/*
 * Copyright (c) 2016-2017 Contributors to the Eclipse Foundation
 *
 *  See the NOTICE file(s) distributed with this work for additional
 *  information regarding copyright ownership.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  You may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 */
package org.eclipse.microprofile.jwt.tck.container.jaxrs;

import org.eclipse.microprofile.jwt.Claim;
import org.eclipse.microprofile.jwt.ClaimValue;
import org.eclipse.microprofile.jwt.JsonWebToken;

import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.SecurityContext;
import java.security.Principal;
import java.util.Date;

@Path("/endp")
@DenyAll
public class RolesEndpoint {

    @Inject
    private JsonWebToken jwtPrincipal;
    @Inject
    @Claim("raw_token")
    private ClaimValue<String> rawToken;

    @GET
    @Path("/echo")
    @RolesAllowed("Echoer")
    public String echoInput(@Context SecurityContext sec, @QueryParam("input") String input) {
        Principal user = sec.getUserPrincipal();
        return input + ", user="+user.getName();
    }

    @GET
    @Path("/echo2")
    @RolesAllowed("NoSuchUser")
    public String echoInput2(@Context SecurityContext sec, @QueryParam("input") String input) {
        Principal user = sec.getUserPrincipal();
        String name = user != null ? user.getName() : "<null>";
        return input + ", user="+name;
    }

    @GET
    @Path("/echo3")
    @RolesAllowed("EndpointCustom")
    public String echoInput3(@Context SecurityContext sec, @QueryParam("input") String input) {
        Principal user = sec.getUserPrincipal();
        return input + ", user="+user.getName();
    }

    /**
     * Validate that the  SecurityContext#getUserPrincipal is a JsonWebToken
     * @param sec
     * @return
     */
    @GET
    @Path("/getPrincipalClass")
    @RolesAllowed("Tester")
    public String getPrincipalClass(@Context SecurityContext sec) {
        Principal user = sec.getUserPrincipal();
        boolean isJsonWebToken = user instanceof JsonWebToken;
        return "isJsonWebToken:"+isJsonWebToken;
    }

    /**
     * This
     * @return
     */
    @GET
    @Path("/needsGroup1Mapping")
    @RolesAllowed("Group1MappedRole")
    public String needsGroup1Mapping(@Context SecurityContext sec) {
        Principal user = sec.getUserPrincipal();
        sec.isUserInRole("group1");
        return user.getName();
    }

    @GET
    @Path("/getInjectedPrincipal")
    public String getInjectedPrincipal(@Context SecurityContext sec) {
        boolean isJsonWebToken = this.jwtPrincipal instanceof JsonWebToken;
        return "isJsonWebToken:"+isJsonWebToken;
    }

    @GET
    @Path("/heartbeat")
    @PermitAll
    public String heartbeat() {
        return "Heartbeat: "+ new Date(System.currentTimeMillis()).toString();
    }
}

@@ -1216,32 +1216,101 @@
 s.core.Context;%0A
+import javax.ws.rs.core.MediaType;%0Aimport javax.ws.rs.core.Response;%0A
 import javax.ws.
@@ -1326,32 +1326,32 @@
 ecurityContext;%0A
-
 import java.secu
@@ -2170,17 +2170,31 @@
 h(%22/echo
-3
+NeedsToken2Role
 %22)%0A    @
@@ -2211,22 +2211,18 @@
 ed(%22
-EndpointCustom
+Token2Role
 %22)%0A 
@@ -2246,14 +2246,23 @@
 echo
-Input3
+NeedsToken2Role
 (@Co
@@ -2880,31 +2880,105 @@
   * This
-%0A     * @return
+ endpoint requires a role that is mapped to the group1 role%0A     * @return principal name
 %0A     */
@@ -3212,16 +3212,16 @@
 oup1%22);%0A
-
         
@@ -3242,32 +3242,1272 @@
 tName();%0A    %7D%0A%0A
+    /**%0A     * This endpoint requires a Tester role, and also validates that the caller has the role Echoer by calling%0A     * %7B@linkplain SecurityContext#isUserInRole(String)%7D.%0A     *%0A     * @return principal name or FORBIDDEN error%0A     */%0A    @GET%0A    @Path(%22/checkIsUserInRole%22)%0A    @RolesAllowed(%22Tester%22)%0A    public Response checkIsUserInRole(@Context SecurityContext sec) %7B%0A        Principal user = sec.getUserPrincipal();%0A        Response response;%0A        if(!sec.isUserInRole(%22Echoer%22)) %7B%0A            response = Response.status(new Response.StatusType() %7B%0A                @Override%0A                public int getStatusCode() %7B%0A                    return Response.Status.FORBIDDEN.getStatusCode();%0A                %7D%0A%0A                @Override%0A                public Response.Status.Family getFamily() %7B%0A                    return Response.Status.FORBIDDEN.getFamily();%0A                %7D%0A%0A                @Override%0A                public String getReasonPhrase() %7B%0A                    return %22SecurityContext.isUserInRole(Echoer) was false%22;%0A                %7D%0A            %7D).build();%0A        %7D%0A        else %7B%0A            response = Response.ok(user.getName(), MediaType.TEXT_PLAIN).build();%0A        %7D%0A        return response;%0A    %7D%0A%0A
     @GET%0A    @Pa

Add isUserInRole tests and alternate token tests