/**
 * SeekQuarry/Yioop --
 * Open Source Pure PHP Search Engine, Crawler, and Indexer
 *
 * Copyright (C) 2009 - 2026  Chris Pollett chris@pollett.org
 *
 * LICENSE:
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * END LICENSE
 *
 * @author Sarika Padmashali (tweaks cpollett)
 * @license https://www.gnu.org/licenses/ GPL3
 * @link https://www.seekquarry.com/
 * @copyright 2009 - 2026
 * @filesource
 */
/*
 * Localized strings handed to this script by the page that loads it. Only
 * the create-account form sets these; the shared password-requirements
 * code below does not use them, so other forms can load this script too.
 */
var tl = document.tl;
/*
 * How long the brief top-of-screen success note stays up, in milliseconds.
 */
var success_message_time = 5000;
/*
 * Returns the list of password-policy rules the given value breaks, using
 * a rules object read from a password-requirements hint. The list is empty
 * when the value satisfies every rule. This mirrors the server-side
 * passwordPolicyViolations so the browser and the server agree on what an
 * acceptable password is.
 */
function passwordPolicyViolations(value, rules)
{
    var violations = [];
    if (value.length < rules.min) {
        violations.push("too_short");
    }
    if (value.length > rules.max) {
        violations.push("too_long");
    }
    if (rules.lower && !(/[a-z]/.test(value))) {
        violations.push("lowercase");
    }
    if (rules.upper && !(/[A-Z]/.test(value))) {
        violations.push("uppercase");
    }
    if (rules.digit && !(/[0-9]/.test(value))) {
        violations.push("digit");
    }
    if (rules.symbol && !(/[^A-Za-z0-9]/.test(value))) {
        violations.push("symbol");
    }
    for (var index = 0; index < rules.forbidden.length; index++) {
        if (value.indexOf(rules.forbidden.charAt(index)) >= 0) {
            violations.push("forbidden");
            break;
        }
    }
    return violations;
}
/*
 * Reads the rule set out of a password-requirements hint's data attributes
 * into a plain object the checker above understands. The forbidden
 * characters travel as space-separated character codes so no quote ever
 * has to sit inside the markup.
 */
function passwordRulesFromContainer(container)
{
    var codes = container.getAttribute("data-pw-forbidden");
    var forbidden = "";
    if (codes != "") {
        var forbidden_codes = codes.split(" ");
        for (var index = 0; index < forbidden_codes.length; index++) {
            forbidden +=
                String.fromCharCode(parseInt(forbidden_codes[index], 10));
        }
    }
    return {
        field: container.getAttribute("data-pw-field"),
        min: parseInt(container.getAttribute("data-pw-min"), 10),
        max: parseInt(container.getAttribute("data-pw-max"), 10),
        lower: container.getAttribute("data-pw-lower") == "1",
        upper: container.getAttribute("data-pw-upper") == "1",
        digit: container.getAttribute("data-pw-digit") == "1",
        symbol: container.getAttribute("data-pw-symbol") == "1",
        forbidden: forbidden,
        gate: container.getAttribute("data-pw-gate") == "1",
        stand_in: container.getAttribute("data-pw-standin") == "1"
    };
}
/*
 * Whether a password box still holds the stand-in the site drew in it for
 * a password that is not being changed. The Manage Users screen fills both
 * of its password boxes that way, so judging what one holds would name
 * requirements about a password nobody is setting, and holding the form
 * back would stop every other change to that account from being saved.
 * Typing anything else in the box makes it a password again and it is
 * judged from then on.
 */
function passwordHoldsStandIn(field, rules)
{
    return rules.stand_in && field.value != "" &&
        field.value == field.password_stand_in;
}
/*
 * Turns a list of broken-rule tokens into a short phrase naming just the
 * requirements still missing, taking the wording from the hint's data
 * attributes so it stays in the page's language and minimal.
 */
function passwordMissingText(violations, container)
{
    var attribute_for = {
        too_short: "data-pw-phrase-short",
        lowercase: "data-pw-phrase-lower",
        uppercase: "data-pw-phrase-upper",
        digit: "data-pw-phrase-digit",
        symbol: "data-pw-phrase-symbol",
        forbidden: "data-pw-phrase-forbidden"
    };
    var phrases = [];
    for (var index = 0; index < violations.length; index++) {
        var name = attribute_for[violations[index]];
        if (name) {
            var phrase = container.getAttribute(name);
            if (phrase) {
                phrases.push(phrase);
            }
        }
    }
    return phrases.join(", ");
}
/*
 * Shows the live feedback for one password box. While a rule is still
 * broken it lists, in green, just what is missing (with "Too short" for the
 * length); once every rule is met it instead turns the box's own border
 * green, clears that text, and flashes a brief note at the top of the page;
 * an empty box shows nothing, and so does one still holding the stand-in
 * the site drew for a password that is not being changed. Because this
 * replaces the hint's sentence, that plain sentence is seen only when
 * JavaScript is off. Returns whether the password is acceptable.
 */
function showPasswordFeedback(container)
{
    var rules = passwordRulesFromContainer(container);
    var field = elt(rules.field);
    var message = container.getElementsByClassName(
        "password-requirements-text")[0];
    if (!field || !message) {
        return true;
    }
    if (passwordHoldsStandIn(field, rules)) {
        message.innerHTML = "";
        setClass(rules.field, false, "field-ok");
        return true;
    }
    if (field.value == "") {
        message.innerHTML = "";
        setClass(rules.field, false, "field-ok");
        field.password_ok = false;
        return false;
    }
    var violations = passwordPolicyViolations(field.value, rules);
    if (violations.length == 0) {
        message.innerHTML = "";
        setClass(rules.field, true, "field-ok");
        if (!field.password_ok) {
            field.password_ok = true;
            doMessage("<h1 class=\"green\">" +
                container.getAttribute("data-pw-ok") + "</h1>",
                success_message_time);
        }
        return true;
    }
    setClass(rules.field, false, "field-ok");
    field.password_ok = false;
    var missing = passwordMissingText(violations, container);
    missing = missing.charAt(0).toUpperCase() + missing.slice(1);
    message.innerHTML = "<span class=\"green\">" + missing + "</span>";
    return false;
}
/*
 * Wires one password-requirements hint to its password box: shows the live
 * feedback as the person types and, when the hint gates its form, blocks
 * submitting an unacceptable password.
 */
function wirePasswordRequirements(container)
{
    var rules = passwordRulesFromContainer(container);
    var field = elt(rules.field);
    if (!field) {
        return;
    }
    if (rules.stand_in) {
        /* What the box arrived holding stands for leaving the password
           alone, so remembering it here is how a later look can tell
           that nobody has typed a password of their own. */
        field.password_stand_in = field.value;
    }
    showPasswordFeedback(container);
    listen(field, "keyup", function () {
        showPasswordFeedback(container);
    });
    listen(field, "blur", function () {
        setClass(rules.field, false, "field-ok");
    });
    if (rules.gate && field.form) {
        listen(field.form, "submit", function (event) {
            if (!passwordHoldsStandIn(field, rules) &&
                passwordPolicyViolations(field.value, rules).length > 0) {
                showPasswordFeedback(container);
                field.focus();
                event.preventDefault();
            }
        });
    }
}
/*
 * Wires up every password-requirements hint on the page. This runs on all
 * the password forms, not just create-account.
 */
function setupPasswordRequirements()
{
    var containers = document.getElementsByClassName(
        "password-requirements");
    for (var index = 0; index < containers.length; index++) {
        wirePasswordRequirements(containers[index]);
    }
}
/*
 * Whether the create-account e-mail box holds a validly formatted address.
 * Returns a yes/no answer only; the form marks a bad address by outlining
 * the box in red rather than by printing words.
 */
function emailValid()
{
    var mail_format = /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/;
    return elt("email").value.match(mail_format) != null;
}
/*
 * Outlines the e-mail box in red once the person leaves it having typed
 * something that is not a valid address, and clears that outline once the
 * box is empty or valid again.
 */
function showEmailValidity()
{
    setClass("email",
        elt("email").value != "" && !emailValid(), "field-error");
}
/*
 * Checks the create-account retyped password matches the first one. While
 * they differ it shows a green note saying so; once they match it instead
 * turns the retype box's border green, drops the note, and flashes a brief
 * note at the top of the page.
 */
function passwordMatch()
{
    var retyped_pass = elt("retype-password");
    var password = elt("pass-word");
    var password_match = elt("pass-match");
    if (password.value == "") {
        password_match.innerHTML = "";
        setClass("retype-password", false, "field-ok");
        retyped_pass.passwords_matched = false;
        return true;
    }
    if (retyped_pass.value == password.value) {
        password_match.innerHTML = "";
        setClass("retype-password", true, "field-ok");
        if (!retyped_pass.passwords_matched) {
            retyped_pass.passwords_matched = true;
            doMessage("<h1 class=\"green\">" +
                tl['register_validator_js_retype_password_matched'] +
                "</h1>", success_message_time);
        }
        return true;
    } else {
        setClass("retype-password", false, "field-ok");
        retyped_pass.passwords_matched = false;
        password_match.innerHTML = "<span class=\"green\">" +
            tl['register_validator_js_retype_password_not_matched'] +
            "</span>";
        return false;
    }
}
/*
 * Shows the required-asterisk next to a box when it is empty and hides it
 * otherwise. Returns whether the box has something in it.
 */
function showRequired(field_id)
{
    var field = elt(field_id);
    if (!field) {
        return true;
    }
    if (field.value == "") {
        setDisplay(field_id + "-star", true, "inline");
        return false;
    }
    setDisplay(field_id + "-star", false);
    return true;
}
/*
 * Hides the required-asterisk next to a box once it has something in it,
 * so an asterisk shown on a failed submit clears itself as the person
 * fills the box in.
 */
function hideRequiredIfFilled(field_id)
{
    var field = elt(field_id);
    if (field && field.value != "") {
        setDisplay(field_id + "-star", false);
    }
}
/*
 * Run when the create-account form is submitted: this is the one client
 * check the submit button performs before anything is sent to the server.
 * It shows an asterisk beside every required box left empty, a red outline
 * on a badly typed e-mail, the retype note when the two passwords differ,
 * and the password-rule feedback when the password breaks a rule. Returns
 * whether the form is good to send.
 */
function checkRegistrationForm()
{
    var required = ["firstname", "lastname", "username", "email",
        "pass-word", "retype-password"];
    var good = true;
    for (var index = 0; index < required.length; index++) {
        if (!showRequired(required[index])) {
            good = false;
        }
    }
    if (elt("email").value != "" && !emailValid()) {
        showEmailValidity();
        good = false;
    }
    if (!passwordMatch()) {
        good = false;
    }
    var container = document.getElementsByClassName(
        "password-requirements")[0];
    if (container && !showPasswordFeedback(container)) {
        good = false;
    }
    return good;
}
/*
 * Wires the create-account-only fields. Each required box clears its
 * asterisk as soon as it has something typed in it (and the e-mail box
 * drops its red outline while being edited); the retype box updates its
 * match note live; and submitting with anything missing shows the
 * asterisks and holds the form back. The other password forms do not have
 * these boxes, so this does nothing on them.
 */
function setupRegistrationForm()
{
    if (!elt("firstname")) {
        return;
    }
    var required = ["firstname", "lastname", "username", "email",
        "pass-word", "retype-password"];
    for (var index = 0; index < required.length; index++) {
        wireRequiredField(required[index]);
    }
    listen(elt("email"), "blur", showEmailValidity);
    listen(elt("retype-password"), "keyup", passwordMatch);
    listen(elt("retype-password"), "blur", function () {
        setClass("retype-password", false, "field-ok");
    });
    listen(elt("firstname").form, "submit", function (event) {
        if (!checkRegistrationForm()) {
            event.preventDefault();
        }
    });
}
/*
 * Wires one create-account box so its asterisk clears as the box is filled
 * in; the e-mail box also drops its red outline while being edited.
 */
function wireRequiredField(field_id)
{
    listen(elt(field_id), "keyup", function () {
        hideRequiredIfFilled(field_id);
        if (field_id == "email") {
            setClass("email", false, "field-error");
        }
    });
}
/*
 * On page load, turn on the shared password-requirements feedback for every
 * password box, then wire the create-account-only fields if they are
 * present.
 */
/*
 * Holds back a form whose two password boxes differ, so the writer is
 * told at once rather than after a trip to the server that throws away
 * what was typed. The create-account form has its own check, which
 * covers more than the two passwords, so this leaves that form alone.
 * A page with no retype box gets nothing.
 */
function setupPasswordMatchGuard()
{
    var retyped = elt("retype-password");
    var password = elt("pass-word");
    if (!retyped || !password || elt("firstname") || !retyped.form) {
        return;
    }
    listen(retyped.form, "submit", function (event) {
        if (retyped.value == password.value) {
            return;
        }
        event.preventDefault();
        setClass("retype-password", false, "field-ok");
        doMessage("<h1 class=\"red\">" +
            tl['register_validator_js_retype_password_not_matched'] +
            "</h1>");
        retyped.focus();
    });
}
listen(window, "load", function () {
    setupPasswordRequirements();
    setupRegistrationForm();
    setupPasswordMatchGuard();
});
