test(security): replay Config Server deny RED on live develop

[seonghobae]

Advances issue #193 with preserved RED→GREEN lineage and a non-destructive live-base merge.

TDD lineage

• RED a8715d3378b9c534a59e46bfbcc7e7d4e9ea429c: boots the real native Config Server, proves anonymous /application/default was not denied while /actuator/health remained public.
• GREEN a8efeff47d2f338e412ace6ea54a0aa7db7e5b9b: adds Spring Security only to config-server plus a fail-closed filter chain permitting health/info and denying all configuration-resource reads. It deliberately does not invent a production service identity.
• Live-base repair a39b82d03ea3f04d7dbabbbf347891251756dd10: ordinary two-parent merge preserving the exact prior head and exact protected develop@1f06296faf7140eff03d069cc7def2d804c02b98. The merge tree was built from the live develop tree and overlays only the three proven Config Server files; no force-push, rebase, ours/theirs strategy, or evidence rewrite was used.

Current exact state

• source head: a39b82d03ea3f04d7dbabbbf347891251756dd10
• independently resolved live base: develop@1f06296faf7140eff03d069cc7def2d804c02b98
• ancestry: current head descends from both prior GREEN head and live base
• changed files: config-server/pom.xml, ConfigServerSecurityConfiguration.java, ConfigServerInboundSecurityTest.java
• fresh exact-head workflows: CI 31588535828, Dependency Review 31588535910, SBOM 31588535840, SAST 31588535941, Security Scan 31588535822; all are currently queued and therefore non-passing
• formal independent non-author APPROVED review: absent
• unresolved review threads: none observed before the head repair

Keep Draft until the unchanged exact head has terminal-success gates, review feedback is revalidated, and a qualifying independent approval exists. Historical checks/reviews from a8efeff... do not transfer. #264 may be closed only after unique-work equivalence against this live-base successor is proven.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 27 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c99170cb-3652-484b-85ca-93ad8829858b

📥 Commits

Reviewing files that changed from the base of the PR and between 1f06296 and a39b82d.

📒 Files selected for processing (3)

• config-server/pom.xml
• config-server/src/main/java/com/xtrmetl/config/ConfigServerSecurityConfiguration.java
• config-server/src/test/java/com/xtrmetl/config/ConfigServerInboundSecurityTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}