<?php
/* $Id$ */
namespace MPF\PayPal;

(defined('MAMMUT') && (basename(__FILE__) != basename($_SERVER['PHP_SELF']))) or die('ACCESS DENIED');

/**
 * PayPal ExpressCheckout class, based on the SDK provided by paypal
 * 
 * @author Stefan Daurer
 */
class PayPalEC {
	const PAYMODE_SALE = "sale";
	const PAYMODE_DIGITAL = "digital";
	const PAYMODE_PROD_URL = "";
	const PAYMODE_SANDBOX_URL = "https://www.sandbox.paypal.com/webscr&cmd=_express-checkout&token=";
	const PAY_CUR_USD = 'USD';
	const PAY_CUR_EUR = 'EUR';
	public $successUrl = NULL;
	public $cancelUrl = NULL;
	public $paypal_url = self::PAYMODE_SANDBOX_URL;
	public $currency = self::PAY_CUR_USD;
	public $paymode = self::PAYMODE_SALE;
	private $items = array();

	public static function nvpHeader() {
		global $API_Endpoint, $version, $API_UserName, $API_Password, $API_Signature, $nvp_Header, $subject, $AUTH_token, $AUTH_signature, $AUTH_timestamp;
		$nvpHeaderStr = "";
		
		if(defined('AUTH_MODE')) {
			//$AuthMode = "3TOKEN"; //Merchant's API 3-TOKEN Credential is required to make API Call.
			//$AuthMode = "FIRSTPARTY"; //Only merchant Email is required to make EC Calls.
			//$AuthMode = "THIRDPARTY";Partner's API Credential and Merchant Email as Subject are required.
			$AuthMode = "AUTH_MODE";
		}
		else {
			
			if((!empty($API_UserName)) && (!empty($API_Password)) && (!empty($API_Signature)) && (!empty($subject))) {
				$AuthMode = "THIRDPARTY";
			}
			
			else if((!empty($API_UserName)) && (!empty($API_Password)) && (!empty($API_Signature))) {
				$AuthMode = "3TOKEN";
			}
			
			elseif(!empty($AUTH_token) && !empty($AUTH_signature) && !empty($AUTH_timestamp)) {
				$AuthMode = "PERMISSION";
			}
			elseif(!empty($subject)) {
				$AuthMode = "FIRSTPARTY";
			}
		}
		switch($AuthMode) {
			
			case "3TOKEN":
				$nvpHeaderStr = "&PWD=" . urlencode($API_Password) . "&USER=" . urlencode($API_UserName) . "&SIGNATURE=" . urlencode($API_Signature);
			break;
			case "FIRSTPARTY":
				$nvpHeaderStr = "&SUBJECT=" . urlencode($subject);
			break;
			case "THIRDPARTY":
				$nvpHeaderStr = "&PWD=" . urlencode($API_Password) . "&USER=" . urlencode($API_UserName) . "&SIGNATURE=" . urlencode($API_Signature) . "&SUBJECT=" . urlencode($subject);
			break;
			case "PERMISSION":
				$nvpHeaderStr = formAutorization($AUTH_token, $AUTH_signature, $AUTH_timestamp);
			break;
		}
		return $nvpHeaderStr;
	}

	/**
	 * Function to perform the API call to PayPal using API signature
	 * 
	 * @param $methodName string
	 *        	is the name of the API method
	 * @param $nvpStr string
	 *        	is a nvp string
	 * @return an associtive array containing the response from the server
	 */
	public static function hashCall($methodName, $nvpStr) {
		//declaring of global variables
		global $API_Endpoint, $version, $API_UserName, $API_Password, $API_Signature, $nvp_Header, $subject, $AUTH_token, $AUTH_signature, $AUTH_timestamp;
		// form header string
		$nvpheader = self::nvpHeader();
		//setting the curl parameters.
		$ch = curl_init();
		curl_setopt($ch, CURLOPT_URL, $API_Endpoint);
		curl_setopt($ch, CURLOPT_VERBOSE, 1);
		
		//turning off the server and peer verification(TrustManager Concept).
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
		
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($ch, CURLOPT_POST, 1);
		
		//in case of permission APIs send headers as HTTPheders
		if(!empty($AUTH_token) && !empty($AUTH_signature) && !empty($AUTH_timestamp)) {
			$headers_array[] = "X-PP-AUTHORIZATION: " . $nvpheader;
			
			curl_setopt($ch, CURLOPT_HTTPHEADER, $headers_array);
			curl_setopt($ch, CURLOPT_HEADER, false);
		}
		else {
			$nvpStr = $nvpheader . $nvpStr;
		}
		//if USE_PROXY constant set to TRUE in Constants.php, then only proxy will be enabled.
		//Set proxy name to PROXY_HOST and port number to PROXY_PORT in constants.php
		if(USE_PROXY)
			curl_setopt($ch, CURLOPT_PROXY, PROXY_HOST . ":" . PROXY_PORT);
			
			//check if version is included in $nvpStr else include the version.
		if(strlen(str_replace('VERSION=', '', strtoupper($nvpStr))) == strlen($nvpStr)) {
			$nvpStr = "&VERSION=" . urlencode($version) . $nvpStr;
		}
		
		$nvpreq = "METHOD=" . urlencode($methodName) . $nvpStr;
		
		//setting the nvpreq as POST FIELD to curl
		curl_setopt($ch, CURLOPT_POSTFIELDS, $nvpreq);
		
		//getting response from server
		$response = curl_exec($ch);
		
		//convrting NVPResponse to an Associative Array
		$nvpResArray = deformatNVP($response);
		$nvpReqArray = deformatNVP($nvpreq);
		$_SESSION['nvpReqArray'] = $nvpReqArray;
		
		if(curl_errno($ch)) {
			// moving to display page to display curl errors
			$_SESSION['curl_error_no'] = curl_errno($ch);
			$_SESSION['curl_error_msg'] = curl_error($ch);
			$location = "APIError.php";
			header("Location: $location");
		}
		else {
			//closing the curl
			curl_close($ch);
		}
		
		return $nvpResArray;
	}

	/**
	 * This function will take NVPString and convert it to an Associative Array and it
	 * will decode the response.
	 * It is usefull to search for a particular key and displaying arrays.
	 * 
	 * @var nvpstr is a NVPString.
	 * @return a Associative Array.
	 */
	public static function deformatNVP($nvpstr) {
		$intial = 0;
		$nvpArray = array();
		
		while(strlen($nvpstr)) {
			//postion of Key
			$keypos = strpos($nvpstr, '=');
			//position of value
			$valuepos = strpos($nvpstr, '&') ? strpos($nvpstr, '&') : strlen($nvpstr);
			
			/*getting the Key and Value values and storing in a Associative Array*/
			$keyval = substr($nvpstr, $intial, $keypos);
			$valval = substr($nvpstr, $keypos + 1, $valuepos - $keypos - 1);
			//decoding the respose
			$nvpArray[urldecode($keyval)] = urldecode($valval);
			$nvpstr = substr($nvpstr, $valuepos + 1, strlen($nvpstr));
		}
		return $nvpArray;
	}

	public static function formAutorization($auth_token, $auth_signature, $auth_timestamp) {
		$authString = "token=" . $auth_token . ",signature=" . $auth_signature . ",timestamp=" . $auth_timestamp;
		return $authString;
	}

	/**
	 *
	 * @return the html code for the digital good tools javascript, loaded from the paypal
	 *         server
	 */
	public function buildDGEmbeddedJS() {
		return '<script type="text/x-javascript" src="https://www.paypalobjects.com/js/external/dg.js"></script>';
	}

	public function buildDGStep1FormAddons($submitBtnId) {
		$st = "";
		// 			$st = "<input type=\"hidden\" name=\"success_url\"	value=\"{$this->successUrl}\" />\n";
		// 			$st .= "<input type=\"hidden\" name=\"cancel_url\"	value=\"{$this->cancelUrl}\" />\n";
		$st .= "<script type=\"text/x-javascript\">\n<!--\n\tvar paypaldg = new PAYPAL.apps.DGFlow({ trigger:\"{$submitBtnId}\" });\n-->\n</script>\n";
		return $st;
	}

	public function addPaymentItem(ECItem $item) {
		$this->items[] = $item;
	}

	public function getPaymentItems() {
		return $this->items;
	}

	public function requestPaymentToken() {
		/* The servername and serverport tells PayPal where the buyer
			should be directed back to after authorizing payment.
		In this case, its the local webserver that is running this script
		Using the servername and serverport, the return URL is the first
		portion of the URL that buyers will return to after authorizing payment
		*/
		$serverName = $_SERVER['SERVER_NAME'];
		$serverPort = $_SERVER['SERVER_PORT'];
		$url = dirname('http://' . $serverName . ':' . $serverPort . $_SERVER['REQUEST_URI']);
		
		$currencyCodeType = $_REQUEST['currencyCodeType'];
		$paymentType = $_REQUEST['paymentType'];
		
		/*           $personName        = $_REQUEST['PERSONNAME'];
		 $SHIPTOSTREET      = $_REQUEST['SHIPTOSTREET'];
		$SHIPTOCITY        = $_REQUEST['SHIPTOCITY'];
		$SHIPTOSTATE	      = $_REQUEST['SHIPTOSTATE'];
		$SHIPTOCOUNTRYCODE = $_REQUEST['SHIPTOCOUNTRYCODE'];
		$SHIPTOZIP         = $_REQUEST['SHIPTOZIP'];
		$L_NAME0           = $_REQUEST['L_NAME0'];
		$L_AMT0            = $_REQUEST['L_AMT0'];
		$L_QTY0            =	$_REQUEST['L_QTY0'];
		$L_NAME1           =	$_REQUEST['L_NAME1'];
		$L_AMT1            = $_REQUEST['L_AMT1'];
		$L_QTY1            =	$_REQUEST['L_QTY1']; */
		
		$personName = 'Tester';
		$L_NAME0 = '1 Year Access';
		$L_AMT0 = '9.00';
		$L_QTY0 = '1.00';
		
		/* The returnURL is the location where buyers return when a
		 payment has been succesfully authorized.
		The cancelURL is the location buyers are sent to when they hit the
		cancel button during authorization of payment during the PayPal flow
		*/
		
		// 			$returnURL =urlencode($url.'/ReviewOrder.php?currencyCodeType='.$currencyCodeType.'&paymentType='.$paymentType);
		// 			$cancelURL =urlencode("$url/SetExpressCheckout.php?paymentType=$paymentType" );
		$returnURL = urlencode($this->successUrl);
		$cancelURL = urlencode($this->cancelUrl);
		
		$orderamt = 0.00;
		$orders = '';
		$i = 0;
		foreach($this->items as $item) {
			$itemamt = $item->amount * $item->quantity;
			$orderamt += $itemamt;
			$orders .= '&L_PAYMENTREQUEST_0_ITEMCATEGORY' . $i . '=Digital';
			$orders .= '&L_PAYMENTREQUEST_0_NAME' . $i . '=' . $item->name;
			$orders .= '&L_PAYMENTREQUEST_0_AMT' . $i . '=' . number_format($item->amount, 2, '.', '');
			$orders .= '&L_PAYMENTREQUEST_0_QTY' . $i . '=' . number_format($item->quantity, 2, '.', '');
			$i++;
		}
		
		/*
		 * Setting up the Shipping address details
		*/
		//          $shiptoAddress = "&SHIPTONAME=$personName&SHIPTOSTREET=$SHIPTOSTREET&SHIPTOCITY=$SHIPTOCITY&SHIPTOSTATE=$SHIPTOSTATE&SHIPTOCOUNTRYCODE=$SHIPTOCOUNTRYCODE&SHIPTOZIP=$SHIPTOZIP";
		

		//           $nvpstr="&ADDRESSOVERRIDE=1$shiptoAddress&L_NAME0=".$L_NAME0."&L_NAME1=".$L_NAME1."&L_AMT0=".$L_AMT0."&L_AMT1=".$L_AMT1."&L_QTY0=".$L_QTY0."&L_QTY1=".$L_QTY1."&MAXAMT=".(string)$maxamt."&AMT=".(string)$amt."&ITEMAMT=".(string)$itemamt."&CALLBACKTIMEOUT=4&L_SHIPPINGOPTIONAMOUNT1=8.00&L_SHIPPINGOPTIONlABEL1=UPS Next Day Air&L_SHIPPINGOPTIONNAME1=UPS Air&L_SHIPPINGOPTIONISDEFAULT1=true&L_SHIPPINGOPTIONAMOUNT0=3.00&L_SHIPPINGOPTIONLABEL0=UPS Ground 7 Days&L_SHIPPINGOPTIONNAME0=Ground&L_SHIPPINGOPTIONISDEFAULT0=false&INSURANCEAMT=1.00&INSURANCEOPTIONOFFERED=true&CALLBACK=https://www.ppcallback.com/callback.pl&SHIPPINGAMT=8.00&SHIPDISCAMT=-3.00&TAXAMT=2.00&L_NUMBER0=1000&L_DESC0=Size: 8.8-oz&L_NUMBER1=10001&L_DESC1=Size: Two 24-piece boxes&L_ITEMWEIGHTVALUE1=0.5&L_ITEMWEIGHTUNIT1=lbs&ReturnUrl=".$returnURL."&CANCELURL=".$cancelURL ."&CURRENCYCODE=".$currencyCodeType."&PAYMENTACTION=".$paymentType;
		// $nvpstr="&REQCONFIRMSHIPPING=0&NOSHIPPING=1&PAYMENTREQUEST_0_CURRENCYCODE=".$this->currency."&PAYMENTREQUEST_0_AMT=".$orderamt."&PAYMENTREQUEST_0_ITEMAMT=".$orderamt."&PAYMENTREQUEST_0_PAYMENTACTION=Sale&L_PAYMENTREQUEST_0_ITEMCATEGORY0=Digital&L_PAYMENTREQUEST_0_NAME0=Kitty&L_PAYMENTREQUEST_0_QTY0=1&L_PAYMENTREQUEST_0_AMT0=150&RETURNURL=".$returnURL."&CANCELURL=".$cancelURL;
		$nvpstr = "&REQCONFIRMSHIPPING=0&NOSHIPPING=1&PAYMENTREQUEST_0_CURRENCYCODE=" . $this->currency . "&PAYMENTREQUEST_0_AMT=" . $orderamt . "&PAYMENTREQUEST_0_ITEMAMT=" . $orderamt . "&PAYMENTREQUEST_0_PAYMENTACTION=Sale" . $orders . "&RETURNURL=" . $returnURL . "&CANCELURL=" . $cancelURL;
		
		$nvpstr = $nvpHeader . $nvpstr;
		
		/* Make the call to PayPal to set the Express Checkout token
		 If the API call succeded, then redirect the buyer to PayPal
		to begin to authorize payment.  If an error occured, show the
		resulting errors
		*/
		$resArray = hash_call("SetExpressCheckout", $nvpstr);
		$_SESSION['reshash'] = $resArray;
		
		$ack = strtoupper($resArray["ACK"]);
		
		if($ack == "SUCCESS") {
			// Redirect to paypal.com here
			$token = urldecode($resArray["TOKEN"]);
			$payPalURL = $this->paypal_url . $token;
			header("Location: " . $payPalURL);
			return true;
		}
		else {
			return false;
		}
	}
}