module Authorization
  extend ActiveSupport::Concern

  included do
    before_action :set_paper_trail_whodunnit
    before_action :load_current_user # load user from database
    before_action :check_authentication # check if user authenticated
    before_action :check_current_user # check if user authorized

    rescue_from ActionController::UnknownFormat do
      request.format = :html
      render_error
    end

    def current_login
      session['zombie'] || cas_login
    end

    private

    def cas_login
      session['cas'] && session['cas']['user']
    end

    def set_current_user(options = {})
      return nil if current_login.blank?
      load_current_user
    end

    def load_current_user
      @current_user ||= User.where('lower(login) = lower(?)', current_login).first
    end

    def check_authentication
      if session.blank? || session['cas'].blank? || session['cas']['user'].blank? ||
        (request.get? && !request.xhr? && request.xhr? != 0 && (session['cas']['last_validated_at'].blank? || session['cas']['last_validated_at'] < 15.minutes.ago))
        render plain: 'Требуется авторизация', status: 401
      end
    end

    def check_current_user
      render_error unless @current_user
    end

    def render_error(error = 'Доступ запрещен!', options = {})
      @error = error
      status = options[:status] || 403
      request.format = options[:format] if options[:format]
      respond_to do |format|
        format.html { render 'error', status: status }
        format.js { render js: %(alert("#{@error}")), status: status }
        format.json { render json: {error: @error}, status: status }
        # session.destroy
      end
    end

    def permissions
      render_error unless admin_permission
    end

    def admin_permission
      @current_user.try(:administrator?)
    end

    def user_for_paper_trail
      current_login || 'Anonymous'
    end
  end
end