package org.xdi.oxauth.service;

import javax.enterprise.context.ApplicationScoped;
import javax.inject.Inject;
import javax.inject.Named;

import org.xdi.oxauth.model.configuration.AppConfiguration;
import org.xdi.oxauth.model.configuration.AuthenticationProtectionConfiguration;

/**
 * Brute Force authentication protection service implementation
 *
 * @author Yuriy Movchan Date: 08/21/2018
 */
@ApplicationScoped
@Named
public class AuthenticationProtectionService extends org.xdi.service.security.protect.AuthenticationProtectionService {

    private static final int DEFAULT_ATTEMPT_EXPIRATION = 15; // 15 seconds

    private static final int DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS = 10; // 10 attempts
    private static final int DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS_WITHOUT_DELAY = 4; // 4 attempts

    private static final int DEFAULT_DELAY_TIME = 2; // 5 seconds

    private static final String DEFAULT_KEY_PREFIX = "user";
    
    @Inject
    private AppConfiguration appConfiguration;

    @Override
    protected void init() {
        AuthenticationProtectionConfiguration authenticationProtectionConfiguration = appConfiguration.getAuthenticationProtectionConfiguration();
        if (authenticationProtectionConfiguration == null) {
            this.attemptExpiration = DEFAULT_ATTEMPT_EXPIRATION;
            this.maximumAllowedAttempts = DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS;
            this.maximumAllowedAttemptsWithoutDelay = DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS_WITHOUT_DELAY;

            this.delayTime = DEFAULT_DELAY_TIME;
        } else {
            this.attemptExpiration = authenticationProtectionConfiguration.getAttemptExpiration();
            this.maximumAllowedAttempts = authenticationProtectionConfiguration.getMaximumAllowedAttempts();
            this.maximumAllowedAttemptsWithoutDelay = authenticationProtectionConfiguration.getMaximumAllowedAttemptsWithoutDelay();

            this.delayTime = authenticationProtectionConfiguration.getDelayTime();
        }

    }

    @Override
    protected String getKeyPrefix() {
        return DEFAULT_KEY_PREFIX;
    }

    public boolean isEnabled() {
        AuthenticationProtectionConfiguration authenticationProtectionConfiguration = appConfiguration.getAuthenticationProtectionConfiguration();

        return (authenticationProtectionConfiguration != null) && (authenticationProtectionConfiguration.getBruteForceProtectionEnabled());
        
    }

}

@@ -80,16 +80,57 @@
 coped;%0D%0A
+import javax.enterprise.event.Observes;%0D%0A
 import j
@@ -150,16 +150,16 @@
 nject;%0D%0A
-
 import j
@@ -322,16 +322,71 @@
 ration;%0D
+%0Aimport org.xdi.service.cdi.event.ConfigurationUpdate;%0D
 %0A%0D%0A/**%0D%0A
@@ -736,92 +736,8 @@
 %0D%0A%0D%0A
-    private static final int DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS = 10; // 10 attempts%0D%0A
     
@@ -1070,24 +1070,186 @@
 d init() %7B%0D%0A
+        updateConfiguration(appConfiguration);%0D%0A    %7D%0D%0A%0D%0A    public void updateConfiguration(@Observes @ConfigurationUpdate AppConfiguration appConfiguration) %7B%0D%0A
         Auth
@@ -1516,85 +1516,8 @@
 N;%0D%0A
-            this.maximumAllowedAttempts = DEFAULT_MAXIMUM_ALLOWED_ATTEMPTS;%0D%0A
     
@@ -1789,118 +1789,8 @@
 );%0D%0A
-            this.maximumAllowedAttempts = authenticationProtectionConfiguration.getMaximumAllowedAttempts();%0D%0A
     
@@ -2001,24 +2001,24 @@
 layTime();%0D%0A
+
         %7D%0D%0A%0D
@@ -2012,26 +2012,24 @@
 %0A        %7D%0D%0A
-%0D%0A
     %7D%0D%0A%0D%0A   

Add method to reinit protection service on configuration update