Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/main/java/com/example/solidconnection/auth/service/AuthTokenProvider.java`:
- Around line 80-85: Wrap the call to tokenProvider.parseSubject in
isValidAdminRefreshToken with a try-catch that catches parsing exceptions (e.g.,
IllegalArgumentException or the specific exception thrown by parseSubject) and
returns false on error; if parsing succeeds, proceed to use
tokenStorage.findToken(subject, AdminRefreshToken.class).map(...).orElse(false)
as before so any parse failure is normalized to false without propagating
exceptions.

In `@src/main/resources/config/application-variable.yml`:
- Around line 169-171: The admin refresh cookie is being set as secure
unconditionally which prevents browsers from saving it on http://localhost;
update AdminRefreshTokenCookieManager to set secure=false when running in
local/non-HTTPS environments or when the configured admin-refresh.cookie-domain
equals "localhost" (or is empty), and only set secure=true for HTTPS domains;
alternatively adjust application-variable.yml for local profile to use an empty
cookie-domain or a local-specific profile value and ensure the cookie builder
logic checks the domain/profile before applying secure(true).

In `@src/test/resources/application.yml`:
- Around line 95-98: The test YAML for token.admin-refresh is missing the
cookie-name required by the AdminRefreshTokenCookieProperties contract; update
the test configuration to include cookie-name (e.g., the same value used in
production) under token.admin-refresh so the AdminRefreshTokenCookieProperties
(cookie-name/cookie-domain) contract is satisfied and cookie creation in the
code paths that use AdminRefreshTokenCookieProperties will not receive a null
name.

---

Outside diff comments:
In
`@src/main/java/com/example/solidconnection/auth/token/config/TokenProperties.java`:
- Around line 33-39: In TokenProperties.init(), add an explicit null-check for
adminRefresh (and other required token config fields if desired) before calling
Map.of so missing configuration throws a clear, fail-fast error; use
Objects.requireNonNull(adminRefresh, "adminRefresh must be configured") or throw
new IllegalStateException with that message, then populate tokenConfigs =
Map.of(...); reference the init() method, the adminRefresh field, tokenConfigs,
and the Map.of call when making the change.

---

Nitpick comments:
In
`@src/main/java/com/example/solidconnection/admin/auth/service/AdminAuthService.java`:
- Around line 69-76: AdminAuthService.reissue currently only issues a new
AccessToken but must implement refresh token rotation: after validating
requestedAdminRefreshToken via authTokenProvider.isValidAdminRefreshToken and
parsing the SiteUser with authTokenProvider.parseSiteUser, generate a new
AccessToken and a new RefreshToken (e.g.,
authTokenProvider.generateRefreshToken(siteUser)), persist or record the new
refresh token and revoke/invalidate the old one (e.g.,
authTokenProvider.revokeRefreshToken(requestedAdminRefreshToken) or
authTokenProvider.rotateRefreshToken(old, new)) in an atomic operation, and
return the new refresh token to the caller (or ensure
AdminReissueResponse.from(newAccessToken) is extended to include the new refresh
token so the controller can replace the admin cookie). Ensure you reference
AdminAuthService.reissue, authTokenProvider.isValidAdminRefreshToken,
authTokenProvider.parseSiteUser, authTokenProvider.generateAccessToken,
authTokenProvider.generateRefreshToken/revoke/rotate, and AdminReissueResponse
when implementing these changes.

In
`@src/main/java/com/example/solidconnection/security/config/SecurityConfiguration.java`:
- Around line 66-68: The broad permitAll for "/admin/auth/**" in
SecurityConfiguration should be narrowed: replace the wildcard with explicit
public auth endpoints (e.g. "/admin/auth/sign-in", "/admin/auth/sign-up",
"/admin/auth/password-reset" — but NOT the sign-out endpoint) inside the same
HttpSecurity configuration method so anonymous access is only granted to those
specific handlers; ensure the "/admin/**" matcher with hasRole(ADMIN.name())
remains and that the ordering of requestMatchers keeps admin role checks intact.

In
`@src/test/java/com/example/solidconnection/admin/auth/service/AdminAuthServiceTest.java`:
- Around line 93-121: Add a negative test in AdminAuthServiceTest that ensures
adminAuthService.reissue(...) rejects a web RefreshToken: generate and save a
web RefreshToken (use authTokenProvider.generateAndSaveRefreshToken(...) or
equivalent that returns a RefreshToken), then call
adminAuthService.reissue(refreshToken.token()) and assert it throws
AuthException with the ADMIN_REFRESH_TOKEN_EXPIRED message; this verifies that
passing a RefreshToken (not AdminRefreshToken) to adminAuthService.reissue is
rejected.