package com.aemreunal.config;

/*
 * *********************** *
 * Copyright (c) 2015      *
 *                         *
 * This code belongs to:   *
 *                         *
 * @author Ahmet Emre Ünal *
 * S001974                 *
 *                         *
 * aemreunal@gmail.com     *
 * emre.unal@ozu.edu.tr    *
 *                         *
 * aemreunal.com           *
 * *********************** *
 */

import javax.sql.DataSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

/*
 * Via: https://spring.io/guides/tutorials/rest/5/
 */

@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private DataSource dataSource;

    @Autowired
    private BCryptPasswordEncoder passwordEncoder;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication()
            .dataSource(dataSource)
            .usersByUsernameQuery(GlobalSettings.USERS_FOR_AUTH_QUERY)
            .authoritiesByUsernameQuery(GlobalSettings.AUTHORITY_OF_USER_QUERY)
            .passwordEncoder(passwordEncoder);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers(GlobalSettings.USER_CREATE_MAPPING).permitAll()
                // TODO is the * necessary?
                .antMatchers(GlobalSettings.API_PATH_MAPPING + "/*").permitAll()
                .anyRequest().authenticated()
                .and()
                .requiresChannel().antMatchers("**").requiresSecure()
                .and()
                .httpBasic()
                .and()
                .requestCache().disable()
                .rememberMe().disable()
                .headers().httpStrictTransportSecurity()
                .and()
                .csrf().disable();
    }

    private boolean allowUnsecured() {
        String envFlag = System.getenv(GlobalSettings.IBEACON_HTTP_ALLOW_KEY);
        return envFlag != null && envFlag.equalsIgnoreCase("true");
    }
}

@@ -1884,32 +1884,131 @@
 ows Exception %7B%0A
+        // TODO is the * necessary?%0A        // @formatter:off%0A        if (!allowUnsecured()) %7B%0A    
         http.aut
@@ -2024,16 +2024,24 @@
 uests()%0A
+        
         
@@ -2113,48 +2113,8 @@
     
-            // TODO is the * necessary?%0A
     
@@ -2206,16 +2206,20 @@
         
+  
+  
 .anyRequ
@@ -2255,32 +2255,36 @@
          .and()%0A
+    
                 
@@ -2376,16 +2376,20 @@
         
+    
 .httpBas
@@ -2428,24 +2428,28 @@
             
+   
+ 
 .requestCach
@@ -2454,32 +2454,36 @@
 che().disable()%0A
+    
                 
@@ -2526,46 +2526,159 @@
     
-.headers().httpStrictTransportSecurity
+    .portMapper().disable()%0A                    .headers()%0A                        .httpStrictTransportSecurity()%0A                        .cacheControl
 ()%0A 
@@ -2691,32 +2691,36 @@
          .and()%0A
+    
                 
@@ -2746,193 +2746,1634 @@
     
-%7D%0A%0A    private boolean allowUnsecured() %7B%0A        String envFlag = System.getenv(GlobalSettings.IBEACON_HTTP_ALLOW_KEY);%0A        return envFlag != null && envFlag.equalsIgnoreCase(%22true
+    %7Delse %7B%0A            showUnsecureAllowedMessage();%0A            http.authorizeRequests()%0A                    .antMatchers(GlobalSettings.USER_CREATE_MAPPING).permitAll()%0A                    .antMatchers(GlobalSettings.API_PATH_MAPPING + %22/*%22).permitAll()%0A                    .anyRequest().authenticated()%0A                .and()%0A                    .httpBasic()%0A                .and()%0A                    .requestCache().disable()%0A                    .rememberMe().disable()%0A                    .portMapper().disable()%0A                    .headers()%0A                        .cacheControl()%0A                .and()%0A                    .csrf().disable();%0A%0A        %7D%0A        // @formatter:on%0A    %7D%0A%0A    private boolean allowUnsecured() %7B%0A        String envFlag = System.getenv(GlobalSettings.IBEACON_HTTP_ALLOW_KEY);%0A        return envFlag != null && envFlag.equalsIgnoreCase(%22true%22);%0A    %7D%0A%0A    private void showUnsecureAllowedMessage() %7B%0A        System.err.println(%22-------------------------------------------------------------------%22);%0A        System.err.println(%22-------------------------------------------------------------------%22);%0A        System.err.println(%22-------------------------------------------------------------------%22);%0A        System.err.println(%22---------------- WARNING: HTTP TRAFFIC IS ALLOWED! ----------------%22);%0A        System.err.println(%22-------------------------------------------------------------------%22);%0A        System.err.println(%22-------------------------------------------------------------------%22);%0A        System.err.println(%22-------------------------------------------------------------------
 %22);%0A

Allow HTTP traffic based on env variables