1 | package finki.it.phoneluxbackend.security.configs;
|
---|
2 |
|
---|
3 | import finki.it.phoneluxbackend.security.CustomAuthenticationFilter;
|
---|
4 | import finki.it.phoneluxbackend.security.CustomAuthorizationFilter;
|
---|
5 | import finki.it.phoneluxbackend.services.UserService;
|
---|
6 | import lombok.AllArgsConstructor;
|
---|
7 | import org.springframework.context.annotation.Bean;
|
---|
8 | import org.springframework.context.annotation.Configuration;
|
---|
9 | import org.springframework.security.authentication.AuthenticationManager;
|
---|
10 | import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
|
---|
11 | import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
---|
12 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
---|
13 | import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
---|
14 | import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
---|
15 | import org.springframework.security.config.http.SessionCreationPolicy;
|
---|
16 | import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
---|
17 | import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
---|
18 |
|
---|
19 | import static org.springframework.http.HttpMethod.GET;
|
---|
20 |
|
---|
21 | @Configuration
|
---|
22 | @AllArgsConstructor
|
---|
23 | @EnableWebSecurity
|
---|
24 | public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
---|
25 |
|
---|
26 | private final UserService userService;
|
---|
27 | private final BCryptPasswordEncoder bCryptPasswordEncoder;
|
---|
28 |
|
---|
29 | @Override
|
---|
30 | protected void configure(HttpSecurity http) throws Exception {
|
---|
31 |
|
---|
32 |
|
---|
33 | http.csrf().disable();
|
---|
34 | http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
|
---|
35 |
|
---|
36 | http.authorizeRequests()
|
---|
37 | .and()
|
---|
38 | .authorizeRequests()
|
---|
39 | .antMatchers("/user/**")
|
---|
40 | .hasAnyAuthority("USER","ADMIN", "SUPERADMIN")
|
---|
41 | .and()
|
---|
42 | .authorizeRequests()
|
---|
43 | .antMatchers("/management/**")
|
---|
44 | .hasAnyAuthority("SUPERADMIN")
|
---|
45 | .and()
|
---|
46 | .authorizeRequests()
|
---|
47 | .antMatchers("/admin/**")
|
---|
48 | .hasAnyAuthority("ADMIN","SUPERADMIN")
|
---|
49 | .anyRequest().permitAll();
|
---|
50 |
|
---|
51 |
|
---|
52 |
|
---|
53 | http.addFilter(new CustomAuthenticationFilter(authenticationManagerBean()));
|
---|
54 | http.addFilterBefore(new CustomAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class);
|
---|
55 |
|
---|
56 | }
|
---|
57 |
|
---|
58 | @Override
|
---|
59 | protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
---|
60 | auth.authenticationProvider(daoAuthenticationProvider());
|
---|
61 | }
|
---|
62 |
|
---|
63 | @Bean
|
---|
64 | @Override
|
---|
65 | public AuthenticationManager authenticationManagerBean() throws Exception {
|
---|
66 | return super.authenticationManagerBean();
|
---|
67 | }
|
---|
68 |
|
---|
69 | public DaoAuthenticationProvider daoAuthenticationProvider(){
|
---|
70 | DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
|
---|
71 | provider.setPasswordEncoder(bCryptPasswordEncoder);
|
---|
72 | provider.setUserDetailsService(userService);
|
---|
73 | return provider;
|
---|
74 | }
|
---|
75 |
|
---|
76 | }
|
---|