/*
 * Copyright 2012-2018 MarkLogic Corporation
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *
 */
package com.marklogic.quickstart.auth;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.marklogic.hub.impl.HubConfigImpl;
import com.marklogic.quickstart.service.EnvironmentConfig;
import com.marklogic.quickstart.model.Project;
import com.marklogic.quickstart.service.ProjectManagerService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.util.Assert;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Properties;

/**
 * Processes an authentication form submission. Called
 * {@code AuthenticationProcessingFilter} prior to Spring Security 3.0.
 * <p>
 * Login forms must present two parameters to this filter: a username and password. The
 * default parameter names to use are contained in the static fields
 * {@link #SPRING_SECURITY_FORM_USERNAME_KEY} and
 * {@link #SPRING_SECURITY_FORM_PASSWORD_KEY}. The parameter names can also be changed by
 * setting the {@code usernameParameter} and {@code passwordParameter} properties.
 * <p>
 * This filter by default responds to the URL {@code /login}.
 *
 * @author Ben Alex
 * @author Colin Sampaleanu
 * @author Luke Taylor
 * @since 3.0
 */

public class ConnectionAuthenticationFilter extends
    AbstractAuthenticationProcessingFilter {
    // ~ Static fields/initializers
    // =====================================================================================

    public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
    public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
    public static final String SPRING_SECURITY_FORM_HOST_KEY = "hostname";

    private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
    private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
    private String hostnameParameter = SPRING_SECURITY_FORM_HOST_KEY;
    private boolean postOnly = true;

    public Authentication authAttempt = null;

    @Autowired
    private HubConfigImpl hubConfig;

    @Autowired
    private ProjectManagerService pm;

    @Autowired
    private EnvironmentConfig environmentConfig;

    // ~ Constructors
    // ===================================================================================================

    public ConnectionAuthenticationFilter() throws IOException, ClassNotFoundException {
        super(new AntPathRequestMatcher("/api/login", "POST"));
    }

    // ~ Methods
    // ========================================================================================================

    public Authentication attemptAuthentication(HttpServletRequest request,
            HttpServletResponse response) throws AuthenticationException, IOException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        final LoginInfo loginInfo = new ObjectMapper().readValue(request.getInputStream(), LoginInfo.class);
        String username = loginInfo.username;
        String password = loginInfo.password;

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();

        Project project = pm.getProject(loginInfo.projectId);
        pm.setLastProject(loginInfo.projectId);

        Properties overrides = new Properties();
        overrides.put("mlUsername", username);
        overrides.put("mlPassword", password);
        hubConfig.refreshProject(overrides, true);
        hubConfig.getAppConfig().setAppServicesUsername(username);
        hubConfig.getAppConfig().setAppServicesPassword(password);

        environmentConfig.setEnvironment(loginInfo.environment);

        ConnectionAuthenticationToken authRequest = new ConnectionAuthenticationToken(
                username, password, hubConfig.getAppConfig().getHost(), loginInfo.projectId, loginInfo.environment);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);
        authAttempt = this.getAuthenticationManager().authenticate(authRequest);
        return authAttempt;
    }

    /**
     * Enables subclasses to override the composition of the password, such as by
     * including additional values and a separator.
     * <p>
     * This might be used for example if a postcode/zipcode was required in addition to
     * the password. A delimiter such as a pipe (|) should be used to separate the
     * password and extended value(s). The <code>AuthenticationDao</code> will need to
     * generate the expected password in a corresponding manner.
     * </p>
     *
     * @param request so that request attributes can be retrieved
     *
     * @return the password that will be presented in the <code>Authentication</code>
     * request token to the <code>AuthenticationManager</code>
     */
    protected String obtainPassword(HttpServletRequest request) {
        return request.getParameter(passwordParameter);
    }

    /**
     * Enables subclasses to override the composition of the username, such as by
     * including additional values and a separator.
     *
     * @param request so that request attributes can be retrieved
     *
     * @return the username that will be presented in the <code>Authentication</code>
     * request token to the <code>AuthenticationManager</code>
     */
    protected String obtainUsername(HttpServletRequest request) {
        return request.getParameter(usernameParameter);
    }

    protected String obtainHostname(HttpServletRequest request) {
        return request.getParameter(hostnameParameter);
    }

    /**
     * Provided so that subclasses may configure what is put into the authentication
     * request's details property.
     *
     * @param request that an authentication request is being created for
     * @param authRequest the authentication request object that should have its details
     * set
     */
    protected void setDetails(HttpServletRequest request,
            ConnectionAuthenticationToken authRequest) {
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
    }

    /**
     * Sets the parameter name which will be used to obtain the username from the login
     * request.
     *
     * @param usernameParameter the parameter name. Defaults to "username".
     */
    public void setUsernameParameter(String usernameParameter) {
        Assert.hasText(usernameParameter, "Username parameter must not be empty or null");
        this.usernameParameter = usernameParameter;
    }

    /**
     * Sets the parameter name which will be used to obtain the password from the login
     * request..
     *
     * @param passwordParameter the parameter name. Defaults to "password".
     */
    public void setPasswordParameter(String passwordParameter) {
        Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
        this.passwordParameter = passwordParameter;
    }

    public void setHostnameParameter(String hostnameParameter) {
        Assert.hasText(hostnameParameter, "Hostname parameter must not be empty or null");
        this.hostnameParameter = hostnameParameter;
    }

    /**
     * Defines whether only HTTP POST requests will be allowed by this filter. If set to
     * true, and an authentication request is received which is not a POST request, an
     * exception will be raised immediately and authentication will not be attempted. The
     * <tt>unsuccessfulAuthentication()</tt> method will be called as if handling a failed
     * authentication.
     * <p>
     * Defaults to <tt>true</tt> but may be overridden by subclasses.
     */
    public void setPostOnly(boolean postOnly) {
        this.postOnly = postOnly;
    }

    public final String getUsernameParameter() {
        return usernameParameter;
    }

    public final String getPasswordParameter() {
        return passwordParameter;
    }

    public final String getHostnameParameter() {
        return hostnameParameter;
    }
}

@@ -4466,73 +4466,22 @@
     
-Properties overrides = new Properties();%0A        overrides.put(%22m
+hubConfig.setM
 lUse
@@ -4485,19 +4485,17 @@
 Username
-%22, 
+(
 username
@@ -4509,24 +4509,22 @@
     
-overrides.put(%22m
+hubConfig.setM
 lPas
@@ -4528,19 +4528,17 @@
 Password
-%22, 
+(
 password
@@ -4577,23 +4577,8 @@
 ect(
-overrides, true
 );%0A 

Use setters to override properties