package com.jh.radegast;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.jh.common.security.UserAuthenticationProvider;
import com.jh.common.security.ReactApplicationSecurityContext;



/**
 * The Class SecurityConfig.
 */
@Configuration
public class SecurityConfig extends ReactApplicationSecurityContext {

    
	
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
	        .authorizeRequests()
	        	.antMatchers("/api/auth/signup").permitAll()
	        	.antMatchers("/api/auth/**").permitAll()
	        	.antMatchers("/api/ratings").permitAll()
	        	.antMatchers("/api/**").authenticated()
	            .anyRequest().permitAll()
	            .and()
	        .addFilterBefore(authFilter(), UsernamePasswordAuthenticationFilter.class)
	        .logout()
	        	.clearAuthentication(true)
	            .permitAll();
        
        http.csrf().disable();
        http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint());
        http.headers().frameOptions().sameOrigin();
        
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
    }
    
    /**
     * @param auth
     * @throws Exception
     * @see com.jh.common.security.ReactApplicationSecurityContext#configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder)
     */
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        super.configure(auth);
        auth.authenticationProvider(userAuthenticationProvider());
    }


    /**
     * User authentication provider.
     *
     * @return the user authentication provider
     */
    @Bean
    public UserAuthenticationProvider userAuthenticationProvider() {
        return new UserAuthenticationProvider();
    }    
    
}
