package com.ilya.sergeev.potlach;

import java.security.Principal;

import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.Authentication;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import retrofit.http.Part;

import com.ilya.sergeev.potlach.client.UserInfoSvcApi;
import com.ilya.sergeev.potlach.model.SimpleMessage;
import com.ilya.sergeev.potlach.repository.UserInfo;
import com.ilya.sergeev.potlach.repository.UserInfoRepository;

@Controller
public class UserController
{
	@Autowired
	UserInfoRepository mUserRepository;
	
	// GET /user_info/name
	@RequestMapping(value = UserInfoSvcApi.HELLO_PATH, method = RequestMethod.GET)
	public @ResponseBody
	SimpleMessage getHello(Principal principal)
	{
		SimpleMessage result = new SimpleMessage();
		result.setUserName(principal.getName());
		result.setMessage("Hello world");
		return result;
	}
	
	@RequestMapping(value = UserInfoSvcApi.DELETE_USER_PATH, method = RequestMethod.GET)
	public @ResponseBody
	UserInfo deleteUser(@RequestParam(UserInfoSvcApi.USER_NAME_PARAM) String userName)
	{
		return mUserRepository.findByName(userName);
	}
	
	@PreAuthorize("hasRole('ADMIN')")
	@RequestMapping(value = UserInfoSvcApi.REGISTER_USER_PATH, method = RequestMethod.POST)
	public @ResponseBody
	UserInfo createUser(@RequestParam(UserInfoSvcApi.USER_NAME_PARAM) String userName, @RequestParam(UserInfoSvcApi.PASSWORD_PARAM) String password)
	{
		UserInfo newUser = new UserInfo();
		newUser.setName(userName);
		newUser.setPassword(password);
		return mUserRepository.save(newUser);
	}
	
	@PreAuthorize("hasRole('ADMIN')")
	@RequestMapping(value = UserInfoSvcApi.DELETE_USER_PATH, method = RequestMethod.POST)
	public void deleteUser(@RequestParam(UserInfoSvcApi.USER_NAME_PARAM) String userName, HttpServletResponse response)
	{
		UserInfo userInfo = mUserRepository.findByName(userName);
		if (userInfo != null && userInfo.getId() > 0)
		{
			mUserRepository.delete(userInfo);
			response.setStatus(HttpServletResponse.SC_OK);
		}
		else
		{
			response.setStatus(HttpServletResponse.SC_NOT_FOUND);
		}
	}
	
	@PreAuthorize("hasRole('ADMIN')")
	@RequestMapping(value = UserInfoSvcApi.CHANGE_PASSWORD_PATH, method = RequestMethod.POST)
	public void changePassword(@RequestParam(UserInfoSvcApi.USER_NAME_PARAM) String userName, @RequestParam(UserInfoSvcApi.PASSWORD_PARAM) String newPassword, HttpServletResponse response)
	{
		UserInfo userInfo = mUserRepository.findByName(userName);
		if (userInfo != null && userInfo.getId() > 0)
		{
			userInfo.setPassword(newPassword);
			UserInfo savedUserInfo = mUserRepository.save(userInfo);
			if (savedUserInfo != null && savedUserInfo.getId() > 0)
			{
				response.setStatus(HttpServletResponse.SC_OK);
			}
			else
			{
				response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
			}
		}
		else
		{
			response.setStatus(HttpServletResponse.SC_NOT_FOUND);
		}
	}
}

@@ -241,65 +241,8 @@
 ze;%0A
-import org.springframework.security.core.Authentication;%0A
 impo
@@ -287,16 +287,16 @@
 roller;%0A
+
 import o
@@ -539,36 +539,8 @@
 y;%0A%0A
-import retrofit.http.Part;%0A%0A
 impo
@@ -1445,32 +1445,49 @@
 hasRole('ADMIN')
+ or isAnonymous()
 %22)%0A%09@RequestMapp
@@ -1901,32 +1901,62 @@
 hasRole('ADMIN')
+ or #userName = principal.name
 %22)%0A%09@RequestMapp
@@ -2021,32 +2021,32 @@
 estMethod.POST)%0A
-
 %09public void del
@@ -2136,32 +2136,48 @@
 esponse response
+, Principal user
 )%0A%09%7B%0A%09%09UserInfo 

fix some access roles