package au.gov.dto.dibp.appointments.config;

import au.gov.dto.dibp.appointments.initializer.HttpsOnlyFilter;
import au.gov.dto.dibp.appointments.initializer.LogClientIdFilter;
import au.gov.dto.dibp.appointments.initializer.NoHttpSessionFilter;
import com.oakfusion.security.SecurityCookieService;
import org.springframework.boot.context.embedded.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;

@Configuration
@ComponentScan(basePackages = "au.gov.dto.dibp.appointments")
public class AppConfig {
    @Bean
    public FilterRegistrationBean httpsFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new HttpsOnlyFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public FilterRegistrationBean noHttpSessionFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new NoHttpSessionFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public FilterRegistrationBean logClientIdFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new LogClientIdFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public SecurityCookieService securityCookieService() {
        return new SecurityCookieService("session", "secretkey");
    }
}

@@ -293,16 +293,75 @@
 ervice;%0A
+import org.springframework.beans.factory.annotation.Value;%0A
 import o
@@ -702,16 +702,17 @@
 onfig %7B%0A
+%0A
     @Bea
@@ -1598,16 +1598,79 @@
 Service(
+@Value(%22$%7Bsession.encryption.key%7D%22) String sessionEncryptionKey
 ) %7B%0A    
@@ -1721,19 +1721,28 @@
 n%22, 
-%22
 se
-cretk
+ssionEncryptionK
 ey
-%22
 );%0A 

Use session cookie encryption key from environment variable