package hello.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

@Configuration
@EnableWebSecurity
public class Security extends WebSecurityConfigurerAdapter {

	private static final String ADMIN_ROLE = "ADMINISTRATOR";

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// By default, all requests are authenticated except /.
		http.authorizeRequests().requestMatchers(new AntPathRequestMatcher("/**", "GET")).permitAll().anyRequest()
		.authenticated();

		// Use form login/logout for the Web.
		http.formLogin().loginPage("/sign-in").permitAll();
		http.logout().logoutUrl("/sign-out").logoutSuccessUrl("/").permitAll();

		// Use HTTP basic for the API.
		http.requestMatcher(new AntPathRequestMatcher("/api/**")).httpBasic();

		// Only use CSRF for Web requests.
		http.antMatcher("/**").csrf().ignoringAntMatchers("/api/**");
	}

	@Autowired
	public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
		auth.inMemoryAuthentication().withUser("Rob").password("Haines").roles(ADMIN_ROLE);
		auth.inMemoryAuthentication().withUser("Caroline").password("Jay").roles(ADMIN_ROLE);
		auth.inMemoryAuthentication().withUser("Markel").password("Vigo").roles(ADMIN_ROLE);
	}
}

@@ -597,16 +597,85 @@
 Matcher;
+%0Aimport org.springframework.security.web.util.matcher.RequestMatcher;
 %0A%0A@Confi
@@ -824,16 +824,448 @@
 ATOR%22;%0A%0A
+%09// List the mappings/methods for which no authorisation is required.%0A%09// We specifically omit '/greeting/new' here so that we require log in%0A%09// before submitting the new greeting.%0A%09private static final RequestMatcher%5B%5D NO_AUTH = %7B new AntPathRequestMatcher(%22/%22, %22GET%22),%0A%09%09%09new AntPathRequestMatcher(%22/api/**%22, %22GET%22), new AntPathRequestMatcher(%22/greeting%22, %22GET%22),%0A%09%09%09new AntPathRequestMatcher(%22/greeting/%7Bid:%5B%5C%5Cd%5D+%7D%22, %22GET%22) %7D;%0A%0A
 %09@Overri
@@ -1386,17 +1386,33 @@
  except 
-/
+our specific list
 .%0A%09%09http
@@ -1452,47 +1452,15 @@
 ers(
-new AntPathRequestMatcher(%22/**%22, %22GET%22)
+NO_AUTH
 ).pe
@@ -1481,19 +1481,16 @@
 equest()
-%0A%09%09
 .authent

Update security settings to auth by default.