--select * from dropall('resolvespec_login');
CREATE
OR REPLACE FUNCTION resolvespec_login(
   INOUT p_data jsonb
  ,OUT p_success boolean
  ,OUT p_error text
)
LANGUAGE plpgsql VOLATILE
SECURITY DEFINER
AS
$$
DECLARE
  --Error Handling--
m_funcname text = 'resolvespec_login';
  m_errmsg
text;
  m_errcontext
text;
  m_errdetail
text;
  m_errhint
text;
  m_errstate
text;
  m_retval
integer;
  --Error Handling--
  m_rid_user
integer;
  m_rid_hub
integer;
  m_pass_hashed
citext[];
  m_session
jsonb;
  m_allow_hash_auth
boolean;
BEGIN
  m_allow_hash_auth
= _try_integer( p_data->'claims'->>'rid_user',0) > 0;
  create
extension if not exists pgcrypto;

  perform
log_event(m_funcname,format('API Login username: %s   hh=%s claims: %s',p_data->>'username',m_allow_hash_auth,p_data->'claims'), bt_enum('eventlog','local notice'));

select h.rid_hub
from public.user h
where h.usercode = p_data ->>'username'
into m_rid_hub;

if
m_rid_hub is null
      and exists (select 1 from information_schema.tables t where t.table_schema = 'public' and t.table_name = 'users')
  then
select u.rid_hub, u.rid_user
from public.users u
where u.rid_user = _try_integer(p_data - > 'claims' ->>'rid_user', 0) into m_rid_hub,m_rid_user;

end if;

  if
m_rid_hub is null
  then
    raise exception 'Invalid username / password';
end if;

  m_pass_hashed
= array[encode(digest(format('%s:%s',p_data->>'username',p_data->>'password'), 'sha512'), 'hex')
    ,encode(digest(format('%s:%s',p_data->>'username',p_data->>'password'), 'md5'), 'hex')
    ,encode(digest(format('%s',p_data->>'password'), 'md5'), 'hex')
    ]::citext[];

  if
m_allow_hash_auth
  then
    m_pass_hashed := m_pass_hashed || array[
      p_data->>'password'
    ]::citext[];
end if;

  --select $A${"meta": null, "claims": {"rid_user": 30000024}, "password": "c4ca4238a0b923820dcc509a6f75849b", "username": "SUPPORT"}$A$::jsonb->>'password'
  --c4ca4238a0b923820dcc509a6f75849b
  --select * from v_eventlog

  if
exists (
    select 1
    from information_schema.tables t
    where t.table_schema = 'public'
      and t.table_name = 'users'
  )
  then
    if not exists (
      select 1
      from public.user h
      left outer join public.users usr on usr.rid_hub = h.rid_hub
      where h.rid_hub = m_rid_hub
      and (
        h.password = any (m_pass_hashed)
        and nv(h.password) <> ''
        or usr.password = any(m_pass_hashed)
        and nv(usr.password) <> ''
      )
    )
    then
      raise exception 'Password incorrect';
end if;

  elsif
not exists (
    select 1
    from public.user h
    where h.rid_hub = m_rid_hub
    and h.password = any(m_pass_hashed)
    and nv(h.password) <> ''
  )
  then
    raise exception 'Password incorrect';
end if;

  if
_try_bool(p_data->'jsonvalue'->>'issecurity',false)
    and not exists (
      select h.rid_hub
      from public.user h
      inner join public.user_all_parents(m_rid_hub) p on p.parent_rid_hub = h.rid_hub
      where h.hubname ilike '%Access Control%'
      )
  then
    raise exception 'Cannot login with security mode. User must be in Access Control group';
end if;

with newsession as (
insert
into core._loginsession (createtm, modifytm, rid_user, usertable, sessionid, token, useragent, location,
                         ipaddress, expiretm, jsonvalue)
select now(),
       now(),
       m_rid_hub,
       'hub',
       newid(),
       newid(),
       p_data ->>'user-agent', p_data->>'fromurl'
        , p_data->>'host', (now() + '31 days':: interval), p_data->'jsonvalue'
    returning *
    )
select to_jsonb(newsession)
from newsession into m_session;

if
_try_integer(m_session->>'rid_user',0) > 0
  then
update public.user u
set jsonvalue = _jsonb_object_cat(u.jsonvalue, jsonb_build_object('lastlogin', to_char(now(), 'YYYY-MM-DD HH24:mi:SS')))
where u.rid_hub = m_rid_hub;
end if;



select jsonb_build_object('token', m_session ->>'token'
           , 'session', m_session ->>'session'
           , 'user', _jsonb_object_cat(jsonb_build_object(
                                               'user_id', h.rid_hub
                                           , 'username', h.usercode
                                           , 'email', null
                                           , 'user_level', 0
                                           , 'roles', jsonb_build_array()
                                           , 'session_id', m_session ->>'sessionid'
                                           , 'token', m_session ->>'token'
                                           , 'session_rid', _try_integer(m_session ->>'id')
                                       ),
                                       (select jsonb_build_object('program_user_table', r.tablename, 'program_user_id',
                                                                  _try_integer(r.key, 0))
                                        from public.user_tableinfo(m_rid_hub) r)
                     )
           , 'expires_in', 86400
       )
from public.user h
where h.rid_hub = m_rid_hub into p_data;

p_success
= true;
EXCEPTION
WHEN others THEN
  GET STACKED DIAGNOSTICS
    m_errmsg = MESSAGE_TEXT
   ,m_errcontext = PG_EXCEPTION_CONTEXT
   ,m_errdetail = PG_EXCEPTION_DETAIL
   ,m_errhint = PG_EXCEPTION_HINT
   ,m_errstate = RETURNED_SQLSTATE;

  p_error
:= get_err_msg(m_funcname, m_errmsg, m_errcontext, m_errdetail, m_errhint, m_errstate);
  p_success
:= false;
END;
$$;