secdiff.txt

diff --git a/backend/src/main/java/com/iaihub/toolbox/config/SecurityConfig.java b/backend/src/main/java/com/iaihub/toolbox/config/SecurityConfig.java
index 1dc055c..8d987b9 100644
--- a/backend/src/main/java/com/iaihub/toolbox/config/SecurityConfig.java
+++ b/backend/src/main/java/com/iaihub/toolbox/config/SecurityConfig.java
@@ -6,6 +6,7 @@ import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
@@ -22,6 +23,7 @@ import java.util.List;
 
 @Configuration
 @EnableWebSecurity
+@EnableMethodSecurity
 @RequiredArgsConstructor
 public class SecurityConfig {
 
@@ -87,6 +89,10 @@ public class SecurityConfig {
                 .requestMatchers(HttpMethod.GET, "/api/v1/knowledge").permitAll()
                 .requestMatchers(HttpMethod.GET, "/api/v1/knowledge/{id}").permitAll()
                 .requestMatchers(HttpMethod.POST, "/api/v1/knowledge/{id}/search").permitAll()
+                // Chat - WebSocket and public history
+                .requestMatchers("/ws/**").permitAll()
+                .requestMatchers(HttpMethod.GET, "/api/v1/chat/messages").permitAll()
+                .requestMatchers(HttpMethod.DELETE, "/api/v1/chat/messages/**").hasAnyRole("ADMIN", "SUPER_ADMIN")
                 // Feedback - GET and POST are public, admin operations use @PreAuthorize
                 .requestMatchers(HttpMethod.GET, "/api/v1/feedback").permitAll()
                 .requestMatchers(HttpMethod.POST, "/api/v1/feedback").permitAll()