--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/client/command/src/test/java/com/redhat/thermostat/client/command/internal/RequestQueueImplTest.java	Tue May 14 18:09:15 2013 +0200
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2012, 2013 Red Hat, Inc.
+ *
+ * This file is part of Thermostat.
+ *
+ * Thermostat is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * Thermostat is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Thermostat; see the file COPYING.  If not see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Linking this code with other modules is making a combined work
+ * based on this code.  Thus, the terms and conditions of the GNU
+ * General Public License cover the whole combination.
+ *
+ * As a special exception, the copyright holders of this code give
+ * you permission to link this code with independent modules to
+ * produce an executable, regardless of the license terms of these
+ * independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also
+ * meet, for each linked independent module, the terms and conditions
+ * of the license of that module.  An independent module is a module
+ * which is not derived from or based on this code.  If you modify
+ * this code, you may extend this exception to your version of the
+ * library, but you are not obligated to do so.  If you do not wish
+ * to do so, delete this exception statement from your version.
+ */
+
+package com.redhat.thermostat.client.command.internal;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.eq;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.osgi.framework.Bundle;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.FrameworkUtil;
+import org.osgi.framework.ServiceReference;
+import org.powermock.api.mockito.PowerMockito;
+import org.powermock.core.classloader.annotations.PrepareForTest;
+import org.powermock.modules.junit4.PowerMockRunner;
+
+import com.redhat.thermostat.common.command.Request;
+import com.redhat.thermostat.storage.core.AuthToken;
+import com.redhat.thermostat.storage.core.SecureStorage;
+import com.redhat.thermostat.storage.core.Storage;
+
+@RunWith(PowerMockRunner.class)
+@PrepareForTest({ FrameworkUtil.class })
+public class RequestQueueImplTest {
+
+
+    /*
+     * Other tests ensure that secure storage is returned from storage providers.
+     * This is an attemtp to make sure that authentication hooks are actually
+     * called if storage is an instance of SecureStorage.
+     * 
+     */
+    @Test
+    public void putRequestAuthenticatesForSecureStorage() {
+        PowerMockito.mockStatic(FrameworkUtil.class);
+        Bundle mockBundle = mock(Bundle.class);
+        BundleContext mockContext = mock(BundleContext.class);
+        ServiceReference mockServiceRef = mock(ServiceReference.class);
+        when(mockContext.getServiceReference(Storage.class.getName())).thenReturn(mockServiceRef);
+        SecureStorage mockStorage = mock(SecureStorage.class);
+        AuthToken mockToken = mock(AuthToken.class);
+        when(mockStorage.generateToken()).thenReturn(mockToken);
+        when(mockContext.getService(mockServiceRef)).thenReturn(mockStorage);
+        when(mockBundle.getBundleContext()).thenReturn(mockContext);
+        when(FrameworkUtil.getBundle(RequestQueueImpl.class)).thenReturn(mockBundle);
+        ConfigurationRequestContext ctx = mock(ConfigurationRequestContext.class);
+        RequestQueueImpl queue = new RequestQueueImpl(ctx);
+        Request request = mock(Request.class);
+        queue.putRequest(request);
+        verify(request).setParameter(eq(Request.CLIENT_TOKEN), any(String.class));
+        verify(request).setParameter(eq(Request.AUTH_TOKEN), any(String.class));
+    }
+}

--- a/storage/core/src/main/java/com/redhat/thermostat/storage/core/QueuedStorage.java	Tue May 14 21:14:43 2013 +0200
+++ b/storage/core/src/main/java/com/redhat/thermostat/storage/core/QueuedStorage.java	Tue May 14 18:09:15 2013 +0200
@@ -45,7 +45,7 @@
 
 import com.redhat.thermostat.storage.model.Pojo;
 
-public final class QueuedStorage implements Storage {
+public class QueuedStorage implements Storage {
 
     private static final int SHUTDOWN_TIMEOUT_SECONDS = 3;
 
@@ -99,9 +99,9 @@
 
     }
 
-    private Storage delegate;
-    private ExecutorService executor;
-    private ExecutorService fileExecutor;
+    protected final Storage delegate;
+    protected final ExecutorService executor;
+    protected final ExecutorService fileExecutor;
 
     /*
      * NOTE: We intentially use single-thread executor. All updates are put into a queue, from which

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/storage/core/src/main/java/com/redhat/thermostat/storage/core/SecureQueuedStorage.java	Tue May 14 18:09:15 2013 +0200
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2012, 2013 Red Hat, Inc.
+ *
+ * This file is part of Thermostat.
+ *
+ * Thermostat is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * Thermostat is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Thermostat; see the file COPYING.  If not see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Linking this code with other modules is making a combined work
+ * based on this code.  Thus, the terms and conditions of the GNU
+ * General Public License cover the whole combination.
+ *
+ * As a special exception, the copyright holders of this code give
+ * you permission to link this code with independent modules to
+ * produce an executable, regardless of the license terms of these
+ * independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also
+ * meet, for each linked independent module, the terms and conditions
+ * of the license of that module.  An independent module is a module
+ * which is not derived from or based on this code.  If you modify
+ * this code, you may extend this exception to your version of the
+ * library, but you are not obligated to do so.  If you do not wish
+ * to do so, delete this exception statement from your version.
+ */
+
+package com.redhat.thermostat.storage.core;
+
+/**
+ * Secure version of {@link QueuedStorage}. I.e. its delegate is an instance of
+ * {@link SecureStorage}.
+ *
+ * @see SecureStorage
+ * @see QueuedStorage
+ */
+public final class SecureQueuedStorage extends QueuedStorage implements SecureStorage {
+
+    public SecureQueuedStorage(SecureStorage storage) {
+        super(storage);
+    }
+    @Override
+    public AuthToken generateToken() throws StorageException {
+        return ((SecureStorage)delegate).generateToken();
+    }
+
+    @Override
+    public boolean verifyToken(AuthToken token) {
+        return ((SecureStorage)delegate).verifyToken(token);
+    }
+
+}

--- a/storage/core/src/main/java/com/redhat/thermostat/storage/core/SecureStorage.java	Tue May 14 21:14:43 2013 +0200
+++ b/storage/core/src/main/java/com/redhat/thermostat/storage/core/SecureStorage.java	Tue May 14 18:09:15 2013 +0200
@@ -59,7 +59,7 @@
  *      the same token for an authenticated client before, and replies with true if it succeeds, and
  *      false otherwise.
  */
-public interface SecureStorage {
+public interface SecureStorage extends Storage {
 
     /**
      * Generates a token in the storage that can be used to authenticate cmd channel requests.

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/storage/mongo/src/test/java/com/redhat/thermostat/storage/mongodb/internal/MongoStorageProviderTest.java	Tue May 14 18:09:15 2013 +0200
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2012, 2013 Red Hat, Inc.
+ *
+ * This file is part of Thermostat.
+ *
+ * Thermostat is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * Thermostat is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Thermostat; see the file COPYING.  If not see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Linking this code with other modules is making a combined work
+ * based on this code.  Thus, the terms and conditions of the GNU
+ * General Public License cover the whole combination.
+ *
+ * As a special exception, the copyright holders of this code give
+ * you permission to link this code with independent modules to
+ * produce an executable, regardless of the license terms of these
+ * independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also
+ * meet, for each linked independent module, the terms and conditions
+ * of the license of that module.  An independent module is a module
+ * which is not derived from or based on this code.  If you modify
+ * this code, you may extend this exception to your version of the
+ * library, but you are not obligated to do so.  If you do not wish
+ * to do so, delete this exception statement from your version.
+ */
+
+package com.redhat.thermostat.storage.mongodb.internal;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import com.redhat.thermostat.storage.config.StartupConfiguration;
+import com.redhat.thermostat.storage.core.QueuedStorage;
+import com.redhat.thermostat.storage.core.SecureStorage;
+import com.redhat.thermostat.storage.core.Storage;
+import com.redhat.thermostat.storage.mongodb.MongoStorageProvider;
+
+public class MongoStorageProviderTest {
+
+    @Test
+    public void createStorageReturnsQueuedStorage() {
+        StartupConfiguration config = mock(StartupConfiguration.class);
+        when(config.getDBConnectionString()).thenReturn("mongodb://something.com");
+        MongoStorageProvider provider = new MongoStorageProvider();
+        provider.setConfig(config);
+        Storage result = provider.createStorage();
+        assertTrue(result instanceof QueuedStorage);
+        assertFalse(result instanceof SecureStorage);
+    }
+}

--- a/web/client/src/main/java/com/redhat/thermostat/web/client/internal/WebStorageProvider.java	Tue May 14 21:14:43 2013 +0200
+++ b/web/client/src/main/java/com/redhat/thermostat/web/client/internal/WebStorageProvider.java	Tue May 14 18:09:15 2013 +0200
@@ -38,7 +38,7 @@
 
 import com.redhat.thermostat.storage.config.AuthenticationConfiguration;
 import com.redhat.thermostat.storage.config.StartupConfiguration;
-import com.redhat.thermostat.storage.core.QueuedStorage;
+import com.redhat.thermostat.storage.core.SecureQueuedStorage;
 import com.redhat.thermostat.storage.core.Storage;
 import com.redhat.thermostat.storage.core.StorageProvider;
 
@@ -54,7 +54,7 @@
             AuthenticationConfiguration authConf = (AuthenticationConfiguration) config;
             storage.setAuthConfig(authConf.getUsername(), authConf.getPassword());
         }
-        return new QueuedStorage(storage);
+        return new SecureQueuedStorage(storage);
     }
 
     @Override

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/web/client/src/test/java/com/redhat/thermostat/web/client/internal/WebStorageProviderTest.java	Tue May 14 18:09:15 2013 +0200
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2012, 2013 Red Hat, Inc.
+ *
+ * This file is part of Thermostat.
+ *
+ * Thermostat is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * Thermostat is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Thermostat; see the file COPYING.  If not see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Linking this code with other modules is making a combined work
+ * based on this code.  Thus, the terms and conditions of the GNU
+ * General Public License cover the whole combination.
+ *
+ * As a special exception, the copyright holders of this code give
+ * you permission to link this code with independent modules to
+ * produce an executable, regardless of the license terms of these
+ * independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also
+ * meet, for each linked independent module, the terms and conditions
+ * of the license of that module.  An independent module is a module
+ * which is not derived from or based on this code.  If you modify
+ * this code, you may extend this exception to your version of the
+ * library, but you are not obligated to do so.  If you do not wish
+ * to do so, delete this exception statement from your version.
+ */
+
+package com.redhat.thermostat.web.client.internal;
+
+import org.junit.Test;
+import org.mockito.Mockito;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.redhat.thermostat.storage.config.AuthenticationConfiguration;
+import com.redhat.thermostat.storage.config.StartupConfiguration;
+import com.redhat.thermostat.storage.core.QueuedStorage;
+import com.redhat.thermostat.storage.core.SecureStorage;
+import com.redhat.thermostat.storage.core.Storage;
+
+public class WebStorageProviderTest {
+
+    @Test
+    public void createStorageCreatesSecureStorage() {
+        WebStorageProvider provider = new WebStorageProvider();
+        MockConfiguration config = mock(MockConfiguration.class);
+        when(config.getDBConnectionString()).thenReturn("http://something");
+        provider.setConfig(config);
+        Storage storage = provider.createStorage();
+        assertTrue(storage instanceof SecureStorage);
+        assertTrue(storage instanceof QueuedStorage);
+        verify(config, Mockito.atLeastOnce()).getUsername();
+        verify(config, Mockito.atLeastOnce()).getPassword();
+    }
+    
+    private abstract static class MockConfiguration implements
+            AuthenticationConfiguration, StartupConfiguration {
+        // no-op
+    }
+}