<?php
/* 各API 需有 token_verify() token驗證function ，因各API撈取API金鑰方式不同*/
class WebAPIForMenuPage extends base_class
{

    /**
     * Leo
     * cashiser機器OTP記錄檢查
     */
    public function Create_cashier_otp($params)
    {
        //設定寫入資料
        $s_cashier_id = (string) $params["cashier"];
        $n_store_id = (int) $params["store"];
        $n_send_at = (int) $params["send_at"];
        //otp
        $s_store_otp = (string) $params["otp"];
        //otp失效時間
        $s_store_otp_invalid_at = (string) $params["invalid_at"];
        //更新門市otp 與失效時間
        $sql = sprintf(
            "UPDATE [%s].[dbo].[store] 
            SET
                [store_otp] = :store_otp,
                [store_otp_invalid_at]= :store_otp_invalid_at
            WHERE
                [store_id] = :store_id",
            $this->database_trend
        );
        $sth = $this->pdo_sql->prepare($sql);
        $sth->execute([
            "store_otp" => $s_store_otp,
            "store_otp_invalid_at" => $s_store_otp_invalid_at,
            "store_id" => $n_store_id,
        ]);

        return "OK";
    }
    /**
     * Leo
     * api 驗證
     */
    public function api_verify($token, $params)
    {
        //門市編號
        $n_store_id = (int) $params["store"];
        if ($n_store_id == 0) { //門市編號為空
            throw new Exception("store 欄位不可為空", 91000);
        } else {    //檢查門市是否存在
            $sql = sprintf(
                "SELECT 
                        _s.store_id
                FROM 	
                    [%s].[dbo].[store] AS _s 
                WHERE
                    _s.store_id = :store_id ",
                $this->database_trend
            );
            //準備執行sql
            $sth = $this->pdo_sql->prepare($sql);
            $sth->execute([
                "store_id" => $n_store_id
            ]);
            $row = $sth->fetch(PDO::FETCH_ASSOC);
            if (empty($row)) {
                throw new Exception("store 異常", 91000);
            }
        }
        //機台序號
        $s_cashier_id = (string) $params["cashier"];
        if ($s_cashier_id == "") { //機台編號為空
            throw new Exception("cashier 欄位不可為空", 91000);
        } else { //檢查機台是否存在
            $sql = sprintf(
                "SELECT 
                        _c.cashier_id
                FROM 	
                    [%s].[dbo].[cashier] AS _c
                WHERE
                    _c.cashier_id = :cashier_id ",
                $this->database_trend
            );
            //準備執行sql
            $sth = $this->pdo_sql->prepare($sql);
            $sth->execute([
                "cashier_id" => $s_cashier_id
            ]);
            $row = $sth->fetch(PDO::FETCH_ASSOC);
            if (empty($row)) {
                throw new Exception("cashier error", 91000);
            }
        }
        //時間戳(單位秒)
        $s_send_at = (string) $params["send_at"];
        if ($s_send_at == "") { //時間戳為空
            throw new Exception("send_at 欄位不可為空", 91000);
        } else if ($this->check_timestamp_format($s_send_at) != true) {
            throw new Exception("send_at format error", 91000);
        }
        //Token
        if (trim($token) == "") { //Token為空
            throw new Exception("token 欄位不可為空", 91000);
        }
        //OTP
        $s_otp = (string) $params["otp"];
        if (trim($s_otp) == "") { //OTP為空
            throw new Exception("otp 欄位不可為空", 91000);
        }
        //OTP失效時間
        $s_otp_invalid_at = (string) $params["invalid_at"];
        if (trim($s_otp) == "") { //OTP為空
            throw new Exception("invalid_at 欄位不可為空", 91000);
        } else if ($this->check_date_format($s_otp_invalid_at) != true) { //時間格式不正確
            throw new Exception("invalid_at 時間格式不正確", 91000);
        }

        //依據資料查詢門市API金鑰來進行Token驗證
        $sql = sprintf(
            "SELECT 
                    _s.store_api_key,
                    _c.cashier_id
            FROM 	
                 [%s].[dbo].[cashier] AS _c
                 LEFT JOIN [%s].[dbo].[store] AS _s ON _s.store_id = _c.store_id
            WHERE
                _c.store_id = :store_id AND
                _c.cashier_id = :cashier_id",
            $this->database_trend,
            $this->database_trend
        );
        //準備執行sql
        $sth = $this->pdo_sql->prepare($sql);
        $sth->execute([
            "store_id" => $n_store_id,
            "cashier_id" => $s_cashier_id
        ]);
        $row = $sth->fetch(PDO::FETCH_ASSOC);
        if (!empty($row)) {
            $s_api_key = $row["store_api_key"];
            if ($this->shopee_api_token_verify($token, $s_api_key, $s_send_at) != true) {
                throw new Exception("Token Verification Failed", 91001);
            }
        } else {
            //查詢不到該門市該機台
            throw new Exception("store and cashier not binding", 91000);
        }
    }
}
