mcp-server: refactor configurer

Signed-off-by: Daniel Garnier-Moiroux <[email protected]>

Author: Kehrlann

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/apikey/web/ApiKeyAuthenticationFilter.java

@@ -43,18 +43,15 @@ public ApiKeyAuthenticationFilter(AuthenticationManager authenticationManager) {
 		this(authenticationManager, new ApiKeyAuthenticationConverter(DEFAULT_API_KEY_HEADER));
 	}
 
-	public ApiKeyAuthenticationFilter(AuthenticationManager authenticationManager, AuthenticationConverter authenticationConverter) {
+	public ApiKeyAuthenticationFilter(AuthenticationManager authenticationManager,
+			AuthenticationConverter authenticationConverter) {
 		super(authenticationManager, authenticationConverter);
 
 		setSuccessHandler(new PassthroughSuccessHandler());
 		setFailureHandler(
 				new AuthenticationEntryPointFailureHandler(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)));
 	}
 
-	public void setApiKeyHeader(String apiKeyHeader) {
-		setAuthenticationConverter(new ApiKeyAuthenticationConverter(apiKeyHeader));
-	}
-
 	private static class PassthroughSuccessHandler implements AuthenticationSuccessHandler {
 
 		@Override

mcp-server-security/src/main/java/org/springaicommunity/mcp/security/server/config/McpApiKeyConfigurer.java

@@ -18,6 +18,7 @@
 
 import org.springaicommunity.mcp.security.server.apikey.ApiKeyEntityRepository;
 import org.springaicommunity.mcp.security.server.apikey.authentication.ApiKeyAuthenticationProvider;
+import org.springaicommunity.mcp.security.server.apikey.web.ApiKeyAuthenticationConverter;
 import org.springaicommunity.mcp.security.server.apikey.web.ApiKeyAuthenticationFilter;
 
 import org.springframework.security.authentication.AuthenticationManager;
@@ -26,6 +27,7 @@
 import org.springframework.security.web.authentication.AuthenticationConverter;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
 
 /**
  * @author Daniel Garnier-Moiroux
@@ -51,14 +53,21 @@ public void configure(HttpSecurity http) throws Exception {
 
 		var authManager = http.getSharedObject(AuthenticationManager.class);
 
-		var filter = new ApiKeyAuthenticationFilter(authManager);
-		if (this.headerName != null) {
-			filter.setApiKeyHeader(this.headerName);
-		}
+		var authenticationConverter = getAuthenticationConverter();
+		var filter = authenticationConverter != null
+				? new ApiKeyAuthenticationFilter(authManager, authenticationConverter)
+				: new ApiKeyAuthenticationFilter(authManager);
+		http.addFilterBefore(filter, BasicAuthenticationFilter.class);
+	}
+
+	private AuthenticationConverter getAuthenticationConverter() {
 		if (this.authenticationConverter != null) {
-			filter.setAuthenticationConverter(this.authenticationConverter);
+			return this.authenticationConverter;
 		}
-		http.addFilterBefore(filter, BasicAuthenticationFilter.class);
+		if (StringUtils.hasText(this.headerName)) {
+			return new ApiKeyAuthenticationConverter(this.headerName);
+		}
+		return null;
 	}
 
 	/**