package com.system.oauth.config;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;

//
@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    private static final String DEMO_RESOURCE_ID = "auth-resource";
//    @Autowired
//    private TokenStore jwtTokenStore;
//    @Autowired
//    private JwtAccessTokenConverter jwtAccessTokenConverter;
//    @Bean
//    public ResourceServerTokenServices tokenService() {
//        DefaultTokenServices service = new DefaultTokenServices();
//
//        service.setTokenStore(jwtTokenStore);//令牌存储策略
//
////        service.setTokenEnhancer(jwtAccessTokenConverter);
//        return service;
//    }

    //    @Override
//    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
//        resources.tokenStore(jwtTokenStore)
//                .resourceId(DEMO_RESOURCE_ID).tokenServices(tokenService());
//    }
    @Value("${spring.profiles.active}")
    private String active;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        //oauth2添加异常信息管理
        resources.authenticationEntryPoint(new CustomAuthenticationEntryPoint());
        //添加认证管理器 解决带过期token请求免登录接口被拦截
        resources.authenticationManager(new BigOAuth2AuthenticationManager());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        if (active.equals("test")) {
            http.authorizeRequests().anyRequest().permitAll() .and().csrf().disable()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        } else {
            http.authorizeRequests()
//                .antMatchers(FeignInsideAuthConfig.FEIGN_INSIDE_URL_PREFIX+"/**").permitAll()
                    .antMatchers("/auth/login").permitAll()//登录接口
                    .antMatchers("/auth/getCaptcha").permitAll()
                    .antMatchers("/user/image").permitAll()
                    .antMatchers("/swagger-ui.html", "/webjars/**", "/swagger-resources/**", "/v2/**", "doc.html", "/").permitAll()
                    .antMatchers("/test").permitAll()
                    .antMatchers("/webSocketApi/**").permitAll()
                    .antMatchers("/websocket/**").permitAll()
                    .antMatchers("/api/lic/online/verification").permitAll()
                    .anyRequest().authenticated()
//                .antMatchers("/**").access("#oauth2.hasScope('ROLE_ADMIN')")
                    .and().csrf().disable()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        }
    }
}