fix(security): hide health details and close Prometheus to the public

/actuator/health showed database and disk details to anyone, and /actuator/prometheus was open. Only health stays public, as plain UP/DOWN for the Docker health check.

src/main/java/auth_service/configuration/security/SecurityConfig.java

@@ -36,8 +36,7 @@ public class SecurityConfig {
             "/api/auth/**",           // Allow login, registration, etc.
             "/api/registration/**",   // Allow new user registration
             "/api/stats/public",      // Public landing-page counters (cached, no PII)
-            "/actuator/health",       // Allow health checks (e.g., for Docker/Traefik)
-            "/actuator/prometheus",   // Allow Prometheus to scrape metrics
+            "/actuator/health",       // Docker health check; details are off
             "/error"                  // Default Spring Boot error page routing
     };
 

src/main/resources/application.yml

@@ -31,15 +31,10 @@ management:
   endpoints:
     web:
       exposure:
-        # Expose health and metrics to the web
-        include: health, prometheus, metrics
+        include: health
   endpoint:
     health:
-      show-details: always
-  prometheus:
-    metrics:
-      export:
-        enabled: true
+      show-details: never
 
 # Security stuff
 security:

src/test/java/auth_service/configuration/security/PublicEndpointsTest.java

@@ -0,0 +1,35 @@
+package auth_service.configuration.security;
+
+import auth_service.shared.test.AbstractIntegrationTest;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.test.web.servlet.MockMvc;
+
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@AutoConfigureMockMvc
+class PublicEndpointsTest extends AbstractIntegrationTest {
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Test
+    void healthIsPublicWithoutDetails() throws Exception {
+        mockMvc.perform(get("/actuator/health"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.status").value("UP"))
+                .andExpect(jsonPath("$.components").doesNotExist());
+    }
+
+    @Test
+    void prometheusIsNotPublic() throws Exception {
+        int status = mockMvc.perform(get("/actuator/prometheus")).andReturn().getResponse().getStatus();
+        assertTrue(Set.of(401, 403).contains(status), "/actuator/prometheus answered " + status);
+    }
+}