From 22837823a0caa7a8d06f8a333d689135755863c1 Mon Sep 17 00:00:00 2001
From: "dmitriy.churmeev" <dmitriy.churmeev@gmail.com>
Date: Sun, 29 Mar 2026 17:13:08 +0300
Subject: [PATCH] fix security configuration

---
 .../com/test/auth/config/WebSecurityConfig.kt | 36 +------------------
 .../kotlin/com/test/rest/TestController.kt    | 18 ----------
 2 files changed, 1 insertion(+), 53 deletions(-)

diff --git a/src/main/kotlin/com/test/auth/config/WebSecurityConfig.kt b/src/main/kotlin/com/test/auth/config/WebSecurityConfig.kt
index 54447b6..2dfe42d 100644
--- a/src/main/kotlin/com/test/auth/config/WebSecurityConfig.kt
+++ b/src/main/kotlin/com/test/auth/config/WebSecurityConfig.kt
@@ -3,12 +3,9 @@ package com.test.auth.config
 import org.slf4j.LoggerFactory
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.Customizer
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
-import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
 import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.core.authority.SimpleGrantedAuthority
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
@@ -31,6 +28,7 @@ class WebSecurityConfig {
 
         http
             .authorizeHttpRequests { auth ->
+                auth.requestMatchers("/actuator/**", "/health", "/info").permitAll()
                 auth.anyRequest().authenticated()
             }
             .oauth2ResourceServer { oauth2 ->
@@ -56,21 +54,15 @@ class WebSecurityConfig {
 
         val converter = JwtAuthenticationConverter()
 
-        // 🔑 КЛЮЧЕВОЕ ИЗМЕНЕНИЕ: используем явный объект вместо лямбды
         converter.setJwtGrantedAuthoritiesConverter(
             Converter<Jwt, Collection<GrantedAuthority>> { jwt ->
-                logger.info("=== JWT Converter called for token ===")
 
                 val roles = mutableSetOf<SimpleGrantedAuthority>()
-
                 val resourceAccess = jwt.claims["resource_access"] as? Map<*, *>
-                logger.info("resource_access: $resourceAccess")
-
                 val clientAccess = resourceAccess?.get("test_client") as? Map<*, *>
                 val clientRoles = clientAccess?.get("roles") as? List<*>
 
                 clientRoles?.forEach { role ->
-                    logger.info("Adding ROLE_$role")
                     roles.add(SimpleGrantedAuthority("ROLE_$role"))
                 }
 
@@ -78,11 +70,9 @@ class WebSecurityConfig {
                 val realmRoles = realmAccess?.get("roles") as? List<*>
 
                 realmRoles?.forEach { role ->
-                    logger.info("Adding realm ROLE_$role")
                     roles.add(SimpleGrantedAuthority("ROLE_$role"))
                 }
 
-                logger.info("Final authorities: ${roles.map { it.authority }}")
                 roles.toList()
             }
         )
@@ -90,28 +80,4 @@ class WebSecurityConfig {
         return converter
     }
 
-
-//    // Конвертер JWT Authentication (извлекает роли из токена)
-//    private fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
-//        val converter = JwtAuthenticationConverter()
-//
-//        // Извлекаем роли из поля resource_access.test_client.roles
-//        val authoritiesExtractor = JwtGrantedAuthoritiesConverter()
-//        authoritiesExtractor.setAuthoritiesClaimName("resource_access.test_client.roles")  // где лежат роли
-//        authoritiesExtractor.setAuthorityPrefix("ROLE_")  // добавляем префикс ROLE_
-//
-//        converter.setJwtGrantedAuthoritiesConverter(authoritiesExtractor)
-//
-////        // Дополнительно: проверяем, что роли не пустые
-////        converter.setJwtGrantedAuthoritiesConverter { jwt ->
-////            val authorities = authoritiesExtractor.convert(jwt)
-////            if (authorities.isEmpty()) {
-////                throw IllegalArgumentException("User has no roles assigned in token")
-////            }
-////            authorities
-////        }
-//
-//        return converter
-//    }
-
 }
\ No newline at end of file
diff --git a/src/main/kotlin/com/test/rest/TestController.kt b/src/main/kotlin/com/test/rest/TestController.kt
index e9c117c..70a191f 100644
--- a/src/main/kotlin/com/test/rest/TestController.kt
+++ b/src/main/kotlin/com/test/rest/TestController.kt
@@ -2,8 +2,6 @@ package com.test.rest
 
 import org.slf4j.LoggerFactory
 import org.springframework.security.access.prepost.PreAuthorize
-import org.springframework.security.core.Authentication
-import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.web.bind.annotation.GetMapping
 import org.springframework.web.bind.annotation.RestController
 
@@ -13,7 +11,6 @@ open class TestController {
 
     private val logger = LoggerFactory.getLogger(TestController::class.java)
 
-
     @PreAuthorize("hasRole('ADMIN')")
     @GetMapping("/test")
     fun test(): String {
@@ -21,16 +18,6 @@ open class TestController {
         return "Test page"
     }
 
-    @GetMapping("/debug")
-    fun debug(): Map<String, Any> {
-        val auth = SecurityContextHolder.getContext().authentication
-        return mapOf(
-            "isAuthenticated" to auth.isAuthenticated,
-            "name" to auth.name,
-            "authorities" to auth.authorities.map { it.authority }
-        )
-    }
-
     @PreAuthorize("hasRole('USER')")
     @GetMapping("/users")
     fun users(): ArrayList<String> {
@@ -42,9 +29,4 @@ open class TestController {
         return "Home page"
     }
 
-    @GetMapping("/me")
-    fun getMe(): Any {
-        val authentication: Authentication = SecurityContextHolder.getContext().getAuthentication()
-        return authentication.getName()
-    }
 }
\ No newline at end of file