passkeys - #32

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/backendlab/team4you/config/CustomAuthenticationSuccessHandler.java`:
- Around line 36-45: Remove the dead isWebAuthn check in
CustomAuthenticationSuccessHandler: the Authentication passed to the
formLogin().successHandler(...) will never be a
WebAuthnAuthenticationRequestToken, so delete the boolean isWebAuthn variable
and the conditional that uses it and simplify the flow that checks userEntity
and credentials; if you actually need to prevent redirect loops for
WebAuthn-authenticated users instead either wire this handler into the
webAuthn(...) configurer (instead of only formLogin().successHandler(...)) or
implement the loop-prevention logic in the WebAuthn success handler rather than
keeping the unreachable isWebAuthn check.

In `@src/main/java/backendlab/team4you/config/SecurityConfig.java`:
- Line 28: The CSRF ignore list in SecurityConfig erroneously disables CSRF for
the form-login endpoint; remove "/login" from the csrf.ignoringRequestMatchers
call so the line only ignores the WebAuthn and files endpoints (e.g., keep
"/webauthn/**" and "/api/files/**" but not "/login"), and if the app’s login
form is missing a CSRF token ensure the login page template injects the _csrf
hidden input (or uses Spring's form tag) so POST /login includes the token.
- Around line 78-83: The signup flow is creating a double-prefixed role string;
in SignupController where authentication is constructed using "ROLE_" +
userEntity.getRole(), remove the extra "ROLE_" prefix and use
userEntity.getRole() directly so it matches SecurityConfig's
User.builder().authorities(user.getRole()) and the seeded roles (e.g.,
ROLE_USER/ROLE_ADMIN); update the authentication creation to pass the existing
role string and ensure any related checks expect the single-prefixed format.
- Around line 33-41: SecurityConfig has inconsistent requestMatcher paths and
role checks: align the "/login/webauthn" matcher with the SignupController
mapping and success handler by permitting "/login/webauthn/" (include the
trailing slash) or add both "/login/webauthn" and "/login/webauthn/"; change the
"/home" matcher from hasRole("USER") to hasAnyRole("USER","ADMIN") if admins
should access /home (adjust in SecurityConfig where
requestMatchers("/home").hasRole("USER") is declared) ; and remove the unused
permitAll matcher for "/webauthn/login/**" (or replace it with the correct
WebAuthn endpoints like "/webauthn/authenticate/**" if needed) so
SecurityConfig, SignupController, and CustomAuthenticationSuccessHandler paths
are consistent.

In `@src/main/java/backendlab/team4you/controller/SignupController.java`:
- Around line 37-39: The controller mapping in SignupController.webauthnCheck
currently only uses "/login/webauthn/" which mismatches SecurityConfig and other
code that use "/login/webauthn"; update the mapping to consistently accept both
variants (e.g. replace `@GetMapping`("/login/webauthn/") with
`@GetMapping`({"/login/webauthn", "/login/webauthn/"}) on webauthnCheck), and
normalize any redirects in CustomAuthenticationSuccessHandler and client-side
HTML/JS to use the same canonical path (preferably "/login/webauthn") so
SecurityConfig rules apply consistently.

In `@src/main/java/backendlab/team4you/Team4youApplication.java`:
- Around line 24-50: The seeding currently runs only when repository.count() ==
0 so existing DBs won't get the new admin; change Team4youApplication to check
and create each account idempotently by calling repository.findByName("dev") and
repository.findByName("user") (or equivalent find method) and only
constructing/saving the corresponding UserEntity (devAdmin / devUser) when the
find returns empty; reuse encoder.encode(...) and repository.save(...) as in the
diff, and keep role/email/password setup identical but guarded per-account
instead of a single repository.count() gate.

In `@src/main/java/backendlab/team4you/user/UserRole.java`:
- Around line 5-6: Add a Flyway SQL migration that backfills old enum names to
the new ones before deploying the enum rename: create a new migration (e.g.,
Vx__backfill_user_roles.sql) containing the two updates "UPDATE user_entities
SET role = 'ROLE_USER' WHERE role = 'USER';" and "UPDATE user_entities SET role
= 'ROLE_ADMIN' WHERE role = 'ADMIN';" and ensure it runs prior to the code
deploy; also review UserRole and UserEntity.setRole(String role) to ensure they
rely on the migrated values (or add a temporary tolerant mapping from
'USER'/'ADMIN' to 'ROLE_USER'/'ROLE_ADMIN' inside setRole to avoid valueOf()
failures until the migration is applied).

In `@src/main/resources/static/js/base64url.js`:
- Around line 20-22: The encode function uses String.fromCharCode(...new
Uint8Array(buffer)) which can hit argument count limits for large buffers;
replace the spread usage with a chunked conversion: create a Uint8Array bytes =
new Uint8Array(buffer), iterate in slices (e.g. step = 0x8000), build a string
by concatenating String.fromCharCode.apply(null, bytes.subarray(i, i+step)) or
using String.fromCharCode(...slice) per chunk, then call window.btoa on the
assembled string and keep the existing replace chain to produce base64url;
update the encode function (and the local base64 variable/window.btoa call) to
use this chunking approach.

In `@src/main/resources/templates/check.html`:
- Around line 50-57: The code discards the server-provided post-auth redirect by
hardcoding window.location.href = "/", so change the await call to capture the
resolved value from webauthn.authenticate (e.g., const authenticationResponse =
await webauthn.authenticate(...)) and then set window.location.href to
authenticationResponse.redirectUrl when present, falling back to "/" only if
redirectUrl is missing; keep the existing catch block unchanged for error
handling.

In `@src/main/resources/templates/fragments/admin-sidenav.html`:
- Line 40: The anchor element using a hardcoded href (the <a ...
href="/webauthn/register" ...> in the admin-sidenav fragment) should be changed
to use Thymeleaf URL generation: replace the static href attribute with a
th:href that generates the URL with the application's context path (e.g.
th:href="@{/webauthn/register}") so navigation works correctly under different
context-path deployments and consistent with other links in this fragment.

In `@src/main/resources/templates/login.html`:
- Line 17: fragments/form-errors.html currently defines th:fragment="errors"
twice which causes unpredictable resolution in login.html; edit
fragments/form-errors.html to remove the duplicate and consolidate into a single
th:fragment="errors" that renders the same markup for both cases by checking
both ${param.error} and ${error} (e.g., use a combined conditional that prefers
${param.error} but falls back to ${error} and displays the message), leaving
login.html's th:replace="~{fragments/form-errors :: errors}" unchanged so it
resolves deterministically.

In `@src/main/resources/templates/profile.html`:
- Line 25: The anchor uses a hard-coded href (href="/webauthn/register") which
ignores the app context path; replace it with Thymeleaf URL rewriting by
changing the attribute to th:href with a context-aware expression (e.g.,
@{/webauthn/register}) on the same anchor element so the passkey link resolves
correctly when the app is deployed under a context path; keep existing
class/style attributes and remove or replace the static href attribute on the
<a> element in profile.html.

---

Outside diff comments:
In `@src/main/java/backendlab/team4you/controller/SignupController.java`:
- Around line 60-61: The Authentication creation in SignupController is adding
an extra "ROLE_" prefix to roles, causing values like "ROLE_ROLE_USER"; remove
the manual prefix so the authority uses the exact role string returned by
userEntity.getRole() when constructing the SimpleGrantedAuthority for the
UsernamePasswordAuthenticationToken (update the Authentication auth = new
UsernamePasswordAuthenticationToken(...) call to pass List.of(new
SimpleGrantedAuthority(userEntity.getRole())) instead of "ROLE_" +
userEntity.getRole()).

---

Nitpick comments:
In `@pom.xml`:
- Around line 141-146: The pom declares an explicit dependency
com.webauthn4j:webauthn4j-core:0.30.2.RELEASE which downgrades the transitive
version brought in by spring-security-webauthn (7.0.4); remove this explicit
dependency from the POM unless application code directly uses WebAuthn4J APIs,
or if you must keep it, update the version to match the transitive 0.31.x and
add a short comment justifying the pin. Locate the dependency block for
com.webauthn4j:webauthn4j-core in the POM, delete it (or change its <version> to
the transitive version and add justification), then run mvn dependency:tree to
confirm the intended version is used.

In
`@src/main/java/backendlab/team4you/config/CustomAuthenticationSuccessHandler.java`:
- Around line 47-56: Replace the manual stream-based role check with Spring's
AuthorityUtils for clarity: import
org.springframework.security.core.authority.AuthorityUtils and compute isAdmin
by converting the authentication authorities to a Set via
AuthorityUtils.authorityListToSet(authentication.getAuthorities()) and checking
contains("ROLE_ADMIN"); keep the existing
getRedirectStrategy().sendRedirect(request, response, "/admin") and the else
branch to "/home" unchanged (ensure this method is used inside
onAuthenticationSuccess in CustomAuthenticationSuccessHandler).

In `@src/main/resources/static/js/webauthn-core.js`:
- Line 100: There is a stray commented-out conditional "//   if
(authenticationResponse && authenticationResponse.authenticated) {" left inside
the try block in webauthn-core.js; remove this dead comment (or, if you need to
keep a note, move it outside the try block as a regular comment) so the try
block only contains active logic and relevant comments referencing
authenticationResponse.
- Line 43: Replace the manual base64url decoding logic for challenge and
credential descriptors by calling the native parsers: use
PublicKeyCredential.parseRequestOptionsFromJSON() where you currently decode
allowCredentials/excludeCredentials and challenge (refer to the variables
allowCredentials, excludeCredentials, challenge and the code paths handling
navigator.credentials.get) and use
PublicKeyCredential.parseCreationOptionsFromJSON() where you decode creation
options for registration (refer to the registration/creation code path and any
createCredentials handling); additionally, before accessing
response.attestationObject in the registration flow, validate that response
instanceof AuthenticatorAttestationResponse and handle the error case if it is
not to avoid wrong-response type crashes. Ensure you replace the manual
base64url-to-ArrayBuffer conversions with the parse*FromJSON calls and add the
instanceof check and clear error handling around response.attestationObject
access.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/main/java/backendlab/team4you/controller/SignupController.java`:
- Around line 37-39: The dashboard routes referenced by the template are
missing; add controller mappings in SignupController (or a new
DashboardController) for `@GetMapping`("/dashboard") and
`@GetMapping`("/dashboard/home") that return the dashboard view names (or redirect
to an existing template), so the template's @{/dashboard} and
hx-get="/dashboard/home" resolve; alternatively, update the template navigation
to point to existing endpoints if you prefer not to restore these routes—locate
SignupController and either restore/create methods named e.g. dashboard() and
dashboardHome() to fix the broken links.