package at.ac.tuwien.inso.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import at.ac.tuwien.inso.entity.Role;
import at.ac.tuwien.inso.entity.UserAccount;
import at.ac.tuwien.inso.service.UserAccountService;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	private UserAccountService userAccountService;

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.headers().frameOptions().disable();
		http
				.csrf().ignoringAntMatchers("/rest/**") //disable csrf for rest
				.ignoringAntMatchers("/console/**") //disable the database
				.and()
				.authorizeRequests()
				.antMatchers("/rest/**").permitAll()   //do not require passwords for rest
				.antMatchers("/public/**").permitAll()
				.antMatchers("/min/**").permitAll()
				.antMatchers("/webjars/**").permitAll()
				.antMatchers("/node_modules/**").permitAll()
				.antMatchers("/console/**").permitAll()
				.antMatchers("/account_activation/**").permitAll()
				.antMatchers("/admin/**").hasRole(Role.ADMIN.name())
				.antMatchers("/lecturer/**").hasRole(Role.LECTURER.name())
				.antMatchers("/student/**").hasRole(Role.STUDENT.name())
				.anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .failureUrl("/login?error")
                .defaultSuccessUrl("/")
                .permitAll()
                .and()
                .logout()
                .logoutSuccessUrl("/login?loggedOut")
                .permitAll();
    }

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .userDetailsService(userAccountService)
            .passwordEncoder(UserAccount.PASSWORD_ENCODER);
	}
}

@@ -990,16 +990,17 @@
 rvice;%0A%0A
+%0A
 %09@Overri
@@ -1066,16 +1066,17 @@
 ption %7B%0A
+%0A
 %09%09http.h
@@ -1114,19 +1114,28 @@
 ();%0A
+%0A
 %09%09http%0A
-%09%09%09%09
+            
 .csr
@@ -1194,20 +1194,28 @@
 or rest%0A
-%09%09%09%09
+            
 .ignorin
@@ -1237,24 +1237,25 @@
 console/**%22)
+;
  //disable t
@@ -1270,23 +1270,34 @@
 ase%0A
-%09%09%09%09.and()%0A%09%09%09%09
+%0A        http%0A            
 .aut
@@ -1313,20 +1313,28 @@
 uests()%0A
-%09%09%09%09
+            
 .antMatc
@@ -1400,20 +1400,28 @@
 or rest%0A
-%09%09%09%09
+            
 .antMatc
@@ -1443,36 +1443,44 @@
 *%22).permitAll()%0A
-%09%09%09%09
+            
 .antMatchers(%22/m
@@ -1491,36 +1491,44 @@
 *%22).permitAll()%0A
-%09%09%09%09
+            
 .antMatchers(%22/w
@@ -1543,36 +1543,44 @@
 *%22).permitAll()%0A
-%09%09%09%09
+            
 .antMatchers(%22/n
@@ -1600,36 +1600,44 @@
 *%22).permitAll()%0A
-%09%09%09%09
+            
 .antMatchers(%22/c
@@ -1652,36 +1652,44 @@
 *%22).permitAll()%0A
-%09%09%09%09
+            
 .antMatchers(%22/a
@@ -1723,20 +1723,28 @@
 itAll()%0A
-%09%09%09%09
+            
 .antMatc
@@ -1780,36 +1780,44 @@
 e.ADMIN.name())%0A
-%09%09%09%09
+            
 .antMatchers(%22/l
@@ -1859,20 +1859,28 @@
 name())%0A
-%09%09%09%09
+            
 .antMatc
@@ -1932,12 +1932,20 @@
 ())%0A
-%09%09%09%09
+            
 .any
@@ -1973,34 +1973,24 @@
 ed()
-%0A                .and()%0A  
+;%0A%0A        http%0A
     
@@ -1997,18 +1997,16 @@
         
-  
 .formLog
@@ -2010,20 +2010,16 @@
 Login()%0A
-    
         
@@ -2043,20 +2043,16 @@
 login%22)%0A
-    
         
@@ -2095,20 +2095,16 @@
         
-    
 .default
@@ -2123,36 +2123,32 @@
 /%22)%0A            
-    
 .permitAll()%0A   
@@ -2147,36 +2147,24 @@
 ll()
-%0A                .and()%0A    
+;%0A%0A        http%0A
     
@@ -2181,20 +2181,16 @@
 ogout()%0A
-    
         
@@ -2231,20 +2231,16 @@
 edOut%22)%0A
-    
         

Reformat code