package com.orange.oss.cloudfoundry.cscpi.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
public class WebSecurityConfig {


    @Value("${cpi.core.user}")
    private String coreUser;
    @Value("${cpi.core.password}")
    private String corePassword;
	
	
    @Value("${cpi.registry.user}")
    private String registryUser;
    @Value("${cpi.registry.password}")
    private String registryPassword;

    
    
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser(coreUser).password(corePassword).roles("CORE");
        auth.inMemoryAuthentication().withUser(registryUser).password(registryPassword).roles("REGISTRY");
    }


    @Configuration
    @Order(1)
    public static class ServiceBrokerSecurity extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .antMatcher("/cpi/**")
                    .authorizeRequests()
                    .anyRequest()
                    .hasRole("CORE")
                    .and()
                    .httpBasic()
                    .and()
                    .csrf().disable();
        }
    }
    
    @Configuration
    @Order(2)
    public static class RegistrySecurity extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .antMatcher("/instances/**")
                    .authorizeRequests()
                    .anyRequest()
                    .hasRole("REGISTRY")
                    .and()
                    .httpBasic()
                    .and()
                    .csrf().disable();
        }
    }
    
}

@@ -2361,20 +2361,547 @@
      %7D%0A    %7D
+%0A%0A    @Configuration%0A    @Order(3)%0A    public static class AdminSecurity extends WebSecurityConfigurerAdapter %7B%0A%0A        @Override%0A        protected void configure(HttpSecurity http) throws Exception %7B%0A            http%0A                    .antMatcher(%22/admin/**%22)%0A                    .authorizeRequests()%0A                    .anyRequest()%0A                    .hasRole(%22CORE%22)%0A                    .and()%0A                    .httpBasic()%0A                    .and()%0A                    .csrf().disable();%0A        %7D%0A    %7D%0A    %0A    
 %0A    %0A%7D%0A

secure /admin with cpi-core basic-auth