func NewCookie(kvdb *bolt.DB) (*sessions.CookieStore, error) {
	var secret []byte

	// Create cookie secret if one does not exist.
	err := kvdb.Update(func(tx *bolt.Tx) error {
		bucket, err := tx.CreateBucketIfNotExists([]byte("cookie"))
		if err != nil {
			return err
		}

		secret = bucket.Get([]byte("secret"))
		if len(secret) == 0 {
			secret = []byte(uuid.New())
			err = bucket.Put([]byte("secret"), secret)
		}

		return err
	})

	if err != nil {
		return nil, err
	}

	if len(secret) == 0 {
		return nil, errors.New("Cookie secret cannot be empty.")
	}

	return sessions.NewCookieStore(secret), nil
}

func initSession() {

	gob.Register(UserPermission(0))

	SessionStorage = sessions.NewCookieStore([]byte( /*NewHashString()*/ "main-session-storage"))
	SessionStorage.MaxAge(86400 * 3) //3 days
}

func init() {
	key := []byte(os.Getenv("SESSION_SECRET"))
	if string(key) == "" {
		fmt.Println("goth/gothic: no SESSION_SECRET environment variable is set. The default cookie store is not available and any calls will fail. Ignore this warning if you are using a different store.")
	}
	Store = sessions.NewCookieStore([]byte(key))
}

func NewServer(conf *ServerConf) *server {
	if conf.Name == "" {
		conf.Name = "server"
	}
	if conf.Port == 0 {
		conf.Port = DEFAULT_PORT
	}
	if conf.SessionSecret == "" {
		conf.SessionSecret = DEFAULT_SESSION_SECRET
	}

	self := &server{conf: conf}

	self.serverMux = http.NewServeMux()
	self.server = &graceful.Server{
		Timeout: 500 * time.Millisecond,

		Server: &http.Server{
			Addr:    ":" + self.getPortStr(),
			Handler: self.LogMiddleware(context.ClearHandler(self.serverMux)),
		},
	}
	self.server.SetKeepAlivesEnabled(false) // FIXME
	self.cookieStore = sessions.NewCookieStore([]byte(self.conf.SessionSecret))

	self.setupHandlers()
	fs := http.FileServer(http.Dir(self.conf.StaticDir))
	self.serverMux.Handle(self.conf.StaticUrl, http.StripPrefix("", fs))
	self.setupLogging()

	self.genPaths = make(map[string]*genpath.GenPath)
	return self
}

//Init initializes the session store
//this reads and sets the auth and encryption keys for session cookie
//throw errors so app is not usable if auth or encrypt keys are missing
func Init() error {
	//get the auth and encypt keys from files
	aKey, err0 := ioutil.ReadFile(authKeyPath)
	eKey, err1 := ioutil.ReadFile(encryptKeyPath)
	if err0 != nil {
		initError = err0
		return err0
	} else if err1 != nil {
		initError = err1
		return err1
	}

	//assign to package variables
	authKey = aKey
	encryptKey = eKey

	//init the session store
	s := sessions.NewCookieStore(
		authKey,
		encryptKey,
	)

	//set session options
	s.Options = options

	//store sessions to global variable
	Store = s

	//done
	return nil
}

func init() {
	if cfg.VersionAndQuit {
		fmt.Printf("cloudkeys-go %s\n", version)
		os.Exit(0)
	}

	if _, err := cfg.ParsedStorage(); err != nil {
		fmt.Printf("ERR: Please provide a valid storage URI\n")
		os.Exit(1)
	}

	if cfg.CookieSigningKey == "" {
		cfg.CookieSigningKey = uuid.NewV4().String()[:32]
		fmt.Printf("WRN: cookie-authkey was set randomly, this will break your sessions!\n")
	}

	if cfg.CookieEncryptKey == "" {
		cfg.CookieEncryptKey = uuid.NewV4().String()[:32]
		fmt.Printf("WRN: cookie-encryptkey was set randomly, this will break your sessions!\n")
	}

	cookieStore = sessions.NewCookieStore(
		[]byte(cfg.CookieSigningKey),
		[]byte(cfg.CookieEncryptKey),
	)
}

func (s *S) SetUpSuite(c *C) {
	s.srv = httptest.NewServer(APIHandler(&Config{
		SessionStore:  sessions.NewCookieStore([]byte("session-secret")),
		LoginToken:    testLoginToken,
		ControllerKey: testControllerKey,
	}))
}

func TestClear(t *testing.T) {
	var cookieName = "test"

	// Create a cookiestore
	store := sessions.NewCookieStore([]byte("secret-key"))

	// Create the recorder
	w := httptest.NewRecorder()

	// Create the request
	r := fakeGet()

	// Get the session
	sess, err := store.Get(r, cookieName)
	if err != nil {
		t.Fatalf("Error getting session: %v", err)
	}

	// Generate a token
	Token(w, r, sess)

	// Clear the token
	Clear(w, r, sess)

	if _, ok := sess.Values[TokenName]; ok {
		t.Errorf("StringMap should not exist: expected %v, got %v", nil, reflect.TypeOf(sess.Values[TokenName]))
	}
}

func TestCSRFTokenBackend(t *testing.T) {
	var cookieName = "test"

	// Create a cookiestore
	store := sessions.NewCookieStore([]byte("secret-key"))

	// Create the recorder
	w := httptest.NewRecorder()

	// Create the handler
	h := New(http.HandlerFunc(successHandler), store, cookieName)

	// Create the form
	form := url.Values{}

	// Create the POST request
	req, err := http.NewRequest("POST", "http://localhost/", bytes.NewBufferString(form.Encode()))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	// Run the page
	h.ServeHTTP(w, req)

	if w.Code == 200 {
		t.Errorf("The request should have failed, but it didn't. Instead, the code was %d",
			w.Code)
	}
}

func TestMatch(t *testing.T) {
	var cookieName = "test"

	// Create a cookiestore
	store := sessions.NewCookieStore([]byte("secret-key"))

	// Create the form
	token := "123456"
	form := url.Values{}
	form.Set(TokenName, token)

	// Create the POST request
	req, err := http.NewRequest("POST", "http://localhost/", bytes.NewBufferString(form.Encode()))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	// Get the session
	sess, err := store.Get(req, cookieName)
	if err != nil {
		t.Fatalf("Error getting session: %v", err)
	}

	// Set the values in the session manually
	sess.Values[TokenName] = make(StringMap)
	sess.Values[TokenName].(StringMap)["/"] = "123456"

	if ok := match(req, sess, true); !ok {
		t.Error("Tokens do not match")
	}
}

func TestToken(t *testing.T) {
	var cookieName = "test"
	TokenName = "foo"

	// Create a cookiestore
	store := sessions.NewCookieStore([]byte("secret-key"))

	// Create the recorder
	w := httptest.NewRecorder()

	// Create the request
	r := fakeGet()

	// Get the session
	sess, err := store.Get(r, cookieName)
	if err != nil {
		t.Fatalf("Error getting session: %v", err)
	}

	token := Token(w, r, sess)

	if token != sess.Values[TokenName].(StringMap)["/"] {
		t.Errorf("Tokens do not match: expected %v, got %v", sess.Values[TokenName], token)
	}

	// Reset the token name
	TokenName = "token"
}

func TestFlash(t *testing.T) {
	codecKey1 := "ePAPW9vJv7gHoftvQTyNj5VkWB52mlza"
	codecKey2 := "N8SmpJ00aSpepNrKoyYxmAJhwVuKEWZD"
	jar, err := cookiejar.New(nil)
	if err != nil {
		t.Error(err)
	}
	client := &http.Client{Jar: jar}
	o := &router.Options{
		Log:          logger.NewDefaultLogger(os.Stdout),
		SessionStore: sessions.NewCookieStore([]byte(codecKey1), []byte(codecKey2)),
	}
	r := router.NewRouter(o)
	r.Add(NewFlashTest)
	ts := httptest.NewServer(r)
	defer ts.Close()
	_, err = client.Get(fmt.Sprintf("%s/", ts.URL))
	if err != nil {
		t.Error(err)
	}
	_, err = client.Get(fmt.Sprintf("%s/flash", ts.URL))
	if err != nil {
		t.Error(err)
	}

	if len(result) != 3 {
		t.Errorf("expected 3 got %d", len(result))
	}
}

// New is the constructor for Application struct.
func New() (*Application, error) {
	u, err := libunix.CurrentUser()
	if err != nil {
		return nil, err
	}

	dsn := libenv.EnvWithDefault("RESOURCED_MASTER_DSN", fmt.Sprintf("postgres://%[email protected]:5432/resourced-master?sslmode=disable", u))

	db, err := sqlx.Connect("postgres", dsn)
	if err != nil {
		return nil, err
	}

	// As a user, you must provide your own secret
	// But make sure you keep using the same one, otherwise sessions will expire.
	cookieStoreSecret := libenv.EnvWithDefault("RESOURCED_MASTER_COOKIE_SECRET", "T0PS3CR3T")

	app := &Application{}
	app.Addr = libenv.EnvWithDefault("RESOURCED_MASTER_ADDR", ":55655")
	app.dsn = dsn
	app.db = db
	app.cookieStore = sessions.NewCookieStore([]byte(cookieStoreSecret))
	app.WSTraffickers = wstrafficker.NewWSTraffickers()

	return app, err
}

func TestNewSession(t *testing.T) {
	store := sessions.NewCookieStore([]byte("secret"))
	fn := func(c web.C, w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("ok"))
	}
	mux := web.New()
	mux.Handle("/*", fn)
	mux.Use(Middleware("session", store))
	ts := httptest.NewServer(context.ClearHandler(mux))
	defer ts.Close()

	var err error

	var resp *http.Response
	resp, err = http.Get(ts.URL)
	if err != nil {
		t.Fatal(err)
	}

	cookie := resp.Header.Get("Set-Cookie")
	t.Logf("Set-Cookie: %v", cookie)
	if cookie == "" {
		t.Fatal("\"Set-Cookie\" header missing")
	}

	matches := sessionPattern.FindStringSubmatch(cookie)
	if len(matches) != 2 {
		t.Fatal("session cookie missing")
	}
}

func TestStatusHandle(t *testing.T) {
	jar := sessions.NewCookieStore([]byte("secret key"))
	statusHandle := statusHandler(jar)
	test := GenerateHandleTester(t, statusHandle)

	// Check that status failed without a user logged in
	w := test("GET", "")
	if w.Code != http.StatusForbidden {
		t.Errorf(
			"GET /status returned %v. Expected %v",
			w.Code,
			http.StatusForbidden,
		)
	}

	// Check succeeds when a user is logged in
	req, err := http.NewRequest("GET", "", nil)
	if err != nil {
		t.Errorf("%v", err)
	}
	w = httptest.NewRecorder()
	session, _ := jar.Get(req, "carton-session")
	session.Values["user"] = "test user"
	session.Save(req, w)
	statusHandle.ServeHTTP(w, req)

	if w.Code != http.StatusOK {
		t.Errorf(
			"GET /status with user returned %v. Expected %v",
			w.Code,
			http.StatusOK,
		)
	}
}

// NewApplication is the constructor for Application struct.
//
// If testing is true, connects to the "test" database.
func NewApplication(testing bool) (*Application, error) {
	u, err := libunix.CurrentUser()
	if err != nil {
		return nil, err
	}

	dbname := "forty-thieves"
	if testing {
		dbname += "-test"
	}
	dsn := libenv.EnvWithDefault(
		"DSN", fmt.Sprintf("postgres://%[email protected]:5432/%s?sslmode=disable", u, dbname))

	db, err := sqlx.Connect("postgres", dsn)
	if err != nil {
		return nil, err
	}

	cookieStoreSecret := libenv.EnvWithDefault("COOKIE_SECRET", "ittwiP92o0oi6P4i")

	app := &Application{}
	app.dsn = dsn
	app.db = db
	app.cookieStore = sessions.NewCookieStore([]byte(cookieStoreSecret))

	return app, err
}

func init() {
	//Changed by William: use a config file instead of an environment variable
	key, err := ioutil.ReadFile(SESSION_SECRET_CONFIG_FILE_PATH)
	if err != nil {
		log.Println("could not load session secret from file ",
			SESSION_SECRET_CONFIG_FILE_PATH)
		log.Println(err)

		//TODO delete these lines, when I know this will never be used.
		// key, err = os.Getenv("SESSION_SECRET")
		// if err != nil {
		// 	log.Println("could not load session secret from " +
		// 		"environment variable SESSION_SECRET.\nUsing a hard-coded value. " +
		// 		"This should be removed from production code.")
		// 	log.Println(err)
		// 	key = "aFakeTemporarySecret"
		// }
	}
	keySet = len(key) != 0
	Store = sessions.NewCookieStore([]byte(key))
	Store.Options = &sessions.Options{
		Path:     "/",
		MaxAge:   60 * SESSION_DURATION_MINUTES,
		HttpOnly: true,
		Secure:   true,
	}
	defaultStore = Store
}

// Create a new server with session configuration and service registry
func New(sessionName, sessionSecret string, services map[string]*url.URL, public bool) *Server {

	srv := &Server{
		sessionName:   sessionName,
		sessionSecret: sessionSecret,
		sessionStore:  sessions.NewCookieStore([]byte(sessionSecret)),
		services:      services,
		public:        public,
	}

	// Proxy services
	prx := proxy.New(srv.services, srv.isAuth)
	http.Handle("/prx/", http.StripPrefix("/prx", prx))

	// Login handle
	http.HandleFunc("/oauth/", srv.oauthCallback)

	// Static GUI
	http.Handle("/", http.FileServer(http.Dir("./public")))

	log.Info("Handling web GUI on /")
	log.Info("Handling proxying to services on /prx/")

	return srv
}

func NewRouter() http.Handler {

	// Setup session store
	authKey := securecookie.GenerateRandomKey(64)
	encryptionKey := securecookie.GenerateRandomKey(32)
	store := sessions.NewCookieStore(
		authKey,
		encryptionKey,
	)

	appContext := &ctx{
		sessionStore: store,
	}

	router := mux.NewRouter()
	// Setup the WS Hub here

	// Add handlers for routes
	router.Handle("/signup", http.RedirectHandler("/signup.html", 307)).Methods("GET")
	router.Handle("/signin", appHandler{appContext, signIn}).Methods("POST")

	// Add handlers for websockets

	return router
}

// Create a new fogo app.  Uses the config object.
func NewFogoApp(c *Config) *Fogo {
	if c == nil {
		c = DefaultConfig()
	}
	tplFuncs := make(map[string]interface{})
	tplFuncs["url_for"] = UrlFor
	tplFuncs["host"] = Host
	tplFuncs["marshal"] = Marshal

	keys := make([][]byte, 0)
	for _, key := range c.SessionKeys {
		keys = append(keys, []byte(key))
	}

	fogo := &Fogo{
		config:              c,
		router:              mux.NewRouter(),
		subRoutes:           make(map[string]*mux.Router),
		tplFuncs:            tplFuncs,
		session:             sessions.NewCookieStore(keys...),
		beforeMiddleware:    make([]FogoMiddleware, 0),
		afterMiddleware:     make([]FogoMiddleware, 0),
		notFoundHandler:     nil,
		defaultErrorHandler: nil,
		logger:              newDefaultLogger(),
		templateCache:       make(map[string]*template.Template),
	}
	fogo.router.NotFoundHandler = fogo
	return fogo
}