Phase 5 + 6: Spring Boot 1.5 → 3.3 / Java 17 / Jakarta + Spring Security 6 rewrite

[devin-ai-integration]

Summary

Incremental backend framework upgrade (stacked on the Phase 4 PR #50). Done in two verified hops, each with all 37 integration tests green, then the Spring Security 6 rewrite (Phase 6) folded into the 3.x step per the plan.

Phase 5a — Spring Boot 1.5.4 → 2.7.18 (still Java 8, javax.*)

• spring-boot-starter-parent → 2.7.18.
• MySQL driver coords mysql:mysql-connector-java → com.mysql:mysql-connector-j.
• CrudRepository.findOne(id) (removed) → findById(id).orElse(null).
• Extract BCryptPasswordEncoder into PasswordEncoderConfig — SecurityConfig both defined and consumed it, which is a self-referential bean cycle now that Boot 2.6+ prohibits circular references.
• spring.main.allow-circular-references=true for the genuine mutual UserService↔AccountService↔TransactionService dependencies (documented; refactoring the service graph is out of scope for a safety-net upgrade).
• Add junit-vintage-engine so the JUnit 4 safety-net suite runs on the JUnit 5 platform.
• H2 test URL NON_KEYWORDS=USER (H2 2.x now reserves USER, and the User entity maps to table user).

Phase 5b — Spring Boot 2.7.18 → 3.3.5, Java 17, Jakarta

• Parent → 3.3.5, java.version → 17; CI backend job → JDK 17.
• Migrate every javax.persistence / javax.servlet import to jakarta.* across the 9 domain classes.
• Hibernate 6 removed MySQL5Dialect → MySQLDialect.

Phase 6 — Spring Security 6 rewrite

-public class SecurityConfig extends WebSecurityConfigurerAdapter {
-  @Override protected void configure(HttpSecurity http) { http.csrf().disable().cors().disable()... }
-  @Autowired void configureGlobal(AuthenticationManagerBuilder auth) {...}
+public class SecurityConfig {
+  @Bean DaoAuthenticationProvider authenticationProvider() {...}
+  @Bean SecurityFilterChain filterChain(HttpSecurity http) {...}
+  @Bean CorsConfigurationSource corsConfigurationSource() {...}

• @EnableGlobalMethodSecurity → @EnableMethodSecurity.
• CSRF enabled (was .csrf().disable()). Server-rendered Thymeleaf forms get the token automatically via th:action; the cross-origin /api/** SPA namespace is exempted (ignoringRequestMatchers) and relies on the CORS allowlist + authenticated session.
• CORS via Spring Security with an explicit http://localhost:4200 allowlist (methods/headers/credentials mirror the old filter), and the hand-rolled RequestFilter is removed.
• Fixed the invalid /error/**/* matcher (Spring 6 PathPattern requires ** to be terminal) → /error/**.

Follow-ups / coordination

• Existing password hashes were made with the (now-removed) fixed BCrypt salt (Phase 4) and won't verify — reset/re-seed users.
• The Angular AdminPortal must send the CSRF token and adapt to the retired filter's behavior; that's Phase 7 frontend work. Its /index login and full SPA CSRF integration are deferred there.

Verified: mvn clean test on JDK 17 → 37 tests, 0 failures; Spring context loads with the new security config.

Link to Devin session: https://app.devin.ai/sessions/82be2e41fda54343a20a9b73e01c0631
Requested by: @gaelkekatos-jpg

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring