javadev / pt-backend

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity

@Configuration

    @Autowired private UserDetailsService userDetailsService;

    @Autowired private CustomLoginSuccessHandler loginSuccessHandler;

    @Autowired private CustomLoginFailureHandler loginFailureHandler;

    @Autowired private CustomLogoutSuccessHandler logoutSuccessHandler;

    @Autowired private CustomAuthenticationEntryPoint authenticationEntryPoint;

    @Bean

    PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.csrf()

                .disable()

                .authorizeRequests()

                .antMatchers("/public/**")

                .permitAll()

                .antMatchers("/api/v1/admin/**", "/api/v1/auth/**")

                .fullyAuthenticated()

                .and()

                .formLogin()

                .loginPage("/login")

                .failureUrl("/login?error")

                .permitAll()

                .successHandler(loginSuccessHandler)

                .failureHandler(loginFailureHandler)

                .and()

                .logout()

                .permitAll()

                .logoutSuccessHandler(logoutSuccessHandler);

        http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);

    }

}