chore(guide): remove decommissioned QDS_ADMIN role reference (dead code)

QDS_ADMIN was removed from the hiveops-auth Role enum (972a28a); no JWT can carry
ROLE_QDS_ADMIN. Strip the stale SecurityConfig hasAnyRole entry. Zero runtime change.

Refs hiveiq-src/hiveops-incident#253

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-07-07 22:35:38 -04:00
parent 7bc96eeaa7
commit d202a494ef
@@ -37,7 +37,7 @@ public class SecurityConfig {
.requestMatchers("/actuator/health", "/error").permitAll()
// Read-only guide API: any authenticated user (audience gating done in the controller)
.requestMatchers(HttpMethod.GET, "/api/v1/guide/**")
.hasAnyRole("USER", "CUSTOMER", "ADMIN", "MSP_ADMIN", "QDS_ADMIN", "BCOS_ADMIN")
.hasAnyRole("USER", "CUSTOMER", "ADMIN", "MSP_ADMIN", "BCOS_ADMIN")
.anyRequest().authenticated()
)
.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);