/// <summary>
        /// Saves the Auth Tokens for this request. Called in OnAuthenticated(). 
        /// Overrideable, the default behaviour is to call IUserAuthRepository.CreateOrMergeAuthSession().
        /// </summary>
        protected virtual void SaveUserAuth(IServiceBase authService, IAuthSession session, IUserAuthRepository authRepo, IOAuthTokens tokens)
        {
            if (authRepo == null) return;
            if (tokens != null)
            {
                session.UserAuthId = authRepo.CreateOrMergeAuthSession(session, tokens);
            }

            authRepo.LoadUserAuth(session, tokens);

            foreach (var oAuthToken in session.ProviderOAuthAccess)
            {
                var authProvider = AuthService.GetAuthProvider(oAuthToken.Provider);
                if (authProvider == null) continue;
                var userAuthProvider = authProvider as OAuthProvider;
                if (userAuthProvider != null)
                {
                    userAuthProvider.LoadUserOAuthProvider(session, oAuthToken);
                }
            }

            authRepo.SaveUserAuth(session);

            var httpRes = authService.RequestContext.Get<IHttpResponse>();
            if (httpRes != null)
            {
                httpRes.Cookies.AddPermanentCookie(HttpHeaders.XUserAuthId, session.UserAuthId);
            }
            OnSaveUserAuth(authService, session);
        }

 public OrderController(IOrderRepository orderRepo,
     IUserAuthRepository userAuthRepo,
     ICustomerRepository customerRepo,
     IOrderLogRepository orderLogRepo,
     IOrderItemRepository orderItemRepo,
     IInboundPackRepository inboundRepo,
     IOutboundRepository outboundRepo,
     IOutboundItemRepository outbounditemRepo,
     ISectionRepository sectionRepo,
     IRMARepository rmaRepo,
     IRMALogRepository rmalogRepo,
     IRMAItemRepository rmaitemRepo
     )
 {
     _orderRepo = orderRepo;
     _userAuthRepo = userAuthRepo;
     _customerRepo = customerRepo;
     _orderLogRepo = orderLogRepo;
     _orderItemRepo = orderItemRepo;
     _inboundRepo = inboundRepo;
     _outboundRepo = outboundRepo;
     _outbounditemRepo = outbounditemRepo;
     _sectionRepo = sectionRepo;
     _rmaRepo = rmaRepo;
     _rmalogRepo = rmalogRepo;
     _rmaitemRepo = rmaitemRepo;
 }

 private static void CreateUser(IUserAuthRepository userRepo, IUserAuth user, string password)
 {
     string hash;
     string salt;
     new SaltedHash().GetHashAndSaltString(password, out hash, out salt);
     user.Salt = salt;
     user.PasswordHash = hash;
     userRepo.CreateUserAuth(user, password);
 }

        public void Can_AutoLogin_whilst_Registering(IUserAuthRepository userAuthRepository)
        {
            InitTest(userAuthRepository);
            var oAuthUserSession = requestContext.ReloadSession();
            registrationDto.AutoLogin = true;
            Register(userAuthRepository, oAuthUserSession, registrationDto);

            oAuthUserSession = requestContext.ReloadSession();
            Assert.That(oAuthUserSession.IsAuthenticated, Is.True);
        }

 public UserAuthController(IUserAuthRepository authRepo
     ,IStoreRepository storeRepo
     ,IBrandRepository brandRepo
     ,ICustomerRepository customerRepo)
 {
     _authRepo = authRepo;
     _storeRepo = storeRepo;
     _brandRep = brandRepo;
     _customerRepo = customerRepo;
    
 }

 public PromotionController(IPromotionRepository promotionRepository
     ,IStoreRepository storeRepository
     ,ITagRepository tagRepository
     ,IResourceService resourceService
     ,IUserAuthRepository authRepo)
 {
     this._promotionRepository = promotionRepository;
     _storeRepository = storeRepository;
     _tagRepository = tagRepository;
     _resourceService = resourceService;
     _authRepo = authRepo;
 }

 public static RegistrationService GetRegistrationService(
     AbstractValidator<Registration> validator = null,
     IUserAuthRepository authRepo=null)
 {
     var requestContext = new MockRequestContext();
     var service = new RegistrationService {
         RegistrationValidator = validator ?? new RegistrationValidator { UserAuthRepo = GetStubRepo() },
         UserAuthRepo = authRepo ?? GetStubRepo(),
         RequestContext = requestContext
     };
     return service;
 }

        public bool HasAllRoles(IHttpRequest req, IAuthSession session, IUserAuthRepository userAuthRepo=null)
        {
            if (HasAllRoles(session)) return true;

            session.UpdateFromUserAuthRepo(req, userAuthRepo);

            if (HasAllRoles(session))
            {
                req.SaveSession(session);
                return true;
            }
            return false;
        }

 public ProductController(IProductRepository productRepository
     , ISpecialTopicProductRelationRepository specialTopicProductRelationRepository
     , IPromotionProductRelationRepository promotionProductRelationRepository
     , IStoreRepository storeRepository
     , IResourceService resourceService
     , IUserAuthRepository userAuthRepo)
 {
     _productRepository = productRepository;
     _stprRepository = specialTopicProductRelationRepository;
     _pprRepository = promotionProductRelationRepository;
     _storeRepository = storeRepository;
     _resourceService = resourceService;
     _userAuthRepo = userAuthRepo;
 }

 public OrderController(IOrderRepository orderRepo,
     IUserAuthRepository userAuthRepo,
     ICustomerRepository customerRepo,
     IOrderLogRepository orderLogRepo,
     IOrderItemRepository orderItemRepo,
     IInboundPackRepository inboundRepo)
 {
     _orderRepo = orderRepo;
     _userAuthRepo = userAuthRepo;
     _customerRepo = customerRepo;
     _orderLogRepo = orderLogRepo;
     _orderItemRepo = orderItemRepo;
     _inboundRepo = inboundRepo;
 }

 public ProductPropertyValueController(ITagRepository tagRepo,
     ICategoryPropertyRepository tagpropertyRepo,
     ICategoryPropertyValueRepository tagpropertyvalRepo,
     IProductPropertyValueRepository prodpropertyvalRepo,
     IProductPropertyRepository prodpropertyRepo,
     IProductRepository prodRepo,
     IUserAuthRepository userauthRepo
 )
 {
     _tagRepo = tagRepo;
     _tagpropertyRepo = tagpropertyRepo;
     _tagpropertyvalueRepo = tagpropertyvalRepo;
     _prodpropertyRepo = prodpropertyRepo;
     _prodpropertyvalRepo = prodpropertyvalRepo;
     _prodRepo = prodRepo;
     _userauthRepo = userauthRepo;
 }

        public void Connecting_to_facebook_whilst_authenticated_connects_account(IUserAuthRepository userAuthRepository)
        {
            InitTest(userAuthRepository);

            var oAuthUserSession = requestContext.ReloadSession();

            oAuthUserSession = RegisterAndLogin(userAuthRepository, oAuthUserSession);

            LoginWithFacebook(oAuthUserSession);

            var userAuth = userAuthRepository.GetUserAuthByUserName(registrationDto.UserName);

            Assert.That(userAuth.UserName, Is.EqualTo(registrationDto.UserName));

            var userAuthProviders = userAuthRepository.GetUserOAuthProviders(userAuth.Id.ToString(CultureInfo.InvariantCulture));
            Assert.That(userAuthProviders.Count, Is.EqualTo(1));
        }

        public static RegistrationService GetRegistrationService(
            AbstractValidator<Registration> validator = null,
            IUserAuthRepository authRepo=null)
        {
            var requestContext = new MockRequestContext();
            var userAuthRepository = authRepo ?? GetStubRepo();
            var service = new RegistrationService {
                RegistrationValidator = validator ?? new RegistrationValidator { UserAuthRepo = userAuthRepository },
                UserAuthRepo = userAuthRepository,
                RequestContext = requestContext,
            };

            var appHost = GetAppHost();
            appHost.Register(userAuthRepository);
            service.SetAppHost(appHost);

            return service;
        }

        public bool HasAllRoles(IHttpRequest req, IAuthSession session, IUserAuthRepository userAuthRepo=null)
        {
            if (HasAllRoles(session)) return true;

            if (userAuthRepo == null)
                userAuthRepo = req.TryResolve<IUserAuthRepository>();

            if (userAuthRepo == null) return false;

            var userAuth = userAuthRepo.GetUserAuth(session, null);
            session.UpdateSession(userAuth);

            if (HasAllRoles(session))
            {
                req.SaveSession(session);
                return true;
            }
            return false;
        }

        private void CreateUser(IUserAuthRepository userRep, int id, string userName, string email, string password, List<string> roles = null, List<string> permissions = null)
        {
            string hash;
            string salt;
            new SaltedHash().GetHashAndSaltString(password, out hash, out salt);

            userRep.CreateUserAuth(new UserAuth {
            Id = id,
            DisplayName = "DisplayName",
            Email = email,
            UserName = userName,
            FirstName = "FirstName",
            LastName = "LastName",
            PasswordHash = hash,
            Salt = salt,
            Roles = roles,
            Permissions = permissions
            }, password);
        }

        protected void InitTest(IUserAuthRepository userAuthRepository)
        {
            try
            {
                ((IClearable)userAuthRepository).Clear();
            }
            catch { /*ignore*/ }

            var appsettingsMock = new Mock<IAppSettings>();
            var appSettings = appsettingsMock.Object;

            new AuthFeature(null, new IAuthProvider[] {
                new CredentialsAuthProvider(),
                new BasicAuthProvider(),
                new FacebookAuthProvider(appSettings),
                new TwitterAuthProvider(appSettings)
            })
            .Register(null);

            mockService = new Mock<IServiceBase>();
            mockService.Expect(x => x.TryResolve<IAuthRepository>()).Returns(userAuthRepository);
            requestContext = new BasicRequest
            {
                Headers = {
                    {"X-ss-id", SessionExtensions.CreateRandomSessionId() }
                }
            };
            mockService.Expect(x => x.Request).Returns(requestContext);
            service = mockService.Object;

            RegisterDto = new Register
            {
                UserName = "UserName",
                Password = "[email protected]",
                Email = "[email protected]",
                DisplayName = "DisplayName",
                FirstName = "FirstName",
                LastName = "LastName",
            };
        }

        public void Can_login_with_user_created_CreateUserAuth(IUserAuthRepository userAuthRepository)
        {
            InitTest(userAuthRepository);

            var registrationService = GetRegistrationService(userAuthRepository);

            var responseObj = registrationService.Post(registrationDto);

            var httpResult = responseObj as IHttpResult;
            if (httpResult != null)
            {
                Assert.Fail("HttpResult found: " + httpResult.Dump());
            }

            var response = (RegistrationResponse)responseObj;
            Assert.That(response.UserId, Is.Not.Null);

            var userAuth = userAuthRepository.GetUserAuth(response.UserId);
            AssertEqual(userAuth, registrationDto);

            userAuth = userAuthRepository.GetUserAuthByUserName(registrationDto.UserName);
            AssertEqual(userAuth, registrationDto);

            userAuth = userAuthRepository.GetUserAuthByUserName(registrationDto.Email);
            AssertEqual(userAuth, registrationDto);

            UserAuth userId;
            var success = userAuthRepository.TryAuthenticate(registrationDto.UserName, registrationDto.Password, out userId);
            Assert.That(success, Is.True);
            Assert.That(userId, Is.Not.Null);

            success = userAuthRepository.TryAuthenticate(registrationDto.Email, registrationDto.Password, out userId);
            Assert.That(success, Is.True);
            Assert.That(userId, Is.Not.Null);

            success = userAuthRepository.TryAuthenticate(registrationDto.UserName, "Bad Password", out userId);
            Assert.That(success, Is.False);
            Assert.That(userId, Is.Null);
        }

        public static RegisterService GetRegistrationService(
            AbstractValidator<Register> validator = null,
            IUserAuthRepository authRepo = null,
            string contentType = null)
        {
            var requestContext = new MockRequestContext();
            if (contentType != null)
            {
                requestContext.ResponseContentType = contentType;
            }
            var userAuthRepository = authRepo ?? GetStubRepo();
            var service = new RegisterService
            {
                RegistrationValidator = validator ?? new RegistrationValidator { UserAuthRepo = userAuthRepository },
                AuthRepo = userAuthRepository,
                RequestContext = requestContext,
            };

            HostContext.Container.Register(userAuthRepository);

            return service;
        }

        public void Does_persist_FacebookOAuth(IUserAuthRepository userAuthRepository)
        {
            InitTest(userAuthRepository);

            var serviceTokens = MockAuthHttpGateway.Tokens = facebookGatewayTokens;

            var oAuthUserSession = requestContext.ReloadSession();
            var authInfo = new Dictionary<string, string> { };
            var facebookAuth = GetFacebookAuthProvider();
            facebookAuth.OnAuthenticated(service, oAuthUserSession, facebookAuthTokens, authInfo);

            oAuthUserSession = requestContext.ReloadSession();

            Assert.That(oAuthUserSession.FacebookUserId, Is.EqualTo(serviceTokens.UserId));

            Assert.That(oAuthUserSession.UserAuthId, Is.Not.Null);

            var userAuth = userAuthRepository.GetUserAuth(oAuthUserSession.UserAuthId);
            Assert.That(userAuth.Id.ToString(CultureInfo.InvariantCulture), Is.EqualTo(oAuthUserSession.UserAuthId));
            Assert.That(userAuth.DisplayName, Is.EqualTo(serviceTokens.DisplayName));
            Assert.That(userAuth.FirstName, Is.EqualTo(serviceTokens.FirstName));
            Assert.That(userAuth.LastName, Is.EqualTo(serviceTokens.LastName));
            Assert.That(userAuth.PrimaryEmail, Is.EqualTo(serviceTokens.Email));

            var authProviders = userAuthRepository.GetUserAuthDetails(oAuthUserSession.UserAuthId);
            Assert.That(authProviders.Count, Is.EqualTo(1));
            var authProvider = authProviders[0];
            Assert.That(authProvider.UserAuthId, Is.EqualTo(userAuth.Id));
            Assert.That(authProvider.DisplayName, Is.EqualTo(serviceTokens.DisplayName));
            Assert.That(authProvider.FirstName, Is.EqualTo(serviceTokens.FirstName));
            Assert.That(authProvider.LastName, Is.EqualTo(serviceTokens.LastName));
            Assert.That(authProvider.Email, Is.EqualTo(serviceTokens.Email));
            Assert.That(authProvider.RequestToken, Is.Null);
            Assert.That(authProvider.RequestTokenSecret, Is.Null);
            Assert.That(authProvider.AccessToken, Is.Null);
            Assert.That(authProvider.AccessTokenSecret, Is.EqualTo(facebookAuthTokens.AccessTokenSecret));

            Console.WriteLine(authProviders.Dump());
        }

        public void Does_merge_FacebookOAuth_TwitterOAuth(IUserAuthRepository userAuthRepository)
        {
            InitTest(userAuthRepository);

            var serviceTokensFb = MockAuthHttpGateway.Tokens = facebookGatewayTokens;

            var oAuthUserSession = requestContext.ReloadSession();
            var facebookAuth = GetFacebookAuthProvider();
            facebookAuth.OnAuthenticated(service, oAuthUserSession, facebookAuthTokens, new Dictionary<string, string>());

            oAuthUserSession = requestContext.ReloadSession();

            var serviceTokensTw = MockAuthHttpGateway.Tokens = twitterGatewayTokens;
            var authInfo = new Dictionary<string, string> {
                {"user_id", "133371690876022785"},
                {"screen_name", "demisbellot"},
            };
            var twitterAuth = GetTwitterAuthProvider();
            twitterAuth.OnAuthenticated(service, oAuthUserSession, twitterAuthTokens, authInfo);

            oAuthUserSession = requestContext.ReloadSession();

            Assert.That(oAuthUserSession.TwitterUserId, Is.EqualTo(authInfo["user_id"]));
            Assert.That(oAuthUserSession.TwitterScreenName, Is.EqualTo(authInfo["screen_name"]));

            var userAuth = userAuthRepository.GetUserAuth(oAuthUserSession.UserAuthId);
            Assert.That(userAuth.Id.ToString(CultureInfo.InvariantCulture), Is.EqualTo(oAuthUserSession.UserAuthId));
            Assert.That(userAuth.DisplayName, Is.EqualTo(serviceTokensTw.DisplayName));
            Assert.That(userAuth.FirstName, Is.EqualTo(serviceTokensFb.FirstName));
            Assert.That(userAuth.LastName, Is.EqualTo(serviceTokensFb.LastName));
            Assert.That(userAuth.PrimaryEmail, Is.EqualTo(serviceTokensFb.Email));

            var authProviders = userAuthRepository.GetUserOAuthProviders(oAuthUserSession.UserAuthId);
            Assert.That(authProviders.Count, Is.EqualTo(2));

            Console.WriteLine(userAuth.Dump());
            Console.WriteLine(authProviders.Dump());
        }