<%@language = "javascript" %>
<% /*
    $Revision$
    $Id$

    File:           prs_perslid_otp_clear.asp
    Description:    Wissen OTP-code
    Parameters:
    Context:        Vanuit prs_perslid_otp.asp (zonder cp_key)
                    en vanuit prs_show_contactpersoon.asp (met cp_key)
    Note:           (Alleen) met FACFAC mag je dat ook bij iemand anders doen
*/
var JSON_Result = true;
%>

<!--#include file="../Shared/common.inc"-->
<!--#include file="../aut/login.inc"-->
<!--#include file="../prs/prs.inc" -->
<%
protectRequest.validateToken();

var theUser_key = getFParamInt("prs_key", user_key);
var contactpersoon_key = getFParamInt("cp_key", -1);
if (theUser_key != user_key && !user.has(["WEB_FACFAC","WEB_PRSSYS","WEB_FACMGT"]))
  abort_with_warning(L("lcl_no_auth"));

if (contactpersoon_key > 0) {
  // Mag de otp van de contactpersoon gewist worden?
  var sql = "SELECT prs_perslid_key"
          + "  FROM prs_contactpersoon"
          + " WHERE prs_contactpersoon_key = " + contactpersoon_key;
  var oRs = Oracle.Execute(sql);
  var prs_prskey = oRs("prs_perslid_key").Value;
  oRs.Close();

  // Controleer of de gebruiker van hetzelfde bedrijf is als de contactpersoon
  // en of de gebruiker ook EXTREL rechten heeft.
  if (prs.checkAutorisation(theUser_key).writecontact && !prs.hasAutorisation(prs_prskey, "WEB_EXTREL").write && (prs_prskey != theUser_key)) {
    theUser_key = prs_prskey;
  }
  else {
    theUser_key = null;
  }
}

var result = { success: true };
if (theUser_key != null) {
  var sql = "UPDATE prs_perslid"
          + "   SET prs_perslid_otpsecret = NULL"
          + "     , prs_perslid_otpcounter = NULL"
          + " WHERE prs_perslid_key = " + theUser_key;
  Oracle.Execute(sql);

  shared.trackaction("PRSLOG", theUser_key, L("lcl_otp_cleared"));

  result.toaster = L("lcl_otp_cleared");
}

Response.Write(JSON.stringify(result));
Response.End;
%>
<% ASPPAGE_END(); %>
