package com.atlassian.stash.internal.spring.security;

import org.springframework.security.web.util.matcher.RequestMatcher;

import javax.servlet.http.HttpServletRequest;

/**
 * {@link RequestMatcher} for GET requests for users avatar images. These do not require permission checks and do not
 * have to be authenticated.
 */
public class GetUserAvatarRequestMatcher implements RequestMatcher {
    @Override
    public boolean matches(HttpServletRequest request) {
        String pathInfo = request.getPathInfo();

        // Authentication happens prior to URL rewriting, so the paths we match should not include /mvc
        return "GET".equals(request.getMethod()) && pathInfo != null &&
                pathInfo.startsWith("/users/") && pathInfo.endsWith("/avatar.png");
    }
}
