package xxx.jq.config

import org.springframework.beans.factory.annotation.Autowired
import org.springframework.boot.autoconfigure.security.SecurityProperties
import org.springframework.context.annotation.Configuration
import org.springframework.core.annotation.Order
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
import xxx.jq.service.AccountService

/**
 * セキュリティ関係のconfig
 * @author rinp
 * @since 2015/10/08
 */
@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
open class SecurityConfiguration : WebSecurityConfigurerAdapter() {
    @Autowired
    lateinit var bcryptEncoder: BCryptPasswordEncoder

    @Autowired
    lateinit private var accountService: AccountService

    @Throws(Exception::class)
    override fun configure(auth: AuthenticationManagerBuilder) {
        auth.userDetailsService<AccountService>(accountService).passwordEncoder(bcryptEncoder)
    }

    @Throws(Exception::class)
    override fun configure(http: HttpSecurity) {
        http.httpBasic().disable()
        http.csrf().disable()
        http.anonymous().principal(accountService.findSystemAccount())
        http.sessionManagement().maximumSessions(30)
    }
}