it('relies SAML invalidate call even if access token is presented.', async () => {
      const request = requestFixture({ search: '?SAMLRequest=xxx%20yyy' });

      callWithInternalUser.withArgs('shield.samlInvalidate').resolves({ redirect: null });

      const authenticationResult = await provider.deauthenticate(request, {
        accessToken: 'x-saml-token',
        refreshToken: 'x-saml-refresh-token',
      });

      sinon.assert.calledOnce(callWithInternalUser);
      sinon.assert.calledWithExactly(callWithInternalUser, 'shield.samlInvalidate', {
        body: {
          queryString: 'SAMLRequest=xxx%20yyy',
          acs: 'test-protocol://test-hostname:1234/test-base-path/api/security/v1/saml',
        },
      });

      expect(authenticationResult.redirected()).toBe(true);
      expect(authenticationResult.redirectURL).toBe('/logged_out');
    });

                promizr.reduceRight(list, reduceTotal, iterator).then(result => {
                    sinon.assert.calledThrice(spy);

                    spy.getCall(0).args[0].should.equal(reduceTotal);
                    spy.getCall(0).args[1].should.equal(list[2]);

                    spy.getCall(1).args[0].should.equal(reduceTotal - list[2]);
                    spy.getCall(1).args[1].should.equal(list[1]);

                    spy.getCall(2).args[0].should.equal(reduceTotal - list[2] - list[1]);
                    spy.getCall(2).args[1].should.equal(list[0]);
                }).then(done, done);

    it('succeeds if only `authorization` header is available.', async () => {
      const request = BasicCredentials.decorateRequest(requestFixture(), 'user', 'password');
      const user = { username: 'user' };

      callWithRequest.withArgs(request, 'shield.authenticate').resolves(user);

      const authenticationResult = await provider.authenticate(request);

      expect(authenticationResult.succeeded()).toBe(true);
      expect(authenticationResult.user).toEqual(user);
      sinon.assert.calledOnce(callWithRequest);
    });

    it('predicates are called with the same context and proper arguments', function () {
        const exampleContext = {some: 'context'},
            structure = {
                key0: sinon.stub().returns(true),
                key1: sinon.stub().returns(true)
            },
            exampleObject = {
                key0: 1,
                key1: 'string'
            };

        const extraArgs = [2, 3];
        const args = [exampleObject, ...extraArgs];
        isValidStructure.call(exampleContext, structure, ...args);
        isValidStructure(structure).call(exampleContext, ...args);

        sinon.assert.calledTwice(structure.key0);
        sinon.assert.calledTwice(structure.key1);

        sinon.assert.alwaysCalledOn(structure.key0, exampleContext);
        sinon.assert.alwaysCalledOn(structure.key1, exampleContext);

        sinon.assert.calledWith(structure.key0, 1, ...extraArgs);
        sinon.assert.calledWith(structure.key1, 'string', ...extraArgs);
    });

    it('clears session if provider failed to authenticate request with 401 with active session.', async () => {
      const systemAPIRequest = requestFixture({ headers: { xCustomHeader: 'xxx' } });
      const notSystemAPIRequest = requestFixture({ headers: { xCustomHeader: 'yyy' } });

      session.get.withArgs(systemAPIRequest).resolves({
        state: { authorization: 'Basic xxx' },
        provider: 'basic',
      });

      session.get.withArgs(notSystemAPIRequest).resolves({
        state: { authorization: 'Basic yyy' },
        provider: 'basic',
      });

      session.clear.resolves();

      server.plugins.kibana.systemApi.isSystemApiRequest
        .withArgs(systemAPIRequest)
        .returns(true)
        .withArgs(notSystemAPIRequest)
        .returns(false);

      cluster.callWithRequest
        .withArgs(systemAPIRequest)
        .rejects(Boom.unauthorized('token expired'))
        .withArgs(notSystemAPIRequest)
        .rejects(Boom.unauthorized('invalid token'));

      const systemAPIAuthenticationResult = await authenticate(systemAPIRequest);
      expect(systemAPIAuthenticationResult.failed()).toBe(true);

      sinon.assert.calledOnce(session.clear);
      sinon.assert.calledWithExactly(session.clear, systemAPIRequest);

      const notSystemAPIAuthenticationResult = await authenticate(notSystemAPIRequest);
      expect(notSystemAPIAuthenticationResult.failed()).toBe(true);

      sinon.assert.calledTwice(session.clear);
      sinon.assert.calledWithExactly(session.clear, notSystemAPIRequest);
    });

  it('should not create unnecessary subscriptions with computeds', function() {
    const kObsA = ko.observable("a");
    const kObsB = ko.observable("b");
    const spyA = sinon.spy((a: any) => a);
    const spyB = sinon.spy((a: any) => a);
    const gObsA = computed((use) => spyA(use(kObsA)));
    const gObsB = pureComputed((use) => spyB(use(kObsB)));

    // A computed notices a change immediately.
    assertResetSingleCall(spyA, undefined, "a");
    assert.equal(gObsA.get(), "a");
    kObsA("A");
    assertResetSingleCall(spyA, undefined, "A");
    assert.equal(gObsA.get(), "A");
    sinon.assert.notCalled(spyA);

    // pureComputed notices a change only when looked at.
    sinon.assert.notCalled(spyB);
    assert.equal(gObsB.get(), "b");
    assertResetSingleCall(spyB, undefined, "b");
    kObsB("B");
    sinon.assert.notCalled(spyB);
    assert.equal(gObsB.get(), "B");
    assertResetSingleCall(spyB, undefined, "B");

    // This is the crux of the matter: kObsB does not have a subscription.
    assert.equal(kObsA.getSubscriptionsCount(), 1);
    assert.equal(kObsB.getSubscriptionsCount(), 0);     // pureComputed doesn't subscribe when inactive

    // Now subscribe to both gObs computeds.
    const spyA2 = sinon.spy((a: any) => a);
    const spyB2 = sinon.spy((a: any) => a);
    const lisA = gObsA.addListener(spyA2);
    const lisB = gObsB.addListener(spyB2);
    assertResetSingleCall(spyB, undefined, "B");

    // Now pureComputed acts as computed and subscribes too.
    assert.equal(kObsA.getSubscriptionsCount(), 1);
    assert.equal(kObsB.getSubscriptionsCount(), 1);

    kObsA("aa");
    assertResetSingleCall(spyA, undefined, "aa");
    assertResetSingleCall(spyA2, undefined, "aa", "A");
    kObsB("bb");
    assertResetSingleCall(spyB, undefined, "bb");
    assertResetSingleCall(spyB2, undefined, "bb", "B");

    // When we unsubscribe, count should go back to 0.
    lisA.dispose();
    lisB.dispose();
    assert.equal(kObsA.getSubscriptionsCount(), 1);
    assert.equal(kObsB.getSubscriptionsCount(), 0);

    kObsA("AA");
    assertResetSingleCall(spyA, undefined, "AA");
    sinon.assert.notCalled(spyA2);
    kObsB("bb");
    sinon.assert.notCalled(spyB);
    sinon.assert.notCalled(spyB2);
  });

  it('should work with nulls', function() {
    let f: Foo|null;
    let g: Foo|null;
    const obs = observable("");
    const comp = computed(obs, (use, val) => val ? Foo.create(use.owner, val) : null);
    f = comp.get();
    assert.strictEqual(f, null);
    sinon.assert.notCalled(fooConstruct);
    sinon.assert.notCalled(fooDispose);

    obs.set("b");     // This should trigger a re-evaluation of comp.
    g = comp.get();
    assertResetSingleCall(fooConstruct, g, "b");
    sinon.assert.notCalled(fooDispose);

    obs.set("");    // Triggers another reevaluation.
    f = comp.get();
    assert.strictEqual(f, null);
    sinon.assert.notCalled(fooConstruct);
    assertResetSingleCall(fooDispose, g);
    assert.isTrue(g && g.isDisposed());

    comp.dispose();
    sinon.assert.notCalled(fooConstruct);
    sinon.assert.notCalled(fooDispose);
  });

  test('validates various props', () => {
    const validators = {
      a: sinon.stub(),
      b: sinon.stub(),
      c: sinon.stub(),
    };
    docValidator(validators)({ type: 'a', b: 'foo' });

    sinon.assert.notCalled(validators.c);

    expect(validators.a.args).toEqual([[{ type: 'a', b: 'foo' }]]);
    expect(validators.b.args).toEqual([[{ type: 'a', b: 'foo' }]]);
  });