package com.infoclinika.pdx.config;

import com.infoclinika.pdx.domain.user.UserAccount;
import com.infoclinika.pdx.repository.user.UserAccountRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Scope;
import org.springframework.context.annotation.ScopedProxyMode;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.context.WebApplicationContext;

/**
 * Spring Security Configuration.
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserAccountRepository userAccountRepository;

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    @Scope(value = WebApplicationContext.SCOPE_REQUEST, proxyMode = ScopedProxyMode.TARGET_CLASS)
    public UserAccount getCurrentUser() {
        final String username = SecurityContextHolder.getContext().getAuthentication().getName();
        return userAccountRepository.findOneByUsername(username);
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return userDetailsService;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(userDetailsService());
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        authenticationProvider.setHideUserNotFoundExceptions(false);

        return authenticationProvider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());

        //+++ replace with I don't know yet (LDAP? SSO?)
        auth.inMemoryAuthentication()
            .withUser("second")
            .password(passwordEncoder().encode("power$2power$3"))
            .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers(HttpMethod.PUT, "/api/user/profile").hasAnyRole("USER", "ADMIN")
            .antMatchers(HttpMethod.GET, "/api/sharedview/**").permitAll()
            .antMatchers("/api/sharedview/**").hasAnyRole("USER", "ADMIN")
            .antMatchers(HttpMethod.GET, "/api/user/sharedview/**").hasAnyRole("USER", "ADMIN")
            .antMatchers(HttpMethod.POST, "/api/user/upload/**").hasAnyRole("USER", "ADMIN")
            .antMatchers("/api/user/project/**").hasAnyRole("USER", "ADMIN")
            .antMatchers("/api/user/dataset/**").hasAnyRole("USER", "ADMIN")
            .antMatchers("/api/user/list").hasAnyRole("ADMIN")
            .and()
            .csrf().disable();
    }
}