package org.gbif.registry.ws.config;

import org.gbif.registry.identity.util.RegistryPasswordEncoder;
import org.gbif.registry.ws.security.jwt.JwtRequestFilter;
import org.gbif.ws.server.filter.AppIdentityFilter;
import org.gbif.ws.server.filter.HttpServletRequestWrapperFilter;
import org.gbif.ws.server.filter.IdentityFilter;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {

  private final ApplicationContext context;

  private UserDetailsService userDetailsService;

  public WebSecurityConfigurer(@Qualifier("registryUserDetailsService") UserDetailsService userDetailsService, ApplicationContext context) {
    this.userDetailsService = userDetailsService;
    this.context = context;
  }

  @Override
  protected void configure(AuthenticationManagerBuilder auth) {
    auth.authenticationProvider(dbAuthenticationProvider());
  }

  private DaoAuthenticationProvider dbAuthenticationProvider() {
    final DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
    authProvider.setUserDetailsService(userDetailsService);
    authProvider.setPasswordEncoder(passwordEncoder());
    return authProvider;
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
        .httpBasic().and()
        // IdentityFilter must be after SecurityContextPersistenceFilter otherwise it would load the context from the previous call
//        .addFilterAfter(context.getBean(IdentityFilter.class), SecurityContextPersistenceFilter.class)
        .addFilterAfter(context.getBean(HttpServletRequestWrapperFilter.class), BasicAuthenticationFilter.class)
        .addFilterAfter(context.getBean(IdentityFilter.class), HttpServletRequestWrapperFilter.class)
        .addFilterAfter(context.getBean(AppIdentityFilter.class), IdentityFilter.class)
        .addFilterAfter(context.getBean(JwtRequestFilter.class), AppIdentityFilter.class)
        .csrf().disable()
        .authorizeRequests()
        .anyRequest().authenticated();

    http
        .sessionManagement()
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  }

  @Bean
  public PasswordEncoder passwordEncoder() {
    return new RegistryPasswordEncoder();
  }

}

@@ -87,32 +87,96 @@
 asswordEncoder;%0A
+import org.gbif.registry.ws.security.EditorAuthorizationFilter;%0A
 import org.gbif.
@@ -2241,24 +2241,76 @@
 vider;%0A  %7D%0A%0A
+  // TODO: 06/09/2019 add LegacyAuthorizationFilter%0A
   @Override%0A
@@ -2301,32 +2301,32 @@
 ter%0A  @Override%0A
-
   protected void
@@ -2546,113 +2546,8 @@
 all%0A
-//        .addFilterAfter(context.getBean(IdentityFilter.class), SecurityContextPersistenceFilter.class)%0A
     
@@ -2647,32 +2647,32 @@
 onFilter.class)%0A
-
         .addFilt
@@ -2749,32 +2749,128 @@
 erFilter.class)%0A
+        .addFilterAfter(context.getBean(EditorAuthorizationFilter.class), IdentityFilter.class)%0A
         .addFilt

Add EditorAuthorizationFilter to config