package demo;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.authorization.EnableMultiFactorAuthentication;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.FactorGrantedAuthority;
import org.springframework.security.web.SecurityFilterChain;

/** Variant 1: EVERY authenticated rule now requires password AND a one-time token. */
@Configuration
@EnableWebSecurity
@Profile("global")
@EnableMultiFactorAuthentication(authorities = {
        FactorGrantedAuthority.PASSWORD_AUTHORITY,
        FactorGrantedAuthority.OTT_AUTHORITY })
public class MfaGlobalConfig {

    @Bean
    SecurityFilterChain chain(HttpSecurity http, MfaTokenCatcher catcher) throws Exception {
        return http
            .authorizeHttpRequests(a -> a
                .requestMatchers("/").permitAll()
                .anyRequest().authenticated())
            .formLogin(Customizer.withDefaults())
            .oneTimeTokenLogin(o -> o.tokenGenerationSuccessHandler(catcher))
            .build();
    }
}