moved the app auth to using spring security instead of an interceptor

src/main/java/org/rostislav/quickdrop/config/SecurityConfig.java

@@ -1,30 +1,83 @@
 package org.rostislav.quickdrop.config;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 
+import java.util.List;
+
 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {
 
+    @Value("${app.enable.password}")
+    private boolean enablePassword;
+
+    @Value("${app.basic.password}")
+    private String appPassword;
+
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-        http.authorizeHttpRequests(authorizeRequests ->
-                authorizeRequests.anyRequest().anonymous()
-        );
-        http.csrf(csrf ->
-                csrf.csrfTokenRepository(new CookieCsrfTokenRepository())
-        );
+        if (enablePassword) {
+            http
+                    .authorizeHttpRequests(authz -> authz
+                            .requestMatchers("/password/login", "/favicon.ico", "/error").permitAll()
+                            .anyRequest().authenticated()
+                    )
+                    .formLogin(form -> form
+                            .loginPage("/password/login")
+                            .permitAll()
+                            .failureUrl("/password/login?error")
+                            .defaultSuccessUrl("/", true)
+                    )
+                    .authenticationProvider(authenticationProvider())
+                    .csrf(csrf -> csrf
+                            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                    );
+        } else {
+            http
+                    .authorizeHttpRequests(authz -> authz
+                            .anyRequest().permitAll()
+                    )
+                    .csrf(csrf -> csrf
+                            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                    );
+        }
 
         return http.build();
     }
 
+    @Bean
+    public AuthenticationProvider authenticationProvider() {
+        return new AuthenticationProvider() {
+            @Override
+            public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+                String providedPassword = (String) authentication.getCredentials();
+                if (appPassword.equals(providedPassword)) {
+                    return new UsernamePasswordAuthenticationToken(null, providedPassword, List.of());
+                } else {
+                    throw new BadCredentialsException("Invalid password");
+                }
+            }
+
+            @Override
+            public boolean supports(Class<?> authentication) {
+                return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
+            }
+        };
+    }
+
     @Bean
     public PasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();

src/main/java/org/rostislav/quickdrop/config/WebConfig.java

@@ -1,21 +0,0 @@
-package org.rostislav.quickdrop.config;
-
-import org.rostislav.quickdrop.interceptor.PasswordInterceptor;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-
-@Configuration
-public class WebConfig implements WebMvcConfigurer {
-    private final PasswordInterceptor passwordInterceptor;
-
-    public WebConfig(PasswordInterceptor passwordInterceptor) {
-        this.passwordInterceptor = passwordInterceptor;
-    }
-
-    @Override
-    public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(passwordInterceptor)
-                .excludePathPatterns("/password/login", "/favicon.ico", "/error");
-    }
-}

src/main/java/org/rostislav/quickdrop/interceptor/PasswordInterceptor.java

@@ -1,29 +0,0 @@
-package org.rostislav.quickdrop.interceptor;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.stereotype.Component;
-import org.springframework.web.servlet.HandlerInterceptor;
-
-@Component
-public class PasswordInterceptor implements HandlerInterceptor {
-    @Value("${app.enable.password}")
-    private Boolean enablePassword;
-
-    @Override
-    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
-        if (!enablePassword) {
-            return true;
-        }
-
-        Boolean authenticated = (Boolean) request.getSession().getAttribute("authenticated");
-
-        if (authenticated != null && authenticated) {
-            return true;
-        }
-
-        response.sendRedirect("/password/login");
-        return false;
-    }
-}