/*
 * The contents of this file are subject to the terms of the Common Development and
 * Distribution License (the License). You may not use this file except in compliance with the
 * License.
 *
 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
 * specific language governing permission and limitations under the License.
 *
 * When distributing Covered Software, include this CDDL Header Notice in each file and include
 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
 * Header, with the fields enclosed by brackets [] replaced by your own identifying
 * information: "Portions copyright [year] [name of copyright owner]".
 *
 * Copyright 2026 3A Systems, LLC.
 */
package org.forgerock.opendj.rest2ldap.authz;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
import static org.forgerock.opendj.ldap.Connections.newInternalConnectionFactory;
import static org.forgerock.opendj.rest2ldap.authz.AuthenticationStrategies.newSimpleBindStrategy;
import static org.forgerock.services.context.SecurityContext.AUTHZID_DN;
import static org.forgerock.services.context.SecurityContext.AUTHZID_ID;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;

import org.forgerock.opendj.ldap.ConnectionFactory;
import org.forgerock.opendj.ldap.LdapException;
import org.forgerock.opendj.ldap.MemoryBackend;
import org.forgerock.opendj.ldap.ResultCode;
import org.forgerock.opendj.ldap.schema.Schema;
import org.forgerock.opendj.ldif.LDIFEntryReader;
import org.forgerock.services.context.RootContext;
import org.forgerock.services.context.SecurityContext;
import org.forgerock.testng.ForgeRockTestCase;
import org.forgerock.util.promise.Promise;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;

@Test
@SuppressWarnings("javadoc")
public final class SimpleBindStrategyTest extends ForgeRockTestCase {
    private static final String USER_DN = "uid=bjensen,ou=People,dc=example,dc=com";

    private ConnectionFactory factory;

    @BeforeMethod
    public void setUp() throws Exception {
        factory = newInternalConnectionFactory(new MemoryBackend(new LDIFEntryReader(
                "dn: dc=example,dc=com",
                "objectClass: domain",
                "dc: example",
                "",
                "dn: ou=People,dc=example,dc=com",
                "objectClass: organizationalUnit",
                "ou: People",
                "",
                "dn: " + USER_DN,
                "objectClass: inetOrgPerson",
                "uid: bjensen",
                "cn: Barbara Jensen",
                "sn: Jensen",
                "userPassword: secret")));
    }

    /** The documented default template, {@code {username}}, takes the user name as the bind DN. */
    @Test
    public void testDefaultTemplateTakesTheUserNameAsTheBindDn() throws Exception {
        final SecurityContext context = newSimpleBindStrategy(factory, "%s", Schema.getDefaultSchema())
                .authenticate(USER_DN, "secret", new RootContext()).getOrThrow();

        assertThat(context.getAuthorization().get(AUTHZID_DN)).isEqualTo(USER_DN);
        assertThat(context.getAuthorization().get(AUTHZID_ID)).isEqualTo(USER_DN);
    }

    @Test
    public void testTemplateTakesTheUserNameAsAnAttributeValue() throws Exception {
        final SecurityContext context =
                newSimpleBindStrategy(factory, "uid=%s,ou=People,dc=example,dc=com", Schema.getDefaultSchema())
                        .authenticate("bjensen", "secret", new RootContext()).getOrThrow();

        assertThat(context.getAuthorization().get(AUTHZID_DN)).isEqualTo(USER_DN);
    }

    /** A user name inside a template stays one attribute value: it cannot add RDNs of its own. */
    @Test
    public void testTemplateEscapesTheUserName() throws Exception {
        assertFailsWith(newSimpleBindStrategy(factory, "uid=%s,dc=example,dc=com", Schema.getDefaultSchema())
                .authenticate("bjensen,ou=People", "secret", new RootContext()), ResultCode.INVALID_CREDENTIALS);
    }

    /** A user name which is not a DN fails the returned promise instead of being thrown by authenticate(). */
    @Test
    public void testUserNameWhichIsNotADnFailsThePromise() throws Exception {
        assertFailsWith(newSimpleBindStrategy(factory, "%s", Schema.getDefaultSchema())
                .authenticate("bjensen", "secret", new RootContext()), ResultCode.INVALID_CREDENTIALS);
    }

    /** A user name which is not a DN is refused before a connection is taken, so none is left open. */
    @Test
    public void testUserNameWhichIsNotADnTakesNoConnection() throws Exception {
        final ConnectionFactory connections = mock(ConnectionFactory.class);
        assertFailsWith(newSimpleBindStrategy(connections, "%s", Schema.getDefaultSchema())
                .authenticate("bjensen", "secret", new RootContext()), ResultCode.INVALID_CREDENTIALS);
        verify(connections, never()).getConnectionAsync();
    }

    @Test
    public void testWrongPasswordFails() throws Exception {
        assertFailsWith(newSimpleBindStrategy(factory, "%s", Schema.getDefaultSchema())
                .authenticate(USER_DN, "wrong", new RootContext()), ResultCode.INVALID_CREDENTIALS);
    }

    private static void assertFailsWith(final Promise<SecurityContext, LdapException> promise,
            final ResultCode expected) throws Exception {
        try {
            promise.getOrThrow();
            fail("The authentication should have failed");
        } catch (final LdapException e) {
            assertThat(e.getResult().getResultCode()).isEqualTo(expected);
        }
    }
}