package it.mice.voila.runtime.springmvc.csrf;

import it.mice.voila.runtime.springmvc.taglibs.TagUtils;

import java.util.HashMap;
import java.util.Map;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.web.servlet.support.RequestDataValueProcessor;

/**
 * A <code>RequestDataValueProcessor</code> that pushes a hidden field with a CSRF token into forms.
 * This process implements the {@link #getExtraHiddenFields(HttpServletRequest)} method to push the
 * CSRF token obtained from {@link CSRFTokenManager}. To register this processor to automatically process all
 * Spring based forms register it as a Spring bean named 'requestDataValueProcessor' as shown below:
 * <pre>
 *  &lt;bean name="requestDataValueProcessor" class="it.mice.voila.runtime.springmvc.csrf.CSRFRequestDataValueProcessor"/&gt;
 * </pre>
 * @author Eyal Lupu
 *
 */
public class CSRFRequestDataValueProcessor implements RequestDataValueProcessor {

    /**
     * Default logger.
     */
    private static final Log LOGGER = LogFactory.getLog(CSRFRequestDataValueProcessor.class); // NOSONAR

	public String processAction(HttpServletRequest request, String action) {
		LOGGER.debug("processAction: " + action);
		return action;
	}

	public String processFormFieldValue(HttpServletRequest request, String name, String value, String type) {
		LOGGER.debug("processFormFieldValue: name=" + name + ", value=" + value + ", type=" + type);
		TagUtils.getSecuritySessionBean().addFormField(name, value, type);
		return value;
	}

	public Map<String, String> getExtraHiddenFields(HttpServletRequest request) {
		Map<String, String> hiddenFields = new HashMap<String, String>();
		hiddenFields.put(CSRFTokenManager.CSRF_PARAM_NAME, CSRFTokenManager.getTokenForSession(request.getSession()));
		return hiddenFields;
	}

	public String processUrl(HttpServletRequest request, String url) {
		LOGGER.debug("processUrl: " + url);
		return url;
	}

}
