package com.informatica.cep.design.custom.application.security.web;

import java.util.Arrays;
import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedCredentialsNotFoundException;
import org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter;
import org.springframework.util.Assert;

import com.informatica.cep.design.application.security.entities.DTUser;

/**
 * supports multiple request headers and onAuthenticationSuccessHandler to put the currentLoggedInUser in Session
 * @author suyadav
 *
 */
public class OAMAuthenticationFilter extends RequestHeaderAuthenticationFilter {
	
	//principal name can be in any one of these headers
	private List<String> principalRequestHeaders = Arrays.asList("REMOTE_USER","HTTP_LOGIN","HTTPS_LOGIN","LOGIN");
	private boolean exceptionIfHeaderMissing = true;
	
	 @Override
	   protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
		 String principal = null;
		 
		 for(String currHdr:principalRequestHeaders){
			 principal = request.getHeader(currHdr);
			 
			 if(principal == null){
				 logger.warn("Failed to find request header "+currHdr);
			 }else{
				 logger.debug((new StringBuilder()).append("Found user id: ").append(principal).toString());
				 break;
			 }
		 }
        if (principal == null && exceptionIfHeaderMissing) {
	            throw new PreAuthenticatedCredentialsNotFoundException(principalRequestHeaders
	                    + " header not found in request.");
	        }

	        return principal;
	    }
 //this method override will be unnecessary if we in CurrentSessionInfoController we pick details from SecurityContextHolder

	@Override
	protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) {
		super.successfulAuthentication(request, response, authResult);
		DTUser currUser = (DTUser)authResult.getPrincipal();
		HttpSession currSess = request.getSession(false);
		currSess.setAttribute("loggedInUser", currUser);
	}
public List<String> getPrincipalRequestHeaders() {
		return principalRequestHeaders;
	}

	public void setPrincipalRequestHeaders(List<String> principalRequestHeaders) {
		 Assert.notEmpty(principalRequestHeaders, "principalRequestHeaders must not be empty or null");
		this.principalRequestHeaders = principalRequestHeaders;
	}

	@Override
	public void setExceptionIfHeaderMissing(boolean exceptionIfHeaderMissing) {
		super.setExceptionIfHeaderMissing(exceptionIfHeaderMissing);
		this.exceptionIfHeaderMissing = exceptionIfHeaderMissing;
	}
}