package de.oaa.xxx.config;

import jakarta.servlet.DispatcherType;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final JwtFilter jwtFilter;

    public SecurityConfig(JwtFilter jwtFilter) {
        this.jwtFilter = jwtFilter;
    }

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint((request, response, authException) ->
                    response.sendRedirect("/login.html")))
            .authorizeHttpRequests(auth -> auth
                .dispatcherTypeMatchers(DispatcherType.ASYNC, DispatcherType.ERROR).permitAll()
                .requestMatchers("/").permitAll()
                .requestMatchers("/error").permitAll()
                .requestMatchers("/api").permitAll()
                .requestMatchers("/userhome.html").authenticated()
                .requestMatchers("/toys.html").authenticated()
                .requestMatchers("/aufgaben.html").authenticated()
                .requestMatchers("/entdecken.html").authenticated()
                .requestMatchers("/profile.html").authenticated()
                .requestMatchers("/infovanilla.html").authenticated()
                .requestMatchers("/infobdsm.html").authenticated()
                .requestMatchers("/infochastity.html").authenticated()
                .requestMatchers("/sessionvanilla.html").authenticated()
                .requestMatchers("/sessionbdsm.html").authenticated()
                .requestMatchers("/sessionchastity.html").authenticated()
                .requestMatchers("/neulock.html").authenticated()
                .requestMatchers("/activelock.html").authenticated()
                .requestMatchers("/sessionbdsmtasks.html").authenticated()
                .requestMatchers("/sessionbdsmtoys.html").authenticated()
                .requestMatchers("/sessionbdsmingame.html").authenticated()
                .requestMatchers("/neubdsm.html").authenticated()
                .requestMatchers("/bdsmingame.html").authenticated()
                .requestMatchers("/bdsmwarten.html").authenticated()
                .requestMatchers("/personen-suchen.html").authenticated()
                .requestMatchers("/freunde.html").authenticated()
                .requestMatchers("/nachrichten.html").authenticated()
                .requestMatchers("/benutzer.html").authenticated()
                .requestMatchers("/gruppen.html").authenticated()
                .requestMatchers("/gruppe.html").authenticated()
                .requestMatchers("/feed.html").authenticated()
                .requestMatchers("/admin.html").authenticated()
                .requestMatchers("/communityvotes.html").authenticated()
                .requestMatchers("/keyholder.html").authenticated()
                .requestMatchers("/keyholder-finden.html").authenticated()
                .requestMatchers("/meine-locks.html").authenticated()
                .requestMatchers("/entdecken-vorlagen.html").authenticated()
                .requestMatchers("/unlock-history.html").authenticated()
                .requestMatchers("/einladungen.html").authenticated()
                .requestMatchers("/joinlock.html").authenticated()
                .requestMatchers("/benachrichtigungen.html").authenticated()
                .requestMatchers("/abonnements.html").authenticated()
                .requestMatchers("/gruppen/**").authenticated()
                .requestMatchers("/feed/**").authenticated()
                .requestMatchers("/notifications/**").authenticated()
                .requestMatchers("/events/**").authenticated()
                .requestMatchers("/*.html").permitAll()
                .requestMatchers("/help/*.html").permitAll()
                .requestMatchers("/css/**").permitAll()
                .requestMatchers("/js/**").permitAll()
                .requestMatchers("/images/**").permitAll()
                .requestMatchers("/img/**").permitAll()
                .requestMatchers("/favicon.ico").permitAll()
                .requestMatchers("/audio/**").permitAll()
                .requestMatchers("/*.png").permitAll()
                .requestMatchers("/*.jpg").permitAll()
                .requestMatchers("/*.svg").permitAll()
                .requestMatchers("/*.webp").permitAll()
                .requestMatchers(HttpMethod.GET, "/login").permitAll()
                .requestMatchers(HttpMethod.GET, "/ttlock").permitAll()
                .requestMatchers(HttpMethod.POST, "/login").permitAll()
                .requestMatchers(HttpMethod.GET, "/login/publickey").permitAll()
                .requestMatchers(HttpMethod.GET, "/login/logout").permitAll()
                .requestMatchers(HttpMethod.POST, "/user").permitAll()
                .requestMatchers(HttpMethod.GET, "/registration").permitAll()
                .requestMatchers(HttpMethod.POST, "/registration").permitAll()
                .requestMatchers(HttpMethod.GET, "/activation").permitAll()
                .requestMatchers(HttpMethod.GET, "/activation/**").permitAll()
                .requestMatchers(HttpMethod.POST, "/password-reset/request").permitAll()
                .requestMatchers(HttpMethod.POST, "/password-reset/confirm").permitAll()
                .requestMatchers(HttpMethod.GET, "/email-change/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/keyholder/invitation/**").permitAll()
                .requestMatchers(HttpMethod.POST, "/api/feedback").permitAll()
                .requestMatchers(HttpMethod.POST, "/filler").permitAll()
                .requestMatchers(HttpMethod.POST, "/api/ttlock/callback").permitAll() 
                .requestMatchers(HttpMethod.GET, "/api/ttlock/callback").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}
