<?php
//
// Will test the forgot password feature
//

error_reporting(E_ALL | E_STRICT);
ini_set("track_errors", "On");

$rg_cache_debug = TRUE;
$test_normal = TRUE;

$INC = dirname(__FILE__) . "/../inc";
require_once(dirname(__FILE__) . "/config.php");
require_once($INC . "/init.inc.php");
require_once($INC . "/util.inc.php");
require_once("helpers.inc.php");
require_once("http.inc.php");

rg_log_set_file("http_forgot.log");

require_once("common.php");

$_testns = 'http_forgot';


$rg_user_max_len = 60;

prepare_http();
rg_test_create_user($db, $rg_ui);


rg_log('');
rg_log_enter('Loading forgot_send form...');
$data = array(); $headers = array();
$r = do_req($test_url . '/op/forgot_send', $data, $headers);
if ($r === FALSE) {
	rg_log("Cannot load forgot pass page!");
	exit(1);
}
rg_log('Posting the forgot_send form...');
$data = array(
	'email' => $rg_ui['email'],
	'doit' => 1
	);
$headers = array();
$r = do_req($test_url . '/op/forgot_send', $data, $headers);
if (!strstr($r['body'], 'your inbox and follow the instructions')) {
	rg_log_ml('r: ' . print_r($r, TRUE));
	rg_log("Cannot post forgot pass form!");
	exit(1);
}
$sql = 'SELECT token FROM forgot_pass WHERE uid = ' . $rg_ui['uid'];
$res = rg_sql_query($db, $sql);
$rows = rg_sql_num_rows($res);
if ($rows > 0)
	$row = rg_sql_fetch_array($res);
rg_sql_free_result($res);
if ($rows != 1) {
	rg_log("Seems the token is not in the database or there are multiple"
		. " ones (rows=" . $rows . ")!");
	exit(1);
}
$db_token = $row['token'];
rg_log_exit();


rg_log('');
rg_log_enter('Loading token from mail...');
$k = 'DEBUG::0::mail::mail/user/forgot/recover';
$c = test_wait_cache($k);
if (!isset($c['body'])) {
	rg_log_ml(print_r($c, TRUE));
	rg_log('No body in c var!');
	exit(1);
}
$s = strstr($c['body'], '/op/forgot_link/');
if ($s === FALSE) {
	rg_log_ml(print_r($c['body'], TRUE));
	rg_log('No link in body!');
	exit(1);
}

$s = substr($s, 16, 20);
if (strcmp($db_token, $s) != 0) {
	rg_log('db token != mail token! [' . $db_token . '] != [' . $s . ']');
	exit(1);
}

// we add junk because I've seen cases when some junk was appended
$s .= 'junk';

rg_log('Loading the forgot link form...');
$data = array(); $headers = array();
$r = do_req($test_url . '/op/forgot_link/' . $s, $data, $headers);
if ($r === FALSE) {
	rg_log("Cannot load forgot_link page!");
	exit(1);
}

rg_log('Posting the forgot link form...');
$pass = rg_id(10);
$data = array(
	'forgot_token' => $s,
	'pass1' => $pass,
	'pass2' => $pass,
	'lock_ip' => 1,
	'doit' => 1
	);
$headers = array();
$r = do_req($test_url . '/op/forgot_link', $data, $headers);
if (!strstr($r['body'], 'Home page of user')) {
	rg_log_ml('r: ' . print_r($r, TRUE));
	rg_log('Cannot post forgot link form'
		. ' ("Home page of user" string not found)!');
	exit(1);
}
$sql = 'SELECT salt, pass FROM users WHERE uid = ' . $rg_ui['uid'];
$res = rg_sql_query($db, $sql);
$rows = rg_sql_num_rows($res);
if ($rows > 0)
	$row = rg_sql_fetch_array($res);
rg_sql_free_result($res);
if ($rows != 1) {
	rg_log('Seems the password was not changed!');
	exit(1);
}
$good_pass = rg_user_pass($row['salt'], $pass);
if (strcmp($good_pass, $row['pass']) != 0) {
	rg_log_ml('row: ' . print_r($row, TRUE));
	rg_log('passwords are not the same pass=[' . $pass . ']!');
	exit(1);
}
rg_log_exit();

// TODO: make sure that the entry from forgot_pass is gone


rg_prof_log();
rg_log("OK!");
?>