package at.ac.tuwien.inso.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import at.ac.tuwien.inso.entity.Role;
import at.ac.tuwien.inso.entity.UserAccount;
import at.ac.tuwien.inso.service.UserAccountService;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	private UserAccountService userAccountService;


	@Override
	protected void configure(HttpSecurity http) throws Exception {

		http.headers().frameOptions().disable();

		http
            .csrf().ignoringAntMatchers("/rest/**") //disable csrf for rest
            .ignoringAntMatchers("/console/**"); //disable the database

        http
            .authorizeRequests()
            .antMatchers("/rest/**").permitAll()   //do not require passwords for rest
            .antMatchers("/public/**").permitAll()
            .antMatchers("/min/**").permitAll()
            .antMatchers("/webjars/**").permitAll()
            .antMatchers("/node_modules/**").permitAll()
            .antMatchers("/console/**").permitAll()
            .antMatchers("/account_activation/**").permitAll()
            .antMatchers("/admin/**").hasRole(Role.ADMIN.name())
            .antMatchers("/lecturer/**").hasRole(Role.LECTURER.name())
            .antMatchers("/student/**").hasRole(Role.STUDENT.name())
            .anyRequest().authenticated();

        http
            .formLogin()
            .loginPage("/login")
            .failureUrl("/login?error")
            .defaultSuccessUrl("/")
            .permitAll();

        http
            .logout()
            .logoutSuccessUrl("/login?loggedOut")
            .permitAll();
    }

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .userDetailsService(userAccountService)
            .passwordEncoder(UserAccount.PASSWORD_ENCODER);
	}
}

@@ -1137,16 +1137,33 @@
  .csrf()
+%0A                
 .ignorin
@@ -1215,32 +1215,36 @@
 est%0A            
+    
 .ignoringAntMatc
@@ -1262,17 +1262,16 @@
 ole/**%22)
-;
  //disab
@@ -1285,16 +1285,88 @@
 database
+%0A                .ignoringAntMatchers(%22/logout%22); // allow double logout
 %0A%0A      

Allow invalid CSRF token for /logout