package digital.loom.rhizome.authentication;

import java.util.regex.Pattern;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;

import com.auth0.jwt.internal.org.apache.commons.lang3.StringUtils;
import com.auth0.spring.security.api.Auth0AuthenticationFilter;
import com.google.common.base.MoreObjects;

public class CookieReadingAuth0AuthenticationFilter extends Auth0AuthenticationFilter {
    @Override
    protected String getToken( HttpServletRequest httpRequest ) {
        String authorizationCookie = null;
        Cookie[] cookies = httpRequest.getCookies();
        if ( cookies != null ) {
            for ( Cookie cookie : httpRequest.getCookies() ) {
                if ( StringUtils.equals( cookie.getName(), "authorization" ) ) {
                    authorizationCookie = cookie.getValue();
                    break;
                }
            }
        }

        final String authorizationHeader = httpRequest.getHeader( "authorization" );

        final String[] parts = MoreObjects.firstNonNull( authorizationHeader, authorizationCookie ).split( " " );
        if ( parts.length != 2 ) {
            // "Unauthorized: Format is Authorization: Bearer [token]"
            return null;
        }
        final String scheme = parts[ 0 ];
        final String credentials = parts[ 1 ];
        final Pattern pattern = Pattern.compile( "^Bearer$", Pattern.CASE_INSENSITIVE );
        return pattern.matcher( scheme ).matches() ? credentials : null;
    }
}

@@ -939,16 +939,40 @@
 tion
-Header =
+Info = MoreObjects.firstNonNull(
  htt
@@ -1012,88 +1012,141 @@
 n%22 )
-;%0A%0A        final String%5B%5D parts = MoreObjects.firstNonNull( authorizationHeader,
+, authorizationCookie ); %0A        if( authorizationInfo == null ) %7B%0A            return null;%0A        %7D%0A        final String%5B%5D parts =
  aut
@@ -1155,24 +1155,20 @@
 rization
-Cookie )
+Info
 .split( 
@@ -1170,24 +1170,33 @@
 lit( %22 %22 );%0A
+        %0A
         if (

Fix NPE if no auth info provided