From d6cd2139f6361d982549297a7b4d68190329ce3b Mon Sep 17 00:00:00 2001
From: "dmitriy.churmeev" <dmitriy.churmeev@gmail.com>
Date: Sun, 29 Mar 2026 14:26:56 +0300
Subject: [PATCH] fix security configuration

---
 .../kotlin/com/auth/config/WebSecurityConfig.kt     | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
index 673c21e..2f532a0 100644
--- a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
+++ b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
@@ -11,20 +11,27 @@ import org.springframework.security.config.annotation.web.configurers.SessionMan
 import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.core.authority.SimpleGrantedAuthority
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
-import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter
 import org.springframework.security.web.SecurityFilterChain
 
 
 @Configuration
 @EnableWebSecurity
-@EnableMethodSecurity
+@EnableMethodSecurity(
+    prePostEnabled = true,  // ← явно включаем
+    securedEnabled = true    // ← опционально
+)
 class WebSecurityConfig () {
 
     @Bean
     @Throws(Exception::class)
     fun filterChain(http: HttpSecurity): SecurityFilterChain? {
         http.authorizeHttpRequests(Customizer { auth ->
-                auth.anyRequest().authenticated() })
+
+            auth.requestMatchers("/public/**", "/health", "/info").permitAll()
+            auth.anyRequest().permitAll()
+                //auth.anyRequest().authenticated()
+
+        })
             .oauth2ResourceServer(Customizer { oauth2 ->
               //  oauth2!!.jwt(Customizer.withDefaults())
                 // добавляем конвертер для извлечения ролей