Refactor tutorial service for public access and enhance authentication handling

src/main/java/com/jambotronGroup/jambotron/ZhiPuAi/ImageController.java

@@ -12,7 +12,11 @@ import org.springframework.web.bind.annotation.*;
 
 import java.util.List;
 
-@CrossOrigin(origins = "http://localhost:4200, https://pony-sincere-chimp.ngrok-free.app/", maxAge = 3600, allowCredentials="true")
+@CrossOrigin(origins = "http://localhost:4200, https://pony-sincere-chimp.ngrok-free.app/",
+        maxAge = 3600,
+        allowCredentials="true",
+        allowedHeaders = {"Content-Type", "Authorization", "X-Requested-With"}
+)
 @RestController
 @RequestMapping("/api/zhipuai")
 public class ImageController {

src/main/java/com/jambotronGroup/jambotron/controllers/TutorialController.java

@@ -24,7 +24,7 @@ import java.util.Optional;
 
 
 
-@CrossOrigin(origins = "${app.origin}", maxAge = 3600, allowCredentials="true")
+@CrossOrigin(origins = "http://localhost:4200", maxAge = 3600, allowCredentials="true")
 @RestController
 @RequestMapping("/api")
 public class TutorialController {
@@ -65,23 +65,25 @@ public class TutorialController {
   }
 
 
-  @GetMapping("/tutorials")
+  @GetMapping("/public/tutorials")
   public ResponseEntity<List<Tutorial>> getAllTutorials(@RequestParam(required = false) String title) {
     try {
       List<Tutorial> tutorials = new ArrayList<Tutorial>();
 
-      Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+/*      Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
       UserDetails userDetails = (UserDetails) authentication.getPrincipal();
       String name = authenticationFacade.getAuthentication().getName();
 
       User user = userRepository.findById(((UserDetailsImpl)userDetails).getId()).get();
-        if (user.getRoles().stream().anyMatch(role -> role.getName().name().equals("ROLE_ADMIN"))) {
+        if (user.getRoles().stream().anyMatch(role -> role.getName().name().equals("ROLE_ADMIN"))) {*/
+/*
           if (title == null)
             tutorialRepository.findAll().forEach(tutorials::add);
           else
             tutorialRepository.findByTitleContaining(title).forEach(tutorials::add);
+*/
 
-        } else {
+/*        } else {
 
             // If the user is not an admin, filter tutorials by user
             tutorialRepository.findByUserId(user.getId()).forEach(tutorials::add);
@@ -89,10 +91,10 @@ public class TutorialController {
                 return new ResponseEntity<>(HttpStatus.NO_CONTENT);
             }
             return new ResponseEntity<>(tutorials, HttpStatus.OK);
-        }
-
-
+        }*/
 
+      //all published tutorials without authentication
+      tutorialRepository.findByPublished(true).forEach(tutorials::add);
 
       if (tutorials.isEmpty()) {
         return new ResponseEntity<>(HttpStatus.NO_CONTENT);

src/main/java/com/jambotronGroup/jambotron/security/WebSecurityConfig.java

@@ -103,7 +103,7 @@ public class WebSecurityConfig implements WebMvcConfigurer {// extends WebSecuri
 
 	@Bean
 	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-		http.csrf(csrf -> csrf.disable())
+		http.csrf(csrf -> csrf.disable()).cors(cors -> cors.disable())
 				.exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
 				.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
 				.authorizeHttpRequests(auth ->
@@ -116,7 +116,7 @@ public class WebSecurityConfig implements WebMvcConfigurer {// extends WebSecuri
 								.requestMatchers("/main/**").permitAll()
 								.requestMatchers("/api/test/**").permitAll()
 
-								//.requestMatchers("/api/tutorials").hasRole("ADMIN")
+								.requestMatchers("/api/tutorials").permitAll()
 
 								.requestMatchers("/api/zhipuai/image/**").permitAll()
 
@@ -130,6 +130,12 @@ public class WebSecurityConfig implements WebMvcConfigurer {// extends WebSecuri
 
 								.requestMatchers("/api/settings").permitAll()
 								.requestMatchers("/api/system/**").permitAll()
+
+								// Allow public access to tutorials (without login)
+								.requestMatchers("/api/public/tutorials").permitAll()
+
+								.requestMatchers("/api/user").permitAll()
+
 								.anyRequest().authenticated()
 				);
 

src/main/java/com/jambotronGroup/jambotron/security/jwt/AuthEntryPointJwt.java

@@ -26,6 +26,7 @@ public class AuthEntryPointJwt implements AuthenticationEntryPoint {
           throws IOException, ServletException {
     logger.error("Unauthorized error: {}", authException.getMessage());
 
+    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Error: Unauthorized");
     response.setContentType(MediaType.APPLICATION_JSON_VALUE);
     response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);