package com.atlassian.plugins.rest.common.security.jersey;
   
   import com.atlassian.annotations.security.XsrfProtectionExcluded;
   import com.atlassian.plugin.PluginAccessor;
   import com.atlassian.plugin.event.PluginEventManager;
   import com.atlassian.sal.api.features.DarkFeatureManager;
   import com.atlassian.sal.api.web.context.HttpContext;
   import com.atlassian.sal.api.xsrf.XsrfRequestValidator;
   import com.atlassian.sal.core.xsrf.IndependentXsrfTokenAccessor;
  import com.atlassian.sal.core.xsrf.IndependentXsrfTokenValidator;
  import com.atlassian.sal.core.xsrf.XsrfRequestValidatorImpl;
  import com.sun.jersey.api.model.AbstractMethod;
  import com.sun.jersey.api.model.AbstractResource;
  import com.sun.jersey.spi.container.ResourceFilter;
  import org.junit.Before;
  import org.junit.Test;
  import org.junit.runner.RunWith;
  import org.mockito.Mock;
  import org.mockito.invocation.InvocationOnMock;
  import org.mockito.runners.MockitoJUnitRunner;
  import org.mockito.stubbing.Answer;
  
  import javax.ws.rs.Consumes;
  import javax.ws.rs.GET;
  import javax.ws.rs.POST;
  import javax.ws.rs.Path;
  import java.lang.annotation.Annotation;
  import java.lang.reflect.AnnotatedElement;
  import java.util.List;
  
  import static org.hamcrest.CoreMatchers.instanceOf;
  import static org.hamcrest.CoreMatchers.not;
  import static org.hamcrest.collection.IsCollectionWithSize.hasSize;
  import static org.hamcrest.collection.IsIterableContainingInOrder.contains;
  import static org.hamcrest.core.Is.is;
  import static org.hamcrest.Matchers.empty;
  import static org.junit.Assert.assertThat;
  import static org.mockito.Mockito.mock;
  import static org.mockito.Mockito.when;
  
  @RunWith(MockitoJUnitRunner.class)
  public class TestXsrfResourceFilterFactory {
      private static final String LEGACY_FEATURE_KEY = "atlassian.rest.xsrf.legacy.enabled";
  
      @Mock
      private DarkFeatureManager darkFeatureManager;
      @Mock
      private HttpContext httpContext;
      private XsrfRequestValidator xsrfRequestValidator;
      @Mock
      private PluginAccessor pluginAccessor;
      @Mock
      private PluginEventManager pluginEventManager;
      private XsrfResourceFilterFactory xsrfResourceFilterFactory;
  
      private interface RequiresXsrfCheck {
      }
  
      @Before
      public void setUp() {
          xsrfRequestValidator = new XsrfRequestValidatorImpl(
                  new IndependentXsrfTokenValidator(
                          new IndependentXsrfTokenAccessor()));
          when(darkFeatureManager.isFeatureEnabledForAllUsers(
                  LEGACY_FEATURE_KEY)).thenReturn(false);
  
          xsrfResourceFilterFactory = new XsrfResourceFilterFactory(
                  httpContext, xsrfRequestValidator, pluginAccessor, pluginEventManager, darkFeatureManager);
      }
  
      @Test
      public void testHasXsrfAnnotationWithRequiresXsrfCheckPresent() {
          AnnotatedElement annotatedElement = getMockAnnotatedElement(true);
          assertThat(xsrfResourceFilterFactory.hasRequiresXsrfCheckAnnotation(
                  annotatedElement), is(true));
      }
  
      @Test
      public void testHasXsrfAnnotationWithoutRequiresXsrfCheckPresent() {
          AnnotatedElement annotatedElement = getMockAnnotatedElement(false);
          assertThat(xsrfResourceFilterFactory.hasRequiresXsrfCheckAnnotation(
                  annotatedElement), is(false));
      }
  
      @Test
      public void testHasXsrfAnnotationWithRequiresXsrfCheckAnnotation() {
          Annotation[] annotations = {getMockAnnotation(Path.class),
                  getMockAnnotation(
                          com.atlassian.plugins.rest.common.security.RequiresXsrfCheck.class
                  )};
          AnnotatedElement annotatedElement = getMockAnnotatedElement(false,
                  annotations);
          assertThat(xsrfResourceFilterFactory.hasRequiresXsrfCheckAnnotation(
                  annotatedElement), is(true));
      }
  
      @Test
      public void testHasXsrfAnnotationWithAnotherRequiresXsrfCheckAnnotation() {
          Annotation[] annotations = {getMockAnnotation(Path.class),
                 getMockAnnotation(RequiresXsrfCheck.class)};
         AnnotatedElement annotatedElement = getMockAnnotatedElement(false,
                 annotations);
         assertThat(xsrfResourceFilterFactory.hasRequiresXsrfCheckAnnotation(
                 annotatedElement), is(true));
     }
 
     @Test
     public void testHasXsrfAnnotationWithoutRequiresXsrfCheckAnnotation() {
         Annotation[] annotations = {getMockAnnotation(Path.class),
                 getMockAnnotation(Consumes.class)};
         AnnotatedElement annotatedElement = getMockAnnotatedElement(false,
                 annotations);
         assertThat(xsrfResourceFilterFactory.hasRequiresXsrfCheckAnnotation(
                 annotatedElement), is(false));
     }
 
     @Test
     public void testCreateWithXsrfProtectionExcludedAnnotation() {
         Annotation[] annotations = {getMockAnnotation(
                 XsrfProtectionExcluded.class)};
         AbstractMethod abstractMethod = getMockAbstractMethod(annotations);
         assertThat(xsrfResourceFilterFactory.create(abstractMethod), empty());
     }
 
     @Test
     public void testCreateWithoutXsrfProtectionExcludedAnnotation() {
         AbstractMethod abstractMethod = getMockAbstractMethod(
                 new Annotation[0]);
         assertThat(xsrfResourceFilterFactory.create(abstractMethod), hasSize(1));
     }
 
     @Test
     public void testCreateWithoutXsrfProtectionExcludedAnnotationInLegacyMode() {
         enableLegacyXsrfMode();
         AbstractMethod abstractMethod = getMockAbstractMethod(
                 new Annotation[0]);
         assertThat(xsrfResourceFilterFactory.create(abstractMethod), empty());
     }
 
     @Test
     public void testCreateGetResourceWithRequiresXsrfCheckAnnotation() {
         Annotation[] annotations = {getMockAnnotation(
                 RequiresXsrfCheck.class)};
         AbstractMethod abstractMethod = getMockAbstractMethod(annotations);
         when(abstractMethod.isAnnotationPresent(GET.class)).thenReturn(true);
         assertThat(xsrfResourceFilterFactory.create(abstractMethod), hasSize(1));
     }
 
     private void assertThatCreatePostProtectedByOriginBasedXsrfFilter(
             boolean containsOriginBasedXsrfFilter) {
         AbstractMethod abstractMethod = mock(AbstractMethod.class);
         AbstractResource abstractResource = getMockAbstractResource(
                 false, new Annotation[0]);
         Annotation[] annotations = {getMockAnnotation(POST.class)};
         when(abstractMethod.getResource()).thenReturn(abstractResource);
 
         when(abstractMethod.getAnnotations()).thenReturn(annotations);
         when(abstractMethod.isAnnotationPresent(POST.class)).thenReturn(true);
 
         List<ResourceFilter> resourceFilters = xsrfResourceFilterFactory.create(
                 abstractMethod);
         if (containsOriginBasedXsrfFilter) {
             assertThat(resourceFilters,
                     contains(instanceOf(OriginBasedXsrfResourceFilter.class)));
         } else {
             assertThat(resourceFilters,
                     not(contains(instanceOf(OriginBasedXsrfResourceFilter.class))));
         }
     }
 
     @Test
     public void testCreatePostProtectedByOriginBasedXsrfFilter() {
         assertThatCreatePostProtectedByOriginBasedXsrfFilter(false);
     }
 
     @Test
     public void testCreatePostProtectedByOriginBasedXsrfFilterInLegacyMode() {
         enableLegacyXsrfMode();
         assertThatCreatePostProtectedByOriginBasedXsrfFilter(true);
     }
 
     @Test
     public void testCreateGetNotProtectedByOriginBasedXsrfFilter() {
         AbstractMethod abstractMethod = mock(AbstractMethod.class);
         AbstractResource abstractResource = getMockAbstractResource(
                 false, new Annotation[0]);
         Annotation[] annotations = {getMockAnnotation(GET.class)};
         when(abstractMethod.getResource()).thenReturn(abstractResource);
 
         when(abstractMethod.getAnnotations()).thenReturn(annotations);
         when(abstractMethod.isAnnotationPresent(GET.class)).thenReturn(true);
 
         List<ResourceFilter> resourceFilters = xsrfResourceFilterFactory.create(
                 abstractMethod);
 
         assertThat(resourceFilters, empty());
     }
 
     @Test
     public void testCreateGetNotProtectedByOriginBasedXsrfFilterInLegacyMode() {
         enableLegacyXsrfMode();
         testCreateGetNotProtectedByOriginBasedXsrfFilter();
     }
 
     @Test
     public void testCreateGetResourceWithRequiresXsrfCheckAnnotationInLegacyMode() {
         enableLegacyXsrfMode();
         testCreateGetResourceWithRequiresXsrfCheckAnnotation();
     }
 
     @Test
     public void testCreateGetResourceWithoutRequiresXsrfCheckAnnotation() {
         AbstractMethod abstractMethod = getMockAbstractMethod(
                 new Annotation[0]);
         when(abstractMethod.isAnnotationPresent(GET.class)).thenReturn(true);
         assertThat(xsrfResourceFilterFactory.create(abstractMethod), empty());
     }
 
     @Test
     public void testCreateGetResourceWithoutRequiresXsrfCheckAnnotationInLegacyMode() {
         enableLegacyXsrfMode();
         testCreateGetResourceWithoutRequiresXsrfCheckAnnotation();
     }
 
     private void enableLegacyXsrfMode() {
         when(darkFeatureManager.isFeatureEnabledForAllUsers(
                 LEGACY_FEATURE_KEY)).thenReturn(true);
     }
 
     private AbstractMethod getMockAbstractMethod(Annotation[] annotations) {
         AbstractMethod abstractMethod = mock(AbstractMethod.class);
         AbstractResource abstractResource = mock(AbstractResource.class);
         when(abstractMethod.getResource()).thenReturn(abstractResource);
         when(abstractMethod.getAnnotations()).thenReturn(annotations);
         when(abstractResource.getAnnotations()).thenReturn(annotations);
         return abstractMethod;
     }
 
     private AnnotatedElement getMockAnnotatedElement(
             boolean xsrfAnnotationPresent) {
         return getMockAnnotatedElement(xsrfAnnotationPresent,
                 new Annotation[]{});
     }
 
     private AnnotatedElement getMockAnnotatedElement(
             boolean xsrfAnnotationPresent, Annotation[] annotations) {
         return setupAnnotatedElement(mock(AnnotatedElement.class),
                 xsrfAnnotationPresent, annotations);
     }
 
     private AnnotatedElement setupAnnotatedElement(
             AnnotatedElement annotatedElement, boolean xsrfAnnotationPresent,
             Annotation[] annotations) {
         when(annotatedElement.isAnnotationPresent(
                 com.atlassian.plugins.rest.common.security.RequiresXsrfCheck.class)
         ).thenReturn(xsrfAnnotationPresent);
         when(annotatedElement.getAnnotations()).thenReturn(annotations);
         return annotatedElement;
     }
 
     private AbstractResource getMockAbstractResource(
             boolean xsrfAnnotationPresent, Annotation[] annotations) {
         AbstractResource abstractResource = mock(AbstractResource.class);
         when(abstractResource.getAnnotations()).thenReturn(annotations);
         when(abstractResource.isAnnotationPresent(
                 com.atlassian.plugins.rest.common.security.RequiresXsrfCheck.class)
         ).thenReturn(xsrfAnnotationPresent);
         return abstractResource;
     }
 
     private Annotation getMockAnnotation(final Class clazz) {
         Annotation annotation = mock(Annotation.class);
         when(annotation.annotationType()).thenAnswer(
                 new Answer<Class<? extends Annotation>>() {
                     public Class<? extends Annotation> answer(InvocationOnMock invoc) {
                         return clazz;
                     }
                 });
         return annotation;
     }
 }