<?php
require 'dbPDO.php';
$title = "About Us";
$nav = true;
$about = array(
    'All product information is dynamically generated using PHP and mySQL.',
    'Product, customer, and order information is stored in a mySQL database.',
    'Include files are used for all code that is used more than once (i.e. header and footer).',
    'mySQL Database',
    array(
        'Normalized to 3rd normal form (or greater). Tables include:',
        array(
            'book details',
            'book categories',
            'relationship details-books (many-to-many)',
            'authors',
            'relationship authors-books (many-to-many)',
            'customers',
            'orders',
            'relationship order items (one-to-many)',
            'Password hashes',
            'relationship uuidcustomers (many-to-one)',
            'uuidcart'
        ),
        'Database is located on a seperate database server for greater security and speed.'
    ),
    'Home page',
    array(
        'Selects three random elements from the database using a SQL statement.',
        'Instructs the template to generate the browse menu dynamically from the database using a SQL query that shows only the book categories that currently contain books.',
        'Truncates book descriptions to less than 250 characters, ensuring words are not cut off'
    ),
    'Search page',
    array(
        'Uses PDO to protect against SQL Injection attacks',
        'Uses the \'htmlspecialchars\' function to prevent users from displaying arbitrary HTML on the page',
        'Searches book title, description, author, and category fields in the database.',
        'The \'rowCount\' function is used to count the number of books found by the search.',
        'Responds gracefully to searches that return no matches.',
        'Redirects to product page if search results contain only one match.'
    ),
    'Shopping Cart Page',
    array(
        'Uses a cookie to store the ISBNs of items in the cart.'
    ),
    'Checkout pages',
    array(
        'Used to search the database for email addresses of existing customer accounts and writes their shipping information in the form on the order confirmation page.',
        'Customer ID is encrypted using Rijndeal encryption algorithm'
    ),
    'Order confirmation page',
    array(
        'Checks for shopping cart and prompts user if cart is empty.',
        'All fields are checked to make sure that they contain information.',
        'Checks email address in database and prompts user to try again user if address not found.',
        'Modifications made to customer information are updated in the database.',
        'Order information are written to the database.',
        'An email is sent to the customer with the order information.',
        'The shopping cart is emptied by setting ItemCount to zero in the ShoppingCart cookie.'
    ),
    'Order history page',
    array(
        'Searches the database for all orders associated with e-mail address',
        'If no matching email address is found user is prompted to try again.'
    ),
    'Account page',
    array(
        'Allows users to update their account information without requiring them to make a purchase',
        'Allows users to create accounts',
        'Allows users to login after they have created an account'
    ),
    'API page',
    array(
        'Requires a request type get by get variable. Types are:',
        array(
            'search',
            'book',
            'cart',
            'history',
            'user',
            'login',
            'logout'
        ),
        'Search request requires query get parameter of + separated words (ex. "hello+world")',
        'Book request requires isbn get parameter',
        'Cart request requires userUUID cookie to be set but no parameters',
        'History request requires user to be logged in but no parameters',
        'User request required user to be logged in but no parameters',
        'Login request requires no user to be logged in, with email and password post parameters',
        'Logout requres no parameters',
        'Page will verify to be sure parameters exist and are not empty',
        'Page displays output in the <a href="http://json.org/example.html">JSON format</a>',
        array(
            'Success field will be set to true if there are no errors',
            'Error will be false or contain the error message',
            'Data will either contain the requested data, or a copy of the error message'
        ),
        'I do not want to document all the error messages, but they should be self explanatory'
    ),
    'Template',
    array(
        'A template page is used to make the whole site look pretty, and enforce consistent design throughot.',
        'Template is called at the end of every user visable page to provide the output',
        'Output buffering is not needed becuase all output is added to a variable instead of the content of the page',
        'This page handles UUID generation for browser identification',
        'Links all necessary CSS and JS files',
        'Template is also responsible for rendering the menu that lists categories',
        'Displays products user has recently visited (hidden on mobile)',
        'Link for logout at the bottom of the page is generated only if a user is logged in'
    ),
    'Enhancements',
    array(
        'About page uses recursive array traversal to generate its content.',
        'One template file is used for the whole website.',
        'The code for the categories is only located in the template file',
        'Links for the authors are fetched by a SQL query from the database and not a seperate function call',
        'PDO is used instead of mySQLi because PDO supports <a href="http://php.net/manual/en/pdo.prepared-statements.php">prepared statements</a> which are more secure than escaping user entered content.',
        'The website uses CSS styles to improve its accessability on mobile devices.',
        'Custom font because it looks cooler',
        'about.php',
        array(
            'Uses recursion to generate this pages content'
        ),
        'Account page',
        array(
            'Allows users to update their account information without requiring them to make a purchase',
            'Allows users to create accounts',
            'Allows users to login/logout after they have created an account',
        ),
        'api.php',
        array(
            'Allows API interaction with the bookstore (documented above)'
        ),
        'apiform.php',
        array(
            'Allows users to easily test the API',
            'Strict mode JavaScript generates the form and select fields'
        ),
        'bookStyle.css',
        array(
            'Custom desktop css styles for the bookstore',
            'Custom mobile css styles for the bookstore',
            'Custom fonts provided by Google Fonts'
        ),
        'checkout01.php',
        array(
            'Modified to use user accounts instead of passing values in POST fields'
        ),
        'checkout02.php',
        array(
            'Modified to use user accounts instead of passing values in POST fields',
            'Verifies cart has something in it before allowing user to check out',
        ),
        'checkout03.php',
        array(
            'Modified to use user accounts instead of passing values in POST fields',
            'Uses database transactions to maintain database consistency'
        ),
        'dbPDO.php',
        array(
            'Extends the PDO class to create a connection to the database'
        ),
        'orderHistory.php',
        array(
            'Modified to use user accounts instead of encrypted custID',
            'Would allow user to enter email address to see previous orders, but this is disabled because of the user account system <small>check a09 branch for this functionality</small>',
        ),
        'productPage.php',
        array(
            'Uses GROUP_CONCAT sql statement to get a link that contains authors names',
            'Tracks user page visits in bookcustomerviews by UUID and ISBN.',
            array(
                'Will create a new row in the database for the users uuid if this is the first time the user has visited this page',
                'Will update the last visited time in a row if the user has previously visited the page',
                'Uses database transactions to ensure database consistency in case of a failure'
            ),
            'Uses JavaScript to display full size book image (has loading icon until the image loads)'
        ),
        'searchBrowse.php',
        array(
            'Redirects to productPage if there is only one result for the search query',
            'Pulls category name from the database instead of from the query string',
            'Redirects user to homepage if no query (search or browse) is set',
            'Truncates descriptions before 250 characters making sure not to remove words'
        ),
        'shoppingCart.php',
        array(
            'Uses PDO prepared statements for security',
            'Stores cart information linked to a user\'s UUID in the database',
            'Redirects page after adding or removing an ISBN to prevent duplicate operations (if the user refreshes the page)',
            'Uses sprintf function to correctly format prices'
        ),
        'template.php',
        array(
            'Handles rendering for the whole site <small>conceptually similar to templating languages like <a href="http://jinja.pocoo.org/">jinja</a></small>',
            'Displays a list of previously viewed products',
            'Displays the number of items in the cart',
            'Generates the navigation on the left of the page',
            'Shows a count of the number of items in each category',
            'Shows username instead of account if user is logged in and has entered their first name',
            'Only shows logout link if a user is logged in'
        ),
        'User accounts',
        array(
            'User passwords are salted and hashed using HMAC with SHA-512',
            'Salts are 64-bit of entropy generated by a CSPRNG (openssl_random_pseudo_bytes)',
            'Salts are stored in the bookCustomers table using a binary(8) field',
            'Storing hashes as binary values is more efficient (it is easier to store and compare binary values) than using a varchar field',
            'Hashed passwords are stored in bookpwhash table independent of any personal user information',
            array(
                'This design concept is called <a href="http://ethanheilman.tumblr.com/post/28481738192/security-through-obesity">security through obesity</a>',
                'Relies on the uniqueness of the SHA-512 hashing function',
                'Statistically, I will win the lottery before there is a collision of SHA-512 hashes (and I don\'t buy lottery tickets)',
                'Therefore salted password hashes can be stored separate from user information',
                'Password hashes are stored as a binary(64) field (512 bits)'
            ),
            'A user account (custID) can have multiple browsers (UUIDs) assigned to it. You can be logged in from multiple differnet browsers',
            'Password hashes are dependent on email address, so users are not allowed to change their email address'
        ),
    ),
    'Thanks to Amazon.com for the use of its icons, book images, and book descriptions.',
    '<a href="https://css-tricks.com/snippets/css/a-guide-to-flexbox/">Flexbox</a> is amazing and beautiful.',
    'Book icon made by <a href="http://www.freepik.com" title="Freepik">Freepik</a> from <a href="http://www.flaticon.com" title="Flaticon">www.flaticon.com</a> is licensed by <a href="http://creativecommons.org/licenses/by/3.0/" title="Creative Commons BY 3.0">CC BY 3.0</a>',
    'CSS loading icon from <a href="http://tobiasahlin.com/spinkit/">Tobias Ahlin</a>',
    'Cart icon made by <a href="http://www.google.com" title="Google">Google</a> from <a href="http://www.flaticon.com" title="Flaticon">www.flaticon.com</a> is licensed under <a href="http://creativecommons.org/licenses/by/3.0/" title="Creative Commons BY 3.0">CC BY 3.0</a>'
);
function generateAboutPage($about) {
    $output = '<li>Site created by Kyle Daling as a class project for <a href="//yorktown.cbe.wwu.edu/sandvig/mis314/">MIS 314</a> as Western Washington University.';
    foreach($about as $line) {
        $output .= recurse($line);
    }
    return $output . '</li>';
}
function recurse($l) {
    if (is_string($l)) {
        return '</li><li>' . $l;
    } else if (is_array($l)) {
        $output = '<ul>';
        foreach ($l as $n) {
            $output .= recurse($n);
        }
        return $output . '</ul>';
    }
}
$content = '<h1 class="subheading">Site Features</h1>';
$content .= '<ul>' . generateAboutPage($about) . '</ul>';
require 'template.php';
?>