package com.specmate.auth.test;

import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;

import org.junit.Assert;
import org.junit.BeforeClass;
import org.junit.Test;
import org.osgi.framework.BundleContext;
import org.osgi.framework.Filter;
import org.osgi.framework.FrameworkUtil;
import org.osgi.util.tracker.ServiceTracker;

import com.specmate.auth.api.ISessionService;
import com.specmate.common.SpecmateException;
import com.specmate.usermodel.AccessRights;

public class InMemorySessionServiceTest {
	private static ISessionService sessionService;
	private static BundleContext context;
	
	@BeforeClass
	public static void init() throws Exception {
		context = FrameworkUtil.getBundle(InMemorySessionServiceTest.class).getBundleContext();
		sessionService = getSessionService();
	}
	
	@Test
	public void testIsAuthorized() throws SpecmateException {
		String token = sessionService.create(AccessRights.ALL, "test");
		assertTrue(sessionService.isAuthorized(token, "localhost/services/rest/test/resource1"));
		assertTrue(sessionService.isAuthorized(token, "localhost/services/rest/test/resource1/resource2"));
		assertTrue(sessionService.isAuthorized(token, "localhost/services/rest/test/"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/test"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest"));
	}
	
	@Test
	public void testRegexInjection() throws SpecmateException {
		String token = sessionService.create(AccessRights.ALL, "test");
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/project/resource1"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/project/"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/project"));
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/"));
		
		token = sessionService.create(AccessRights.ALL, "");
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/pro/resource1"));
		sessionService.delete(token);
		
		token = sessionService.create(AccessRights.ALL, "?");
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/p/resource1"));
		sessionService.delete(token);
		
		token = sessionService.create(AccessRights.ALL, ".*");
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/pr/resource1"));
		sessionService.delete(token);
		
		token = sessionService.create(AccessRights.ALL, ".+");
		assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/pro/resource1"));
	}
	
	@Test
	public void testDeleteSession() throws SpecmateException {
		boolean thrown = false;
		String token = sessionService.create(AccessRights.ALL, "test");
		assertTrue(sessionService.isAuthorized(token, "localhost/services/rest/test/resource1"));
		sessionService.delete(token);
		try {
			assertFalse(sessionService.isAuthorized(token, "localhost/services/rest/test/resource1"));
		} catch (SpecmateException e) {
			thrown = true;
		}
		
		assertTrue(thrown);
	}
	
	private static ISessionService getSessionService() throws Exception {
		Filter sessionFilter = context.createFilter("(impl=volatile)");
		ServiceTracker<ISessionService, ISessionService> sessionTracker = new ServiceTracker<>(context,
				sessionFilter, null);
		sessionTracker.open();
		ISessionService sessionService;
		try {
			sessionService = sessionTracker.waitForService(10000);
		} catch (InterruptedException e) {
			throw new SpecmateException(e);
		}
		Assert.assertNotNull(sessionService);
		return sessionService;
	}
}

@@ -620,16 +620,70 @@
 ontext;%0A
+%09private String baseURL = %22localhost/services/rest/%22;%0A
 %09%0A%09@Befo
@@ -929,32 +929,75 @@
 mateException %7B%0A
+%09%09String projectName = %22testIsAuthorized%22;%0A
 %09%09String token =
@@ -1029,38 +1029,43 @@
 cessRights.ALL, 
-%22test%22
+projectName
 );%0A%09%09assertTrue(
@@ -1103,37 +1103,33 @@
 en, 
-%22localhost/services/rest/test
+baseURL + projectName + %22
 /res
@@ -1191,37 +1191,33 @@
 en, 
-%22localhost/services/rest/test
+baseURL + projectName + %22
 /res
@@ -1289,37 +1289,33 @@
 en, 
-%22localhost/services/rest/test
+baseURL + projectName + %22
 /%22))
@@ -1369,38 +1369,29 @@
 en, 
-%22localhost/services/rest/test%22
+baseURL + projectName
 ));%0A
@@ -1443,34 +1443,15 @@
 en, 
-%22localhost/services/rest/%22
+baseURL
 ));%0A
@@ -1503,33 +1503,50 @@
 en, 
-%22localhost/services/rest%22
+baseURL.substring(0, baseURL.length() - 1)
 ));%0A
@@ -1672,32 +1672,46 @@
 ights.ALL, %22test
+RegexInjection
 %22);%0A%09%09assertFals
@@ -1751,33 +1751,19 @@
 en, 
-%22localhost/services/rest/
+baseURL + %22
 proj
@@ -1833,33 +1833,19 @@
 en, 
-%22localhost/services/rest/
+baseURL + %22
 proj
@@ -1906,119 +1906,26 @@
 en, 
-%22localhost/services/rest/project%22));%0A%09%09assertFalse(sessionService.isAuthorized(token, %22localhost/services/rest/
+baseURL + %22project
 %22));
@@ -2036,33 +2036,19 @@
 en, 
-%22localhost/services/rest/
+baseURL + %22
 pro/
@@ -2205,33 +2205,19 @@
 en, 
-%22localhost/services/rest/
+baseURL + %22
 p/re
@@ -2373,33 +2373,19 @@
 en, 
-%22localhost/services/rest/
+baseURL + %22
 pr/r
@@ -2542,33 +2542,20 @@
 en, 
-%22localhost/services/rest/
+ baseURL + %22
 pro/
@@ -2666,16 +2666,60 @@
  false;%0A
+%09%09String projectName = %22testDeleteSession%22;%0A
 %09%09String
@@ -2771,14 +2771,19 @@
 LL, 
-%22test%22
+projectName
 );%0A%09
@@ -2833,37 +2833,33 @@
 en, 
-%22localhost/services/rest/test
+baseURL + projectName + %22
 /res
@@ -2963,37 +2963,33 @@
 en, 
-%22localhost/services/rest/test
+baseURL + projectName + %22
 /res

Test refactoring to increase clarity