package org.jeecg.config;


import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.jeecg.common.constant.SecurityFilterProperties;
import org.jeecg.config.filter.XssAndSqlInjectionFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * 过滤器配置类
 * <p>
 * 配置 XSS 和 SQL 注入防护过滤器
 *
 * @author zsElectric
 */
@Slf4j
@Configuration
@RequiredArgsConstructor
public class FilterConfig {
    
    private final SecurityFilterProperties securityFilterProperties;

    /**
     * 注册 XSS 和 SQL 注入防护过滤器
     */
    @Bean
    public FilterRegistrationBean<XssAndSqlInjectionFilter> xssAndSqlInjectionFilter() {
        log.info("注册 XSS 和 SQL 注入防护过滤器");
        
        FilterRegistrationBean<XssAndSqlInjectionFilter> registration = new FilterRegistrationBean<>();
        registration.setFilter(new XssAndSqlInjectionFilter(securityFilterProperties));
        registration.addUrlPatterns("/*");
        registration.setName("xssAndSqlInjectionFilter");
        // 设置过滤器优先级（数字越小优先级越高）
        // 应该在 Spring Security 过滤器之前执行
        registration.setOrder(1);
        
        return registration;
    }
}
