From dadd26e7bdb89a426c136c134fcb4be4318e3e23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Skj=C3=B8lberg?= <thomas.skjolberg@gmail.com>
Date: Fri, 28 Aug 2026 15:44:41 +0200
Subject: [PATCH] Move configuration of optional bean to avoid ordering problem

---
 .../JwtWebSecurityChainAutoConfiguration.java | 40 +++++++++----------
 1 file changed, 18 insertions(+), 22 deletions(-)

diff --git a/jwt-server/spring/jwt-spring-web/src/main/java/org/entur/jwt/spring/JwtWebSecurityChainAutoConfiguration.java b/jwt-server/spring/jwt-spring-web/src/main/java/org/entur/jwt/spring/JwtWebSecurityChainAutoConfiguration.java
index 64186eeca..755524348 100644
--- a/jwt-server/spring/jwt-spring-web/src/main/java/org/entur/jwt/spring/JwtWebSecurityChainAutoConfiguration.java
+++ b/jwt-server/spring/jwt-spring-web/src/main/java/org/entur/jwt/spring/JwtWebSecurityChainAutoConfiguration.java
@@ -89,21 +89,6 @@ public UserDetailsService userDetailsService() {
         return new NoUserDetailsService();  // avoid the default user.
     }
 
-    @Bean
-    @ConditionalOnProperty(name = "entur.jwt.decode.header.map-to-issuer.enabled", havingValue = "true")
-    @ConditionalOnMissingBean(JwtHeaderToIssuerMapper.class)
-    public JwtHeaderToIssuerMapper jwtHeaderToIssuerMapper(SecurityProperties securityProperties) {
-        int maxSize = securityProperties.getJwt().getDecode().getHeader().getMapToIssuer().getMaxSize();
-        return maxSize != -1 ? new BoundedJwtHeaderToIssuerMapper(maxSize) : new JwtHeaderToIssuerMapper();
-    }
-
-    @Bean
-    @ConditionalOnProperty(name = "entur.jwt.decode.header.map-to-issuer.enabled", havingValue = "true")
-    @ConditionalOnMissingBean(JwtHeaderToIssuerMapperDecider.class)
-    public JwtHeaderToIssuerMapperDecider jwtHeaderToIssuerHeaderMapperDecider() {
-        return new DefaultJwtHeaderToIssuerMapperDecider();
-    }
-
     @Configuration
     @ConditionalOnMissingBean(name = BeanIds.SPRING_SECURITY_FILTER_CHAIN)
     @ConditionalOnExpression("${entur.authorization.enabled:true} || ${entur.jwt.enabled:true}")
@@ -112,16 +97,25 @@ public static class CompositeWebSecurityConfigurerAdapter {
 
         private SecurityProperties securityProperties;
 
-        @Autowired(required = false)
-        private JwtHeaderToIssuerMapper jwtHeaderToIssuerMapper;
-
-        @Autowired(required = false)
-        private JwtHeaderToIssuerMapperDecider jwtHeaderToIssuerMapperDecider;
-
         public CompositeWebSecurityConfigurerAdapter(SecurityProperties securityProperties) {
             this.securityProperties = securityProperties;
         }
 
+        @Bean
+        @ConditionalOnProperty(name = "entur.jwt.decode.header.map-to-issuer.enabled", havingValue = "true")
+        @ConditionalOnMissingBean(JwtHeaderToIssuerMapper.class)
+        public JwtHeaderToIssuerMapper jwtHeaderToIssuerMapper(SecurityProperties securityProperties) {
+            int maxSize = securityProperties.getJwt().getDecode().getHeader().getMapToIssuer().getMaxSize();
+            return maxSize != -1 ? new BoundedJwtHeaderToIssuerMapper(maxSize) : new JwtHeaderToIssuerMapper();
+        }
+
+        @Bean
+        @ConditionalOnProperty(name = "entur.jwt.decode.header.map-to-issuer.enabled", havingValue = "true")
+        @ConditionalOnMissingBean(JwtHeaderToIssuerMapperDecider.class)
+        public JwtHeaderToIssuerMapperDecider jwtHeaderToIssuerHeaderMapperDecider() {
+            return new DefaultJwtHeaderToIssuerMapperDecider();
+        }
+
         @Bean
         @ConditionalOnExpression("${entur.authorization.enabled:true} && !${entur.jwt.enabled:true}")
         public SecurityFilterChain securityWebFilterChain(
@@ -143,7 +137,9 @@ public SecurityFilterChain filterChain(
                 HttpSecurity http,
                 JwkSourceMap jwkSourceMap,
                 List<JwtAuthorityEnricher> jwtAuthorityEnrichers,
-                List<OAuth2TokenValidator<Jwt>> jwtValidators
+                List<OAuth2TokenValidator<Jwt>> jwtValidators,
+                @Autowired(required = false) JwtHeaderToIssuerMapper jwtHeaderToIssuerMapper,
+                @Autowired(required = false) JwtHeaderToIssuerMapperDecider jwtHeaderToIssuerMapperDecider
         ) throws Exception {
 
             AuthorizationProperties authorization = securityProperties.getAuthorization();