package org.realityforge.ssf;

import java.lang.reflect.Field;
import javax.annotation.Nonnull;
import org.keycloak.KeycloakSecurityContext;
import org.keycloak.adapters.OidcKeycloakAccount;
import org.keycloak.representations.AccessToken;
import org.keycloak.representations.IDToken;
import org.keycloak.representations.JsonWebToken;
import org.realityforge.guiceyloops.server.AssertUtil;
import org.realityforge.guiceyloops.shared.ValueUtil;
import org.realityforge.keycloak.sks.SimpleAuthService;
import org.testng.annotations.Test;
import static org.mockito.Mockito.*;
import static org.testng.Assert.*;

public class SimpleSecureSessionManagerTest
{
  @Test
  public void isCdiType()
  {
    AssertUtil.assertNoFinalMethodsForCDI( SimpleSecureSessionManager.class );
  }

  @Test
  public void basicWorkflow()
    throws Exception
  {
    final SimpleAuthService authService = mock( SimpleAuthService.class );
    final SimpleSecureSessionManager sm = new SimpleSecureSessionManager();
    setField( sm, authService );

    final String userID = ValueUtil.randomString();

    final OidcKeycloakAccount account = mock( OidcKeycloakAccount.class );
    final AccessToken token = new AccessToken();
    setField( token, userID );

    final KeycloakSecurityContext context =
      new KeycloakSecurityContext( ValueUtil.randomString(), token, ValueUtil.randomString(), new IDToken() );
    when( account.getKeycloakSecurityContext() ).thenReturn( context );
    when( authService.getAccount() ).thenReturn( account );

    final SessionInfo sessionInfo = sm.createSession();
    assertNotNull( sessionInfo );
    assertEquals( sessionInfo.getUserID(), userID );
  }

  private void setField( @Nonnull final JsonWebToken object, @Nonnull final String value )
    throws NoSuchFieldException, IllegalAccessException
  {
    final Field field = JsonWebToken.class.getDeclaredField( "id" );
    field.setAccessible( true );
    field.set( object, value );
  }

  private void setField( @Nonnull final SimpleSecureSessionManager object, @Nonnull final SimpleAuthService value )
    throws NoSuchFieldException, IllegalAccessException
  {
    final Field field = SimpleSecureSessionManager.class.getDeclaredField( "_authService" );
    field.setAccessible( true );
    field.set( object, value );
  }
}

@@ -1480,42 +1480,507 @@
 ice.
-getAccount() ).thenReturn( account
+findAccount() ).thenReturn( account );%0A%0A    final SessionInfo sessionInfo = sm.createSession();%0A    assertNotNull( sessionInfo );%0A    assertEquals( sessionInfo.getUserID(), userID );%0A  %7D%0A%0A  @Test%0A  public void supportUnAuthenticated()%0A    throws Exception%0A  %7B%0A    final SimpleAuthService authService = mock( SimpleAuthService.class );%0A    final SimpleSecureSessionManager sm = new SimpleSecureSessionManager();%0A    setField( sm, authService );%0A%0A    when( authService.findAccount() ).thenReturn( null
  );%0A
@@ -2105,38 +2105,36 @@
 fo.getUserID(), 
-userID
+null
  );%0A  %7D%0A%0A  priva

Add some additional tests