content model; add petition to database

2 files changed, 68 insertions, 17 deletions

diff --git a/public/app/controllers/Auth.php b/public/app/controllers/Auth.php
index e2fe989..9f440ed 100644
--- a/public/app/controllers/Auth.php
+++ b/public/app/controllers/Auth.php
@@ -136,7 +136,7 @@ class Auth {
      * setups and renders the form for a certain invitation
      * 
      * NOTE:
-     * after form is submited, client calls Auth::activate()
+     * after form is submited, client shall call Auth::activate()
      * 
      * @param $id (string|MD5) : invitation code
      * 
@@ -144,15 +144,13 @@ class Auth {
     public static function invitation($id)
     {
         // get user from invitation number
-        $user_array = Registry::use('database')->query(
-                "SELECT * FROM user WHERE invitation = :id",
-                ['id' => $id]
-            )->getFirst();
-        if ($user_array == false) {
+        $user_array = Access_model::getUserByInvitation($id);
+
+        if ($user_array == false) {     // no invitation ? serve error then die;
             Render::view('error/404', ['moto' => 'Δεν βρέθηκε η πρόσκληση']);
             die();
         }
-        $user = json_decode( json_encode($user_array, JSON_UNESCAPED_UNICODE));     // user in json format
+        $user = json_decode(json_encode($user_array, JSON_UNESCAPED_UNICODE));
 
         // format form_setup to a json array
         $form_setup = json_decode(json_encode(REGISTRATION_FORM, JSON_UNESCAPED_UNICODE));
@@ -342,6 +340,8 @@ class Auth {
 
     public static function in_admin_group()
     {
+        if (!self::is_connected())  return false;
+        
         $manager = new App_manager();
         return ($manager->isGranted([1, 2, 3]));
     }
diff --git a/public/app/controllers/Office.php b/public/app/controllers/Office.php
index 800247e..9ff4e14 100644
--- a/public/app/controllers/Office.php
+++ b/public/app/controllers/Office.php
@@ -6,7 +6,7 @@ use Registry;
 use Render;
 use app\controllers\Auth;
 use app\extends\App_manager;
-use app\models\Cms_model;
+use app\models\Content_model;
 use app\extends\Cache_service;
 
 /** Office class
@@ -112,10 +112,13 @@ class Office {
 
 
 
-    ## PETITIONS
-    ## -------------------------------------------------------------------------
-    ## secretarial support / teachers' requests and applications
 
+    ## -------------------------------------------------------------------------
+    ##
+    ## PETITION FORMS
+    ## secretarial support / serve forms for teachers' requests and applications
+    ##
+    ## -------------------------------------------------------------------------
 
 
     /** request any (empty/new) petition form
@@ -200,7 +203,7 @@ class Office {
         ]);
 
         // #5: create ticket; then render the view -----------------------------
-        $ticket = self::create_ticket($ticket);      // save ticket
+        $ticket = self::create_ticket();      // save ticket
         Render::view('templates/application', [
             'form' => $form,
             'applier' => (($userData['prefix'] == 'η') ? 'Η Αιτούσα' : 'Ο Αιτών'),
@@ -263,12 +266,55 @@ class Office {
 
     ## -------------------------------------------------------------------------
     ##
+    ## PETITION SUBMITS
+    ## handle submits of forms
+    ##
+    ## -------------------------------------------------------------------------
+
+
+    /** add_petition
+     * 
+     * handle an add petition request (petition form is submited)
+     * 
+     * @param void; all params are readed from POST, Auth and SESSION
+     * @return int new petition-id
+     */
+    public static function add_petition()
+    {
+        $post = Registry::get('REQUEST')->POST;
+
+                
+        if (self::remove_ticket($post['ticket'])) {     // check ticket + remove
+
+            $manager = new App_manager();
+
+            $new_id = Content_model::add_petition([
+                'user_id' => $manager->getUserToken()->getUser()->getID(),
+                'type_id' => $post['type_id'],
+                'subject' => $post['subject'],
+                'signature' => $post['ticket'],
+                'form_structure' => serialize($post)
+            ]);
+
+            Render::json([
+                'success' => true,
+                'id' => $new_id
+            ]);
+
+        } else {
+            Render::json(['success' => false, 'error' => TICKET_EXPIRED]);
+        }
+    }
+
+
+
+    ## -------------------------------------------------------------------------
+    ##
     ## TICKET METHODS (create, remove)
     ## tickets eliminate CSRF attacks
     ##
     ## -------------------------------------------------------------------------
 
-
     /** create_ticket
      * 
      * creates a tickef and saves it into session
@@ -278,24 +324,29 @@ class Office {
     private static function create_ticket()
     {
         // create ticket
-        $tick = md5( time() . Auth::user_data() . rand(1,65536) );
+        $tick = md5( time() . json_encode(Auth::user_data()) . rand(1,65536) );
         // then save to session
         if (isset($_SESSION['tickets'])) {
             $tickets = explode(',', $_SESSION['tickets']);
-            $tickets[] = $tick;
+
+            if (count($tickets) > 99) {     // if more than 99 tickets
+                array_shift($tickets);      // remove the older
+            }
+            $tickets[] = $tick;     // add new ticket to the tickets list
             $_SESSION['tickets'] = implode(',', $tickets);
 
         } else {
             $_SESSION['tickets'] = $tick;
         }
 
-        return $tick;
+        return $tick;               // return the xreated ticket
     }
 
+
     /** remove_ticker
      * 
      * removes a ticket and return true;
-     * if ticket not exists return fase;
+     * NOTE: if ticket not exists return false;
      * 
      * @param string $t : ticket (MD5)
      * @return boolean