<?xml version="1.0" encoding="UTF-8"?>

<!--
========================================================================================================================
beans-security.xml

Copyright (c) 2013 Manning Publications Co.

Willie Wheeler (willie.wheeler@gmail.com)

Book: http://manning.com/wheeler/
Blog: http://springinpractice.com/
Code: https://github.com/springinpractice
========================================================================================================================
-->
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:p="http://www.springframework.org/schema/p"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
		http://www.springframework.org/schema/beans
		http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/security
		http://www.springframework.org/schema/security/spring-security-3.0.xsd">
	
	<http auto-config="true" use-expressions="true">
		<form-login default-target-url="/home.html" />
		<logout logout-success-url="/home.html" />
		<access-denied-handler error-page="/accessdenied.html"/>
		
		<!-- Unfiltered -->
		<intercept-url pattern="/skin/**" filters="none" />
		<intercept-url pattern="/extras/**" filters="none" />
		<intercept-url pattern="/styles/**" filters="none" />
		<intercept-url pattern="/scripts/**" filters="none" />
		<intercept-url pattern="/images/**" filters="none" />
		
		<!-- Whitelist. Being very paranoid here, which is a security best practice. -->
		
		<!-- Get home page -->
		<!-- This requires filtering for the controller test and taglib -->
		<intercept-url pattern="/home.html" method="GET" access="permitAll" />
		
		<!-- Admin console -->
		<intercept-url pattern="/admin.html" method="GET" access="hasRole('ROLE_ADMIN')" />
		
		<!-- Get individual forum -->
		<!-- /forums doesn't work. It has to be /forums.html. -->
		<intercept-url pattern="/forums.html" method="GET" access="isAuthenticated()" />
		<intercept-url pattern="/forums/*" method="GET" access="isAuthenticated()" />
		
		<!-- Post new message -->
		<intercept-url pattern="/forums/*/messages" method="POST" access="isAuthenticated()" />
		
		<!-- Get individual message -->
		<intercept-url pattern="/forums/*/messages/*" method="GET" access="isAuthenticated()" />
		
		<!-- Various message operations. Just block unauthenticated users, and we'll rely on ACLs to authorize specific
		     requests. -->
		<intercept-url pattern="/forums/*/messages/*/edit.html" method="GET" access="isAuthenticated()" />
		<intercept-url pattern="/forums/*/messages/*" method="PUT" access="isAuthenticated()" />
		<intercept-url pattern="/forums/*/messages/*/visible" method="PUT" access="isAuthenticated()" />
		<intercept-url pattern="/forums/*/messages/*" method="DELETE" access="isAuthenticated()" />
		
		<intercept-url pattern="/accounts/*" method="GET" access="isAuthenticated()" />
		
		<!-- Deny all policy by default, using expressions. This is part of our paranoia. This comes last since match
		     policy is first-match. -->
		<intercept-url pattern="/**" access="denyAll" />
	</http>
	
	<global-method-security pre-post-annotations="enabled">
		<!-- Added for recipe 7.4 to support hasPermission() expressions -->
		<expression-handler ref="expressionHandler" />
	</global-method-security>
	
	<authentication-manager alias="authenticationManager">
		<authentication-provider user-service-ref="accountDao" />
	</authentication-manager>
</beans:beans>
