package com.atlassian.plugins.rest.common.security.jersey;
   
   import com.atlassian.plugins.rest.common.security.XsrfCheckFailedException;
   import com.atlassian.sal.api.web.context.HttpContext;
   import com.atlassian.sal.core.xsrf.IndependentXsrfTokenAccessor;
   import com.atlassian.sal.core.xsrf.IndependentXsrfTokenValidator;
   import com.sun.jersey.spi.container.ContainerRequest;
   import org.junit.Before;
   import org.junit.Test;
  import org.junit.runner.RunWith;
  import org.mockito.Mock;
  import org.mockito.runners.MockitoJUnitRunner;
  
  import javax.servlet.http.Cookie;
  import javax.servlet.http.HttpServletRequest;
  import javax.ws.rs.core.MediaType;
  import java.util.Arrays;
  
  import static org.hamcrest.CoreMatchers.is;
  import static org.junit.Assert.assertEquals;
  import static org.junit.Assert.assertThat;
  import static org.mockito.Mockito.when;
  
  /**
   */
  @RunWith (MockitoJUnitRunner.class)
  public class TestXsrfResourceFilter
  {
      private XsrfResourceFilter xsrfResourceFilter;
      @Mock
      private ContainerRequest request;
      @Mock
      private HttpContext httpContext;
      @Mock
      private HttpServletRequest httpServletRequest;
  
      @Before
      public void setUp()
      {
          xsrfResourceFilter = new XsrfResourceFilter();
          xsrfResourceFilter.setXsrfTokenValidator(new IndependentXsrfTokenValidator(new IndependentXsrfTokenAccessor()));
      }
  
      @Test(expected = XsrfCheckFailedException.class)
      public void testGetBlocked()
      {
          when(request.getMethod()).thenReturn("GET");
          xsrfResourceFilter.filter(request);
      }
  
      @Test
      public void testGetSuccess()
      {
          when(request.getMethod()).thenReturn("GET");
          when(request.getHeaderValue("X-Atlassian-Token")).thenReturn("nocheck");
          assertEquals(request, xsrfResourceFilter.filter(request));
      }
  
      @Test(expected = XsrfCheckFailedException.class)
      public void testPostBlocked()
      {
          when(request.getMethod()).thenReturn("POST");
          when(request.getMediaType()).thenReturn(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
          xsrfResourceFilter.filter(request);
      }
  
      @Test
      public void testPostSuccess()
      {
          when(request.getMethod()).thenReturn("POST");
          when(request.getMediaType()).thenReturn(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
          when(request.getHeaderValue("X-Atlassian-Token")).thenReturn("nocheck");
          assertEquals(request, xsrfResourceFilter.filter(request));
      }
  
      @Test
      public void testPostJsonSuccess()
      {
          when(request.getMethod()).thenReturn("POST");
          when(request.getMediaType()).thenReturn(MediaType.APPLICATION_JSON_TYPE);
          assertEquals(request, xsrfResourceFilter.filter(request));
      }
  
      @Test
      public void testPutFormSuccess()
      {
          when(request.getMethod()).thenReturn("PUT");
          when(request.getMediaType()).thenReturn(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
          assertEquals(request, xsrfResourceFilter.filter(request));
      }
  
      private static HttpServletRequest setupRequestWithXsrfToken(HttpServletRequest request, String expectedToken, String formToken)
      {
          Cookie [] cookies = {new Cookie(IndependentXsrfTokenAccessor.XSRF_COOKIE_KEY, expectedToken)};
          when(request.getCookies()).thenReturn(cookies);
          when(request.getParameter(IndependentXsrfTokenValidator.XSRF_PARAM_NAME)).thenReturn(formToken);
          return request;
      }
  
     @Test
     public void testPostWithValidXsrfTokenSuccess()
     {
         when(request.getMethod()).thenReturn("POST");
         when(request.getMediaType()).thenReturn(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
         for (String validToken : Arrays.asList("abc123", "ffff", "FFFx3~324", "☃☃☃"))
         {
             httpServletRequest = setupRequestWithXsrfToken(httpServletRequest, validToken, validToken);
             when(httpContext.getRequest()).thenReturn(httpServletRequest);
             xsrfResourceFilter.setHttpContext(httpContext);
             assertThat(xsrfResourceFilter.filter(request), is(request));
         }
     }
 
     @Test(expected = XsrfCheckFailedException.class)
     public void testPostWithInvalidXsrfTokenBlocked()
     {
         when(request.getMethod()).thenReturn("POST");
         when(request.getMediaType()).thenReturn(MediaType.APPLICATION_FORM_URLENCODED_TYPE);
         httpServletRequest = setupRequestWithXsrfToken(httpServletRequest, "abc123", "notabc123");
         when(httpContext.getRequest()).thenReturn(httpServletRequest);
         xsrfResourceFilter.setHttpContext(httpContext);
         xsrfResourceFilter.filter(request);
     }
 }