package org.opencds.cqf.ruler.security.interceptor;

import ca.uhn.fhir.interceptor.api.Hook;
import ca.uhn.fhir.interceptor.api.Interceptor;
import ca.uhn.fhir.interceptor.api.Pointcut;
import ca.uhn.fhir.rest.api.server.RequestDetails;
import ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
import org.apache.commons.lang3.StringUtils;
import org.opencds.cqf.ruler.security.SecurityProperties;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Base64;

import static java.nio.charset.StandardCharsets.UTF_8;


@Interceptor
public class AuthenticationInterceptor implements org.opencds.cqf.ruler.api.Interceptor {
	private final Logger myLog = LoggerFactory.getLogger(AuthenticationInterceptor.class);

	@Autowired
	private SecurityProperties securityProperties;

	@Hook(Pointcut.SERVER_INCOMING_REQUEST_POST_PROCESSED)
	public boolean incomingRequestPostProcessed(RequestDetails theRequestDetails, HttpServletRequest theRequest,
															  HttpServletResponse theResponse) throws AuthenticationException {
		if(securityProperties.getBasicAuth().getEnabled()) {
			String authHeader = theRequest.getHeader("Authorization");

			myLog.info("incoming request intercepted");
			// The format of the header must be:
			// Authorization: Basic [base64 of username:password]
			if (authHeader == null || !authHeader.startsWith("Basic ")) {
				throw new AuthenticationException(642 + "Missing or invalid Authorization header");
			}

			String base64 = authHeader.substring("Basic ".length());
			String base64decoded = new String(Base64.getDecoder().decode(base64), UTF_8);
			String[] parts = base64decoded.split(":");

			if(parts.length <= 1) {
				throw new AuthenticationException(642 + "Missing or invalid Authorization header");
			}

			String username = parts[0];
			String password = parts[1];

			/*
			 * Here we test for a hardcoded username & password. This is
			 * not typically how you would implement this in a production
			 * system of course..
			 */

			if (!StringUtils.equals(username.trim(), securityProperties.getBasicAuth().getUsername().trim()) ||
				!StringUtils.equals(password.trim(), securityProperties.getBasicAuth().getPassword().trim())) {
				throw new AuthenticationException(643 + "Invalid username or password");
			}

			myLog.info("Authorization successful");
		}

		// Return true to allow the request to proceed
		return true;
	}

}

@@ -57,252 +57,176 @@
 ort 
-ca.uhn.fhir.interceptor.api.Hook;%0Aimport ca.uhn.fhir.interceptor.api.Interceptor;%0Aimport ca.uhn.fhir.interceptor.api.Pointcut;%0Aimport ca.uhn.fhir.rest.api.server.RequestDetails;%0Aimport ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
+static java.nio.charset.StandardCharsets.UTF_8;%0A%0Aimport java.util.Base64;%0A%0Aimport javax.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse;%0A
 %0Aimp
@@ -457,175 +457,252 @@
 ort 
-javax.servlet.http.HttpServletRequest;%0Aimport javax.servlet.http.HttpServletResponse;%0Aimport java.util.Base64
+ca.uhn.fhir.interceptor.api.Hook;%0Aimport ca.uhn.fhir.interceptor.api.Interceptor;%0Aimport ca.uhn.fhir.interceptor.api.Pointcut;%0Aimport ca.uhn.fhir.rest.api.server.RequestDetails
 ;%0A
-%0A
 import 
-static java.nio.charset.StandardCharsets.UTF_8;%0A
+ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
 %0A%0A@I
@@ -1125,22 +1125,8 @@
 %0A%09%09%09
-%09%09%09%09%09%09%09%09%09%09%09%09  
 Http
@@ -1191,16 +1191,17 @@
 n %7B%0A%09%09if
+ 
 (securit
@@ -1545,38 +1545,32 @@
 cationException(
-642 + 
 %22Missing or inva
@@ -1796,16 +1796,17 @@
 ;%0A%0A%09%09%09if
+ 
 (parts.l
@@ -1861,14 +1861,8 @@
 ion(
-642 + 
 %22Mis
@@ -2245,16 +2245,17 @@
  %7C%7C%0A%09%09%09%09
+%09
 !StringU
@@ -2384,14 +2384,8 @@
 ion(
-643 + 
 %22Inv

Remove magic numbers copied from example