Arosha

src/main/java/com/crimeLink/analyzer/config/SecurityConfig.java

@@ -40,6 +40,61 @@ public class SecurityConfig {
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         http
+            .csrf(csrf -> csrf.disable())
+            // CRITICAL FIX: Enable CORS using the bean configuration
+            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+            .authorizeHttpRequests(auth -> auth
+                .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
+                .requestMatchers("/api/auth/**").permitAll()
+                .requestMatchers("/api/health").permitAll()
+                .requestMatchers("/api/admin/health").permitAll()
+                .requestMatchers("/api/facial/health").permitAll()  // ML service health check
+                .requestMatchers("/api/call-analysis/health").permitAll()  // ML service health check
+                // ML Service endpoints
+                .requestMatchers("/api/call-analysis/**").hasRole("Investigator")
+                .requestMatchers("/api/facial/register").hasAnyRole("Investigator", "OIC")
+                .requestMatchers("/api/facial/criminals").hasAnyRole("Investigator", "OIC")
+                .requestMatchers("/api/facial/**").hasRole("Investigator")
+                // Criminal CRUD (direct DB, no Python)
+                .requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")
+                .requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")
+                .requestMatchers("/api/database/**").permitAll()
+                .requestMatchers("/api/test").permitAll()
+                .requestMatchers("/api/debug/**").permitAll() // 🔍 Debug endpoints
+                .requestMatchers("/error").permitAll() // Allow error page without auth
+                // Public endpoints
+                .requestMatchers("/api/vehicles/**").permitAll()
+                .requestMatchers("/api/mobile/auth/**").permitAll()
+                .requestMatchers("/api/duties/**").permitAll()
+                .requestMatchers("/api/crime-reports/map").permitAll()
+                .requestMatchers(HttpMethod.GET, "/api/crime-reports").permitAll()
+                .requestMatchers("/api/crime-reports/upload-evidence").authenticated()
+                .requestMatchers("/api/crime-reports/**").hasAnyRole("OIC", "Admin")
+                // Field Officer routes
+                .requestMatchers("/api/officers/me/**").hasRole("FieldOfficer")
+                .requestMatchers("/api/mobile/**").hasRole("FieldOfficer")
+                .requestMatchers("/api/leaves/**").permitAll()
+                // OIC-only routes
+                .requestMatchers("/api/duty-schedules/**").hasRole("OIC")
+                .requestMatchers("/api/weapon/**").hasRole("OIC")
+                .requestMatchers("/api/weapon-issue/**").hasRole("OIC")
+                // Admin/OIC/Investigator routes (officer data, locations, users)
+                .requestMatchers("/api/users/field-officers").hasAnyRole("Admin", "OIC", "Investigator")
+                .requestMatchers("/api/admin/officers/*/locations/**").hasAnyRole("Admin", "OIC", "Investigator")
+                .requestMatchers("/api/admin/**").hasAnyRole("OIC", "Admin")
+                .anyRequest().authenticated())
+            .exceptionHandling(exception -> exception
+                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
+                .accessDeniedHandler((request, response, accessDeniedException) -> {
+                    response.setStatus(HttpStatus.FORBIDDEN.value());
+                    response.setContentType("application/json");
+                    response.getWriter().write("{\"message\":\"Access denied\"}");
+                }))
+            .sessionManagement(session -> session
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+            )
+            .authenticationProvider(authenticationProvider())
+            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
                 .csrf(csrf -> csrf.disable())
                 // CRITICAL FIX: Enable CORS using the bean configuration
                 .cors(cors -> cors.configurationSource(corsConfigurationSource()))
@@ -111,7 +166,7 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
                 .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
 
         return http.build();
-    }
+        }
 
     @Bean
     public AuthenticationProvider authenticationProvider() {

src/main/resources/application.properties

@@ -1,3 +1,5 @@
+spring.config.import=optional:file:.env.properties
+
 spring.application.name=CrimeLinkAnalyzer
 
 # Server Configuration