package com.codebyte.api.config;

import com.codebyte.api.common.web.RateLimitingFilter;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/** Registers the auth rate-limiting filter ahead of the security filter chain. */
@Configuration
public class RateLimitConfig {

    @Bean
    FilterRegistrationBean<RateLimitingFilter> rateLimitingFilter(
            AppProperties properties, ObjectMapper objectMapper) {
        AppProperties.RateLimit rateLimit = properties.rateLimit();
        FilterRegistrationBean<RateLimitingFilter> registration = new FilterRegistrationBean<>();
        registration.setFilter(
                new RateLimitingFilter(
                        rateLimit.enabled(),
                        rateLimit.capacity(),
                        rateLimit.refillPeriod(),
                        objectMapper));
        registration.addUrlPatterns("/api/v1/auth/*");
        // Run before Spring Security so floods are rejected before authentication work.
        registration.setOrder(SecurityProperties.DEFAULT_FILTER_ORDER - 10);
        return registration;
    }
}