require 'minitest/autorun'
require 'prism'
require 'support'
require 'tmpdir'

class AuthSessionsController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser

  def create
    user = AuthUser.find_by(email: params['email'])
    if user && user.authenticate(params['password'])
      sign_in(user)
      halt(200, after_authentication_url)
    else
      halt(401, 'invalid credentials')
    end
  end

  def destroy
    sign_out
    halt(200, 'signed out')
  end
end

class AuthDashboardController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in'
  before_action :require_authentication

  def index
    halt(200, "hello #{current_user.email}")
  end
end

class AuthApiController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser
  before_action :require_authentication

  def index
    halt(200, "hello #{current_user.email}")
  end
end

class AuthRememberSessionsController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, remember_cookie: :remember_token

  def create
    user = AuthUser.find_by(email: params['email'])
    if user && user.authenticate(params['password'])
      sign_in(user, remember: params['remember'] == '1')
      halt(200, 'signed in')
    else
      halt(401, 'invalid credentials')
    end
  end

  def destroy
    sign_out
    halt(200, 'signed out')
  end
end

class AuthRememberDashboardController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in', remember_cookie: :remember_token
  before_action :require_authentication

  def index
    halt(200, "hello #{current_user.email}")
  end
end

# `authenticate_with` is declared only on the base class here, the way a
# real app declares it once on ApplicationController - proving the setting
# (and its unauthenticated_redirect_path) reaches a subclass that never
# calls `authenticate_with` itself.
class AuthBaseController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in'
end

class AuthInheritedController < AuthBaseController
  before_action :require_authentication

  def index
    halt(200, "hello #{current_user.email}")
  end
end

class AuthMultiSessionsController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, remember_sessions: :AuthLoginSession

  def create
    user = AuthUser.find_by(email: params['email'])
    if user && user.authenticate(params['password'])
      sign_in(user, remember: params['remember'] == '1')
      halt(200, 'signed in')
    else
      halt(401, 'invalid credentials')
    end
  end

  def destroy
    sign_out
    halt(200, 'signed out')
  end
end

class AuthMultiDashboardController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in', remember_sessions: :AuthLoginSession
  before_action :require_authentication

  def index
    halt(200, "hello #{current_user.email}")
  end

  def other_devices
    halt(200, other_login_sessions.count.to_s)
  end

  def sign_out_others
    sign_out_all_other_sessions
    halt(200, other_login_sessions.count.to_s)
  end

  def revoke
    # Deliberately the raw String params['id'] gives, not params['id'].to_i -
    # a real controller (see examples/blog's LoginSessionsController) has no
    # reason to convert it itself; revoke_login_session! must do that on its
    # own or every real HTTP request would silently no-op (see its comment).
    ok = revoke_login_session!(params['id'])
    halt(ok ? 200 : 404, ok ? 'revoked' : 'not found')
  end
end

class AuthCappedSessionsController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, remember_sessions: :AuthLoginSession, max_remember_sessions: 2

  def create
    user = AuthUser.find_by(email: params['email'])
    if user && user.authenticate(params['password'])
      sign_in(user, remember: true)
      halt(200, 'signed in')
    else
      halt(401, 'invalid credentials')
    end
  end
end

class AuthCappedDashboardController < Prism::Controller
  include Prism::Authenticatable
  authenticate_with model: :AuthUser, unauthenticated_redirect_path: '/sign_in',
                     remember_sessions: :AuthLoginSession, max_remember_sessions: 2
  before_action :require_authentication