package io.aiven.klaw;

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

import org.junit.jupiter.api.MethodOrderer;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.TestMethodOrder;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.security.test.context.support.WithMockUser;
import org.springframework.test.annotation.DirtiesContext;
import org.springframework.test.context.TestPropertySource;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;

@SpringBootTest(
    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
    classes = UiapiApplication.class)
@TestPropertySource(locations = "classpath:test-application-rdbms1.properties")
@AutoConfigureMockMvc
@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
@DirtiesContext
class SecurityConfigNoSSOIT {

  @Autowired private MockMvc mockMvc;

  // CSRF should prevent unauthorized POSTs to secure endpoints
  @Test
  void testCsrfProtection() throws Exception {
    mockMvc
        .perform(MockMvcRequestBuilders.post("/updateProfile"))
        .andExpect(status().isForbidden());
  }

  // Logout should be allowed without CSRF
  @Test
  void testCsrfIgnoredForLogout() throws Exception {
    mockMvc.perform(MockMvcRequestBuilders.post("/logout")).andExpect(status().is3xxRedirection());
  }

  // Logout is not allowed as it's secured
  @Test
  void testLogout() throws Exception {
    mockMvc
        .perform(MockMvcRequestBuilders.post("/logout").with(csrf()))
        .andExpect(status().is3xxRedirection())
        .andExpect(redirectedUrl("/login"));
  }

  // Static resources should be permitted without login
  @Test
  void testStaticResourcesAreAccessible() throws Exception {
    mockMvc.perform(MockMvcRequestBuilders.get("/assets/css/style.css")).andExpect(status().isOk());
  }

  // Should be accessible to un-authenticated users
  @Test
  void testEndpointWithoutAuthentication() throws Exception {
    mockMvc.perform(MockMvcRequestBuilders.get("/getRoles")).andExpect(status().isOk());
  }

  // Should be accessible to authenticated users
  @Test
  @WithMockUser
  void testAuthenticatedEndpoint() throws Exception {
    mockMvc
        .perform(MockMvcRequestBuilders.get("/getRequestTypeStatuses"))
        .andExpect(status().isOk());
  }

  // Redirect to login for secured end point
  @Test
  void testUnauthorizedAccess() throws Exception {
    mockMvc
        .perform(MockMvcRequestBuilders.get("/getRequestTypeStatuses"))
        .andExpect(status().is3xxRedirection())
        .andExpect(redirectedUrlPattern("**/login"));
  }
}
