Fix broken Swagger path due to incomplete Spring Security configuration (#23)

[men229]

What was fixed

• Allowed access to Swagger UI endpoints
• Permitted /v3/api-docs and /api.yaml
• Fixed 403 error when loading OpenAPI documentation

Closes #23

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • API documentation endpoints (Swagger UI and OpenAPI docs) are now publicly accessible without requiring authentication.

Walkthrough

The PR updates Spring Security configuration to resolve Swagger access issues by permitting unauthenticated requests to Swagger UI and OpenAPI documentation endpoints, while also simplifying the method signature by removing the throws declaration.

Changes

Spring Security Configuration for Swagger Access

Layer / File(s)	Summary
Security Filter Chain Configuration for Swagger Access backend/smartjam-api/src/main/java/com/smartjam/smartjamapi/config/SecurityConfig.java	The securityFilterChain method signature removes the throws Exception clause. HTTP authorization is updated to permit unauthenticated access to Swagger documentation routes (/swagger-ui/**, /v3/api-docs/**, /api.yaml) and auth endpoints (/api/v1/auth/**) via the initial requestMatchers(...).permitAll() configuration.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Swagger paths now shine bright,
Spring Security set it right,
Docs accessible, no auth wall,
OpenAPI serves us all! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: fixing Spring Security configuration to allow Swagger/OpenAPI documentation access.
Description check	✅ Passed	The description is clearly related to the changeset, listing specific endpoints permitted and the issue being resolved.
Linked Issues check	✅ Passed	The pull request meets the primary objective from issue #23 by configuring Spring Security to permit Swagger UI and OpenAPI documentation endpoints.
Out of Scope Changes check	✅ Passed	All changes are scoped to fixing the Spring Security configuration for Swagger access; no unrelated modifications are present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch men228/fix/swagger-security-23

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@backend/smartjam-api/src/main/java/com/smartjam/smartjamapi/config/SecurityConfig.java`:
- Around line 26-27: The current SecurityConfig change permits "/swagger-ui/**",
"/v3/api-docs/**", and "/api.yaml" via
authorizeHttpRequests(requestMatchers(...)) which exposes API docs in
production; update the configuration to restrict Swagger in prod by introducing
environment-specific SecurityFilterChain beans (e.g., devSecurityFilterChain and
prodSecurityFilterChain) and annotate with `@Profile`("!prod") and
`@Profile`("prod") respectively, keeping the existing jwtAuthFilter and session
policy but only permitting Swagger endpoints in non-production and removing them
from the permitAll requestMatchers in the production chain (or require
authentication) so that SecurityConfig no longer publicly exposes Swagger in
prod.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 55f6b608-6757-4061-a41b-e0b42c8e321b

📥 Commits

Reviewing files that changed from the base of the PR and between 8e323e8 and b668302.

📒 Files selected for processing (1)

• backend/smartjam-api/src/main/java/com/smartjam/smartjamapi/config/SecurityConfig.java

[Satlykovs]

Пойдет