Phase 2: Externalize datasource secrets + remove debug output - #48

Summary

Phase 2 of the modernization plan: remove committed credentials and debug noise. Version-independent, low-risk changes. Stacked on top of the Phase 1 PR (#47) so the integration-test safety net verifies behavior is unchanged (21 tests still green).

Base branch is the Phase 1 branch, not master. Once #47 merges, this retargets cleanly to master.

Secrets externalized (application.properties)

-spring.datasource.username = root
-spring.datasource.password = avengers1993
+spring.datasource.url = ${DB_URL:jdbc:mysql://localhost:3306/onlinebanking}
+spring.datasource.username = ${DB_USERNAME}
+spring.datasource.password = ${DB_PASSWORD}

Required env vars (DB_USERNAME, DB_PASSWORD, optional DB_URL) are documented in the README. The previously committed password must be treated as compromised and rotated on the DB server — flagged in the README (this repo has no infra I can rotate directly).

Credential/debug leaks removed

• User.toString() no longer includes the password field (it would otherwise leak the (encoded) password into any log line that prints a User).
• UserServiceImpl.disableUser: dropped two System.out.println calls; the disable action is now a single LOG.info.
• RequestFilter: e.printStackTrace() → LOG.error(...), and the System.out.println("Pre-flight") → LOG.debug(...). (This filter is retired entirely in Phase 6.)

Verification

mvn clean test → 21 tests, 0 failures. Tests are unaffected because the test profile supplies its own H2 datasource properties, which shadow the main application.properties.

Link to Devin session: https://app.devin.ai/sessions/82be2e41fda54343a20a9b73e01c0631
Requested by: @gaelkekatos-jpg

Devin Review

Run Devin Review