package org.araymond.joal.web.config.security;

import org.araymond.joal.web.annotations.ConditionalOnWebUi;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

/**
 * Created by raymo on 29/07/2017.
 */
@ConditionalOnWebUi
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private final String pathPrefix;
    private final boolean shouldDisableFrameOptions;

    public WebSecurityConfig(
            @Value("${joal.ui.path.prefix}") final String pathPrefix,
            @Value("${joal.iframe.enabled:false}") final boolean shouldDisableFrameOptions
    ) {
        this.pathPrefix = pathPrefix;
        this.shouldDisableFrameOptions = shouldDisableFrameOptions;
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        if (this.shouldDisableFrameOptions) {
            http.headers().frameOptions().disable();
        }

        http
                .httpBasic().disable()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                .authorizeRequests()
                .antMatchers("/" + this.pathPrefix).permitAll()
                .antMatchers("/" + this.pathPrefix + "/ui/**").permitAll()
                .anyRequest().denyAll();
    }

}

@@ -161,16 +161,68 @@
 .Value;%0A
+import org.springframework.context.annotation.Bean;%0A
 import o
@@ -355,16 +355,107 @@
 curity;%0A
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;%0A
 import o
@@ -618,16 +618,222 @@
 nPolicy;
+%0Aimport org.springframework.security.provisioning.InMemoryUserDetailsManager;%0Aimport org.springframework.security.web.DefaultSecurityFilterChain;%0Aimport org.springframework.security.web.SecurityFilterChain;
 %0A%0A/**%0A *
@@ -889,16 +889,35 @@
 OnWebUi%0A
+@EnableWebSecurity%0A
 @Configu
@@ -958,45 +958,8 @@
 fig 
-extends WebSecurityConfigurerAdapter 
 %7B%0A  
@@ -1368,52 +1368,57 @@
    @
-Override%0A    protected void configure(final 
+Bean%0A    SecurityFilterChain securityFilterChain(
 Http
@@ -1565,24 +1565,31 @@
  %7D%0A%0A        
+return 
 http%0A       
@@ -1620,16 +1620,55 @@
 sable()%0A
+                .formLogin().disable()%0A
         
@@ -1972,16 +1972,293 @@
 enyAll()
+%0A                .and().build();%0A    %7D%0A%0A    // Provide an empty UserDetailService to prevent spring from injecting a default one with a valid random password.%0A    @Bean%0A    public InMemoryUserDetailsManager userDetailsService() %7B%0A        return new InMemoryUserDetailsManager()
 ;%0A    %7D%0A

update spring security config