@Configuration
@EnableWebSecurity
public class SecurityConfig {

  @Value("${asimiotech.security.digest.key}")
  private String digestKey;

  @Value("${asimiotech.security.digest.nonce-validity-seconds:300}")
  private int digestNonceValiditySeconds;

  @Bean
  public PasswordEncoder noOpPasswordEncoder() {
    return NoOpPasswordEncoder.getInstance();
  }

  @Bean
  @Primary
  // Compatible with adding more password encoders in the future
  public PasswordEncoder passwordEncoderDelegate() {
    // Other password encoders
    // ...
    PasswordEncoder noOpPasswordEncoder = this.noOpPasswordEncoder();

    Map<String, PasswordEncoder> encoders = new HashMap<>();
    // ...
    encoders.put("noop", noOpPasswordEncoder);
    encoders.put(null, noOpPasswordEncoder);

    // bcrypt for instance
    return new DelegatingPasswordEncoder("<other than noop>", encoders);
  }

  @Bean
  public UserDetailsService userDetailsService() {
    UserDetails user1 = User.builder()
      .username("username")
      .password("password") // Has to be plain text, without {noop} prefix
      .roles("USER_ROLE")
      .build();
    return new InMemoryUserDetailsManager(user1);
  }

  @Bean
  public DigestAuthenticationEntryPoint digestAuthenticationEntryPoint() {
    DigestAuthenticationEntryPoint result = new DigestAuthenticationEntryPoint();
    result.setRealmName("Access to Web and API protected resources via Digest Auth");
    result.setNonceValiditySeconds(this.digestNonceValiditySeconds);
    result.setKey(this.digestKey);
    return result;
  }

  @Bean
  public DigestAuthenticationFilter digestAuthenticationFilter() {
    DigestAuthenticationFilter result = new DigestAuthenticationFilter();
    result.setUserDetailsService(this.userDetailsService());
    result.setAuthenticationEntryPoint(this.digestAuthenticationEntryPoint());
    result.setCreateAuthenticatedToken(true);
    return result;
  }

  @Bean
  public SecurityFilterChain basicSecurityFilterChain(HttpSecurity http) throws Exception {
    http
      .csrf(CsrfConfigurer::disable)
      .authorizeHttpRequests(authorize -> {
        authorize
          .requestMatchers(
            "/css/**",
            "/error",
            "/favicon.ico",
            "/public/**",
            "/webjars/**"
          )
            .permitAll()
          .anyRequest()
            .authenticated();
    })
    .exceptionHandling(ex ->
      ex.authenticationEntryPoint(this.digestAuthenticationEntryPoint())
    )
    .addFilter(this.digestAuthenticationFilter());
    return http.build();
  }

}