From 16b11873b6cb2461cdbd43af30915685e58a349c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=BD=AF=E5=AE=89=E7=A7=91=E6=8A=80=EF=BC=88SoftSec-Tech?=
 =?UTF-8?q?=EF=BC=89?= <opensource@softsec-tech.cn>
Date: Fri, 12 Dec 2025 14:29:56 +0800
Subject: [PATCH] Add files via upload

---
 SecurityConfig.java | 49 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 SecurityConfig.java

diff --git a/SecurityConfig.java b/SecurityConfig.java
new file mode 100644
index 0000000..92bcf04
--- /dev/null
+++ b/SecurityConfig.java
@@ -0,0 +1,49 @@
+package com.softsafe.sast.platform.config.security;
+
+import com.softsafe.sast.platform.config.RestAccessDeniedHandler;
+import com.softsafe.sast.platform.config.RestAuthenticationEntryPoint;
+import lombok.RequiredArgsConstructor;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+@RequiredArgsConstructor
+public class SecurityConfig {
+    private final RestAuthenticationEntryPoint restAuthEntryPoint;
+    private final RestAccessDeniedHandler restAccessDeniedHandler;
+    private final OAuth2LoginSuccessHandler oauth2LoginSuccessHandler;
+
+    @Bean
+    @Order(2)
+    public SecurityFilterChain applicationSecurity(HttpSecurity http) throws Exception {
+
+        http.exceptionHandling(ex -> ex
+                        .authenticationEntryPoint(restAuthEntryPoint)
+                        .accessDeniedHandler(restAccessDeniedHandler)
+                )
+                .authorizeHttpRequests(authorize -> authorize
+                        .requestMatchers(
+                                "/", "/login", "/login.html",
+                                "/error",
+                                "/github/webhook",
+                                "/api/sast/**",
+                                "/favicon.ico", "/icons/**"
+                        ).permitAll()
+                        .anyRequest().authenticated()
+                )
+                .oauth2Login(oauth2 -> oauth2
+                        .successHandler(oauth2LoginSuccessHandler)
+                        .failureUrl("/login?error")
+                )
+                .csrf(csrf -> csrf
+                        .ignoringRequestMatchers("/github/webhook", "/api/sast/**")
+                );
+
+        return http.build();
+    }
+}