fix: correct EC2 auth filter profile name to match real production pr…

[weited]

…ofile

[Copilot]

🟡 Changes recommended

Profile naming is now inconsistent across the codebase (e.g., remaining prod-based profile conditions), which risks unexpected profile-conditional behavior unless reconciled.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR aligns the EC2 monitoring authentication filter with the repository’s actual production Spring profile name (production) and adds a regression test to ensure the filter is enforced under that profile.

Changes:

• Switch Ec2InstanceAuthenticationFilter from @Profile({"prod","edge"}) to @Profile({"production","edge"}).
• Make filter initialization tolerant of a null configured authorised-instance list.
• Add a Spring Boot integration test that runs with the production profile and asserts unauthorised behavior without PKCS7.

File summaries

File	Description
src/test/java/au/org/aodn/oceancurrent/security/Ec2InstanceAuthenticationFilterProductionProfileTest.java	Adds a production-profile integration test asserting monitoring auth is enforced.
src/main/java/au/org/aodn/oceancurrent/security/Ec2InstanceAuthenticationFilter.java	Updates active profiles to production/edge and hardens whitelist initialization.
Dockerfile	Updates documentation comment to reflect production profile naming.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

OpenApiConfig uses an invalid Spring profile expression operator (&&), which is likely to break profile evaluation or startup.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/main/java/au/org/aodn/oceancurrent/security/Ec2InstanceAuthenticationFilter.java:59

• When authorisedInstanceIds is missing/empty, the filter now silently starts with an empty whitelist, causing all authenticated requests to be rejected; this can hide a production misconfiguration. Consider logging a warning (or failing fast) when the whitelist is null/empty so the issue is visible.

        List<String> configuredIds = monitoringSecurityProperties.getAuthorisedInstanceIds();
        this.authorisedInstanceIds = configuredIds != null ? new HashSet<>(configuredIds) : Collections.emptySet();
        log.info("Initialized EC2 authentication filter with {} authorised instance IDs", authorisedInstanceIds.size());

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite