package org.berzerkula.builddb.config;

import org.berzerkula.builddb.BuilddbConstants;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

	@Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
				.securityMatcher("/**")
				//.requiresChannel(channel -> channel.anyRequest().requiresSecure())
                .authorizeHttpRequests( auth -> auth
                		.requestMatchers("/").permitAll()
						.requestMatchers("/actuator/health","/actuator/info").permitAll()
						.requestMatchers("/actuator/beans", "/actuator/env", "actuator/metrics", "/actuator/shutdown").hasRole(BuilddbConstants.ROLE_ADMIN)
						.requestMatchers("/contact").permitAll()
	                    .requestMatchers("/pkgs/**").hasRole(BuilddbConstants.ROLE_CLIENT)
	                    .requestMatchers("/register").permitAll()
	                    .requestMatchers("/login").permitAll()
	                    .requestMatchers("/logout").permitAll()
	                    .anyRequest().authenticated()
                )
				.csrf(csrf -> csrf
						.ignoringRequestMatchers("/actuator/shutdown"))
                .formLogin(form -> form
                		.loginPage("/login")
                		.usernameParameter("email")
                		.passwordParameter("password")
                		.defaultSuccessUrl("/", true)
                )
				.headers(headers -> headers
						.httpStrictTransportSecurity(hsts -> hsts
								.includeSubDomains(true)
								.maxAgeInSeconds(40)
								.preload(false)))
                .logout(config -> config.logoutSuccessUrl("/"))
				.build();
    }

	@Bean
	public PasswordEncoder passwordEncoder() {
	    return new BCryptPasswordEncoder();
	}
}