package com.atlassian.seraph.filter;
   
   import com.atlassian.seraph.auth.StubAuthenticator;
   import com.atlassian.seraph.config.SecurityConfig;
   import com.atlassian.seraph.util.LocalMockHttpServletRequest;
   import com.mockobjects.dynamic.Mock;
   import com.mockobjects.servlet.MockHttpServletResponse;
   import junit.framework.TestCase;
   
  import java.io.IOException;
  import java.util.Collections;
  import javax.servlet.FilterChain;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import javax.servlet.http.HttpSession;
  
  public class TestBaseLoginFilter extends TestCase
  {
      private SecurityConfig securityConfig;
      private CountingBaseLoginFilter baseLoginFilter;
  
      @Override
      protected void setUp() throws Exception
      {
          baseLoginFilter = new CountingBaseLoginFilter();
      }
  
      public void testRedirectToOriginalDestinationNoURL() throws Exception
      {
          // Build up the mock HttpServletRequest.
          final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
          final HttpSession session = new MockSession();
          request.setSession(session);
          request.setupGetContextPath("/jira");
          request.setupAddParameter("os_destination", (String) null);
  
          // Build up the mock response.
          final Mock mockHttpServletResponse = new Mock(HttpServletResponse.class);
          // expect not to be called
  
          assertFalse(baseLoginFilter.redirectToOriginalDestination(request, (HttpServletResponse) mockHttpServletResponse.proxy()));
  
          mockHttpServletResponse.verify();
      }
  
      public void testRedirectToOriginalDestinationViaSession() throws Exception
      {
          final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
          // Set a redirect URL in the session
          final HttpSession session = new MockSession();
          session.setAttribute("seraph_originalurl", "/Stuff");
          request.setSession(session);
          request.setupGetContextPath("/jira");
  
          // Build up the mock response.
          final Mock mockHttpServletResponse = new Mock(HttpServletResponse.class);
          // expect to be able to redirect to given URL
          mockHttpServletResponse.expect("sendRedirect", "/jira/Stuff");
  
          assertTrue(baseLoginFilter.redirectToOriginalDestination(request, (HttpServletResponse) mockHttpServletResponse.proxy()));
  
          mockHttpServletResponse.verify();
      }
  
      public void testRedirectToOriginalDestinationViaRequestParameter() throws Exception
      {
          final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
          // No redirect URL in the session
          request.setSession(new MockSession());
          request.setupScheme("http");
          request.setupServerName("example.com");
          request.setupPort(80);
          request.setupGetContextPath("/jira");
          request.setupAddParameter("os_destination", "http://example.com/jira/Stuff");
  
          // Build up the mock response.
          final Mock mockHttpServletResponse = new Mock(HttpServletResponse.class);
          // expect to be able to redirect to given URL
          mockHttpServletResponse.expect("sendRedirect", "http://example.com/jira/Stuff");
  
          assertTrue(baseLoginFilter.redirectToOriginalDestination(request, (HttpServletResponse) mockHttpServletResponse.proxy()));
  
          mockHttpServletResponse.verify();
      }
  
      public void testRedirectToOriginalDestinationViaBoth() throws Exception
      {
          final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
          // No redirect URL in the session
          request.setSession(new MockSession());
          request.setupScheme("http");
          request.setupServerName("example.com");
          request.setupGetContextPath("/jira");
          request.setupAddParameter("os_destination", "http://evil.com/jira/Stuff");
  
          // Build up the mock response.
         final Mock mockHttpServletResponse = new Mock(HttpServletResponse.class);
         // expect to be NOT able to redirect to given URL (security violation) - we send you to the home of the context instead.
         mockHttpServletResponse.expect("sendRedirect", "/jira/");
 
         assertTrue(baseLoginFilter.redirectToOriginalDestination(request, (HttpServletResponse) mockHttpServletResponse.proxy()));
 
         mockHttpServletResponse.verify();
     }
 
     public void testSecurityWrappingAndLoginCalled() throws IOException, ServletException
     {
         StubAuthenticator stubAuthenticator = new StubAuthenticator();
         securityConfig = new MockSecurityConfig(null, null, stubAuthenticator, null, Collections.EMPTY_LIST);
 
         final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
         request.setupGetAttribute(null);
         request.setupGetParameterMap(Collections.EMPTY_MAP);
 
         final MockHttpServletResponse mockHttpServletResponse = new MockHttpServletResponse();
 
         FilterChain filterChain = new FilterChain()
         {
             int filterCount = 0;
 
             public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse)
                     throws IOException, ServletException
             {
                 // at this stage the servlet request should be a security wrapped HttpServletRequest
                 // see SER-142
                 assertTrue(servletRequest instanceof BaseLoginFilter.SecurityHttpRequestWrapper);
                 filterCount++;
                 assertEquals("We must not call the FilterChain more than once", 1, filterCount);
             }
         };
 
         baseLoginFilter.doFilter(request, mockHttpServletResponse, filterChain);
         assertEquals(1, baseLoginFilter.getLoginCount());
     }
 
     public void testAlreadyFilterNeverCallsLogin() throws IOException, ServletException
     {
         final LocalMockHttpServletRequest request = new LocalMockHttpServletRequest();
         request.setupGetAttribute(true);   // cause ALREADY_FILTERED to be true
 
 
         final MockHttpServletResponse mockHttpServletResponse = new MockHttpServletResponse();
         FilterChain filterChain = new FilterChain()
         {
             int filterCount = 0;
 
             public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse)
                     throws IOException, ServletException
             {
                 // at this stage the servlet request should be a security wrapped HttpServletRequest
                 // see SER-142
                 assertTrue(servletRequest instanceof BaseLoginFilter.SecurityHttpRequestWrapper);
                 filterCount++;
                 assertEquals("We must not call the FilterChain more than once", 1, filterCount);
             }
         };
 
         baseLoginFilter.doFilter(request, mockHttpServletResponse, filterChain);
         assertEquals(0, baseLoginFilter.getLoginCount());
     }
 
 
     class CountingBaseLoginFilter extends BaseLoginFilter
     {
         private int loginCount = 0;
         private final String loginStatus;
 
         public CountingBaseLoginFilter()
         {
             this(LOGIN_NOATTEMPT);
         }
 
         public CountingBaseLoginFilter(final String loginStatus)
         {
             this.loginStatus = loginStatus;
         }
 
 
         /**
          * We have to override this because BaseLoginFilter is abstract on this method
          *
          * @param request  the HTTP request in play
          * @param response the HTTP response in play
          *
          * @return the state of the login
          */
         @Override
         public String login(final HttpServletRequest request, final HttpServletResponse response)
         {
             loginCount++;
             return loginStatus;
 
         }
 
         @Override
         protected SecurityConfig getSecurityConfig()
         {
             if (securityConfig == null)
             {
                 securityConfig = new MockSecurityConfig();
             }
             return securityConfig;
         }
 
         public int getLoginCount()
         {
             return loginCount;
         }
     }
 }