add-security

What problem does it solve?

Adding Spring Security to a Spring Boot 4 project often causes every existing controller test to fail with unexpected 401/403 responses, because the security filter chain changes request authorization behavior at runtime.

Core Features & Use Cases

• Dependency-ready security setup: Adds the right Spring Security starters for baseline security plus JWT Resource Server and OAuth2 Client scenarios.
• Production-style SecurityFilterChain configuration: Provides stateless JWT and Basic Auth patterns, including explicit health endpoint access for Kubernetes probes.
• End-to-end test ripple fixes: Shows how to update @WebMvcTest, @SpringBootTest, E2E, and acceptance/Pact test setups so security-aware requests behave correctly.
• OpenAPI and pact alignment: Guides adding bearerAuth to the OpenAPI spec and handling authentication as an orthogonal concern for Pact provider verification.

Quick Start

Use the add-security skill when you need to secure an existing Spring Boot 4 API and keep your unit, component, E2E, acceptance, and contract tests passing after enabling authentication and authorization.