package io.github.jhipster.registry.config;

import io.github.jhipster.registry.security.AuthoritiesConstants;
import io.github.jhipster.registry.security.Http401UnauthorizedEntryPoint;
import io.github.jhipster.registry.security.jwt.JWTConfigurer;
import io.github.jhipster.registry.security.jwt.TokenProvider;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final Http401UnauthorizedEntryPoint authenticationEntryPoint;

    private final TokenProvider tokenProvider;

    public SecurityConfiguration(Http401UnauthorizedEntryPoint authenticationEntryPoint,
                                 TokenProvider tokenProvider) {
        this.authenticationEntryPoint = authenticationEntryPoint;
        this.tokenProvider = tokenProvider;
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
            .antMatchers(HttpMethod.OPTIONS, "/**")
            .antMatchers("/app/**/*.{js,html}")
            .antMatchers("/bower_components/**")
            .antMatchers("/content/**")
            .antMatchers("/test/**")
            .antMatchers("/h2-console/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .exceptionHandling()
            .authenticationEntryPoint(authenticationEntryPoint)
        .and()
            .csrf()
            .disable()
            .headers()
            .frameOptions()
            .disable()
        .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
         .and()
            .httpBasic()
            .realmName("JHipster Registry")
        .and()
            .authorizeRequests()
            .antMatchers("/**").permitAll() // cannot reconnect without this line
            .antMatchers("/api/**").authenticated()
            .antMatchers("/api/authenticate").permitAll()
            .antMatchers("/eureka/**").hasAuthority(AuthoritiesConstants.ADMIN)
            .antMatchers("/config/**").hasAuthority(AuthoritiesConstants.ADMIN)
            .antMatchers("/management/health").permitAll()
            .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
            .anyRequest().authenticated() // always at the end
        .and()
            .apply(securityConfigurerAdapter());
    }

    private JWTConfigurer securityConfigurerAdapter() {
        return new JWTConfigurer(tokenProvider);
    }
}

@@ -1745,144 +1745,15 @@
 s(%22/
-bower_components/**%22)%0A            .antMatchers(%22/content/**%22)%0A            .antMatchers(%22/test/**%22)%0A            .antMatchers(%22/h2-console
+content
 /**%22
@@ -2365,113 +2365,139 @@
 s(%22/
-**%22).permitAll() // cannot reconnect without this line%0A            .antMatchers(%22/api/**%22).authenticated(
+eureka/**%22).hasAuthority(AuthoritiesConstants.ADMIN)%0A            .antMatchers(%22/config/**%22).hasAuthority(AuthoritiesConstants.ADMIN
 )%0A  
@@ -2583,59 +2583,31 @@
 s(%22/
-eureka/**%22).hasAuthority(AuthoritiesConstants.ADMIN
+api/**%22).authenticated(
 )%0A  
@@ -2623,38 +2623,42 @@
  .antMatchers(%22/
-config
+management
 /**%22).hasAuthori
@@ -2719,25 +2719,9 @@
 s(%22/
-management/health
+*
 %22).p
@@ -2735,92 +2735,8 @@
 l()%0A
-            .antMatchers(%22/management/**%22).hasAuthority(AuthoritiesConstants.ADMIN)%0A
     
@@ -2776,29 +2776,8 @@
 ed()
- // always at the end
 %0A   

Change security filters to protect config endpoints