prajapatiiranjeet/security_setup_with-jwt

Purpose and Runtime

This is a Java 21 Spring Boot REST service demonstrating database-backed authentication and role-based authorization using stateless JWTs. It starts through src/main/java/com/chaiorcode/mycode/MycodeApplication.java; Maven coordinates dependencies/build via pom.xml. Runtime persistence is PostgreSQL, configured in src/main/resources/application.properties.

HTTP Entry Points

Authentication APIs are exposed by src/main/java/com/chaiorcode/mycode/Controller/AuthController.java: public /auth/** registration endpoints for admin, student, and faculty users, plus /auth/login. Protected route namespaces are represented by src/main/java/com/chaiorcode/mycode/Controller/StudentController.java and src/main/java/com/chaiorcode/mycode/Controller/FacultyController.java; admin support is incomplete in src/main/java/com/chaiorcode/mycode/Controller/AdminController.java.

Security Boundary and Authorization

src/main/java/com/chaiorcode/mycode/security/websecurityconfig.java defines the Spring Security filter chain, BCrypt password encoding, and authentication manager. It permits /auth/**, restricts /students/** to ADMIN/STUDENT, /faculty/** to ADMIN/FACULTY, and requires authentication elsewhere. This is the central HTTP trust boundary; controllers receive requests only after filter-chain enforcement.

A material inconsistency exists: src/main/java/com/chaiorcode/mycode/Entity/Role.java uses STUDENTS, while the security policy checks STUDENT, which can deny student access unless normalized.

Registration and Login Flow

src/main/java/com/chaiorcode/mycode/Service/AuthService.java owns registration and login orchestration. Registration accepts API DTOs, assigns role based on the selected registration endpoint rather than trusting the request role, hashes passwords through the configured encoder, and persists the user. Login delegates credential verification to Spring Security’s AuthenticationManager; on success it returns the user ID and signed JWT.

API contracts are separated from persistence in src/main/java/com/chaiorcode/mycode/DTO/CreateUserDto.java, src/main/java/com/chaiorcode/mycode/DTO/LoginDTO.java, and src/main/java/com/chaiorcode/mycode/DTO/LoginResponceDTO.java.

JWT Request Lifecycle

src/main/java/com/chaiorcode/mycode/security/JwtService.java generates JWTs with email as subject and validates signature/expiration using the configured secret; tokens expire after 15 minutes. src/main/java/com/chaiorcode/mycode/security/JwtFilter.java extracts Authorization: Bearer <token>, parses it, reloads the user and authorities, then populates Spring’s SecurityContext before dispatch continues. JWT validation is stateless, but each authenticated request still crosses the database-backed user lookup boundary.

Identity Persistence and Principal Mapping

src/main/java/com/chaiorcode/mycode/Entity/User.java is the primary persisted identity model, with roles represented by src/main/java/com/chaiorcode/mycode/Entity/Role.java. src/main/java/com/chaiorcode/mycode/Repo/UserRepo.java provides JPA access, notably lookup by email. src/main/java/com/chaiorcode/mycode/Service/CustomUserDetailsService.java converts the stored user and role into Spring Security UserDetails, bridging JPA identity data to authentication and authorization authorities.

src/main/java/com/chaiorcode/mycode/Entity/EntityStudent.java is presently outside the active request/service flow.

External Dependencies and Operational Boundaries

Spring WebMVC handles REST dispatch; Spring Security provides authentication, authorization, and context management; JPA/Hibernate maps identity data to PostgreSQL; JJWT signs/parses tokens. The datasource and JWT secret are externalized in src/main/resources/application.properties. Hibernate schema auto-update is configured, making schema management application-driven in the current local-oriented deployment model.