passkeys

pom.xml

@@ -138,6 +138,13 @@
             <artifactId>htmx-spring-boot</artifactId>
             <version>5.0.0</version>
         </dependency>
+        <dependency>
+            <groupId>com.webauthn4j</groupId>
+            <artifactId>webauthn4j-core</artifactId>
+            <version>0.30.2.RELEASE</version>
+            <scope>compile</scope>
+        </dependency>
+
     </dependencies>
 
 
@@ -155,4 +162,4 @@
 
 
 
-</project>
+</project>

src/main/java/backendlab/team4you/Team4youApplication.java

@@ -23,17 +23,31 @@ ApplicationRunner init(UserRepository repository, BCryptPasswordEncoder encoder)
 		return args -> {
 			if (repository.count() == 0) {
 
-				UserEntity devUser = new UserEntity(
-						Bytes.fromBase64("01"),
+				UserEntity devAdmin = new UserEntity(
+						Bytes.fromBase64("YWRtaW4="),
 						"dev",           // name (username)
-						"Developer"      // displayName
+						"admin"      // displayName
+				);
+
+				devAdmin.setPasswordHash(encoder.encode("123456"));
+				devAdmin.setRole("ROLE_ADMIN");
+				devAdmin.setEmail("devadmin@gmail.com");
+
+				repository.save(devAdmin);
+				System.out.println("✅ Admin created");
+
+				UserEntity devUser = new UserEntity(
+						Bytes.fromBase64("dXNlcg=="),
+						"user",           // name (username)
+						"user"      // displayName
 				);
 
-				devUser.setPasswordHash(encoder.encode("123456"));
-				devUser.setRole("USER");
-				devUser.setEmail("dev@gmail.com");
+				devUser.setPasswordHash(encoder.encode("1234"));
+				devUser.setRole("ROLE_USER");
+				devUser.setEmail("devuser@gmail.com");
 
 				repository.save(devUser);
+				System.out.println("✅ User created");
 			}
 		};
 	}

src/main/java/backendlab/team4you/config/CustomAuthenticationSuccessHandler.java

@@ -6,7 +6,7 @@
 import org.springframework.context.annotation.Lazy;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
-import org.springframework.security.web.webauthn.management.PublicKeyCredentialUserEntityRepository;
+import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationRequestToken;
 import org.springframework.security.web.webauthn.management.UserCredentialRepository;
 import org.springframework.stereotype.Component;
 
@@ -31,17 +31,26 @@ public void onAuthenticationSuccess(HttpServletRequest request,
                                         ) throws IOException {
 
         String username = authentication.getName();
-
         var userEntity = userService.findByName(username);
 
         if (userEntity != null){
             var credentials = userCredentialRepository.findByUserId(userEntity.getId());
 
             if (!credentials.isEmpty()){
-                getRedirectStrategy().sendRedirect(request, response, "/webauthn-check");
+                getRedirectStrategy().sendRedirect(request, response, "/login/webauthn");
                 return;
             }
         }
-        getRedirectStrategy().sendRedirect(request, response, "/dashboard");
+
+        var authorities = authentication.getAuthorities();
+
+        boolean isAdmin = authorities.stream()
+                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
+
+        if (isAdmin)
+            getRedirectStrategy().sendRedirect(request, response, "/admin");
+        else {
+            getRedirectStrategy().sendRedirect(request, response, "/home");
+        }
     }
 }

src/main/java/backendlab/team4you/config/SecurityConfig.java

@@ -15,7 +15,7 @@
 import backendlab.team4you.user.UserEntity;
 import backendlab.team4you.user.UserService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
-import org.springframework.security.core.userdetails.User;
+import org.springframework.security.config.annotation.web.configurers.WebAuthnConfigurer;
 
 @Configuration
 public class SecurityConfig {
@@ -25,23 +25,20 @@ SecurityFilterChain securityFilterChain(HttpSecurity http,
                                             CustomAuthenticationSuccessHandler successHandler) throws Exception {
 
         return http
-                .csrf(csrf -> csrf.disable())
+                .csrf(csrf -> csrf.ignoringRequestMatchers("/webauthn/**", "/api/files/**"))
                 .authorizeHttpRequests(
                         authorizeHttp -> authorizeHttp
                                 // Public endpoints
                                 .requestMatchers("/css/**", "/js/**", "/images/**").permitAll()
                                 .requestMatchers( "/","/login", "/login/webauthn", "/signup", "/error").permitAll()
-                                .requestMatchers("/webauthn/authenticate/**").permitAll()
-                                .requestMatchers("/api/files/**").permitAll()
 
+                                .requestMatchers("/api/files/**", "/webauthn/authenticate/**").permitAll()
 
-//                                .requestMatchers("/profile", "/logout").authenticated()
-                                .requestMatchers("/webauthn-check").authenticated()
+                                .requestMatchers("/webauthn/**").hasAnyRole("USER", "ADMIN")
 
                                 .requestMatchers("/admin/**").hasRole("ADMIN")
-                                .requestMatchers("/dashboard", "/profile/**").hasAnyRole("USER", "ADMIN")
-                                .requestMatchers("/add-passkey").hasAnyRole("USER", "ADMIN")
-                                .requestMatchers("/webauthn/register/**").hasAnyRole("USER", "ADMIN")
+                                .requestMatchers("/home", "/profile/**").hasRole("USER")
+                                .requestMatchers("/add-passkey", "/webauthn/register/**").hasAnyRole("USER", "ADMIN")
 
                                 .anyRequest().authenticated()
                 )
@@ -52,8 +49,10 @@ SecurityFilterChain securityFilterChain(HttpSecurity http,
                 )
                 .formLogin(form -> form
                         .loginPage("/login")
-                        .successHandler(successHandler))
-
+                        .loginProcessingUrl("/login")
+                        .successHandler(successHandler)
+                        .permitAll()
+                )
                 .logout(logout -> logout.logoutSuccessUrl("/").permitAll())
                 .build();
     }
@@ -79,7 +78,7 @@ public UserDetailsService userDetailsService(UserService userService){
             return User.builder()
                     .username(user.getName())
                     .password(user.getPasswordHash())
-                    .roles(user.getRole())
+                    .authorities(user.getRole())
                     .accountLocked(false)
                     .build();
         };
@@ -89,4 +88,4 @@ public UserDetailsService userDetailsService(UserService userService){
     public BCryptPasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();
     }
-}
+}

src/main/java/backendlab/team4you/controller/AdminController.java

@@ -10,15 +10,11 @@
 import backendlab.team4you.user.UserService;
 import groovy.util.logging.Slf4j;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Sort;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.core.Authentication;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -28,7 +24,6 @@
 import org.springframework.web.server.ResponseStatusException;
 
 import java.util.List;
-import java.util.Scanner;
 
 
 @Slf4j
@@ -174,5 +169,3 @@ public String deleteApplication(@RequestParam Long id, Model model) {
         return "fragments/alert :: success";
     }
 }
-
-

src/main/java/backendlab/team4you/controller/DashboardController.java

@@ -0,0 +1,25 @@
+package backendlab.team4you.controller;
+
+import backendlab.team4you.user.UserService;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+
+@Controller
+public class DashboardController {
+
+    private final UserService userService;
+
+    public DashboardController(UserService userService){
+        this.userService = userService;
+    }
+
+    @GetMapping("/dashboard")
+    public String dashboard(){
+        return "dashboard";
+    }
+
+    @GetMapping("/dashboard/home")
+    public String dashboardHome() {
+        return "dashboard :: content";
+    }
+}

src/main/java/backendlab/team4you/controller/SignupController.java

@@ -3,8 +3,6 @@
 import backendlab.team4you.user.UserEntity;
 import backendlab.team4you.user.UserService;
 
-import backendlab.team4you.user.UserRepository;
-
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -36,13 +34,9 @@ public SignupController(PublicKeyCredentialUserEntityRepository users,
         this.userService = userService;
     }
 
-    @GetMapping("/webauthn-check")
-    public String showWebAuthnCheck(){
-        return "webauthn-check";
-    }
-    @GetMapping("/dashboard")
-    public String dashboard() {
-        return "dashboard";
+    @GetMapping("/login/webauthn")
+    public String webauthnCheck() {
+        return "check";
     }
 
     @GetMapping("/signup")
@@ -64,7 +58,7 @@ public void signup(@RequestBody SignupRequest req, HttpServletRequest request, H
         );
 
         Authentication auth = new UsernamePasswordAuthenticationToken(
-                userEntity.getName(), null, List.of(new SimpleGrantedAuthority("ROLE_" + userEntity.getRole())));
+                userEntity.getName(), null, List.of(new SimpleGrantedAuthority(userEntity.getRole())));
 
         SecurityContext context = SecurityContextHolder.createEmptyContext();
         context.setAuthentication(auth);

src/main/java/backendlab/team4you/controller/UserController.java

@@ -23,20 +23,15 @@ public UserController(UserService userService) {
 
     }
 
-
-
     @GetMapping("/")
     public String homepage(){
         return "home";
     }
 
-
-
-
-
-
-
-
+    @GetMapping("/home")
+    public String userHome() {
+        return "home";
+    }
 
     @DeleteMapping("/account")
     public String deleteAccount(Principal principal) {

src/main/java/backendlab/team4you/user/UserRole.java

@@ -2,7 +2,7 @@
 
 public enum UserRole {
 
-    USER,
-    ADMIN,
+    ROLE_USER,
+    ROLE_ADMIN,
 
 }

src/main/resources/application.properties

@@ -19,4 +19,4 @@ aws.access-key=${AWS_ACCESS_KEY}
 aws.secret-key=${AWS_SECRET_KEY}
 aws.region=${AWS_REGION}
 aws.bucket-name=${AWS_BUCKET_NAME}
-aws.endpoint-url=${AWS_ENDPOINT_URL}
+aws.endpoint-url=${AWS_ENDPOINT_URL}

src/main/resources/static/js/abort-controller.js

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+"use strict";
+
+const holder = {
+    controller: new AbortController(),
+};
+
+/**
+ * Returns a new AbortSignal to be used in the options for the registration and authentication ceremonies.
+ * Aborts the existing AbortController if it exists, cancelling any existing ceremony.
+ *
+ * The authentication ceremony, when triggered with conditional mediation, shows a non-modal
+ * interaction. If the user does not interact with the non-modal dialog, the existing ceremony MUST
+ * be cancelled before initiating a new one, hence the need for a singleton AbortController.
+ *
+ * @returns {AbortSignal} a new, non-aborted AbortSignal
+ */
+function newSignal() {
+    if (!!holder.controller) {
+        holder.controller.abort("Initiating new WebAuthN ceremony, cancelling current ceremony");
+    }
+    holder.controller = new AbortController();
+    return holder.controller.signal;
+}
+
+export default {
+    newSignal,
+};

src/main/resources/static/js/base64url.js

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+"use strict";
+
+export default {
+    encode: function (buffer) {
+        const base64 = window.btoa(String.fromCharCode(...new Uint8Array(buffer)));
+        return base64.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+    },
+    decode: function (base64url) {
+        const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+        const binStr = window.atob(base64);
+        const bin = new Uint8Array(binStr.length);
+        for (let i = 0; i < binStr.length; i++) {
+            bin[i] = binStr.charCodeAt(i);
+        }
+        return bin.buffer;
+    },
+};