feat(auth): registration, JWT login and logout, password reset

README.md

@@ -334,15 +334,15 @@ No other naming style (`shouldX()`, `testX()`, `givenX_whenY_thenZ()`) is used a
 
 ### Tasks
 
-- [ ] `core/auth`: `User`, `ActivationToken`, `BlacklistedToken`, `PasswordResetToken` **entity** classes (`entity/`, `@Table("users")`/`@Table("activation_tokens")`/etc., `@Id`/`@Column` on fields, plain Java otherwise) and their matching `UserDto`, `ActivationTokenDto`, `BlacklistedTokenDto`, `PasswordResetTokenDto` classes (`dto/`)
-- [ ] `UserRowMapper`, `ActivationTokenRowMapper`, `BlacklistedTokenRowMapper`, `PasswordResetTokenRowMapper` (`ResultSet` → entity), and `UserMapper` (entity ↔ dto, the only one of these four actually needed yet - the token entities/dtos are used directly by `AuthServiceImpl` without a full bidirectional mapper, since nothing outside the service ever needs a token dto's shape beyond what `AuthController` reads directly off `AuthService`'s own return types)
-- [ ] `UserDao` + `UserDaoImpl` (and the token DAOs), all `JdbcTemplate`-based, all unannotated, all working in `entity/` types
-- [ ] `AuthService` (interface) + `AuthServiceImpl`: registration, activation, login (password hashing/verification via `org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder`, used standalone), logout, forgot/reset password - every public method takes/returns `dto/` types, converting to/from `entity/` via `UserMapper` around each `UserDao` call
-- [ ] `forgotPassword` returns the exact same outcome - same behavior, roughly the same timing - whether or not the submitted email matches an existing account, so the endpoint can't be used to enumerate registered emails
-- [ ] `core/auth`'s `DaoConfig`/`ServiceConfig`
-- [ ] `ws`: `JwtService` (issuance/validation via `jjwt`, unique `jti` per token), `JwtAuthFilter`, `AuthController`, `UserConverter` (`core.auth.dto.UserDto` ↔ `ws.payload.auth.*`)
-- [ ] `WebMvcConfig` updated to import `core/auth`'s `DaoConfig`/`ServiceConfig`
-- [ ] Tests at all five layers (see [Testing strategy](#testing-strategy)): `UserDao`/token DAOs against Testcontainers with their own fixture files, each `RowMapper` against a mocked `ResultSet`, `UserMapper` against a hand-built entity/dto pair (pure unit test, no mocks needed), `AuthServiceImpl` with `UserDao` mocked, `AuthController` via `MockMvc` with `AuthService` mocked - plus one full register → activate → login → `/me` flow
+- [x] `core/auth`: `User`, `ActivationToken`, `BlacklistedToken`, `PasswordResetToken` **entity** classes (`entity/`, `@Table("users")`/`@Table("activation_tokens")`/etc., `@Id`/`@Column` on fields, plain Java otherwise) and their matching `UserDto`, `ActivationTokenDto`, `BlacklistedTokenDto`, `PasswordResetTokenDto` classes (`dto/`)
+- [x] `UserRowMapper`, `ActivationTokenRowMapper`, `BlacklistedTokenRowMapper`, `PasswordResetTokenRowMapper` (`ResultSet` → entity), and `UserMapper` (entity ↔ dto, the only one of these four actually needed yet - the token entities/dtos are used directly by `AuthServiceImpl` without a full bidirectional mapper, since nothing outside the service ever needs a token dto's shape beyond what `AuthController` reads directly off `AuthService`'s own return types)
+- [x] `UserDao` + `UserDaoImpl` (and the token DAOs), all `JdbcTemplate`-based, all unannotated, all working in `entity/` types
+- [x] `AuthService` (interface) + `AuthServiceImpl`: registration, activation, login (password hashing/verification via `org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder`, used standalone), logout, forgot/reset password - every public method takes/returns `dto/` types, converting to/from `entity/` via `UserMapper` around each `UserDao` call
+- [x] `forgotPassword` returns the exact same outcome - same behavior, roughly the same timing - whether or not the submitted email matches an existing account, so the endpoint can't be used to enumerate registered emails
+- [x] `core/auth`'s `DaoConfig`/`ServiceConfig`
+- [x] `ws`: `JwtService` (issuance/validation via `jjwt`, unique `jti` per token), `JwtAuthFilter`, `AuthController`, `UserConverter` (`core.auth.dto.UserDto` ↔ `ws.payload.auth.*`)
+- [x] `WebMvcConfig` updated to import `core/auth`'s `DaoConfig`/`ServiceConfig`
+- [x] Tests at all five layers (see [Testing strategy](#testing-strategy)): `UserDao`/token DAOs against Testcontainers with their own fixture files, each `RowMapper` against a mocked `ResultSet`, `UserMapper` against a hand-built entity/dto pair (pure unit test, no mocks needed), `AuthServiceImpl` with `UserDao` mocked, `AuthController` via `MockMvc` with `AuthService` mocked - plus one full register → activate → login → `/me` flow
 
 ## feature/rbac
 

core/auth/pom.xml

@@ -19,5 +19,28 @@
             <groupId>com.edgareldy.springjdbctutorial</groupId>
             <artifactId>common</artifactId>
         </dependency>
+        <!-- BCryptPasswordEncoder / PasswordEncoder only, without the rest of Spring Security -->
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-crypto</artifactId>
+        </dependency>
+
+        <!-- Test scope only: the DAO tests reuse the PostgreSQL Testcontainer support published by common -->
+        <dependency>
+            <groupId>com.edgareldy.springjdbctutorial</groupId>
+            <artifactId>common</artifactId>
+            <type>test-jar</type>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>postgresql</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 </project>

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/config/DaoConfig.java

@@ -0,0 +1,45 @@
+package com.edgareldy.springjdbctutorial.core.auth.config;
+
+import com.edgareldy.springjdbctutorial.core.auth.dao.ActivationTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.BlacklistedTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.PasswordResetTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.UserDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.impl.ActivationTokenDaoImpl;
+import com.edgareldy.springjdbctutorial.core.auth.dao.impl.BlacklistedTokenDaoImpl;
+import com.edgareldy.springjdbctutorial.core.auth.dao.impl.PasswordResetTokenDaoImpl;
+import com.edgareldy.springjdbctutorial.core.auth.dao.impl.UserDaoImpl;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+/**
+ * Declares the DAO beans of the auth module, typed by interface (no stereotype on the implementations).
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+@Configuration
+public class DaoConfig {
+
+    @Bean
+    public UserDao userDao(JdbcTemplate jdbcTemplate) {
+        return new UserDaoImpl(jdbcTemplate);
+    }
+
+    @Bean
+    public ActivationTokenDao activationTokenDao(JdbcTemplate jdbcTemplate) {
+        return new ActivationTokenDaoImpl(jdbcTemplate);
+    }
+
+    @Bean
+    public PasswordResetTokenDao passwordResetTokenDao(JdbcTemplate jdbcTemplate) {
+        return new PasswordResetTokenDaoImpl(jdbcTemplate);
+    }
+
+    @Bean
+    public BlacklistedTokenDao blacklistedTokenDao(JdbcTemplate jdbcTemplate) {
+        return new BlacklistedTokenDaoImpl(jdbcTemplate);
+    }
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/config/ServiceConfig.java

@@ -0,0 +1,57 @@
+package com.edgareldy.springjdbctutorial.core.auth.config;
+
+import com.edgareldy.springjdbctutorial.core.auth.dao.ActivationTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.BlacklistedTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.PasswordResetTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.dao.UserDao;
+import com.edgareldy.springjdbctutorial.core.auth.service.AuthService;
+import com.edgareldy.springjdbctutorial.core.auth.service.impl.AuthServiceImpl;
+import com.edgareldy.springjdbctutorial.core.auth.service.impl.ExpiredTokenCleanupJob;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+import java.time.Clock;
+
+/**
+ * Declares the service beans of the auth module. Imports its DaoConfig so importing this class alone
+ * is enough. The Clock bean comes from CommonConfig, the JdbcTemplate from DataSourceConfig.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+@Configuration
+// @EnableScheduling registers the post-processor that finds @Scheduled methods on beans and runs them
+@EnableScheduling
+@Import(DaoConfig.class)
+public class ServiceConfig {
+
+    // PasswordEncoder is Spring Security's abstraction for one-way password hashing. BCrypt is adaptive
+    // (tunable cost) and salted per hash, so equal passwords give different hashes and brute force is
+    // slow. Only the spring-security-crypto artifact is needed, not the whole security stack.
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    // Returned as the AuthService interface: Spring wraps the bean in a JDK dynamic proxy that applies
+    // the @Transactional advice, which only works when callers go through the interface.
+    @Bean
+    public AuthService authService(UserDao userDao, ActivationTokenDao activationTokenDao,
+                                   PasswordResetTokenDao passwordResetTokenDao,
+                                   BlacklistedTokenDao blacklistedTokenDao, PasswordEncoder passwordEncoder,
+                                   Clock clock) {
+        return new AuthServiceImpl(userDao, activationTokenDao, passwordResetTokenDao, blacklistedTokenDao,
+                passwordEncoder, clock);
+    }
+
+    @Bean
+    public ExpiredTokenCleanupJob expiredTokenCleanupJob(AuthService authService) {
+        return new ExpiredTokenCleanupJob(authService);
+    }
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/ActivationTokenDao.java

@@ -0,0 +1,25 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao;
+
+import com.edgareldy.springjdbctutorial.core.auth.entity.ActivationToken;
+
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * Data access for activation tokens (stored as SHA-256 hash). Entity types only.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public interface ActivationTokenDao {
+
+    ActivationToken insert(ActivationToken token);
+
+    Optional<ActivationToken> findByTokenHash(String tokenHash);
+
+    void markValidated(Long id, Instant validatedAt);
+
+    void deleteByUserId(Long userId);
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/BlacklistedTokenDao.java

@@ -0,0 +1,23 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao;
+
+import com.edgareldy.springjdbctutorial.core.auth.entity.BlacklistedToken;
+
+import java.time.Instant;
+
+/**
+ * Data access for revoked JWTs (stored as SHA-256 hash). Entity types only.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public interface BlacklistedTokenDao {
+
+    BlacklistedToken insert(BlacklistedToken token);
+
+    boolean existsByTokenHash(String tokenHash);
+
+    /** Deletes the rows whose expires_at is strictly before the given instant and returns how many. */
+    int deleteExpiredBefore(Instant instant);
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/PasswordResetTokenDao.java

@@ -0,0 +1,22 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao;
+
+import com.edgareldy.springjdbctutorial.core.auth.entity.PasswordResetToken;
+
+import java.util.Optional;
+
+/**
+ * Data access for password reset tokens (stored as SHA-256 hash). Entity types only.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public interface PasswordResetTokenDao {
+
+    PasswordResetToken insert(PasswordResetToken token);
+
+    Optional<PasswordResetToken> findByTokenHash(String tokenHash);
+
+    void deleteByUserId(Long userId);
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/UserDao.java

@@ -0,0 +1,37 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao;
+
+import com.edgareldy.springjdbctutorial.core.auth.entity.User;
+
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Data access for users and for the read-only role/permission lookups of a user. Entity types only.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public interface UserDao {
+
+    Optional<User> findById(Long id);
+
+    /** Case-insensitive lookup. */
+    Optional<User> findByEmail(String email);
+
+    boolean existsByEmail(String email);
+
+    /** Inserts the user and returns it with its generated id. */
+    User insert(User user);
+
+    void updatePassword(Long userId, String passwordHash);
+
+    void updateEnabled(Long userId, boolean enabled);
+
+    /** Names of the roles assigned to the user, sorted. */
+    List<String> findRoleNamesByUserId(Long userId);
+
+    /** Distinct "RESOURCE:ACTION" codes granted through the user's roles, sorted. */
+    List<String> findPermissionCodesByUserId(Long userId);
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/impl/ActivationTokenDaoImpl.java

@@ -0,0 +1,60 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao.impl;
+
+import com.edgareldy.springjdbctutorial.core.auth.dao.ActivationTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.entity.ActivationToken;
+import com.edgareldy.springjdbctutorial.core.auth.mapper.ActivationTokenRowMapper;
+import com.edgareldy.springjdbctutorial.core.common.dao.support.AbstractDao;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+import java.sql.Timestamp;
+import java.time.Instant;
+import java.util.Optional;
+
+/**
+ * JdbcTemplate implementation of ActivationTokenDao. Declared by @Bean in DaoConfig, no stereotype.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public class ActivationTokenDaoImpl extends AbstractDao implements ActivationTokenDao {
+
+    private final ActivationTokenRowMapper rowMapper = new ActivationTokenRowMapper();
+
+    public ActivationTokenDaoImpl(JdbcTemplate jdbcTemplate) {
+        super(jdbcTemplate);
+    }
+
+    @Override
+    public ActivationToken insert(ActivationToken token) {
+        long id = insertReturningId(
+                "INSERT INTO activation_tokens (user_id, token, created_at, expires_at, validated_at) "
+                        + "VALUES (?, ?, ?, ?, ?) RETURNING id",
+                token.getUserId(), token.getToken(), toTimestamp(token.getCreatedAt()),
+                toTimestamp(token.getExpiresAt()), toTimestamp(token.getValidatedAt()));
+        token.setId(id);
+        return token;
+    }
+
+    @Override
+    public Optional<ActivationToken> findByTokenHash(String tokenHash) {
+        return findOne("SELECT id, user_id, token, created_at, expires_at, validated_at "
+                + "FROM activation_tokens WHERE token = ?", rowMapper, tokenHash);
+    }
+
+    @Override
+    public void markValidated(Long id, Instant validatedAt) {
+        getJdbcTemplate().update("UPDATE activation_tokens SET validated_at = ? WHERE id = ?",
+                toTimestamp(validatedAt), id);
+    }
+
+    @Override
+    public void deleteByUserId(Long userId) {
+        getJdbcTemplate().update("DELETE FROM activation_tokens WHERE user_id = ?", userId);
+    }
+
+    private static Timestamp toTimestamp(Instant instant) {
+        return instant == null ? null : Timestamp.from(instant);
+    }
+}

core/auth/src/main/java/com/edgareldy/springjdbctutorial/core/auth/dao/impl/BlacklistedTokenDaoImpl.java

@@ -0,0 +1,52 @@
+package com.edgareldy.springjdbctutorial.core.auth.dao.impl;
+
+import com.edgareldy.springjdbctutorial.core.auth.dao.BlacklistedTokenDao;
+import com.edgareldy.springjdbctutorial.core.auth.entity.BlacklistedToken;
+import com.edgareldy.springjdbctutorial.core.common.dao.support.AbstractDao;
+import org.springframework.jdbc.core.JdbcTemplate;
+
+import java.sql.Timestamp;
+import java.time.Instant;
+
+/**
+ * JdbcTemplate implementation of BlacklistedTokenDao. Declared by @Bean in DaoConfig, no stereotype.
+ * Uses no RowMapper: the blacklist is only ever probed for existence, inserted or purged.
+ * <p>
+ * Created edgar.muhamyangabo on 9/19/26
+ * Author : edgar.muhamyangabo
+ * Date : 9/19/26
+ * Project : spring-jdbc-tutorial
+ */
+public class BlacklistedTokenDaoImpl extends AbstractDao implements BlacklistedTokenDao {
+
+    public BlacklistedTokenDaoImpl(JdbcTemplate jdbcTemplate) {
+        super(jdbcTemplate);
+    }
+
+    @Override
+    public BlacklistedToken insert(BlacklistedToken token) {
+        long id = insertReturningId(
+                "INSERT INTO blacklisted_tokens (user_id, token, jti, blacklisted_at, created_at, expires_at, "
+                        + "validated_at) VALUES (?, ?, ?, ?, ?, ?, ?) RETURNING id",
+                token.getUserId(), token.getToken(), token.getJti(), toTimestamp(token.getBlacklistedAt()),
+                toTimestamp(token.getCreatedAt()), toTimestamp(token.getExpiresAt()),
+                toTimestamp(token.getValidatedAt()));
+        token.setId(id);
+        return token;
+    }
+
+    @Override
+    public boolean existsByTokenHash(String tokenHash) {
+        return count("SELECT COUNT(*) FROM blacklisted_tokens WHERE token = ?", tokenHash) > 0;
+    }
+
+    @Override
+    public int deleteExpiredBefore(Instant instant) {
+        return getJdbcTemplate().update("DELETE FROM blacklisted_tokens WHERE expires_at < ?",
+                Timestamp.from(instant));
+    }
+
+    private static Timestamp toTimestamp(Instant instant) {
+        return instant == null ? null : Timestamp.from(instant);
+    }
+}