/*
 * Copyright 2016 Google, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License")
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.netflix.spinnaker.fiat.shared;

import com.netflix.spinnaker.security.AuthenticatedRequest;
import lombok.extern.slf4j.Slf4j;
import lombok.val;
import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import java.io.IOException;
import java.util.ArrayList;

@Slf4j
@Component
public class FiatAuthenticationFilter implements Filter {

  @Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    Authentication auth = AuthenticatedRequest
        .getSpinnakerUser()
        .map(username -> (Authentication) new PreAuthenticatedAuthenticationToken(username,
                                                                                  null,
                                                                                  new ArrayList<>()))
        .orElseGet(() -> new AnonymousAuthenticationToken(
            "ignored1", // These values are never used. See FiatPermissionEvaluator.
            "ignored2",
            AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")
        ));

    val ctx = SecurityContextHolder.createEmptyContext();
    ctx.setAuthentication(auth);
    SecurityContextHolder.setContext(ctx);
    log.debug("Set SecurityContext to user: {}", auth.getPrincipal().toString());
    chain.doFilter(request, response);
  }

  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
  }

  @Override
  public void destroy() {
  }
}

@@ -1905,79 +1905,19 @@
    %22
-ignored1%22, // These values are never used. See FiatPermissionEvaluator.
+anonymous%22,
 %0A   
@@ -1930,16 +1930,17 @@
    %22
-ignored2
+anonymous
 %22,%0A 

Make anonymous user principal be 'anonymous' (#109)