Update SecurityConfig to refine request authorization rules

[apaegs]

• Add role-based access control for /admin/**, /handler/**, and /user/** paths
• Include /favicon.ico in permitted requests
• Update exception handling to redirect to the home page on access denial

Summary by CodeRabbit

• New Features

  • Added a user-facing "Access Denied" page (403) with a link back to home.
  • Improved post-login handling to ensure consistent redirect behavior after sign-in.

• Bug Fixes

  • Enforced role-specific access for admin, handler, and user routes.
  • Allowed unauthenticated access to favicon and public assets.
  • Tightened authentication for all other requests.

[coderabbitai]

Warning

Rate limit exceeded

@apaegs has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 45 minutes and 42 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f58c7cd6-57ef-45b1-bc24-532043e0b4dd

📥 Commits

Reviewing files that changed from the base of the PR and between ccb01fd and 501faf8.

📒 Files selected for processing (1)

• src/main/java/org/example/untitled/config/SecurityConfig.java

📝 Walkthrough

Walkthrough

Security wiring changed: CustomAuthenticationSuccessHandler is now a Spring component and injected into SecurityConfig; SecurityConfig enforces role-based access for /admin/, /handler/, /user/**, adds /favicon.ico to permit-all, and redirects access-denied to /access-denied. HomeController adds an /access-denied GET returning a 403 view and a new template was added.

Changes

Cohort / File(s)	Summary
Security configuration src/main/java/org/example/untitled/config/SecurityConfig.java	Replaced bean factory for AuthenticationSuccessHandler with constructor injection of CustomAuthenticationSuccessHandler; added role-based matchers for "/admin/**", "/handler/**", "/user/**"; added "/favicon.ico" to permit-all; configured access-denied redirect to "/access-denied".
Authentication success handler src/main/java/org/example/untitled/security/CustomAuthenticationSuccessHandler.java	Marked handler as a Spring component (@Component) so it can be injected; formatting newline added.
Access-denied endpoint & template src/main/java/org/example/untitled/HomeController.java, src/main/resources/templates/access_denied.html	Added GET /access-denied route returning access_denied view with HTTP 403 status and new Thymeleaf template for the access-denied page.

Sequence Diagram(s)

sequenceDiagram
    participant Browser
    participant SecurityFilterChain as "Spring Security\nFilter Chain"
    participant AuthHandler as "CustomAuthenticationSuccessHandler"
    participant AppController as "HomeController / Controllers"

    Browser->>SecurityFilterChain: POST /login (credentials)
    SecurityFilterChain-->>SecurityFilterChain: Authenticate via UserDetailsService
    alt authentication success
        SecurityFilterChain->>AuthHandler: onAuthenticationSuccess()
        AuthHandler-->>Browser: HTTP 302 Redirect to target (based on roles)
        Browser->>AppController: GET /user or /admin...
        AppController-->>Browser: 200 OK (page)
    else access denied (forbidden)
        Browser->>AppController: GET protected resource
        AppController-->>Browser: 302 -> /access-denied
        Browser->>AppController: GET /access-denied
        AppController-->>Browser: 403 Forbidden (access_denied view)
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix: preserve SavedRequest in auth success handler and fix deleteFile… #130 — related changes to authentication-success handler wiring and redirect logic.
• Feature/35 handler support access #56 — related SecurityConfig changes (method security and config adjustments).

Suggested reviewers

• Xeutos
• FeFFe1996

Poem

🐰 I hopped through filters, light and spry,
Injected handlers, gave login a try.
Favicon free, roles set just right,
Denied folks sent to a polite, stern sight.
Hooray — secure fields under moonlight!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: refining authorization rules in SecurityConfig with role-based access control, permit-all routes, and access-denied handling.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/role-based-access-control

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/main/java/org/example/untitled/config/SecurityConfig.java`:
- Around line 52-53: The current SecurityConfig uses .exceptionHandling(...
.accessDeniedPage("/")) which silently redirects 403s to the home page; change
this to either route to a dedicated page (e.g., replace accessDeniedPage("/")
with accessDeniedPage("/access-denied") and add a controller/view for
/access-denied that returns a 403 status) or register a custom
AccessDeniedHandler (implement AccessDeniedHandler and set it via
exceptionHandling(ex -> ex.accessDeniedHandler(new YourAccessDeniedHandler()))
to preserve the 403 status and optionally add a flash attribute or log the
AccessDeniedException). Ensure modifications are made in SecurityConfig and add
the new controller/class names (e.g., AccessDeniedHandlerImpl and
AccessDeniedController) referenced above.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f021d9ca-abef-4c90-9d1e-fdf5a1eb88dc

📥 Commits

Reviewing files that changed from the base of the PR and between 2ada33f and dfd2447.

📒 Files selected for processing (1)

• src/main/java/org/example/untitled/config/SecurityConfig.java

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/main/java/org/example/untitled/config/SecurityConfig.java`:
- Around line 36-41: Update the security matcher configuration in SecurityConfig
so the access-denied page is publicly reachable: add "/access-denied" to the
list passed to requestMatchers(...).permitAll() (the chain that currently lists
"/auth/**", "/", "/home", "/images/**", "/style.css", "/upload/**", "/login",
"/register", "/favicon.ico") so that Spring Security won't require
authentication for direct or forwarded requests to the accessDeniedPage; modify
the requestMatchers usage in the SecurityConfig class accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d089599a-7124-44f5-8ee1-e17a886ceef1

📥 Commits

Reviewing files that changed from the base of the PR and between dfd2447 and ccb01fd.

📒 Files selected for processing (4)

• src/main/java/org/example/untitled/HomeController.java
• src/main/java/org/example/untitled/config/SecurityConfig.java
• src/main/java/org/example/untitled/security/CustomAuthenticationSuccessHandler.java
• src/main/resources/templates/access_denied.html

✅ Files skipped from review due to trivial changes (2)

• src/main/java/org/example/untitled/security/CustomAuthenticationSuccessHandler.java
• src/main/resources/templates/access_denied.html