쿠키와 상태 관리

package board.web;

import static java.nio.charset.StandardCharsets.UTF_8;
import static java.time.ZoneOffset.UTC;
import static java.util.concurrent.TimeUnit.SECONDS;
import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.http.HttpStatus.UNAUTHORIZED;
import static org.springframework.http.MediaType.APPLICATION_JSON;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.http.Cookie;
import java.net.CookieManager;
import java.net.CookiePolicy;
import java.net.URI;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.Clock;
import java.time.Duration;
import java.time.Instant;
import java.time.ZoneId;
import java.time.format.DateTimeFormatter;
import java.util.ArrayDeque;
import java.util.ArrayList;
import java.util.Base64;
import java.util.HashMap;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.Callable;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.Executors;
import org.junit.jupiter.api.Test;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseCookie;
import org.springframework.http.ResponseEntity;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult;
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import org.springframework.web.bind.annotation.CookieValue;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

class LoginCookieContractTest {
    private static final Duration SESSION_TTL =
            Duration.ofMinutes(30);
    private static final Instant START =
            Instant.parse("2030-01-01T00:00:00Z");
    private static final Member MEMBER =
            new Member(7L, "[email protected]");
    private static final String LOGIN_JSON = """
            {
              "email": "[email protected]",
              "password": "correct-horse-battery-staple"
            }
            """;
    private static final ObjectMapper JSON =
            new ObjectMapper();

    @Test
    void 로그인은_정확한_host_cookie_속성과_no_store를_반환한다()
            throws Exception {
        var fixture = fixture("login-001");

        var login = fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var response = login.getResponse();
        var setCookie = response.getHeader(
                HttpHeaders.SET_COOKIE);
        var actualParts = Set.of(
                Objects.requireNonNull(setCookie)
                        .split(";\\s*"));
        var expectedParts = Set.of(
                "__Host-board-session=login-001",
                "Path=/",
                "Max-Age=1800",
                "Secure",
                "HttpOnly",
                "SameSite=Lax",
                "Expires=Tue, 1 Jan 2030 00:30:00 GMT");

        assertAll(
                () -> assertEquals(
                        204, response.getStatus()),
                () -> assertEquals(
                        1,
                        response.getHeaders(
                                HttpHeaders.SET_COOKIE).size()),
                () -> assertEquals(
                        expectedParts, actualParts),
                () -> assertEquals(
                        "no-store",
                        response.getHeader(
                                HttpHeaders.CACHE_CONTROL)),
                () -> assertFalse(
                        fixture.store()
                                .containsRawStorageKey(
                                        "login-001")),
                () -> assertTrue(
                        fixture.store()
                                .containsDigestFor(
                                        "login-001")),
                () -> assertEquals(
                        List.of(
                                "__Host-board-session="
                                        + "login-001"),
                        fixture.browser()
                                .cookieHeaderValues(
                                        "/api/me")));
    }

    @Test
    void 로그인_cookie는_jar를_거쳐_me_요청에_자동_첨부된다()
            throws Exception {
        var fixture = fixture("roundtrip-001");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var me = fixture.browser().perform(
                fixture.mvc(),
                "/api/me",
                get("/api/me"));
        JsonNode body = JSON.readTree(
                me.getResponse().getContentAsByteArray());

        assertAll(
                () -> assertEquals(
                        200,
                        me.getResponse().getStatus()),
                () -> assertEquals(
                        "no-store",
                        me.getResponse().getHeader(
                                HttpHeaders.CACHE_CONTROL)),
                () -> assertEquals(
                        7L, body.get("id").longValue()),
                () -> assertEquals(
                        "[email protected]",
                        body.get("email").textValue()));
    }

    @Test
    void 없거나_위조된_cookie는_challenge가_있는_401이다()
            throws Exception {
        var fixture = fixture("unused-001");

        var absent = fixture.mvc().perform(
                get("/api/me").secure(true))
                .andReturn();
        var forged = fixture.mvc().perform(
                get("/api/me")
                        .secure(true)
                        .cookie(new Cookie(
                                SessionCookieFactory.NAME,
                                "forged-token")))
                .andReturn();

        assertUnauthorized(absent);
        assertUnauthorized(forged);
    }

    @Test
    void 로그아웃은_cookie를_삭제하고_같은_jar의_me를_401로_바꾼다()
            throws Exception {
        var fixture = fixture("logout-001");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var logout = fixture.browser().perform(
                fixture.mvc(),
                "/api/logout",
                post("/api/logout"));
        var deletion = Objects.requireNonNull(
                logout.getResponse().getHeader(
                        HttpHeaders.SET_COOKIE));
        var me = fixture.browser().perform(
                fixture.mvc(),
                "/api/me",
                get("/api/me"));

        assertAll(
                () -> assertEquals(
                        204,
                        logout.getResponse().getStatus()),
                () -> assertEquals(
                        Set.of(
                                "__Host-board-session=",
                                "Path=/",
                                "Secure",
                                "HttpOnly",
                                "SameSite=Lax",
                                "Expires=Thu, 1 Jan 1970 "
                                        + "00:00:00 GMT"),
                        Set.of(deletion.split(";\\s*"))),
                () -> assertTrue(
                        fixture.browser()
                                .cookieHeaderValues(
                                        "/api/me")
                                .isEmpty()),
                () -> assertEquals(
                        401, me.getResponse().getStatus()));
    }

    @Test
    void 로그아웃_전에_복사한_token도_서버_폐기_뒤에는_401이다()
            throws Exception {
        var fixture = fixture("replay-001");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        fixture.browser().perform(
                fixture.mvc(),
                "/api/logout",
                post("/api/logout"));
        var replay = fixture.mvc().perform(
                get("/api/me")
                        .secure(true)
                        .cookie(new Cookie(
                                SessionCookieFactory.NAME,
                                "replay-001")))
                .andReturn();

        assertUnauthorized(replay);
    }

    @Test
    void cookie가_없는_로그아웃과_반복_로그아웃은_모두_204다()
            throws Exception {
        var fixture = fixture("repeat-001");

        var missing = fixture.browser().perform(
                fixture.mvc(),
                "/api/logout",
                post("/api/logout"));
        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var first = fixture.browser().perform(
                fixture.mvc(),
                "/api/logout",
                post("/api/logout"));
        var repeated = fixture.browser().perform(
                fixture.mvc(),
                "/api/logout",
                post("/api/logout"));

        assertAll(
                () -> assertEquals(
                        204,
                        missing.getResponse().getStatus()),
                () -> assertEquals(
                        204,
                        first.getResponse().getStatus()),
                () -> assertEquals(
                        204,
                        repeated.getResponse().getStatus()));
    }

    @Test
    void 서버_TTL이_지나면_jar가_token을_보내도_401이다()
            throws Exception {
        var fixture = fixture("ttl-001");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        fixture.clock().advance(
                SESSION_TTL.plusSeconds(1));
        var beforeRequest = fixture.browser()
                .cookieHeaderValues("/api/me");
        var expired = fixture.browser().perform(
                fixture.mvc(),
                "/api/me",
                get("/api/me"));

        assertAll(
                () -> assertEquals(
                        List.of(
                                "__Host-board-session="
                                        + "ttl-001"),
                        beforeRequest),
                () -> assertEquals(
                        401,
                        expired.getResponse().getStatus()),
                () -> assertEquals(
                        SessionController.CHALLENGE,
                        expired.getResponse().getHeader(
                                HttpHeaders
                                        .WWW_AUTHENTICATE)));
    }

    @Test
    void rotate는_이전_token을_폐기하고_새_cookie만_유효하게_한다()
            throws Exception {
        var fixture = fixture(
                "rotate-old", "rotate-new");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var rotate = fixture.browser().perform(
                fixture.mvc(),
                "/api/session/rotate",
                post("/api/session/rotate"));
        var oldReplay = fixture.mvc().perform(
                get("/api/me")
                        .secure(true)
                        .cookie(new Cookie(
                                SessionCookieFactory.NAME,
                                "rotate-old")))
                .andReturn();
        var current = fixture.browser().perform(
                fixture.mvc(),
                "/api/me",
                get("/api/me"));

        assertAll(
                () -> assertEquals(
                        204,
                        rotate.getResponse().getStatus()),
                () -> assertEquals(
                        List.of(
                                "__Host-board-session="
                                        + "rotate-new"),
                        fixture.browser()
                                .cookieHeaderValues(
                                        "/api/me")),
                () -> assertEquals(
                        401,
                        oldReplay.getResponse().getStatus()),
                () -> assertEquals(
                        200,
                        current.getResponse().getStatus()));
    }

    @Test
    void 재로그인은_같은_회원의_이전_session을_폐기한다()
            throws Exception {
        var fixture = fixture(
                "login-old", "login-new");

        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        fixture.browser().perform(
                fixture.mvc(),
                "/api/login",
                loginRequest());
        var oldReplay = fixture.mvc().perform(
                get("/api/me")
                        .secure(true)
                        .cookie(new Cookie(
                                SessionCookieFactory.NAME,
                                "login-old")))
                .andReturn();
        var current = fixture.browser().perform(
                fixture.mvc(),
                "/api/me",
                get("/api/me"));

        assertAll(
                () -> assertEquals(
                        401,
                        oldReplay.getResponse().getStatus()),
                () -> assertEquals(
                        List.of(
                                "__Host-board-session="
                                        + "login-new"),
                        fixture.browser()
                                .cookieHeaderValues(
                                        "/api/me")),
                () -> assertEquals(
                        200,
                        current.getResponse().getStatus()));
    }

    @Test
    void 동시에_같은_token을_rotate하면_정확히_하나만_성공한다()
            throws Exception {
        var fixture = fixture(
                "concurrent-old",
                "concurrent-new-a",
                "concurrent-new-b");
        fixture.store().create(MEMBER);
        var ready = new CountDownLatch(2);
        var start = new CountDownLatch(1);
        var pool = Executors.newFixedThreadPool(2);
        Callable<Optional<IssuedSession>> task = () -> {
            ready.countDown();
            if (!start.await(5, SECONDS)) {
                throw new IllegalStateException(
                        "rotate start timeout");
            }
            return fixture.store().rotate(
                    "concurrent-old");
        };

        try {
            var first = pool.submit(task);
            var second = pool.submit(task);
            assertTrue(ready.await(5, SECONDS));
            start.countDown();
            var outcomes = List.of(
                    first.get(5, SECONDS),
                    second.get(5, SECONDS));
            var winner = outcomes.stream()
                    .flatMap(Optional::stream)
                    .findFirst()
                    .orElseThrow();

            assertAll(
                    () -> assertEquals(
                            1L,
                            outcomes.stream()
                                    .filter(Optional::isPresent)
                                    .count()),
                    () -> assertTrue(
                            fixture.store()
                                    .findMember(
                                            winner.rawToken())
                                    .isPresent()),
                    () -> assertTrue(
                            fixture.store()
                                    .findMember(
                                            "concurrent-old")
                                    .isEmpty()));
        } finally {
            start.countDown();
            pool.shutdownNow();
        }
    }

    private static MockHttpServletRequestBuilder loginRequest() {
        return post("/api/login")
                .contentType(APPLICATION_JSON)
                .content(LOGIN_JSON);
    }

    private static void assertUnauthorized(
            MvcResult result) {
        assertAll(
                () -> assertEquals(
                        401,
                        result.getResponse().getStatus()),
                () -> assertEquals(
                        SessionController.CHALLENGE,
                        result.getResponse().getHeader(
                                HttpHeaders
                                        .WWW_AUTHENTICATE)),
                () -> assertEquals(
                        "no-store",
                        result.getResponse().getHeader(
                                HttpHeaders.CACHE_CONTROL)));
    }

    private static TestFixture fixture(
            String... tokens) {
        var clock = new MutableClock(START, UTC);
        var store = new InMemorySessionStore(
                clock,
                SESSION_TTL,
                new QueuedTokenIssuer(tokens));
        var cookies = new SessionCookieFactory(
                SESSION_TTL);
        var controller = new SessionController(
                new FixedAuthenticator(),
                store,
                cookies);
        var mvc = MockMvcBuilders
                .standaloneSetup(controller)
                .setMessageConverters(
                        new MappingJackson2HttpMessageConverter())
                .build();
        return new TestFixture(
                mvc,
                clock,
                store,
                new BrowserSession());
    }

    private record TestFixture(
            MockMvc mvc,
            MutableClock clock,
            InMemorySessionStore store,
            BrowserSession browser) {}

    private record LoginRequest(
            String email,
            String password) {}

    private record Member(
            long id,
            String email) {}

    private record MemberResponse(
            long id,
            String email) {
        private static MemberResponse from(
                Member member) {
            return new MemberResponse(
                    member.id(), member.email());
        }
    }

    private record IssuedSession(
            String rawToken,
            Instant expiresAt) {}

    private static final class FixedAuthenticator {
        private Optional<Member> authenticate(
                LoginRequest request) {
            if (request != null
                    && MEMBER.email().equals(
                            request.email())
                    && "correct-horse-battery-staple"
                            .equals(request.password())) {
                return Optional.of(MEMBER);
            }
            return Optional.empty();
        }
    }

    private interface TokenIssuer {
        String next();
    }

    private static final class QueuedTokenIssuer
            implements TokenIssuer {
        private final ArrayDeque<String> tokens;

        private QueuedTokenIssuer(
                String... tokens) {
            this.tokens = new ArrayDeque<>(
                    List.of(tokens));
        }

        @Override
        public synchronized String next() {
            if (tokens.isEmpty()) {
                throw new IllegalStateException(
                        "no deterministic token remains");
            }
            return tokens.removeFirst();
        }
    }

    private static final class StoredSession {
        private final Member member;
        private final Instant expiresAt;
        private boolean revoked;

        private StoredSession(
                Member member,
                Instant expiresAt) {
            this.member = member;
            this.expiresAt = expiresAt;
        }
    }

    private static final class InMemorySessionStore {
        private final Map<String, StoredSession>
                sessionsByDigest = new HashMap<>();
        private final Clock clock;
        private final Duration ttl;
        private final TokenIssuer tokens;

        private InMemorySessionStore(
                Clock clock,
                Duration ttl,
                TokenIssuer tokens) {
            this.clock = clock;
            this.ttl = ttl;
            this.tokens = tokens;
        }

        private synchronized IssuedSession create(
                Member member) {
            var rawToken = tokens.next();
            var key = digest(rawToken);
            ensureUnused(key);
            var expiresAt = clock.instant().plus(ttl);

            sessionsByDigest.values().stream()
                    .filter(session ->
                            session.member.id()
                                    == member.id())
                    .forEach(session ->
                            session.revoked = true);
            sessionsByDigest.put(
                    key,
                    new StoredSession(
                            member, expiresAt));
            return new IssuedSession(
                    rawToken, expiresAt);
        }

        private synchronized Optional<Member> findMember(
                String rawToken) {
            return Optional.ofNullable(
                            active(rawToken))
                    .map(session -> session.member);
        }

        private synchronized void revoke(
                String rawToken) {
            if (rawToken == null
                    || rawToken.isBlank()) {
                return;
            }
            var session = sessionsByDigest.get(
                    digest(rawToken));
            if (session != null) {
                session.revoked = true;
            }
        }

        private synchronized Optional<IssuedSession> rotate(
                String oldRawToken) {
            var current = active(oldRawToken);
            if (current == null) {
                return Optional.empty();
            }

            var newRawToken = tokens.next();
            var newKey = digest(newRawToken);
            ensureUnused(newKey);
            var expiresAt = clock.instant().plus(ttl);

            current.revoked = true;
            sessionsByDigest.put(
                    newKey,
                    new StoredSession(
                            current.member,
                            expiresAt));
            return Optional.of(
                    new IssuedSession(
                            newRawToken,
                            expiresAt));
        }

        private StoredSession active(
                String rawToken) {
            if (rawToken == null
                    || rawToken.isBlank()) {
                return null;
            }
            var session = sessionsByDigest.get(
                    digest(rawToken));
            if (session == null || session.revoked) {
                return null;
            }
            if (!clock.instant().isBefore(
                    session.expiresAt)) {
                session.revoked = true;
                return null;
            }
            return session;
        }

        private void ensureUnused(String key) {
            if (sessionsByDigest.containsKey(key)) {
                throw new IllegalStateException(
                        "token digest collision");
            }
        }

        private synchronized boolean
                containsRawStorageKey(String rawToken) {
            return sessionsByDigest.containsKey(
                    rawToken);
        }

        private synchronized boolean containsDigestFor(
                String rawToken) {
            return sessionsByDigest.containsKey(
                    digest(rawToken));
        }

        private static String digest(String rawToken) {
            try {
                var sha256 = MessageDigest.getInstance(
                        "SHA-256");
                return Base64.getUrlEncoder()
                        .withoutPadding()
                        .encodeToString(
                                sha256.digest(
                                        rawToken.getBytes(
                                                UTF_8)));
            } catch (NoSuchAlgorithmException exception) {
                throw new IllegalStateException(
                        "SHA-256 is required",
                        exception);
            }
        }
    }

    private static final class SessionCookieFactory {
        private static final String NAME =
                "__Host-board-session";
        private static final DateTimeFormatter COOKIE_DATE =
                DateTimeFormatter.ofPattern(
                                "EEE, d MMM uuuu "
                                        + "HH:mm:ss 'GMT'",
                                Locale.US)
                        .withZone(UTC);
        private final Duration ttl;

        private SessionCookieFactory(Duration ttl) {
            this.ttl = ttl;
        }

        private String issued(IssuedSession session) {
            var cookie = ResponseCookie.from(
                            NAME, session.rawToken())
                    .path("/")
                    .maxAge(ttl)
                    .secure(true)
                    .httpOnly(true)
                    .sameSite("Lax")
                    .build();
            return withExpires(
                    cookie, session.expiresAt());
        }

        private String deleted() {
            var cookie = ResponseCookie.from(NAME, "")
                    .path("/")
                    .secure(true)
                    .httpOnly(true)
                    .sameSite("Lax")
                    .build();
            return withExpires(cookie, Instant.EPOCH);
        }

        private static String withExpires(
                ResponseCookie cookie,
                Instant expiresAt) {
            return cookie
                    + "; Expires="
                    + COOKIE_DATE.format(expiresAt);
        }
    }

    @RestController
    @RequestMapping("/api")
    private static final class SessionController {
        private static final String CHALLENGE =
                "Session realm=\"board\"";
        private final FixedAuthenticator authenticator;
        private final InMemorySessionStore sessions;
        private final SessionCookieFactory cookies;

        private SessionController(
                FixedAuthenticator authenticator,
                InMemorySessionStore sessions,
                SessionCookieFactory cookies) {
            this.authenticator = authenticator;
            this.sessions = sessions;
            this.cookies = cookies;
        }

        @PostMapping(
                path = "/login",
                consumes = "application/json")
        private ResponseEntity<Void> login(
                @RequestBody LoginRequest request) {
            var member = authenticator.authenticate(
                    request);
            if (member.isEmpty()) {
                return unauthorized();
            }
            var session = sessions.create(
                    member.orElseThrow());
            return ResponseEntity.noContent()
                    .header(
                            HttpHeaders.SET_COOKIE,
                            cookies.issued(session))
                    .header(
                            HttpHeaders.CACHE_CONTROL,
                            "no-store")
                    .build();
        }

        @GetMapping("/me")
        private ResponseEntity<MemberResponse> me(
                @CookieValue(
                                name = SessionCookieFactory.NAME,
                                required = false)
                        String rawToken) {
            return sessions.findMember(rawToken)
                    .map(MemberResponse::from)
                    .map(member ->
                            ResponseEntity.ok()
                                    .header(
                                            HttpHeaders
                                                    .CACHE_CONTROL,
                                            "no-store")
                                    .body(member))
                    .orElseGet(
                            SessionController
                                    ::unauthorized);
        }

        @PostMapping("/logout")
        private ResponseEntity<Void> logout(
                @CookieValue(
                                name = SessionCookieFactory.NAME,
                                required = false)
                        String rawToken) {
            sessions.revoke(rawToken);
            return ResponseEntity.noContent()
                    .header(
                            HttpHeaders.SET_COOKIE,
                            cookies.deleted())
                    .header(
                            HttpHeaders.CACHE_CONTROL,
                            "no-store")
                    .build();
        }

        @PostMapping("/session/rotate")
        private ResponseEntity<Void> rotate(
                @CookieValue(
                                name = SessionCookieFactory.NAME,
                                required = false)
                        String rawToken) {
            return sessions.rotate(rawToken)
                    .map(session ->
                            ResponseEntity.noContent()
                                    .header(
                                            HttpHeaders.SET_COOKIE,
                                            cookies.issued(
                                                    session))
                                    .header(
                                            HttpHeaders
                                                    .CACHE_CONTROL,
                                            "no-store")
                                    .<Void>build())
                    .orElseGet(
                            SessionController
                                    ::unauthorized);
        }

        private static <T> ResponseEntity<T>
                unauthorized() {
            return ResponseEntity.status(UNAUTHORIZED)
                    .header(
                            HttpHeaders.WWW_AUTHENTICATE,
                            CHALLENGE)
                    .header(
                            HttpHeaders.CACHE_CONTROL,
                            "no-store")
                    .build();
        }
    }

    private static final class BrowserSession {
        private static final URI ORIGIN =
                URI.create("https://board.example");
        private final CookieManager cookies =
                new CookieManager(
                        null, CookiePolicy.ACCEPT_ALL);

        private MvcResult perform(
                MockMvc mvc,
                String path,
                MockHttpServletRequestBuilder request)
                throws Exception {
            var uri = ORIGIN.resolve(path);
            attachRequestCookies(uri, request);
            var result = mvc.perform(
                            request.secure(true)
                                    .header(
                                            HttpHeaders.HOST,
                                            uri.getHost()))
                    .andReturn();
            acceptEverySetCookie(uri, result);
            return result;
        }

        private List<String> cookieHeaderValues(
                String path) throws Exception {
            var values = new ArrayList<String>();
            cookies.get(
                            ORIGIN.resolve(path),
                            Map.of())
                    .forEach((name, lines) -> {
                        if (name != null
                                && name.equalsIgnoreCase(
                                        HttpHeaders.COOKIE)) {
                            values.addAll(lines);
                        }
                    });
            return List.copyOf(values);
        }

        private void attachRequestCookies(
                URI uri,
                MockHttpServletRequestBuilder request)
                throws Exception {
            cookies.get(uri, Map.of())
                    .forEach((name, lines) -> {
                        if (name == null
                                || !name.equalsIgnoreCase(
                                        HttpHeaders.COOKIE)) {
                            return;
                        }
                        lines.forEach(line ->
                                addCookieLine(request, line));
                    });
        }

        private void acceptEverySetCookie(
                URI uri,
                MvcResult result) throws Exception {
            var fields = result.getResponse()
                    .getHeaders(HttpHeaders.SET_COOKIE);
            if (!fields.isEmpty()) {
                cookies.put(
                        uri,
                        Map.of(
                                HttpHeaders.SET_COOKIE,
                                List.copyOf(fields)));
            }
        }

        private static void addCookieLine(
                MockHttpServletRequestBuilder request,
                String line) {
            for (var pair : line.split(";\\s*")) {
                var equals = pair.indexOf('=');
                if (equals <= 0
                        || pair.startsWith("$")) {
                    continue;
                }
                request.cookie(new Cookie(
                        pair.substring(0, equals),
                        pair.substring(equals + 1)));
            }
        }
    }

    private static final class MutableClock extends Clock {
        private Instant current;
        private final ZoneId zone;

        private MutableClock(
                Instant current,
                ZoneId zone) {
            this.current = current;
            this.zone = zone;
        }

        private synchronized void advance(
                Duration duration) {
            current = current.plus(duration);
        }

        @Override
        public ZoneId getZone() {
            return zone;
        }

        @Override
        public Clock withZone(ZoneId requestedZone) {
            return new MutableClock(
                    instant(), requestedZone);
        }

        @Override
        public synchronized Instant instant() {
            return current;
        }
    }
}