package urteam.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;


@Configuration
@Order(1)
public class RestSecurityConfiguration extends WebSecurityConfigurerAdapter {

	@Autowired
	public UserRepositoryAuthenticationProvider userRepoAuthProvider;

	@Override
	protected void configure(HttpSecurity http) throws Exception {

		http.antMatcher("/api/**");
		
		// URLs that need authentication to access to it
		
		http.authorizeRequests().antMatchers(HttpMethod.GET, "/api/users/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.POST, "/api/users/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.PUT, "/api/users/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.DELETE, "/api/users/**").hasRole("ADMIN");		
		
		http.authorizeRequests().antMatchers(HttpMethod.GET, "/api/users/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.POST, "/api/users/**").hasRole("ADMIN");
		http.authorizeRequests().antMatchers(HttpMethod.PUT, "/api/users/**").hasRole("ADMIN");
		http.authorizeRequests().antMatchers(HttpMethod.DELETE, "/api/users/**").hasRole("ADMIN");		
			
		
		http.authorizeRequests().antMatchers(HttpMethod.GET, "/api/groups/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.POST, "/api/groups/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.PUT, "/api/groups/**").hasRole("USER");
		http.authorizeRequests().antMatchers(HttpMethod.DELETE, "/api/groups/**").hasRole("ADMIN");		
		
		// Other URLs can be accessed without authentication
		http.authorizeRequests().anyRequest().permitAll();

		// Disable CSRF protection (it is difficult to implement with ng2)
		http.csrf().disable();

		// Use Http Basic Authentication
		http.httpBasic();

		// Do not redirect when logout
		http.logout().logoutSuccessHandler((rq, rs, a) -> {	});
	}

	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {

		// Database authentication provider
		auth.authenticationProvider(userRepoAuthProvider);
	}
}
@@ -919,34 +919,35 @@
 hers(HttpMethod.
-GE
+POS
 T, %22/api/users/*
@@ -931,36 +931,37 @@
 hod.POST, %22/api/
-user
+event
 s/**%22).hasRole(%22
@@ -1011,34 +1011,33 @@
 ers(HttpMethod.P
-OS
+U
 T, %22/api/users/*
@@ -1021,36 +1021,37 @@
 thod.PUT, %22/api/
-user
+event
 s/**%22).hasRole(%22
@@ -1100,34 +1100,131 @@
 hers(HttpMethod.
-PU
+DELETE, %22/api/events/**%22).hasRole(%22ADMIN%22);%0A%09%09%0A%09%09http.authorizeRequests().antMatchers(HttpMethod.GE
 T, %22/api/users/*
@@ -1286,38 +1286,35 @@
 hers(HttpMethod.
-DELETE
+PUT
 , %22/api/users/**
@@ -1321,34 +1321,32 @@
 %22).hasRole(%22
-ADMIN
+USER
 %22);%09
-%09
 %0A%09%09%0A%09%09http.a
@@ -1390,36 +1390,126 @@
 thod.GET, %22/api/
-user
+stats/**%22).hasRole(%22USER%22);%0A%09%09http.authorizeRequests().antMatchers(HttpMethod.POST, %22/api/stat
 s/**%22).hasRole(%22
@@ -1508,32 +1508,35 @@
 asRole(%22USER%22);%0A
+%09%09%0A
 %09%09http.authorize
@@ -1573,36 +1573,37 @@
 hod.POST, %22/api/
-user
+sport
 s/**%22).hasRole(%22
@@ -1664,36 +1664,37 @@
 thod.PUT, %22/api/
-user
+sport
 s/**%22).hasRole(%22
@@ -1758,36 +1758,37 @@
 d.DELETE, %22/api/
-user
+sport
 s/**%22).hasRole(%22
@@ -2165,24 +2165,28 @@
 le(%22ADMIN%22);
+%0A%09%09%0A
 %09%09%0A%09%09%0A%09%09// O

Fix RestSecurity issue.