package yushijinhun.authlibagent.web.servlet;

import java.util.UUID;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServletRequest;
import org.json.JSONArray;
import org.json.JSONObject;
import yushijinhun.authlibagent.api.web.ForbiddenOperationException;
import yushijinhun.authlibagent.api.web.response.AuthenticateResponse;
import yushijinhun.authlibagent.api.web.response.GameProfileResponse;
import yushijinhun.authlibagent.web.YggdrasilPostServlet;
import static yushijinhun.authlibagent.commons.UUIDUtils.*;
import static yushijinhun.authlibagent.commons.RandomUtils.*;

@WebServlet("/yggdrasil/authenticate")
public class AuthenticateServlet extends YggdrasilPostServlet {

	private static final long serialVersionUID = 1L;

	@Override
	protected JSONObject process(JSONObject req, HttpServletRequest rawReq) throws Exception {
		checkAgent(req);
		String username = req.getString("username");
		String password = req.getString("password");
		String clientTokenStr = req.optString("clientToken");
		UUID clientToken;
		if (clientTokenStr == null) {
			clientToken = randomUUID();
		} else {
			clientToken = toUUID(clientTokenStr);
		}

		AuthenticateResponse authResp = backend.authenticate(username, password, clientToken);
		JSONObject resp = new JSONObject();
		resp.put("accessToken", unsign(authResp.getAccessToken()));
		resp.put("clientToken", unsign(clientToken));

		JSONObject userEntry = new JSONObject();
		userEntry.put("id", username);
		resp.put("user", userEntry);

		resp.put("selectedProfile", profileSerializer.serialize(authResp.getSelectedProfile()));

		JSONArray profilesEntry = new JSONArray();
		for (GameProfileResponse profile : authResp.getProfiles()) {
			profilesEntry.put(profileSerializer.serialize(profile));
		}
		resp.put("availableProfiles", profilesEntry);

		return resp;
	}

	private void checkAgent(JSONObject req) throws ForbiddenOperationException {
		JSONObject agent = req.getJSONObject("agent");
		if (!"Minecraft".equals(agent.getString("name")) || agent.getInt("version") != 1) {
			throw new ForbiddenOperationException("Invalid agent");
		}
	}

}

@@ -1508,24 +1508,129 @@
 serEntry);%0A%0A
+%09%09GameProfileResponse selectedProfile = authResp.getSelectedProfile();%0A%09%09if (selectedProfile != null) %7B%0A%09
 %09%09resp.put(%22
@@ -1675,29 +1675,17 @@
 rialize(
-authResp.getS
+s
 electedP
@@ -1690,21 +1690,23 @@
 dProfile
-()
 ));
+%0A%09%09%7D
 %0A%0A%09%09JSON

add null checks for selectedProfile