Fix rest auth. Review filters.

wise-webapp/src/main/java/com/wisemapping/config/Application.java

@@ -2,7 +2,7 @@ package com.wisemapping.config;
 
 import com.wisemapping.config.mvc.MvcAppConfig;
 import com.wisemapping.config.mvc.MvcSecurityConfig;
-import com.wisemapping.config.mvc.ServletConfig;
+import com.wisemapping.config.rest.ServletConfig;
 import com.wisemapping.config.rest.RestAppConfig;
 import org.springframework.boot.WebApplicationType;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
@@ -13,20 +13,15 @@ import org.springframework.context.annotation.ImportResource;
 import org.springframework.security.web.firewall.StrictHttpFirewall;
 
 @SpringBootApplication
-@ImportResource(value = {"classpath:spring/wisemapping-service.xml"})
-@ComponentScan({"com.wisemapping.security", "com.wisemapping.service", "com.wisemapping.dao", "com.wisemapping.util", "com.wisemapping.model"})
 public class Application {
 
     public static void main(String[] args) {
 
         new SpringApplicationBuilder()
-                .parent(Application.class, MethodSecurityConfig.class, HibernateConfig.class).web(WebApplicationType.NONE)
-                .child(MvcAppConfig.class, MvcSecurityConfig.class, ServletConfig.class).web(WebApplicationType.SERVLET)
-                .sibling(RestAppConfig.class).web(WebApplicationType.SERVLET)
+                .parent(MethodSecurityConfig.class, HibernateConfig.class).web(WebApplicationType.NONE)
+//                .child(MvcAppConfig.class, MvcSecurityConfig.class).web(WebApplicationType.SERVLET)
+                .child(RestAppConfig.class, ServletConfig.class).web(WebApplicationType.SERVLET)
                 .run(args);
-
-//        new SpringApplicationBuilder(Application.class, MethodSecurityConfig.class,MvcAppConfig.class, MvcSecurityConfig.class, HibernateConfig.class, ServletConfig.class).web(WebApplicationType.SERVLET).run(args);
-
     }
 
     @Bean

wise-webapp/src/main/java/com/wisemapping/config/MethodSecurityConfig.java

@@ -5,7 +5,9 @@ import com.wisemapping.security.ReadSecurityAdvise;
 import com.wisemapping.security.UpdateSecurityAdvise;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.ImportResource;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
@@ -14,6 +16,8 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
 @EnableMethodSecurity(
         securedEnabled = true,
         jsr250Enabled = true)
+@ImportResource(value = {"classpath:spring/wisemapping-service.xml"})
+@ComponentScan({"com.wisemapping.security", "com.wisemapping.service", "com.wisemapping.dao", "com.wisemapping.util", "com.wisemapping.model"})
 public class MethodSecurityConfig  {
 
     @Autowired

wise-webapp/src/main/java/com/wisemapping/config/rest/RestAppConfig.java

@@ -4,7 +4,10 @@ import org.jetbrains.annotations.NotNull;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.ImportResource;
 import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -13,32 +16,43 @@ import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
+import static org.springframework.security.config.Customizer.withDefaults;
+
 
 @SpringBootApplication
 @EnableWebSecurity
-@ComponentScan("com.wisemapping.rest")
+@ImportResource(value = {"classpath:spring/wisemapping-service.xml"})
+@ComponentScan({"com.wisemapping.rest"})
 public class RestAppConfig {
     @Bean
     @Order(2)
     SecurityFilterChain apiSecurityFilterChain(@NotNull final HttpSecurity http, @NotNull final HandlerMappingIntrospector introspector) throws Exception {
-        final MvcRequestMatcher.Builder matcher = new MvcRequestMatcher.Builder(introspector).servletPath("/service");
-        return http
-                .securityMatchers((matchers) ->
-                        matchers.requestMatchers(matcher.pattern(("/**"))))
-                .authorizeHttpRequests(auth ->
-                        auth
-                                .requestMatchers(matcher.pattern("/users/")).permitAll()
-                                .requestMatchers(matcher.pattern("/users/resetPassword")).permitAll()
-                                .requestMatchers(matcher.pattern("/oauth2/googlecallback")).permitAll()
-                                .requestMatchers(matcher.pattern("/oauth2/confirmaccountsync")).permitAll()
-                                .requestMatchers(matcher.pattern("/admin/**")).hasAnyRole("ADMIN")
-                                .requestMatchers(matcher.pattern("/**")).hasAnyRole("USER", "ADMIN")
-                )
-                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-                .httpBasic(httpBasic -> {
-                })
-                .csrf(AbstractHttpConfigurer::disable)
-                .build();
+//        final MvcRequestMatcher.Builder matcher = new MvcRequestMatcher.Builder(introspector).servletPath("**");
+//        return http
+//                .securityMatchers((matchers) ->
+//                        matchers.requestMatchers(matcher.pattern(("/**"))))
+//                .authorizeHttpRequests(auth -> auth
+//                        .requestMatchers(matcher.pattern("api/restfull/users/")).permitAll()
+//                        .requestMatchers(matcher.pattern("api/restfull/users/resetPassword")).permitAll()
+//                        .requestMatchers(matcher.pattern("api/restfull/oauth2/googlecallback")).permitAll()
+//                        .requestMatchers(matcher.pattern("api/restfull/oauth2/confirmaccountsync")).permitAll()
+//                        .requestMatchers(matcher.pattern("api/restfull/admin/**")).hasAnyRole("ADMIN")
+//                        .requestMatchers(matcher.pattern("/**"))
+//                        .authenticated()
+////                        .hasAnyRole("USER", "ADMIN")
+//                )
+//                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+//                .httpBasic(withDefaults())
+//                .csrf(AbstractHttpConfigurer::disable)
+//                .build();
+
+        http.csrf().disable()
+                .authorizeHttpRequests()
+                .anyRequest()
+                .authenticated()
+                .and()
+                .httpBasic(withDefaults());
+        return http.build();
     }
 
 }

wise-webapp/src/main/java/com/wisemapping/config/rest/ServletConfig.java

@@ -1,4 +1,4 @@
-package com.wisemapping.config.mvc;
+package com.wisemapping.config.rest;
 
 import org.springframework.boot.web.server.WebServerFactoryCustomizer;
 import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;