/*
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
 * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
 * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */

package app.config;

import com.mpalourdio.springboottemplate.properties.CredentialsProperties;
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

@Configuration
@EnableWebSecurity
@EnableConfigurationProperties(CredentialsProperties.class)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private static final String BASIC_AUTH_ENDPOINT = "/basicauth";
    private static final String ADMIN_ROLE = "ADMIN";
    private static final String ACTUATOR_ROLE = "ACTUATOR";

    private final CredentialsProperties credentialsProperties;

    public WebSecurityConfig(CredentialsProperties credentialsProperties) {
        this.credentialsProperties = credentialsProperties;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //We disable csrf protection for actuator endpoints so we can post with curl
        //ex : the refresh endpoint
        http.csrf().ignoringRequestMatchers(EndpointRequest.toAnyEndpoint());

        http.logout()
                .logoutSuccessUrl("/")
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .logoutSuccessHandler(logoutHandler())
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));

        http.authorizeRequests()
                .antMatchers(BASIC_AUTH_ENDPOINT)
                .hasRole(ADMIN_ROLE)
                .requestMatchers(EndpointRequest.toAnyEndpoint())
                .hasRole(ACTUATOR_ROLE)
                .and()
                .httpBasic();
    }

    @Bean
    public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
        return new InMemoryUserDetailsManager(
                User.withDefaultPasswordEncoder()
                        .username(credentialsProperties.getUsername())
                        .password(credentialsProperties.getPassword())
                        .roles(ADMIN_ROLE, ACTUATOR_ROLE)
                        .build()
        );
    }

    private LogoutSuccessHandler logoutHandler() {
        var logoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
        var redirectStrategy = new DefaultRedirectStrategy();

        redirectStrategy.setContextRelative(false);
        logoutSuccessHandler.setRedirectStrategy(redirectStrategy);

        return logoutSuccessHandler;
    }
}


@@ -1035,110 +1035,8 @@
 ty;%0A
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;%0A
 impo
@@ -1232,16 +1232,77 @@
 rategy;%0A
+import org.springframework.security.web.SecurityFilterChain;%0A
 import o
@@ -1676,45 +1676,8 @@
 fig 
-extends WebSecurityConfigurerAdapter 
 %7B%0A%0A 
@@ -2074,224 +2074,124 @@
    @
-Override%0A    protected void configure(HttpSecurity http) throws Exception %7B%0A        //We disable csrf protection for actuator endpoints so we can post with curl%0A        //ex : the refresh endpoint%0A        http.
+Bean%0A    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception %7B%0A        http.csrf(csrf -%3E 
 csrf
-()
 .ign
@@ -2243,18 +2243,17 @@
 point())
-;%0A
+)
 %0A       
@@ -2257,22 +2257,47 @@
     
-http.logout()%0A
+        .logout(logout -%3E logout%0A      
     
@@ -2300,32 +2300,34 @@
                 
+  
 .logoutSuccessUr
@@ -2333,16 +2333,24 @@
 rl(%22/%22)%0A
+        
         
@@ -2402,16 +2402,24 @@
         
+  
+      
 .clearAu
@@ -2445,32 +2445,40 @@
                 
+      
+  
 .logoutSuccessHa
@@ -2496,24 +2496,32 @@
 tHandler())%0A
+        
             
@@ -2587,24 +2587,83 @@
 t%22))
-;%0A%0A        http.
+%0A                )%0A                .authorizeRequests(authorizeRequests -%3E 
 auth
@@ -2675,19 +2675,25 @@
 Requests
-()%0A
+%0A        
         
@@ -2742,32 +2742,40 @@
                 
+        
 .hasRole(ADMIN_R
@@ -2795,16 +2795,24 @@
         
+   
+     
 .request
@@ -2861,32 +2861,40 @@
                 
+       
+ 
 .hasRole(ACTUATO
@@ -2921,13 +2921,8 @@
     
-.and(
 )%0A  
@@ -2948,16 +2948,46 @@
 Basic();
+%0A%0A        return http.build();
 %0A    %7D%0A%0A

Use Spring Security DSL and remove WebSecurityConfigurerAdapter usage