<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
       xsi:schemaLocation="http://www.springframework.org/schema/beans		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                           http://www.springframework.org/schema/security   http://www.springframework.org/schema/security/spring-security-3.1.xsd
                           http://www.springframework.org/schema/security/oauth2 	http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">

    <security:http pattern="/rest/**" entry-point-ref="forbiddenEntryPoint" access-decision-manager-ref="secureAccessDecisionManager">
        <security:intercept-url pattern="/rest/public/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <!--<security:intercept-url pattern="/rest/immunization-campaign/**" access="ROLE_STAFF, CHECK_STAFF_USER_DISCLAIMER, ROLE_MHP_USER, CAN_TIMEOUT"/>-->
        <security:intercept-url pattern="/rest/scheduling-service/**" access="ROLE_STAFF, ROLE_MHP_USER"/>
        <!--<security:intercept-url pattern="/rest/**" access="ROLE_MHP_USER, CAN_TIMEOUT"/>-->
        <!--<security:intercept-url pattern="/rest/**" access="ROLE_MHP_USER"/>-->
        <security:intercept-url pattern="/rest/**" access="ROLE_STAFF"/>
        <security:anonymous />
        <security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    </security:http>

    <security:http access-decision-manager-ref="secureAccessDecisionManager" entry-point-ref="forbiddenEntryPoint">
        <security:intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/fonts/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/js/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/html/templates/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/img/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/name" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/favicon.ico" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/launchpad/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/staff-user-disclaimer/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/index.html" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/newbrowser.html" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/test/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <security:intercept-url pattern="/**" access="ROLE_MHP_USER"/>
        <security:anonymous />
        <security:custom-filter ref="resourceServerFilter" after="PRE_AUTH_FILTER" />
    </security:http>


    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userService">
        </security:authentication-provider>
    </security:authentication-manager>

    <security:user-service id="userService">
        <security:user name="user.none" password="pass" authorities="ROLE_NONE"/>
    </security:user-service>

    <bean id="forbiddenEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

	<!-- Access Decision Manager for restricted specific url's	 -->
	<bean id="secureAccessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
		<constructor-arg>
			<list>
				<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
				<bean class="org.springframework.security.access.vote.RoleVoter" />
				<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
				<bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
                <bean class="com.agilex.healthcare.schedulingmanager.security.StaffUserDisclaimerVoter"/>
			</list>
		</constructor-arg>
	</bean>

    <bean id="tokenServices" class="com.agilex.healthcare.mobilehealthplatform.security.HATokenValidation">
        <constructor-arg value="${oauth.validateTokenUri}"/>
    </bean>

	<oauth:resource-server id="resourceServerFilter" resource-id="mhp" token-services-ref="tokenServices" />

	<oauth:expression-handler id="oauthExpressionHandler" />
</beans>
