 * Automatically called when closing the tag
	 * @return int
	 * @see javax.servlet.jsp.tagext.Tag#doEndTag()
	 */
	public int doEndTag() {
		try {
			User userInfo;

			HttpSession session = pageContext.getSession();
			String loggedIn = (String) session.getAttribute("loggedIn");

			// if the user is logged in we proceed, 
			// otherwise we send the user to the login page
			if (!loggedIn.equals("true")) {
				ServletRequest request = pageContext.getRequest();
				RequestDispatcher rd =
					request.getRequestDispatcher("login.jsp");

				try {
					rd.forward(request, pageContext.getResponse());
				} catch (IOException ee) {
				} catch (ServletException ee) {
				} //ignored exception
				return SKIP_PAGE;
			}

			// if the person has just logged in we get the information
			// from the database and puts it in the sessionscope, 
			// otherwise we find it already in the sessionscope.
			String name = (String) session.getAttribute("name");
			if (name != null) {
				userInfo = DataAccess.retrieveUser(name);
				session.setAttribute("userInfo", userInfo);
				session.removeAttribute("name");
			} else {
				userInfo = (User) session.getAttribute("userInfo");
			}

			// if the user is not of the required usertype we force a logout
			if (!userInfo.getAccessControl().getUserType().equals(access)) {
				ServletRequest request = pageContext.getRequest();
				RequestDispatcher rd =
					request.getRequestDispatcher("logout.jsp");

				try {
					rd.forward(request, pageContext.getResponse());
				} catch (IOException ee) {
				} catch (ServletException ee) {
				} //ignored exception
				return SKIP_PAGE;

			}

			return EVAL_PAGE;

			// This exception is cast if we cannot retrieve any information about a login
			// This happens if someone tries to bypass the login page or
			// if a session has timeout, in that case we redirect to the login page	
		} catch (NullPointerException e) {
			ServletRequest request = pageContext.getRequest();
			RequestDispatcher rd = request.getRequestDispatcher("login.jsp");

			try {
				rd.forward(request, pageContext.getResponse());
			} catch (IOException ee) {
			} catch (ServletException ee) {
			} // ignored

			return SKIP_PAGE;

		}
	}

}
