From eb9665d0556bd5bf2dd9be1aa2537f2962b2ca6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=91=A8=E6=B6=9B?= <zhoutaoo@foxmail.com>
Date: Thu, 10 Sep 2026 00:35:51 +0800
Subject: [PATCH 1/3] feat: secure actuator metrics with internal tokens

---
 pom.xml                                             |  8 ++++++--
 ...nternalTokenManagementSecurityConfiguration.java | 13 +++++++++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 6c917fc..0843bc2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,11 +7,11 @@
     <parent>
         <artifactId>opensabre-base-dependencies</artifactId>
         <groupId>io.github.opensabre</groupId>
-        <version>1.1.3</version>
+        <version>1.1.4-SNAPSHOT</version>
     </parent>
 
     <artifactId>base-sysadmin</artifactId>
-    <version>1.1.3</version>
+    <version>1.1.4-SNAPSHOT</version>
     <packaging>jar</packaging>
 
     <name>base-sysadmin</name>
@@ -65,6 +65,10 @@
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-governance</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-security</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-eda</artifactId>
diff --git a/src/main/java/io/github/opensabre/sysadmin/internaltoken/config/InternalTokenManagementSecurityConfiguration.java b/src/main/java/io/github/opensabre/sysadmin/internaltoken/config/InternalTokenManagementSecurityConfiguration.java
index afea936..e384802 100644
--- a/src/main/java/io/github/opensabre/sysadmin/internaltoken/config/InternalTokenManagementSecurityConfiguration.java
+++ b/src/main/java/io/github/opensabre/sysadmin/internaltoken/config/InternalTokenManagementSecurityConfiguration.java
@@ -1,5 +1,7 @@
 package io.github.opensabre.sysadmin.internaltoken.config;
 
+import io.github.opensabre.security.actuator.ActuatorMonitoringAccess;
+import io.github.opensabre.security.webmvc.InternalTokenAuthenticationFilter;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.convert.converter.Converter;
@@ -10,6 +12,7 @@
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
 import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
+import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter;
 import org.springframework.security.web.SecurityFilterChain;
 
 /**
@@ -21,7 +24,9 @@ public class InternalTokenManagementSecurityConfiguration {
     private static final String MANAGEMENT_PATH = "/security/internal-token/keys/**";
 
     @Bean
-    public SecurityFilterChain sysadminSecurityFilterChain(HttpSecurity http)
+    public SecurityFilterChain sysadminSecurityFilterChain(
+            HttpSecurity http,
+            InternalTokenAuthenticationFilter internalTokenAuthenticationFilter)
             throws Exception {
         http
                 .csrf(csrf -> csrf.disable())
@@ -29,9 +34,13 @@ public SecurityFilterChain sysadminSecurityFilterChain(HttpSecurity http)
                         session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(authorize -> authorize
                         .requestMatchers(MANAGEMENT_PATH).hasAuthority("ADMIN")
+                        .requestMatchers(ActuatorMonitoringAccess.metricPathArray())
+                        .hasAuthority(ActuatorMonitoringAccess.AUTHORITY)
                         .anyRequest().permitAll())
                 .oauth2ResourceServer(resourceServer -> resourceServer
-                        .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())));
+                        .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())))
+                .addFilterBefore(internalTokenAuthenticationFilter,
+                        BearerTokenAuthenticationFilter.class);
         return http.build();
     }
 

From d28252993ad9d232b6bf390d9c1110cc9e0e3c7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=91=A8=E6=B6=9B?= <zhoutaoo@foxmail.com>
Date: Fri, 11 Sep 2026 12:45:02 +0800
Subject: [PATCH 2/3] feat: adopt framework monitoring defaults

---
 pom.xml                            | 19 ++++++++-----------
 src/main/resources/application.yml |  2 +-
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0843bc2..e68ae52 100644
--- a/pom.xml
+++ b/pom.xml
@@ -69,6 +69,14 @@
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-security</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-webmvc</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.github.opensabre</groupId>
+            <artifactId>opensabre-starter-monitoring</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.github.opensabre</groupId>
             <artifactId>opensabre-starter-eda</artifactId>
@@ -81,17 +89,6 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
         </dependency>
-        <!-- Boot 4 OpenAPI endpoints and Knife4j user interface. -->
-        <dependency>
-            <groupId>org.springdoc</groupId>
-            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-            <version>3.0.3</version>
-        </dependency>
-        <dependency>
-            <groupId>com.github.xiaoymin</groupId>
-            <artifactId>knife4j-openapi3-ui</artifactId>
-            <version>4.5.0</version>
-        </dependency>
         <!--测试框架-->
         <dependency>
             <groupId>org.springframework.boot</groupId>
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index ef6b56e..bf966c8 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -77,7 +77,7 @@ management:
   endpoints:
     web:
       exposure:
-        include: '*'
+        include: health,info,metrics,prometheus,internalTokenKeyStatus
   tracing:
     sampling:
       probability: 1.0

From f25e07895753a065d3286b0bbbc3e8456948b3c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=91=A8=E6=B6=9B?= <zhoutaoo@foxmail.com>
Date: Sun, 13 Sep 2026 07:36:22 +0800
Subject: [PATCH 3/3] build: use framework 1.1.4

---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index e68ae52..4d036c4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,11 +7,11 @@
     <parent>
         <artifactId>opensabre-base-dependencies</artifactId>
         <groupId>io.github.opensabre</groupId>
-        <version>1.1.4-SNAPSHOT</version>
+        <version>1.1.4</version>
     </parent>
 
     <artifactId>base-sysadmin</artifactId>
-    <version>1.1.4-SNAPSHOT</version>
+    <version>1.1.4</version>
     <packaging>jar</packaging>
 
     <name>base-sysadmin</name>