package gov.samhsa.c2s.c2suiapi.config;

import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;

import static gov.samhsa.c2s.common.oauth2.OAuth2ScopeUtils.hasScopes;

@Configuration
public class SecurityConfig {

    private static final String RESOURCE_ID = "c2sUiApi";

    @Bean
    public ResourceServerConfigurer resourceServer(SecurityProperties securityProperties) {
        return new ResourceServerConfigurerAdapter() {
            @Override
            public void configure(ResourceServerSecurityConfigurer resources) {
                resources.resourceId(RESOURCE_ID);
            }

            @Override
            public void configure(HttpSecurity http) throws Exception {
                if (securityProperties.isRequireSsl()) {
                    http.requiresChannel().anyRequest().requiresSecure();
                }
                http.authorizeRequests()
                        .antMatchers(HttpMethod.GET, "/pcm/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.POST, "/pcm/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.DELETE, "/pcm/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.PUT, "/pcm/**").access(hasScopes("c2sUiApi.write"))

                        .antMatchers(HttpMethod.GET, "/ums/users/profile/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.PUT, "/ums/users/locale/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.POST, "/ums/users/verification/**").permitAll()
                        .antMatchers(HttpMethod.GET, "/ums/users/activation/**").permitAll()
                        .antMatchers(HttpMethod.POST, "/ums/users/activation/**").permitAll()

                        .antMatchers(HttpMethod.GET, "/phr/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.POST, "/phr/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.DELETE, "/phr/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.PUT, "/phr/**").access(hasScopes("c2sUiApi.write"))

                        .antMatchers(HttpMethod.GET, "/vss/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.GET, "/pls/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.GET, "/tryPolicy/**").access(hasScopes("c2sUiApi.read"))

                        .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                        .anyRequest().denyAll();
            }
        };
    }
}
@@ -2427,27 +2427,27 @@
 thod.GET, %22/
-phr
+vss
 /**%22).access
@@ -2527,19 +2527,18 @@
 hod.
-POS
+GE
 T, %22/p
-hr
+ls
 /**%22
@@ -2558,37 +2558,36 @@
 copes(%22c2sUiApi.
-write
+read
 %22))%0A            
@@ -2626,21 +2626,24 @@
 hod.
-DEL
+G
 ET
-E
 , %22/
-phr
+tryPolicy
 /**%22
@@ -2667,33 +2667,33 @@
 s(%22c2sUiApi.
-write
+read
 %22))%0A
+%0A
             
@@ -2724,26 +2724,26 @@
 (HttpMethod.
-PU
+GE
 T, %22/phr/**%22
@@ -2739,16 +2739,34 @@
 , %22/phr/
+uploadedDocuments/
 **%22).acc
@@ -2785,34 +2785,32 @@
 s(%22c2sUiApi.
-write
+read
 %22))%0A
-%0A
             
@@ -2841,33 +2841,52 @@
 (HttpMethod.
-GE
+POS
 T, %22/
-vs
+phr/uploadedDocument
 s/**%22).acces
@@ -2899,36 +2899,37 @@
 copes(%22c2sUiApi.
-read
+write
 %22))%0A            
@@ -2960,33 +2960,54 @@
 (HttpMethod.
-G
+DEL
 ET
+E
 , %22/p
-l
+hr/uploadedDocument
 s/**%22).acces
@@ -3020,36 +3020,37 @@
 copes(%22c2sUiApi.
-read
+write
 %22))%0A            
@@ -3085,32 +3085,44 @@
 pMethod.
-GE
+PU
 T, %22/
-tryPolicy
+phr/uploadedDocuments
 /**%22).ac
@@ -3138,36 +3138,37 @@
 copes(%22c2sUiApi.
-read
+write
 %22))%0A%0A           

Modify SecurityConfig to restrict phr access to only the '/phr/uploadedDocuments/' paths