/* ====================================================================
 *    Licensed to the Apache Software Foundation (ASF) under one
 *    or more contributor license agreements.  See the NOTICE file
 *    distributed with this work for additional information
 *    regarding copyright ownership.  The ASF licenses this file
 *    to you under the Apache License, Version 2.0 (the
 *    "License"); you may not use this file except in compliance
 *    with the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing,
 *    software distributed under the License is distributed on an
 *    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *    KIND, either express or implied.  See the License for the
 *    specific language governing permissions and limitations
 *    under the License.
 * ====================================================================
 */

#include <apr_strings.h>

#include "serf.h"
#include "test_serf.h"

static apr_status_t
authn_callback_expect_not_called(char **username,
                                 char **password,
                                 serf_request_t *request, void *baton,
                                 int code, const char *authn_type,
                                 const char *realm,
                                 apr_pool_t *pool)
{
    handler_baton_t *handler_ctx = baton;
    test_baton_t *tb = handler_ctx->tb;

    tb->result_flags |= TEST_RESULT_AUTHNCB_CALLED;

    /* Should not have been called. */
    return REPORT_TEST_SUITE_ERROR();
}

/* Tests that authn fails if all authn schemes are disabled. */
static void test_authentication_disabled(CuTest *tc)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[1];
    apr_status_t status;

    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    serf_config_authn_types(tb->context, SERF_AUTHN_NONE);
    serf_config_credentials_callback(tb->context,
                                     authn_callback_expect_not_called);

    Given(tb->mh)
      GETRequest(URLEqualTo("/"), ChunkedBodyEqualTo("1"))
        Respond(WithCode(401), WithChunkedBody("1"),
                WithHeader("WWW-Authenticate", "Basic realm=\"Test Suite\""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/", 1);
    status = run_client_and_mock_servers_loops(tb, 1,
                                               handler_ctx, tb->pool);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceived);
    EndVerify
    CuAssertIntEquals(tc, SERF_ERROR_AUTHN_NOT_SUPPORTED, status);
    CuAssertTrue(tc, !(tb->result_flags & TEST_RESULT_AUTHNCB_CALLED));
}

/* Tests that authn fails if encountered an unsupported scheme. */
static void test_unsupported_authentication(CuTest *tc)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[1];
    apr_status_t status;


    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    serf_config_authn_types(tb->context, SERF_AUTHN_ALL);
    serf_config_credentials_callback(tb->context,
                                     authn_callback_expect_not_called);

    Given(tb->mh)
      GETRequest(URLEqualTo("/"), ChunkedBodyEqualTo("1"))
        Respond(WithCode(401), WithChunkedBody("1"),
                WithHeader("WWW-Authenticate",
                           "NotExistent realm=\"Test Suite\""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/", 1);
    status = run_client_and_mock_servers_loops(tb, 1,
                                               handler_ctx, tb->pool);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceived);
    EndVerify
    CuAssertIntEquals(tc, SERF_ERROR_AUTHN_NOT_SUPPORTED, status);
    CuAssertTrue(tc, !(tb->result_flags & TEST_RESULT_AUTHNCB_CALLED));
}

static apr_status_t
basic_authn_callback(char **username,
                     char **password,
                     serf_request_t *request, void *baton,
                     int code, const char *authn_type,
                     const char *realm,
                     apr_pool_t *pool)
{
    handler_baton_t *handler_ctx = baton;
    test_baton_t *tb = handler_ctx->tb;

    tb->result_flags |= TEST_RESULT_AUTHNCB_CALLED;

    if (code != 401)
        return REPORT_TEST_SUITE_ERROR();
    if (strcmp("Basic", authn_type) != 0)
        return REPORT_TEST_SUITE_ERROR();
    if (strcmp(apr_psprintf(pool, "<http://localhost:%d> Test Suite",
                            tb->serv_port), realm) != 0)
        return REPORT_TEST_SUITE_ERROR();

    *username = "serf";
    *password = "serftest";

    return APR_SUCCESS;
}

/* Test template, used for KeepAlive Off and KeepAlive On test */
static void basic_authentication(CuTest *tc, int close_conn)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[2];
    int num_requests_sent;
    apr_status_t status;


    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    serf_config_authn_types(tb->context, SERF_AUTHN_BASIC);
    serf_config_credentials_callback(tb->context, basic_authn_callback);

    /* Test that a request is retried and authentication headers are set
       correctly. */
    num_requests_sent = 1;

    /* c2VyZjpzZXJmdGVzdA== is base64 encoded serf:serftest . */
    /* Use non-standard case WWW-Authenticate header and scheme name to test
       for case insensitive comparisons. */
    Given(tb->mh)
      GETRequest(URLEqualTo("/"), HeaderNotSet("Authorization"))
        Respond(WithCode(401),WithChunkedBody("1"),
                WithHeader("www-Authenticate", "bAsIc realm=\"Test Suite\""),
                OnConditionThat(close_conn, WithConnectionCloseHeader))
      GETRequest(URLEqualTo("/"),
                 HeaderEqualTo("Authorization", "Basic c2VyZjpzZXJmdGVzdA=="))
        Respond(WithCode(200),WithChunkedBody(""))
    Expect
      AllRequestsReceivedInOrder
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/", 1);
    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    CuAssertTrue(tc, tb->result_flags & TEST_RESULT_AUTHNCB_CALLED);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllExpectationsOk);
    EndVerify

    /* Test that credentials were cached by asserting that the authn callback
       wasn't called again. */
    Given(tb->mh)
      GETRequest(URLEqualTo("/"),
                 HeaderEqualTo("Authorization", "Basic c2VyZjpzZXJmdGVzdA=="))
        Respond(WithCode(200), WithChunkedBody(""))
    Expect
      AllRequestsReceivedInOrder
    EndGiven
    tb->result_flags = 0;

    create_new_request(tb, &handler_ctx[0], "GET", "/", 2);
    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    CuAssertTrue(tc, !(tb->result_flags & TEST_RESULT_AUTHNCB_CALLED));
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllExpectationsOk);
    EndVerify
}

static void test_basic_authentication(CuTest *tc)
{
    basic_authentication(tc, 0 /* don't close connection */);
}

static void test_basic_authentication_keepalive_off(CuTest *tc)
{
    basic_authentication(tc, 1);
}

static apr_status_t
digest_authn_callback(char **username,
                      char **password,
                      serf_request_t *request, void *baton,
                      int code, const char *authn_type,
                      const char *realm,
                      apr_pool_t *pool)
{
    handler_baton_t *handler_ctx = baton;
    test_baton_t *tb = handler_ctx->tb;

    tb->result_flags |= TEST_RESULT_AUTHNCB_CALLED;

    if (code != 401)
        return REPORT_TEST_SUITE_ERROR();
    if (strcmp("Digest", authn_type) != 0)
        return REPORT_TEST_SUITE_ERROR();
    if (strcmp(apr_psprintf(pool, "<http://localhost:%d> Test Suite",
                            tb->serv_port), realm) != 0)
        return REPORT_TEST_SUITE_ERROR();

    *username = "serf";
    *password = "serftest";

    return APR_SUCCESS;
}

/* Test template, used for KeepAlive Off and KeepAlive On test */
static void digest_authentication(CuTest *tc, int close_conn)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[2];
    int num_requests_sent;
    apr_status_t status;

    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    /* Add both Basic and Digest here, should use Digest only. */
    serf_config_authn_types(tb->context, SERF_AUTHN_BASIC | SERF_AUTHN_DIGEST);
    serf_config_credentials_callback(tb->context, digest_authn_callback);

    create_new_request(tb, &handler_ctx[0], "GET", "/test/index.html", 1);

    /* Test that a request is retried and authentication headers are set
       correctly. */
    num_requests_sent = 1;


    /* Expected string relies on strict order of attributes of Digest, which are
       not guaranteed.
       6ff0d4cc201513ce970d5c6b25e1043b is encoded as:
         md5hex(md5hex("serf:Test Suite:serftest") & ":" &
                md5hex("ABCDEF1234567890") & ":" &
                md5hex("GET:/test/index.html"))
     */
    Given(tb->mh)
      GETRequest(URLEqualTo("/test/index.html"), HeaderNotSet("Authorization"))
        Respond(WithCode(401), WithChunkedBody("1"),
                WithHeader("www-Authenticate", "Digest realm=\"Test Suite\","
                           "nonce=\"ABCDEF1234567890\",opaque=\"myopaque\","
                           "algorithm=\"MD5\",qop-options=\"auth\""),
                OnConditionThat(close_conn, WithConnectionCloseHeader))
      GETRequest(URLEqualTo("/test/index.html"),
                 HeaderEqualTo("Authorization", "Digest realm=\"Test Suite\", "
                               "username=\"serf\", nonce=\"ABCDEF1234567890\", "
                               "uri=\"/test/index.html\", "
                               "response=\"6ff0d4cc201513ce970d5c6b25e1043b\", "
                               "opaque=\"myopaque\", algorithm=\"MD5\""))
        Respond(WithCode(200),WithChunkedBody(""))
    Expect
      AllRequestsReceivedInOrder
    EndGiven

    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    CuAssertIntEquals(tc, num_requests_sent, tb->handled_requests->nelts);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllExpectationsOk);
    EndVerify

    CuAssertTrue(tc, tb->result_flags & TEST_RESULT_AUTHNCB_CALLED);
}

static void test_digest_authentication(CuTest *tc)
{
    digest_authentication(tc, 0 /* don't close connection */);
}

static void test_digest_authentication_keepalive_off(CuTest *tc)
{
    /* Add the Connection: close header to the response with the Digest headers.
       This to test that the Digest headers will be added to the retry of the
       request on the new connection. */
    digest_authentication(tc, 1);
}

static apr_status_t
switched_realm_authn_callback(char **username,
                              char **password,
                              serf_request_t *request, void *baton,
                              int code, const char *authn_type,
                              const char *realm,
                              apr_pool_t *pool)
{
    handler_baton_t *handler_ctx = baton;
    test_baton_t *tb = handler_ctx->tb;
    const char *exp_realm = tb->user_baton;

    tb->result_flags |= TEST_RESULT_AUTHNCB_CALLED;

    if (code != 401)
        return REPORT_TEST_SUITE_ERROR();
    if (strcmp(exp_realm, realm) != 0)
        return REPORT_TEST_SUITE_ERROR();

    if (strcmp(apr_psprintf(pool, "<http://localhost:%d> Test Suite",
                            tb->serv_port), realm) == 0) {
        *username = "serf";
        *password = "serftest";
    } else {
        *username = "serf_newrealm";
        *password = "serftest";
    }

    return APR_SUCCESS;
}

/* Test template, used for both Basic and Digest switch realms test */
static void authentication_switch_realms(CuTest *tc,
                                         const char *scheme,
                                         const char *authn_attr,
                                         const char *authz_attr_test_suite,
                                         const char *authz_attr_wrong_realm,
                                         const char *authz_attr_new_realm)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[2];
    int num_requests_sent;
    apr_status_t status;

    const char *exp_authz_test_suite = apr_psprintf(tb->pool, "%s %s", scheme,
                                                    authz_attr_test_suite);
    const char *exp_authz_wrong_realm = apr_psprintf(tb->pool, "%s %s", scheme,
                                                     authz_attr_wrong_realm);
    const char *exp_authz_new_realm = apr_psprintf(tb->pool, "%s %s", scheme,
                                                   authz_attr_new_realm);

    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    serf_config_authn_types(tb->context, SERF_AUTHN_BASIC | SERF_AUTHN_DIGEST);
    serf_config_credentials_callback(tb->context,
                                     switched_realm_authn_callback);

    /* Test that a request is retried and authentication headers are set
       correctly. */
    tb->user_baton = apr_psprintf(tb->pool, "<http://localhost:%d> Test Suite",
                                  mhServerPortNr(tb->mh));
    num_requests_sent = 1;

    Given(tb->mh)
      GETRequest(URLEqualTo("/"), ChunkedBodyEqualTo("1"),
                 HeaderNotSet("Authorization"))
        Respond(WithCode(401), WithChunkedBody("1"),
                WithHeader("WWW-Authenticate",
                           apr_psprintf(tb->pool, "%s realm=\"Test Suite\"%s",
                                        scheme, authn_attr)))
      GETRequest(URLEqualTo("/"), ChunkedBodyEqualTo("1"),
                 HeaderEqualTo("Authorization", exp_authz_test_suite))
        Respond(WithCode(200), WithChunkedBody(""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/", 1);
    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    CuAssertIntEquals(tc, num_requests_sent, tb->handled_requests->nelts);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceivedInOrder);
    EndVerify
    CuAssertTrue(tc, tb->result_flags & TEST_RESULT_AUTHNCB_CALLED);

    /* Test that credentials were cached by asserting that the authn callback
       wasn't called again. */
    tb->result_flags = 0;

    Given(tb->mh)
      GETRequest(URLEqualTo("/"), ChunkedBodyEqualTo("2"),
                 HeaderEqualTo("Authorization", exp_authz_test_suite))
        Respond(WithCode(200), WithChunkedBody(""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/", 2);
    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceivedInOrder);
    EndVerify
    CuAssertTrue(tc, !(tb->result_flags & TEST_RESULT_AUTHNCB_CALLED));

    /* Switch realms. Test that serf asks the application for new
       credentials. */
    tb->result_flags = 0;
    tb->user_baton = apr_psprintf(tb->pool, "<http://localhost:%d> New Realm",
                                  mhServerPortNr(tb->mh));

    Given(tb->mh)
      GETRequest(URLEqualTo("/newrealm/index.html"), ChunkedBodyEqualTo("3"),
                 HeaderEqualTo("Authorization", exp_authz_wrong_realm))
        Respond(WithCode(401), WithChunkedBody("1"),
                WithHeader("WWW-Authenticate",
                           apr_psprintf(tb->pool, "%s realm=\"New Realm\"%s",
                                        scheme, authn_attr)))
    GETRequest(URLEqualTo("/newrealm/index.html"), ChunkedBodyEqualTo("3"),
               HeaderEqualTo("Authorization", exp_authz_new_realm))
        Respond(WithCode(200), WithChunkedBody(""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "GET", "/newrealm/index.html", 3);
    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceivedInOrder);
    EndVerify
    CuAssertTrue(tc, tb->result_flags & TEST_RESULT_AUTHNCB_CALLED);
}

static void test_basic_switch_realms(CuTest *tc)
{
    authentication_switch_realms(tc, "Basic", "", "c2VyZjpzZXJmdGVzdA==",
                                 "c2VyZjpzZXJmdGVzdA==",
                                 "c2VyZl9uZXdyZWFsbTpzZXJmdGVzdA==");
}

static void test_digest_switch_realms(CuTest *tc)
{
    authentication_switch_realms(tc, "Digest", ",nonce=\"ABCDEF1234567890\","
 "opaque=\"myopaque\", algorithm=\"MD5\",qop-options=\"auth\"",
 /* response hdr attribute for Test Suite realm, uri / */
 "realm=\"Test Suite\", username=\"serf\", nonce=\"ABCDEF1234567890\", "
 "uri=\"/\", response=\"3511a71fec5c02ab1c9212711a8baa58\", "
 "opaque=\"myopaque\", algorithm=\"MD5\"",
 /* response hdr attribute for Test Suite realm, uri /newrealm/index.html */
 "realm=\"Test Suite\", username=\"serf\", nonce=\"ABCDEF1234567890\", "
 "uri=\"/newrealm/index.html\", response=\"c6b673cf44ad16ef379930856b607344\", "
 "opaque=\"myopaque\", algorithm=\"MD5\"",
 /* response hdr attribute for New Realm realm, uri /newrealm/index.html */
 "realm=\"New Realm\", username=\"serf_newrealm\", nonce=\"ABCDEF1234567890\", "
 "uri=\"/newrealm/index.html\", response=\"f93f07d1412e53c421f66741a89198cb\", "
 "opaque=\"myopaque\", algorithm=\"MD5\"");
}

static void test_auth_on_HEAD(CuTest *tc)
{
    test_baton_t *tb = tc->testBaton;
    handler_baton_t handler_ctx[1];
    int num_requests_sent;
    apr_status_t status;

    /* Set up a test context with a server */
    setup_test_mock_server(tb);
    status = setup_test_client_context(tb, NULL, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);

    serf_config_authn_types(tb->context, SERF_AUTHN_BASIC);
    serf_config_credentials_callback(tb->context, basic_authn_callback);

    /* Test that a request is retried and authentication headers are set
       correctly. */
    num_requests_sent = 1;

    Given(tb->mh)
      HEADRequest(URLEqualTo("/"), BodyEqualTo(""),
                  HeaderNotSet("Authorization"))
        Respond(WithCode(401), WithBody(""),
                WithHeader("WWW-Authenticate", "Basic Realm=\"Test Suite\""))
      HEADRequest(URLEqualTo("/"), BodyEqualTo(""),
                  HeaderEqualTo("Authorization", "Basic c2VyZjpzZXJmdGVzdA=="))
        Respond(WithCode(200), WithBody(""))
    EndGiven

    create_new_request(tb, &handler_ctx[0], "HEAD", "/", -1);

    status = run_client_and_mock_servers_loops(tb, num_requests_sent,
                                               handler_ctx, tb->pool);
    CuAssertIntEquals(tc, APR_SUCCESS, status);
    CuAssertIntEquals(tc, num_requests_sent, tb->handled_requests->nelts);
    Verify(tb->mh)
      CuAssertTrue(tc, VerifyAllRequestsReceivedInOrder);
    EndVerify

    CuAssertTrue(tc, tb->result_flags & TEST_RESULT_AUTHNCB_CALLED);
}

/*****************************************************************************/
CuSuite *test_auth(void)
{
    CuSuite *suite = CuSuiteNew();

    CuSuiteSetSetupTeardownCallbacks(suite, test_setup, test_teardown);

    SUITE_ADD_TEST(suite, test_authentication_disabled);
    SUITE_ADD_TEST(suite, test_unsupported_authentication);
    SUITE_ADD_TEST(suite, test_basic_authentication);
    SUITE_ADD_TEST(suite, test_basic_authentication_keepalive_off);
    SUITE_ADD_TEST(suite, test_digest_authentication);
    SUITE_ADD_TEST(suite, test_digest_authentication_keepalive_off);
    SUITE_ADD_TEST(suite, test_basic_switch_realms);
    SUITE_ADD_TEST(suite, test_digest_switch_realms);
    SUITE_ADD_TEST(suite, test_auth_on_HEAD);

    return suite;
}