package basearch;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.security.SecurityProperties.Headers;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import basearch.service.AuthService;

@Configuration
@EnableWebSecurity
@EnableConfigurationProperties(SecurityProperties.class)
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {

	private static final String[] MANAGEMENT_ENDPOINTS = {"/management/dump","/management/health","/management/metrics","/management/trace"};

	@Autowired
	private AuthService authService;
	
	@Autowired
	private SecurityProperties securityProperties;

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		// general properties
		if (securityProperties.isRequireSsl()) http.requiresChannel().anyRequest().requiresSecure();
		if (!securityProperties.isEnableCsrf()) http.csrf().disable();
		if (!securityProperties.getHeaders().isFrame()) http.headers().frameOptions().disable();
		if (!securityProperties.getHeaders().isContentType()) http.headers().contentTypeOptions().disable();
		if (!securityProperties.getHeaders().isXss()) http.headers().xssProtection().disable();
		if (securityProperties.getHeaders().getHsts() != Headers.HSTS.NONE) http.headers().httpStrictTransportSecurity().includeSubDomains(securityProperties.getHeaders().getHsts() == Headers.HSTS.ALL);
		http.sessionManagement().sessionCreationPolicy(securityProperties.getSessions());
		// management access rules
		http.requiresChannel().antMatchers(MANAGEMENT_ENDPOINTS).requiresSecure();
		http.authorizeRequests().antMatchers(MANAGEMENT_ENDPOINTS).hasRole("ADMIN").and().httpBasic();
		// app access rules
		http.requiresChannel().antMatchers("/login","/logout","/login.page","/secured.page").requiresSecure();
		http.formLogin().loginPage("/login.page").loginProcessingUrl("/login").defaultSuccessUrl("/secured.page").failureUrl("/login.page?error");
		http.exceptionHandling().accessDeniedPage("/unauthorized.page");
		http.logout().logoutSuccessUrl("/index.page");
		http.authorizeRequests().antMatchers("/secured.page").hasRole("ADMIN").and().formLogin();
		// default access rules
		http.authorizeRequests().antMatchers("/**").permitAll();
	}

	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		auth.userDetailsService(authService).passwordEncoder(new BCryptPasswordEncoder());
	}

}
@@ -2107,16 +2107,312 @@
 ons());%0A
+%09%09// login config%0A%09%09http.formLogin().loginPage(%22/login.page%22).loginProcessingUrl(%22/login%22).defaultSuccessUrl(%22/secured.page%22).failureUrl(%22/login.page?error%22);%0A%09%09http.exceptionHandling().accessDeniedPage(%22/unauthorized.page%22);%0A%09%09http.logout().logoutUrl(%22/logout%22).logoutSuccessUrl(%22/index.page%22);%0A
 %09%09// man
@@ -2590,26 +2590,8 @@
 IN%22)
-.and().httpBasic()
 ;%0A%09%09
@@ -2719,265 +2719,8 @@
 ();%0A
-%09%09http.formLogin().loginPage(%22/login.page%22).loginProcessingUrl(%22/login%22).defaultSuccessUrl(%22/secured.page%22).failureUrl(%22/login.page?error%22);%0A%09%09http.exceptionHandling().accessDeniedPage(%22/unauthorized.page%22);%0A%09%09http.logout().logoutSuccessUrl(%22/index.page%22);%0A
 %09%09ht
@@ -2791,26 +2791,8 @@
 IN%22)
-.and().formLogin()
 ;%0A%09%09

Streamline application security