content: package com.example.resourceserver.config;
  
  import org.springframework.beans.factory.annotation.Value;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.Customizer;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.oauth2.core.OAuth2TokenValidator;
  import org.springframework.security.oauth2.jwt.*;
  import org.springframework.security.web.SecurityFilterChain;
  import org.springframework.web.cors.CorsConfiguration;
  import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  import org.springframework.web.filter.CorsFilter;
  import java.util.List;
  
  @Configuration
  public class SecurityConfig {
  
    @Bean
    SecurityFilterChain rs(HttpSecurity http) throws Exception {
      http
        .authorizeHttpRequests(auth -> auth
          .requestMatchers("/public/**").permitAll()
          .anyRequest().hasAuthority("SCOPE_api.read"))
        .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
        .cors(Customizer.withDefaults());
      return http.build();
    }
  
    @Bean
    public JwtDecoder jwtDecoder(@Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}") String issuer,
                                 @Value("${rs.jwk-set-uri}") String jwkSetUri) {
      NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
      OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuer);
      decoder.setJwtValidator(withIssuer);
      return decoder;
    }
  
    @Bean
    public CorsFilter corsFilter(@Value("${cors.allowed-origins}") String origins) {
      CorsConfiguration cfg = new CorsConfiguration();
      cfg.setAllowedOrigins(List.of(origins));
      cfg.setAllowedMethods(List.of("GET","POST","OPTIONS"));
      cfg.setAllowedHeaders(List.of("*"));
      cfg.setAllowCredentials(true);
      UrlBasedCorsConfigurationSource src = new UrlBasedCorsConfigurationSource();
      src.registerCorsConfiguration("/**", cfg);
      return new CorsFilter(src);
    }
  }
  