refactor(security): centralize global CORS configuration

src/main/java/br/com/notehub/adapter/controller/MailController.java

@@ -9,15 +9,13 @@
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 import java.util.Objects;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @Hidden
 @RequestMapping("/api/v1/mail")
 @RequiredArgsConstructor

src/main/java/br/com/notehub/application/controller/auth/AuthController.java

@@ -25,7 +25,6 @@
 import org.springframework.web.bind.annotation.*;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/auth")
 @Tag(name = "Auth Controller", description = "Endpoints for authentication and authorization")
 @RequiredArgsConstructor

src/main/java/br/com/notehub/application/controller/comment/CommentController.java

@@ -26,7 +26,6 @@
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/notes")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "Comment Controller", description = "Endpoints for managing comments")

src/main/java/br/com/notehub/application/controller/flame/FlameController.java

@@ -23,7 +23,6 @@
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/flames")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "Flame Controller", description = "Endpoints for managing user flames")

src/main/java/br/com/notehub/application/controller/note/NoteController.java

@@ -28,7 +28,6 @@
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/notes")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "Note Controller", description = "Endpoints for managing notes")

src/main/java/br/com/notehub/application/controller/notification/NotificationController.java

@@ -18,12 +18,14 @@
 import org.springframework.data.web.PageableDefault;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.*;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
 
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/notifications")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "Notification Controller", description = "Endpoints for managing user notifications, including retrieving and marking notifications as read.")

src/main/java/br/com/notehub/application/controller/payment/PaymentController.java

@@ -23,7 +23,6 @@
 import org.springframework.web.bind.annotation.*;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/payment")
 @Tag(name = "Payment Controller", description = "Endpoints for managing payments")
 @RequiredArgsConstructor

src/main/java/br/com/notehub/application/controller/reply/ReplyController.java

@@ -26,7 +26,6 @@
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/notes/comments")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "Reply Controller", description = "Endpoints for managing replies")

src/main/java/br/com/notehub/application/controller/user/UserController.java

@@ -38,7 +38,6 @@
 import java.util.UUID;
 
 @RestController
-@CrossOrigin(origins = {"https://notehub.com.br"})
 @RequestMapping("/api/v1/users")
 @SecurityRequirement(name = "bearer-key")
 @Tag(name = "User Controller", description = "Endpoints for managing users")

src/main/java/br/com/notehub/infra/security/SecurityConfig.java

@@ -13,6 +13,11 @@
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.Arrays;
 
 @Configuration
 @EnableWebSecurity
@@ -53,7 +58,9 @@ public class SecurityConfig {
 
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-        return http.csrf(csrf -> csrf.disable())
+        return http
+                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+                .csrf(csrf -> csrf.disable())
                 .headers(httpSecurityHeadersConfigurer -> httpSecurityHeadersConfigurer.frameOptions(frameOptionsConfig -> frameOptionsConfig.disable()))
                 .sessionManagement((sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS)))
                 .authorizeHttpRequests(req -> {
@@ -78,4 +85,17 @@ public PasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();
     }
 
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowedOrigins(Arrays.asList("https://notehub.com.br"));
+        config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
+        config.setAllowedHeaders(Arrays.asList("*"));
+        config.setAllowCredentials(true);
+        config.setMaxAge(3600L);
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
+
 }