package com.google.rolecall.config;

import java.util.Arrays;
import java.util.List;

import com.google.rolecall.authentication.PreAuthTokenHeaderFilter;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

/* Security Configuration for authenticating a request to the REST application. */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, proxyTargetClass = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  private final AuthenticationProvider authProvider;
  private final Environment env;

  @Override
  public void configure(AuthenticationManagerBuilder authenticationManagerBuilder)
      throws Exception {
      authenticationManagerBuilder.authenticationProvider(authProvider);
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.httpBasic()
        .and()
        .cors()
        .and()
        .addFilter(getFilter())
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
        .sessionFixation().migrateSession()
        .and()
        .authorizeRequests().antMatchers("/api/**").authenticated()
        .and()
        .logout()
        .deleteCookies("SESSIONID").invalidateHttpSession(true)
        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
        .logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))
        .permitAll();

    List<String> activeProfiles = Arrays.asList(env.getActiveProfiles());
    if(activeProfiles.contains("dev")) {
      http.csrf().disable();
    }
  }

  @Bean
  CorsConfigurationSource corsConfigurationSource() {
    String allowedOrigin = env.getProperty("rolecall.frontend.url");
    CorsConfiguration configuration = new CorsConfiguration();

    configuration.setAllowedOrigins(Arrays.asList(allowedOrigin));
    configuration.setAllowedMethods(Arrays.asList("GET","POST","PATCH","DELETE"));
    configuration.setAllowCredentials(true);
    configuration.setAllowedHeaders(Arrays.asList("*"));

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);

    return source;
  }

  /** Initializes the filter for Authentication header information. */
  private PreAuthTokenHeaderFilter getFilter() throws Exception {
    PreAuthTokenHeaderFilter filter = new PreAuthTokenHeaderFilter();
    filter.setAuthenticationManager(authenticationManager());
    return filter;
  }

  public WebSecurityConfig(AuthenticationProvider authProvider, Environment env) {
    this.authProvider = authProvider;
    this.env = env;
  }
}

@@ -2003,32 +2003,49 @@
 )%0A        .and()
+.csrf().disable()
 %0A        .cors()
@@ -2059,25 +2059,16 @@
   .and()
-%0A        
 .addFilt
@@ -2227,25 +2227,16 @@
   .and()
-%0A        
 .authori
@@ -2301,25 +2301,16 @@
   .and()
-%0A        
 .logout(
@@ -2560,159 +2560,8 @@
 l();
-%0A%0A    List%3CString%3E activeProfiles = Arrays.asList(env.getActiveProfiles());%0A    if(activeProfiles.contains(%22dev%22)) %7B%0A      http.csrf().disable();%0A    %7D
 %0A  %7D

disable csfr