package se.kth.csc.controller;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import se.kth.csc.model.Account;
import se.kth.csc.persist.AccountStore;

import java.security.Principal;

/**
 * Controls the home page.
 */
@Controller
public class HomeController {
    private static final Logger log = LoggerFactory.getLogger(HomeController.class);
    private final AccountStore accountStore;

    protected HomeController() {
        // Needed for injection
        accountStore = null;
    }

    @Autowired
    public HomeController(AccountStore accountStore) {
        this.accountStore = accountStore;
    }

    /**
     * The welcome page of the web application
     */
    @RequestMapping(value = "/", method = RequestMethod.GET)
    public String welcome(){
        return "welcome";
    }

    /**
     * The about page of the web application.
     */
    @RequestMapping(value = "/about", method = RequestMethod.GET)
    public String index() {
        return "home";
    }

    /**
     * The help page of the web application
     */
    @RequestMapping(value = "/help", method = RequestMethod.GET)
    public String help(){
        return "help";
    }

    /**
     * The debug page of the web application
     */
    @RequestMapping(value = "/debug", method = RequestMethod.GET)
    public String debug(){
        return "debug";
    }

    @Transactional
    @RequestMapping(value = "/make-me-admin", method = RequestMethod.POST)
    public String makeMeAdmin(Principal principal) {
        // Make user into an admin
        if (principal != null) {
            Account account = accountStore.fetchAccountWithPrincipalName(principal.getName());
            account.setAdmin(true);

            // Log out user to reload auth roles
            SecurityContextHolder.clearContext();

            log.info("User {} is now an admin and was logged out", account.getName());
        }
        return "redirect:/debug";
    }

    @Transactional
    @RequestMapping(value = "/make-me-not-admin", method = RequestMethod.POST)
    public String makeMeNotAdmin(Principal principal) {
        // Make user into a non-admin
        if (principal != null) {
            Account account = accountStore.fetchAccountWithPrincipalName(principal.getName());
            account.setAdmin(false);

            // Log out user to reload auth roles
            SecurityContextHolder.clearContext();

            log.info("User {} is now not an admin and was logged out", account.getName());
        }
        return "redirect:/debug";
    }

    // Used to enforce authentication when logging in from welcome page
    @RequestMapping(value = "/login", method = {RequestMethod.GET})
    public String loginRedirect() {
        return "redirect:/queue";
    }
}

@@ -1866,32 +1866,58 @@
 cipal principal)
+ throws ForbiddenException
  %7B%0A        // Ma
@@ -2286,34 +2286,29 @@
 getName());%0A
-   
+%0A
     
- %7D%0A
         retu
@@ -2321,32 +2321,103 @@
 direct:/debug%22;%0A
+        %7D else %7B%0A            throw new ForbiddenException();%0A        %7D%0A
     %7D%0A%0A    @Tran
@@ -2558,16 +2558,42 @@
 incipal)
+ throws ForbiddenException
  %7B%0A     
@@ -2982,26 +2982,21 @@
 ame());%0A
-   
+%0A
     
- %7D%0A
         
@@ -3013,32 +3013,103 @@
 direct:/debug%22;%0A
+        %7D else %7B%0A            throw new ForbiddenException();%0A        %7D%0A
     %7D%0A%0A    // Us

Throw ForbiddenException