package be.mentoringsystems.merke.config;

import be.mentoringsystems.merke.security.JWTAuthenticationFilter;
import be.mentoringsystems.merke.service.LoginService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.factory.PasswordEncoderFactories;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.switchuser.SwitchUserFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

/**
 *
 * @author anthonyarents
 */
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private LoginService loginService;
    @Autowired
    private JWTAuthenticationFilter jwtAuthenticationFilter;

    @Override
    public void configure(final WebSecurity web) {
        web.ignoring().antMatchers("/static/**", "/classic/**", "/app/**", "/production/**", "/Merke/**");
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        // temporary
        http.csrf().disable();
        http.headers().frameOptions().sameOrigin();
        http.userDetailsService(loginService);
        http
                .addFilter(switchUserFilter())
                .addFilterAfter(jwtAuthenticationFilter, BasicAuthenticationFilter.class)
                //.formLogin()
                //.loginPage("/login").defaultSuccessUrl("/", false).failureUrl("/login?error").permitAll() //login page, redirect tologinrequired page if there was one, permitall is necessary
                //.and()
                .logout().logoutUrl("/logout").logoutSuccessUrl("/").permitAll() // logout page, permitall is necessary
                .and()
                .authorizeRequests() // request matching with ant
                .antMatchers("/**").permitAll()
                .antMatchers("/login/**").permitAll()
                .antMatchers("/logins/authenticate").permitAll()
                .antMatchers("/register").permitAll()
                .antMatchers("/categories").permitAll()
                .antMatchers("/venues").permitAll()
                .antMatchers("/privateVenues").permitAll()
                .antMatchers("/recoverPassword").anonymous()
                .antMatchers("/passwordrecovery").anonymous()
                .antMatchers("/switchuser").hasRole("MSADMIN")
                .anyRequest().authenticated(); // all remaining requests need login
    }

    @Bean(name = "switchUserFilter")
    public SwitchUserFilter switchUserFilter() {
        final SwitchUserFilter filter = new SwitchUserFilter();
        filter.setUserDetailsService(loginService);
        filter.setExitUserUrl("/exituser");
        filter.setSwitchUserUrl("/switchuser");
        filter.setTargetUrl("/");
        filter.setUsernameParameter("username");
        return filter;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Override
    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(loginService).passwordEncoder(passwordEncoder());
    }

}