/*
 * Copyright 2017 flow.ci
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.flow.platform.api.security;

import com.flow.platform.api.domain.user.Action;
import com.flow.platform.api.exception.AccessDeniedException;
import com.flow.platform.api.exception.AuthenticationException;
import com.flow.platform.api.security.token.TokenGenerator;
import com.flow.platform.util.Logger;
import com.google.common.base.Strings;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

/**
 * @author yang
 */
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {

    public final static String TOKEN_HEADER_PARAM = "X-Authorization";

    private final static Logger LOGGER = new Logger(AuthenticationInterceptor.class);

    private final static String TOKEN_PAYLOAD_FOR_TEST = "mytokenpayload";

    @Autowired
    private UserSecurityService userSecurityService;

    @Autowired
    private TokenGenerator tokenGenerator;

    /**
     * Requests needs to verify token
     */
    private final List<RequestMatcher> authRequests;

    private boolean enableAuth = false;

    public AuthenticationInterceptor(List<RequestMatcher> matchers) {
        this.authRequests = matchers;
    }

    public void enable() {
        this.enableAuth = true;
    }

    public void disable() {
        this.enableAuth = false;
    }

    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) throws Exception {

        if (!enableAuth) {
            return true;
        }

        if(!isNeedToVerify(request)) {
            return true;
        }

        try {
            doVerify(request, handler);
            return true;
        } catch (Throwable e) {
            response.sendError(HttpStatus.UNAUTHORIZED.value(), e.getMessage());
            return false;
        }
    }

    private void doVerify(HttpServletRequest request, Object handler) {
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        if (handler == null) {
            return;
        }

        // check token is provided from http header
        String tokenPayload = request.getHeader(TOKEN_HEADER_PARAM);
        if (Strings.isNullOrEmpty(tokenPayload)) {
            throw new AuthenticationException("Invalid request");
        }

        if (TOKEN_PAYLOAD_FOR_TEST.equals(tokenPayload)) {
            return;
        }

        // get user email from token payload
        String email = tokenGenerator.extract(tokenPayload);

        // find annotation
        WebSecurity securityAnnotation = handlerMethod.getMethodAnnotation(WebSecurity.class);
        if (securityAnnotation == null) {
            return;
        }

        // find action for request
        Action action = userSecurityService.getAction(securityAnnotation.action());
        LOGGER.debug("User '%s' requested for action %s", email, action.getName());

        if (!userSecurityService.canAccess(email, action)) {
            throw new AccessDeniedException(email, action.getName());
        }
    }

    private boolean isNeedToVerify(HttpServletRequest request) {
        for (RequestMatcher matcher : authRequests) {
            if (matcher.matches(request)) {
                return true;
            }
        }
        return false;
    }
}

@@ -670,24 +670,71 @@
 ser.Action;%0A
+import com.flow.platform.api.domain.user.User;%0A
 import com.f
@@ -775,32 +775,32 @@
 eniedException;%0A
-
 import com.flow.
@@ -907,16 +907,71 @@
 erator;%0A
+import com.flow.platform.api.service.user.UserService;%0A
 import c
@@ -1463,16 +1463,156 @@
 r;%0A%0A/**%0A
+ * Verify token from header if controller method has%0A * annotation @WebSecurity with action name, the auth%0A * can be enabled or disabled%0A *%0A
  * @auth
@@ -1941,32 +1941,32 @@
 %0A    @Autowired%0A
-
     private User
@@ -1999,24 +1999,77 @@
 tyService;%0A%0A
+    @Autowired%0A    private UserService userService;%0A%0A
     @Autowir
@@ -4255,32 +4255,222 @@
 me());%0A        %7D
+%0A%0A        // TODO: to be cached%0A        // set current user to request attribute%0A        User currentUser = userService.findByEmail(email);%0A        request.setAttribute(%22user%22, currentUser);
 %0A    %7D%0A%0A    priv

add user object to request attribute