package org.oxerr.spring.security.guest.web.authentication;
   
   import java.io.IOException;
   
   import javax.servlet.FilterChain;
   import javax.servlet.ServletException;
   import javax.servlet.http.HttpServletRequest;
   import javax.servlet.http.HttpServletResponse;
   
  import org.oxerr.spring.security.guest.authentication.GuestAuthenticationToken;
  import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.AuthenticationException;
  import org.springframework.security.core.context.SecurityContextHolder;
  import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
  import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
  import org.springframework.util.Assert;
  
  public class GuestAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
  
  	private String headerName = "X-Client-Token";
  
  	public GuestAuthenticationFilter() {
  		super(new AntPathRequestMatcher("/**", ""));
  	}
  
  	@Override
  	protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
  		return SecurityContextHolder.getContext().getAuthentication() == null && request.getHeader(headerName) != null;
  	}
  
  	@Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws AuthenticationException, IOException, ServletException {
  		String clientToken = request.getHeader(headerName);
  		GuestAuthenticationToken authRequest = new GuestAuthenticationToken(clientToken);
  
  		// Allow subclasses to set the "details" property
  		setDetails(request, authRequest);
  
  		return this.getAuthenticationManager().authenticate(authRequest);
  	}
  
  	@Override
  	protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
  			Authentication authResult) throws IOException, ServletException {
  
  		SecurityContextHolder.getContext().setAuthentication(authResult);
  
  		getRememberMeServices().loginSuccess(request, response, authResult);
  
  		// Fire event
  		if (this.eventPublisher != null) {
  			eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
  					authResult, this.getClass()));
  		}
  
  		chain.doFilter(request, response);
  	}
  
  	/**
  	 * Provided so that subclasses may configure what is put into the authentication
  	 * request's details property.
  	 *
  	 * @param request that an authentication request is being created for
  	 * @param authRequest the authentication request object that should have its details
  	 * set
  	 */
  	protected void setDetails(HttpServletRequest request,
  			GuestAuthenticationToken authRequest) {
  		authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
  	}
  
  	public void setHeaderName(String headerName) {
  		Assert.hasText(headerName, "Header name must not be empty or null");
  		this.headerName = headerName;
  	}
  
  }