package de.digitalcollections.iiif.bookshelf.config;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.security.servlet.PathRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@Order(2)
public class SpringConfigSecurityWebapp extends WebSecurityConfigurerAdapter {

  @Value("${custom.app.security.enabled}")
  private boolean isAuthenticationEnabled;

  @Value("${custom.app.security.username}")
  private String username;

  @Value("${custom.app.security.password}")
  private String password;

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    if (isAuthenticationEnabled) {
      auth.inMemoryAuthentication().passwordEncoder(passwordEncoderDummy()).withUser(
              User.withUsername(username).password(password).roles("USER")
      );
    }
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    if (!isAuthenticationEnabled) {
      return;
    }

    http.authorizeRequests().requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();

    http.authorizeRequests().antMatchers("/add/**").authenticated().and()
            // enable form based log in
            .formLogin().loginPage("/login")
            .and().headers().frameOptions().disable(); // to make universalviewer work
    /* Refused to display 'http://localhost:8080/webjars/universalviewer/2.0.2/dist/uv-2.0.2/app.html?isHomeDomain=true&isOnlyInstance=true&manifestUri=https%3A%2F%2Fapi.digitale-sammlungen.de%2Fiiif%2Fpresentation%2Fv2%2Fbsb00010484_00505_u001%2Fmanifest&embedScriptUri=http://localhost:8080/webjars/universalviewer/2.0.2/dist/uv-2.0.2/lib/embed.js&embedDomain=localhost&domain=localhost&isLightbox=false&locale=en-GB&xdm_e=http%3A%2F%2Flocalhost%3A8080%2Fuv%2F1FC1F766&xdm_c=default127&xdm_p=4' in a frame because it set 'X-Frame-Options' to 'deny'. */

    http.authorizeRequests().antMatchers("/api/add").authenticated()
            .and().httpBasic().and().csrf().disable();
  }

  private PasswordEncoder passwordEncoderDummy() {
    return new PasswordEncoder() {
      @Override
      public String encode(CharSequence rawPassword) {
        return rawPassword.toString();
      }

      @Override
      public boolean matches(CharSequence rawPassword, String encodedPassword) {
        return rawPassword.toString().equals(encodedPassword);
      }
    };
  }
}

@@ -1271,22 +1271,16 @@
         
-      
 User.wit
@@ -1433,65 +1433,8 @@
 n %7B%0A
-    if (!isAuthenticationEnabled) %7B%0A      return;%0A    %7D%0A%0A
     
@@ -1540,17 +1540,16 @@
 tAll();%0A
-%0A
     http
@@ -1553,177 +1553,8 @@
 ttp.
-authorizeRequests().antMatchers(%22/add/**%22).authenticated().and()%0A            // enable form based log in%0A            .formLogin().loginPage(%22/login%22)%0A            .and().
 head
@@ -2172,17 +2172,54 @@
 ny'. */%0A
-%0A
+    if (!isAuthenticationEnabled) %7B%0A  
     http
@@ -2258,45 +2258,282 @@
 (%22/a
-pi/add%22).authenticated()%0A            
+dd*%22, %22/api/**%22).permitAll().and().csrf().disable();%0A      return;%0A    %7D%0A%0A    http.authorizeRequests().antMatchers(%22/add*%22).authenticated().and().formLogin().loginPage(%22/login%22); // enable form based log in%0A    http.authorizeRequests().antMatchers(%22/api/**%22).authenticated()
 .and
@@ -2570,16 +2570,45 @@
 sable();
+ // enable basic auth for api
 %0A  %7D%0A%0A  

Fix spring security configuration