/*
 * Copyright 2012-2016 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package io.springlets.security.web.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.header.writers.StaticHeadersWriter;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

/**
 * 
 * @author Enrique Ruiz at http://www.disid.com[DISID Corporation S.L.]
 */
class SpringletsWebSecurityConfigurer extends WebSecurityConfigurerAdapter {

  boolean disableConcurrency = true;

  // Don't make final to allow test cases faking them
  private static String DEFAULT_POLICY_DIRECTIVES = "script-src 'self' 'unsafe-inline' ";

  private static String CONTENT_SECURITY_POLICY_HEADER = "Content-Security-Policy";

  private static String LOGIN_FORM_URL = "/login";

  private static String X_CONTENT_SECURITY_POLICY_HEADER = "X-Content-Security-Policy";

  private static String X_WEBKIT_CSP_POLICY_HEADER = "X-WebKit-CSP";

  /**
   * {@inheritDoc}
   * 
   * Initializes the default {@link UserDetailsService} causing the {@link AuthenticationManagerBuilder} 
   * creates automatically the {@link DaoAuthenticationProvider} that delegates on the given
   * {@link UserDetailsService}.
   * 
   * Also setup the {@link BCryptPasswordEncoder} to use with the {@link DaoAuthenticationProvider}
   */
  @Override
  protected void configure(HttpSecurity http) throws Exception {

    // Session management
    
    if (disableConcurrency) {
      http.sessionManagement().maximumSessions(1).expiredUrl("/login?expired");
    }

    // CSP settings

    http
      .headers()
        .addHeaderWriter(new StaticHeadersWriter(X_CONTENT_SECURITY_POLICY_HEADER,
            DEFAULT_POLICY_DIRECTIVES))
        .addHeaderWriter(new StaticHeadersWriter(CONTENT_SECURITY_POLICY_HEADER,
            DEFAULT_POLICY_DIRECTIVES))
        .addHeaderWriter(
            new StaticHeadersWriter(X_WEBKIT_CSP_POLICY_HEADER, DEFAULT_POLICY_DIRECTIVES));

    // Authentication

    http
      .authorizeRequests()
        .antMatchers("/public/**", "/webjars/**", "/resources/**", "/static/**", "/login/**").permitAll()
        .anyRequest().authenticated()
        .and()
      .formLogin()
        .loginPage(LOGIN_FORM_URL)
        .permitAll()
        .and()
      .logout()
        .permitAll();

    // IMPORTANT: loginPage() will set the URL path to which redirect to
    // identify the user it does NOT create the method that handles the 
    // request.

    // se añade redirección personalizada en caso de excepción por acceso no autorizado
    http
      .exceptionHandling()
        .authenticationEntryPoint(new SpringletsSecurityWebAuthenticationEntryPoint())
      .accessDeniedHandler(new SpringletsSecurityWebAccessDeniedHandlerImpl());

  }

  /**
   * El método heredado {@link WebSecurityConfigurerAdapter#authenticationManagerBean()}
   * no registra el {@link AuthenticationManager} en el contexto de Spring.
   *
   * El objeto de este método es obtener el {@link AuthenticationManager} del padre y
   * registrarlo en el contexto de Spring.
   */
//  @Bean
//  @Override
//  public AuthenticationManager authenticationManagerBean() throws Exception {
//    return super.authenticationManagerBean();
//  }

}

@@ -663,195 +663,8 @@
 g;%0A%0A
-import org.springframework.context.annotation.Bean;%0Aimport org.springframework.context.annotation.Configuration;%0Aimport org.springframework.security.authentication.AuthenticationManager;%0A
 impo
@@ -1257,171 +1257,8 @@
 ter;
-%0Aimport org.springframework.web.servlet.config.annotation.ViewControllerRegistry;%0Aimport org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
 %0A%0A/*
@@ -3718,477 +3718,6 @@
   %7D%0A
-%0A  /**%0A   * El m%C3%A9todo heredado %7B@link WebSecurityConfigurerAdapter#authenticationManagerBean()%7D%0A   * no registra el %7B@link AuthenticationManager%7D en el contexto de Spring.%0A   *%0A   * El objeto de este m%C3%A9todo es obtener el %7B@link AuthenticationManager%7D del padre y%0A   * registrarlo en el contexto de Spring.%0A   */%0A//  @Bean%0A//  @Override%0A//  public AuthenticationManager authenticationManagerBean() throws Exception %7B%0A//    return super.authenticationManagerBean();%0A//  %7D%0A%0A
 %7D%0A

Remove not used code