package com.example.bot.spring;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {
	/**
	 *  defines which URL paths should be secured and which should not
	 *  Specifically, the "/" and "/home" paths are configured to not require any authentication. All other paths must be authenticated.
	 * */
    //@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests()
            .antMatchers("/", "/home").permitAll()
            .anyRequest().authenticated() 
            .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
        .logout()
            .permitAll();
    /* .authorizeRequests()
     * 		.anyRequest().authenticated() -- every request requires the user to be authenticated
     * .formLogin()						  -- form based authentication is supported
     * 		.loginPage("/login")		  -- when authentication is required, redirect the browser to /login && we are in charge of rendering the login page 
     * 									  -- when authentication attempt fails, redirect the browser to /login?error && we are in charge of rendering a failure page
     * 									  -- when we successfully logout, redirect the browser to /login?logout && we are in charge of rendering a logout confirmation page 
     *		.permitAll()				  -- without this, we will get stuck in the login page with an infinit loop
     *									  -- thus we need to instruct Spring Security to allow anyone to access the /login URL
     *									  -- .permitAll() with .formLogin()  allows any access to any URL (i.e. /login and /login?error) associated to formLogin()
     *
     * */	
    }

    /**
     *  Sets up an in-memory user store with a single user;
     *  The user is given a username of "user", a password of "password", and a role of "USER".
     * */
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    	String username = "user";
    	String pw = "pass";
    	
        auth
            .inMemoryAuthentication()
                .withUser(username).password(pw).roles("USER");
    }
}

/* HELPFUL LINKS: 
 * https://spring.io/guides/gs/securing-web/
 */

@@ -26,16 +26,97 @@
 pring;%0A%0A
+%0Aimport java.util.regex.Pattern;%0A%0Aimport javax.servlet.http.HttpServletRequest;%0A%0A
 import o
@@ -510,16 +510,159 @@
 ecurity;
+%0Aimport org.springframework.security.web.util.matcher.RegexRequestMatcher;%0Aimport org.springframework.security.web.util.matcher.RequestMatcher;
 %0A%0A@Confi
@@ -932,24 +932,29 @@
 ted.%0A%09 * */%0A
+    %0A
     //@Overr
@@ -1295,16 +1295,16 @@
 ogout()%0A
-
         
@@ -1321,16 +1321,793 @@
 tAll();%0A
+        http.csrf().requireCsrfProtectionMatcher(new RequestMatcher() %7B%0A            private Pattern allowedMethods = Pattern.compile(%22%5E(GET%7CHEAD%7CTRACE%7COPTIONS)$%22);%0A            private RegexRequestMatcher apiMatcher = new RegexRequestMatcher(%22/v%5B0-9%5D*/.*%22, null);%0A%0A            @Override%0A            public boolean matches(HttpServletRequest request) %7B%0A                // No CSRF due to allowedMethod%0A                if(allowedMethods.matcher(request.getMethod()).matches())%0A                    return false;%0A%0A                // No CSRF due to api call%0A                if(apiMatcher.matches(request))%0A                    return false;%0A%0A                // CSRF for everything else that is not an API call or an allowedMethod%0A                return true;%0A            %7D%0A        %7D);%0A
     /* .

Test again