package org.synyx.urlaubsverwaltung.security;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.boot.actuate.metrics.export.prometheus.PrometheusScrapeEndpoint;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private boolean isOauth2Enabled;
    private SecurityContextLogoutHandler oidcLogoutHandler;

    public WebSecurityConfig(SecurityConfigurationProperties properties) {
        isOauth2Enabled = "oidc".equalsIgnoreCase(properties.getAuth().name());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .csrf()
            .disable()
            .authorizeRequests()
            // TODO move to common url static or resources
            .antMatchers("/favicons/**").permitAll()
            .antMatchers("/browserconfig.xml").permitAll()
            .antMatchers("/manifest.json").permitAll()
            .antMatchers("/css/**").permitAll()
            .antMatchers("/fonts/**").permitAll()
            .antMatchers("/images/**").permitAll()
            .antMatchers("/assets/**").permitAll()
            .antMatchers("/login*").permitAll()
            // WEB
            .antMatchers("/web/overview").hasAuthority("USER")
            .antMatchers("/web/application/**").hasAuthority("USER")
            .antMatchers("/web/sicknote/**").hasAuthority("USER")
            .antMatchers("/web/person/**").hasAuthority("USER")
            .antMatchers("/web/overtime/**").hasAuthority("USER")
            .antMatchers("/web/department/**").hasAnyAuthority("BOSS", "OFFICE")
            .antMatchers("/web/settings/**").hasAuthority("OFFICE")
            .antMatchers("/web/google-api-handshake/**").hasAuthority("OFFICE")
            .requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll()
            .requestMatchers(EndpointRequest.to(PrometheusScrapeEndpoint.class)).permitAll()
            // TODO muss konfigurierbar werden!
            .requestMatchers(EndpointRequest.toAnyEndpoint()).hasAuthority("ADMIN")
            .anyRequest()
            .authenticated();

        if (isOauth2Enabled) {
            http.oauth2Login().and()
                .logout()
                .addLogoutHandler(oidcLogoutHandler);
        } else {
            http.formLogin()
                .loginPage("/login").permitAll()
                .defaultSuccessUrl("/web/overview")
                .failureUrl("/login?login_error=1")
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login");
        }
    }

    @Autowired(required = false)
    public void setOidcLogoutHandler(SecurityContextLogoutHandler oidcLogoutHandler) {
        this.oidcLogoutHandler = oidcLogoutHandler;
    }
}

@@ -1029,24 +1029,219 @@
 rAdapter %7B%0A%0A
+    private static final String OFFICE = %22OFFICE%22;%0A    private static final String BOSS = %22BOSS%22;%0A    private static final String USER = %22USER%22;%0A    private static final String ADMIN = %22ADMIN%22;%0A%0A
     private 
@@ -1265,16 +1265,16 @@
 nabled;%0A
-
     priv
@@ -2199,38 +2199,36 @@
 %22).hasAuthority(
-%22
 USER
-%22
 )%0A            .a
@@ -2266,38 +2266,36 @@
 %22).hasAuthority(
-%22
 USER
-%22
 )%0A            .a
@@ -2330,38 +2330,36 @@
 %22).hasAuthority(
-%22
 USER
-%22
 )%0A            .a
@@ -2392,38 +2392,36 @@
 %22).hasAuthority(
-%22
 USER
-%22
 )%0A            .a
@@ -2464,22 +2464,20 @@
 thority(
-%22
 USER
-%22
 )%0A      
@@ -2537,24 +2537,20 @@
 ity(
-%22
 BOSS
-%22
 , 
-%22
 OFFICE
-%22
 )%0A  
@@ -2601,32 +2601,30 @@
 asAuthority(
-%22
 OFFICE
-%22
 )%0A          
@@ -2683,24 +2683,22 @@
 thority(
-%22
 OFFICE
-%22
 )%0A      
@@ -2990,23 +2990,21 @@
 thority(
-%22
 ADMIN
-%22
 )%0A      

Define a constant for web security roles