# rapter1990/springbootmicroserviceswithsecurity architecture
> Architecture diagram of the GitHub repository rapter1990/springbootmicroserviceswithsecurity, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-08-05). It is an AI-made overview: check details against the source.
- Interactive diagram: https://gitdiagram.com/rapter1990/springbootmicroserviceswithsecurity
- Repository: https://github.com/rapter1990/springbootmicroserviceswithsecurity
## Overview
#### Purpose and topology
A Java 21/Spring Boot 3 microservice example providing JWT authentication and role-based product access. It is a multi-module-by-directory repository: each service is independently buildable/deployable via Maven and Docker. Runtime order is Eureka → API Gateway → auth, user, and product services.
#### Service entry points
Each deployable has its own Spring Boot main class and configuration:
- Discovery: `eurekaserver/src/main/java/com/springbootmicroservices/eurekaserver/EurekaserverApplication.java`
- Edge gateway: `apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java`
- Authentication façade: `authservice/src/main/java/com/springbootmicroservices/authservice/AuthserviceApplication.java`
- Identity/token authority: `userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java`
- Product API: `productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java`
Service registration, ports, routes, and security properties are service-local in each `src/main/resources/application.yml`.
#### Discovery and edge boundary
Eureka is the service-discovery control plane, allowing gateway and internal clients to resolve service instances rather than hard-code addresses. The API Gateway is the public routing and first authentication boundary; its JWT filter and routing configuration are:
- `apigateway/src/main/java/com/springbootmicroservices/apigateway/config/GatewayConfig.java`
- `apigateway/src/main/java/com/springbootmicroservices/apigateway/filter/JwtAuthenticationFilter.java`
- `apigateway/src/main/java/com/springbootmicroservices/apigateway/client/UserServiceClient.java`
Client traffic reaches gateway routes, which authenticate/validate bearer-token context and forward to authentication or product endpoints.
#### Authentication and identity flow
`authservice` exposes register, login, refresh, and logout APIs through `AuthController`, but delegates user/account-oriented work through its user-service client. Its service layer separates registration, credentials login, token refresh, and logout:
- `authservice/src/main/java/com/springbootmicroservices/authservice/controller/AuthController.java`
- `authservice/src/main/java/com/springbootmicroservices/authservice/client/UserServiceClient.java`
- `authservice/src/main/java/com/springbootmicroservices/authservice/service/impl/UserLoginServiceImpl.java`
`userservice` is the persistence-owning identity and token service. It stores users and invalidated tokens, issues/refreshes tokens, and enforces token invalidation:
- `userservice/src/main/java/com/springbootmicroservices/userservice/controller/UserController.java`
- `userservice/src/main/java/com/springbootmicroservices/userservice/service/impl/TokenServiceImpl.java`
- `userservice/src/main/java/com/springbootmicroservices/userservice/repository/InvalidTokenRepository.java`
This boundary means authentication orchestration is separate from authoritative user and revoked-token state.
#### Authorization model
JWT bearer authentication is independently enforced at gateway and protected downstream services. User and product services each provide custom bearer filters, Spring Security configuration, authentication-entry-point handling, and JWT key/configuration handling:
- `userservice/src/main/java/com/springbootmicroservices/userservice/filter/CustomBearerTokenAuthenticationFilter.java`
- `productservice/src/main/java/com/springbootmicroservices/productservice/filter/CustomBearerTokenAuthenticationFilter.java`
- `productservice/src/main/java/com/springbootmicroservices/productservice/config/TokenConfigurationParameter.java`
The stated policy is role-based: Admin can create/read/update/delete products; User can only read. Product service also has a `UserServiceClient`, indicating an interservice identity/authorization dependency.
#### Product domain and persistence
`productservice` owns product CRUD, pagination, domain/entity mapping, repository access, and API exception translation:
- `productservice/src/main/java/com/springbootmicroservices/productservice/controller/ProductController.java`
- `productservice/src/main/java/com/springbootmicroservices/productservice/service/impl/ProductReadServiceImpl.java`
- `productservice/src/main/java/com/springbootmicroservices/productservice/repository/ProductRepository.java`
Request flow is controller → role/security filter → focused CRUD service → repository → `ProductEntity`, with DTO/domain mappers at the API/persistence boundary. User and product persistence schemas are initialized through `init.sql`.
#### Deployment and external infrastructure
Docker Compose orchestrates the five containers plus database dependencies/configuration: `docker-compose.yml`; each service supplies a multi-stage image build via its `Dockerfile`. Database credentials are injected through `DATABASE_USERNAME` and `DATABASE_PASSWORD`. GitHub Actions maintains separate CI/CD pipelines per deployable service, e.g. `.github/workflows/product-service-ci-cd.yml` and `.github/workflows/api-gateway-ci-cd.yml`. Images are published to Docker Hub per the README.
Main entry points: [`docker-compose.yml`](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/docker-compose.yml) (Docker Compose), [`apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java`](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java) (API Gateway), [`productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java`](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java) (Product Service), [`userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java`](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java) (User Service)
## Diagram (Mermaid)
```mermaid
flowchart TD
subgraph group_edge["Discovery & Edge"]
node_eureka{{"Eureka Server
discovery service"}}
node_gateway["API Gateway
Spring Boot service"]
node_gateway_security["Gateway JWT Filter
edge security"]
node_gateway_routes["Gateway Routes
routing config
[GatewayConfig.java]"]
end
subgraph group_auth["Authentication"]
node_auth_api["Auth Service
authentication façade"]
node_auth_controller["Auth Controller
REST controller"]
node_auth_login["Login & Refresh Service
auth orchestration"]
node_auth_user_client["User Service Client"]
end
subgraph group_identity["Identity Authority"]
node_user_service["User Service
identity/token authority"]
node_user_api["User Controller
REST controller"]
node_token_service["Token Service
token lifecycle"]
node_invalid_tokens[("Invalid Token Repository
revocation repository")]
node_user_security["Bearer Token Filter
service security"]
end
subgraph group_product["Product Domain"]
node_product_service["Product Service
product API"]
node_product_controller["Product Controller
REST controller"]
node_product_security["Bearer Token Filter
service security"]
node_product_read["Product CRUD Service
domain service"]
node_product_repository[("Product Repository
persistence repository")]
end
node_clients(("Client Traffic
external clients"))
node_compose["Docker Compose
deployment orchestration
[docker-compose.yml]"]
node_clients -->|"HTTP requests"| node_gateway
node_gateway -->|"authenticates bearer token"| node_gateway_security
node_gateway_security -->|"authorized context"| node_gateway_routes
node_gateway_routes -->|"routes auth APIs"| node_auth_api
node_gateway_routes -->|"routes product APIs"| node_product_service
node_gateway -.->|"registers/resolves"| node_eureka
node_auth_api -->|"serves endpoints"| node_auth_controller
node_auth_controller -->|"delegates"| node_auth_login
node_auth_login -->|"account/token calls"| node_auth_user_client
node_auth_user_client -->|"service request"| node_user_service
node_user_service -->|"serves identity APIs"| node_user_api
node_user_api -->|"protects requests"| node_user_security
node_user_api -->|"token operations"| node_token_service
node_token_service -->|"stores revocations"| node_invalid_tokens
node_product_service -->|"serves product APIs"| node_product_controller
node_product_controller -->|"enforces roles"| node_product_security
node_product_controller -->|"delegates CRUD"| node_product_read
node_product_read -->|"persists products"| node_product_repository
node_product_service -.->|"identity/authorization dependency"| node_user_service
node_compose -.->|"starts container"| node_eureka
node_compose -.->|"starts container"| node_gateway
node_compose -.->|"starts container"| node_auth_api
node_compose -.->|"starts container"| node_user_service
node_compose -.->|"starts container"| node_product_service
click node_eureka "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/eurekaserver/src/main/java/com/springbootmicroservices/eurekaserver/EurekaserverApplication.java"
click node_gateway "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java"
click node_gateway_security "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/filter/JwtAuthenticationFilter.java"
click node_gateway_routes "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/config/GatewayConfig.java"
click node_auth_api "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/AuthserviceApplication.java"
click node_auth_controller "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/controller/AuthController.java"
click node_auth_login "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/service/impl/UserLoginServiceImpl.java"
click node_auth_user_client "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/client/UserServiceClient.java"
click node_user_service "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java"
click node_user_api "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/controller/UserController.java"
click node_token_service "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/service/impl/TokenServiceImpl.java"
click node_invalid_tokens "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/repository/InvalidTokenRepository.java"
click node_user_security "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/filter/CustomBearerTokenAuthenticationFilter.java"
click node_product_service "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java"
click node_product_controller "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/controller/ProductController.java"
click node_product_security "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/filter/CustomBearerTokenAuthenticationFilter.java"
click node_product_read "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/service/impl/ProductReadServiceImpl.java"
click node_product_repository "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/repository/ProductRepository.java"
click node_compose "https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/docker-compose.yml"
classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_eureka,node_gateway,node_gateway_security,node_gateway_routes toneBlue
class node_auth_api,node_auth_controller,node_auth_login,node_auth_user_client toneAmber
class node_user_service,node_user_api,node_token_service,node_invalid_tokens,node_user_security toneMint
class node_product_service,node_product_controller,node_product_security,node_product_read,node_product_repository toneRose
class node_clients,node_compose toneNeutral
```
## Components
### Discovery & Edge
- [Eureka Server](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/eurekaserver/src/main/java/com/springbootmicroservices/eurekaserver/EurekaserverApplication.java): discovery service · Service registry and instance resolution. · `eurekaserver/src/main/java/com/springbootmicroservices/eurekaserver/EurekaserverApplication.java`
- [API Gateway](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java): Spring Boot service · Public routing and first authentication boundary. · `apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java`
- [Gateway JWT Filter](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/filter/JwtAuthenticationFilter.java): edge security · `apigateway/src/main/java/com/springbootmicroservices/apigateway/filter/JwtAuthenticationFilter.java`
- [Gateway Routes](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/apigateway/src/main/java/com/springbootmicroservices/apigateway/config/GatewayConfig.java): routing config · `apigateway/src/main/java/com/springbootmicroservices/apigateway/config/GatewayConfig.java`
### Authentication
- [Auth Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/AuthserviceApplication.java): authentication façade · Exposes registration, login, refresh, and logout APIs. · `authservice/src/main/java/com/springbootmicroservices/authservice/AuthserviceApplication.java`
- [Auth Controller](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/controller/AuthController.java): REST controller · `authservice/src/main/java/com/springbootmicroservices/authservice/controller/AuthController.java`
- [Login & Refresh Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/service/impl/UserLoginServiceImpl.java): auth orchestration · `authservice/src/main/java/com/springbootmicroservices/authservice/service/impl/UserLoginServiceImpl.java`
- [User Service Client](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/authservice/src/main/java/com/springbootmicroservices/authservice/client/UserServiceClient.java): service client · `authservice/src/main/java/com/springbootmicroservices/authservice/client/UserServiceClient.java`
### Identity Authority
- [User Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java): identity/token authority · Owns user accounts and revoked-token state. · `userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java`
- [User Controller](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/controller/UserController.java): REST controller · `userservice/src/main/java/com/springbootmicroservices/userservice/controller/UserController.java`
- [Token Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/service/impl/TokenServiceImpl.java): token lifecycle · Issues, refreshes, and invalidates JWTs. · `userservice/src/main/java/com/springbootmicroservices/userservice/service/impl/TokenServiceImpl.java`
- [Invalid Token Repository](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/repository/InvalidTokenRepository.java): revocation repository · `userservice/src/main/java/com/springbootmicroservices/userservice/repository/InvalidTokenRepository.java`
- [Bearer Token Filter](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/userservice/src/main/java/com/springbootmicroservices/userservice/filter/CustomBearerTokenAuthenticationFilter.java): service security · `userservice/src/main/java/com/springbootmicroservices/userservice/filter/CustomBearerTokenAuthenticationFilter.java`
### Product Domain
- [Product Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java): product API · Enforces Admin CRUD and User read access. · `productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java`
- [Product Controller](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/controller/ProductController.java): REST controller · `productservice/src/main/java/com/springbootmicroservices/productservice/controller/ProductController.java`
- [Bearer Token Filter](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/filter/CustomBearerTokenAuthenticationFilter.java): service security · `productservice/src/main/java/com/springbootmicroservices/productservice/filter/CustomBearerTokenAuthenticationFilter.java`
- [Product CRUD Service](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/service/impl/ProductReadServiceImpl.java): domain service · Handles CRUD, pagination, and mapping. · `productservice/src/main/java/com/springbootmicroservices/productservice/service/impl/ProductReadServiceImpl.java`
- [Product Repository](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/productservice/src/main/java/com/springbootmicroservices/productservice/repository/ProductRepository.java): persistence repository · `productservice/src/main/java/com/springbootmicroservices/productservice/repository/ProductRepository.java`
### Other components
- **Client Traffic**: external clients
- [Docker Compose](https://github.com/rapter1990/springbootmicroserviceswithsecurity/blob/main/docker-compose.yml): deployment orchestration · Runs five services with database dependencies. · `docker-compose.yml`
## Connections
- Client Traffic → API Gateway: HTTP requests
- API Gateway → Gateway JWT Filter: authenticates bearer token
- Gateway JWT Filter → Gateway Routes: authorized context
- Gateway Routes → Auth Service: routes auth APIs
- Gateway Routes → Product Service: routes product APIs
- API Gateway → Eureka Server: registers/resolves
- Auth Service → Auth Controller: serves endpoints
- Auth Controller → Login & Refresh Service: delegates
- Login & Refresh Service → User Service Client: account/token calls
- User Service Client → User Service: service request
- User Service → User Controller: serves identity APIs
- User Controller → Bearer Token Filter: protects requests
- User Controller → Token Service: token operations
- Token Service → Invalid Token Repository: stores revocations
- Product Service → Product Controller: serves product APIs
- Product Controller → Bearer Token Filter: enforces roles
- Product Controller → Product CRUD Service: delegates CRUD
- Product CRUD Service → Product Repository: persists products
- Product Service → User Service: identity/authorization dependency
- Docker Compose → Eureka Server: starts container
- Docker Compose → API Gateway: starts container
- Docker Compose → Auth Service: starts container
- Docker Compose → User Service: starts container
- Docker Compose → Product Service: starts container