package org.berzerkula.builddb.config;

import org.berzerkula.builddb.BuilddbConstants;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

	@Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests( auth -> auth
                		.requestMatchers("/").permitAll()
						.requestMatchers("/actuator/**").hasRole(BuilddbConstants.ROLE_ADMIN)
						.requestMatchers("/env/**").hasRole(BuilddbConstants.ROLE_ADMIN)
						.requestMatchers("/health/**").hasRole(BuilddbConstants.ROLE_ADMIN)
						.requestMatchers("/info/**").hasRole(BuilddbConstants.ROLE_ADMIN)
                		.requestMatchers("/contact").permitAll()
	                    .requestMatchers("/pkgs/**").hasRole(BuilddbConstants.ROLE_CLIENT)
	                    .requestMatchers("/register").permitAll()
	                    .requestMatchers("/login").permitAll()
	                    .requestMatchers("/logout").permitAll()
	                    .anyRequest().authenticated()
                )
                .formLogin(form -> form
                		.loginPage("/login")
                		.usernameParameter("email")
                		.passwordParameter("password")
                		.defaultSuccessUrl("/", true)
                )
                .logout(config -> config.logoutSuccessUrl("/"))
        		.build();
    }
	
	
	@Bean
	public PasswordEncoder passwordEncoder() {
	    return new BCryptPasswordEncoder();
	}
}