// Path: src/main/java/co/lilpilot/blog/security/AuthenticationTokenFilter.java
// @Component
// public class AuthenticationTokenFilter extends OncePerRequestFilter {
// 
//     private String tokenHeader = "Authorization";
// 
//     @Autowired
//     private JwtTokenUtil jwtTokenUtil;
//     @Autowired
//     private CustomUserDetailsService userDetailsService;
// 
//     @Override
//     protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
//         String authToken = httpServletRequest.getHeader(this.tokenHeader);
//         // authToken.startsWith("Bearer ")
//         // String authToken = header.substring(7);
//         String username = jwtTokenUtil.getUsernameFromToken(authToken);
// 
// //        System.out.println("checking authentication for user " + username);
// 
//         if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
// 
//             // It is not compelling necessary to load the use details from the database. You could also store the information
//             // in the token and read it from it. It's up to you ;)
//             UserDetails userDetails = userDetailsService.loadUserByUsername(username);
// 
//             // For simple validation it is completely sufficient to just check the token integrity. You don't have to call
//             // the database compellingly. Again it's up to you ;)
//             if (jwtTokenUtil.validateToken(authToken, userDetails)) {
//                 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
//                 authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpServletRequest));
//                 System.out.println("authenticated user " + username + ", setting security context");
//                 SecurityContextHolder.getContext().setAuthentication(authentication);
//             }
//         }
// 
//         filterChain.doFilter(httpServletRequest, httpServletResponse);
//     }
// }
// 
// Path: src/main/java/co/lilpilot/blog/security/CustomUserDetailsService.java
// @Service
// public class CustomUserDetailsService implements UserDetailsService {
// 
//     @Autowired
//     private UserService userService;
// 
//     @Override
//     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//         User user = userService.getByUsername(username);
//         if (user == null) {
//             throw new UsernameNotFoundException("username not found:" + username);
//         }
//         /*
//         * 例如：
//         * 在使用hasRole('ADMIN')时
//         * spring security会加上ROLE_即ROLE_ADMIN去校对 所以手动加上ROLE_
//         * */
//         return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPasswordHashed(), AuthorityUtils.createAuthorityList("ROLE_" + user.getRole()));
//     }
// }
// 
// Path: src/main/java/co/lilpilot/blog/security/UnauthorizedHandler.java
// @Component
// public class UnauthorizedHandler implements AuthenticationEntryPoint {
//     @Override
//     public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
//         // This is invoked when user tries to access a secured REST resource without supplying any credentials
//         // We should just send a 401 Unauthorized response because there is no 'login page' to redirect to
//         httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
//     }
// }


import co.lilpilot.blog.security.AuthenticationTokenFilter;
import co.lilpilot.blog.security.CustomUserDetailsService;
import co.lilpilot.blog.security.UnauthorizedHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
package co.lilpilot.blog.config;


/**
 * Created by lilpilot on 2017/5/1.
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService userDetailsService;
    @Autowired
// Path: src/main/java/co/lilpilot/blog/security/AuthenticationTokenFilter.java
// @Component
// public class AuthenticationTokenFilter extends OncePerRequestFilter {
// 
//     private String tokenHeader = "Authorization";
// 
//     @Autowired
//     private JwtTokenUtil jwtTokenUtil;
//     @Autowired
//     private CustomUserDetailsService userDetailsService;
// 
//     @Override
//     protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
//         String authToken = httpServletRequest.getHeader(this.tokenHeader);
//         // authToken.startsWith("Bearer ")
//         // String authToken = header.substring(7);
//         String username = jwtTokenUtil.getUsernameFromToken(authToken);
// 
// //        System.out.println("checking authentication for user " + username);
// 
//         if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
// 
//             // It is not compelling necessary to load the use details from the database. You could also store the information
//             // in the token and read it from it. It's up to you ;)
//             UserDetails userDetails = userDetailsService.loadUserByUsername(username);
// 
//             // For simple validation it is completely sufficient to just check the token integrity. You don't have to call
//             // the database compellingly. Again it's up to you ;)
//             if (jwtTokenUtil.validateToken(authToken, userDetails)) {
//                 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
//                 authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(httpServletRequest));
//                 System.out.println("authenticated user " + username + ", setting security context");
//                 SecurityContextHolder.getContext().setAuthentication(authentication);
//             }
//         }
// 
//         filterChain.doFilter(httpServletRequest, httpServletResponse);
//     }
// }
// 
// Path: src/main/java/co/lilpilot/blog/security/CustomUserDetailsService.java
// @Service
// public class CustomUserDetailsService implements UserDetailsService {
// 
//     @Autowired
//     private UserService userService;
// 
//     @Override
//     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//         User user = userService.getByUsername(username);
//         if (user == null) {
//             throw new UsernameNotFoundException("username not found:" + username);
//         }
//         /*
//         * 例如：
//         * 在使用hasRole('ADMIN')时
//         * spring security会加上ROLE_即ROLE_ADMIN去校对 所以手动加上ROLE_
//         * */
//         return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPasswordHashed(), AuthorityUtils.createAuthorityList("ROLE_" + user.getRole()));
//     }
// }
// 
// Path: src/main/java/co/lilpilot/blog/security/UnauthorizedHandler.java
// @Component
// public class UnauthorizedHandler implements AuthenticationEntryPoint {
//     @Override
//     public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
//         // This is invoked when user tries to access a secured REST resource without supplying any credentials
//         // We should just send a 401 Unauthorized response because there is no 'login page' to redirect to
//         httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
//     }
// }


// Path: src/main/java/co/lilpilot/blog/config/SecurityConfig.java
import co.lilpilot.blog.security.AuthenticationTokenFilter;
import co.lilpilot.blog.security.CustomUserDetailsService;
import co.lilpilot.blog.security.UnauthorizedHandler;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

package co.lilpilot.blog.config;


/**
 * Created by lilpilot on 2017/5/1.
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService userDetailsService;
    @Autowired
    private UnauthorizedHandler unauthorizedHandler;