Defaulting JWT settings to false (#4416)

Defaulting the configuration settings for Stirling PDF's JWT to false to
avoid any unexpected issues

app/proprietary/src/main/java/stirling/software/proprietary/security/InitialSecuritySetup.java

@@ -5,6 +5,7 @@ import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
 import jakarta.annotation.PostConstruct;
@@ -26,6 +27,9 @@ import stirling.software.proprietary.security.service.UserService;
 @RequiredArgsConstructor
 public class InitialSecuritySetup {
 
+    @Value("${v2:false}")
+    private boolean v2Enabled = false;
+
     private final UserService userService;
     private final TeamService teamService;
     private final ApplicationProperties applicationProperties;
@@ -43,6 +47,7 @@ public class InitialSecuritySetup {
                 }
             }
 
+            configureJWTSettings();
             assignUsersToDefaultTeamIfMissing();
             initializeInternalApiUser();
         } catch (IllegalArgumentException | SQLException | UnsupportedProviderException e) {
@@ -51,6 +56,18 @@ public class InitialSecuritySetup {
         }
     }
 
+    private void configureJWTSettings() {
+        ApplicationProperties.Security.Jwt jwtProperties =
+                applicationProperties.getSecurity().getJwt();
+
+        boolean jwtEnabled = jwtProperties.isEnabled();
+        if (!v2Enabled || !jwtEnabled) {
+            log.debug("V2 enabled: {}, JWT enabled: {} - disabling all JWT features", v2Enabled, jwtEnabled);
+
+            jwtProperties.setKeyCleanup(false);
+        }
+    }
+
     private void assignUsersToDefaultTeamIfMissing() {
         Team defaultTeam = teamService.getOrCreateDefaultTeam();
         Team internalTeam = teamService.getOrCreateInternalTeam();

app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java

@@ -40,7 +40,7 @@ public class KeyPairCleanupService {
     @PostConstruct
     @Scheduled(fixedDelay = 1, timeUnit = TimeUnit.DAYS)
     public void cleanup() {
-        if (!jwtProperties.isEnableKeyCleanup() || !keyPersistenceService.isKeystoreEnabled()) {
+        if (!jwtProperties.isEnabled() || !jwtProperties.isKeyCleanup()) {
             return;
         }
 
@@ -71,7 +71,7 @@ public class KeyPairCleanupService {
     }
 
     private void removePrivateKey(String keyId) throws IOException {
-        if (!keyPersistenceService.isKeystoreEnabled()) {
+        if (!jwtProperties.isEnabled()) {
             return;
         }
 

app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceService.java

@@ -84,7 +84,7 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
 
     @PostConstruct
     public void initializeKeystore() {
-        if (!isKeystoreEnabled()) {
+        if (!jwtProperties.isEnabled()) {
             return;
         }
 
@@ -132,7 +132,7 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
 
     @Override
     public Optional<KeyPair> getKeyPair(String keyId) {
-        if (!isKeystoreEnabled()) {
+        if (!jwtProperties.isEnabled()) {
             return Optional.empty();
         }
 
@@ -155,11 +155,6 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
         }
     }
 
-    @Override
-    public boolean isKeystoreEnabled() {
-        return jwtProperties.isEnableKeystore();
-    }
-
     @Override
     public JwtVerificationKey refreshActiveKeyPair() {
         return generateAndStoreKeypair();
@@ -268,4 +263,8 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
         KeyFactory keyFactory = KeyFactory.getInstance("RSA");
         return keyFactory.generatePublic(keySpec);
     }
+
+    public boolean isKeystoreEnabled() {
+        return jwtProperties.isEnabled();
+    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceServiceInterface.java

@@ -16,8 +16,6 @@ public interface KeyPersistenceServiceInterface {
 
     Optional<KeyPair> getKeyPair(String keyId);
 
-    boolean isKeystoreEnabled();
-
     JwtVerificationKey refreshActiveKeyPair();
 
     List<JwtVerificationKey> getKeysEligibleForCleanup(LocalDateTime cutoffDate);