package it.w0rd.filters;

import it.w0rd.api.auth.AdminAuthenticationCredentialsError;
import it.w0rd.api.auth.AuthenticationProvider;
import it.w0rd.api.auth.SingleAdminAuthentication;
import org.slf4j.LoggerFactory;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Base64;

@Component
@Order(Ordered.HIGHEST_PRECEDENCE - 2)
public class AdminFilter implements Filter {

    private final AuthenticationProvider authenticationProvider;
    public static final org.slf4j.Logger LOGGER = LoggerFactory.getLogger(AdminFilter.class);

    public AdminFilter() throws AdminAuthenticationCredentialsError {
        authenticationProvider = new SingleAdminAuthentication("admin", "default");
    }

    public AdminFilter(AuthenticationProvider authenticationProvider) {
        this.authenticationProvider = authenticationProvider;
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        final String requestURI = httpRequest.getRequestURI();
        if(!requestURI.matches("/admin/.*") && !requestURI.matches("/api/admin.*")){
            LOGGER.info("Request does need not be authorized: " + httpRequest.getRequestURI());
            chain.doFilter(request, response);
            return;
        }

        final String authKey = httpRequest.getHeader("Authorization");
        final String[] authInfo = new String(Base64.getDecoder().decode(authKey.substring(6))).split(":");
        if (authInfo.length < 2) {
            challenge(httpResponse);
            return;
        }

        final String userName = authInfo[0];
        final String password = authInfo[1];

        if(authKey != null && authKey.startsWith("Basic ")) {
            if(authenticationProvider.isAdministrator(userName, password)) {
                LOGGER.info("User " + userName + " has successfully logged in");
                chain.doFilter(request, response);
                return;
            }
        }

        challenge(httpResponse);
    }

    private void challenge(HttpServletResponse httpResponse) {
        LOGGER.info("No or wrong credentials");
        httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        httpResponse.setHeader("WWW-Authenticate", "Basic");
    }

    @Override
    public void destroy() {

    }
}

@@ -1860,24 +1860,90 @@
 rization%22);%0A
+        if(authKey != null && authKey.startsWith(%22Basic %22)) %7B%0A    
         fina
@@ -2045,16 +2045,20 @@
         
+    
 if (auth
@@ -2080,32 +2080,36 @@
 ) %7B%0A            
+    
 challenge(httpRe
@@ -2121,32 +2121,36 @@
 e);%0A            
+  
+  
 return;%0A        
@@ -2141,35 +2141,43 @@
 return;%0A        
-%7D%0A%0A
+    %7D%0A%0A    
         final St
@@ -2205,32 +2205,36 @@
 nfo%5B0%5D;%0A        
+    
 final String pas
@@ -2259,70 +2259,8 @@
 %5D;%0A%0A
-        if(authKey != null && authKey.startsWith(%22Basic %22)) %7B%0A
     

Fix introduced NullPointer exception