Himai Minh

I heard we are not recommended to use milestone versions because those versions are not stable.
Have you try those stable versions without the milestone?

Do you put @Autowired to UserRepository?

Does this package org.springframework.transaction.annotation exist in your classpath in your project?
If not, try to reimport the dependencies from your POM.

Does this help: https://stackoverflow.com/questions/70920113/the-following-method-did-not-exist-com-mongodb-connection-clustersettings-getde ?
Does add this help ? Try to put any available version for the mongodb driver core.
<dependency>
       <groupId>org.mongodb</groupId>
       <artifactId>mongodb-driver-core</artifactId>
       <version> ... </version>
   </dependency>

Your username should be root. I don't know your password.

How about trying any different Spring Boot version?

Does this help:
https://stackoverflow.com/questions/74146917/spring-security-the-request-was-rejected-because-the-url-contained-a-potential  ?

Does this discussion help:
https://github.com/spring-projects/spring-security/issues/14636  ?

Also, my next test is to use  @PreAuthorize("hasAuthority('USER')") for the get endpoint instead of @RolesAllowed.
It now works.

So far, I made some changes to your code:
public class JwtTokenProvider { public String createAccessToken(long id, String username, Role role){        Claims claims = Jwts.claims().subject(username)                .add("id",id)                .add("scope","read")  //use read instead of access                .add("role",role.name())                .build();          return Jwts.builder()                .header()                .add("type","JWT")   //use type instead of typ                .and()               ....    }

import jakarta.annotation.security.RolesAllowed; @RestController @RequestMapping("/endpoints") public class EndPoints {    //use RolesAllowed instead of @PreAuthorize    @GetMapping("/user")   @RolesAllowed({"USER"})    public String ordinaryUsersOnly(){        return "Ordinary users only";    }

In application.properties, use this property instead of create-drop to recreate the table every time I start the application:
spring.jpa.hibernate.ddl-auto=validate
I use port 8080 instead of 6666
I use Postman to do the following:
1. I first send a POST request at  localhost:8080/auth/register.
I submit these info in JSON
{
       
        "firstname" : "John",
         "lastname": "Smith",
         "username" : "jsmith3",
         "password": "smith3",
         "email" : "[email protected]"
       
   }
2. I then send a POST request at localhost:8080/auth/login
{       "username" : "jsmith3",
         "password": "smith3"
}
I got the access token
3. I create another GET request at localhost:8080/endpoints/user
Under the Authorization panel, copy and paste the token in the Bearer Token field.
4. So far, I get access to the endpoint

Does this article help:
https://www.baeldung.com/security-none-filters-none-access-permitAll ?

Section 5 of the article says this:

Also note that, if an <http> element doesn’t specify a pattern, then by default, that maps to the universal match pattern – “/**” – so again, this element
needs to be last. If the order of the elements is not correct, the creation of the security filter chain will fail:

One more additional note to my previous post.
Can you try to create a second user , maybe called John and a password for John?
Then, you, as Obert user,  log in and log out.
Then, you log in as John. See if John can be authenticated.

As I check your CustomLogoutHandler, it simply deletes the token, which was once used by the user and no longer needed.
It should not affect the authorities of the user.
So, when you log back in, you are denied again.
Maybe, put some debuggers in the JwtAuthenticationFilter and see.

I don't understand why you need to use the refreshToken like this:
String access_token = jwtTokenProvider.createAccessToken(user_id,username,Role.valueOf(role));     String refresh_token = jwtTokenProvider.createRefreshToken(user_id).getRefresh_token();        return LoginResponse.builder()                .access_token(access_token)                .refresh_token(refresh_token)                .build();

Also, one more thing. From the above public free example, I notice the author encrypted the text password of the user:
https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/bootstrap/DefaultBreweryLoader.java
https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/config/SecurityConfig.java

I am not sure if you need to encrypt your raw text password before you convert it to JWT token.

Also, one more additional note to my above comment. I found a public free educational example Github https://github.com/springframeworkguru/ssc-brewery/blob/mtc-secure-read-beer-order/src/main/java/guru/sfg/brewery/security/JpaUserDetailsService.java
This example shows:

   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {         //the findByUsername returns a User instead of UserDetails        return userRepository.findByUsername(username).orElseThrow(() -> {            return new UsernameNotFoundException("User name: " + username + " not found");        });    }

So, in your code, you can do this:
 public class OurUserDetailsService implements UserDetailsService {    private final UserRepository userRepository;    @Override    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {        User user = userRepository.findByUsername(username)                .orElseThrow(()-> new UsernameNotFoundException("OurUserDetailsService-: Username not found"));        Set<GrantedAuthority> authorities = new HashSet<>();     //return User which is a child of UserDetails anyway      return user;       //   return new org.springframework.security.core.userdetails.User(   //             user.getUsername(),       //         user.getPassword(),      //          authorities);    }

First of all, where is this error coming from : ((User)userDetails).password = Cannot find local variable 'userDetails'   ?

In the AuthService class,  can you put some debuggers in the login method  to see how it goes?
Especially inside the generateNewAccessToken method, put a debugger in this line:  UserDetails userDetails = ourUserDetailsService.loadUserByUsername(username);

Also, in the JwtAuthenticationFilter class, can you put some debuggers in this piece of code:
if(jwtTokenProvider.isTokenValid(jwtToken,userDetails)){                UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(                        userDetails,                        null,                        userDetails.getAuthorities()                );                authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));                SecurityContextHolder.getContext().setAuthentication(authenticationToken);            }        }        filterChain.doFilter(request,response);

That way, you can see if your token is valid or invalid.