def test_bearer_header_with_http_args():
    client = Client("A")
    client.client_secret = "boarding pass"

    request_args = {"access_token": "Sesame"}

    cis = ResourceRequest()

    bh = BearerHeader(client)
    http_args = bh.construct(cis, request_args, http_args={"foo": "bar"})

    print cis
    print http_args
    assert _eq(http_args.keys(), ["foo", "headers"])
    assert http_args["headers"] == {"Authorization": "Bearer Sesame"}

    # -----------------

    request_args = {"access_token": "Sesame"}

    bh = BearerHeader(client)
    http_args = bh.construct(cis, request_args,
                             http_args={"headers": {"x-foo": "bar"}})

    print cis
    print http_args
    assert _eq(http_args.keys(), ["headers"])
    assert _eq(http_args["headers"].keys(), ["Authorization", "x-foo"])
    assert http_args["headers"]["Authorization"] == "Bearer Sesame"

def test_grant_access_token_1():
    resp = AuthorizationResponse(code="code", state="state")
    grant = Grant()
    grant.add_code(resp)

    atr = AccessTokenResponse(access_token="2YotnFZFEjr1zCsicMWpAA",
                              token_type="example", expires_in=1,
                              refresh_token="tGzv3JOkF0XG5Qx2TlKWIA",
                              example_parameter="example_value",
                              xscope=["inner", "outer"])

    token = Token(atr)
    grant.tokens.append(token)

    print grant.keys()
    assert _eq(grant.keys(), ['tokens', 'id_token', 'code', 'exp_in', 'seed',
                              'grant_expiration_time'])
    print token.keys()
    assert _eq(token.keys(), ['token_expiration_time', 'access_token',
                              'expires_in', 'example_parameter', 'token_type',
                              'xscope', 'refresh_token', 'scope',
                              'replaced'])

    assert token.access_token == "2YotnFZFEjr1zCsicMWpAA"
    assert token.token_type == "example"
    assert token.refresh_token == "tGzv3JOkF0XG5Qx2TlKWIA"
    assert token.example_parameter == "example_value"
    assert token.xscope == ["inner", "outer"]
    assert token.token_expiration_time != 0

    time.sleep(2)
    assert token.is_valid() is False

def test_message():
    _dict = {"req_str": "Fair", "opt_str": "game", "opt_int": 9,
             "opt_str_list": ["one", "two"], "req_str_list": ["spike", "lee"],
             "opt_json": '{"ford": "green"}'}

    cls = Dummy_Message(**_dict)
    cls.verify()
    assert _eq(cls.keys(), ['opt_str', 'req_str', 'opt_json',
                            'req_str_list', 'opt_str_list', 'opt_int'])

    _dict = {"req_str": "Fair", "opt_str": "game", "opt_int": 9,
             "opt_str_list": ["one", "two"], "req_str_list": ["spike", "lee"],
             "opt_json": '{"ford": "green"}', "extra": "internal"}

    cls = Dummy_Message(**_dict)
    cls.verify()
    print cls.keys()
    assert _eq(cls.keys(), ['opt_str', 'req_str', 'extra', 'opt_json',
                            'req_str_list', 'opt_str_list', 'opt_int'])

    _dict = {"req_str": "Fair", "opt_str": "game", "opt_int": 9,
             "opt_str_list": ["one", "two"], "req_str_list": ["spike", "lee"]}

    cls = Dummy_Message(**_dict)
    cls.verify()
    assert _eq(cls.keys(), ['opt_str', 'req_str', 'req_str_list',
                            'opt_str_list', 'opt_int'])

def test_ProviderConfigurationResponse():
    resp = {
        "authorization_endpoint": "https://server.example.com/connect/authorize",
        "issuer": "https://server.example.com",
        "token_endpoint": "https://server.example.com/connect/token",
        "token_endpoint_auth_methods_supported": ["client_secret_basic",
                                                  "private_key_jwt"],
        "userinfo_endpoint": "https://server.example.com/connect/user",
        "check_id_endpoint": "https://server.example.com/connect/check_id",
        "refresh_session_endpoint": "https://server.example.com/connect/refresh_session",
        "end_session_endpoint": "https://server.example.com/connect/end_session",
        "jwk_url": "https://server.example.com/jwk.json",
        "registration_endpoint": "https://server.example.com/connect/register",
        "scopes_supported": ["openid", "profile", "email", "address", "phone"],
        "response_types_supported": ["code", "code id_token", "token id_token"],
        "acrs_supported": ["1", "2", "http://id.incommon.org/assurance/bronze"],
        "user_id_types_supported": ["public", "pairwise"],
        "userinfo_algs_supported": ["HS256", "RS256", "A128CBC", "A128KW",
                                    "RSA1_5"],
        "id_token_algs_supported": ["HS256", "RS256", "A128CBC", "A128KW",
                                    "RSA1_5"],
        "request_object_algs_supported": ["HS256", "RS256", "A128CBC", "A128KW",
                                          "RSA1_5"]
    }

    pcr = ProviderConfigurationResponse().deserialize(json.dumps(resp), "json")

    assert _eq(pcr["user_id_types_supported"], ["public", "pairwise"])
    assert _eq(pcr["acrs_supported"],
               ["1", "2", "http://id.incommon.org/assurance/bronze"])

    def test_authenticated_hybrid(self):
        _state, location = self.cons.begin(
            scope="openid email claims_in_id_token",
            response_type="code id_token",
            path="http://localhost:8087")

        resp = self.provider.authorization_endpoint(
            request=urlparse(location).query)

        part = self.cons.parse_authz(resp.message)

        aresp = part[0]
        assert part[1] is None
        assert part[2] is not None

        assert isinstance(aresp, AuthorizationResponse)
        assert _eq(aresp.keys(), ['scope', 'state', 'code', 'id_token'])

        assert _eq(self.cons.grant[_state].keys(),
                   ['code', 'id_token', 'tokens',
                    'exp_in',
                    'grant_expiration_time', 'seed'])
        id_token = part[2]
        assert isinstance(id_token, IdToken)
        assert _eq(id_token.keys(),
                   ['nonce', 'c_hash', 'sub', 'iss', 'acr', 'exp', 'auth_time',
                    'iat', 'aud'])

    def test_complete_auth_token(self):
        _state = "state0"
        self.consumer.config["response_type"] = ["code", "token"]

        args = {
            "client_id": self.consumer.client_id,
            "response_type": self.consumer.config["response_type"],
            "scope": ["openid"],
        }

        result = self.consumer.do_authorization_request(state=_state,
                                                        request_args=args)
        self.consumer._backup("state0")

        assert result.status_code == 302
        parsed = urlparse(result.headers["location"])
        baseurl = "{}://{}{}".format(parsed.scheme, parsed.netloc, parsed.path)
        assert baseurl == self.consumer.redirect_uris[0]

        part = self.consumer.parse_authz(query=parsed.query)
        auth = part[0]
        acc = part[1]
        assert part[2] is None

        assert isinstance(auth, AuthorizationResponse)
        assert isinstance(acc, AccessTokenResponse)
        print(auth.keys())
        assert _eq(auth.keys(), ['code', 'access_token',
                                 'token_type', 'state', 'client_id', 'scope'])
        assert _eq(acc.keys(), ['token_type', 'state', 'access_token', 'scope'])

def test_provider_authenticated():
    provider = Provider("pyoicserv", sdb.SessionDB(SERVER_INFO["issuer"]), CDB,
                        AUTHN_BROKER, AUTHZ, verify_client, symkey=rndstr(16))
    _session_db = {}
    cons = Consumer(_session_db, client_config=CLIENT_CONFIG,
                    server_info=SERVER_INFO, **CONSUMER_CONFIG)
    cons.debug = True

    sid, location = cons.begin("http://localhost:8087",
                               "http://localhost:8088/authorization")

    query_string = location.split("?")[1]

    resp = provider.authorization_endpoint(query_string)
    assert resp.status == "302 Found"
    print resp.headers
    print resp.message
    if content_type(resp.headers) == "json":
        resp = resp.message
    else:
        resp = resp.message.split("?")[1]
    aresp = cons.handle_authorization_response(query=resp)

    print aresp.keys()
    assert aresp.type() == "AuthorizationResponse"
    assert _eq(aresp.keys(), ['state', 'code'])

    print cons.grant[sid].keys()
    assert _eq(cons.grant[sid].keys(), ['tokens', 'code', 'exp_in',
                                               'seed', 'id_token',
                                               'grant_expiration_time'])

def test_server_parse_token_request():
    atr = AccessTokenRequest(grant_type="authorization_code",
                             code="SplxlOBeZQQYbYS6WxSbIA",
                             redirect_uri="https://client.example.com/cb",
                             client_id=CLIENT_ID, extra="foo")

    uenc = atr.to_urlencoded()

    srv = Server()
    srv.keyjar = KEYJ
    tr = srv.parse_token_request(body=uenc)
    print tr.keys()

    assert tr.type() == "AccessTokenRequest"
    assert _eq(tr.keys(), ['code', 'redirect_uri', 'grant_type', 'client_id',
                           'extra'])

    assert tr["grant_type"] == "authorization_code"
    assert tr["code"] == "SplxlOBeZQQYbYS6WxSbIA"

    tr = srv.parse_token_request(body=uenc)
    print tr.keys()

    assert tr.type() == "AccessTokenRequest"
    assert _eq(tr.keys(), ['code', 'grant_type', 'client_id', 'redirect_uri',
                           'extra'])

    assert tr["extra"] == "foo"

    def test_to_urlencoded_extended_omit(self):
        atr = AccessTokenResponse(
            access_token="2YotnFZFEjr1zCsicMWpAA",
            token_type="example",
            expires_in=3600,
            refresh_token="tGzv3JOkF0XG5Qx2TlKWIA",
            example_parameter="example_value",
            scope=["inner", "outer"],
            extra=["local", "external"],
            level=3)

        uec = atr.to_urlencoded()
        assert query_string_compare(uec,
                                    "scope=inner+outer&level=3&expires_in=3600&token_type=example&extra=local&extra=external&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA&access_token=2YotnFZFEjr1zCsicMWpAA&example_parameter=example_value")

        del atr["extra"]
        ouec = atr.to_urlencoded()
        assert query_string_compare(ouec,
                                    "access_token=2YotnFZFEjr1zCsicMWpAA&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA&level=3&example_parameter=example_value&token_type=example&expires_in=3600&scope=inner+outer")
        assert len(uec) == (len(ouec) + len("extra=local") +
                            len("extra=external") + 2)

        atr2 = AccessTokenResponse().deserialize(uec, "urlencoded")
        assert _eq(atr2.keys(), ['access_token', 'expires_in', 'token_type',
                                 'scope', 'refresh_token', 'level',
                                 'example_parameter', 'extra'])

        atr3 = AccessTokenResponse().deserialize(ouec, "urlencoded")
        assert _eq(atr3.keys(), ['access_token', 'expires_in', 'token_type',
                                 'scope', 'refresh_token', 'level',
                                 'example_parameter'])

def test_sp_sep_list_deserializer():
    vals = sp_sep_list_deserializer("foo bar zen")
    assert len(vals) == 3
    assert _eq(vals, ["foo", "bar", "zen"])

    vals = sp_sep_list_deserializer(["foo bar zen"])
    assert len(vals) == 3
    assert _eq(vals, ["foo", "bar", "zen"])

def test_address_deser():
    pre = AddressClaim(street_address="Kasamark 114", locality="Umea",
                       country="Sweden")

    adc = address_deser(pre.to_json(), sformat="json")
    assert _eq(adc.keys(), ['street_address', 'locality', 'country'])

    adc = address_deser(pre.to_dict(), sformat="json")
    assert _eq(adc.keys(), ['street_address', 'locality', 'country'])

    def test_init(self):
        info = user_info(None, USERDB, "diana")

        keys = [SYMKey(key="hemlig")]
        cresp = UserClaimsResponse(jwt=info.to_jwt(key=keys, algorithm="HS256"),
                                   claims_names=list(info.keys()))

        assert _eq(list(cresp.keys()), ["jwt", "claims_names"])
        assert _eq(cresp["claims_names"], ['gender', 'birthdate'])
        assert "jwt" in cresp

    def test_construct_with_headers(self, client):
        request_args = {"access_token": "Sesame"}

        bh = BearerHeader(client)
        http_args = bh.construct(request_args=request_args,
                                 http_args={"headers": {"x-foo": "bar"}})

        assert _eq(http_args.keys(), ["headers"])
        assert _eq(http_args["headers"].keys(), ["Authorization", "x-foo"])
        assert http_args["headers"]["Authorization"] == "Bearer Sesame"

def test_parse_userinfo_request():
    srv = Server()
    qdict = srv.parse_user_info_request(data=UIREQ.to_urlencoded())
    assert _eq(qdict.keys(), ['access_token'])
    assert qdict["access_token"] == "access_token"

    url = "https://example.org/userinfo?%s" % UIREQ.to_urlencoded()
    qdict = srv.parse_user_info_request(data=url)
    assert _eq(qdict.keys(), ['access_token'])
    assert qdict["access_token"] == "access_token"

def test_multiple_response_types_urlencoded():
    ar = AuthorizationRequest(response_type=["code", "token"],
                              client_id="foobar")
    ue = ar.to_urlencoded()
    ue_splits = ue.split('&')
    expected_ue_splits = "response_type=code+token&client_id=foobar".split('&')
    assert _eq(ue_splits, expected_ue_splits)

    are = AuthorizationRequest().deserialize(ue, "urlencoded")
    assert _eq(are.keys(), ["response_type", "client_id"])
    assert _eq(are["response_type"], ["code", "token"])

def test_claims_deser_dict():
    pre = Claims(name={"essential": True}, nickname=None,
                 email={"essential": True},
                 email_verified={"essential": True}, picture=None)

    claims = claims_deser(pre.to_json(), sformat="json")
    assert _eq(claims.keys(), ['name', 'nickname', 'email', 'email_verified',
                               'picture'])

    claims = claims_deser(pre.to_dict(), sformat="dict")
    assert _eq(claims.keys(), ['name', 'nickname', 'email', 'email_verified',
                               'picture'])

def test_clean_response():
    atr = AccessTokenResponse(access_token="access_token",
                              token_type="bearer", expires_in=600,
                              refresh_token="refresh", steps=39, stalls="yes")

    catr = clean_response(atr)
    atr_keys = atr.keys()
    catr_keys = catr.keys()
    assert _eq(atr_keys, ['token_type', 'access_token', 'expires_in',
                          'refresh_token', 'steps', 'stalls'])
    assert _eq(catr_keys, ['token_type', 'access_token', 'expires_in',
                           'refresh_token'])

    def test_parse_userinfo_requesr(self):
        uireq = UserInfoRequest(access_token="access_token")
        uencq = uireq.to_urlencoded()

        qdict = self.srv.parse_user_info_request(data=uencq)
        assert _eq(qdict.keys(), ['access_token'])
        assert qdict["access_token"] == "access_token"

        url = "https://example.org/userinfo?{}".format(uencq)
        qdict = self.srv.parse_user_info_request(data=url)
        assert _eq(qdict.keys(), ['access_token'])
        assert qdict["access_token"] == "access_token"

def test_parse_refresh_session_request():
    srv = Server()
    request = srv.parse_refresh_session_request(query=RSREQ.to_urlencoded())
    assert request.type() == "RefreshSessionRequest"
    assert _eq(request.keys(), ['id_token', 'state', 'redirect_url'])
    assert request["id_token"] == "id_token"

    url = "https://example.org/userinfo?%s" % RSREQ.to_urlencoded()
    request = srv.parse_refresh_session_request(url=url)
    assert request.type() == "RefreshSessionRequest"
    assert _eq(request.keys(), ['id_token', 'state', 'redirect_url'])
    assert request["id_token"] == "id_token"

    def test_multiple_response_types_json(self):
        ar = AuthorizationRequest(response_type=["code", "token"],
                                  client_id="foobar")
        ue = ar.to_json()
        ue_obj = json.loads(ue)
        expected_ue_obj = {
            "response_type": "code token",
            "client_id": "foobar"
        }
        assert ue_obj == expected_ue_obj

        are = AuthorizationRequest().deserialize(ue, "json")
        assert _eq(are.keys(), ["response_type", "client_id"])
        assert _eq(are["response_type"], ["code", "token"])