Update SecurityConfig.java

Author: krtksharma

src/main/java/com/cognizant/config/SecurityConfig.java

@@ -33,31 +33,33 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
             .cors(cors -> cors.configurationSource(corsConfigurationSource()))
             .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
-                // 1. Public Endpoints
-                .requestMatchers("/api/users/login", "/api/users/register").permitAll()
+                // Public — no token needed
+                .requestMatchers("/api/users/login").permitAll()
+                .requestMatchers("/api/users/register").permitAll()
                 .requestMatchers("/api/attachments/download/**").permitAll()
                 .requestMatchers("/swagger-ui/**", "/v3/api-docs/**").permitAll()
 
-                // 2. Attachment Endpoints (Requires Auth)
-                .requestMatchers(HttpMethod.POST, "/api/defects/*/attachments").authenticated()
-                .requestMatchers(HttpMethod.DELETE, "/api/attachments/**").authenticated()
-
-                // 3. Role-Based Endpoints
-                .requestMatchers(HttpMethod.POST, "/api/defects/new").hasRole("TESTER")
-                .requestMatchers(HttpMethod.PUT, "/api/defects/resolve").hasAnyRole("DEVELOPER", "TESTER")
-                .requestMatchers("/api/defects/report/**").hasRole("PRODUCTOWNER")
+                // Role-specific routes
+                .requestMatchers(HttpMethod.POST, "/api/defects/new")
+                    .hasRole("TESTER")
+                .requestMatchers(HttpMethod.PUT, "/api/defects/resolve")
+                    .hasAnyRole("DEVELOPER", "TESTER")
+                .requestMatchers("/api/defects/report/**")
+                    .hasRole("PRODUCTOWNER")
 
+                // Everything else just needs a valid token
                 .anyRequest().authenticated()
             )
-            .addFilterBefore(new JwtAuthFilter(jwtUtil), UsernamePasswordAuthenticationFilter.class);
+            .addFilterBefore(new JwtAuthFilter(jwtUtil),
+                             UsernamePasswordAuthenticationFilter.class);
 
         return http.build();
     }
 
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration config = new CorsConfiguration();
-        config.setAllowedOriginPatterns(List.of("*")); 
+        config.setAllowedOriginPatterns(List.of("*"));
         config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
         config.setAllowedHeaders(List.of("*"));
         config.setAllowCredentials(true);