package org.sagebionetworks.web.server.servlet;

import static org.sagebionetworks.web.client.cookie.CookieKeys.USER_LOGIN_TOKEN;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.io.IOUtils;
import org.sagebionetworks.repo.model.auth.Session;
import org.sagebionetworks.schema.adapter.JSONObjectAdapter;
import org.sagebionetworks.schema.adapter.org.json.JSONObjectAdapterImpl;
import org.sagebionetworks.web.shared.WebConstants;

/**
 * Servlet for setting the session token HttpOnly cookie.
 */
public class InitSessionServlet extends HttpServlet {
	public static final String ROOT_PATH = "/";
	public static final String SYNAPSE_ORG = ".synapse.org";
	private static final long serialVersionUID = 1L;
	protected static final ThreadLocal<HttpServletRequest> perThreadRequest = new ThreadLocal<HttpServletRequest>();
	public static final int ONE_DAY_IN_SECONDS = 60*60*24;
	
	@Override
	protected void service(HttpServletRequest arg0, HttpServletResponse arg1)
			throws ServletException, IOException {
		InitSessionServlet.perThreadRequest.set(arg0);
		super.service(arg0, arg1);
	}

	@Override
	public void service(ServletRequest arg0, ServletResponse arg1)
			throws ServletException, IOException {
		super.service(arg0, arg1);
	}

	@Override
	public void doPost(final HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		
		// return the Set-Cookie response with the session token
		try {
			String sessionJson = IOUtils.toString(request.getReader());
			JSONObjectAdapter adapter = new JSONObjectAdapterImpl(sessionJson);
			Session s = new Session(adapter);
			String sessionToken = s.getSessionToken();
			if (sessionToken == null || sessionToken.isEmpty()) {
				sessionToken = WebConstants.EXPIRE_SESSION_TOKEN;
			}
			Cookie cookie = new Cookie(USER_LOGIN_TOKEN, sessionToken);
			
			if (!WebConstants.EXPIRE_SESSION_TOKEN.equals(sessionToken)) {
				cookie.setMaxAge(ONE_DAY_IN_SECONDS);
			} else {
				cookie.setMaxAge(0);
			}
			boolean isSecure = "https".equals(request.getScheme().toLowerCase());
			cookie.setSecure(isSecure);
			cookie.setHttpOnly(true);
			cookie.setPath(ROOT_PATH);
			
			String domain = request.getServerName();
			String lowerCaseDomain = domain.toLowerCase();
			if (lowerCaseDomain.contains(SYNAPSE_ORG)) {
				cookie.setDomain(SYNAPSE_ORG);
			}
			response.addCookie(cookie);
		} catch (Exception e) {
			response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
			response.getOutputStream().write("Invalid session token".getBytes("UTF-8"));
			response.getOutputStream().flush();
		}
	}
}

@@ -139,27 +139,91 @@
 java.io.
-IOException
+BufferedReader;%0Aimport java.io.IOException;%0Aimport java.util.logging.Logger
 ;%0A%0Aimpor
@@ -528,18 +528,65 @@
 ons.
-io.IOUtils
+logging.Log;%0Aimport org.apache.commons.logging.LogFactory
 ;%0Aim
@@ -943,16 +943,87 @@
 rvlet %7B%0A
+%09static private Log log = LogFactory.getLog(InitSessionServlet.class);%0A
 %09public 
@@ -1919,59 +1919,228 @@
 ring
- sessionJson = IOUtils.toString(request.getReader()
+Builder buffer = new StringBuilder();%0A%09%09%09BufferedReader reader = request.getReader();%0A%09%09%09String line;%0A%09%09%09while ((line = reader.readLine()) != null) %7B%0A%09%09%09%09buffer.append(line);%0A%09%09%09%7D%0A%09%09%09String sessionJson = buffer.toString(
 );%0A%09
@@ -3005,16 +3005,16 @@
 ookie);%0A
-
 %09%09%7D catc
@@ -3031,16 +3031,57 @@
 on e) %7B%0A
+%09%09%09log.error(e);%0A%09%09%09e.printStackTrace();%0A
 %09%09%09respo

add logging to InitSessionCookie servlet, and best guess to fix error