@Provider
@Authorization
public class AuthorizationFilter extends SpringApplication implements ContainerRequestFilter, ContainerResponseFilter {

    @Context
    private ResourceInfo resourceInfo;

    @Override
    public void filter(ContainerRequestContext requestContext) {

        // check for @PermitAll
        if (isResourcePubliclyAllowed()) {
            return;
        }

        if (!requestContext.getHeaders().containsKey(Constants.cookieSessionKey)
            || !requestContext.getHeaders().containsKey(Constants.cookieUsernameKey)) {
            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
                    .entity("You can't access the resource without login").build());
            return;
        }
        String requestSessionId = requestContext.getHeaders().getFirst("SESSION_ID");
        String username = requestContext.getHeaders().getFirst("USERNAME");
        EntityDAO<SessionDO> sessionDAO = getBean(SessionDAOImpl.class);
        Optional<SessionDO> session = sessionDAO.get(requestSessionId);
        if (session.isEmpty() || session.get().getExpiryTimestamp() < System.currentTimeMillis()) {
            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
                    .entity("The login session has expired,  please login again to access the resource").build());
            return;
        }

        if (!username.equals(session.get().getUser().getUid())) {
            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
                    .entity("Activity is suspicious, action will be reported to system admin").build());
            return;
        }

        String role = session.get().getUser().getRole();
        if (!isResourcePermitted(role)) {
            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
                    .entity("User is authenticated successfully, but doesn't have legitimate rights over the resource")
                    .build());
            return;
        }
    }

    @Override
    public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) {

    }

    /**
     * Check if the role is allowed to access given resource.
     *
     * @param role of the user trying to access the resource
     * @return false if role is not permitted to execute, otherwise true
     */
    private boolean isResourcePermitted(String role) {

        Method method = resourceInfo.getResourceMethod();
        if (method.isAnnotationPresent(DenyAll.class)) {
            return false;
        }

        if (method.isAnnotationPresent(RolesAllowed.class)) {
            HashSet<String> rolesSet = new HashSet<String>(Arrays.asList(method.getAnnotation(RolesAllowed.class).value()));
            if (!rolesSet.contains(role)) {
                return false;
            }
        }

        // @PermitAll will be allowed by default
        return true;
    }

    /**
     * Checks for @PermitAll annotation,
     *
     * @return true if method have @PermitAll annotation, false otherwise
     */
    private boolean isResourcePubliclyAllowed() {

        return resourceInfo.getResourceMethod().isAnnotationPresent(PubliclyAllowed.class);
    }
}