gt:         Map<String, String> userDTO = new HashMap<>();
context: /*
   * Copyright (c) 2018  W.I.S.V. 'Christiaan Huygens'
   *
   *     This program is free software: you can redistribute it and/or modify
   *     it under the terms of the GNU General Public License as published by
   *     the Free Software Foundation, either version 3 of the License, or
   *     (at your option) any later version.
   *
   *     This program is distributed in the hope that it will be useful,
   *     but WITHOUT ANY WARRANTY; without even the implied warranty of
   *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   *     GNU General Public License for more details.
   *
   *     You should have received a copy of the GNU General Public License
   *     along with this program.  If not, see <http://www.gnu.org/licenses/>.
   */
  
  package ch.wisv.areafiftylan.integration;
  
  import ch.wisv.areafiftylan.products.model.Ticket;
  import ch.wisv.areafiftylan.security.token.repository.VerificationTokenRepository;
  import ch.wisv.areafiftylan.users.model.Role;
  import ch.wisv.areafiftylan.users.model.RoleDTO;
  import ch.wisv.areafiftylan.users.model.User;
  import io.restassured.http.ContentType;
  import io.restassured.http.Header;
  import org.apache.http.HttpStatus;
  import org.junit.jupiter.api.Test;
  import org.springframework.beans.factory.annotation.Autowired;
  
  import java.time.LocalDate;
  import java.util.HashMap;
  import java.util.Map;
  
  import static io.restassured.RestAssured.given;
  import static io.restassured.RestAssured.when;
  import static org.hamcrest.CoreMatchers.equalTo;
  import static org.hamcrest.CoreMatchers.is;
  import static org.hamcrest.Matchers.*;
  import static org.junit.jupiter.api.Assertions.*;
  
  public class UserRestIntegrationTest extends XAuthIntegrationTest {
  
      @Autowired
      private VerificationTokenRepository verificationTokenRepository;
  
      static Map<String, String> getProfileDTO() {
          Map<String, String> profileDTO = new HashMap<>();
          profileDTO.put("birthday", "2000-01-02");
          profileDTO.put("gender", "MALE");
          profileDTO.put("address", "Testaddress");
          profileDTO.put("zipcode", "Testzipcode");
          profileDTO.put("city", "Testcity");
          profileDTO.put("phoneNumber", "TestphoneNumber");
          profileDTO.put("notes", "Testnotes");
          profileDTO.put("firstName", "TestfirstName");
          profileDTO.put("lastName", "TestlastName");
          profileDTO.put("displayName", "TestdisplayName");
          return profileDTO;
      }
  
      @Test
      public void testGetAllUsersAsAnonymous() {
          //@formatter:off
          when().
              get("/users").
          then().
              statusCode(HttpStatus.SC_FORBIDDEN);
          //@formatter:on
      }
  
      @Test
      public void testGetAllUsersAsUser() {
          User user = createUser();
  
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(user)).
          when().
              get("/users").
          then().
              statusCode(HttpStatus.SC_FORBIDDEN).
              body("message", equalTo("Access denied"));
          //@formatter:on
      }
  
      @Test
      public void testGetAllUsersAsAdmin() {
          User user = createUser();
          User admin = createAdmin();
  
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(admin)).
          when().
              get("/users").
          then().
              statusCode(HttpStatus.SC_OK).
              body("email", hasItems(user.getEmail(), admin.getEmail())).
              body("profile.displayName",
              hasItems(user.getProfile().getDisplayName(), admin.getProfile().getDisplayName()));
          //@formatter:on
      }
  
      @Test
      public void testGetCurrentUserAsAnonymous() {
          //@formatter:off
          when().
              get("/users/current").
          then().
              statusCode(HttpStatus.SC_OK).
              body("object", nullValue()).
              body("message", containsString("Not logged in"));
  
          //@formatter:on
      }
  
      @Test
      public void testGetCurrentUserAsUser() {
          User user = createUser();
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(user)).
          when().
              get("/users/current").
          then().
              statusCode(HttpStatus.SC_OK).
              body("email", equalTo(user.getEmail())).
              body("authorities", hasItem("ROLE_USER")).
              body("authorities", not(hasItem("ROLE_ADMIN")));
          //@formatter:on
      }
  
      @Test
      public void testGetCurrentUserHasNoPasswordHash() {
          User user = createUser();
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(user)).
          when().
              get("/users/current").
          then().
              body("passwordHash", isEmptyOrNullString());
          //@formatter:on
      }
  
      @Test
      public void testGetCurrentUserAsAdmin() {
          User admin = createAdmin();
  
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(admin)).
          when().
              get("/users/current").
          then().statusCode(HttpStatus.SC_OK).
              body("email", equalTo(admin.getEmail())).
              body("authorities", hasItem("ROLE_ADMIN"));
          //@formatter:on
      }
  
      @Test
      public void testGetOtherUserAsAnonymous() {
          //@formatter:off
          when().
              get("/users/1").
          then().
              statusCode(HttpStatus.SC_FORBIDDEN);
          //@formatter:on
      }
  
      @Test
      public void testGetOtherUserAsUser() {
          User user = createUser();
          long id = user.getId();
          id++;
  
          //@formatter:off
          given().
                  header(getXAuthTokenHeaderForUser(user)).
          when().get("/users/" + id).
              then().statusCode(HttpStatus.SC_FORBIDDEN).body("message", equalTo("Access denied"));
          //@formatter:on
      }
  
      @Test
      public void testGetOtherUserAsAdmin() {
          User user = createUser();
          long userId = user.getId();
          User admin = createAdmin();
  
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(admin)).
          when().
              get("/users/" + userId).
          then().statusCode(HttpStatus.SC_OK).
              body("email", equalTo(user.getEmail()));
          //@formatter:on
      }
  
      @Test
      public void testGetOwnUserId() {
          User user = createUser();
  
          //@formatter:off
          given().
              header(getXAuthTokenHeaderForUser(user)).
          when().
              get("/users/" + user.getId()).
          then().statusCode(HttpStatus.SC_OK).
              body("email", equalTo(user.getEmail()));
          //@formatter:on
      }
  
  
      // USER POST
      @Test
      public void testCreateUser() {
          Map<String, String> userDTO = new HashMap<>();
          userDTO.put("email", "test@mail.com");
          userDTO.put("password", cleartextPassword);
  
          //@formatter:off
          given().
          when().
              body(userDTO).contentType(ContentType.JSON).
              post("/users").
          then().
              statusCode(HttpStatus.SC_CREATED).
              body("message", containsString("User successfully created at")).
              body("object.email", is(userDTO.get("email")));
          //@formatter:on
      }
  
      @Test
      public void testCreateUserIsDisabled() {
          Map<String, String> userDTO = new HashMap<>();
          userDTO.put("email", "disabled@mail.com");
          userDTO.put("password", cleartextPassword);
  
          //@formatter:off
          given().
          when().
              body(userDTO).contentType(ContentType.JSON).
              post("/users").
          then().
              statusCode(HttpStatus.SC_CREATED).
              body("message", containsString("User successfully created at")).
              body("object.email", is(userDTO.get("email")));
  
          given().
              body(userDTO).
          when().
              post("/login").
          then().
              statusCode(HttpStatus.SC_UNAUTHORIZED).
              body("error", containsString("Unauthorized"));
          //@formatter:on
  
      }
  
      @Test
      public void createUserMissingEmailField() {
  