fix(security): close the Steam test endpoint, /internal and Prometheus to the public

/api/steam/test/{steamId} let anyone query any Steam profile with our API key. /internal/** had no controller but was open for any future one. Actuator now exposes only health, without details. The management block was also indented under endpoints, so show-details never applied.

src/main/java/core_service/configuration/security/SecurityConfig.java

@@ -25,11 +25,8 @@ import java.util.List;
 public class SecurityConfig {
 
     private static final String[] WHITE_LIST_URLS = {
-            "/internal/**",           // Allow internal service communication
-            "/actuator/health",
-            "/actuator/prometheus",
+            "/actuator/health",       // Docker health check; details are off
             "/error",
-            "/api/steam/test/**",
             "/api/stats/public"
     };
 

src/main/java/core_service/modules/steam_adapter/api/SteamTestController.java

@@ -1,32 +0,0 @@
-package core_service.modules.steam_adapter.api;
-
-import core_service.modules.steam_adapter.api.dto.response.SteamProfileAndGamesResponse;
-import core_service.modules.steam_adapter.service.SteamApiService;
-import lombok.RequiredArgsConstructor;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-import java.util.Optional;
-
-@RestController
-@RequestMapping("/api/steam/test")
-@RequiredArgsConstructor
-public class SteamTestController {
-
-    private final SteamApiService steamApiService;
-
-    @GetMapping("/{steamId}")
-    public ResponseEntity<?> testSteamConnection(@PathVariable String steamId) {
-
-        Optional<SteamProfileAndGamesResponse> profileOpt = steamApiService.getFullPlayerProfile(steamId);
-
-        if (profileOpt.isPresent()) {
-            return ResponseEntity.ok(profileOpt.get());
-        } else {
-            return ResponseEntity.notFound().build();
-        }
-    }
-}

src/main/resources/application.yml

@@ -26,14 +26,10 @@ management:
   endpoints:
     web:
       exposure:
-        include: health, prometheus, metrics
-    endpoint:
-      health:
-        show-details: always
-    prometheus:
-      metrics:
-        export:
-          enabled: true
+        include: health
+  endpoint:
+    health:
+      show-details: never
 security:
   jwt:
     public-key: ${JWT_PUBLIC_KEY}