package com.quizdeck.filters;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.MalformedJwtException;
import io.jsonwebtoken.SignatureException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * This filter checks for a JWT token in the Authorization header of http requests.
 * If it exists, it parses the claims and exposes them as an attribute on the request.
 * If it does not exist / is invalid, it denies the request and returns an error message.
 *
 * Created by Brandon on 2/10/2016.
 */
public class AuthenticationFilter implements Filter {
    public static final String CLAIMS_ATTRIBUTE = "claims";

    public AuthenticationFilter(String secretKey) {
        this.secretKey = secretKey;
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        String header = request.getHeader(HttpHeaders.AUTHORIZATION);

        if(header == null || !header.startsWith("Bearer ")) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            response.getWriter().write("You are not authenticated, please log in and try again.");

            log.warn("Unauthorized request to: " + request.getRequestURL() + " Cause: no auth token");
            return;
        }

        try {
            String token = header.substring(7); // The part after "Bearer "

            Claims claims = Jwts
                    .parser()
                    .setSigningKey(this.secretKey)
                    .parseClaimsJws(token)
                    .getBody();

            request.setAttribute(CLAIMS_ATTRIBUTE, claims);
        }
        catch(MalformedJwtException | SignatureException e) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            response.getWriter().write("Your login token is invalid, please log in and try again.");

            log.warn("Unauthorized request to: " + request.getRequestURL() + " Cause: invalid token");
            return;
        }

        chain.doFilter(req, res);
    }

    @Override
    public void init(FilterConfig filterConfig) {
    }

    @Override
    public void destroy() {
    }

    private final String secretKey;
    private static final Logger log = LoggerFactory.getLogger(AuthenticationFilter.class);
}

@@ -169,24 +169,58 @@
 eException;%0A
+import lombok.extern.slf4j.Slf4j;%0A
 import org.s
@@ -232,16 +232,16 @@
 Logger;%0A
-
 import o
@@ -309,16 +309,60 @@
 eaders;%0A
+import org.springframework.http.HttpMethod;%0A
 import o
@@ -852,16 +852,23 @@
 16.%0A */%0A
+@Slf4j%0A
 public c
@@ -1270,16 +1270,16 @@
 t) req;%0A
-
         
@@ -1337,16 +1337,199 @@
 ) res;%0A%0A
+        // Allow CORS options to pass through%0A        if(request.getMethod().equals(HttpMethod.OPTIONS.name())) %7B%0A            chain.doFilter(req, res);%0A            return;%0A        %7D%0A%0A
         
@@ -2867,97 +2867,6 @@
 ey;%0A
-    private static final Logger log = LoggerFactory.getLogger(AuthenticationFilter.class);%0A
 %7D%0A

Fix Cors Preflight bug