/**************************************************************
 * Copyright (c) Stéphane Bégaudeau
 *
 * This source code is licensed under the MIT license found in
 * the LICENSE file in the root directory of this source tree.
 **************************************************************/
package com.svalyn.application.configuration;

import java.util.Arrays;
import java.util.Objects;

import org.springframework.core.env.Environment;
import org.springframework.http.HttpStatus;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.CorsConfigurer;
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
import org.springframework.security.web.authentication.AuthenticationEntryPointFailureHandler;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler;

@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final Environment environment;

    public SecurityConfiguration(Environment environment) {
        this.environment = Objects.requireNonNull(environment);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        boolean isDevProfileActive = Arrays.asList(this.environment.getActiveProfiles()).contains("dev");
        // @formatter:off
        http
        .authorizeRequests(exchanges -> {
            exchanges.antMatchers("/login").permitAll();
            exchanges.antMatchers("/new/account").permitAll();

            exchanges.antMatchers("/static/**").permitAll();
            exchanges.antMatchers("/favicon.ico").permitAll();
            exchanges.antMatchers("/manifest.json").permitAll();
            exchanges.antMatchers("/logo192.png").permitAll();
            exchanges.antMatchers("/logo512.png").permitAll();
            exchanges.antMatchers("/api/graphql").hasAnyRole("USER");
            exchanges.anyRequest().authenticated();
        })
        .httpBasic(httpBasic -> {
            if (isDevProfileActive) {
                httpBasic.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));
            } else {
                httpBasic.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"));
            }
        })
        .formLogin(formLogin -> {
            formLogin.loginPage("/login");
            formLogin.failureHandler(new AuthenticationEntryPointFailureHandler(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)));
            formLogin.successHandler((request, response, authentication) -> response.setStatus(HttpStatus.OK.value()));
        })
        .logout(logout -> logout.logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.ACCEPTED)))
        .cors(CorsConfigurer<HttpSecurity>::disable)
        .csrf(CsrfConfigurer<HttpSecurity>::disable);
        // @formatter:on
    }
}

@@ -338,109 +338,8 @@
 n;%0A%0A
-import java.util.Arrays;%0Aimport java.util.Objects;%0A%0Aimport org.springframework.core.env.Environment;%0A
 impo
@@ -1000,97 +1000,8 @@
 nt;%0A
-import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;%0A
 impo
@@ -1202,365 +1202,84 @@
     
-private final Environment environment;%0A%0A    public SecurityConfiguration(Environment environment) %7B%0A        this.environment = Objects.requireNonNull(environment);%0A    %7D%0A%0A    @Override%0A    protected void configure(HttpSecurity http) throws Exception %7B%0A        boolean isDevProfileActive = Arrays.asList(this.environment.getActiveProfiles()).contains(%22dev%22);
+@Override%0A    protected void configure(HttpSecurity http) throws Exception %7B
 %0A   
@@ -1960,64 +1960,8 @@
 c -%3E
- %7B%0A            if (isDevProfileActive) %7B%0A               
  htt
@@ -2046,154 +2046,8 @@
 ED))
-;%0A            %7D else %7B%0A                httpBasic.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint(%22/login%22));%0A            %7D%0A        %7D
 )%0A  

Fix an issue with the integration tests in a production environment