package by.bsuir.mpp.computershop.config.security;

import by.bsuir.mpp.computershop.entity.UserAuth;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;

import javax.sql.DataSource;

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    private final DataSource dataSource;

    @Autowired
    public ResourceServerConfiguration(DataSource dataSource) {
        this.dataSource = dataSource;
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources
                .tokenStore(tokenStore());
        resources.stateless(false);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.
                authorizeRequests()
                    .antMatchers("/").anonymous()
                // TODO: configure access for roles
                .antMatchers("/api/**").hasAuthority(UserAuth.Role.ADMIN.name())
                .anyRequest().permitAll();
    }
}

@@ -271,16 +271,60 @@
 ration;%0A
+import org.springframework.http.HttpMethod;%0A
 import o
@@ -1557,16 +1557,180 @@
 ption %7B%0A
+        String DIRECTOR = UserAuth.Role.DIRECTOR.name();%0A        String MANAGER = UserAuth.Role.MANAGER.name();%0A        String ADMIN = UserAuth.Role.ADMIN.name();%0A%0A
         
@@ -1779,36 +1779,32 @@
                 
-    
 .antMatchers(%22/%22
@@ -1800,16 +1800,32 @@
 atchers(
+HttpMethod.GET, 
 %22/%22).ano
@@ -1853,43 +1853,150 @@
     
-// TODO: configure access for roles
+.antMatchers(HttpMethod.POST, %22/oauth/revoke_token%22).authenticated()%0A%0A                .antMatchers(HttpMethod.GET, %22/api/**%22).authenticated()%0A
 %0A   
@@ -2023,24 +2023,33 @@
 chers(%22/api/
+provider/
 **%22).hasAuth
@@ -2045,16 +2045,19 @@
 *%22).hasA
+nyA
 uthority
@@ -2061,77 +2061,428 @@
 ity(
-UserAuth.Role.ADMIN.name())%0A                .anyRequest().permitAll()
+DIRECTOR, ADMIN)%0A%0A                .antMatchers(%22/api/order/**%22,%0A                        %22/api/customer/**%22,%0A                        %22/api/component/store/**%22,%0A                        %22/api/assembly%22,%0A                        %22/api/imports%22,%0A                        %22/api/component/model%22).hasAnyAuthority(MANAGER, ADMIN)%0A%0A                .antMatchers(%22/api/user/**%22, %22/api/component/type/**%22).hasAuthority(ADMIN)%0A        
 ;%0A  

Update Security config