package com.atlassian.stash.internal.spring.security;

import com.atlassian.bitbucket.user.TestApplicationUser;
import com.atlassian.stash.internal.user.StashUserAuthenticationToken;
import com.atlassian.bitbucket.user.ApplicationUser;
import com.atlassian.bitbucket.user.UserService;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.runners.MockitoJUnitRunner;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.web.context.HttpRequestResponseHolder;
import org.springframework.security.web.util.matcher.RequestMatcher;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertSame;
import static org.mockito.Matchers.any;
import static org.mockito.Matchers.anyBoolean;
import static org.mockito.Matchers.eq;
import static org.mockito.Mockito.reset;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

@RunWith(MockitoJUnitRunner.class)
public class HttpSessionSecurityContextRepositoryTest {

    private static final Integer ID = 99;

    private HttpRequestResponseHolder holder;
    @InjectMocks
    private HttpSessionSecurityContextRepository repository;
    @Mock
    private HttpServletRequest request;
    @Mock
    private RequestMatcher requestMatcher;
    @Mock
    private HttpServletResponse response;
    @Mock
    private SecurityContext securityContext;
    @Mock
    private HttpSession session;
    @Mock
    private ApplicationUser user;
    @Mock
    private UserService userService;

    @Before
    public void setup() {
        holder = new HttpRequestResponseHolder(request, response);
        when(request.getSession(anyBoolean())).thenReturn(session);
        when(requestMatcher.matches(any(HttpServletRequest.class))).thenReturn(true);
    }

    @Test
    public void testLoadNoAuthToken() {
        SecurityContext context = repository.loadContext(holder);
        assertNotNull(context);
        assertNull(context.getAuthentication());
    }

    @Test
    public void testLoadInactiveUser() {
        when(session.getAttribute(HttpSessionSecurityContextRepository.STASH_SECURITY_CONTEXT_KEY)).thenReturn(ID);
        when(userService.getUserById(eq(ID))).thenReturn(user);

        SecurityContext context = repository.loadContext(holder);
        assertNotNull(context);
        assertNull(context.getAuthentication());
    }

    @Test
    public void testLoadNoSuchUser() {
        when(session.getAttribute(HttpSessionSecurityContextRepository.STASH_SECURITY_CONTEXT_KEY)).thenReturn(ID);

        SecurityContext context = repository.loadContext(holder);
        assertNotNull(context);
        assertNull(context.getAuthentication());
    }

    @Test
    public void testLoadToken() {
        when(session.getAttribute(HttpSessionSecurityContextRepository.STASH_SECURITY_CONTEXT_KEY)).thenReturn(ID);
        when(userService.getUserById(eq(ID))).thenReturn(user);
        when(user.isActive()).thenReturn(true);

        SecurityContext context = repository.loadContext(holder);
        assertNotNull(context);
        assertNotNull(context.getAuthentication());
        assertSame(user, context.getAuthentication().getPrincipal());
    }

    @Test
    public void testLoadNoSession() {
        reset(request);

        SecurityContext context = repository.loadContext(holder);
        assertNotNull(context);
        assertNull(context.getAuthentication());
    }

    @Test
    public void testSaveAuthenticated() {

        when(securityContext.getAuthentication()).thenReturn(StashUserAuthenticationToken.forUser(new TestApplicationUser("", ID)));

        repository.saveContext(securityContext, request, response);

        verify(session).setAttribute(eq(HttpSessionSecurityContextRepository.STASH_SECURITY_CONTEXT_KEY), eq(ID));
    }

    @Test
    public void testSaveNotAuthenticatedRemovesToken() {
        repository.saveContext(securityContext, request, response);

        verify(session).removeAttribute(eq(HttpSessionSecurityContextRepository.STASH_SECURITY_CONTEXT_KEY));
    }
}


