content: package com.alibou.whatsappclone.security;
  
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.http.HttpHeaders;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
  import org.springframework.security.web.SecurityFilterChain;
  import org.springframework.web.cors.CorsConfiguration;
  import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  import org.springframework.web.filter.CorsFilter;
  
  import java.util.Arrays;
  import java.util.Collections;
  
  import static org.springframework.security.config.Customizer.withDefaults;
  
  @Configuration
  @EnableWebSecurity
  public class SecurityConfig {
  
      @Bean
      public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
                  .cors(withDefaults())
                  .csrf(AbstractHttpConfigurer::disable)
                  .authorizeHttpRequests(req ->
                          req
                                  .requestMatchers("/auth/**",
                                          "/v2/api-docs",
                                          "/v3/api-docs",
                                          "/v3/api-docs/**",
                                          "/swagger-resources",
                                          "/swagger-resources/**",
                                          "/configuration/ui",
                                          "/configuration/security",
                                          "/swagger-ui/**",
                                          "/webjars/**",
                                          "/swagger-ui.html",
                                          "/ws/**")
                                  .permitAll()
                                  .anyRequest().authenticated()
                          )
                  .oauth2ResourceServer(auth ->
                          auth.jwt(token ->
                                  token.jwtAuthenticationConverter(new KeycloakJwtAuthenticationConverter())));
          return http.build();
      }
  
      @Bean
      public CorsFilter corsFilter() {
          final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          final CorsConfiguration config = new CorsConfiguration();
          config.setAllowCredentials(true);
          config.setAllowedOrigins(Collections.singletonList("http://localhost:4200"));
          config.setAllowedHeaders(Arrays.asList(
                  HttpHeaders.ORIGIN,
                  HttpHeaders.CONTENT_TYPE,
                  HttpHeaders.ACCEPT,
                  HttpHeaders.AUTHORIZATION
          ));
          config.setAllowedMethods(Arrays.asList(
                  "GET",
                  "POST",
                  "DELETE",
                  "PUT",
                  "PATCH"
          ));
          source.registerCorsConfiguration("/**", config);
          return new CorsFilter(source);
  
      }
  }
  