When attempting to POST user credentials to the login endpoint (http://localhost:8080/api/auth/login), I consistently encounter the following issue:

2024-05-01T14:34:53.434-03:00 DEBUG 9960 --- [transit-system] [nio-8080-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext

Additionally, in Postman, the server responds with a 401 Unauthorized error, instead of providing the expected detailed user information.

Repository Link: (https://github.com/Diego-Pimenta/transit-system/tree/dev)

Main Relevant Files:
SecurityConfig:

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true)
@RequiredArgsConstructor
public class SecurityConfig {

    private final AuthenticationProvider authenticationProvider;

    private final JwtAuthenticationFilterApi jwtAuthenticationFilterApi;

    private static final String[] PUBLIC = {
            "/auth/login"
    };

    private static final String[] USER = {
            "/users/**",
            "/search/**"
    };

    private static final String[] WORKER = {
            "/tickets/**",
            "/vehicles/**",
            "/driver-tickets/**"
    };

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .cors(cors->cors.configurationSource(corsConfigurationSource()))
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(
                        auth -> auth
                                .requestMatchers(PUBLIC).permitAll()
                                .requestMatchers(USER).hasAnyRole("WORKER", "USER")
                                .requestMatchers(WORKER).hasRole("WORKER")
                                .anyRequest().authenticated()
                )
                .sessionManagement(
                        session -> session
                                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                )
                .authenticationProvider(authenticationProvider)
                .addFilterBefore(jwtAuthenticationFilterApi, UsernamePasswordAuthenticationFilter.class)
                .exceptionHandling(
                        e -> e
                                .accessDeniedHandler((request, response, accessDeniedException)->response.setStatus(403))
                                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
                )
                .logout(
                        l -> l
                                .logoutUrl("/auth/logout")
                                .logoutSuccessHandler(((request, response, authentication) -> SecurityContextHolder.clearContext()))
                )
                .build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.setAllowedOrigins(Arrays.asList("*"));
        corsConfiguration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
        corsConfiguration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "PATCH", "DELETE"));
        corsConfiguration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfiguration);
        return source;
    }
}

AppConfig:

@Configuration
@RequiredArgsConstructor
public class AppConfig {

    private final UserRepository repository;

    @Bean
    public UserDetailsService userDetailsService() {
        return username -> repository.findByCpf(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    }

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
        return configuration.getAuthenticationManager();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService());
        authProvider.setPasswordEncoder(bCryptPasswordEncoder());
        return authProvider;
    }
}

I expect to receive a response with detailed user information in the body upon successful authentication.

Attempts to Solve:

Initially tried permitting all requests by removing .authenticated(), which resulted in a 500 Internal Server Error with the following server response:

{
    "type": "about:blank",
    "title": "Internal Server Error",
    "status": 500,
    "detail": "No static resource api/auth/login.",
    "instance": "/api/auth/login",
    "description": "Unknown internal server error."
}

The Spring console continues to print the same debug message:
2024-05-01T14:59:57.956-03:00 DEBUG 3132 --- [transit-system] [nio-8080-exec-2] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext