kane-diagnostics/hubzilla/addon/scn01/scn01.php

<?php

/**
 * Name: SCN01 Scenarios
 * Description: Public civic diagnostic — browse and submit diagnostic scenarios in plain language.
 * Version: 0.3.0
 * MinVersion: 11.0
 * MaxVersion: 12.0
 */

use Zotlabs\Extend\Widget;

require_once 'addon/scn01/scn01_renderer.php';
require_once 'addon/scn01/scn01_spool.php';

function scn01_module() {}

function scn01_load() {
    register_hook('load_pdl', 'addon/scn01/scn01.php', 'scn01_load_pdl');
    Widget::register('addon/scn01/Widget/Scn01.php', 'scn01');
}

function scn01_unload() {
    unregister_hook('load_pdl', 'addon/scn01/scn01.php', 'scn01_load_pdl');
    Widget::unregister('addon/scn01/Widget/Scn01.php', 'scn01');
}

function scn01_load_pdl(&$b) {
    if (!is_array($b) || empty($b['module']) || $b['module'] !== 'scn01') {
        return;
    }
    $layout = @file_get_contents('addon/scn01/mod_scn01.pdl');
    if ($layout !== false) {
        $b['layout'] = $layout;
    }
}

// ---------------------------------------------------------------------------
// HELPERS
// ---------------------------------------------------------------------------

function scn01_h($value) {
    return htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8');
}

// ---------------------------------------------------------------------------
// ACCESS
// ---------------------------------------------------------------------------

function scn01_access_state($association_slug = '') {
    // Operator check — association channel owner (local channel only)
    if (local_channel()) {
        $channel = App::get_channel();
        if (local_channel() === intval($channel['channel_id'])) {
            return 'operator';
        }
    }

    if (!$association_slug) {
        return 'public';
    }

    // Load association config from vs01 — the single source of truth.
    $raw = @file_get_contents('addon/vs01/config.json');
    if ($raw === false) return 'public';
    $cfg = json_decode($raw, true);
    if (json_last_error() !== JSON_ERROR_NONE) return 'public';

    $assoc = $cfg['associations'][$association_slug] ?? null;
    if (!$assoc) return 'public';

    // get_observer_hash() works for both local channels and guest token visitors.
    $observer = get_observer_hash();
    if (!$observer) return 'public';

    $groups = $assoc['groups'] ?? [];

    // Direct pgrp_member query — does not call local_channel(), works for guest tokens.

    // Corpus Builder — highest participant tier
    $cb_gid = intval($groups['corpus_builder'] ?? 0);
    if ($cb_gid) {
        $r = q("SELECT xchan FROM pgrp_member WHERE gid = %d AND xchan = '%s' LIMIT 1",
            intval($cb_gid),
            dbesc($observer)
        );
        if ($r) return 'participant';
    }

    // SASE Participant
    $sase_gid = intval($groups['sase_participant'] ?? 0);
    if ($sase_gid) {
        $r = q("SELECT xchan FROM pgrp_member WHERE gid = %d AND xchan = '%s' LIMIT 1",
            intval($sase_gid),
            dbesc($observer)
        );
        if ($r) return 'participant';
    }

    // Civic Professional
    $prof_gid = intval($groups['civic_professional'] ?? 0);
    if ($prof_gid) {
        $r = q("SELECT xchan FROM pgrp_member WHERE gid = %d AND xchan = '%s' LIMIT 1",
            intval($prof_gid),
            dbesc($observer)
        );
        if ($r) return 'professional';
    }

    return 'public';
}

function scn01_access_wall($association_slug = '') {
    $raw   = @file_get_contents('addon/vs01/config.json');
    $cfg   = $raw ? json_decode($raw, true) : [];
    $assoc = $association_slug ? ($cfg['associations'][$association_slug] ?? null) : null;
    $name  = $assoc ? scn01_h($assoc['name']) : 'this association';
    return '
        <div class="scn01-content">
            <div class="alert alert-info" role="alert">
                <strong>HOA_MEMBER standing required to submit a record for ' . $name . '.</strong>
                Scenarios are public and readable by anyone.
                To submit a record, you must complete the SASE process.
                Visit <a href="https://directory.diagnostics.kane-il.us/channel/theron">
                    directory.diagnostics.kane-il.us
                </a> to begin.
            </div>
        </div>
    ';
}

// ---------------------------------------------------------------------------
// CONTENT ROUTER
// ---------------------------------------------------------------------------

function scn01_content() {
    if (function_exists('head_add_css')) {
        head_add_css('/addon/scn01/view/css/scn01.css');
    }
    if (function_exists('head_add_js')) {
        head_add_js('/addon/scn01/view/js/scn01.js');
    }

    $association_slug = argv(1) ?? '';

    // Index — no association selected
    if (!$association_slug) {
        return scn01_render_index();
    }

    $raw = @file_get_contents('addon/vs01/config.json');
    $cfg = $raw ? json_decode($raw, true) : [];
    if (json_last_error() !== JSON_ERROR_NONE || !isset($cfg['associations'][$association_slug])) {
        return scn01_render_not_found();
    }

    $access = scn01_access_state($association_slug);

    // POST — submission handler
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if ($access === 'public') {
            return scn01_access_wall($association_slug);
        }
        if (!scn01_verify_csrf()) {
            return '<div class="alert alert-danger">Invalid form token. Please reload and try again.</div>';
        }
        return scn01_handle_post($association_slug, $access);
    }

    // Association landing — carousel + submission form
    return scn01_render_landing($association_slug, $access);
}

// ---------------------------------------------------------------------------
// NOT FOUND
// ---------------------------------------------------------------------------

function scn01_render_not_found() {
    return '<div class="scn01-content"><div class="alert alert-warning">Association not found.</div></div>';
}

// ---------------------------------------------------------------------------
// CSRF
// ---------------------------------------------------------------------------

function scn01_csrf_token() {
    if (empty($_SESSION['scn01_csrf'])) {
        $_SESSION['scn01_csrf'] = bin2hex(random_bytes(16));
    }
    return '<input type="hidden" name="scn01_csrf" value="'
         . scn01_h($_SESSION['scn01_csrf']) . '">';
}

function scn01_verify_csrf() {
    return isset($_POST['scn01_csrf'], $_SESSION['scn01_csrf'])
        && hash_equals($_SESSION['scn01_csrf'], $_POST['scn01_csrf']);
}