All aboard the refactor tractor

blocks/ORB/Login.pm

@@ -1,5 +1,5 @@
 ## @file
-# This file contains the implementation of the login/logout facility.
+# This file contains the implementation of the login/signout facility.
 #
 # @author  Chris Page <chris@starforge.co.uk>
 #
@@ -26,7 +26,7 @@ use strict;
 use parent qw(ORB); # This class extends the ORB block class
 use experimental qw(smartmatch);
 use Webperl::Utils qw(path_join is_defined_numeric);
-use v5.12;
+use v5.14;
 
 # ============================================================================
 #  Emailer functions
@@ -226,7 +226,7 @@ sub validate_login {
                                                                             "formattest" => '^[-\w]+$',
                                                                             "formatdesc" => $self -> {"template"} -> replace_langvar("LOGIN_ERR_BADUSERCHAR")});
     # Bomb out at this point if the username is not valid.
-    return ($self -> {"template"} -> load_template("login/error.tem", {"***reason***" => $error}), $args)
+    return ($self -> {"template"} -> load_template("login/error.tem", {"%(reason)s" => $error}), $args)
         if($error);
 
     # Do the same with the password...
@@ -234,7 +234,7 @@ sub validate_login {
                                                                             "nicename"   => $self -> {"template"} -> replace_langvar("LOGIN_PASSWORD"),
                                                                             "minlen"     => 2,
                                                                             "maxlen"     => 255});
-    return ($self -> {"template"} -> load_template("login/error.tem", {"***reason***" => $error}), $args)
+    return ($self -> {"template"} -> load_template("login/error.tem", {"%(reason)s" => $error}), $args)
         if($error);
 
     # Username and password appear to be present and contain sane characters. Try to log the user in...
@@ -250,7 +250,7 @@ sub validate_login {
         } else {
             # Otherwise, send back the 'account needs activating' error
             return ($self -> {"template"} -> load_template("login/error.tem",
-                                                           {"***reason***" => $self -> {"template"} -> replace_langvar("LOGIN_ERR_INACTIVE",
+                                                           {"%(reason)s" => $self -> {"template"} -> replace_langvar("LOGIN_ERR_INACTIVE",
                                                                                                                      { "***url-resend***" => $self -> build_url("block" => "login", "pathinfo" => [ "resend" ]) })
                                                            }), $args);
         }
@@ -297,10 +297,7 @@ sub validate_login {
     }
 
     # limiting not supported, or username is bunk - return the failure message as-is
-    return ($self -> {"template"} -> load_template("login/error.tem",
+    return ($self -> {"template"} -> load_template("login/error.tem", { "%(reason)" => $failmsg }), $args);
-                                                   {
-                                                    "***reason***" => $failmsg
-                                                   }), $args);
 }
 
 
@@ -705,28 +702,21 @@ sub generate_login_form {
     my $args  = shift;
 
     # Wrap the error message in a message box if we have one.
-    $error = $self -> {"template"} -> load_template("login/error_box.tem", {"***message***" => $error})
+    $error = $self -> {"template"} -> load_template("login/error_box.tem", {"%(message)s" => $error})
         if($error);
 
-    # Persist length is always in seconds, so convert it to something more readable
+    my $persist = $self -> {"settings"} -> {"config"} -> {"Auth:allow_autologin"} ?
-    my $persist_length = $self -> {"template"} -> humanise_seconds($self -> {"session"} -> {"auth"} -> get_config("max_autologin_time"));
+        $self -> {"template"} -> load_template("login/persist_enabled.tem") :
-
+        $self -> {"template"} -> load_template("login/persist_disabled.tem");
-    # if self-registration is enabled, turn on the option
-    my $self_register = $self -> {"settings"} -> {"config"} -> {"Login:allow_self_register"} ?
-                        $self -> {"template"} -> load_template("login/selfreg.tem") :
-                        $self -> {"template"} -> load_template("login/no_selfreg.tem");
 
     return ($self -> {"template"} -> replace_langvar("LOGIN_TITLE"),
-            $self -> {"template"} -> load_template("login/form.tem", {"***error***"       => $error,
+            $self -> {"template"} -> load_template("login/form.tem", {"%(error)s"      => $error,
-                                                                      "***persistlen***"  => $persist_length,
+                                                                      "%(persist)s"    => $persist,
-                                                                      "***selfreg***"     => $self_register,
+                                                                      "%(url-forgot)s" => $self -> build_url("block" => "login", "pathinfo" => [ "recover" ]),
-                                                                      "***url-actform***" => $self -> build_url("block" => "login", "pathinfo" => [ "activate" ]),
+                                                                      "%(target)s"     => $self -> build_url("block" => "login"),
-                                                                      "***url-recform***" => $self -> build_url("block" => "login", "pathinfo" => [ "recover" ]),
+                                                                      "%(username)s"   => $args -> {"username"}}),
-                                                                      "***target***"      => $self -> build_url("block" => "login"),
+            $self -> {"template"} -> load_template("login/extrahead.tem"),
-                                                                      "***question***"    => $self -> {"settings"} -> {"config"} -> {"Login:self_register_question"},
+            $self -> {"template"} -> load_template("login/extrajs.tem"));
-                                                                      "***username***"    => $args -> {"username"},
-                                                                      "***regname***"     => $args -> {"regname"},
-                                                                      "***email***"       => $args -> {"email"}}));
 }
 
 
@@ -846,22 +836,27 @@ sub generate_loggedin {
     # If any warnings were encountered, send back a different logged-in page to avoid
     # confusing users.
     if(!$warning) {
-        # Note that, while it would be nice to immediately redirect users at this point,
+        # Do a redirect to the return URL. This bypasses problems with double-post, and
-        $content = $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_DONETITLE"),
+        # avoids the need for an interstitial. There is ambiguity about whether 302/303
-                                                        "security",
+        # responses should contain cookies, but all major browsers support doing this
-                                                        $self -> {"template"} -> replace_langvar("LOGIN_SUMMARY"),
+        # (see, eg http://blog.dubbelboer.com/2012/11/25/302-cookie.html )
-                                                        $self -> {"template"} -> replace_langvar("LOGIN_LONGDESC", {"***url***" => $url}),
+        print $self -> {"cgi"} -> redirect( -url     => $url,
-                                                        undef,
+                                            -charset => 'utf-8',
-                                                        "logincore",
+                                            -cookie  => $self -> {"session"} -> session_cookies());
-                                                        [ {"message" => $self -> {"template"} -> replace_langvar("SITE_CONTINUE"),
+        # Prevent circular references from messing up shutdown
-                                                           "colour"  => "blue",
+        $self -> {"template"} -> set_module_obj(undef);
-                                                           "action"  => "location.href='$url'"} ]);
+        $self -> {"messages"} -> set_module_obj(undef);
-        $extrahead = $self -> {"template"} -> load_template("refreshmeta.tem", {"***url***" => $url});
+        $self -> {"system"} -> clear() if($self -> {"system"});
+        $self -> {"appuser"} -> set_system(undef) if($self -> {"appuser"});
+
+        $self -> {"dbh"} -> disconnect();
+        $self -> {"logger"} -> end_log();
+        exit;
 
     # Users who have encountered warnings during login always get a login confirmation page, as it has
     # to show them the warning message box.
     } else {
-        my $message = $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_DONETITLE"),
+        my $message = $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_DONETITLE"),
                                                            "security",
                                                            $self -> {"template"} -> replace_langvar("LOGIN_SUMMARY"),
                                                            $self -> {"template"} -> replace_langvar("LOGIN_NOREDIRECT", {"***url***" => $url,
@@ -882,12 +877,12 @@ sub generate_loggedin {
 }
 
 
-## @method private @ generate_loggedout()
+## @method private @ generate_signedout()
 # Generate the contents of a page telling the user that they have successfully logged out.
 #
 # @return An array of three values: the page title string, the 'logged out' message, and
 #         a meta element to insert into the head element to redirect the user.
-sub generate_loggedout {
+sub generate_signedout {
     my $self = shift;
 
     # NOTE: This is called **after** the session is deleted, so savestate will be undef. This
@@ -896,7 +891,7 @@ sub generate_loggedout {
 
     # return the title, content, and extraheader
     return ($self -> {"template"} -> replace_langvar("LOGOUT_TITLE"),
-            $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGOUT_TITLE"),
+            $self -> message_box($self -> {"template"} -> replace_langvar("LOGOUT_TITLE"),
                                                  "security",
                                                  $self -> {"template"} -> replace_langvar("LOGOUT_SUMMARY"),
                                                  $self -> {"template"} -> replace_langvar("LOGOUT_LONGDESC", {"***url***" => $url}),
@@ -921,7 +916,7 @@ sub generate_activated {
                                     pathinfo => []);
 
     return ($self -> {"template"} -> replace_langvar("LOGIN_ACT_DONETITLE"),
-            $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_ACT_DONETITLE"),
+            $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_ACT_DONETITLE"),
                                                  "security",
                                                  $self -> {"template"} -> replace_langvar("LOGIN_ACT_SUMMARY"),
                                                  $self -> {"template"} -> replace_langvar("LOGIN_ACT_LONGDESC",
@@ -946,7 +941,7 @@ sub generate_registered {
                                  pathinfo => [ "activate" ]);
 
     return ($self -> {"template"} -> replace_langvar("LOGIN_REG_DONETITLE"),
-            $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_REG_DONETITLE"),
+            $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_REG_DONETITLE"),
                                                  "security",
                                                  $self -> {"template"} -> replace_langvar("LOGIN_REG_SUMMARY"),
                                                  $self -> {"template"} -> replace_langvar("LOGIN_REG_LONGDESC"),
@@ -969,7 +964,7 @@ sub generate_resent {
     my $url = $self -> build_url("block" => "login", "pathinfo" => [ "activate" ]);
 
     return ($self -> {"template"} -> replace_langvar("LOGIN_RESEND_DONETITLE"),
-            $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESEND_DONETITLE"),
+            $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESEND_DONETITLE"),
                                                  "security",
                                                  $self -> {"template"} -> replace_langvar("LOGIN_RESEND_SUMMARY"),
                                                  $self -> {"template"} -> replace_langvar("LOGIN_RESEND_LONGDESC"),
@@ -992,7 +987,7 @@ sub generate_recover {
     my $url = $self -> build_url("block" => "login", "pathinfo" => []);
 
     return ($self -> {"template"} -> replace_langvar("LOGIN_RECOVER_DONETITLE"),
-            $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RECOVER_DONETITLE"),
+            $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RECOVER_DONETITLE"),
                                                  "security",
                                                  $self -> {"template"} -> replace_langvar("LOGIN_RECOVER_SUMMARY"),
                                                  $self -> {"template"} -> replace_langvar("LOGIN_RECOVER_LONGDESC"),
@@ -1018,7 +1013,7 @@ sub generate_reset {
 
     if(!$error) {
         return ($self -> {"template"} -> replace_langvar("LOGIN_RESET_DONETITLE"),
-                $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESET_DONETITLE"),
+                $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESET_DONETITLE"),
                                                      "security",
                                                      $self -> {"template"} -> replace_langvar("LOGIN_RESET_SUMMARY"),
                                                      $self -> {"template"} -> replace_langvar("LOGIN_RESET_LONGDESC"),
@@ -1029,7 +1024,7 @@ sub generate_reset {
                                                         "action"  => "location.href='$url'"} ]));
     } else {
         return ($self -> {"template"} -> replace_langvar("LOGIN_RESET_ERRTITLE"),
-                $self -> {"template"} -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESET_ERRTITLE"),
+                $self -> message_box($self -> {"template"} -> replace_langvar("LOGIN_RESET_ERRTITLE"),
                                                      "error",
                                                      $self -> {"template"} -> replace_langvar("LOGIN_RESET_ERRSUMMARY"),
                                                      $self -> {"template"} -> replace_langvar("LOGIN_RESET_ERRDESC", {"***reason***" => $error}),
@@ -1092,61 +1087,156 @@ sub _build_login_response {
 # ============================================================================
 #  Interface functions
 
-## @method $ page_display()
+sub _handle_signout {
-# Generate the page content for this module.
-sub page_display {
     my $self = shift;
 
-    # Is this an API call, or a normal page operation?
+    # User must be logged in to log out
-    my $apiop = $self -> is_api_operation();
+    return $self -> _generate_not_loggedin()
-    if(defined($apiop)) {
+        if($self -> {"session"} -> anonymous_session());
-        # API call - dispatch to appropriate handler.
-        given($apiop) {
-            when("check")     { return $self -> api_response     ($self -> _build_login_check_response()); }
-            when("loginform") { return $self -> api_html_response($self -> _build_loginform_response()); }
-            when("login")     { return $self -> api_response     ($self -> _build_login_response()); }
 
-            default {
+    # User is logged in, do the signout
-                return $self -> api_response($self -> api_errorhash('bad_op',
+    $self -> log("signout", $self -> {"session"} -> get_session_userid());
-                                                                    $self -> {"template"} -> replace_langvar("API_BAD_OP")))
+    if($self -> {"session"} -> delete_session()) {
-            }
+        return $self -> _generate_signedout();
-        }
     } else {
-        # We need to determine what the page title should be, and the content to shove in it...
+        return $self -> _generate_fatal($SessionHandler::errstr);
-        my ($title, $body, $extrahead) = ("", "", "");
+    }
-        my @pathinfo = $self -> {"cgi"} -> multi_param("pathinfo");
+}
+
+
+sub _handle_activate {
+    my $self = shift;
+
+    # Does the get/post data include an activation code? If so, check it
+    if(defined($self -> {"cgi"} -> param("actcode"))) {
+        my ($user, $args) = $self -> _validate_actcode();
+        if(!ref($user)) {
+            $self -> log("activation error", $user);
+            return $self -> _generate_actcode_form($user);
+        } else {
+            $self -> log("activation success", $user -> {"username"});
+            return $self -> _generate_activated($user);
+        }
+    }
+
+    # Otherwise, just return the activation form
+    return $self -> _generate_actcode_form();
+}
+
+
+sub _handle_recover {
+    my $self = shift;
+
+    if(defined($self -> {"cgi"} -> param("dorecover"))) {
+        my ($user, $args) = $self -> _validate_recover();
+        if(!ref($user)) {
+            $self -> log("Reset error", $user);
+            return $self -> _generate_recover_form($user);
+        } else {
+            $self -> log("Reset success", $user -> {"username"});
+            return $self -> _generate_recover($user);
+        }
+    }
+
+    return $self -> _generate_recover_form();
+}
+
+
+sub _handle_resend {
+    my $self = shift;
+
+    if(defined($self -> {"cgi"} -> param("doresend"))) {
+        my ($user, $args) = $self -> _validate_resend();
+        if(!ref($user)) {
+            $self -> log("Resend error", $user);
+            return $self -> _generate_resend_form($user);
+        } else {
+            $self -> log("Resend success", $user -> {"username"});
+            return $self -> _generate_resent($user);
+        }
+    }
+
+    return $self -> _generate_resend_form();
+}
+
+
+sub _handle_signup {
+    my $self = shift;
+
+    if(defined($self -> {"cgi"} -> param("signup"))) {
+        # Validate/perform the registration
+        my ($user, $args) = $self -> _validate_signup();
+
+        # Do we have any errors? If so, send back the login form with them
+        if(!ref($user)) {
+            $self -> log("registration error", $user);
+            return $self -> _generate_signup_form($user, $args);
+
+            # No errors, user is registered
+        } else {
+            # Do not create a new session - the user needs to confirm the account.
+            $self -> log("registered inactive", $user -> {"username"});
+            return $self -> _generate_signedup();
+        }
+    }
+
+    return $self -> _generate_signup_form();
+}
+
+
+sub _handle_changepass {
+    my $self = shift;
 
-        # User is attempting to do a password change
     if(defined($self -> {"cgi"} -> param("changepass"))) {
-
         # Check the password is valid
         my ($user, $args) = $self -> validate_passchange();
 
         # Change failed, send back the change form
         if(!ref($user)) {
             $self -> log("passchange error", $user);
-                ($title, $body) = $self -> generate_passchange_form($user);
+            return $self -> _generate_passchange_form($user);
 
             # Change done, send back the loggedin page
         } else {
             $self -> log("password updated", $user);
-                ($title, $body, $extrahead) = $self -> generate_loggedin();
+            return $self -> _generate_loggedin();
         }
+    }
+
+    return $self -> _generate_passchange_form();
+}
+
+
+sub _dispatch_ui {
+    my $self = shift;
+
+    # We need to determine what the page title should be, and the content to shove in it...
+    my ($title, $body, $extrahead, $extrajs) = ("", "", "", "");
+    my @pathinfo = $self -> {"cgi"} -> multi_param("pathinfo");
+
+    given($pathinfo[0]) {
+        when("signup")     { ($title, $body, $extrahead, $extrajs) = $self -> _handle_signup();     }
+        when("signout")    { ($title, $body, $extrahead, $extrajs) = $self -> _handle_signout();    }
+        when("activate")   { ($title, $body, $extrahead, $extrajs) = $self -> _handle_activate();   }
+        when("recover")    { ($title, $body, $extrahead, $extrajs) = $self -> _handle_recover();    }
+        when("resend")     { ($title, $body, $extrahead, $extrajs) = $self -> _handle_resend();     }
+        when("passchange") { ($title, $body, $extrahead, $extrajs) = $self -> _handle_passchange(); }
+
+        default {
+            ($title, $body, $extrahead, $extrajs) = $self -> generate_login_form();
+        }
+    }
+
+    # Done generating the page content, return the filled in page template
+    return $self -> generate_orb_page($title, $body, $extrahead, $extrajs, 'login');
+}
+
+
+        # User is attempting to do a password change
 
             # If the user is not anonymous, they have logged in already.
-        } elsif(!$self -> {"session"} -> anonymous_session()) {
+        } elsif(!) {
 
-            # Is the user requesting a logout? If so, doo eet.
-            if(defined($self -> {"cgi"} -> param("logout")) || ($pathinfo[0] && $pathinfo[0] eq "logout")) {
-                $self -> log("logout", $self -> {"session"} -> get_session_userid());
-                if($self -> {"session"} -> delete_session()) {
-                    ($title, $body, $extrahead) = $self -> generate_loggedout();
-                } else {
-                    return $self -> generate_fatal($SessionHandler::errstr);
-                }
-
-                # Already logged in, check password and either force a change or tell the user they logged in.
-            } else {
                 my $user = $self -> {"session"} -> get_user_byid();
 
                 if($user) {
@@ -1159,7 +1249,7 @@ sub page_display {
                         ($title, $body, $extrahead) = $self -> generate_loggedin();
                     } else {
                         $self -> {"session"} -> set_variable("passchange_reason", $passchange);
-                        ($title, $body) = $self -> generate_passchange_form();
+                        ($title, $body, $extrahead, $extrajs) = $self -> generate_passchange_form();
                     }
                 } else {
                     $self -> {"logger"} -> die_log($self -> {"cgi"} -> remote_host(), "Logged in session with no user record. This Should Not Happen.");
@@ -1167,7 +1257,7 @@ sub page_display {
             }
 
             # User is anonymous - do we have a login?
-        } elsif(defined($self -> {"cgi"} -> param("login"))) {
+        } elsif(defined($self -> {"cgi"} -> param("signin"))) {
 
             # Validate the other fields...
             my ($user, $args) = $self -> validate_login();
@@ -1175,7 +1265,7 @@ sub page_display {
             # Do we have any errors? If so, send back the login form with them
             if(!ref($user)) {
                 $self -> log("login error", $user);
-                ($title, $body) = $self -> generate_login_form($user, $args);
+                ($title, $body, $extrahead, $extrajs) = $self -> generate_login_form($user, $args);
 
                 # No errors, user is valid...
             } else {
@@ -1202,87 +1292,49 @@ sub page_display {
                     ($title, $body, $extrahead) = $self -> generate_loggedin();
                 } else {
                     $self -> {"session"} -> set_variable("passchange_reason", $passchange);
-                    ($title, $body) = $self -> generate_passchange_form();
+                    ($title, $body, $extrahead, $extrajs) = $self -> generate_passchange_form();
                 }
             }
 
             # Has a registration attempt been made?
-        } elsif(defined($self -> {"cgi"} -> param("register"))) {
+        } els
-
-            # Validate/perform the registration
-            my ($user, $args) = $self -> validate_register();
-
-            # Do we have any errors? If so, send back the login form with them
-            if(!ref($user)) {
-                $self -> log("registration error", $user);
-                ($title, $body) = $self -> generate_login_form($user, $args);
-
-                # No errors, user is registered
-            } else {
-                # Do not create a new session - the user needs to confirm the account.
-                $self -> log("registered inactive", $user -> {"username"});
-                ($title, $body) = $self -> generate_registered();
-            }
-
-            # Is the user attempting activation?
-        } elsif(defined($self -> {"cgi"} -> param("actcode"))) {
-
-            my ($user, $args) = $self -> validate_actcode();
-            if(!ref($user)) {
-                $self -> log("activation error", $user);
-                ($title, $body) = $self -> generate_actcode_form($user);
-            } else {
-                $self -> log("activation success", $user -> {"username"});
-                ($title, $body) = $self -> generate_activated($user);
-            }
-
-            # Password reset requested?
-        } elsif(defined($self -> {"cgi"} -> param("dorecover"))) {
-
-            my ($user, $args) = $self -> validate_recover();
-            if(!ref($user)) {
-                $self -> log("Reset error", $user);
-                ($title, $body) = $self -> generate_recover_form($user);
-            } else {
-                $self -> log("Reset success", $user -> {"username"});
-                ($title, $body) = $self -> generate_recover($user);
-            }
 
         } elsif(defined($self -> {"cgi"} -> param("resetcode"))) {
 
             my ($user, $args) = $self -> validate_reset();
-            ($title, $body) = $self -> generate_reset(!ref($user) ? $user : undef);
+            ($title, $body, $extrahead, $extrajs) = $self -> generate_reset(!ref($user) ? $user : undef);
             # User wants a resend?
-        } elsif(defined($self -> {"cgi"} -> param("doresend"))) {
+        } els
-
-            my ($user, $args) = $self -> validate_resend();
-            if(!ref($user)) {
-                $self -> log("Resend error", $user);
-                ($title, $body) = $self -> generate_resend_form($user);
-            } else {
-                $self -> log("Resend success", $user -> {"username"});
-                ($title, $body) = $self -> generate_resent($user);
-            }
 
 
-        } elsif(defined($self -> {"cgi"} -> param("activate")) || ($pathinfo[0] && $pathinfo[0] eq "activate")) {
-            ($title, $body) = $self -> generate_actcode_form();
-
-        } elsif(defined($self -> {"cgi"} -> param("recover")) || ($pathinfo[0] && $pathinfo[0] eq "recover")) {
-            ($title, $body) = $self -> generate_recover_form();
-
-        } elsif(defined($self -> {"cgi"} -> param("resend")) || ($pathinfo[0] && $pathinfo[0] eq "resend")) {
-            ($title, $body) = $self -> generate_resend_form();
 
             # No session, no submission? Send back the login form...
-        } else {
-            ($title, $body) = $self -> generate_login_form();
         }
 
-        # Done generating the page content, return the filled in page template
+}
-        return $self -> {"template"} -> load_template("login/page.tem", {"***title***"     => $title,
+
-                                                                         "***extrahead***" => $extrahead,
+
-                                                                         "***content***"   => $body,});
+## @method $ page_display()
+# Generate the page content for this module.
+sub page_display {
+    my $self = shift;
+
+    # Is this an API call, or a normal page operation?
+    my $apiop = $self -> is_api_operation();
+    if(defined($apiop)) {
+        # API call - dispatch to appropriate handler.
+        given($apiop) {
+            when("check")     { return $self -> api_response     ($self -> _build_login_check_response()); }
+            when("loginform") { return $self -> api_html_response($self -> _build_loginform_response()); }
+            when("login")     { return $self -> api_response     ($self -> _build_login_response()); }
+
+            default {
+                return $self -> api_response($self -> api_errorhash('bad_op',
+                                                                    $self -> {"template"} -> replace_langvar("API_BAD_OP")))
+            }
+        }
+    } else {
+        return $self -> _dispatch_ui();
     }
 }
 

templates/default/api/docs.tem

@@ -0,0 +1,102 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>User Data Tools API Documentation</title>
+  <link rel="icon" type="image/png" href="{V_[scriptpath]}apidocs/images/favicon-32x32.png" sizes="32x32" />
+  <link rel="icon" type="image/png" href="{V_[scriptpath]}apidocs/images/favicon-16x16.png" sizes="16x16" />
+  <link href='{V_[scriptpath]}apidocs/css/typography.css' media='screen' rel='stylesheet' type='text/css'/>
+  <link href='{V_[scriptpath]}apidocs/css/reset.css' media='screen' rel='stylesheet' type='text/css'/>
+  <link href='{V_[scriptpath]}apidocs/css/screen.css' media='screen' rel='stylesheet' type='text/css'/>
+  <link href='{V_[scriptpath]}apidocs/css/reset.css' media='print' rel='stylesheet' type='text/css'/>
+  <link href='{V_[scriptpath]}apidocs/css/print.css' media='print' rel='stylesheet' type='text/css'/>
+
+  <script src='{V_[scriptpath]}apidocs/lib/object-assign-pollyfill.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/jquery-1.8.0.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/jquery.slideto.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/jquery.wiggle.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/jquery.ba-bbq.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/handlebars-4.0.5.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/lodash.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/backbone-min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/swagger-ui.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/highlight.9.1.0.pack.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/highlight.9.1.0.pack_extended.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/jsoneditor.min.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/marked.js' type='text/javascript'></script>
+  <script src='{V_[scriptpath]}apidocs/lib/swagger-oauth.js' type='text/javascript'></script>
+
+  <!-- Some basic translations -->
+  <!-- <script src='lang/translator.js' type='text/javascript'></script> -->
+  <!-- <script src='lang/ru.js' type='text/javascript'></script> -->
+  <!-- <script src='lang/en.js' type='text/javascript'></script> -->
+
+  <script type="text/javascript">
+    $(function () {
+      var url = window.location.search.match(/url=([^&]+)/);
+      if (url && url.length > 1) {
+        url = decodeURIComponent(url[1]);
+      } else {
+        url = "{V_[scriptpath]}data/swagger.json";
+      }
+
+      hljs.configure({
+        highlightSizeThreshold: 5000
+      });
+
+      // Pre load translate...
+      if(window.SwaggerTranslator) {
+        window.SwaggerTranslator.translate();
+      }
+      window.swaggerUi = new SwaggerUi({
+        url: url,
+        dom_id: "swagger-ui-container",
+        supportedSubmitMethods: ['get', 'post', 'put', 'delete', 'patch'],
+        onComplete: function(swaggerApi, swaggerUi){
+          if(typeof initOAuth == "function") {
+            initOAuth({
+              clientId: "your-client-id",
+              clientSecret: "your-client-secret-if-required",
+              realm: "your-realms",
+              appName: "your-app-name",
+              scopeSeparator: " ",
+              additionalQueryStringParams: {}
+            });
+          }
+
+          if(window.SwaggerTranslator) {
+            window.SwaggerTranslator.translate();
+          }
+
+          window.swaggerUi.api.setHost('%(host)s');
+        },
+        onFailure: function(data) {
+          log("Unable to Load SwaggerUI");
+        },
+        docExpansion: "list",
+        jsonEditor: false,
+        defaultModelRendering: 'schema',
+        showRequestHeaders: false
+      });
+
+      window.swaggerUi.load();
+      function log() {
+        if ('console' in window) {
+          console.log.apply(console, arguments);
+        }
+      }
+  });
+  </script>
+</head>
+
+<body class="swagger-section">
+<div id='header'>
+  <div class="swagger-ui-wrap">
+    <a id="logo" href="http://swagger.io"><img class="logo__img" alt="swagger" height="30" width="30" src="{V_[scriptpath]}apidocs/images/logo_small.png" /><span class="logo__title">swagger API explorer</span></a>
+  </div>
+</div>
+
+<div id="message-bar" class="swagger-ui-wrap" data-sw-translate>&nbsp;</div>
+<div id="swagger-ui-container" class="swagger-ui-wrap"></div>
+</body>
+</html>

templates/default/api/html_error.tem

@@ -0,0 +1 @@
+<div id="apierror" class="error %(code)s">%(info)s</div>

templates/default/api/html_wrapper.tem

@@ -0,0 +1,7 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head profile="http://www.w3.org/2005/10/profile">
+<title>API Response</title>
+</head>
+<body>%(data)s</body>
+</html>

templates/default/css/foundation.mods.css

@@ -0,0 +1,23 @@
+/* Remove margins from selected elements */
+.nomargin {
+    margin: 0 0;
+}
+
+/* Label to the right of switches */
+.switch-label {
+    color: #0a0a0a;
+    font-weight: normal;
+    padding-left: 0.5rem;
+    vertical-align: 50%;
+}
+
+/* Space out buttons in the title bar */
+div.top-bar-right ul.menu li {
+    padding-left: 0.25rem;
+}
+
+/* Centre text in title part of bar */
+div.top-bar-title {
+    padding-top: 0.5rem;
+    font-weight: bold;
+}

templates/default/css/login.css

@@ -0,0 +1,4 @@
+@charset "utf-8";
+div.contextlink {
+    font-size: 12px;
+}

templates/default/error/error_box.tem

@@ -0,0 +1,6 @@
+<table class="notebox notebox-error">
+    <tr>
+        <td class="nbox-image show-for-medium"><img src="{V_[templatepath]}images/error.png" width="48" height="48" alt="error" /></td>
+        <td class="nbox-text">%(message)s</td>
+    </tr>
+</table>

templates/default/error/error_item.tem

@@ -0,0 +1 @@
+<li>%(error)s</li>

templates/default/error/error_list.tem

@@ -0,0 +1,2 @@
+<div>%(message)s</div>
+<ul>%(errors)s</ul>

templates/default/login/extrahead.tem

@@ -0,0 +1 @@
+        <link rel="stylesheet" href="{V_[csspath]}login.css" />

templates/default/login/extrajs.tem

@@ -0,0 +1,12 @@
+                    $(function() {
+                        // Toggle the persist warning box, if it exists
+                        if($('#persist').length) {
+                            $('#persist').change(function() {
+                                if($('#persist').is(':checked')) {
+                                    $('#persist-warn').fadeIn();
+                                } else {
+                                    $('#persist-warn').fadeOut();
+                                }
+                            });
+                        }
+                    });

templates/default/login/form.tem

@@ -0,0 +1,34 @@
+            <div class="small-8 small-centered columns">
+%(error)s
+                <!-- Start login form -->
+                <div class="signinform callout secondary">
+                    <div>{L_LOGIN_INTRO}</div>
+                    <form id="signinform" method="post" action="%(target)s">
+                        <div class="entry">
+                            <label for="username">{L_LOGIN_USERNAME}:<br />
+                                <input type="text" id="username" name="username" size="24" maxlength="32" value="%(username)s"/>
+                            </label>
+                        </div>
+                        <div class="entry">
+                            <label for="password">{L_LOGIN_PASSWORD}:<br />
+                                <input type="password" id="password" name="password" size="24" maxlength="255" />
+                            </label>
+                        </div>
+                        <div class="persist">
+%(persist)s
+                            <div class="contextlink">(<a href="%(url-forgot)s">{L_LOGIN_RECOVER}</a>)</div>
+                        </div>
+                        <div class="submit clearfix">
+                            <input type="submit" class="button float-right nomargin" id="signin" name="signin" value="{L_LOGIN_LOGIN}" />
+                        </div>
+                    </form>
+                </div>
+                <!-- Persist warning shown when persist is enabled -->
+                <table class="notebox notebox-error hidden" id="persist-warn">
+                    <tr>
+                        <td class="nbox-image show-for-medium"><img src="{V_[templatepath]}images/error.png" width="48" height="48" alt="error" /></td>
+                        <td class="nbox-text">{L_PERSIST_WARNING}</td>
+                    </tr>
+                </table>
+                <!-- End login form -->
+            </div>

templates/default/login/persist_disabled.tem

@@ -0,0 +1 @@
+<!-- no persist -->

templates/default/login/persist_enabled.tem

@@ -0,0 +1,4 @@
+                            <div class="switch nomargin">
+                                <input class="switch-input nomargin" id="persist" type="checkbox" name="persist">
+                                <label class="switch-paddle" for="persist"><span class="show-for-sr">Keep me logged in</span></label><span class="switch-label">Keep me logged in</span>
+                            </div>

templates/default/messagebox.tem

@@ -0,0 +1,15 @@
+            <div class="small-8 small-centered columns">
+                <!-- Start messagebox core -->
+                <div class="messagebox callout %(boxclass)s">
+                    <h2>%(title)s</h2>
+                    <div class="mbcontent">
+                        <div class="mcore">
+                            <div class="msummary">%(summary)s</div>
+                            <div class="mtext">%(longdesc)s</div>
+                        </div>
+%(additional)s
+%(buttons)s
+                    </div>
+                </div>
+                <!-- End messagebox core -->
+            </div>

templates/default/messagebox_button.tem

@@ -0,0 +1 @@
+<button class="button %(colour)s" onclick="%(onclick)s">%(message)s</div>

templates/default/messagebox_buttonbar.tem

@@ -0,0 +1 @@
+                        <div class="buttonbox">%(buttons)s</div>

templates/default/page.tem

@@ -0,0 +1,30 @@
+<!doctype html>
+<html class="no-js" lang="en">
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>%(title)s</title>
+        <link rel="stylesheet" href="{V_[templatepath]}foundation/css/foundation.min.css" />
+        <link rel="stylesheet" href="{V_[csspath]}notebox.css" />
+        <link rel="stylesheet" href="{V_[csspath]}foundation.mods.css" />
+%(extrahead)s
+    </head>
+    <body>
+        <!-- Start top bar -->
+%(userbar)s
+        <!-- End top bar -->
+        <br />
+        <!-- Start content -->
+        <div class="row" id="content">
+%(content)s
+        </div>
+        <!-- End content -->
+        <!-- Foundation and other javascript shenanigans -->
+        <script src="{V_[templatepath]}foundation/js/vendor/jquery.js"></script>
+        <script src="{V_[templatepath]}foundation/js/vendor/foundation.min.js"></script>
+        <script>
+            $(document).foundation();
+%(extrajs)s
+        </script>
+    </body>
+</html>

templates/default/userbar/userbar.tem

@@ -0,0 +1,9 @@
+        <div class="top-bar">
+            <div class="top-bar-title"><span class="title">%(title)s</span></div>
+            <div class="top-bar-right">
+                <ul class="menu">
+                    <li><a class="button success">Sign up</a></li>
+                    <li><a class="button">Sign in</a></li>
+                </ul>
+            </div>
+        </div>

templates/default/validator_harness.tem

@@ -0,0 +1,10 @@
+<!doctype html>
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+        <title>AATL Validation Harness</title>
+    </head>
+    <body>
+        ***body***
+    </body>
+</html>