Security Fundamentals and Spring Security: Passwords, JWT, Access Control, CORS and Secrets

// File: src/main/java/com/example/jobtracker/JwtConfig.javapackage com.example.jobtracker;import com.nimbusds.jose.jwk.source.ImmutableSecret;import java.util.Base64;import javax.crypto.SecretKey;import javax.crypto.spec.SecretKeySpec;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.security.crypto.factory.PasswordEncoderFactories;import org.springframework.security.crypto.password.PasswordEncoder;import org.springframework.security.oauth2.jose.jws.MacAlgorithm;import org.springframework.security.oauth2.jwt.JwtDecoder;import org.springframework.security.oauth2.jwt.JwtEncoder;import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;/** The cryptography: how passwords are hashed and how tokens are signed and checked. */@Configurationpublic class JwtConfig {    private static final int MINIMUM_SECRET_BYTES = 32;    @Bean    SecretKey jwtKey(SecuritySettings settings) {        if (settings.jwtSecret().startsWith("${")) {       // the placeholder was never replaced: the variable is missing            throw new IllegalStateException("security.jwt-secret is not set. Provide the JWT_SECRET environment "                    + "variable: base64 text of at least " + MINIMUM_SECRET_BYTES + " random bytes");        }        byte[] bytes;        try {            bytes = Base64.getDecoder().decode(settings.jwtSecret());        } catch (IllegalArgumentException e) {            throw new IllegalStateException("security.jwt-secret must be base64 text");   // never print the secret itself        }        if (bytes.length < MINIMUM_SECRET_BYTES) {            throw new IllegalStateException("security.jwt-secret must decode to at least "                    + MINIMUM_SECRET_BYTES + " bytes, but it decodes to " + bytes.length);        }        return new SecretKeySpec(bytes, "HmacSHA256");    }    @Bean    JwtEncoder jwtEncoder(SecretKey jwtKey) {        return new NimbusJwtEncoder(new ImmutableSecret<>(jwtKey));    }    @Bean    JwtDecoder jwtDecoder(SecretKey jwtKey) {        return NimbusJwtDecoder.withSecretKey(jwtKey).macAlgorithm(MacAlgorithm.HS256).build();    }    /** Hashes with bcrypt and stores the algorithm name with the hash, so the algorithm can be changed later. */    @Bean    PasswordEncoder passwordEncoder() {        return PasswordEncoderFactories.createDelegatingPasswordEncoder();    }}

header:    {"alg":"HS256"}payload:   {"iss":"jobtracker","sub":"1","exp":"<time, one hour later>","iat":"<time>"}signature: <32 bytes, HMAC-SHA256>

CREATE TABLE users (    id            bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,    email         varchar(254) NOT NULL UNIQUE,    password_hash varchar(100) NOT NULL,    created_at    timestamptz  NOT NULL);-- Every application now belongs to one user. NOT NULL works here because the table is empty at this point in the-- course. With existing rows you would add the column as nullable, fill it in, and make it NOT NULL in a later migration.ALTER TABLE job_applications ADD COLUMN owner_id bigint NOT NULL REFERENCES users (id);CREATE INDEX idx_job_applications_owner_id ON job_applications (owner_id);

// File: src/main/java/com/example/jobtracker/AppUser.javapackage com.example.jobtracker;import jakarta.persistence.Column;import jakarta.persistence.Entity;import jakarta.persistence.GeneratedValue;import jakarta.persistence.GenerationType;import jakarta.persistence.Id;import jakarta.persistence.Table;import java.time.Instant;/** A person who can log in. The password is stored only as a salted hash, never as text. */@Entity@Table(name = "users")public class AppUser {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id;    @Column(nullable = false, unique = true, length = 254)    private String email;    @Column(nullable = false, length = 100)    private String passwordHash;    @Column(nullable = false, updatable = false)    private Instant createdAt;    protected AppUser() {    }    public AppUser(String email, String passwordHash, Instant createdAt) {        this.email = email;        this.passwordHash = passwordHash;        this.createdAt = createdAt;    }    public Long getId() {        return id;    }    public String getEmail() {        return email;    }    public String getPasswordHash() {        return passwordHash;    }}

// File: src/main/java/com/example/jobtracker/AppUserRepository.javapackage com.example.jobtracker;import java.util.Optional;import org.springframework.data.jpa.repository.JpaRepository;public interface AppUserRepository extends JpaRepository<AppUser, Long> {    Optional<AppUser> findByEmail(String email);    boolean existsByEmail(String email);}

// File: src/main/java/com/example/jobtracker/SecuritySettings.javapackage com.example.jobtracker;import jakarta.validation.constraints.NotBlank;import jakarta.validation.constraints.NotEmpty;import java.time.Duration;import java.util.List;import org.springframework.boot.context.properties.ConfigurationProperties;import org.springframework.boot.context.properties.bind.DefaultValue;import org.springframework.validation.annotation.Validated;/** Security settings. The signing secret must be supplied from outside the code. */@ConfigurationProperties(prefix = "security")@Validatedpublic record SecuritySettings(        @NotBlank String jwtSecret,        @DefaultValue("PT1H") Duration tokenLifetime,        @NotEmpty @DefaultValue("http://localhost:3000") List<String> allowedOrigins) {}

tracker.default-page-size=20tracker.max-page-size=50# The database. The address and user can be overridden, and the password must come from the environment.spring.datasource.url=${DB_URL:jdbc:postgresql://localhost:5432/jobtracker}spring.datasource.username=${DB_USER:jobtracker}spring.datasource.password=${DB_PASSWORD}# Flyway creates and changes the tables. Hibernate only checks that the entities match them.spring.jpa.hibernate.ddl-auto=validatespring.jpa.open-in-view=false# Security. The secret has no default: it is base64 text of at least 32 random bytes, and comes from the environment.security.jwt-secret=${JWT_SECRET}security.token-lifetime=PT1Hsecurity.allowed-origins=http://localhost:3000

// File: src/main/java/com/example/jobtracker/TokenService.javapackage com.example.jobtracker;import java.time.Clock;import java.time.Instant;import org.springframework.security.oauth2.jose.jws.MacAlgorithm;import org.springframework.security.oauth2.jwt.JwsHeader;import org.springframework.security.oauth2.jwt.JwtClaimsSet;import org.springframework.security.oauth2.jwt.JwtEncoder;import org.springframework.security.oauth2.jwt.JwtEncoderParameters;import org.springframework.stereotype.Service;/** Issues signed access tokens. The token says who the user is (the subject) and when it stops being valid. */@Servicepublic class TokenService {    private static final String ISSUER = "jobtracker";    private final JwtEncoder encoder;    private final SecuritySettings settings;    private final Clock clock;    public TokenService(JwtEncoder encoder, SecuritySettings settings, Clock clock) {        this.encoder = encoder;        this.settings = settings;        this.clock = clock;    }    public TokenResponse issueFor(AppUser user) {        Instant now = Instant.now(clock);        JwtClaimsSet claims = JwtClaimsSet.builder()                .issuer(ISSUER)                .subject(String.valueOf(user.getId()))                .issuedAt(now)                .expiresAt(now.plus(settings.tokenLifetime()))                .build();        String token = encoder.encode(JwtEncoderParameters.from(JwsHeader.with(MacAlgorithm.HS256).build(), claims))                .getTokenValue();        return new TokenResponse(token, "Bearer", settings.tokenLifetime().toSeconds());    }}

// File: src/main/java/com/example/jobtracker/AuthService.javapackage com.example.jobtracker;import java.time.Clock;import java.time.Instant;import java.util.Locale;import org.springframework.security.crypto.password.PasswordEncoder;import org.springframework.stereotype.Service;import org.springframework.transaction.annotation.Transactional;@Service@Transactionalpublic class AuthService {    private final AppUserRepository users;    private final PasswordEncoder passwordEncoder;    private final TokenService tokens;    private final Clock clock;    private final String dummyHash;    public AuthService(AppUserRepository users, PasswordEncoder passwordEncoder, TokenService tokens, Clock clock) {        this.users = users;        this.passwordEncoder = passwordEncoder;        this.tokens = tokens;        this.clock = clock;        this.dummyHash = passwordEncoder.encode("a password nobody has");   // lets an unknown email cost the same time    }    public UserResponse register(RegisterRequest request) {        String email = normalise(request.email());        if (users.existsByEmail(email)) {            throw new EmailAlreadyUsedException();        }        AppUser user = new AppUser(email, passwordEncoder.encode(request.password()), Instant.now(clock));        AppUser saved = users.saveAndFlush(user);        return new UserResponse(saved.getId(), saved.getEmail());    }    @Transactional(readOnly = true)    public TokenResponse login(LoginRequest request) {        AppUser user = users.findByEmail(normalise(request.email())).orElse(null);        String hash = user == null ? dummyHash : user.getPasswordHash();        boolean matches = passwordEncoder.matches(request.password(), hash);    // always runs, so timing does not reveal accounts        if (user == null || !matches) {            throw new InvalidCredentialsException();        }        return tokens.issueFor(user);    }    private static String normalise(String email) {        return email.strip().toLowerCase(Locale.ROOT);    }}

// File: src/main/java/com/example/jobtracker/AuthController.javapackage com.example.jobtracker;import jakarta.validation.Valid;import org.springframework.http.HttpStatus;import org.springframework.web.bind.annotation.PostMapping;import org.springframework.web.bind.annotation.RequestBody;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.ResponseStatus;import org.springframework.web.bind.annotation.RestController;/** The only endpoints that can be called without a token. */@RestController@RequestMapping("/api/auth")public class AuthController {    private final AuthService service;    public AuthController(AuthService service) {        this.service = service;    }    @PostMapping("/register")    @ResponseStatus(HttpStatus.CREATED)    public UserResponse register(@Valid @RequestBody RegisterRequest request) {        return service.register(request);    }    @PostMapping("/login")    public TokenResponse login(@Valid @RequestBody LoginRequest request) {        return service.login(request);    }}

// File: src/main/java/com/example/jobtracker/RegisterRequest.javapackage com.example.jobtracker;import jakarta.validation.constraints.Email;import jakarta.validation.constraints.NotBlank;import jakarta.validation.constraints.Size;public record RegisterRequest(        @NotBlank @Email @Size(max = 254) String email,        @NotBlank @Size(min = 12, max = 72) String password) {}

// File: src/main/java/com/example/jobtracker/LoginRequest.javapackage com.example.jobtracker;import jakarta.validation.constraints.NotBlank;public record LoginRequest(@NotBlank String email, @NotBlank String password) {}

// File: src/main/java/com/example/jobtracker/TokenResponse.javapackage com.example.jobtracker;public record TokenResponse(String accessToken, String tokenType, long expiresInSeconds) {}

// File: src/main/java/com/example/jobtracker/UserResponse.javapackage com.example.jobtracker;public record UserResponse(Long id, String email) {}

// File: src/main/java/com/example/jobtracker/EmailAlreadyUsedException.javapackage com.example.jobtracker;public class EmailAlreadyUsedException extends RuntimeException {    public EmailAlreadyUsedException() {        super("That email address is already registered");    }}

// File: src/main/java/com/example/jobtracker/InvalidCredentialsException.javapackage com.example.jobtracker;/** The same message for an unknown email and a wrong password, so the response does not reveal which accounts exist. */public class InvalidCredentialsException extends RuntimeException {    public InvalidCredentialsException() {        super("Invalid email or password");    }}

// File: src/main/java/com/example/jobtracker/SecurityConfig.javapackage com.example.jobtracker;import java.time.Duration;import java.util.List;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.http.HttpMethod;import org.springframework.http.HttpStatus;import org.springframework.http.MediaType;import org.springframework.http.ProblemDetail;import org.springframework.security.config.Customizer;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;import org.springframework.security.config.http.SessionCreationPolicy;import org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationEntryPoint;import org.springframework.security.web.AuthenticationEntryPoint;import org.springframework.security.web.SecurityFilterChain;import org.springframework.security.web.access.AccessDeniedHandler;import org.springframework.web.cors.CorsConfiguration;import org.springframework.web.cors.CorsConfigurationSource;import org.springframework.web.cors.UrlBasedCorsConfigurationSource;import tools.jackson.databind.json.JsonMapper;/** Who may call what: everything needs a valid token except registering and logging in. */@Configuration@EnableWebSecuritypublic class SecurityConfig {    @Bean    SecurityFilterChain apiSecurity(HttpSecurity http, JsonMapper json) throws Exception {        AuthenticationEntryPoint unauthorized = (request, response, exception) -> {            new BearerTokenAuthenticationEntryPoint().commence(request, response, exception);   // 401 and WWW-Authenticate            writeProblem(response, json, HttpStatus.UNAUTHORIZED, "Unauthorized",                    "A valid access token is required. Log in and send it as: Authorization: Bearer <token>");        };        AccessDeniedHandler forbidden = (request, response, exception) -> {            response.setStatus(HttpStatus.FORBIDDEN.value());            writeProblem(response, json, HttpStatus.FORBIDDEN, "Forbidden", "You are not allowed to do that");        };        http                // CSRF protects browsers that send a session cookie automatically. This API uses no cookies, and                // a token in the Authorization header is never sent by a browser on its own, so CSRF does not apply.                .csrf(csrf -> csrf.disable())                .cors(Customizer.withDefaults())                                  // uses the CorsConfigurationSource below                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))                .authorizeHttpRequests(requests -> requests                        .requestMatchers(HttpMethod.POST, "/api/auth/register", "/api/auth/login").permitAll()                        .anyRequest().authenticated())                            // deny by default                .oauth2ResourceServer(oauth -> oauth                        .jwt(Customizer.withDefaults())                        .authenticationEntryPoint(unauthorized)                        .accessDeniedHandler(forbidden))                .exceptionHandling(errors -> errors                        .authenticationEntryPoint(unauthorized)                        .accessDeniedHandler(forbidden));        return http.build();    }    /** Which web pages (origins) may call this API from a browser. */    @Bean    CorsConfigurationSource corsConfigurationSource(SecuritySettings settings) {        CorsConfiguration cors = new CorsConfiguration();        cors.setAllowedOrigins(settings.allowedOrigins());        cors.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));        cors.setAllowedHeaders(List.of("Authorization", "Content-Type"));        cors.setMaxAge(Duration.ofHours(1));        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();        source.registerCorsConfiguration("/api/**", cors);        return source;    }    private static void writeProblem(jakarta.servlet.http.HttpServletResponse response, JsonMapper json,                                     HttpStatus status, String title, String detail) throws java.io.IOException {        ProblemDetail problem = ProblemDetail.forStatusAndDetail(status, detail);        problem.setTitle(title);        response.setStatus(status.value());        response.setContentType(MediaType.APPLICATION_PROBLEM_JSON_VALUE);        response.setCharacterEncoding("UTF-8");        response.getWriter().write(json.writeValueAsString(problem));    }}

--- a/src/main/java/com/example/jobtracker/JobApplicationRepository.java+++ b/src/main/java/com/example/jobtracker/JobApplicationRepository.java@@ -1,4 +1,5 @@ package com.example.jobtracker; +import java.util.Optional; import org.springframework.data.domain.Page; import org.springframework.data.domain.Pageable;@@ -8,19 +9,23 @@  /**- * There is no implementation class. Spring Data creates one at start-up from this interface.- * save, findById, findAll, deleteById and many more come from JpaRepository.+ * Every query is limited to one owner, so a user can never reach another user's applications through this class.  */ public interface JobApplicationRepository extends JpaRepository<JobApplication, Long> { +    /** Looks an application up by id, but only if it belongs to the given user. */+    Optional<JobApplication> findByIdAndOwnerId(Long id, Long ownerId);+     /**-     * Both filters are optional: a null status or a null company means "do not filter on it".+     * The owner's applications. Both filters are optional: a null status or a null company means "do not filter on it".      * The cast tells PostgreSQL that the company parameter is text even when it is null.      */     @Query("""             select a from JobApplication a-            where (:status is null or a.status = :status)+            where a.ownerId = :ownerId+              and (:status is null or a.status = :status)               and (:company is null or lower(a.company) like lower(concat('%', cast(:company as string), '%')))             """)-    Page<JobApplication> search(@Param("status") ApplicationStatus status,+    Page<JobApplication> search(@Param("ownerId") Long ownerId,+                                @Param("status") ApplicationStatus status,                                 @Param("company") String company,                                 Pageable pageable);

--- a/src/main/java/com/example/jobtracker/JobApplicationService.java+++ b/src/main/java/com/example/jobtracker/JobApplicationService.java@@ -10,5 +10,8 @@ import org.springframework.transaction.annotation.Transactional; -/** The rules of the application. It knows nothing about HTTP, and now storage is a database. */+/**+ * The rules of the application. Every method takes the id of the user making the request and only ever touches that+ * user's applications. An application that belongs to someone else behaves exactly like one that does not exist.+ */ @Service @Transactional@@ -25,6 +28,6 @@      /** A new application starts as APPLIED if the user says when they applied, otherwise as WISHLIST. */-    public JobApplicationResponse create(JobApplicationRequest request) {-        JobApplication application = new JobApplication(request.company(), request.position());+    public JobApplicationResponse create(Long ownerId, JobApplicationRequest request) {+        JobApplication application = new JobApplication(ownerId, request.company(), request.position());         copyFields(request, application);         application.setStatus(request.appliedOn() == null ? ApplicationStatus.WISHLIST : ApplicationStatus.APPLIED);@@ -36,16 +39,17 @@      @Transactional(readOnly = true)-    public JobApplicationResponse get(Long id) {-        return JobApplicationResponse.from(find(id));+    public JobApplicationResponse get(Long ownerId, Long id) {+        return JobApplicationResponse.from(find(ownerId, id));     }      /** Filters by status and by part of the company name in the database, and returns one page, oldest first. */     @Transactional(readOnly = true)-    public PageResponse<JobApplicationResponse> list(ApplicationStatus status, String company, Integer page, Integer size) {+    public PageResponse<JobApplicationResponse> list(Long ownerId, ApplicationStatus status, String company,+                                                     Integer page, Integer size) {         int pageSize = size == null ? settings.defaultPageSize() : Math.min(size, settings.maxPageSize());         int pageNumber = page == null ? 0 : page;         String companyFilter = company == null || company.isBlank() ? null : company.strip(); -        Page<JobApplication> result = repository.search(status, companyFilter,+        Page<JobApplication> result = repository.search(ownerId, status, companyFilter,                 PageRequest.of(pageNumber, pageSize, Sort.by("id"))); @@ -55,6 +59,6 @@      /** Replaces the editable fields. The status is not editable here, see changeStatus. */-    public JobApplicationResponse replace(Long id, JobApplicationRequest request) {-        JobApplication application = find(id);+    public JobApplicationResponse replace(Long ownerId, Long id, JobApplicationRequest request) {+        JobApplication application = find(ownerId, id);         if (request.version() != null && request.version() != application.getVersion()) {             throw new StaleVersionException(id, request.version(), application.getVersion());@@ -65,6 +69,6 @@     } -    public JobApplicationResponse changeStatus(Long id, ApplicationStatus next) {-        JobApplication application = find(id);+    public JobApplicationResponse changeStatus(Long ownerId, Long id, ApplicationStatus next) {+        JobApplication application = find(ownerId, id);         if (!application.getStatus().canMoveTo(next)) {             throw new InvalidStatusChangeException(application.getStatus(), next);@@ -75,6 +79,6 @@     } -    public InterviewResponse addInterview(Long applicationId, InterviewRequest request) {-        JobApplication application = find(applicationId);+    public InterviewResponse addInterview(Long ownerId, Long applicationId, InterviewRequest request) {+        JobApplication application = find(ownerId, applicationId);         Interview interview = new Interview(request.scheduledAt(), request.type(), request.notes());         application.addInterview(interview);@@ -84,10 +88,10 @@      @Transactional(readOnly = true)-    public List<InterviewResponse> listInterviews(Long applicationId) {-        return find(applicationId).getInterviews().stream().map(InterviewResponse::from).toList();+    public List<InterviewResponse> listInterviews(Long ownerId, Long applicationId) {+        return find(ownerId, applicationId).getInterviews().stream().map(InterviewResponse::from).toList();     } -    public void deleteInterview(Long applicationId, Long interviewId) {-        JobApplication application = find(applicationId);+    public void deleteInterview(Long ownerId, Long applicationId, Long interviewId) {+        JobApplication application = find(ownerId, applicationId);         Interview interview = application.getInterviews().stream()                 .filter(i -> i.getId().equals(interviewId))@@ -97,10 +101,10 @@     } -    public void delete(Long id) {-        repository.delete(find(id));                // throws if it does not exist+    public void delete(Long ownerId, Long id) {+        repository.delete(find(ownerId, id));        // throws if it does not exist or belongs to someone else     } -    private JobApplication find(Long id) {-        return repository.findById(id).orElseThrow(() -> new ApplicationNotFoundException(id));+    private JobApplication find(Long ownerId, Long id) {+        return repository.findByIdAndOwnerId(id, ownerId).orElseThrow(() -> new ApplicationNotFoundException(id));     } 

--- a/src/main/java/com/example/jobtracker/JobApplicationController.java+++ b/src/main/java/com/example/jobtracker/JobApplicationController.java@@ -7,4 +7,6 @@ import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity;+import org.springframework.security.core.annotation.AuthenticationPrincipal;+import org.springframework.security.oauth2.jwt.Jwt; import org.springframework.web.bind.annotation.DeleteMapping; import org.springframework.web.bind.annotation.GetMapping;@@ -19,5 +21,8 @@ import org.springframework.web.util.UriComponentsBuilder; -/** The HTTP layer: translate requests into service calls and results into responses. No rules live here. */+/**+ * The HTTP layer: translate requests into service calls and results into responses. No rules live here.+ * The user comes from the verified token, never from anything the client could simply claim in the request body.+ */ @RestController @RequestMapping("/api/applications")@@ -29,8 +34,14 @@     } +    /** The token's subject is the user's id, put there by TokenService when the user logged in. */+    private static Long userId(Jwt token) {+        return Long.valueOf(token.getSubject());+    }+     @PostMapping-    public ResponseEntity<JobApplicationResponse> create(@Valid @RequestBody JobApplicationRequest request,+    public ResponseEntity<JobApplicationResponse> create(@AuthenticationPrincipal Jwt token,+                                                         @Valid @RequestBody JobApplicationRequest request,                                                          UriComponentsBuilder uriBuilder) {-        JobApplicationResponse created = service.create(request);+        JobApplicationResponse created = service.create(userId(token), request);         URI location = uriBuilder.path("/api/applications/{id}").buildAndExpand(created.id()).toUri();         return ResponseEntity.created(location).body(created);@@ -38,38 +49,41 @@      @GetMapping("/{id}")-    public JobApplicationResponse get(@PathVariable Long id) {-        return service.get(id);+    public JobApplicationResponse get(@AuthenticationPrincipal Jwt token, @PathVariable Long id) {+        return service.get(userId(token), id);     }      @GetMapping     public PageResponse<JobApplicationResponse> list(+            @AuthenticationPrincipal Jwt token,             @RequestParam(required = false) ApplicationStatus status,             @RequestParam(required = false) String company,             @RequestParam(required = false) @Min(0) Integer page,             @RequestParam(required = false) @Min(1) Integer size) {-        return service.list(status, company, page, size);+        return service.list(userId(token), status, company, page, size);     }      @PutMapping("/{id}")-    public JobApplicationResponse replace(@PathVariable Long id, @Valid @RequestBody JobApplicationRequest request) {-        return service.replace(id, request);+    public JobApplicationResponse replace(@AuthenticationPrincipal Jwt token, @PathVariable Long id,+                                          @Valid @RequestBody JobApplicationRequest request) {+        return service.replace(userId(token), id, request);     }      @PostMapping("/{id}/status")-    public JobApplicationResponse changeStatus(@PathVariable Long id, @Valid @RequestBody StatusChangeRequest request) {-        return service.changeStatus(id, request.status());+    public JobApplicationResponse changeStatus(@AuthenticationPrincipal Jwt token, @PathVariable Long id,+                                               @Valid @RequestBody StatusChangeRequest request) {+        return service.changeStatus(userId(token), id, request.status());     }      @DeleteMapping("/{id}")     @ResponseStatus(HttpStatus.NO_CONTENT)-    public void delete(@PathVariable Long id) {-        service.delete(id);+    public void delete(@AuthenticationPrincipal Jwt token, @PathVariable Long id) {+        service.delete(userId(token), id);     }      @PostMapping("/{id}/interviews")-    public ResponseEntity<InterviewResponse> addInterview(@PathVariable Long id,+    public ResponseEntity<InterviewResponse> addInterview(@AuthenticationPrincipal Jwt token, @PathVariable Long id,                                                           @Valid @RequestBody InterviewRequest request,                                                           UriComponentsBuilder uriBuilder) {-        InterviewResponse created = service.addInterview(id, request);+        InterviewResponse created = service.addInterview(userId(token), id, request);         URI location = uriBuilder.path("/api/applications/{id}/interviews/{interviewId}")                 .buildAndExpand(id, created.id()).toUri();@@ -78,12 +92,13 @@      @GetMapping("/{id}/interviews")-    public List<InterviewResponse> listInterviews(@PathVariable Long id) {-        return service.listInterviews(id);+    public List<InterviewResponse> listInterviews(@AuthenticationPrincipal Jwt token, @PathVariable Long id) {+        return service.listInterviews(userId(token), id);     }      @DeleteMapping("/{id}/interviews/{interviewId}")     @ResponseStatus(HttpStatus.NO_CONTENT)-    public void deleteInterview(@PathVariable Long id, @PathVariable Long interviewId) {-        service.deleteInterview(id, interviewId);+    public void deleteInterview(@AuthenticationPrincipal Jwt token, @PathVariable Long id,+                                @PathVariable Long interviewId) {+        service.deleteInterview(userId(token), id, interviewId);     } }

--- a/src/main/java/com/example/jobtracker/JobApplication.java+++ b/src/main/java/com/example/jobtracker/JobApplication.java@@ -31,4 +31,8 @@     @Version     private long version;++    /** The user this application belongs to. It is set once, when the application is created. */+    @Column(nullable = false, updatable = false)+    private Long ownerId;      @Column(nullable = false, length = 100)@@ -69,5 +73,6 @@     } -    public JobApplication(String company, String position) {+    public JobApplication(Long ownerId, String company, String position) {+        this.ownerId = ownerId;         this.company = company;         this.position = position;@@ -76,4 +81,8 @@     public Long getId() {         return id;+    }++    public Long getOwnerId() {+        return ownerId;     } 

--- a/src/main/java/com/example/jobtracker/ApiExceptionHandler.java+++ b/src/main/java/com/example/jobtracker/ApiExceptionHandler.java@@ -56,4 +56,18 @@     } +    @ExceptionHandler(EmailAlreadyUsedException.class)+    ProblemDetail emailAlreadyUsed(EmailAlreadyUsedException e) {+        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.CONFLICT, e.getMessage());+        problem.setTitle("Email already registered");+        return problem;+    }++    @ExceptionHandler(InvalidCredentialsException.class)+    ProblemDetail invalidCredentials(InvalidCredentialsException e) {+        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, e.getMessage());+        problem.setTitle("Login failed");+        return problem;+    }+     @ExceptionHandler(InvalidStatusChangeException.class)     ProblemDetail invalidStatusChange(InvalidStatusChangeException e) {

$ curl -i -X OPTIONS http://localhost:18084/api/applications -H 'Origin: https://app.example.com' -H 'Access-Control-Request-Method: POST' -H 'Access-Control-Request-Headers: authorization,content-type'HTTP/1.1 200 Access-Control-Allow-Origin: https://app.example.comAccess-Control-Allow-Methods: GET,POST,PUT,DELETEAccess-Control-Allow-Headers: authorization, content-typeAccess-Control-Max-Age: 3600$ curl -i -X OPTIONS http://localhost:18084/api/applications -H 'Origin: https://evil.example.net' -H 'Access-Control-Request-Method: POST'HTTP/1.1 403 Invalid CORS request$ curl -i http://localhost:18084/api/applications -H 'Authorization: Bearer <token>'    (response headers only)HTTP/1.1 200 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersX-Content-Type-Options: nosniffX-XSS-Protection: 0Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: 0X-Frame-Options: DENYContent-Type: application/json

o.s.boot.SpringApplication               : Application run failedCaused by: java.lang.IllegalStateException: security.jwt-secret is not set. Provide the JWT_SECRET environment variable: base64 text of at least 32 random bytes

o.s.boot.SpringApplication               : Application run failedCaused by: java.lang.IllegalStateException: security.jwt-secret must decode to at least 32 bytes, but it decodes to 9

$ curl -i http://localhost:18084/api/applicationsHTTP/1.1 401 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersWWW-Authenticate: Bearer resource_metadata="http://localhost:18084/.well-known/oauth-protected-resource"Content-Type: application/problem+json;charset=UTF-8{"detail":"A valid access token is required. Log in and send it as: Authorization: Bearer <token>","status":401,"title":"Unauthorized"}$ curl -i -X POST http://localhost:18084/api/auth/register -H 'Content-Type: application/json' -d '{"email":"ada@example.com","password":"correct horse battery"}'HTTP/1.1 201 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/json{"id":1,"email":"ada@example.com"}$ curl -i -X POST http://localhost:18084/api/auth/register -H 'Content-Type: application/json' -d '{"email":"ADA@example.com","password":"correct horse battery"}'HTTP/1.1 409 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/problem+json{"detail":"That email address is already registered","instance":"/api/auth/register","status":409,"title":"Email already registered"}$ curl -i -X POST http://localhost:18084/api/auth/register -H 'Content-Type: application/json' -d '{"email":"not-an-email","password":"short"}'HTTP/1.1 400 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/problem+json{"detail":"The request has invalid fields","instance":"/api/auth/register","status":400,"title":"Validation failed","errors":{"email":"must be a well-formed email address","password":"size must be between 12 and 72"}}$ curl -i -X POST http://localhost:18084/api/auth/login -H 'Content-Type: application/json' -d '{"email":"ada@example.com","password":"wrong password here"}'HTTP/1.1 401 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/problem+json{"detail":"Invalid email or password","instance":"/api/auth/login","status":401,"title":"Login failed"}$ curl -i -X POST http://localhost:18084/api/auth/login -H 'Content-Type: application/json' -d '{"email":"nobody@example.com","password":"wrong password here"}'HTTP/1.1 401 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/problem+json{"detail":"Invalid email or password","instance":"/api/auth/login","status":401,"title":"Login failed"}$ curl -i -X POST http://localhost:18084/api/auth/login -H 'Content-Type: application/json' -d '{"email":"ada@example.com","password":"correct horse battery"}'HTTP/1.1 200 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/json{"accessToken":"<token>","tokenType":"Bearer","expiresInSeconds":3600}

$ curl -i -X POST http://localhost:18084/api/applications -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"company":"Acme","position":"Java Developer"}'HTTP/1.1 201 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersLocation: http://localhost:18084/api/applications/1Content-Type: application/json{"id":1,"version":0,"company":"Acme","position":"Java Developer","status":"WISHLIST","appliedOn":null,"jobUrl":null,"notes":null,"createdAt":"<now>","updatedAt":"<now>","interviews":[]}

$ curl -i http://localhost:18084/api/applications/1 -H 'Authorization: Bearer <Ada's token>'HTTP/1.1 200 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/json{"id":1,"version":0,"company":"Acme","position":"Java Developer","status":"WISHLIST","appliedOn":null,"jobUrl":null,"notes":null,"createdAt":"<now>","updatedAt":"<now>","interviews":[]}$ curl -i http://localhost:18084/api/applications/1 -H 'Authorization: Bearer <Grace's token>'HTTP/1.1 404 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/problem+json{"detail":"No job application with id 1","instance":"/api/applications/1","status":404,"title":"Application not found"}$ curl -i http://localhost:18084/api/applications -H 'Authorization: Bearer <Grace's token>'HTTP/1.1 200 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersContent-Type: application/json{"items":[],"page":0,"size":20,"totalItems":0,"totalPages":0}$ curl -i http://localhost:18084/api/applications -H 'Authorization: Bearer <Ada's token with the last character changed>'HTTP/1.1 401 Vary: OriginVary: Access-Control-Request-MethodVary: Access-Control-Request-HeadersWWW-Authenticate: Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:18084/.well-known/oauth-protected-resource"Content-Type: application/problem+json;charset=UTF-8{"detail":"A valid access token is required. Log in and send it as: Authorization: Bearer <token>","status":401,"title":"Unauthorized"}

// File: src/test/java/com/example/jobtracker/SecurityRulesTest.javapackage com.example.jobtracker;import static org.mockito.ArgumentMatchers.any;import static org.mockito.BDDMockito.given;import static org.mockito.Mockito.verifyNoInteractions;import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.options;import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;import org.junit.jupiter.api.Test;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;import org.springframework.context.annotation.Import;import org.springframework.http.MediaType;import org.springframework.security.oauth2.jwt.BadJwtException;import org.springframework.security.oauth2.jwt.JwtDecoder;import org.springframework.test.context.bean.override.mockito.MockitoBean;import org.springframework.test.web.servlet.MockMvc;/** Who is let in, and who is turned away. The services are mocks, so only the security rules are tested here. */@WebMvcTest(controllers = {JobApplicationController.class, AuthController.class},        properties = {"security.jwt-secret=c2VjcmV0LWZvci10ZXN0cy1vbmx5LTMyLWJ5dGVzLWxvbmch",                "security.allowed-origins=https://app.example.com"})@Import(SecurityTestConfig.class)class SecurityRulesTest {    @Autowired    MockMvc mvc;    @MockitoBean    JobApplicationService applications;    @MockitoBean    AuthService auth;    @MockitoBean    JwtDecoder jwtDecoder;    @Test    void aRequestWithoutATokenIsRefusedWith401AndAProblemBody() throws Exception {        mvc.perform(get("/api/applications"))                .andExpect(status().isUnauthorized())                .andExpect(header().exists("WWW-Authenticate"))                .andExpect(content().contentTypeCompatibleWith(MediaType.APPLICATION_PROBLEM_JSON))                .andExpect(jsonPath("$.title").value("Unauthorized"));        verifyNoInteractions(applications);    }    @Test    void aTokenThatFailsVerificationIsRefusedWith401() throws Exception {        given(jwtDecoder.decode("forged")).willThrow(new BadJwtException("signature does not match"));        mvc.perform(get("/api/applications").header("Authorization", "Bearer forged"))                .andExpect(status().isUnauthorized());        verifyNoInteractions(applications);    }    @Test    void aValidTokenIsLetThrough() throws Exception {        given(applications.list(any(), any(), any(), any(), any())).willReturn(                new PageResponse<>(java.util.List.of(), 0, 20, 0, 0));        mvc.perform(get("/api/applications").with(jwt().jwt(token -> token.subject("1"))))                .andExpect(status().isOk());    }    @Test    void registeringAndLoggingInNeedNoToken() throws Exception {        given(auth.register(any())).willReturn(new UserResponse(1L, "ada@example.com"));        mvc.perform(post("/api/auth/register").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"ada@example.com\", \"password\": \"a long enough password\"}"))                .andExpect(status().isCreated());    }    @Test    void aShortPasswordIsRejectedBeforeItReachesTheService() throws Exception {        mvc.perform(post("/api/auth/register").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"ada@example.com\", \"password\": \"short\"}"))                .andExpect(status().isBadRequest())                .andExpect(jsonPath("$.errors.password").exists());        verifyNoInteractions(auth);    }    @Test    void everythingElseIsDeniedByDefault() throws Exception {        mvc.perform(get("/actuator/env")).andExpect(status().isUnauthorized());        mvc.perform(get("/anything-at-all")).andExpect(status().isUnauthorized());    }    @Test    void aBrowserPageFromAnAllowedOriginPassesThePreflightCheck() throws Exception {        mvc.perform(options("/api/applications")                        .header("Origin", "https://app.example.com")                        .header("Access-Control-Request-Method", "POST")                        .header("Access-Control-Request-Headers", "authorization,content-type"))                .andExpect(status().isOk())                .andExpect(header().string("Access-Control-Allow-Origin", "https://app.example.com"));    }    @Test    void aPageFromAnyOtherOriginIsRefused() throws Exception {        mvc.perform(options("/api/applications")                        .header("Origin", "https://evil.example.net")                        .header("Access-Control-Request-Method", "POST"))                .andExpect(status().isForbidden());    }}

// File: src/test/java/com/example/jobtracker/TokenServiceTest.javapackage com.example.jobtracker;import static org.junit.jupiter.api.Assertions.assertEquals;import static org.junit.jupiter.api.Assertions.assertThrows;import static org.junit.jupiter.api.Assertions.assertTrue;import java.lang.reflect.Field;import java.time.Clock;import java.time.Duration;import java.util.Base64;import java.util.List;import javax.crypto.SecretKey;import org.junit.jupiter.api.Test;import org.springframework.security.oauth2.jwt.Jwt;import org.springframework.security.oauth2.jwt.JwtDecoder;import org.springframework.security.oauth2.jwt.JwtException;/** The token machinery without Spring: what is in a token, and what the decoder refuses. */class TokenServiceTest {    private static final String SECRET = Base64.getEncoder().encodeToString(            "a-test-secret-of-exactly-32-byte".getBytes(java.nio.charset.StandardCharsets.UTF_8));    private static final String OTHER_SECRET = Base64.getEncoder().encodeToString(            "another-secret-of-32-bytes-long!".getBytes(java.nio.charset.StandardCharsets.UTF_8));    private static SecuritySettings settings(String secret, Duration lifetime) {        return new SecuritySettings(secret, lifetime, List.of("http://localhost:3000"));    }    private static TokenService tokenService(String secret, Duration lifetime, Clock clock) {        JwtConfig config = new JwtConfig();        SecuritySettings settings = settings(secret, lifetime);        return new TokenService(config.jwtEncoder(config.jwtKey(settings)), settings, clock);    }    private static JwtDecoder decoder(String secret) {        JwtConfig config = new JwtConfig();        SecretKey key = config.jwtKey(settings(secret, Duration.ofHours(1)));        return config.jwtDecoder(key);    }    private static AppUser user(long id) throws Exception {        AppUser user = new AppUser("ada@example.com", "{bcrypt}x", java.time.Instant.now());        Field field = AppUser.class.getDeclaredField("id");        field.setAccessible(true);        field.set(user, id);        return user;    }    @Test    void aTokenNamesTheUserAndExpiresAfterTheConfiguredLifetime() throws Exception {        TokenResponse response = tokenService(SECRET, Duration.ofHours(1), Clock.systemUTC()).issueFor(user(42));        Jwt token = decoder(SECRET).decode(response.accessToken());        assertEquals("Bearer", response.tokenType());        assertEquals(3600, response.expiresInSeconds());        assertEquals("42", token.getSubject());        assertEquals("jobtracker", token.getClaimAsString("iss"));        assertEquals(Duration.ofHours(1), Duration.between(token.getIssuedAt(), token.getExpiresAt()));    }    @Test    void aTokenChangedByAnAttackerIsRejected() throws Exception {        String token = tokenService(SECRET, Duration.ofHours(1), Clock.systemUTC()).issueFor(user(42)).accessToken();        String[] parts = token.split("\\.");        String forgedPayload = Base64.getUrlEncoder().withoutPadding()                .encodeToString("{\"sub\":\"1\",\"iss\":\"jobtracker\"}".getBytes(java.nio.charset.StandardCharsets.UTF_8));        String forged = parts[0] + "." + forgedPayload + "." + parts[2];       // a new payload with the old signature        assertThrows(JwtException.class, () -> decoder(SECRET).decode(forged));    }    @Test    void aTokenSignedWithAnotherSecretIsRejected() throws Exception {        String token = tokenService(OTHER_SECRET, Duration.ofHours(1), Clock.systemUTC()).issueFor(user(42)).accessToken();        assertThrows(JwtException.class, () -> decoder(SECRET).decode(token));    }    @Test    void anExpiredTokenIsRejected() throws Exception {        Clock twoHoursAgo = Clock.fixed(java.time.Instant.now().minus(Duration.ofHours(2)), java.time.ZoneOffset.UTC);        String token = tokenService(SECRET, Duration.ofHours(1), twoHoursAgo).issueFor(user(42)).accessToken();   // expired an hour ago        JwtException e = assertThrows(JwtException.class, () -> decoder(SECRET).decode(token));        assertTrue(e.getMessage().contains("expired"), e.getMessage());    }    @Test    void aSecretThatIsTooShortStopsTheApplicationFromStarting() {        String shortSecret = Base64.getEncoder().encodeToString("too short".getBytes(java.nio.charset.StandardCharsets.UTF_8));        IllegalStateException e = assertThrows(IllegalStateException.class,                () -> new JwtConfig().jwtKey(settings(shortSecret, Duration.ofHours(1))));        assertEquals("security.jwt-secret must decode to at least 32 bytes, but it decodes to 9", e.getMessage());    }    @Test    void aMissingSecretStopsTheApplicationWithAnInstruction() {        IllegalStateException e = assertThrows(IllegalStateException.class,                () -> new JwtConfig().jwtKey(settings("${JWT_SECRET}", Duration.ofHours(1))));        assertTrue(e.getMessage().contains("JWT_SECRET"), e.getMessage());    }    @Test    void aSecretThatIsNotBase64StopsTheApplicationFromStarting() {        assertThrows(IllegalStateException.class,                () -> new JwtConfig().jwtKey(settings("this is not base64 !!!", Duration.ofHours(1))));    }}

// File: src/test/java/com/example/jobtracker/AuthServiceTest.javapackage com.example.jobtracker;import static org.junit.jupiter.api.Assertions.assertEquals;import static org.junit.jupiter.api.Assertions.assertFalse;import static org.junit.jupiter.api.Assertions.assertNotEquals;import static org.junit.jupiter.api.Assertions.assertThrows;import static org.junit.jupiter.api.Assertions.assertTrue;import static org.mockito.ArgumentMatchers.any;import static org.mockito.BDDMockito.given;import static org.mockito.Mockito.never;import static org.mockito.Mockito.verify;import java.time.Clock;import java.time.Instant;import java.time.ZoneOffset;import java.util.Optional;import org.junit.jupiter.api.BeforeEach;import org.junit.jupiter.api.Test;import org.junit.jupiter.api.extension.ExtendWith;import org.mockito.ArgumentCaptor;import org.mockito.Mock;import org.mockito.junit.jupiter.MockitoExtension;import org.springframework.security.crypto.factory.PasswordEncoderFactories;import org.springframework.security.crypto.password.PasswordEncoder;/** Registration and login with a real password encoder and a mocked user store. */@ExtendWith(MockitoExtension.class)class AuthServiceTest {    private static final Clock CLOCK = Clock.fixed(Instant.parse("2026-03-15T10:00:00Z"), ZoneOffset.UTC);    @Mock    AppUserRepository users;    @Mock    TokenService tokens;    private final PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();    private AuthService service;    @BeforeEach    void setUp() {        service = new AuthService(users, encoder, tokens, CLOCK);    }    @Test    void registerStoresAHashAndNeverThePassword() {        given(users.existsByEmail("ada@example.com")).willReturn(false);        given(users.saveAndFlush(any(AppUser.class))).willAnswer(call -> call.getArgument(0));        service.register(new RegisterRequest("  Ada@Example.COM ", "correct horse battery"));        ArgumentCaptor<AppUser> saved = ArgumentCaptor.forClass(AppUser.class);        verify(users).saveAndFlush(saved.capture());        String hash = saved.getValue().getPasswordHash();        assertEquals("ada@example.com", saved.getValue().getEmail());          // trimmed and lower-cased        assertNotEquals("correct horse battery", hash);        assertFalse(hash.contains("correct horse"));        assertTrue(hash.startsWith("{bcrypt}"), hash);        assertTrue(encoder.matches("correct horse battery", hash));    }    @Test    void twoUsersWithTheSamePasswordGetDifferentHashes() {        String first = encoder.encode("correct horse battery");        String second = encoder.encode("correct horse battery");        assertNotEquals(first, second);                                          // each hash has its own random salt        assertTrue(encoder.matches("correct horse battery", first));        assertTrue(encoder.matches("correct horse battery", second));    }    @Test    void registeringAnEmailThatExistsIsRejectedAndNothingIsSaved() {        given(users.existsByEmail("ada@example.com")).willReturn(true);        assertThrows(EmailAlreadyUsedException.class,                () -> service.register(new RegisterRequest("ada@example.com", "correct horse battery")));        verify(users, never()).saveAndFlush(any());    }    @Test    void loginWithTheRightPasswordIssuesAToken() {        AppUser ada = new AppUser("ada@example.com", encoder.encode("correct horse battery"), Instant.now());        given(users.findByEmail("ada@example.com")).willReturn(Optional.of(ada));        TokenResponse token = new TokenResponse("the-token", "Bearer", 3600);        given(tokens.issueFor(ada)).willReturn(token);        assertEquals(token, service.login(new LoginRequest("Ada@example.com", "correct horse battery")));    }    @Test    void aWrongPasswordAndAnUnknownEmailGiveTheSameFailure() {        AppUser ada = new AppUser("ada@example.com", encoder.encode("correct horse battery"), Instant.now());        given(users.findByEmail("ada@example.com")).willReturn(Optional.of(ada));        given(users.findByEmail("nobody@example.com")).willReturn(Optional.empty());        InvalidCredentialsException wrongPassword = assertThrows(InvalidCredentialsException.class,                () -> service.login(new LoginRequest("ada@example.com", "wrong password here")));        InvalidCredentialsException unknownEmail = assertThrows(InvalidCredentialsException.class,                () -> service.login(new LoginRequest("nobody@example.com", "whatever it was")));        assertEquals(wrongPassword.getMessage(), unknownEmail.getMessage());     // the response must not reveal which one        verify(tokens, never()).issueFor(any());    }}

// File: src/test/java/com/example/jobtracker/SecurityIntegrationTest.javapackage com.example.jobtracker;import static org.junit.jupiter.api.Assertions.assertEquals;import static org.junit.jupiter.api.Assertions.assertFalse;import static org.junit.jupiter.api.Assertions.assertTrue;import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;import com.jayway.jsonpath.JsonPath;import org.junit.jupiter.api.AfterEach;import org.junit.jupiter.api.Test;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.boot.test.context.SpringBootTest;import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;import org.springframework.http.MediaType;import org.springframework.jdbc.core.JdbcTemplate;import org.springframework.test.context.DynamicPropertyRegistry;import org.springframework.test.context.DynamicPropertySource;import org.springframework.test.web.servlet.MockMvc;/** The whole stack: real security filters, real controllers and services, real PostgreSQL, real tokens. */@SpringBootTest(properties = "security.jwt-secret=c2VjcmV0LWZvci10ZXN0cy1vbmx5LTMyLWJ5dGVzLWxvbmch")@AutoConfigureMockMvcclass SecurityIntegrationTest {    private static final String PASSWORD = "correct horse battery";    @DynamicPropertySource    static void database(DynamicPropertyRegistry registry) {        TestPostgres.register(registry);    }    @Autowired    MockMvc mvc;    @Autowired    JdbcTemplate jdbc;    @AfterEach    void cleanUp() {        jdbc.update("delete from interviews");        jdbc.update("delete from job_applications");        jdbc.update("delete from users");    }    private void register(String email) throws Exception {        mvc.perform(post("/api/auth/register").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"" + email + "\", \"password\": \"" + PASSWORD + "\"}"))                .andExpect(status().isCreated());    }    private String login(String email, String password) throws Exception {        String body = mvc.perform(post("/api/auth/login").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"" + email + "\", \"password\": \"" + password + "\"}"))                .andExpect(status().isOk())                .andReturn().getResponse().getContentAsString();        return JsonPath.read(body, "$.accessToken");    }    private String createApplicationAs(String token) throws Exception {        String body = mvc.perform(post("/api/applications").header("Authorization", "Bearer " + token)                        .contentType(MediaType.APPLICATION_JSON)                        .content("{\"company\": \"Acme\", \"position\": \"Java Developer\"}"))                .andExpect(status().isCreated())                .andReturn().getResponse().getContentAsString();        return String.valueOf((Integer) JsonPath.read(body, "$.id"));    }    @Test    void registerLoginAndUseTheApiWithTheToken() throws Exception {        register("ada@example.com");        String token = login("ada@example.com", PASSWORD);        String id = createApplicationAs(token);        mvc.perform(get("/api/applications/" + id).header("Authorization", "Bearer " + token))                .andExpect(status().isOk())                .andExpect(jsonPath("$.company").value("Acme"));    }    @Test    void thePasswordIsStoredOnlyAsABcryptHash() throws Exception {        register("ada@example.com");        String stored = jdbc.queryForObject("select password_hash from users where email = 'ada@example.com'", String.class);        assertTrue(stored.startsWith("{bcrypt}$2"), stored);        assertFalse(stored.contains(PASSWORD));    }    @Test    void registeringTheSameEmailTwiceGives409() throws Exception {        register("ada@example.com");        mvc.perform(post("/api/auth/register").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"ADA@example.com\", \"password\": \"" + PASSWORD + "\"}"))                .andExpect(status().isConflict());    }    @Test    void aWrongPasswordAndAnUnknownUserBothGet401WithTheSameBody() throws Exception {        register("ada@example.com");        String wrongPassword = mvc.perform(post("/api/auth/login").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"ada@example.com\", \"password\": \"not the password\"}"))                .andExpect(status().isUnauthorized()).andReturn().getResponse().getContentAsString();        String unknownUser = mvc.perform(post("/api/auth/login").contentType(MediaType.APPLICATION_JSON)                        .content("{\"email\": \"nobody@example.com\", \"password\": \"not the password\"}"))                .andExpect(status().isUnauthorized()).andReturn().getResponse().getContentAsString();        String detailForWrongPassword = JsonPath.read(wrongPassword, "$.detail");        String detailForUnknownUser = JsonPath.read(unknownUser, "$.detail");        assertEquals(detailForWrongPassword, detailForUnknownUser);    }    @Test    void aUserCannotSeeAnotherUsersApplicationNotEvenByGuessingItsId() throws Exception {        register("ada@example.com");        register("grace@example.com");        String adasToken = login("ada@example.com", PASSWORD);        String gracesToken = login("grace@example.com", PASSWORD);        String adasApplication = createApplicationAs(adasToken);        mvc.perform(get("/api/applications/" + adasApplication).header("Authorization", "Bearer " + gracesToken))                .andExpect(status().isNotFound());        mvc.perform(get("/api/applications").header("Authorization", "Bearer " + gracesToken))                .andExpect(status().isOk())                .andExpect(jsonPath("$.totalItems").value(0));        mvc.perform(get("/api/applications").header("Authorization", "Bearer " + adasToken))                .andExpect(jsonPath("$.totalItems").value(1));    }    @Test    void aMissingOrBrokenTokenGets401() throws Exception {        mvc.perform(get("/api/applications")).andExpect(status().isUnauthorized());        mvc.perform(get("/api/applications").header("Authorization", "Bearer not.a.token"))                .andExpect(status().isUnauthorized());    }}