package net.sumaris.server.http.security;
   
   /*-
    * #%L
    * SUMARiS:: Server
    * %%
    * Copyright (C) 2018 - 2019 SUMARiS Consortium
    * %%
    * This program is free software: you can redistribute it and/or modify
   * it under the terms of the GNU General Public License as
   * published by the Free Software Foundation, either version 3 of the
   * License, or (at your option) any later version.
   * 
   * This program is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU General Public License for more details.
   * 
   * You should have received a copy of the GNU General Public
   * License along with this program.  If not, see
   * <http://www.gnu.org/licenses/gpl-3.0.html>.
   * #L%
   */
  
  import org.apache.commons.lang3.StringUtils;
  import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.AuthenticationException;
  import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
  import org.springframework.security.web.util.matcher.RequestMatcher;
  
  import javax.servlet.FilterChain;
  import javax.servlet.ServletException;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.io.IOException;
  
  import static java.util.Optional.ofNullable;
  import static org.apache.commons.lang3.StringUtils.removeStart;
  import static org.springframework.http.HttpHeaders.AUTHORIZATION;
  
  /**
   * @author peck7 on 03/12/2018.
   */
  public class TokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
  
      private static final String TOKEN = "token";
  
      protected TokenAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher) {
          super(requiresAuthenticationRequestMatcher);
      }
  
      @Override
      public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
  
          final String param = ofNullable(request.getHeader(AUTHORIZATION))
                  .orElse(request.getParameter("t"));
  
          final String token = ofNullable(param)
                  .map(value -> removeStart(value, TOKEN))
                  .map(StringUtils::trimToNull)
                  .orElse(AnonymousUser.TOKEN);
  
          final Authentication auth = new UsernamePasswordAuthenticationToken(token, token);
          return getAuthenticationManager().authenticate(auth);
      }
  
      @Override
      protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
          super.successfulAuthentication(request, response, chain, authResult);
          chain.doFilter(request, response);
      }
  }