Skip to content

Commit 0047805

Browse files
arosha-warosha-w
committed
resolve merge confilcr in security config
1 parent 2353f9f commit 0047805

1 file changed

Lines changed: 56 additions & 63 deletions

File tree

‎src/main/java/com/crimeLink/analyzer/config/SecurityConfig.java‎

Lines changed: 56 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -40,71 +40,64 @@ public class SecurityConfig {
4040
@Bean
4141
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
4242
http
43-
.csrf(csrf -> csrf.disable())
44-
// CRITICAL FIX: Enable CORS using the bean configuration
45-
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
46-
.authorizeHttpRequests(auth -> auth
47-
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
48-
.requestMatchers("/api/auth/**").permitAll()
49-
.requestMatchers("/api/health").permitAll()
50-
.requestMatchers("/api/admin/health").permitAll()
51-
.requestMatchers("/api/facial/health").permitAll() // ML service health check
52-
.requestMatchers("/api/call-analysis/health").permitAll() // ML service health check
53-
54-
// ML Service endpoints
55-
.requestMatchers("/api/call-analysis/**").hasRole("Investigator")
56-
.requestMatchers("/api/facial/register").hasAnyRole("Investigator", "OIC")
57-
.requestMatchers("/api/facial/criminals").hasAnyRole("Investigator", "OIC")
58-
.requestMatchers("/api/facial/**").hasRole("Investigator")
59-
60-
// Criminal CRUD (direct DB, no Python)
61-
.requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")
62-
.requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")
63-
64-
.requestMatchers("/api/database/**").permitAll()
65-
.requestMatchers("/api/test").permitAll()
66-
.requestMatchers("/api/debug/**").permitAll() // 🔍 Debug endpoints
67-
.requestMatchers("/error").permitAll() // Allow error page without auth
68-
69-
// Public endpoints
70-
.requestMatchers("/api/vehicles/**").permitAll()
71-
.requestMatchers("/api/mobile/auth/**").permitAll()
72-
.requestMatchers("/api/duties/**").permitAll()
73-
.requestMatchers("/api/crime-reports/map").permitAll()
74-
.requestMatchers(HttpMethod.GET, "/api/crime-reports").permitAll()
75-
.requestMatchers("/api/crime-reports/upload-evidence").authenticated()
76-
.requestMatchers("/api/crime-reports/**").hasAnyRole("OIC", "Admin")
77-
78-
// Field Officer routes
79-
.requestMatchers("/api/officers/me/**").hasRole("FieldOfficer")
80-
.requestMatchers("/api/mobile/**").hasRole("FieldOfficer")
81-
.requestMatchers("/api/leaves/**").permitAll()
82-
83-
// OIC-only routes
84-
.requestMatchers("/api/duty-schedules/**").hasRole("OIC")
85-
.requestMatchers("/api/weapon/**").hasRole("OIC")
86-
.requestMatchers("/api/weapon-issue/**").hasRole("OIC")
87-
88-
// Admin/OIC/Investigator routes (officer data, locations, users)
89-
.requestMatchers("/api/users/field-officers").hasAnyRole("Admin", "OIC", "Investigator")
90-
.requestMatchers("/api/admin/officers/*/locations/**").hasAnyRole("Admin", "OIC", "Investigator")
91-
.requestMatchers("/api/admin/**").hasAnyRole("OIC", "Admin")
92-
93-
.anyRequest().authenticated())
94-
.exceptionHandling(exception -> exception
95-
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
96-
.accessDeniedHandler((request, response, accessDeniedException) -> {
97-
response.setStatus(HttpStatus.FORBIDDEN.value());
98-
response.setContentType("application/json");
99-
response.getWriter().write("{\"message\":\"Access denied\"}");
100-
}))
101-
.sessionManagement(session -> session
102-
.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
103-
.authenticationProvider(authenticationProvider())
104-
.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
43+
.csrf(csrf -> csrf.disable())
44+
// CRITICAL FIX: Enable CORS using the bean configuration
45+
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
46+
.authorizeHttpRequests(auth -> auth
47+
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
48+
.requestMatchers("/api/auth/**").permitAll()
49+
.requestMatchers("/api/health").permitAll()
50+
.requestMatchers("/api/admin/health").permitAll()
51+
.requestMatchers("/api/facial/health").permitAll() // ML service health check
52+
.requestMatchers("/api/call-analysis/health").permitAll() // ML service health check
53+
// ML Service endpoints
54+
.requestMatchers("/api/call-analysis/**").hasRole("Investigator")
55+
.requestMatchers("/api/facial/register").hasAnyRole("Investigator", "OIC")
56+
.requestMatchers("/api/facial/criminals").hasAnyRole("Investigator", "OIC")
57+
.requestMatchers("/api/facial/**").hasRole("Investigator")
58+
// Criminal CRUD (direct DB, no Python)
59+
.requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")
60+
.requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")
61+
.requestMatchers("/api/database/**").permitAll()
62+
.requestMatchers("/api/test").permitAll()
63+
.requestMatchers("/api/debug/**").permitAll() // 🔍 Debug endpoints
64+
.requestMatchers("/error").permitAll() // Allow error page without auth
65+
// Public endpoints
66+
.requestMatchers("/api/vehicles/**").permitAll()
67+
.requestMatchers("/api/mobile/auth/**").permitAll()
68+
.requestMatchers("/api/duties/**").permitAll()
69+
.requestMatchers("/api/crime-reports/map").permitAll()
70+
.requestMatchers(HttpMethod.GET, "/api/crime-reports").permitAll()
71+
.requestMatchers("/api/crime-reports/upload-evidence").authenticated()
72+
.requestMatchers("/api/crime-reports/**").hasAnyRole("OIC", "Admin")
73+
// Field Officer routes
74+
.requestMatchers("/api/officers/me/**").hasRole("FieldOfficer")
75+
.requestMatchers("/api/mobile/**").hasRole("FieldOfficer")
76+
.requestMatchers("/api/leaves/**").permitAll()
77+
// OIC-only routes
78+
.requestMatchers("/api/duty-schedules/**").hasRole("OIC")
79+
.requestMatchers("/api/weapon/**").hasRole("OIC")
80+
.requestMatchers("/api/weapon-issue/**").hasRole("OIC")
81+
// Admin/OIC/Investigator routes (officer data, locations, users)
82+
.requestMatchers("/api/users/field-officers").hasAnyRole("Admin", "OIC", "Investigator")
83+
.requestMatchers("/api/admin/officers/*/locations/**").hasAnyRole("Admin", "OIC", "Investigator")
84+
.requestMatchers("/api/admin/**").hasAnyRole("OIC", "Admin")
85+
.anyRequest().authenticated())
86+
.exceptionHandling(exception -> exception
87+
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
88+
.accessDeniedHandler((request, response, accessDeniedException) -> {
89+
response.setStatus(HttpStatus.FORBIDDEN.value());
90+
response.setContentType("application/json");
91+
response.getWriter().write("{\"message\":\"Access denied\"}");
92+
}))
93+
.sessionManagement(session -> session
94+
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
95+
)
96+
.authenticationProvider(authenticationProvider())
97+
.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
10598

10699
return http.build();
107-
}
100+
}
108101

109102
@Bean
110103
public AuthenticationProvider authenticationProvider() {

0 commit comments

Comments
 (0)