<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">


  <listener>
    <listener-class>org.uberfire.backend.server.io.DisposableShutdownService</listener-class>
  </listener>

  <servlet-mapping>
    <servlet-name>javax.ws.rs.core.Application</servlet-name>
    <url-pattern>/rest/*</url-pattern>
  </servlet-mapping>

  <filter>
    <filter-name>request-capture</filter-name>
    <filter-class>org.uberfire.ext.security.server.SecurityIntegrationFilter</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>request-capture</filter-name>
    <url-pattern>*</url-pattern>
  </filter-mapping>

  <filter>
    <filter-name>Host Page Patch</filter-name>
    <filter-class>org.jboss.errai.security.server.servlet.UserHostPageFilter</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>Host Page Patch</filter-name>
    <url-pattern>/jbpm-wb.html</url-pattern>
  </filter-mapping>

  <filter>
    <filter-name>UberFire Security Headers Filter</filter-name>
    <filter-class>org.uberfire.ext.security.server.SecureHeadersFilter</filter-class>
    <init-param>
      <param-name>x-frame-options</param-name>
      <param-value>SAMEORIGIN</param-value>
    </init-param>
    <init-param>
      <param-name>x-xss-protection-enable</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>x-xss-protection-block</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>

  <filter-mapping>
    <filter-name>UberFire Security Headers Filter</filter-name>
    <url-pattern>*</url-pattern>
  </filter-mapping>

  <servlet>
    <servlet-name>LoginRedirectServlet</servlet-name>
    <servlet-class>org.uberfire.ext.security.server.LoginRedirectServlet</servlet-class>
    <init-param>
      <param-name>display-after-login</param-name>
      <param-value>/jbpm-wb.html</param-value>
    </init-param>
  </servlet>

  <servlet-mapping>
    <servlet-name>LoginRedirectServlet</servlet-name>
    <url-pattern>/login</url-pattern>
  </servlet-mapping>

  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>

  <!-- Basic Auth Filter for REST and Maven2 repo -->
  <filter>
    <filter-name>HTTP Basic Auth Filter</filter-name>
    <filter-class>org.uberfire.ext.security.server.BasicAuthSecurityFilter</filter-class>
    <init-param>
      <param-name>realmName</param-name>
      <param-value>KIE Workbench Realm</param-value>
    </init-param>
  </filter>

  <filter-mapping>
    <filter-name>HTTP Basic Auth Filter</filter-name>
    <url-pattern>/rest/*</url-pattern>
    <url-pattern>/maven2/*</url-pattern>
    <url-pattern>/ws/*</url-pattern>
  </filter-mapping>

  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>

  <!-- Errai servlets -->
  <servlet>
    <!-- NOTE: the integration-test profile uses this web.xml. Integration tests only work properly
with the DefaultBlockingServlet. If you change this setting, make a backup of this web.xml
(perhaps under src/integration-test-settings/web.xml and alter the integration-test
profile in pom.xml to use that. -->
    <servlet-name>ErraiServlet</servlet-name>
    <servlet-class>org.jboss.errai.bus.server.servlet.DefaultBlockingServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>ErraiServlet</servlet-name>
    <url-pattern>*.erraiBus</url-pattern>
  </servlet-mapping>

  <!-- start jBPM Designer -->
  <!-- Designer Injection Filter -->
  <filter>
    <filter-name>Redirect Filter</filter-name>
    <filter-class>org.jbpm.designer.filter.DesignerResourcesRedirectFilter</filter-class>
    <init-param>
      <param-name>redirectTo</param-name>
      <param-value>/org.jbpm.workbench.jBPMShowcase</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>Redirect Filter</filter-name>
    <url-pattern>/org.jbpm.designer.jBPMDesigner/*</url-pattern>
  </filter-mapping>
  <filter>
    <filter-name>Pluggable Filter</filter-name>
    <filter-class>org.jbpm.designer.web.filter.impl.PluggableFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>Pluggable Filter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- the number within the session-timout element must be expressed in
       minutes. it is now 24 hours. -->
  <session-config>
    <session-timeout>1440</session-timeout>
  </session-config>
  <!-- jBoss' default mapping is to "image/svg", which causes the client
       not to parse the SVG content as XML. However, the Oryx Editor client relies
       on that behaviour. The mimetype as per W3C specification must be "image/svg+xml".
       See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
  <mime-mapping>
    <extension>svg</extension>
    <mime-type>image/svg+xml</mime-type>
  </mime-mapping>
  <mime-mapping>
    <extension>json</extension>
    <mime-type>application/json</mime-type>
  </mime-mapping>
  <mime-mapping>
    <extension>css</extension>
    <mime-type>text/css</mime-type>
  </mime-mapping>
  <!-- Set Favourites Icon MIME-Type -->
  <mime-mapping>
    <extension>ico</extension>
    <mime-type>image/x-icon</mime-type>
  </mime-mapping>
  <!-- end jBPM Designer -->

  <!-- Container based security -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>wb</web-resource-name>
      <url-pattern>/jbpm-wb.html</url-pattern>
      <url-pattern>/uf_security_check</url-pattern>
      <url-pattern>*.erraiBus</url-pattern>
      <url-pattern>/org.jbpm.workbench.jBPMShowcase/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
      <role-name>user</role-name>
      <role-name>manager</role-name>
    </auth-constraint>
  </security-constraint>

  <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/login.jsp?message=Login failed: Invalid UserName or Password</form-error-page>
    </form-login-config>
  </login-config>

  <error-page>
    <error-code>403</error-code>
    <location>/not_authorized.jsp</location>
  </error-page>

  <security-role>
    <description>Administrator - Administrates the BPMS system. Has full access
      rights to make any changes necessary. Also has the
      ability to add and remove users from the system.
    </description>
    <role-name>admin</role-name>
  </security-role>

  <security-role>
    <description>Analyst - Responsible for creating and designing processes
      into the system. Creates process flows and handles
      process change requests. Needs to test processes that
      they create. Also creates forms and dashboards.
    </description>
    <role-name>analyst</role-name>
  </security-role>

  <security-role>
    <description>Developer - Implements code required for process to work. Mostly uses
      the JBDS connection to view processes, but may use the
      web tool occasionally.
    </description>
    <role-name>developer</role-name>
  </security-role>

  <security-role>
    <description>Business user - Daily user of the system to take actions on business tasks
      that are required for the processes to continue forward. Works
      primarily with the task lists.
    </description>
    <role-name>user</role-name>
  </security-role>

  <security-role>
    <description>Manager/Viewer-only User - Viewer of the system that is interested in statistics
      around the business processes and their performance, business indicators, and other
      reporting of the system and people who interact with the system.
    </description>
    <role-name>manager</role-name>
  </security-role>
</web-app>
