Add JWT authentication, RBAC and signup functionality

pom.xml

@@ -91,6 +91,23 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+            <version>0.12.5</version>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+            <version>0.12.5</version>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+            <version>0.12.5</version>
+            <scope>runtime</scope>
+        </dependency>
     </dependencies>
 
     <build>

src/main/java/org/example/alfs/config/SecurityConfig.java

@@ -0,0 +1,58 @@
+package org.example.alfs.config;
+
+import org.example.alfs.security.JwtAuthenticationFilter;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+@Configuration
+@EnableMethodSecurity
+public class SecurityConfig {
+    private final JwtAuthenticationFilter jwtFilter;
+
+    public SecurityConfig(JwtAuthenticationFilter jwtFilter) {this.jwtFilter = jwtFilter;}
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+
+        http
+                // Only for development (H2 console support)
+                .securityMatcher("/**")
+
+                .csrf(csrf -> csrf.disable())
+
+                .headers(headers -> headers.frameOptions(frame -> frame.disable()))
+
+                // stateless jwt
+                .sessionManagement(session ->
+                        session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                )
+
+
+                // Authorization strategy:
+                // - JWT is used for authentication (identifying the user)
+                // - User roles are NOT trusted from the JWT
+                // - Roles are always loaded from the database
+                // This ensures that permission changes take effect immediately
+                .authorizeHttpRequests(auth -> auth
+                        .requestMatchers("/auth/login").permitAll()
+                        .requestMatchers("/auth/signup").permitAll()
+                        .requestMatchers("/auth/hash").permitAll()
+                        .requestMatchers("/h2-console/**").permitAll()
+                        .anyRequest().authenticated()
+                )
+
+                // disable DEFAULT LOGIN
+                .formLogin(form -> form.disable())
+                .httpBasic(basic -> basic.disable())
+
+
+                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+}

src/main/java/org/example/alfs/controllers/AuthController.java

@@ -2,26 +2,27 @@
 
 import org.example.alfs.dto.auth.LoginRequestDTO;
 import org.example.alfs.dto.auth.LoginResponseDTO;
+import org.example.alfs.dto.auth.SignupRequestDTO;
 import org.example.alfs.entities.User;
+import org.example.alfs.security.JwtService;
 import org.example.alfs.services.AuthService;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 import jakarta.validation.Valid;
 
 @RestController
 @RequestMapping("/auth")
 public class AuthController {
 
     private final AuthService authService;
+    private final JwtService jwtService;
 
-    public AuthController(AuthService authService) {
+    public AuthController(AuthService authService, JwtService jwtService) {
         this.authService = authService;
+        this.jwtService = jwtService;
     }
 
     /**
-     * Handles user login by validating credentials and returning user details.
+     * Authenticates a user by validating credentials and returns a JWT token.
      */
     @PostMapping("/login")
     public LoginResponseDTO login(@Valid @RequestBody LoginRequestDTO request) {
@@ -31,9 +32,17 @@ public LoginResponseDTO login(@Valid @RequestBody LoginRequestDTO request) {
                 request.getPassword()
         );
 
-        return new LoginResponseDTO(
-                user.getUsername(),
-                user.getRole().name()
-        );
+        String token = jwtService.generateToken(user);
+        return new LoginResponseDTO(token);
     }
+
+
+    /**
+     * Handles user signup by validating input and creating a new account.
+     */
+    @PostMapping("/signup")
+    public void signup(@Valid @RequestBody SignupRequestDTO request) {
+        authService.signup(request);
+    }
+
 }

src/main/java/org/example/alfs/controllers/TestController.java

@@ -0,0 +1,64 @@
+package org.example.alfs.controllers;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+// This controller demonstrates role-based access control using @PreAuthorize.
+// Use this as a reference when implementing real endpoints.
+@RestController
+public class TestController {
+
+    @PreAuthorize("hasAnyRole('ADMIN','INVESTIGATOR','REPORTER')")
+    @GetMapping("/api/test/all-roles")
+    public String allRoles() {
+        return "all roles allowed";
+    }
+
+    @PreAuthorize("hasRole('REPORTER')")
+    @GetMapping("/api/test/create-ticket")
+    public String createTicket() {
+        return "reporter can create ticket";
+    }
+
+
+    @PreAuthorize("hasRole('ADMIN')")
+    @GetMapping("/api/test/assign-ticket")
+    public String assignTicket() {
+        return "admin can assign ticket";
+    }
+
+    @PreAuthorize("hasRole('INVESTIGATOR')")
+    @GetMapping("/api/test/update-status")
+    public String updateStatus() {
+        return "investigator can update status";
+    }
+
+    // need to be signed in - all roles
+    @GetMapping("/api/hello")
+    public String hello() {
+        return "hello secured";
+    }
+
+    // Only ADMIN
+    @PreAuthorize("hasRole('ADMIN')")
+    @GetMapping("/api/admin/test")
+    public String adminOnly() {
+        return "only admin";
+    }
+
+    // Only INVESTIGATOR
+    @PreAuthorize("hasRole('INVESTIGATOR')")
+    @GetMapping("/api/investigator/test")
+    public String investigatorOnly() {
+        return "only investigator";
+    }
+
+    // Only REPORTER
+    @PreAuthorize("hasRole('REPORTER')")
+    @GetMapping("/api/reporter/test")
+    public String reporterOnly() {
+        return "only reporter";
+    }
+
+}

src/main/java/org/example/alfs/dto/auth/LoginResponseDTO.java

@@ -7,6 +7,5 @@
 @AllArgsConstructor
 public class LoginResponseDTO {
 
-    private String username;
-    private String role;
+    private String token;
 }

src/main/java/org/example/alfs/dto/auth/SignupRequestDTO.java

@@ -0,0 +1,18 @@
+package org.example.alfs.dto.auth;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.Getter;
+import lombok.Setter;
+
+
+@Getter
+@Setter
+public class SignupRequestDTO {
+
+    @NotBlank(message = "Username is required")
+    private String username;
+
+    @NotBlank(message = "Password is required")
+    private String password;
+
+}

src/main/java/org/example/alfs/security/JwtAuthenticationFilter.java

@@ -0,0 +1,103 @@
+package org.example.alfs.security;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.example.alfs.entities.User;
+import org.example.alfs.repositories.UserRepository;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.util.List;
+
+@Component
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    private final JwtService jwtService;
+    private final UserRepository userRepository;
+
+    public JwtAuthenticationFilter(JwtService jwtService, UserRepository userRepository) {
+        this.jwtService = jwtService;
+        this.userRepository = userRepository;
+    }
+
+    // Skips filter for LOGIN & H2
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) {
+        String path = request.getRequestURI();
+        return path.startsWith("/auth") || path.startsWith("/h2-console");
+    }
+
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain)
+            throws ServletException, IOException {
+
+        final String authHeader = request.getHeader("Authorization");
+
+        // if no token, keep going
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        String jwt = authHeader.substring(7);
+        String username;
+        try {
+            username = jwtService.extractUsername(jwt);
+        } catch (Exception e) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
+
+            User user = userRepository.findByUsername(username).orElse(null);
+
+            if (user == null) {
+                filterChain.doFilter(request, response);
+                return;
+            }
+
+            // IMPORTANT:
+            // We do NOT trust the role stored in the JWT.
+            // Instead, we always load the user's role from the database.
+            //
+            // This ensures that if a user's role changes (e.g. ADMIN → REPORTER),
+            // the change takes effect immediately, even if the old JWT is still valid.
+            org.springframework.security.core.userdetails.UserDetails userDetails =
+                    new org.springframework.security.core.userdetails.User(
+                            user.getUsername(),
+                            user.getPasswordHash(),
+                            List.of(new SimpleGrantedAuthority("ROLE_" + user.getRole().name()))
+                    );
+
+            boolean valid = jwtService.isTokenValid(jwt, user);
+
+            if (valid) {
+                UsernamePasswordAuthenticationToken authToken =
+                        new UsernamePasswordAuthenticationToken(
+                                userDetails,
+                                null,
+                                userDetails.getAuthorities()
+                        );
+
+                authToken.setDetails(
+                        new org.springframework.security.web.authentication.WebAuthenticationDetailsSource()
+                                .buildDetails(request)
+                );
+
+                SecurityContextHolder.getContext().setAuthentication(authToken);
+            }
+        }
+
+        filterChain.doFilter(request, response);
+    }
+}