auth

README.md

@@ -31,11 +31,11 @@ Create that file once on the server with the production values required by the
 app. The Gitea deploy step verifies that it exists, but it does not create or
 overwrite it.
 
-Protected API routes require the shared API key from `ORG_BACKEND_API_KEY`.
-Clients send it as:
+Use `/api/auth/register` to create users and `/api/auth/login` to receive a JWT.
+Protected API routes send that token as:
 
 ```text
-X-Org-Api-Key: <key>
+Authorization: Bearer <token>
 ```
 
 The live systemd unit at `/etc/systemd/system/org-backend.service` is managed

src/main/java/org/zaine/app/controller/AuthController.java

@@ -4,7 +4,6 @@ package org.zaine.app.controller;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import org.zaine.app.security.JwtUtil;
-import org.zaine.app.security.RequiresAuth;
 import org.zaine.app.user.User;
 import org.zaine.app.user.UserRepository;
 import org.springframework.http.*;
@@ -17,7 +16,6 @@ import java.util.Map;
 
 @RestController
 @RequestMapping("/api/auth")
-@RequiresAuth
 @Tag(name = "Authentication")
 public class AuthController {
 

src/main/java/org/zaine/app/controller/CommentsController.java

@@ -22,6 +22,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 
 @RestController
 @RequestMapping("/api/comments")
+@RequiresAuth
 @Tag(name = "Comments", description = "Endpoints for managing comments")
 public class CommentsController {
 
@@ -86,7 +87,6 @@ public class CommentsController {
 		value = "",
 		consumes = "application/json"
 	)
-	@RequiresAuth
 	public void addComment(@RequestBody CreateCommentDTO dto) {
 
 		if (dto.getContent() == null || dto.getContent().trim().isEmpty()) {

src/main/java/org/zaine/app/security/ApiKeyAuthService.java

@@ -1,31 +0,0 @@
-package org.zaine.app.security;
-
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.stereotype.Component;
-
-@Component
-public class ApiKeyAuthService {
-
-    private final String apiKey;
-
-    public ApiKeyAuthService(@Value("${org.auth.api-key:}") String apiKey) {
-        this.apiKey = apiKey == null ? "" : apiKey.trim();
-    }
-
-    public boolean isConfigured() {
-        return !apiKey.isBlank();
-    }
-
-    public boolean isValid(String candidate) {
-        if (!isConfigured() || candidate == null || candidate.isBlank()) {
-            return false;
-        }
-
-        byte[] expected = apiKey.getBytes(StandardCharsets.UTF_8);
-        byte[] provided = candidate.trim().getBytes(StandardCharsets.UTF_8);
-        return MessageDigest.isEqual(expected, provided);
-    }
-}

src/main/java/org/zaine/app/security/JwtAuthFilter.java

@@ -19,14 +19,11 @@ import java.util.List;
 @Component
 public class JwtAuthFilter extends OncePerRequestFilter {
 
-    public static final String API_KEY_HEADER = "X-Org-Api-Key";
-
-    private final ApiKeyAuthService apiKeyAuthService;
+    private final JwtUtil jwtUtil;
     private final RequestMappingHandlerMapping requestMappingHandlerMapping;
 
-    public JwtAuthFilter(ApiKeyAuthService apiKeyAuthService,
-                         RequestMappingHandlerMapping requestMappingHandlerMapping) {
-        this.apiKeyAuthService = apiKeyAuthService;
+    public JwtAuthFilter(JwtUtil jwtUtil, RequestMappingHandlerMapping requestMappingHandlerMapping) {
+        this.jwtUtil = jwtUtil;
         this.requestMappingHandlerMapping = requestMappingHandlerMapping;
     }
 
@@ -39,17 +36,26 @@ public class JwtAuthFilter extends OncePerRequestFilter {
             return;
         }
 
-        String apiKey = request.getHeader(API_KEY_HEADER);
-        if (apiKeyAuthService.isValid(apiKey)) {
-            var auth = new UsernamePasswordAuthenticationToken("api-key", null, List.of());
-            auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
-            SecurityContextHolder.getContext().setAuthentication(auth);
-            filterChain.doFilter(request, response);
+        String authHeader = request.getHeader("Authorization");
+
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing or invalid Authorization header");
             return;
         }
 
-        response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
-                "Missing or invalid " + API_KEY_HEADER + " header");
+        String token = authHeader.substring(7);
+
+        if (!jwtUtil.isTokenValid(token)) {
+            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid or expired token");
+            return;
+        }
+
+        String username = jwtUtil.extractUsername(token);
+        var auth = new UsernamePasswordAuthenticationToken(username, null, List.of());
+        auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
+        SecurityContextHolder.getContext().setAuthentication(auth);
+
+        filterChain.doFilter(request, response);
     }
 
     private boolean endpointRequiresAuth(HttpServletRequest request) {

src/test/java/org/zaine/app/security/ApiKeyAuthServiceTest.java

@@ -1,27 +0,0 @@
-package org.zaine.app.security;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-import org.junit.jupiter.api.Test;
-
-class ApiKeyAuthServiceTest {
-
-    @Test
-    void rejectsAllKeysWhenNoApiKeyIsConfigured() {
-        ApiKeyAuthService service = new ApiKeyAuthService("");
-
-        assertFalse(service.isConfigured());
-        assertFalse(service.isValid("anything"));
-    }
-
-    @Test
-    void acceptsOnlyConfiguredApiKey() {
-        ApiKeyAuthService service = new ApiKeyAuthService("secret-key");
-
-        assertTrue(service.isConfigured());
-        assertTrue(service.isValid("secret-key"));
-        assertFalse(service.isValid("wrong-key"));
-        assertFalse(service.isValid(null));
-    }
-}

src/test/java/org/zaine/app/security/JwtAuthFilterTest.java

@@ -6,6 +6,7 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
 
@@ -23,11 +24,14 @@ class JwtAuthFilterTest {
     @BeforeEach
     void setUp() {
         handlerMapping = new TestHandlerMapping();
-        filter = new JwtAuthFilter(new ApiKeyAuthService("secret-key"), handlerMapping);
+        JwtUtil jwtUtil = new JwtUtil();
+        ReflectionTestUtils.setField(jwtUtil, "secret", "test-secret-key-that-is-at-least-32-characters");
+        ReflectionTestUtils.setField(jwtUtil, "expirationMs", 86_400_000L);
+        filter = new JwtAuthFilter(jwtUtil, handlerMapping);
     }
 
     @Test
-    void rejectsProtectedEndpointWithoutApiKey() throws Exception {
+    void rejectsProtectedEndpointWithoutBearerToken() throws Exception {
         MockHttpServletRequest request = new MockHttpServletRequest("GET", "/secure");
         MockHttpServletResponse response = new MockHttpServletResponse();
         AtomicBoolean chainCalled = new AtomicBoolean(false);
@@ -40,9 +44,12 @@ class JwtAuthFilterTest {
     }
 
     @Test
-    void allowsProtectedEndpointWithValidApiKey() throws Exception {
+    void allowsProtectedEndpointWithValidBearerToken() throws Exception {
         MockHttpServletRequest request = new MockHttpServletRequest("GET", "/secure");
-        request.addHeader(JwtAuthFilter.API_KEY_HEADER, "secret-key");
+        JwtUtil jwtUtil = new JwtUtil();
+        ReflectionTestUtils.setField(jwtUtil, "secret", "test-secret-key-that-is-at-least-32-characters");
+        ReflectionTestUtils.setField(jwtUtil, "expirationMs", 86_400_000L);
+        request.addHeader("Authorization", "Bearer " + jwtUtil.generateToken("zaine"));
         MockHttpServletResponse response = new MockHttpServletResponse();
         AtomicBoolean chainCalled = new AtomicBoolean(false);
         handlerMapping.setHandler(handlerFor("secure"));
@@ -54,7 +61,7 @@ class JwtAuthFilterTest {
     }
 
     @Test
-    void allowsPublicEndpointWithoutApiKey() throws Exception {
+    void allowsPublicEndpointWithoutBearerToken() throws Exception {
         MockHttpServletRequest request = new MockHttpServletRequest("GET", "/public");
         MockHttpServletResponse response = new MockHttpServletResponse();
         AtomicBoolean chainCalled = new AtomicBoolean(false);