(:~
 : This module contains some basic examples for RESTXQ annotations
 : @author BaseX Team
 :)

module namespace page = 'http://item-store.com/module';
import module namespace session = 'http://basex.org/modules/session';

declare %sec:requires-login %restxq:GET %restxq:path("")
  function page:start() {
 <response>
  <html>
    <title>Awesome-Itemmanagement</title>
  </html>
 </response>
};

declare %sec:requires-principal('USER') %restxq:GET
%restxq:path("items")
  function page:users() {
 <response>
   {db:open('pers_items')/items/*[@name=sec:user()]/item}
 </response>
};

declare %sec:requires-principal('USER') %updating
%restxq:path("items/{$name}")
        %output:method("xhtml")
        %restxq:PUT        
        function page:put-item($name as xs:string) {
          let $items:=db:open('pers_items')/items
          return if(not(exists($items)))
           then insert node <user name='{sec:user()}'>
<item>{$name}</item> </user> into $items
           else insert node <item>{$name}</item> into
$items/*[@name=sec:user()]
};

declare %sec:requires-principal('USER') %updating
%restxq:path("items/{$name}")
        %output:method("xhtml")
        %restxq:POST("{$newName}")        
        function page:post-item($name as xs:string,$newName as xs:string
) {
 replace value of node
db:open('pers_items')/*[@name=sec:user()]/item[text() eq $name] with
$newName
};

declare %sec:requires-principal('USER') %updating
%restxq:path("items/{$name}")
        %output:method("xhtml")
        %restxq:DELETE        
        function page:del-item($name as xs:string) {
 delete node db:open('pers_items')/*[@name=sec:user()]/item[text() eq
$name]
};

declare %sec:requires-principal('ADMIN', 'NO_ADMIN')
%restxq:path("items-all")
        %restxq:GET
        function page:get-all-item() {
  <response>
    {db:open('pers_items')/items}
  </response>
};

declare %sec:requires-principal('USER')
%sec:authorization-fallback('NO_ADMIN') function page:but_user(){
   <response>
      User {sec:user()} is not an Admin but an user
   </response>
};

declare %sec:authorization-fallback function page:but_others(){
 <response>
 {sec:token()}
    User {sec:user()} is not authorized
 </response>
};

declare %sec:authentication-fallback function page:auth_redirect(){
  <restxq:forward>login</restxq:forward>
};

declare %restxq:GET %restxq:path("login") function page:login_page(){
  <html xmlns="http://www.w3.org/1999/xhtml">
    <body>
      Please login
      <form method="post" action="login">
        <p>User Login:<br />
        <input name="name" size="50"></input>
        <input name="password" size="50"></input>
        <input type="submit" /></p>
      </form>
    </body>
 </html>
};

declare %output:method("xhtml") %restxq:path("login")
        %restxq:POST %restxq:form-param("name", "{$name}")
%restxq:form-param("password", "{$password}") function
page:login_sd($name, $password){
       
  let $token := sec:login($name,$password)

  return session:set('sec:token',$token), <html
xmlns="http://www.w3.org/1999/xhtml">
    <body>
      You tried log in with in
    </body>
 </html>
};

(:declare %output:method("xhtml") %restxq:path("restxq/login")
        %restxq:POST %restxq:form-param("name", "{$name}")
%restxq:form-param("password", "{$password}") function page:login($name,
$password){
       
  let $token := sec:login($name,$password)

  return  <html xmlns="http://www.w3.org/1999/xhtml">
    <body>
      You tried log in with in {$token}
    </body>
 </html>
};:)

declare %sec:authenticate function page:auth(){
  let $tok:=session:get('sec:token')
  return if(exists($tok))then sec:login-token($tok) else ()
  
};