/*
 * Copyright (C) 2013 salesforce.com, inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *         http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.auraframework.http.resource;

import org.auraframework.Aura;
import org.auraframework.adapter.ConfigAdapter;
import org.auraframework.system.AuraContext;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

/**
 * Handles /l/{}/app.encryptionkey requests to retrieve encryption key.
 */
public class EncryptionKeyJs extends AuraResourceImpl {

    private ConfigAdapter configAdapter = Aura.getConfigAdapter();
    private final String PREPEND_JS = "window.Aura || (window.Aura = {});\nwindow.Aura.bootstrap || (window.Aura.bootstrap = {});\nwindow.Aura.Crypto = {};\nwindow.Aura.Crypto.key =";
    private final String APPEND_JS = ";\n(function () {\n\twindow.Aura.bootstrap.execEncryptionKey = window.performance && window.performance.now ? window.performance.now() : Date.now();\n\twindow.Aura.encryptionKeyReady = true;\n\tif (window.Aura.afterEncryptionKeyReady){\n\t\twindow.Aura.afterEncryptionKeyReady();\n\t}\n}());";

    public EncryptionKeyJs() {
        super("app.encryptionkey.js", AuraContext.Format.JS);
    }

    @Override
    public void write(HttpServletRequest request, HttpServletResponse response, AuraContext context) throws IOException {
    	servletUtilAdapter.setNoCache(response);
    	
        String key = configAdapter.getEncryptionKey();
        PrintWriter out = response.getWriter();
        out.append(PREPEND_JS);
        out.append(key);
        out.append(APPEND_JS);
    }
    
    public void setConfigAdapter(ConfigAdapter configAdapter) {
    	this.configAdapter = configAdapter;
    }
}

@@ -658,123 +658,55 @@
 ort 
-org.auraframework.Aura;%0Aimport org.auraframework.adapter.ConfigAdapter;%0Aimport org.auraframework.system.AuraContext
+java.io.IOException;%0Aimport java.io.PrintWriter
 ;%0A%0Ai
@@ -801,62 +801,131 @@
 se;%0A
+%0A
 import 
-java.io.IOException;%0Aimport java.io.PrintWriter
+org.auraframework.Aura;%0Aimport org.auraframework.adapter.ConfigAdapter;%0Aimport org.auraframework.system.AuraContext
 ;%0A%0A/
@@ -1884,17 +1884,113 @@
 n %7B%0A    
-%09
+    if (this.configAdapter.validateGetEncryptionKey(request.getParameter(%22ssid%22))) %7B%0A            
 servletU
@@ -2026,14 +2026,13 @@
 e);%0A
+%0A
     
-%09%0A
     
@@ -2078,24 +2078,28 @@
 ptionKey();%0A
+    
         Prin
@@ -2134,32 +2134,36 @@
 iter();%0A        
+    
 out.append(PREPE
@@ -2170,32 +2170,36 @@
 ND_JS);%0A        
+   
+ 
 out.append(key);
@@ -2199,16 +2199,20 @@
 d(key);%0A
+    
         
@@ -2230,24 +2230,117 @@
 APPEND_JS);%0A
+        %7D else %7B%0A            response.sendError(HttpServletResponse.SC_FORBIDDEN);%0A        %7D%0A
     %7D%0A    %0A 

validate app.encryptionkey.js requests