package com.objecteye.config;

import com.objecteye.common.ResultCode;
import com.objecteye.service.impl.UserDetailServiceImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.jwt.crypto.sign.RsaSigner;
import org.springframework.security.jwt.crypto.sign.RsaVerifier;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RsaVerifier verifier;

    @Autowired
    private RsaSigner signer;

    @Autowired
    private UserDetailServiceImpl userDetailService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        AuthenticationLoginFilter authenticationLoginFilter = new AuthenticationLoginFilter();
        authenticationLoginFilter.setAuthenticationManager(this.authenticationManagerBean());

        LoginSuccessHandler loginSuccessHandler = new LoginSuccessHandler();
        loginSuccessHandler.setSigner(signer);
        authenticationLoginFilter.setAuthenticationSuccessHandler(loginSuccessHandler);
        authenticationLoginFilter.setAuthenticationFailureHandler(new LoginFailureHandler());

        AuthenticationProviderConfig provider = new AuthenticationProviderConfig();
        provider.setPasswordEncoder(passwordEncoder());
        provider.setUserDetailsService(userDetailService);

        AuthenticationHeadFilter headFilter = new AuthenticationHeadFilter();
        headFilter.setRsaVerifier(verifier);

        http.exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write(ResultCode.UNAUTHORIZED.getMessage());
        })
                .accessDeniedHandler((httpServletRequest, httpServletResponse, accessDeniedException) -> {
                    httpServletResponse.setContentType("application/json;charset=UTF-8");
                    httpServletResponse.getWriter().write(ResultCode.FORBIDDEN.getMessage());
                })
                .and()
                .authorizeRequests()
                .anyRequest().access("@accessConfirmService.hasPermission(request , authentication)")
                .and()
                //注册授权管理器(AuthenticationManager)
                .authenticationProvider(provider)
                .addFilterAfter(authenticationLoginFilter, UsernamePasswordAuthenticationFilter.class)
                .addFilterAfter(headFilter, AuthenticationLoginFilter.class)
                //禁用session
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .csrf().disable();
    }


    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}