// The configuration every Spring Authorization Server tutorial written before
// September 2025 tells you to write. It compiled against 1.5.8 and does not compile
// against 7.1.1. Kept out of the build on purpose - scripts/compile-legacy.sh runs
// javac against it and captures the real compiler output into
// docs/output/as-legacy-compile-failure.txt.
//
// Three separate breakages in nine lines:
//   1. the *Configuration class moved out of the SAS jar into spring-security-config
//   2. the *Configurer class moved AND changed package shape
//   3. applyDefaultSecurity(HttpSecurity) was deleted outright
package com.ankurm.authserver.legacy;

import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class LegacySasConfig {

    @Bean
    @Order(Ordered.HIGHEST_PRECEDENCE)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
            throws Exception {

        // The 1.x one-liner.
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .oidc(Customizer.withDefaults());

        return http.build();
    }
}