package com.atlassian.plugins.rest.module.sal.websudo;
   
   import static org.junit.Assert.assertFalse;
   import static org.junit.Assert.assertTrue;
   import static org.mockito.Mockito.never;
   import static org.mockito.Mockito.verify;
   import static org.mockito.Mockito.when;
   import static org.mockito.MockitoAnnotations.initMocks;
   
  import com.atlassian.plugins.rest.common.sal.websudo.WebSudoResourceContext;
  import com.atlassian.plugins.rest.module.servlet.ServletUtils;
  import com.atlassian.sal.api.websudo.WebSudoManager;
  import org.junit.After;
  import org.junit.Before;
  import org.junit.Test;
  import org.mockito.Matchers;
  import org.mockito.Mock;
  
  import javax.servlet.http.HttpServletRequest;
  
  public final class TestSalWebSudoResourceContext
  {
      @Mock private WebSudoManager webSudoManager;
      @Mock private HttpServletRequest request;
      
      private WebSudoResourceContext webSudoResourceContext;
  
      @Before
      public void setUp()
      {
          initMocks(this);
          webSudoResourceContext = new SalWebSudoResourceContext(webSudoManager);
          ServletUtils.setHttpServletRequest(request);
      }
  
      @After
      public void teardown()
      {
          webSudoManager = null;
          request = null;
          webSudoResourceContext = null;
      }
  
      @Test
      public void enforceWebSudoProtection()
      {
          when(webSudoManager.canExecuteRequest(request)).thenReturn(false);
          assertTrue(webSudoResourceContext.shouldEnforceWebSudoProtection());
      }
  
      @Test
      public void dontEnforceWebSudoProtection()
      {
          when(webSudoManager.canExecuteRequest(request)).thenReturn(true);
          assertFalse(webSudoResourceContext.shouldEnforceWebSudoProtection());
      }
  
      @Test
      public void basicAuthDoesNotRequireWebSudo()
      {
          // From http://www.ietf.org/rfc/rfc2617.txt
          when(request.getHeader("Authorization")).thenReturn("Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==");
  
          assertFalse(webSudoResourceContext.shouldEnforceWebSudoProtection());
          verify(webSudoManager, never()).canExecuteRequest(Matchers.<HttpServletRequest>anyObject());
      }
  }