[FEAT/#114] 화이트리스트 축소 및 공개 엔드포인트 명시 (401 루프 오류 수정)

[ckkim817]

💡 Issue

• resolved: [FIX] 화이트리스트 축소 및 공개 엔드포인트 명시 (401 루프 오류 수정) #114

📄 Description

• 화이트리스트를 축소하고 공개 엔드포인트를 명시하여 액세스 토큰이 Optional인 API의 401 무한루프 에러를 수정했습니다.
• 이때 Security가 Spring MVC와 동일한 규칙(@RequestMapping)으로 경로를 매칭하게 해 주는 도구인 MvcRequestMatcher.Builder를 활용해 경로변수와 정규식 제약을 세밀하게 설정했습니다.

[Copilot]

Pull Request Overview

This PR fixes a 401 infinite loop error for APIs where access tokens are optional by reducing the whitelist and explicitly defining public endpoints. The changes replace a generic NO_PRINCIPAL_ERROR with a more specific UN_LOGIN_ERROR and implement precise endpoint security configuration using MvcRequestMatcher.Builder for path variable matching.

• Replaced generic authentication error with specific login error
• Reduced authentication whitelist from wildcard patterns to specific endpoints
• Added explicit public endpoint definitions with path variable constraints

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
SpotService.java	Changed error type from NO_PRINCIPAL_ERROR to UN_LOGIN_ERROR for guest users
SecurityConfig.java	Refactored security configuration to use specific endpoints instead of wildcards and added MvcRequestMatcher for precise path matching

[Copilot]

Allowing unrestricted POST access to create spots could be a security risk. Consider if anonymous users should be able to create spots without authentication.

Suggested change

.requestMatchers(HttpMethod.POST, "/api/v1/spots").permitAll()