1 package fr.tiogars.inception.config;
2
3 import org.springframework.context.annotation.Bean;
4 import org.springframework.context.annotation.Configuration;
5 import org.springframework.http.HttpMethod;
6 import org.springframework.security.authentication.AuthenticationManager;
7 import org.springframework.security.config.Customizer;
8 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
9 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
10 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
11 import org.springframework.security.config.http.SessionCreationPolicy;
12 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
13 import org.springframework.security.crypto.password.PasswordEncoder;
14 import org.springframework.security.web.SecurityFilterChain;
15 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
16
17 import fr.tiogars.inception.domains.auth.services.JwtAuthenticationFilter;
18
19
20 @Configuration
21 @EnableMethodSecurity
22 class SecurityConfiguration {
23
24 @Bean
25 SecurityFilterChain securityFilterChain(HttpSecurity http, JwtAuthenticationFilter jwtAuthenticationFilter) throws Exception {
26 return http
27 .csrf(csrf -> csrf.disable())
28 .cors(Customizer.withDefaults())
29 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
30 .authorizeHttpRequests(authorize -> authorize
31 .requestMatchers(HttpMethod.POST, "/api/v1/auth/login").permitAll()
32 .requestMatchers("/actuator/health", "/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html").permitAll()
33 .requestMatchers(HttpMethod.GET, "/api/v1/domaintemplate/export.*").hasRole("ADMIN")
34 .requestMatchers(HttpMethod.GET, "/api/v1/domaintemplate/*/print.pdf").hasAnyRole("ADMIN", "USER")
35 .requestMatchers(HttpMethod.POST, "/api/v1/domaintemplate/print-selected.pdf").hasAnyRole("ADMIN", "USER")
36 .requestMatchers(HttpMethod.GET, "/api/v1/domaintemplate", "/api/v1/domaintemplate/*").hasAnyRole("ADMIN", "USER")
37 .requestMatchers("/api/v1/domaintemplate", "/api/v1/domaintemplate/**").hasRole("ADMIN")
38 .requestMatchers("/api/v1/auth/users", "/api/v1/auth/users/**").hasRole("ADMIN")
39 .requestMatchers("/api/v1/auth/roles", "/api/v1/auth/roles/**").hasRole("ADMIN")
40 .requestMatchers("/api/v1/auth/me").authenticated()
41 .requestMatchers(HttpMethod.GET, "/api/v1/settings/user/anonymous").permitAll()
42 .requestMatchers("/api/v1/settings/user/anonymous", "/api/v1/settings/user/users/**").hasRole("ADMIN")
43 .requestMatchers("/api/v1/settings/user/me").hasAnyRole("ADMIN", "USER")
44 .anyRequest().authenticated())
45 .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
46 .build();
47 }
48
49 @Bean
50 AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
51 return authenticationConfiguration.getAuthenticationManager();
52 }
53
54 @Bean
55 PasswordEncoder passwordEncoder() {
56 return new BCryptPasswordEncoder();
57 }
58 }