
package com.ejie.ab79.rest.configuracion;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.session.SessionManagementFilter;

	/**
	 * Clase para especificar la configuración de accesos a los recursos del API Rest
	 * 
	 *  
	 *
	 */
@EnableWebSecurity
@Configuration

public	class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	
	
	

	    @Bean
	    CorsFilter corsFilter() {
	        CorsFilter filter = new CorsFilter();
	        return filter;
	    }

	
		/**
		 *  Clase para especificar la configuración de accesos a los recursos del API Rest.
		 *  Se permiten todas las llamadas al controlador /user/login,
		 *  pero el resto de las llamadas requieren autenticación.
 		 */
		@Override
		protected void configure(HttpSecurity http) throws Exception {
			
			
			http.csrf().disable()
			.addFilterBefore(corsFilter(), SessionManagementFilter.class)
			.addFilterAfter(new JWTAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class)
			.authorizeRequests()
			.antMatchers(HttpMethod.POST, "/user/login").permitAll()
			.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
			.anyRequest().authenticated();
		   
		}
	}

