package com.asquera.elasticsearch.plugins.http;

import static org.hamcrest.Matchers.equalTo;

import java.net.InetSocketAddress;
import java.util.HashMap;
import java.util.Map;

import net.jalg.hawkj.Algorithm;
import net.jalg.hawkj.HawkContext;

import org.elasticsearch.common.settings.ImmutableSettings;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.http.HttpServerTransport;
import org.elasticsearch.rest.RestStatus;
import org.elasticsearch.rest.helper.HttpClient;
import org.elasticsearch.rest.helper.HttpClientResponse;
import org.elasticsearch.test.ElasticsearchIntegrationTest;
import org.elasticsearch.test.ElasticsearchIntegrationTest.ClusterScope;
import org.elasticsearch.test.ElasticsearchIntegrationTest.Scope;
import org.junit.Test;

/**
 * Copied from elasticsearch tests: org.elasticsearch.plugin.ResponseHeaderPluginTest
 * then edited for this
 */
@ClusterScope(scope= Scope.SUITE, numDataNodes =1)
public class TestHttpHawkAuthentication extends ElasticsearchIntegrationTest {

    @Override
    protected Settings nodeSettings(int nodeOrdinal) {
        return ImmutableSettings.settingsBuilder()
        		.put("plugin.types", HttpAuthenticationPlugin.class.getName())
                .put("force.http.enabled", true)
                .put("http.basic.user", "Aladdin")
                .put("http.basic.password", "open sesame")
                .put("http.basic.ipwhitelist", new String[] { "192.169.12.12" })
                .put("http.authentication.scheme", "hawk")
                .put(super.nodeSettings(nodeOrdinal))
                .build();
    }

    @Test
    public void testHttpBasicAuth() throws Exception {
        ensureGreen();

        HttpClientResponse response = httpClient().request("/_status");
        assertThat(response.errorCode(), equalTo(RestStatus.UNAUTHORIZED.getStatus()));
        assertThat(response.getHeader("WWW-Authenticate"), equalTo("Basic realm=\"Restricted\""));

        Map<String, String> headers = new HashMap<String, String>();
        InetSocketAddress address = cluster().httpAddresses()[0];
        HawkContext hawk = HawkContext.request("GET",
             "/_status", 
             address.getAddress().getHostAddress(),
             address.getPort())
			.credentials("Aladdin", "open sesame", Algorithm.SHA_256)
//			.tsAndNonce(authHeader.getTs(), authHeader.getNonce())
//			.hash(authHeader.getHash())
			.build();
        headers.put("Authorization", hawk.createAuthorizationHeader().toString());
        HttpClientResponse authResponse = httpClient().request("GET", "/_status", headers);
        assertThat(authResponse.errorCode(), equalTo(RestStatus.OK.getStatus()));
    }

    private HttpClient httpClient() {
        HttpServerTransport httpServerTransport = cluster().getDataNodeInstance(HttpServerTransport.class);
        return new HttpClient(httpServerTransport.boundAddress().publishAddress());
    }

}

@@ -2670,24 +2670,621 @@
 Status()));%0A
+        %0A        // Test with wrong authentication%0A        headers = new HashMap%3CString, String%3E();%0A        hawk = HawkContext.request(%22GET%22,%0A             %22/_status%22, %0A             address.getAddress().getHostAddress(),%0A             address.getPort())%0A           .credentials(%22Aladdin%22, %22DO NOT open sesame%22, Algorithm.SHA_256)%0A           .build();%0A        headers.put(%22Authorization%22, hawk.createAuthorizationHeader().toString());%0A        authResponse = httpClient().request(%22GET%22, %22/_status%22, headers);%0A        assertThat(authResponse.errorCode(), equalTo(RestStatus.UNAUTHORIZED.getStatus()));%0A
     %7D%0A%0A    p

Add test with invalid credentials