package gov.samhsa.c2s.c2suiapi.config;

import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;

import static gov.samhsa.c2s.common.oauth2.OAuth2ScopeUtils.hasScopes;

@Configuration
public class SecurityConfig {

    private static final String RESOURCE_ID = "c2sUiApi";

    @Bean
    public ResourceServerConfigurer resourceServer(SecurityProperties securityProperties) {
        return new ResourceServerConfigurerAdapter() {
            @Override
            public void configure(ResourceServerSecurityConfigurer resources) {
                resources.resourceId(RESOURCE_ID);
            }

            @Override
            public void configure(HttpSecurity http) throws Exception {
                if (securityProperties.isRequireSsl()) {
                    http.requiresChannel().anyRequest().requiresSecure();
                }
                http.authorizeRequests()
                        .antMatchers(HttpMethod.GET, "/pcm/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.POST, "/pcm/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.DELETE, "/pcm/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.PUT, "/pcm/**").access(hasScopes("c2sUiApi.write"))

                        .antMatchers(HttpMethod.GET, "/ums/users/profile/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.PUT, "/ums/users/locale/**").access(hasScopes("c2sUiApi.write"))
                        .antMatchers(HttpMethod.POST, "/ums/users/verification/**").permitAll()
                        .antMatchers(HttpMethod.GET, "/ums/users/activation/**").permitAll()
                        .antMatchers(HttpMethod.POST, "/ums/users/activation/**").permitAll()

                        .antMatchers(HttpMethod.GET, "/vss/**").access(hasScopes("c2sUiApi.read"))
                        .antMatchers(HttpMethod.GET, "/pls/**").access(hasScopes("c2sUiApi.read"))

                        .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                        .anyRequest().denyAll();
            }
        };
    }
}
@@ -2571,24 +2571,500 @@
 pi.read%22))%0A%0A
+                        .antMatchers(HttpMethod.GET, %22/phr/uploadedDocuments/**%22).access(hasScopes(%22c2sUiApi.read%22))%0A                        .antMatchers(HttpMethod.POST, %22/phr/uploadedDocuments/**%22).access(hasScopes(%22c2sUiApi.write%22))%0A                        .antMatchers(HttpMethod.DELETE, %22/phr/uploadedDocuments/**%22).access(hasScopes(%22c2sUiApi.write%22))%0A                        .antMatchers(HttpMethod.PUT, %22/phr/uploadedDocuments/**%22).access(hasScopes(%22c2sUiApi.write%22))%0A%0A
             

Modify SecurityConfig to restrict phr access to only the '/phr/uploadedDocuments/' paths