gt:         WebSession s = SessionManager.makeSession(u.getId(), duration);
context: /**
   * Copyright (c) 2009--2013 Red Hat, Inc.
   *
   * This software is licensed to you under the GNU General Public License,
   * version 2 (GPLv2). There is NO WARRANTY for this software, express or
   * implied, including the implied warranties of MERCHANTABILITY or FITNESS
   * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
   * along with this software; if not, see
   * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
   *
   * Red Hat trademarks are not licensed under GPLv2. No permission is
   * granted to use or replicate Red Hat trademarks that are incorporated
   * in this software or its documentation.
   */
  
  package com.redhat.rhn.manager.session.test;
  
  import com.redhat.rhn.common.conf.Config;
  import com.redhat.rhn.common.conf.ConfigDefaults;
  import com.redhat.rhn.common.hibernate.LookupException;
  import com.redhat.rhn.common.util.TimeUtils;
  import com.redhat.rhn.domain.session.InvalidSessionIdException;
  import com.redhat.rhn.domain.session.WebSession;
  import com.redhat.rhn.domain.session.WebSessionFactory;
  import com.redhat.rhn.domain.user.User;
  import com.redhat.rhn.manager.session.SessionManager;
  import com.redhat.rhn.testing.RhnBaseTestCase;
  import com.redhat.rhn.testing.UserTestUtils;
  
  /** JUnit test case for the SessionManagerTest.
   * @version $Rev$
   */
  
  public class SessionManagerTest extends RhnBaseTestCase {
  
      public void testLifetimeValue() throws Exception {
          long lifetime = SessionManager.lifetimeValue();
          long duration = Long.parseLong(Config.get().getString(
                  ConfigDefaults.WEB_SESSION_DATABASE_LIFETIME));
          assertEquals(lifetime, duration);
      }
  
      public void testMakeSession() throws Exception {
          long expTime = SessionManager.lifetimeValue();
          User u = UserTestUtils.findNewUser("testUser",
                  "testOrg" + this.getClass().getSimpleName());
          WebSession s = SessionManager.makeSession(u.getId(), expTime);
  
          assertNotNull(s);
          assertEquals(s.getExpires(), TimeUtils.currentTimeSeconds() + expTime);
      }
  
      public void testGenerateSessionKey() {
          String s = "12345678";
          String k1 = "";
          String k2 = "";
          k1 = SessionManager.generateSessionKey(s);
          k2 = SessionManager.generateSessionKey(s);
          assertTrue(k1.equals(k2));
      }
  
      public void testMakeSecureParamNoTimestamp() {
          String s = "12345678";
          String param = SessionManager.makeSecureParamNoTimestamp(s);
          assertTrue("param == null", param != null);
          assertTrue("param is empty", !param.equals(""));
          assertTrue("token not found",
                param.indexOf(SessionManager.SEC_PARM_TOKENIZER_CHAR) > 0);
          assertTrue("s != param",
                s.equals(SessionManager.extractSecureParam(param)));
          assertTrue("not a valid secure param",
                SessionManager.isValidSecureParam(param));
      }
  
      public void testMakeSecureParamTimestamped() {
          String s = "12345678";
          String param = SessionManager.makeSecureParamTimestamped(s);
          assertTrue(param != null);
          assertTrue(!param.equals(""));
          assertTrue(param.indexOf(SessionManager.SEC_PARM_TOKENIZER_CHAR) > 0);
          assertTrue(s.equals(SessionManager.extractSecureParam(param)));
          assertTrue(SessionManager.isValidSecureParam(param));
      }
  
      public void testIsValidSecureParam() {
          String s = "12345678";
          String paramNTS = SessionManager.makeSecureParamNoTimestamp(s);
          String paramTS = SessionManager.makeSecureParamTimestamped(s);
          assertTrue(SessionManager.isValidSecureParam(paramTS));
          assertTrue(SessionManager.isValidSecureParam(paramNTS));
          assertFalse(SessionManager.isValidSecureParam(s));
      }
  
      public void testExtractSecureParam() {
          String s = "12345678";
          String paramTS = SessionManager.makeSecureParamTimestamped(s);
          String paramNTS = SessionManager.makeSecureParamNoTimestamp(s);
          assertTrue(SessionManager.extractSecureParam(s).equals(""));
          assertFalse(SessionManager.extractSecureParam(paramTS).equals(""));
          assertTrue(SessionManager.extractSecureParam(paramTS).equals(s));
          assertFalse(SessionManager.extractSecureParam(paramNTS).equals(""));
          assertTrue(SessionManager.extractSecureParam(paramNTS).equals(s));
      }
  
      public void testIsPxtSessionKeyValidWhenKeyIsNull() {
          assertFalse(SessionManager.isPxtSessionKeyValid(null));
      }
  
      public void testIsPxtSessionKeyValidWhenKeyIsValid() {
          String pxtSessionKey = generatePxtSessionKey();
  
          assertTrue(SessionManager.isPxtSessionKeyValid(pxtSessionKey));
      }
  
      /**
       * This test was created for
       * https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206558
       */
      public void testIsPxtSessionKeyValidWhenKeyIsInvalid() {
          String pxtSessionKey = generatePxtSessionKey();
          pxtSessionKey = pxtSessionKey.replace('x', ':');
  
          assertFalse(SessionManager.isPxtSessionKeyValid(pxtSessionKey));
      }
  
      public void testIsPxtSessionKeyValidWhenSessionIdHijacked() {
          String pxtSessionKey = generatePxtSessionKey();
          String[] keyParts = pxtSessionKey.split("x");
          String sessionId = keyParts[0];
  
          sessionId = sessionId.replaceAll("2", "3");
          sessionId = sessionId.replaceAll("5", "7");
  
          pxtSessionKey = sessionId + "x" + keyParts[1];
  
          assertFalse(SessionManager.isPxtSessionKeyValid(pxtSessionKey));
      }
  
      private String generatePxtSessionKey() {
          String id = "12345678";
          String generatedKey = SessionManager.generateSessionKey(id);
  
          return id + "x" + generatedKey;
      }
  
      public void testLookupByEmptyKey() {
          try {
              SessionManager.lookupByKey("");
              fail();
          }
          catch (InvalidSessionIdException e) {
              // expected
          }
      }
  
      public void testLookupByKey() {
          WebSession s = WebSessionFactory.createSession();
          verifySession(s);
          assertNotNull(s);
          WebSessionFactory.save(s);
          assertNotNull(s.getId());
  
          String key = s.getKey();
  
          WebSession s2 = SessionManager.lookupByKey(key);
          assertEquals(s, s2);
  
          String invalidKey = s.getId() + "xfoobaredkeyhash";
          try {
              s2 = SessionManager.lookupByKey(invalidKey);
          }
          catch (InvalidSessionIdException e) {
              //success
          }
  
          try {
              s2 = SessionManager.lookupByKey(null);
          }
          catch (InvalidSessionIdException e) {
              //success
          }
  
          try {
              s2 = SessionManager.lookupByKey(s.getId() + "foobaredkeyhash");
          }
          catch (InvalidSessionIdException e) {
              //success
          }
      }
  
      private void verifySession(WebSession s) {
          assertNull(s.getId());
          assertNull(s.getUser());
          assertEquals(" ", s.getValue());
          assertNull(s.getWebUserId());
          assertEquals(0, s.getExpires());
      }
  
      public void testPurgeSession() throws Exception {
          long duration = 3600L;
          User u = UserTestUtils.findNewUser("testUser",
                  "testOrg" + this.getClass().getSimpleName());
  