package org.dionysus;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	@Qualifier("dionysus")
	private UserDetailsService securityUserService;

	@Override
	protected void configure(HttpSecurity http) throws Exception {
	    http.csrf().disable()
	    	.authorizeRequests()
	    	.antMatchers(HttpMethod.POST, "/api/v1/*").hasAnyRole("USER", "ADMIN")
	    	.antMatchers(HttpMethod.PUT, "/api/v1/*").hasAnyRole("USER", "ADMIN")
	    	.antMatchers(HttpMethod.DELETE, "/api/v1/*").hasAnyRole("USER", "ADMIN")
	    	.anyRequest()
	    	.authenticated();	
	}

	@Override
	protected void configure(AuthenticationManagerBuilder registry) throws Exception {
		registry.userDetailsService(securityUserService);
	}

	@Override
	public void configure(WebSecurity web) throws Exception {
		web.ignoring().antMatchers("/", "/wro/*", "/assets/**");
	}

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		auth.inMemoryAuthentication()
		    .withUser("admin")
		    .password("admin")
		    .roles("ADMIN", "USER")
		.and()
			.withUser("user")
			.password("password")
			.roles("USER");
	}
}
@@ -1140,25 +1140,8 @@
 ers(
-HttpMethod.POST, 
 %22/ap
@@ -1190,171 +1190,101 @@
 %09.an
-tMatchers(HttpMethod.PUT, %22/api/v1/*%22).hasAnyRole(%22USER%22, %22ADMIN%22)%0A%09    %09.antMatchers(HttpMethod.DELETE, %22/api/v1/*%22).hasAnyRole(%22USER%22, %22ADMIN%22
+yRequest()%0A%09    %09.authenticated()%0A%09    .and()%0A%09    %09.formLogin()%0A%09    %09.permitAll(
 )%0A%09    
-%09
 .an
-yRequest
+d
 ()%0A%09
@@ -1293,30 +1293,49 @@
   %09.
-authenticated
+logout()%0A            .permitAll
 ();
-%09
 %0A%09%7D%0A%0A
+//
 %09@Ov
@@ -1333,32 +1333,34 @@
 %7D%0A%0A//%09@Override%0A
+//
 %09protected void 
@@ -1427,16 +1427,18 @@
 ption %7B%0A
+//
 %09%09regist
@@ -1481,16 +1481,18 @@
 rvice);%0A
+//
 %09%7D%0A%0A%09@Ov

add login form