From 57fffb3a5a4cb6142a182f4988bda4e01d719340 Mon Sep 17 00:00:00 2001
From: "dmitriy.churmeev" <dmitriy.churmeev@gmail.com>
Date: Sun, 29 Mar 2026 01:53:34 +0300
Subject: [PATCH] fix security configuration

---
 .../com/auth/config/WebSecurityConfig.kt      | 32 ++++++++++++++++---
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
index c27a672..c2e4a79 100644
--- a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
+++ b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
@@ -24,25 +24,49 @@ class WebSecurityConfig () {
         http
             .authorizeHttpRequests(Customizer { auth ->
                 auth
-                    .requestMatchers("/public/**").permitAll()
                     .anyRequest().authenticated()
             }
             )
             .oauth2ResourceServer(Customizer { oauth2 ->
                 oauth2!!
                     .jwt(Customizer.withDefaults())
-            } // ← проверяем JWT токены
+            } // ← проверяем JWT токен
             )
             .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
                 session!!
                     .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
-            } // REST API без сессий
+            } // без сессий
             )
-            .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
+            .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API
 
         return http.build()
     }
 
+//    @Bean
+//    @Throws(Exception::class)
+//    fun filterChain(http: HttpSecurity): SecurityFilterChain? {
+//        http
+//            .authorizeHttpRequests(Customizer { auth ->
+//                auth
+//                    .requestMatchers("/public/**").permitAll()
+//                    .anyRequest().authenticated()
+//            }
+//            )
+//            .oauth2ResourceServer(Customizer { oauth2 ->
+//                oauth2!!
+//                    .jwt(Customizer.withDefaults())
+//            } // ← проверяем JWT токены
+//            )
+//            .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
+//                session!!
+//                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+//            } // REST API без сессий
+//            )
+//            .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
+//
+//        return http.build()
+//    }
+
 //    @Bean
 //    @Throws(Exception::class)
 //    fun filterChain(http: HttpSecurity): SecurityFilterChain? {