package au.gov.dto.dibp.appointments.config;

import au.gov.dto.dibp.appointments.initializer.HttpsOnlyFilter;
import au.gov.dto.dibp.appointments.initializer.LogClientIdFilter;
import au.gov.dto.dibp.appointments.initializer.NoHttpSessionFilter;
import com.oakfusion.security.SecurityCookieService;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.context.embedded.FilterRegistrationBean;
import org.springframework.boot.context.embedded.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;

import javax.servlet.http.HttpSessionListener;

@Configuration
@ComponentScan(basePackages = "au.gov.dto.dibp.appointments")
public class AppConfig {
    private static final String SESSION_COOKIE_NAME = "session";

    @Bean
    public FilterRegistrationBean httpsFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new HttpsOnlyFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public FilterRegistrationBean noHttpSessionFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new NoHttpSessionFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public FilterRegistrationBean logClientIdFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new LogClientIdFilter());
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public ServletListenerRegistrationBean<HttpSessionListener> sessionCreatedListener() {
        ServletListenerRegistrationBean<HttpSessionListener> listenerRegistrationBean = new ServletListenerRegistrationBean<>();
        listenerRegistrationBean.setListener(new HttpSessionCreatedListener());
        return listenerRegistrationBean;
    }

    @Bean
    public SecurityCookieService securityCookieService(@Value("${session.encryption.key}") String sessionEncryptionKey) {
        return new SecurityCookieService(SESSION_COOKIE_NAME, sessionEncryptionKey);
    }
}

@@ -251,52 +251,213 @@
 ort 
-com.oakfusion.security.SecurityCookieService
+au.gov.dto.dibp.appointments.initializer.DoSFilter;%0Aimport com.oakfusion.security.SecurityCookieService;%0Aimport org.apache.commons.lang3.StringUtils;%0Aimport org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory
 ;%0Aim
@@ -841,16 +841,66 @@
 uration;
+%0Aimport org.springframework.core.annotation.Order;
 %0A%0Aimport
@@ -1072,58 +1072,898 @@
 nal 
-String SESSION_COOKIE_NAME = %22session%22;%0A%0A    @Bean
+Logger LOG = LoggerFactory.getLogger(AppConfig.class);%0A    private static final String SESSION_COOKIE_NAME = %22session%22;%0A%0A    @Bean%0A    @Order(1)%0A    public FilterRegistrationBean dosFilter() %7B%0A        FilterRegistrationBean registration = new FilterRegistrationBean();%0A        DoSFilter dosFilter = new DoSFilter();%0A        String ipAddressOrCidrRange;%0A        for (int i = 1; StringUtils.isNotBlank(ipAddressOrCidrRange = System.getenv(%22IP_WHITELIST_%22 + i)); i++) %7B%0A            dosFilter.addWhitelistAddress(ipAddressOrCidrRange);%0A            LOG.info(%22Adding IP address or range=%5B%7B%7D%5D to DoSFilter whitelist%22, ipAddressOrCidrRange);%0A        %7D%0A        registration.setFilter(dosFilter);%0A        registration.addInitParameter(%22managedAttr%22, %22true%22);  // allow filter to be managed via JMX%0A        registration.addUrlPatterns(%22/*%22);%0A        return registration;%0A    %7D%0A%0A    @Bean%0A    @Order(2)
 %0A   

Use DoSFilter