/*
    * Copyright 2018-2022 Medical Information Systems Research Group (https://medical.zcu.cz),
    * Department of Computer Science and Engineering, University of West Bohemia.
    * Address: Univerzitni 8, 306 14 Plzen, Czech Republic.
    *
    * Author Petr Vcelak (vcelak@kiv.zcu.cz).
    *
    * This file is part of MRECore project.
    *
   * MRECore is free software: you can redistribute it and/or modify
   * it under the terms of the GNU General Public License as published by
   * the Free Software Foundation, either version 3 of the License.
   *
   * MRECore is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
   * GNU General Public License for more details.
   *
   * You should have received a copy of the GNU General Public License
   * along with MRECore. If not, see <http://www.gnu.org/licenses/>.
   */
  package cz.zcu.mre.config;
  
  import cz.zcu.mre.service.account.AccountService;
  import cz.zcu.mre.service.account.AccountServiceImpl;
  import cz.zcu.mre.service.data.MREDataService;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.core.Ordered;
  import org.springframework.core.annotation.Order;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  import org.springframework.security.web.SecurityFilterChain;
  import org.springframework.security.web.access.AccessDeniedHandler;
  import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;
  
  /**
   * SecurityConfiguration with Spring Security 5.
   * 
   * @author Petr Vcelak (vcelak@kiv.zcu.cz)
   */
  @Configuration
  @EnableWebSecurity
  //@EnableGlobalMethodSecurity(securedEnabled = true)
  @Order(value = Ordered.LOWEST_PRECEDENCE)
  public class SecurityConfiguration  {
  
      private static final Logger LOG = LoggerFactory.getLogger(SecurityConfiguration.class);
  
      @Autowired
      private MREDataService dataService;
  
      private AccountService accountService;
  
      @Bean
      public AccountService accountService() {
  
          if (accountService == null) {
              LOG.info("Create bean accountService");
              accountService = new AccountServiceImpl(dataService, passwordEncoder());
          }
  
          return accountService;
      }
  
      @Bean
      public TokenBasedRememberMeServices rememberMeServices() {
          return new TokenBasedRememberMeServices("remember-me-key", accountService());
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
  
          return new BCryptPasswordEncoder();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .eraseCredentials(true)
                  .userDetailsService(accountService())
                  .passwordEncoder(passwordEncoder());
      }
  
      @Bean
      public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
          http
                  .csrf()
                  .ignoringRequestMatchers("/api/**")
                  .and()
                  .exceptionHandling().accessDeniedHandler(accessDeniedHandler())
                  .and()
                  .authorizeHttpRequests()
                 .requestMatchers("/", "/login", "/registration", "/favicon.ico", "/resources/**", "/api/**").permitAll()
                 .requestMatchers("/api/**").permitAll()
                 .anyRequest().authenticated()
                 .and()
                 .formLogin()
                 .loginPage("/login").permitAll()
                 //.failureUrl("/login?error=1")
                 .failureForwardUrl("/login?error=1")
                 .loginProcessingUrl("/authenticate")
                 .and()
                 .logout()
                 .logoutUrl("/logout").permitAll()
                 .logoutSuccessUrl("/login?logout")
                 .and()
                 .rememberMe()
                 .rememberMeServices(rememberMeServices())
                 .key("remember-me-key")
                 .and()
                 .headers().frameOptions().sameOrigin(); // allows iframe content from the same origin
         return http.build();
     }
 
     @Bean
     public AccessDeniedHandler accessDeniedHandler() {
         return new cz.zcu.mre.security.AccessDeniedHandler();
     }
 }