package au.gov.dto.dibp.appointments.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

/**
 * Authentication configuration for read-only admin pages that expose application metrics for monitoring purposes.
 */
@Configuration
@Order(1) // must have lower value (higher priority) than ClientSecurityConfigurerAdapter
@EnableWebSecurity
public class AdminSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    private static final String ROLE_ADMIN = "ADMIN";

    @Autowired
    @Value("${security.admin.password}")
    private String adminPassword;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .requestCache()
                .disable()
            .antMatcher("/monitoring/**").authorizeRequests().anyRequest().hasAnyRole(ROLE_ADMIN)
                .and()
            .httpBasic();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
            .withUser("admin").password(adminPassword).roles(ROLE_ADMIN);
    }
}

@@ -724,16 +724,98 @@
 nPolicy;
+%0Aimport org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
 %0A%0A/**%0A *
@@ -927,16 +927,115 @@
 rposes.%0A
+ *%0A * When accessing these URLs in an environment with a load balancer present, HTTPS is required.%0A
  */%0A@Con
@@ -1749,16 +1749,33 @@
 ing/**%22)
+%0A                
 .authori
@@ -1790,21 +1790,121 @@
 ts()
-.anyRequest()
+%0A                .requestMatchers(new RequestHeaderRequestMatcher(%22x-forwarded-proto%22, %22https%22))%0A                
 .has

Enforce HTTPS for monitoring authentication