Session 9

// src/main/java/in/ignou/admission/entity/User.java   (Session 9, Q37)
package in.ignou.admission.entity;

import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import jakarta.persistence.Table;

/** Login account. @Table("users") because USER is a reserved word in several databases. */
@Entity
@Table(name = "users")
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, unique = true, length = 50)
    private String username;

    /** BCrypt hash, never the raw password. 60 characters. */
    @Column(nullable = false, length = 100)
    private String password;

    private boolean enabled = true;

    public Long getId() { return id; }
    public void setId(Long id) { this.id = id; }
    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }
    public String getPassword() { return password; }
    public void setPassword(String password) { this.password = password; }
    public boolean isEnabled() { return enabled; }
    public void setEnabled(boolean enabled) { this.enabled = enabled; }
}

// src/main/java/in/ignou/admission/repository/UserRepository.java   (Session 9, Q37)
package in.ignou.admission.repository;

import java.util.Optional;

import org.springframework.data.jpa.repository.JpaRepository;

import in.ignou.admission.entity.User;

public interface UserRepository extends JpaRepository<User, Long> {

    Optional<User> findByUsername(String username);

    boolean existsByUsername(String username);
}

// src/main/java/in/ignou/admission/security/AppUserDetailsService.java   (Session 9, Q37)
package in.ignou.admission.security;

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import in.ignou.admission.entity.User;
import in.ignou.admission.repository.UserRepository;

/**
 * The bridge between the users table and Spring Security. The framework calls
 * loadUserByUsername at login, then compares the submitted password with the
 * stored hash through the PasswordEncoder bean.
 */
@Service
public class AppUserDetailsService implements UserDetailsService {

    private final UserRepository users;

    public AppUserDetailsService(UserRepository users) {
        this.users = users;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User u = users.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("No user: " + username));
        // Spring's own User class (org.springframework.security.core.userdetails.User)
        return org.springframework.security.core.userdetails.User.withUsername(u.getUsername())
                .password(u.getPassword())      // already BCrypt-hashed
                .disabled(!u.isEnabled())
                .roles("USER")                  // Session 10 replaces this with roles from the DB
                .build();
    }
}

// src/main/java/in/ignou/admission/security/DataSeeder.java   (Session 9, Q37: first login account)
package in.ignou.admission.security;

import org.springframework.boot.CommandLineRunner;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Component;

import in.ignou.admission.entity.User;
import in.ignou.admission.repository.UserRepository;

/** Runs once after start-up. Hashes the password in Java, so no hash needs to be pasted into SQL. */
@Component
public class DataSeeder implements CommandLineRunner {

    private final UserRepository users;
    private final PasswordEncoder encoder;

    public DataSeeder(UserRepository users, PasswordEncoder encoder) {
        this.users = users;
        this.encoder = encoder;
    }

    @Override
    public void run(String... args) {
        if (users.existsByUsername("admin")) {
            return;
        }
        User admin = new User();
        admin.setUsername("admin");
        admin.setPassword(encoder.encode("admin123"));
        users.save(admin);
        System.out.println("Seeded user admin / admin123");
    }
}

// src/main/java/in/ignou/admission/security/SecurityConfig.java   (Session 9: Q37 encoder, Q38 login page, Q39 logout)
package in.ignou.admission.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    /** Q37: BCrypt with a random salt per password; strength 10 (default) = 2^10 rounds. */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    /** Q40 uses this to log the new user in programmatically. */
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/register", "/css/**", "/actuator/health").permitAll()
                .anyRequest().authenticated())
            // Q38: our own page at GET /login; the POST /login handler is still Spring's
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
                .permitAll())
            // Q39: POST /logout ends the session and returns to the login page
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout")
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID")
                .permitAll())
            // lets curl -u user:pass call /api/** (browser still uses the form)
            .httpBasic(Customizer.withDefaults())
            // the JSON API is called by curl/Postman, not from a browser session: no CSRF token there
            .csrf(csrf -> csrf.ignoringRequestMatchers("/api/**", "/xml/**", "/actuator/**"));
        return http.build();
    }
}

// src/main/java/in/ignou/admission/web/PageController.java   (Session 9, Q38)
package in.ignou.admission.web;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

/** Plain @Controller: return values are Thymeleaf template names under src/main/resources/templates. */
@Controller
public class PageController {

    @GetMapping("/login")
    public String login() {
        return "login";        // templates/login.html
    }

    @GetMapping({"/", "/dashboard"})
    public String dashboard() {
        return "dashboard";    // templates/dashboard.html
    }
}

<!DOCTYPE html>
<!-- src/main/resources/templates/login.html   (Session 9, Q38) -->
<html xmlns:th="http://www.thymeleaf.org">
<head>
  <meta charset="UTF-8">
  <title>Admission Portal - Login</title>
</head>
<body>
  <h2>Student Admission Portal</h2>

  <p th:if="${param.error}" style="color:red">Invalid username or password.</p>
  <p th:if="${param.logout}" style="color:green">You have been logged out.</p>

  <!-- th:action posts to /login, the URL Spring Security listens on, and adds the CSRF token -->
  <form th:action="@{/login}" method="post">
    <p>
      <label for="username">Username</label>
      <input type="text" id="username" name="username" required autofocus>
    </p>
    <p>
      <label for="password">Password</label>
      <input type="password" id="password" name="password" required>
    </p>
    <button type="submit">Sign in</button>
  </form>

  <p>New student? <a th:href="@{/register}">Register here</a></p>
</body>
</html>

<!DOCTYPE html>
<!-- src/main/resources/templates/dashboard.html   (Session 9, Q38 landing page + Q39 logout button) -->
<html xmlns:th="http://www.thymeleaf.org">
<head>
  <meta charset="UTF-8">
  <title>Admission Portal - Dashboard</title>
</head>
<body>
  <h2>Dashboard</h2>
  <p>Welcome, <span th:text="${#authentication.name}">user</span>.</p>

  <ul>
    <li><a th:href="@{/api/students}">Students (JSON)</a></li>
    <li><a th:href="@{/actuator/health}">Health</a></li>
  </ul>

  <!-- Q39: logout must be a POST (CSRF-protected); a plain GET link would be rejected -->
  <form th:action="@{/logout}" method="post">
    <button type="submit">Logout</button>
  </form>
</body>
</html>

<!-- Session 9, Q40: Bean Validation (@NotBlank, @Size, @Email). Add inside <dependencies>. -->
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-validation</artifactId>
</dependency>

// src/main/java/in/ignou/admission/web/RegistrationForm.java   (Session 9, Q40)
package in.ignou.admission.web;

import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
import jakarta.validation.constraints.Size;

/** Form-backing object. Not an entity: it carries confirmPassword, which is never stored. */
public class RegistrationForm {

    @NotBlank(message = "Username is required")
    @Size(min = 4, max = 50, message = "Username must be 4 to 50 characters")
    @Pattern(regexp = "[a-zA-Z0-9_]+", message = "Letters, digits and underscore only")
    private String username;

    @NotBlank(message = "Password is required")
    @Size(min = 6, max = 40, message = "Password must be 6 to 40 characters")
    private String password;

    @NotBlank(message = "Confirm the password")
    private String confirmPassword;

    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }
    public String getPassword() { return password; }
    public void setPassword(String password) { this.password = password; }
    public String getConfirmPassword() { return confirmPassword; }
    public void setConfirmPassword(String confirmPassword) { this.confirmPassword = confirmPassword; }
}

// src/main/java/in/ignou/admission/web/RegistrationController.java   (Session 9, Q40)
package in.ignou.admission.web;

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.context.SecurityContextRepository;
import org.springframework.stereotype.Controller;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;

import in.ignou.admission.entity.User;
import in.ignou.admission.repository.UserRepository;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.validation.Valid;

@Controller
public class RegistrationController {

    private final UserRepository users;
    private final PasswordEncoder encoder;
    private final AuthenticationManager authenticationManager;
    // saves the SecurityContext into the HTTP session so the next request is still logged in
    private final SecurityContextRepository contextRepository = new HttpSessionSecurityContextRepository();

    public RegistrationController(UserRepository users, PasswordEncoder encoder,
                                  AuthenticationManager authenticationManager) {
        this.users = users;
        this.encoder = encoder;
        this.authenticationManager = authenticationManager;
    }

    @GetMapping("/register")
    public String form(@ModelAttribute("form") RegistrationForm form) {
        return "register";
    }

    /**
     * @Valid runs the annotations on RegistrationForm; BindingResult must be the very next
     * parameter, otherwise Spring throws instead of letting us re-show the form.
     */
    @PostMapping("/register")
    public String register(@Valid @ModelAttribute("form") RegistrationForm form, BindingResult result,
                           HttpServletRequest request, HttpServletResponse response) {
        if (!result.hasFieldErrors("confirmPassword") && !form.getPassword().equals(form.getConfirmPassword())) {
            result.rejectValue("confirmPassword", "mismatch", "Passwords do not match");
        }
        if (!result.hasFieldErrors("username") && users.existsByUsername(form.getUsername())) {
            result.rejectValue("username", "taken", "Username is already taken");
        }
        if (result.hasErrors()) {
            return "register";                       // re-render with th:errors messages
        }

        User user = new User();
        user.setUsername(form.getUsername());
        user.setPassword(encoder.encode(form.getPassword()));
        users.save(user);

        // --- auto-login: the same path the login form takes, done in code ---
        Authentication auth = authenticationManager.authenticate(
                UsernamePasswordAuthenticationToken.unauthenticated(form.getUsername(), form.getPassword()));
        SecurityContext context = SecurityContextHolder.createEmptyContext();
        context.setAuthentication(auth);
        SecurityContextHolder.setContext(context);            // current thread
        contextRepository.saveContext(context, request, response);   // HTTP session

        return "redirect:/dashboard";
    }
}

<!DOCTYPE html>
<!-- src/main/resources/templates/register.html   (Session 9, Q40) -->
<html xmlns:th="http://www.thymeleaf.org">
<head>
  <meta charset="UTF-8">
  <title>Admission Portal - Register</title>
</head>
<body>
  <h2>Create your account</h2>

  <!-- th:object binds the form to the "form" model attribute; th:field fills name, id and value -->
  <form th:action="@{/register}" th:object="${form}" method="post">
    <p>
      <label for="username">Username</label>
      <input type="text" th:field="*{username}" required>
      <span th:if="${#fields.hasErrors('username')}" th:errors="*{username}" style="color:red"></span>
    </p>
    <p>
      <label for="password">Password</label>
      <input type="password" th:field="*{password}" required>
      <span th:if="${#fields.hasErrors('password')}" th:errors="*{password}" style="color:red"></span>
    </p>
    <p>
      <label for="confirmPassword">Confirm password</label>
      <input type="password" th:field="*{confirmPassword}" required>
      <span th:if="${#fields.hasErrors('confirmPassword')}" th:errors="*{confirmPassword}" style="color:red"></span>
    </p>
    <button type="submit">Register and sign in</button>
  </form>

  <p>Already registered? <a th:href="@{/login}">Login</a></p>
</body>
</html>