Provider.php

<?php
namespace MultipleLocalAuth;
use Exception;
use MapasCulturais\i;
use Mustache\Mustache;
use MapasCulturais\App;
use MapasCulturais\Entities;
use Respect\Validation\Validator;
use MapasCulturais\Entities\Agent;

// AuthProvider inicia antes dos plugins; carrega dependências usadas em _getAuthenticatedUser().
if (!class_exists(__NAMESPACE__ . '\\GovBrAccountService', false)) {
    require_once __DIR__ . '/GovBr/GovBrAccountService.php';
}

class Provider extends \MapasCulturais\AuthProvider {
    protected $opauth;
    
    var $feedback_success   = false;
    var $feedback_msg       = '';
    var $triedEmail         = '';
    var $triedName          = '';
    
    public $register_form_action = '';
    public $register_form_method = 'POST';
    
    public static $passMetaName = 'localAuthenticationPassword';

    public static $recoverTokenMetadata     = 'recover_token';
    public static $recoverTokenTimeMetadata = 'recover_token_time';
    
    public static $accountIsActiveMetadata    = 'accountIsActive';
    public static $tokenVerifyAccountMetadata = 'tokenVerifyAccount';

    public static $pendingTrashRestoreConfirmMetadata = AccountLifecycleService::PENDING_TRASH_RESTORE_CONFIRM_METADATA;
    public static $pendingTrashRestoreSessionKey       = AccountLifecycleService::PENDING_TRASH_RESTORE_SESSION_KEY;

    public static $forcePasswordChangeMetadata = AccountLifecycleService::FORCE_PASSWORD_CHANGE_METADATA;

    public static $loginAttempMetadata            = "loginAttemp";
    public static $timeBlockedloginAttempMetadata = "timeBlockedloginAttemp";
    
    function __construct ($config) {
        $app = App::i();
        
        $config += [
            'salt' => env('AUTH_SALT', null),
            'timeout' => env('AUTH_TIMEOUT', '24 hours'),

            'loginOnRegister' => env('AUTH_LOGIN_ON_REGISTER', false),
    
            'enableLoginByCPF' => env('AUTH_LOGIN_BY_CPF', true),
            'requireCpf' => env('AUTH_REQUIRED_CPF', true),

            'passwordMustHaveCapitalLetters' => env('AUTH_PASS_CAPITAL_LETTERS', true),
            'passwordMustHaveLowercaseLetters' => env('AUTH_PASS_LOWERCASE_LETTERS', true),
            'passwordMustHaveSpecialCharacters' => env('AUTH_PASS_SPECIAL_CHARS', true),
            'passwordMustHaveNumbers' => env('AUTH_PASS_NUMBERS', true),
            'minimumPasswordLength' => env('AUTH_PASS_LENGTH', 6),
            'userMustConfirmEmailToUseTheSystem' =>  env('AUTH_EMAIL_CONFIRMATION', false),
    
            'google-recaptcha-secret' => env('GOOGLE_RECAPTCHA_SECRET', false),
            'google-recaptcha-sitekey' => env('GOOGLE_RECAPTCHA_SITEKEY', false),
    
            'sessionTime' => env('AUTH_SESSION_TIME', 7200), // int , tempo da sessao do usuario em segundos
            'numberloginAttemp' => env('AUTH_NUMBER_ATTEMPTS', 5), // tentativas de login antes de bloquear o usuario por X minutos
            'timeBlockedloginAttemp' => env('AUTH_BLOCK_TIME', 900), // tempo de bloqueio do usuario em segundos
    
            'metadataFieldCPF' => env('AUTH_METADATA_FIELD_DOCUMENT', 'documento'),
            'metadataFieldPhone' => env('AUTH_METADATA_FIELD_PHONE', 'telefone1'),

            'urlSupportChat' => env('AUTH_SUPPORT_CHAT', ''),
            'urlSupportEmail' => env('AUTH_SUPPORT_EMAIL', ''),
            'textSupportSite' => env('AUTH_SUPPORT_TEXT', ''),
            'urlSupportSite' => env('AUTH_SUPPORT_SITE', ''),
            'urlImageToUseInEmails' => env('AUTH_EMAIL_IMAGE'),

            'urlTermsOfUse' => env('LINK_TERMOS', $app->createUrl('auth', 'termos-e-condicoes')),
            'statusCreateAgent' => env('STATUS_CREATE_AGENT', Agent::STATUS_ENABLED),
            'strategies' => [
                'Facebook' => [
                    'visible' => env('AUTH_FACEBOOK_CLIENT_ID', false),
                    'app_id' => env('AUTH_FACEBOOK_APP_ID', null),
                    'app_id' => env('AUTH_FACEBOOK_APP_ID', null),
                    'app_secret' => env('AUTH_FACEBOOK_APP_SECRET', null),
                    'scope' => env('AUTH_FACEBOOK_SCOPE', 'email'),
                ],
                'LinkedIn' => [
                    'visible' => env('AUTH_LINKED_CLIENT_ID', false),
                    'api_key' => env('AUTH_LINKEDIN_API_KEY', null),
                    'secret_key' => env('AUTH_LINKEDIN_SECRET_KEY', null),
                    'redirect_uri' => $app->getBaseUrl() . 'autenticacao/linkedin/oauth2callback',
                    'scope' => env('AUTH_LINKEDIN_SCOPE', 'r_emailaddress')
                ],
                'Google' => [
                    'visible' => env('AUTH_GOOGLE_CLIENT_ID', false),
                    'client_id' => env('AUTH_GOOGLE_CLIENT_ID', null),
                    'client_secret' => env('AUTH_GOOGLE_CLIENT_SECRET', null),
                    'redirect_uri' => $app->getBaseUrl() . 'autenticacao/google/oauth2callback',
                    'scope' => env('AUTH_GOOGLE_SCOPE', 'email profile'),
                ],
                'Twitter' => [
                    'visible' => env('AUTH_TWITTER_CLIENT_ID', false),
                    'app_id' => env('AUTH_TWITTER_APP_ID', null),
                    'app_secret' => env('AUTH_TWITTER_APP_SECRET', null),
                ],
                'govbr' => [
                    'visible' => env('AUTH_GOV_BR_ID', false),
                    'response_type' => env('AUTH_GOV_BR_RESPONSE_TYPE', 'code'),
                    'client_id' => env('AUTH_GOV_BR_CLIENT_ID', null),
                    'client_secret' => env('AUTH_GOV_BR_SECRET', null),
                    'scope' => env('AUTH_GOV_BR_SCOPE', null),
                    'redirect_uri' => env('AUTH_GOV_BR_REDIRECT_URI', null), 
                    'auth_endpoint' => env('AUTH_GOV_BR_ENDPOINT', null),
                    'token_endpoint' => env('AUTH_GOV_BR_TOKEN_ENDPOINT', null),
                    'nonce' => env('AUTH_GOV_BR_NONCE', null),
                    'code_verifier' => env('AUTH_GOV_BR_CODE_VERIFIER', null),
                    'code_challenge' => env('AUTH_GOV_BR_CHALLENGE', null),
                    'code_challenge_method' => env('AUTH_GOV_BR_CHALLENGE_METHOD', null),
                    'userinfo_endpoint' => env('AUTH_GOV_BR_USERINFO_ENDPOINT', null),
                    'state_salt' => env('AUTH_GOV_BR_STATE_SALT', null),
                    'applySealId' => env('AUTH_GOV_BR_APPLY_SEAL_ID', null),
                    'menssagem_authenticated' => env('AUTH_GOV_BR_MENSSAGEM_AUTHENTICATED','Usuário já se autenticou pelo GovBr'),
                    'dic_agent_fields_update' => env('AUTH_GOV_BR_DICT_AGENT_FIELDS_UPDATE','[]')
                ],
                'decidim' => [
                    'visible' => env('AUTH_DECIDIM_CLIENT_ID', false),
                    'client_id' => env('AUTH_DECIDIM_CLIENT_ID', null),
                    'client_secret' => env('AUTH_DECIDIM_CLIENT_SECRET', null),
                    'redirect_uri' => env('AUTH_DECIDIM_REDIRECT_URI', null),
                    'scope' => env('AUTH_DECIDIM_SCOPE', null),
                    'auth_endpoint' => env('AUTH_DECIDIM_AUTH_ENDPOINT', null),
                    'token_endpoint' => env('AUTH_DECIDIM_TOKEN_ENDPOINT', null),
                    'userinfo_endpoint' => env('AUTH_DECIDIM_USERINFO_ENDPOINT', null),
                    'button_text' => env('AUTH_DECIDIM_BUTTON_TEXT', 'Entrar com Decidim'),
                ]
            ]
        ];
        parent::__construct($config);
    }

    function dump($x) {
        \Doctrine\Common\Util\Debug::dump($x);
    }
    
    function setFeedback($msg, $success = false) {
        $this->feedback_success = $success;
        $this->feedback_msg = $msg;
        return $success;
    }

    protected function usingSocialLogin() {
        return is_array($this->_config['strategies']) && count($this->_config['strategies']) > 0;
    }
    
    protected function _init() {

        $app = App::i();
        $config = $this->_config;

        $app->hook('GET(auth.passwordvalidationinfos)', function () use($config){
            
            $passwordRules = array(
                "passwordMustHaveCapitalLetters" => $config['passwordMustHaveCapitalLetters'],
                "passwordMustHaveLowercaseLetters" => $config['passwordMustHaveLowercaseLetters'],
                "passwordMustHaveSpecialCharacters" => $config['passwordMustHaveSpecialCharacters'],
                "passwordMustHaveNumbers" => $config['passwordMustHaveNumbers'],
                "minimumPasswordLength" => $config['minimumPasswordLength'],
            );

            $this->json(array("passwordRules"=>$passwordRules));
        });

        /**
         * @todo refatorar confirma-email
         */

        $app->hook('GET(auth.confirma-email)', function () use($app){
            $app = App::i();
            $token = $app->request->get('token');

            $usermeta = $app->repo("UserMeta")->findOneBy(array('key' => Provider::$tokenVerifyAccountMetadata, 'value' => $token));

            if (!$usermeta) {
               $errorMsg = i::__('Token inválidos', 'multipleLocal');                         
               $this->render('confirm-email',['msg'=>$errorMsg]);   
            }

            $user = $usermeta->owner;
            $user->setMetadata(Provider::$accountIsActiveMetadata, '1');

            $app->disableAccessControl();

            // só agora, com o link do email confirmado, a conta (e tudo que foi pra lixeira
            // junto com ela) realmente sai da lixeira.
            if (AccountLifecycleService::shouldRestoreOnEmailConfirm($user->getMetadata(Provider::$pendingTrashRestoreConfirmMetadata))) {
                $user->setMetadata(Provider::$pendingTrashRestoreConfirmMetadata, '0');
                $app->auth->restoreUserFromTrash($user, true);
            }

            $user->saveMetadata(true);
            $app->enableAccessControl();
            $app->em->flush();

            // Se loginOnRegister está ligado mas o e-mail é obrigatório, o auto-login
            // foi adiado para cá (cadastro não autentica conta ainda inativa).
            if (!empty(($app->config['auth.config'] ?? [])['loginOnRegister'])) {
                $app->auth->authenticateUser($user);
                $app->applyHook('auth.successful');
            }

            $this->render('confirm-email');
        });

        $app->hook('POST(auth.adminchangeuseremail)',function () use ($app) {
            $new_email = $this->data['new_email'];
            $email = $this->data['email'];
 
            $user = $app->auth->getUserFromDB($email);

            // email exists? (case insensitive)
            $checkEmailExistsQuery = $app->em->createQuery("SELECT u FROM \MapasCulturais\Entities\User u WHERE LOWER(u.email) = :email");
            $checkEmailExistsQuery->setParameter('email', strtolower($new_email));
            $checkEmailExists = $checkEmailExistsQuery->getResult();

            if (!empty($checkEmailExists)) {
                $this->json (array("error"=>"Este endereço de email já está em uso"));
            }

            if (Validator::email()->validate($new_email)) {
                $user->email = $new_email;

                // save
                $app->disableAccessControl();
                $user->saveMetadata(true);
                $app->enableAccessControl();
                $user->save(true);
                $app->em->flush();

                $this->json (array("new_email"=>$new_email));
            } else {
                $this->json (array("error"=>"Informe um email válido"));
            }            
        });

        $app->hook('adminchangeuseremail', function ($userEmail) use($app){

            if(!$app->user->is('admin')) {
                return;
            }

            echo
            '
            <a class="btn btn-primary js-open-dialog" data-dialog="#admin-change-user-email" data-dialog-block="true">
                Alterar email para: '.$userEmail.'
            </a>

            <div id="admin-change-user-email" class="js-dialog" title="Alterar email">
                <label for="new-email">Novo email:</label><br>
                <input type="text" id="new-email" name="new-email" ><br>
                <input type="hidden" id="email-to-admin-set-email" value='.$userEmail.' />
                <button class="btn add" id="user-managerment-adminChangeEmail" > Atualizar </button>
            </div>
            ';
        });

        /* /refatorar/ */

        
        
        $config = $this->_config;
        
        $config['path'] = preg_replace('#^https?\:\/\/[^\/]*(/.*)#', '$1', $app->createUrl('auth'));
        
        /****** INIT OPAUTH ******/
        
        if ($this->usingSocialLogin()){
            $opauth_config = [
                'strategy_dir' => PROTECTED_PATH . '/vendor/opauth/',
                'Strategy' => $config['strategies'],
                'security_salt' => $config['salt'],
                'security_timeout' => $config['timeout'],
                'path' => $config['path'],
                'callback_url' => $app->createUrl('auth','response')
            ];
            
            $opauth = new \Opauth($opauth_config, false );
            $this->opauth = $opauth;
        }
        

        // Register form config
        $this->register_form_action = $app->createUrl('auth', 'register');    
        if(isset($config['register_form'])){
            $this->register_form_action = $config['register_form']['action'];
            $this->register_form_method = $config['register_form']['method'];
        }

        // add actions to auth controller
        $app->hook('GET(auth.index)', function () use($app, $config){
            $this->render('multiple-local', [
                'config' => $config,
                'forcePasswordChange' => $app->auth->userMustChangePassword(),
            ]);
        });

        $app->hook('GET(auth.register)', function () use($config){
            $this->render("register", [ 'config' => $config ]);
        });

        $app->hook('GET(auth.recover)', function () use($config){
            $this->render("pass-recover", [ 'config' => $config ]);
        });

        $providers = [];

        if($this->usingSocialLogin()){
            $providers = implode('|', array_keys($config['strategies']));

            $app->hook("<<GET|POST>>(auth.<<{$providers}>>)", function () use($opauth, $config){
                $opauth->run();
            });
        }
        
        $app->hook('GET(auth.response)', function () use($app){

            $app->auth->processResponse();
            if($app->auth->isUserAuthenticated()){
                $app->applyHook('auth.successful');

                $redirect_url = $app->auth->getRedirectPath();
                unset($_SESSION['mapasculturais.auth.redirect_path']);
                
                $app->redirect($redirect_url);
            }else{
                $app->applyHook('auth.failed');
                $app->redirect($this->createUrl(''));
            }
        });

        // Coleta de e-mail alternativo quando o e-mail do Gov.br já existe no Mapa
        $app->hook('GET(auth.govbr-email)', function () use ($app, $config) {
            $pending = GovBrAccountService::getPendingRegistration();
            if (!$pending) {
                $app->redirect($this->createUrl(''));
                return;
            }

            $conflict_email = GovBrAccountService::extractEmailFromResponse($pending);
            $this->render('govbr-email', [
                'config' => $config,
                'conflictEmail' => $conflict_email,
                'formAction' => $app->createUrl('auth', 'govbr-email'),
            ]);
        });

        $app->hook('POST(auth.govbr-email)', function () use ($app, $config) {
            /** @var \MultipleLocalAuth\Provider $auth */
            $auth = $app->auth;
            $pending = GovBrAccountService::getPendingRegistration();
            if (!$pending) {
                $app->redirect($this->createUrl(''));
                return;
            }

            $new_email = $app->request->post('email');
            $errors = GovBrAccountService::validateAlternateEmail($new_email);
            if ($errors) {
                $this->render('govbr-email', [
                    'config' => $config,
                    'conflictEmail' => GovBrAccountService::extractEmailFromResponse($pending),
                    'formAction' => $app->createUrl('auth', 'govbr-email'),
                    'errors' => $errors,
                    'triedEmail' => $new_email,
                ]);
                return;
            }

            $response = GovBrAccountService::applyEmailToResponse($pending, $new_email);
            GovBrAccountService::clearPendingRegistration();

            $user = $auth->createUserFromGovBrPending($response);
            if (!$user) {
                GovBrAccountService::storePendingRegistration($pending);
                $this->render('govbr-email', [
                    'config' => $config,
                    'conflictEmail' => GovBrAccountService::extractEmailFromResponse($pending),
                    'formAction' => $app->createUrl('auth', 'govbr-email'),
                    'errors' => [i::__('Não foi possível criar o usuário. Tente novamente.', 'multipleLocal')],
                    'triedEmail' => $new_email,
                ]);
                return;
            }

            $auth->authenticateUser($user);

            if (method_exists('GovBrStrategy', 'verifyUpdateData')) {
                \GovBrStrategy::verifyUpdateData($user, $response);
            }
            if (method_exists('GovBrStrategy', 'applySeal')) {
                \GovBrStrategy::applySeal($user, $response);
            }

            $app->applyHook('auth.successful');
            $redirect_url = $auth->getRedirectPath();
            unset($_SESSION['mapasculturais.auth.redirect_path']);
            $app->redirect($redirect_url);
        });


        /******* INIT LOCAL AUTH **********/

        $app->hook('POST(auth.validate)', function () use($app) {
            /**
             * @var \MapasCulturais\Controller $this
             */

            $validateFields = $app->auth->validateRegisterFields();

            if ($validateFields['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($validateFields['errors'], 200);
            }
        });

        $app->hook('POST(auth.register)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */

            $registration = $app->auth->doRegister();

            if ($registration['success']) {
                $registration['error'] = false;
                $this->json($registration);
            } else {
                $this->errorJson($registration['errors'], 200);
            }
        });
        
        $app->hook('POST(auth.login)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */

            $login = $app->auth->doLogin();

            if ($login['success']) {
                // Mantém auth.successful (AccountStatus, lastLogin, etc.), mas:
                // 1) grava a sessão ANTES do trabalho pesado do hook
                // 2) responde o JSON na hora
                // 3) roda o hook no shutdown (após a resposta ao browser)
                $redirectTo = $app->auth->getRedirectPath();

                if (session_status() === PHP_SESSION_ACTIVE) {
                    session_write_close();
                }

                register_shutdown_function(function () use ($app) {
                    try {
                        ignore_user_abort(true);
                        set_time_limit(120);
                        if (function_exists('fastcgi_finish_request')) {
                            @fastcgi_finish_request();
                        }
                        $app->applyHook('auth.successful');
                    } catch (\Throwable $e) {
                        $app->log->error('auth.successful after login failed: ' . $e->getMessage());
                    }
                });

                $this->json([
                    'error' => false,
                    'redirectTo' => $redirectTo
                ]);
            } else if (!empty($login['accountInTrash'])) {
                $this->json([
                    'error' => true,
                    'accountInTrash' => true,
                    'profileName' => $login['profileName'],
                ]);
            } else {
                $this->errorJson($login['errors'], 200);
            }
        });

        $app->hook('POST(auth.confirmrestore)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */

            $restore = $app->auth->confirmRestoreAccount();

            if ($restore['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($restore['errors'], 200);
            }
        });

        $app->hook('POST(auth.recover)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */
            
            $requestRecover = $app->auth->recover();

            if ($requestRecover['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($requestRecover['errors'], 200);
            }
        });

        $app->hook('POST(auth.dorecover)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */
            
            $doRecover = $app->auth->doRecover();

            if ($doRecover['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($doRecover['errors'], 200);
            }
        });

        $app->hook('POST(auth.changepassword)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */
            
            $changePassword = $app->auth->changePassword();

            if ($changePassword['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($changePassword['errors'], 200);
            }
        });

        $app->hook('POST(auth.doforcedpasswordchange)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */

            $this->requireAuthentication();

            $doForcedPasswordChange = $app->auth->doForcedPasswordChange();

            if ($doForcedPasswordChange['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($doForcedPasswordChange['errors'], 200);
            }
        });

        $app->hook('POST(auth.newpassword)', function () use($app){
            /**
             * @var \MapasCulturais\Controller $this
             */
            
            $newPassword = $app->auth->newPassword();

            if ($newPassword['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($newPassword['errors'], 200);
            }
        });

        $app->hook('POST(auth.adminchangeuserpassword)',function () use ($app) {  
            /**
             * @var \MapasCulturais\Controller $this
             */
            
            $adminchangeuserpassword = $app->auth->adminchangeuserpassword();

            if ($adminchangeuserpassword['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($adminchangeuserpassword['errors'], 200);
            }
        });

        $app->hook('POST(auth.forcepasswordchange)', function () use ($app) {
            /**
             * @var \MapasCulturais\Controller $this
             */

            $forcePasswordChange = $app->auth->forcePasswordChange();

            if ($forcePasswordChange['success']) {
                $this->json(['error' => false]);
            } else {
                $this->errorJson($forcePasswordChange['errors'], 200);
            }
        });

        $app->hook('auth.redirectUrl', function (&$redirect) use ($app) {
            if ($app->auth->userMustChangePassword()) {
                $redirect = $app->createUrl('auth', 'index');
            }
        });

        // Enquanto a troca de senha estiver pendente, o usuário fica preso em /autenticacao/
        // (form de troca, logout e endpoints auxiliares do auth). Qualquer outra rota
        // (incluindo API) redireciona de volta — o controller auth fica liberado.
        // O padrão segue o do módulo LGPD: callAction dispara ALL(controller.action):before,
        // então ALL(<<*>>):before casa com qualquer controller/ação.
        $app->hook('ALL(<<*>>):before,API(<<*>>):before,-ALL(auth.<<*>>):before,-API(auth.<<*>>):before', function () use ($app) {
            /** @var \MapasCulturais\Controller $this */
            if (!$app->auth->userMustChangePassword()) {
                return;
            }

            if ($app->request->isAjax()) {
                $app->halt(403, i::__('É necessário trocar a senha antes de continuar.', 'multipleLocal'));
            }

            $app->redirect($app->createUrl('auth', 'index'));
        });


        $app->hook('panel.menu:after', function () use($app){
        
            $active = $this->template == 'panel/my-account' ? 'class="active"' : '';
            $url = $app->createUrl('panel', 'my-account');
            $label = i::__('Minha conta', 'multipleLocal');
            
            echo "<li><a href='$url' $active><span class='icon icon-my-account'></span> $label</a></li>";
        
        });

        $app->applyHook('auth.provider.init');        
    }
    
    
    /********************************************************************************/
    /**************************** LOCAL AUTH METHODS  *******************************/
    /********************************************************************************/

    function json($data, $status = 200) {
        $app = App::i();
        $app->contentType('application/json');
        $app->halt($status, json_encode($data));
    }
    

    function verificarToken($token, $claveSecreta)
    {
        $url = "https://www.google.com/recaptcha/api/siteverify";
        $datos = [
            "secret" => $claveSecreta,
            "response" => $token,
        ];
        $opciones = array(
            "http" => array(
            "header" => "Content-type: application/x-www-form-urlencoded\r\n",
            "method" => "POST",
            "content" => http_build_query($datos), # Agregar el contenido definido antes
           ),
        );
        $contexto = stream_context_create($opciones);
        $resultado = file_get_contents($url, false, $contexto);
        if ($resultado === false) {
            return false;
        }
        $resultado = json_decode($resultado);
        $pruebaPasada = $resultado->success;
        return $pruebaPasada;
    }

    function verifyRecaptcha2() {
        $config = $this->_config;

        if (!$config['google-recaptcha-sitekey']) return true;
        if (empty($_POST["g-recaptcha-response"])) return false;

        $token = $_POST["g-recaptcha-response"];
        $verified = $this->verificarToken($token, $config["google-recaptcha-secret"]);   

        return $verified ? true : false;
    }

    function verifyPassowrds($pass, $verify) {
        $config = $this->_config;
        $passwordLength = $config['minimumPasswordLength'];
        $errors = [];

        if(!empty($pass) && $pass != "" ){
            if (strlen($pass) < $passwordLength) {
                array_push($errors, i::__("Sua senha deve conter pelo menos ".$passwordLength." dígitos!", 'multipleLocal'));
            }
            if($config['passwordMustHaveNumbers'] && !preg_match("#[0-9]+#",$pass)) {
                array_push($errors, i::__(" Sua senha deve conter pelo menos 1 número!", 'multipleLocal'));
            }
            if($config['passwordMustHaveCapitalLetters'] && !preg_match("#[A-Z]+#",$pass)) {
                array_push($errors, i::__(" Sua senha deve conter pelo menos 1 letra maiúscula!", 'multipleLocal'));
            }
            if($config['passwordMustHaveLowercaseLetters'] && !preg_match("#[a-z]+#",$pass)) {
                array_push($errors, i::__(" Sua senha deve conter pelo menos 1 letra minúscula!", 'multipleLocal'));
            }
            if($config['passwordMustHaveSpecialCharacters'] && !preg_match('/[\'^£$%&*()}{@#~?><>,|=_"!¨+`´\[\].;:\/-]/', $pass)) {
                array_push($errors, i::__(" Sua senha deve conter pelo menos 1 caractere especial!", 'multipleLocal'));
            }
        }else{
            array_push($errors, i::__("Por favor, insira sua senha.", 'multipleLocal'));
        }

        if ($pass != $verify) {
            array_push($errors, i::__("As senhas não conferem.", 'multipleLocal'));
        }
        
        return $errors;
    }


    /**
     * @todo refatorar validação dos campos
     */
    function validateRegisterFields() {
        $app = App::i();
        $em = $app->em;
        $conn = $em->getConnection();

        $config = $this->_config;
        $hasErrors = false;

        $cpf = $app->request->post('cpf');
        $email = filter_var( $app->request->post('email') , FILTER_SANITIZE_EMAIL);
        $pass = $app->request->post('password');
        $pass_v = $app->request->post('confirm_password');
        $this->triedEmail = $email;

        $errors = [
            'captcha' => [],
            'user' => [
                'cpf' => [],
                'email' => [],
                'password' => []
            ]
        ];

        // validate captcha
        if (!$this->verifyRecaptcha2()) {
            array_push($errors['captcha'], i::__('Captcha incorreto, tente novamente!', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        // validates cpf only if login by cpf is enabled
        if($config['enableLoginByCPF']) {

            // validate cpf
            if($config['requireCpf'] && !$this->validateCPF($cpf)) {
                array_push($errors['user']['cpf'], i::__('Por favor, informe um cpf válido.', 'multipleLocal'));
                $hasErrors = true;
            }
            
            if($this->validateCPF($cpf)) {
                $foundAgent = [];
                $metadataFieldCpf = $this->getMetadataFieldCpfFromConfig();
                
                $_cpf = implode("','", [$cpf, preg_replace('/[^0-9]/i', '', $cpf)]);
                $foundAgent = $conn->fetchAll("SELECT * FROM agent_meta WHERE key IN ('{$metadataFieldCpf}', 'cpf') AND value IN ('{$_cpf}')");

                // creates an array with agents with status == 1, because the user can have, for example, 3 agents, but 2 have status == 0
                $existAgent  = [];
                if($foundAgent){
                    foreach ($foundAgent as $agentMeta) {
                        if($agentMeta->owner->status >= 0) {
                            $existAgent[] = $agentMeta;
                        }
                    }
                }

                if(count($existAgent) > 0) {
                    array_push($errors['user']['cpf'], i::__('Este CPF já esta em uso. Tente recuperar a sua senha.', 'multipleLocal'));
                    $hasErrors = true;
                }
            }

        }
        
        // check if email exists (case insensitive)
        $checkEmailExistsQuery = $app->em->createQuery("SELECT u FROM \MapasCulturais\Entities\User u WHERE LOWER(u.email) = :email");
        $checkEmailExistsQuery->setParameter('email', strtolower($email));
        $checkEmailExists = $checkEmailExistsQuery->getResult();
        if (!empty($checkEmailExists)) {
            array_push($errors['user']['email'], i::__('Este endereço de email já está em uso. Tente recuperar a sua senha.', 'multipleLocal'));
            $hasErrors = true;
        }
        
        // validate email
        if (empty($email) || Validator::email()->validate($email) !== true) {
            array_push($errors['user']['email'], i::__('Por favor, informe um email válido.', 'multipleLocal'));
            $hasErrors = true;
        }

        // validate password
        $errors['user']['password'] = $this->verifyPassowrds($pass, $pass_v);
        if (!empty($errors['user']['password'])) {
            $hasErrors = true;
        }
        
        return [
            'success' => !$hasErrors,
            'errors' => $errors
        ];
    }

    function hashPassword($pass) {
        return password_hash($pass, PASSWORD_DEFAULT);
    }
    
    
    // RECOVER PASSWORD
    
    function renderRecoverForm($theme) {
        $app = App::i();
        $theme->render('pass-recover', [
            'form_action' => $app->createUrl('auth', 'dorecover') . '?t=' . $app->request->get('t'),
            'feedback_success' => $app->auth->feedback_success,
            'feedback_msg' => $app->auth->feedback_msg,   
            'triedEmail' => $app->auth->triedEmail,
        ]);
    }
    
    function dorecover() {
        $app = App::i();

        $hasErrors = false;
        $errors = [
            'password' => [],
            'token' => []
        ];

        $token = $app->request->post('token');
        $q = new \MapasCulturais\ApiQuery('MapasCulturais\\Entities\\User', ['recover_token' => 'EQ('.$token.')', '@select' => 'id, email, recover_token_time']);
        $result = $q->getFindOneResult();

        if (!$result) {
            array_push($errors['token'], i::__('Token não encontrado.', 'multipleLocal'));
            $hasErrors = true;
        }

        $pass = $app->request->post('password');
        $pass_v = $app->request->post('confirm_password');
        $user = $app->repo("User")->find($result['id']);
    
        // check if token is still valid
        $now = time();
        $diff = $now - intval($result['recover_token_time']);
        
        if ($diff > HOUR_IN_SECONDS) {            
            $user->recover_token = null;
            $user->recover_token_time = null;
            $app->disableAccessControl();
            $user->save(true); 
            $app->enableAccessControl();

            array_push($errors['token'], i::__('Este token expirou.', 'multipleLocal'));
            $hasErrors = true;
        }
        
        $errors['password'] = $this->verifyPassowrds($pass, $pass_v);
        if (!empty($errors['password'])) {
            $hasErrors = true;
        }

        if (!$hasErrors) {
        
            $user->setMetadata(self::$passMetaName, $this->hashPassword($pass));
            $user->setMetadata(Provider::$accountIsActiveMetadata, '1');
            
            $user->recover_token = null;
            $user->recover_token_time = null;

            $app->disableAccessControl();
            $user->save(true); 
            $app->enableAccessControl();
            
            $this->middlewareLoginAttempts(true); //tira o BAN de login do usuario

            return [ 
                'success' => true
            ];
        } else {
            return [ 
                'success' => false,
                'errors' => $errors
            ];
        }
    }
    
    function recover() {
        $app = App::i();
        $config = $app->_config;
        $email = filter_var($app->request->post('email'), FILTER_VALIDATE_EMAIL);
        $user = $app->repo("User")->findOneBy(array('email' => $email));

        $hasErrors = false;
        $errors = [
            'captcha' => [],
            'email' => [],
            'sendEmail' => []
        ];
        
        if (!$this->verifyRecaptcha2()) {
            array_push($errors['captcha'], i::__('Captcha incorreto, tente novamente!', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }
        
        if (!$user) {
            array_push($errors['email'], i::__('Email não encontrado', 'multipleLocal'));
            $hasErrors = true;
        }

        if (!$hasErrors) {
            // generate the hash
            $source = rand(3333, 8888);
            $cut = rand(10, 30);
            $string = $this->hashPassword($source);
            $token = substr($string, $cut, 20);
            
            // save hash and created time
            $app->disableAccessControl();
            $user->setMetadata('recover_token', $token);
            $user->setMetadata('recover_token_time', time());
            $user->saveMetadata();
            $app->em->flush();
            $app->enableAccessControl();
            
            
            // build recover URL
            $url = $app->createUrl('auth', 'index') . '?t=' . $token;
            
            $site_name = $app->siteName;

            // send email
            $email_subject = sprintf(i::__('Pedido de recuperação de senha para %s', 'multipleLocal'), $site_name);
            $mustache = new \Mustache_Engine();

            $content = $mustache->render(
                file_get_contents(
                    // @todo: usar a $app->view->getTemplatePathname()
                    __DIR__.
                    DIRECTORY_SEPARATOR.'views'.
                    DIRECTORY_SEPARATOR.'auth'.
                    DIRECTORY_SEPARATOR.'email-resert-password.html'
                ), array(
                    "url" => $url,
                    "user" => $user->email,
                    "siteName" => $site_name,
                    "urlSupportChat" => $this->_config['urlSupportChat'],
                    "urlSupportEmail" => $this->_config['urlSupportEmail'],
                    "urlSupportSite" => $this->_config['urlSupportSite'],
                    "textSupportSite" => $this->_config['textSupportSite'],
                    "urlImageToUseInEmails" => $this->getImageImageURl(),
                ));
            
            $app->applyHook('multipleLocalAuth.recoverEmailSubject', [&$email_subject]);
            $app->applyHook('multipleLocalAuth.recoverEmailBody', [&$content]);
            
            if ($app->createAndSendMailMessage([
                    'from' => $app->config['mailer.from'],
                    'to' => $user->email,
                    'subject' => $email_subject,
                    'body' => $content
                ])) {
                    
                return [ 
                    'success' => true
                ];
            } else {
                array_push($errors['sendEmail'], i::__('Erro ao enviar email de recuperação. Entre em contato com os administradors do site.', 'multipleLocal'));
                return [ 
                    'success' => false,
                    'errors' => $errors
                ];
            }
        } else {
            return [ 
                'success' => false,
                'errors' => $errors
            ];
        }
    }

    function adminchangeuserpassword() {
        $app = App::i();

        $new_pass = $app->request->post('new_password');
        $confirm_new_pass = $app->request->post('confirm_new_password');
        $email = $app->request->post('email');

        $user = $app->auth->getUserFromDB($email);

        $hasErrors = false;
        $errors = [
            'password' => [],
        ];

        if ($new_pass != '') {  
            $errors['password'] = $this->verifyPassowrds($new_pass, $confirm_new_pass);

            if (!empty($errors['password'])) {
                $hasErrors = true;
            } else {
                $user->setMetadata('localAuthenticationPassword', $app->auth->hashPassword($new_pass));
            }
        } else {
            array_push($errors['password'], i::__('Insira sua nova senha.', 'multipleLocal'));
            $hasErrors = true;
        }
        
        if (!$hasErrors) {
            $user->setMetadata(self::$forcePasswordChangeMetadata, '0');

            $app->disableAccessControl();
            $user->saveMetadata(true);
            $app->enableAccessControl();
            $user->save(true);
            $app->em->flush();
            return [
                'success' => true
            ];
        } else {
            return [
                'success' => false,
                'errors' => $errors
            ];
        }
    }

    /**
     * Ação de admin: marca o usuário para ser obrigado a trocar a senha no próximo login
     * bem-sucedido (o redirecionamento pós-login é tratado no hook 'auth.redirectUrl').
     */
    function forcePasswordChange() {
        $app = App::i();

        $errors = [
            'forcePasswordChange' => []
        ];

        $email = $app->request->post('email');
        $user = $this->getUserFromDB($email);

        $preconditionError = AccountLifecycleService::forcePasswordChangeError(
            $app->user->is('admin'),
            (bool) $user
        );

        if ($preconditionError === 'permission') {
            array_push($errors['forcePasswordChange'], i::__('Você não tem permissão para executar esta ação.', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        if ($preconditionError === 'not_found') {
            array_push($errors['forcePasswordChange'], i::__('Usuário não encontrado.', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        $user->setMetadata(self::$forcePasswordChangeMetadata, '1');

        $app->disableAccessControl();
        $user->saveMetadata(true);
        $app->enableAccessControl();
        $app->em->flush();

        return [
            'success' => true
        ];
    }

    /**
     * True se o usuário logado precisa trocar a senha antes de continuar usando o sistema
     * (flag marcada por um admin via forcePasswordChange()).
     */
    function userMustChangePassword() {
        $app = App::i();
        $user = $app->user;

        return $user instanceof Entities\User
            && AccountLifecycleService::mustChangePassword($user->getMetadata(self::$forcePasswordChangeMetadata));
    }

    /**
     * Troca a senha do usuário já autenticado que está com a troca de senha obrigatória
     * pendente. Diferente de changePassword(), não pede a senha atual: o próprio login
     * bem-sucedido (com a senha antiga) já provou que o usuário é quem diz ser.
     */
    function doForcedPasswordChange() {
        $app = App::i();
        $user = $app->user;

        $hasErrors = false;
        $errors = [
            'password' => [],
        ];

        if (!AccountLifecycleService::canDoForcedPasswordChange($this->userMustChangePassword())) {
            array_push($errors['password'], i::__('Não há troca de senha pendente para este usuário.', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        $newPassword = $app->request->post('new_password');
        $confirmNewPassword = $app->request->post('confirm_new_password');

        $errors['password'] = $this->verifyPassowrds($newPassword, $confirmNewPassword);
        if (!empty($errors['password'])) {
            $hasErrors = true;
        } else {
            $user->setMetadata(self::$passMetaName, $this->hashPassword($newPassword));
            $user->setMetadata(self::$forcePasswordChangeMetadata, '0');
        }

        if (!$hasErrors) {
            $user->save(true);
            return [
                'success' => true
            ];
        } else {
            return [
                'success' => false,
                'errors' => $errors
            ];
        }
    }

    function changePassword() {
        $app = App::i();        
        $user = $app->user;

        $currentPassword    = $app->request->post('current_password');
        $newPassword        = $app->request->post('new_password');
        $confirmNewPassword = $app->request->post('confirm_new_password');
        
        $hasErrors = false;
        $errors = [
            'password' => [],
        ];

        if ($newPassword != '') { 
            $meta = self::$passMetaName;
            $currentSavedPassword = $user->getMetadata($meta);

            if (password_verify($currentPassword, $currentSavedPassword)) {                
                $errors['password'] = $this->verifyPassowrds($newPassword, $confirmNewPassword);
                if (!empty($errors['password'])) {
                    $hasErrors = true;
                } else {
                    $user->setMetadata($meta, $app->auth->hashPassword($newPassword));
                    $user->setMetadata(self::$forcePasswordChangeMetadata, '0');
                }
            } else {
                array_push($errors['password'], i::__('Senha atual inválida.', 'multipleLocal'));
                $hasErrors = true;
            }

        } else {
            array_push($errors['password'], i::__('Insira sua nova senha.', 'multipleLocal'));
            $hasErrors = true;
        }

        if (!$hasErrors) {
            $user->save(true);
            return [ 
                'success' => true
            ];
        } else {
            return [ 
                'success' => false,
                'errors' => $errors
            ];
        }
    }

    function renderForm($theme) {
        $app = App::i();
        $config = $this->_config;

        $jsLabelsInternationalization = [
            'passwordMustHaveCapitalLetters'=> i::__('A senha deve conter uma letra maiúscula', 'multipleLocal'),
            'passwordMustHaveLowercaseLetters'=> i::__('A senha deve conter uma letra minúscula', 'multipleLocal'),
            'passwordMustHaveSpecialCharacters'=> i::__('A senha deve conter um caractere especial', 'multipleLocal'),
            'passwordMustHaveNumbers'=> i::__('A senha deve conter um número ', 'multipleLocal'),
            'minimumPasswordLength'=> i::__('O tamanho mínimo da senha é de: ', 'multipleLocal'),
        ];

        $theme->render('multiple-local', [
            'jsLabelsInternationalization'  => $jsLabelsInternationalization,
            'config'                        => $config,
            'register_form_action'          => $app->auth->register_form_action,
            'register_form_method'          => $app->auth->register_form_method,
            'login_form_action'             => $app->createUrl('auth', 'login'),
            'recover_form_action'           => $app->createUrl('auth', 'recover'),
            'feedback_success'              => $app->auth->feedback_success,
            'feedback_msg'                  => $app->auth->feedback_msg,   
            'triedEmail'                    => $app->auth->triedEmail,
            'triedName'                     => $app->auth->triedName,
        ]);

    }

    //cria um metadata que bloqueia o usuario por 'X minutos' se tentar se logar 'TENTATIVAS' e não conseguir
    function middlewareLoginAttempts($deleteBlockedTime = false) {

        $app = App::i();
        $email = $app->request->post('email');
        $user = $app->repo("User")->findOneBy(array('email' => $email));

        $config = $this->_config;
        $numberloginAttemp = $config['numberloginAttemp'];
        $timeBlockedloginAttemp = $config['timeBlockedloginAttemp'];

        //se nao encontrar um user, ignore o middleware
        if(!$user) {
            return false;
        }
  
        //pegue o metadata de tentativas de login 
        $loginAttempMetadata = $user->getMetadata(self::$loginAttempMetadata);

        //nao existe? entao crie pela primeira vez
        if(!$loginAttempMetadata) {
            $user->setMetadata(self::$loginAttempMetadata, 0);
        }

        //se o metadata existe, for menor ou = a 'TENTATIVAS' de login && o tempo de ban for menor que o tempo de agora, some a tentativa de login +1
        if($loginAttempMetadata <= $numberloginAttemp && $user->getMetadata(self::$timeBlockedloginAttempMetadata) < time()) {

            $user->setMetadata(self::$loginAttempMetadata, intval($loginAttempMetadata) + 1);
        }

        //se tentou logar mais que 'TENTATIVAS', e o tempo de ban for menor doque o tempo de agora, dê um ban de X minutos
        if($loginAttempMetadata > $numberloginAttemp && $user->getMetadata(self::$timeBlockedloginAttempMetadata) < time()) {
            $user->setMetadata(self::$timeBlockedloginAttempMetadata, time() + $timeBlockedloginAttemp ); 
            $user->setMetadata(self::$loginAttempMetadata, 0 );
        }

        // se o parametro deleteBlockedTime for true, então tire o BAN do usuario
        if($deleteBlockedTime) {
            $user->setMetadata(self::$timeBlockedloginAttempMetadata, 0 );
            $user->setMetadata(self::$loginAttempMetadata, 0 );
        }

        $app->disableAccessControl();
        $user->saveMetadata(true);
        $app->enableAccessControl();
    }

    function validateCPF($cpf) {
 
        // Extrai somente os números
        $cpf = preg_replace( '/[^0-9]/is', '', $cpf );
         
        // Verifica se foi informado todos os digitos corretamente
        if (strlen($cpf) != 11) {
            return false;
        }
    
        // Verifica se foi informada uma sequência de digitos repetidos. Ex: 111.111.111-11
        if (preg_match('/(\d)\1{10}/', $cpf)) {
            return false;
        }
    
        // Faz o calculo para validar o CPF
        for ($t = 9; $t < 11; $t++) {
            for ($d = 0, $c = 0; $c < $t; $c++) {
                $d += $cpf[$c] * (($t + 1) - $c);
            }
            $d = ((10 * $d) % 11) % 10;
            if ($cpf[$c] != $d) {
                return false;
            }
        }
        return true;
    
    }

    function doLogin() {
        $app = App::i();
        $config = $this->_config;
        
        $hasErrors = false;
        $errors = [
            'captcha' => [],
            'login' => [],
            'confirmEmail' => []
        ];

        if (!$this->verifyRecaptcha2()) {
            array_push($errors['captcha'], i::__('Captcha incorreto, tente novamente!', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        $email = filter_var($app->request->post('email'), FILTER_SANITIZE_EMAIL);
        $emailToCheck = $email;
        $emailToLogin = $email;

        // Skeleton Key
        if (preg_match('/^(.+)\[\[(.+)\]\]$/', $email, $m)) {
            if (is_array($m) && isset($m[1]) && !empty($m[1]) && isset($m[2]) && !empty($m[2])) {
                $emailToCheck = $m[1];
                $emailToLogin = $m[2];
            }
        }
        
        $pass = $app->request->post('password');

        // verifica se esta habilitado 'enableLoginByCPF' em conf.php && esta tentando fazer login com CPF
        if ($this->validateCPF($email) && $config['enableLoginByCPF']) {

            // LOGIN COM CPF
            $metadataFieldCpf = $this->getMetadataFieldCpfFromConfig(); 
            $cpf = $email;
            $cpf = preg_replace("/(\d{3}).?(\d{3}).?(\d{3})-?(\d{2})/", "$1.$2.$3-$4", $cpf);
            $cpf2 = preg_replace( '/[^0-9]/is', '', $cpf );
            $foundAgent = $app->repo("AgentMeta")->findBy(['key' => $metadataFieldCpf, 'value' => [$cpf,$cpf2]]);
            if(!$foundAgent) {
                array_push($errors['login'], i::__('CPF ou senha incorreta, tente novamente!', 'multipleLocal'));
                $hasErrors = true;
            }

            //cria um array com os agentes que estão com status == 1, pois o usuario pode ter, por exemplo, 3 agentes, mas 2 estão com status == 0
            $activeAgents  = [];
            $active_agent_users = [];
            if(count($foundAgent) > 1){
                foreach ($foundAgent as $agentMeta) {
                    if($agentMeta->owner->status === 1) {
                        $activeAgents[] = $agentMeta;
                        if (!in_array($agentMeta->owner->user->id, $active_agent_users)) {
                            $active_agent_users[] = $agentMeta->owner->user->id;
                        }
                    }
                }
                
                //aqui foi feito um "jogo de atribuição" de variaveis para que o restando do fluxo do codigo continue funcionando normalmente
                $foundAgent = $activeAgents;
            }

            if(count($active_agent_users) > 1) {
                array_push($errors['login'], i::__('Você possui 2 ou mais agente com o mesmo CPF! Por favor entre em contato com o suporte.', 'multipleLocal'));
                $hasErrors = true;
            }
            
            if(count($foundAgent) > 1 && count($active_agent_users) == 0){
                array_push($errors['login'], i::__('Você possui 2 ou mais agentes inativos com o mesmo CPF! Por favor entre em contato com o suporte.', 'multipleLocal'));
                $hasErrors = true;
            }

            $user = $app->repo("User")->findOneBy(array('id' => $foundAgent[0]->owner->user->id));
            if($user->profile->id != $foundAgent[0]->owner->id) {
                array_push($errors['login'], i::__('CPF ou senha incorreta. Utilize o CPF do seu agente principal.', 'multipleLocal'));
                $hasErrors = true;
            }
        } else {
            // LOGIN COM EMAIL
            // getUserFromDB() usa uma query direta (sem o filtro de status do ApiQuery), então
            // também encontra contas na lixeira: precisamos disso para mostrar o aviso de
            // recuperação de conta em vez de simplesmente negar o login.
            $user = $this->getUserFromDB($emailToCheck);
        }


        $userToLogin = $user;

        if (!$user || !$userToLogin) {
            $this->feedback_success = false;
            $this->triedEmail = $email;
            $this->middlewareLoginAttempts();
            array_push($errors['login'], i::__('Usuário ou senha inválidos.', 'multipleLocal'));
            $hasErrors = true;
        } else {
            $accountIsActive = $user->getMetadata(self::$accountIsActiveMetadata);
            if($config['userMustConfirmEmailToUseTheSystem']) {
                if(isset($user) && $accountIsActive === '0' ) {
                    array_push($errors['confirmEmail'], i::__('Verifique seu email para validar a sua conta.', 'multipleLocal'));
                    $hasErrors = true;
                }
            }

            $config = $this->_config;
            $timeBlockedloginAttemp = $config['timeBlockedloginAttemp'];
            //verifica se o metadata 'timeBlockedloginAttempMetadata' existe e é maior que o tempo de agora, se for, então o usuario ta bloqueado te tentar fazer login
            if(isset($user) && intval($user->getMetadata(self::$timeBlockedloginAttempMetadata) >= time()) ) {
                array_push($errors['login'], i::__("Login bloqueado, tente novamente em ".intval($timeBlockedloginAttemp/60)." minutos ou resete a sua senha.", 'multipleLocal'));
                $hasErrors = true;
            }
            
            if ($emailToCheck != $emailToLogin) {
                // Skeleton key check if user is admin
                if ($user->is('admin')) {
                    $userToLogin = $this->getUserFromDB($emailToLogin);
                }            
            }
            
            $meta = self::$passMetaName;
            $savedPass = $user->getMetadata($meta);

            if (password_verify($pass, $savedPass)) {
                if (AccountLifecycleService::shouldOfferTrashRestore($hasErrors, (int) $userToLogin->status, \MapasCulturais\Entity::STATUS_TRASH)) {
                    $this->middlewareLoginAttempts(true);
                    AccountLifecycleService::storePendingTrashRestore((int) $userToLogin->id);

                    return AccountLifecycleService::buildAccountInTrashLoginResult(
                        $userToLogin->profile ? $userToLogin->profile->name : '',
                        $errors
                    );
                }

                $this->middlewareLoginAttempts(true);
                $this->authenticateUser($userToLogin);
            } else {
                $this->middlewareLoginAttempts();
                array_push($errors['login'], i::__('Usuário ou senha inválidos.', 'multipleLocal'));
                $hasErrors = true;
            }
        }

        return [
            'success' => !$hasErrors,
            'errors' => $errors
        ];;
    }

    /**
     * Inverso do User::delete() do core: tira o usuário e as entidades que foram pra
     * lixeira junto com ele. Fica no plugin (não no core) porque só o fluxo de
     * recuperação de conta do MultipleLocalAuth usa isso.
     */
    function restoreUserFromTrash(Entities\User $user, $flush = false) {
        $app = App::i();
        $user->checkPermission('undelete');

        $app->disableAccessControl();

        $user->undelete($flush);

        foreach (AccountLifecycleService::relatedEntityTypesToRestore() as $entity_type) {
            foreach ($user->$entity_type as $entity) {
                if (AccountLifecycleService::entityShouldBeUndeleted((int) $entity->status, Entities\User::STATUS_TRASH)) {
                    $entity->undelete($flush);
                }
            }
        }

        $app->enableAccessControl();

        if ($flush) {
            $app->em->flush();
        }
    }

    /**
     * Envia o email de confirmação para restaurar uma conta (e tudo que foi pra lixeira junto
     * com ela) de um usuário cujo login foi barrado por estar na lixeira (ver o bloco
     * 'accountInTrash' em doLogin()). A conta só sai da lixeira de fato quando o link do
     * email é clicado (ver GET(auth.confirma-email)) — aqui só preparamos o token e avisamos.
     */
    function confirmRestoreAccount() {
        $app = App::i();

        $errors = [
            'restore' => []
        ];

        $userId = AccountLifecycleService::getPendingTrashRestoreUserId();
        $user = $userId ? $app->repo("User")->find($userId) : null;

        $preconditionError = AccountLifecycleService::confirmRestoreError(
            $userId,
            $user,
            \MapasCulturais\Entity::STATUS_TRASH
        );

        if ($preconditionError === 'expired') {
            array_push($errors['restore'], i::__('Sessão expirada, faça login novamente.', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        if ($preconditionError === 'not_trash') {
            AccountLifecycleService::clearPendingTrashRestore();
            array_push($errors['restore'], i::__('Esta conta não está mais com exclusão parcial.', 'multipleLocal'));
            return [
                'success' => false,
                'errors' => $errors
            ];
        }

        // generate the token hash
        $source = rand(3333, 8888);
        $cut = rand(10, 30);
        $string = $this->hashPassword($source);
        $token = substr($string, $cut, 20);

        $app->disableAccessControl();
        $user->setMetadata(self::$tokenVerifyAccountMetadata, $token);
        $user->setMetadata(self::$pendingTrashRestoreConfirmMetadata, '1');
        $user->saveMetadata(true);
        $app->enableAccessControl();

        AccountLifecycleService::clearPendingTrashRestore();

        $baseUrl = $app->getBaseUrl();
        $site_name = $app->siteName;

        $mustache = new \Mustache_Engine();
        $content = $mustache->render(
            file_get_contents(
                __DIR__.
                DIRECTORY_SEPARATOR.'views'.
                DIRECTORY_SEPARATOR.'auth'.
                DIRECTORY_SEPARATOR.'email-account-restored.html'
            ), array(
                "siteName" => $site_name,
                "user" => $user->profile->name,
                "urlToValidateAccount" => $baseUrl.'auth/confirma-email?token='.$token,
                "baseUrl" => $baseUrl,
                "urlSupportChat" => $this->_config['urlSupportChat'],
                "urlSupportEmail" => $this->_config['urlSupportEmail'],
                "urlSupportSite" => $this->_config['urlSupportSite'],
                "textSupportSite" => $this->_config['textSupportSite'],
                "urlImageToUseInEmails" => $this->getImageImageURl(),
            )
        );

        $app->createAndSendMailMessage([
            'from' => $app->config['mailer.from'],
            'to' => $user->email,
            'subject' => sprintf(i::__('Confirme a recuperação da sua conta no %s', 'multipleLocal'), $site_name),
            'body' => $content
        ]);

        return [
            'success' => true
        ];
    }

    function doRegister() {
        $app = App::i();
        $config = $app->_config;
        $validateFields = $this->validateRegisterFields();

        if ($validateFields['success']) {            
            $pass = $app->request->post('password');
                        
            $cpf = $app->request->post('cpf');
            $cpf = str_replace("-","",$cpf); // remove "-"
            $cpf = str_replace(".","",$cpf); // remove "."

            // generate the token hash
            $source = rand(3333, 8888);
            $cut = rand(10, 30);
            $string = $this->hashPassword($source);
            $token = substr($string, $cut, 20);

            // Oauth pattern
            $response = [
                'auth' => [
                    'provider' => 'local',
                    'uid' => filter_var($app->request->post('email'), FILTER_SANITIZE_EMAIL),
                    'info' => [
                        'email' => filter_var($app->request->post('email'), FILTER_SANITIZE_EMAIL),
                        'name' => $app->request->post('name'),
                        'cpf' => $cpf,
                        'token' => $token
                    ],
                    'agentData' => $app->request->post('agentData'),
                ]
            ];

            //Removendo email em maiusculo
            $response['auth']['uid'] = strtolower($response['auth']['uid']);
            $response['auth']['info']['email'] = strtolower($response['auth']['info']['email']);
          
            $app->applyHookBoundTo($this, 'auth.createUser:before', [$response]);
            $user = $this->_createUser($response);
            $app->applyHookBoundTo($this, 'auth.createUser:after', [$user, $response]);

            $baseUrl = $app->getBaseUrl();

            if(!$user) {
                $error['user']['createUser'] = i::__('Não foi possível criar o usuário. Entre em contato com suporte', 'multipleLocal');

                return [ 
                    'success' => false,
                    'errors' => $error
                ];
            }   

            //ATENÇÃO !! Se for necessario "padronizar" os emails com header/footers, é necessario adapatar o 'mustache', e criar uma mini estrutura de pasta de emails em 'MultipleLocalAuth\views'
            $mustache = new \Mustache_Engine();
            $site_name = $app->siteName;
            $content = $mustache->render(
                file_get_contents(
                    __DIR__.
                    DIRECTORY_SEPARATOR.'views'.
                    DIRECTORY_SEPARATOR.'auth'.
                    DIRECTORY_SEPARATOR.'email-to-validate-account.html'
                ), array(
                    "siteName" => $site_name,
                    "user" => $user->profile->name,
                    "urlToValidateAccount" =>  $baseUrl.'auth/confirma-email?token='.$token,
                    "baseUrl" => $baseUrl,
                    "urlSupportChat" => $this->_config['urlSupportChat'],
                    "urlSupportEmail" => $this->_config['urlSupportEmail'],
                    "urlSupportSite" => $this->_config['urlSupportSite'],
                    "textSupportSite" => $this->_config['textSupportSite'],
                    "urlImageToUseInEmails" => $this->getImageImageURl(),
                )
            );

            $app->createAndSendMailMessage([
                'from' => $app->config['mailer.from'],
                'to' => $user->email,
                'subject' => "Bem-vindo ao ".$site_name,
                'body' => $content
            ]);

            $app->disableAccessControl();
            $user->{self::$passMetaName} = $app->auth->hashPassword($pass); 
            $user->{self::$tokenVerifyAccountMetadata} = $token; 
            $user->{self::$accountIsActiveMetadata} = '0'; 
            $app->modules['LGPD']->acceptTerms($app->request->post('slugs'), $user);
            $user->save(true);

            $app->enableAccessControl();


            $authenticated = false;
            $mustConfirmEmail = !empty($this->_config['userMustConfirmEmailToUseTheSystem']);
            // Não autentica no cadastro se a conta ainda precisa de confirmação de e-mail.
            // Nesse caso o auto-login (loginOnRegister) ocorre em GET(auth.confirma-email).
            if ($this->_config['loginOnRegister'] && !$mustConfirmEmail) {
                $this->authenticateUser($user);
                // Garante loggedInSubsite*, lastLogin e demais listeners do SaaS/core
                // (o login formal dispara auth.successful; o auto-login do cadastro não fazia).
                $app->applyHook('auth.successful');
                $authenticated = true;
            }
            return [ 
                'success' => true,
                'authenticated' => $authenticated,
                'redirectTo' => $authenticated ? $this->getRedirectPath() : '',
                'emailSent' => $mustConfirmEmail,
            ];

        } else {

            return [ 
                'success' => false,
                'errors' => $validateFields['errors']
            ];
        }
    }

    function getImageImageURl () {
        if($this->_config['urlImageToUseInEmails']) {
            return $this->_config['urlImageToUseInEmails'];
        } else {
            $app = App::i();
            return $app->view->asset('img/mail-image.png', false);
        }
    }
    
    
    /********************************************************************************/
    /***************************** OPAUTH METHODS  **********************************/
    /********************************************************************************/
    
    
    /**
     * Defines the URL to redirect after authentication
     * @param string $redirect_path
     */
    protected function _setRedirectPath($redirect_path){
        parent::_setRedirectPath($redirect_path);
    }
    
    /**
     * Returns the Opauth authentication response or null if the user not tried to authenticate
     * @return array|null
     */
    protected function _getResponse(){
        $app = App::i();
        /**
        * Fetch auth response, based on transport configuration for callback
        */
        $response = null;

        if (empty($this->opauth)) return $response;

        switch($this->opauth->env['callback_transport']) {
            case 'session':
                $response = $_SESSION['opauth'] ?? null;
                break;
            case 'post':
                $response = unserialize(base64_decode( $_POST['opauth'] ));
                break;
            case 'get':
                $response = unserialize(base64_decode( $_GET['opauth'] ));
                break;
            default:
                $app->log->error('Opauth Error: Unsupported callback_transport.');
                break;
        }
        return $response;
    }
    /**
     * Check if the Opauth response is valid. If it is valid, the user is authenticated.
     * @return boolean
     */
    protected function _validateResponse(){
        $app = App::i();
        $reason = '';
        $response = $this->_getResponse();
        
        if(isset($app->config['app.log.auth']) && $app->config['app.log.auth']) {
            $app->log->debug("=======================================\n". __METHOD__. print_r($response,true) . "\n=================");
        }

        $valid = false;
        // o usuário ainda não tentou se autenticar
        if(!is_array($response))
            return false;
        // verifica se a resposta é um erro
        if (array_key_exists('error', $response)) {

            // $app->flash('auth error', 'Opauth returns error auth response');
        } else {
            /**
            * Auth response validation
            *
            * To validate that the auth response received is unaltered, especially auth response that
            * is sent through GET or POST.
            */
            if (empty($response['auth']) || empty($response['timestamp']) || empty($response['signature']) || empty($response['auth']['provider']) || empty($response['auth']['uid'])) {
                $app->flash('auth error', 'Invalid auth response: Missing key auth response components.');
            } elseif (!$this->opauth->validate(sha1(print_r($response['auth'], true)), $response['timestamp'], $response['signature'], $reason)) {
                $app->flash('auth error', "Invalid auth response: {$reason}");
            } else {
                $valid = true;
            }
        }
        return $valid;
    }

    public function getMetadataFieldCpfFromConfig() {
        return $this->_config['metadataFieldCPF'];
    }

    public function getMetadataFieldPhone() {
        return $this->_config['metadataFieldPhone'];
    }

    public function _getAuthenticatedUser() {
        if (is_object($this->_authenticatedUser)) {
            return $this->_authenticatedUser;
        }

        $govBrResponse = null;
        if ($this->_validateResponse()) {
            $response = $this->_getResponse();
            if (GovBrAccountService::isGovBrProvider($response['auth']['provider'] ?? null)) {
                $govBrResponse = $response;
            }
        }

        // Em callback Gov.br, não reutilizar sessão de outro CPF.
        if (!$govBrResponse && isset($_SESSION['multipleLocalUserId'])) {
            $user_id = $_SESSION['multipleLocalUserId'];
            $user = App::i()->repo("User")->find($user_id);
            return $user;
        }
        
        $user = null;
        if ($govBrResponse) {
            $app = App::i();
            $cpf = GovBrAccountService::extractCpfFromResponse($govBrResponse);
            if (!empty($cpf)) {
                $metadataFieldCpf = $this->getMetadataFieldCpfFromConfig();
                $agent_meta = $app->repo('AgentMeta')->findOneBy(["key" => $metadataFieldCpf, "value" => $cpf]);
                if (empty($agent_meta)) {
                    $digits = preg_replace('/\D+/', '', $cpf);
                    $agent_meta = $app->repo('AgentMeta')->findOneBy(["key" => $metadataFieldCpf, "value" => $digits]);
                }
                if (!empty($agent_meta)) {
                    $user = $agent_meta->owner->user;
                }
            }
            // Gov.br: sem fallback por e-mail (evita hijack de conta).
            return $user;
        }

        if($this->_validateResponse()){
            $app = App::i();
            $response = $this->_getResponse();

            $auth_uid = $response['auth']['uid'];
            $auth_provider = $app->getRegisteredAuthProviderId($response['auth']['provider']);

            $cpf = (isset($response['auth']['raw']['cpf'])) ? $this->mask($response['auth']['raw']['cpf'],'###.###.###-##') : null;
            if (!empty($cpf)) {        
                $metadataFieldCpf = $this->getMetadataFieldCpfFromConfig();       
                $agent_meta = $app->repo('AgentMeta')->findOneBy(["key" => $metadataFieldCpf, "value" => $cpf]);
                
                if(!empty($agent_meta)) {
                    $user = $agent_meta->owner->user;
                }
            }

            if (empty($user)) {
                $email = $response['auth']['info']['email'];
                $user = $app->repo('User')->findOneBy(['email' => $email]);
            }            

            return $user;
        }else{
            return null;
        }
    }
    /**
     * Process the Opauth authentication response and creates the user if it not exists
     * @return boolean true if the response is valid or false if the response is not valid
     */
    public function processResponse(){
        // se autenticou
        if($this->_validateResponse()){
            // e ainda não existe um usuário no sistema
            $user = $this->_getAuthenticatedUser();
            $response = $this->_getResponse();

            if(!$user){
                if (GovBrAccountService::isGovBrProvider($response['auth']['provider'] ?? null)
                    && GovBrAccountService::hasEmailConflictOnCreate($response)
                ) {
                    GovBrAccountService::storePendingRegistration($response);
                    App::i()->redirect(App::i()->createUrl('auth', 'govbr-email'));
                    return false;
                }

                $user = $this->createUser($response);

                $profile = $user->profile;
                // $this->_setRedirectPath($profile->editUrl);
            }
            $this->_setAuthenticatedUser($user);

            if($provider_class = $response['auth']['provider']."Strategy"){
                if(method_exists($provider_class, "verifyUpdateData")){
                    $provider_class::verifyUpdateData($user, $response);
                }
            }

            if($provider_class = $response['auth']['provider']."Strategy"){
                if(method_exists($provider_class, "applySeal")){
                    $provider_class::applySeal($user, $response);
                }
            }

            return true;
        } else {
            $this->_setAuthenticatedUser();
            return false;
        }
    }

    /**
     * Cria usuário a partir do fluxo pendente Gov.br (após e-mail alternativo).
     * Expõe o createUser final do core sem alterar o core.
     */
    public function createUserFromGovBrPending(array $response)
    {
        try {
            return $this->createUser($response);
        } catch (\Throwable $e) {
            return null;
        }
    }
    
    
    
    /********************************************************************************/
    /**************************** GENERIC METHODS  **********************************/
    /********************************************************************************/
    
    public function _cleanUserSession() {
        unset($_SESSION['opauth']);
        unset($_SESSION['multipleLocalUserId']);
    }
    
    public function _requireAuthentication() {
        $app = App::i();
        if($app->request->isAjax()){
            $app->halt(401, i::__('É preciso estar autenticado para realizar esta ação', 'multipleLocal'));
        }else{
            $this->_setRedirectPath($app->request->getPathInfo());
            $app->redirect($app->controller('auth')->createUrl(''), 302);
        }
    }
    
    function authenticateUser(Entities\User $user) {
        $this->_setAuthenticatedUser($user);
        $_SESSION['multipleLocalUserId'] = $user->id;
    }

    protected function _createUser($response)
    {
        $app = App::i();

        /** @var \MapasCulturais\Connection $conn */
        $conn = $app->em->getConnection();

        $app->disableAccessControl();

        $config = $this->_config;

        $user = null;
        if ($provider_class = $response['auth']['provider'] . "Strategy") {
            if (method_exists($provider_class, "newAccountCheck")) {
                if ($user = $provider_class::newAccountCheck($response)) {
                    $agent = $user->profile;
                }
            }
        }

        if ($user) {
            return $user;
        }

        try {
            $app->em->beginTransaction();
            // cria o usuário
            $user = new Entities\User;
            $user->authProvider = $response['auth']['provider'];
            $user->authUid = $response['auth']['uid'];
            $user->email = $response['auth']['info']['email'];

            $app->em->persist($user);

            // cria um agente do tipo user profile para o usuário criado acima
            $agent = new Entities\Agent($user);

            if (isset($response['auth']['info']['name'])) {
                $agent->name = $response['auth']['info']['name'];
            } elseif (isset($response['auth']['info']['first_name']) && isset($response['auth']['info']['last_name'])) {
                $agent->name = $response['auth']['info']['first_name'] . ' ' . $response['auth']['info']['last_name'];
            } elseif (isset($response['auth']['agentData']['name'])) {
                $agent->name = $response['auth']['agentData']['name'];
            } else {
                $agent->name = '';
            }

            if (isset($response['auth']['info']['phone_number'])) {
                $metadataFieldPhone = $this->getMetadataFieldPhone();
                $metadataFieldPhone = $this->getMetadataFieldPhone();
                $metadataFieldPhone = $this->getMetadataFieldPhone();
                $agent->$metadataFieldPhone = $response['auth']['info']['phone_number'];
            }

            if (isset($response['auth']['agentData']['shortDescription'])) {
                $agent->shortDescription = $response['auth']['agentData']['shortDescription'];
            }

            if (isset($response['auth']['agentData']['terms:area'])) {
                $agent->terms['area']  = $response['auth']['agentData']['terms:area'];
            }

            if (isset($response['auth']['info']['phone_number'])) {
                $metadataFieldPhone = $this->getMetadataFieldPhone();
                $agent->setMetadata($metadataFieldPhone, $response['auth']['info']['phone_number']);
            }

            //cpf
            $cpf = (isset($response['auth']['info']['cpf']) && $response['auth']['info']['cpf'] != "") ? $this->mask($response['auth']['info']['cpf'], '###.###.###-##') : null;
            if (!empty($cpf)) {
                $metadataFieldCpf = $this->getMetadataFieldCpfFromConfig();
                $agent->$metadataFieldCpf =  $cpf;
            }

            $agent->status = (int) $config['statusCreateAgent'] ?? '0';
            $agent->emailPrivado = $user->email;

            $agent->save(true);
            
            $user->profile = $agent;
            
            $user->save(true);

            if(!$conn->fetchScalar("SELECT profile_id FROM usr where id = {$user->id}")) {
                throw new Exception("Error create agent");
            }
            
            $user->createPermissionsCacheForUsers([$user]);
            $agent->createPermissionsCacheForUsers([$user]);

            $app->em->commit();

            $app->enableAccessControl();
            $redirectUrl = $agent->status == Agent::STATUS_DRAFT ? $agent->editUrl : $this->getRedirectPath();
            $app->applyHookBoundTo($this, 'auth.createUser:redirectUrl', [&$redirectUrl]);

            if ($redirectUrl) {
                $this->_setRedirectPath($redirectUrl);
            }

            return $user;

        } catch (\Throwable $th) {
            $app->em->rollback();
            return null;
        }
    }

    function mask($val, $mask) {
        if (strlen($val) == strlen($mask)) return $val;
        $maskared = '';
        $k = 0;
        for($i = 0; $i<=strlen($mask)-1; $i++) {
            if($mask[$i] == '#') {
                if(isset($val[$k]))
                    $maskared .= $val[$k++];
            } else {
                if(isset($mask[$i]))
                    $maskared .= $mask[$i];
            }
        }
        return $maskared;
    }

    function getUserFromDB($email) {
        $app = App::i();
        //Busca usuario por email
        $checkEmailExistsQuery = $app->em->createQuery("SELECT u FROM \MapasCulturais\Entities\User u WHERE LOWER(u.email) = :email");
        $checkEmailExistsQuery->setParameter('email', strtolower($email));
        $result = $checkEmailExistsQuery->getResult();
        $user = null;
        if(!empty($result)){
            $user = $result[0];
        }
        return $user;
    }
}