package at.poquito.assetmanager.intern;

import javax.enterprise.context.RequestScoped;
import javax.enterprise.inject.Instance;
import javax.enterprise.inject.Produces;
import javax.inject.Inject;
import javax.servlet.http.HttpServletRequest;

import at.poquito.assetmanager.AssetManagerContext;
import at.poquito.assetmanager.security.AuthorizationService;
import at.poquito.assetmanager.security.AuthorizationServiceFactory;

@RequestScoped
public class AssetManagerContextFactory {

	private static final String UNAUTHENTICATED = "UNAUTHENTICATED";

	private HttpServletRequest currentRequest;

	@Inject
	private Instance<AuthorizationServiceFactory<HttpServletRequest>> authorizers;

	@Produces
	public AssetManagerContext create() {
		return new DefaultAssetManagerContext(getAuthorizationService());
	}

	private AuthorizationService getAuthorizationService() {
		if (authorizers.isUnsatisfied()) {
			return new AuthorizationService() {

				@Override
				public boolean hasPermission(String permission) {
					return false;
				}

				@Override
				public String currentUser() {
					return UNAUTHENTICATED;
				}
			};
		}
		return authorizers.get().create(currentRequest);
	}

	public void setCurrentRequest(HttpServletRequest currentRequest) {
		this.currentRequest = currentRequest;
	}

}

@@ -34,16 +34,49 @@
 ntern;%0A%0A
+import java.security.Principal;%0A%0A
 import j
@@ -1056,13 +1056,47 @@
 urn 
-false
+currentRequest.isUserInRole(permission)
 ;%0A%09%09
@@ -1157,30 +1157,159 @@
 %09%09%09%09
-return UNAUTHENTICATED
+Principal principal = currentRequest.getUserPrincipal();%0A%09%09%09%09%09if(principal==null)%7B%0A%09%09%09%09%09%09return UNAUTHENTICATED;%0A%09%09%09%09%09%7D%0A%09%09%09%09%09return principal.getName()
 ;%0A%09%09

use javaee security by default