Phase 1A: Identity & Access — carddemo-auth Spring Boot module

.gitignore

@@ -6,3 +6,4 @@ batch-app/markers/*
 /.idea/
 .DS_Store
 **/.DS_Store
+**/target/

services/carddemo-auth/README.md

@@ -0,0 +1,86 @@
+# CardDemo Auth Service
+
+Identity & Access Management microservice for the CardDemo system, migrated from legacy COBOL programs to Spring Boot 3.x.
+
+## Legacy COBOL Mapping
+
+| COBOL Program | Function | Java Equivalent |
+|---|---|---|
+| `COSGN00C` | User sign-on (authentication) | `POST /auth/login` — validates credentials, returns JWT |
+| `COUSR00C` | List users | `GET /users` — returns all users (admin) or own profile (user) |
+| `COUSR01C` | Add user | `POST /users` — creates a new user (admin only) |
+| `COUSR02C` | Update user | `PUT /users/{id}` — updates user fields |
+| `COUSR03C` | Delete user | `DELETE /users/{id}` — removes a user (admin only) |
+
+### Data Model Mapping (Copybook `CSUSR01Y`)
+
+| COBOL Field | PIC | Java Field | Type | Notes |
+|---|---|---|---|---|
+| `SEC-USR-ID` | `X(08)` | `userId` | `String(8)` | Primary key |
+| `SEC-USR-FNAME` | `X(20)` | `firstName` | `String(20)` | |
+| `SEC-USR-LNAME` | `X(20)` | `lastName` | `String(20)` | |
+| `SEC-USR-PWD` | `X(08)` | `password` | `String` | BCrypt hash (replaces plaintext COBOL storage) |
+| `SEC-USR-TYPE` | `X(01)` | `userType` | `Enum(ADMIN,USER)` | 'A' → ADMIN, 'U' → USER |
+| `SEC-USR-FILLER` | `X(23)` | — | — | Not migrated (padding) |
+
+## Architecture
+
+- **Framework**: Spring Boot 3.2.x
+- **Security**: Spring Security + JWT (stateless)
+- **Persistence**: Spring Data JPA with PostgreSQL (H2 for tests)
+- **Password Storage**: BCrypt (replacing COBOL plaintext `PIC X(08)`)
+
+## API Endpoints
+
+### Authentication
+```
+POST /auth/login
+Body: { "userId": "ADMIN01", "password": "secret" }
+Response: { "token": "eyJ...", "userId": "ADMIN01", "userType": "ADMIN" }
+```
+
+### User Management (requires Bearer token)
+```
+GET    /users          — List users (admin: all, user: own profile only)
+POST   /users          — Create user (admin only)
+PUT    /users/{id}     — Update user (admin: any, user: own profile only)
+DELETE /users/{id}     — Delete user (admin only)
+```
+
+## Role-Based Access Control
+
+| Role | GET /users | POST /users | PUT /users/{id} | DELETE /users/{id} |
+|---|---|---|---|---|
+| ADMIN | All users | Yes | Any user | Yes |
+| USER | Own profile only | No | Own profile only (cannot change role) | No |
+
+## Running Locally
+
+### Prerequisites
+- Java 17+
+- Maven 3.8+
+- PostgreSQL 14+ (or use the H2 test profile)
+
+### Build & Test
+```bash
+cd services/carddemo-auth
+mvn clean package
+```
+
+### Run
+```bash
+# Set environment variables for PostgreSQL connection
+export DB_USERNAME=carddemo
+export DB_PASSWORD=carddemo
+export JWT_SECRET=your-256-bit-secret-key-here
+
+mvn spring-boot:run
+```
+
+## Security Improvements Over Legacy
+
+1. **Password Hashing**: BCrypt replaces plaintext COBOL `PIC X(08)` passwords
+2. **Stateless Auth**: JWT tokens replace CICS session-based security
+3. **Role Enforcement**: Programmatic RBAC replaces RACF group checks
+4. **Input Validation**: Bean Validation replaces manual COBOL field checks
+5. **Audit-Ready**: Structured JSON responses replace BMS screen output

services/carddemo-auth/pom.xml

@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>3.2.5</version>
+        <relativePath/>
+    </parent>
+
+    <groupId>com.cardemo</groupId>
+    <artifactId>carddemo-auth</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <name>CardDemo Auth Service</name>
+    <description>Identity and Access Management service for CardDemo - migrated from COBOL COSGN00C/COUSR* programs</description>
+
+    <properties>
+        <java.version>17</java.version>
+        <jjwt.version>0.12.5</jjwt.version>
+    </properties>
+
+    <dependencies>
+        <!-- Spring Boot Starters -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-jpa</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-validation</artifactId>
+        </dependency>
+
+        <!-- JWT -->
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+            <version>${jjwt.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+            <version>${jjwt.version}</version>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+            <version>${jjwt.version}</version>
+            <scope>runtime</scope>
+        </dependency>
+
+        <!-- PostgreSQL Driver -->
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+
+        <!-- H2 for testing -->
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <scope>test</scope>
+        </dependency>
+
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+        </plugins>
+    </build>
+</project>

services/carddemo-auth/src/main/java/com/cardemo/auth/CardDemoAuthApplication.java

@@ -0,0 +1,12 @@
+package com.cardemo.auth;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class CardDemoAuthApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(CardDemoAuthApplication.class, args);
+    }
+}

services/carddemo-auth/src/main/java/com/cardemo/auth/config/SecurityConfig.java

@@ -0,0 +1,50 @@
+package com.cardemo.auth.config;
+
+import com.cardemo.auth.security.JwtAuthenticationFilter;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+public class SecurityConfig {
+
+    private final JwtAuthenticationFilter jwtAuthenticationFilter;
+
+    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter) {
+        this.jwtAuthenticationFilter = jwtAuthenticationFilter;
+    }
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        http
+                .csrf(csrf -> csrf.disable())
+                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .exceptionHandling(ex -> ex
+                        .authenticationEntryPoint((request, response, authException) ->
+                                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"))
+                )
+                .authorizeHttpRequests(auth -> auth
+                        .requestMatchers(HttpMethod.POST, "/auth/login").permitAll()
+                        .anyRequest().authenticated()
+                )
+                .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}

services/carddemo-auth/src/main/java/com/cardemo/auth/controller/AuthController.java

@@ -0,0 +1,28 @@
+package com.cardemo.auth.controller;
+
+import com.cardemo.auth.dto.LoginRequest;
+import com.cardemo.auth.dto.LoginResponse;
+import com.cardemo.auth.service.AuthService;
+import jakarta.validation.Valid;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/auth")
+public class AuthController {
+
+    private final AuthService authService;
+
+    public AuthController(AuthService authService) {
+        this.authService = authService;
+    }
+
+    @PostMapping("/login")
+    public ResponseEntity<LoginResponse> login(@Valid @RequestBody LoginRequest request) {
+        LoginResponse response = authService.authenticate(request);
+        return ResponseEntity.ok(response);
+    }
+}

services/carddemo-auth/src/main/java/com/cardemo/auth/controller/GlobalExceptionHandler.java

@@ -0,0 +1,47 @@
+package com.cardemo.auth.controller;
+
+import com.cardemo.auth.service.AuthService.AuthenticationException;
+import com.cardemo.auth.service.UserService.UserAlreadyExistsException;
+import com.cardemo.auth.service.UserService.UserNotFoundException;
+import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.MethodArgumentNotValidException;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+import java.util.Map;
+
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+
+    @ExceptionHandler(AuthenticationException.class)
+    public ResponseEntity<Map<String, String>> handleAuthenticationException(AuthenticationException ex) {
+        return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                .body(Map.of("error", ex.getMessage()));
+    }
+
+    @ExceptionHandler(UserNotFoundException.class)
+    public ResponseEntity<Map<String, String>> handleUserNotFound(UserNotFoundException ex) {
+        return ResponseEntity.status(HttpStatus.NOT_FOUND)
+                .body(Map.of("error", ex.getMessage()));
+    }
+
+    @ExceptionHandler(UserAlreadyExistsException.class)
+    public ResponseEntity<Map<String, String>> handleUserAlreadyExists(UserAlreadyExistsException ex) {
+        return ResponseEntity.status(HttpStatus.CONFLICT)
+                .body(Map.of("error", ex.getMessage()));
+    }
+
+    @ExceptionHandler(DataIntegrityViolationException.class)
+    public ResponseEntity<Map<String, String>> handleDataIntegrity(DataIntegrityViolationException ex) {
+        return ResponseEntity.status(HttpStatus.CONFLICT)
+                .body(Map.of("error", "Resource conflict"));
+    }
+
+    @ExceptionHandler(MethodArgumentNotValidException.class)
+    public ResponseEntity<Map<String, String>> handleValidation(MethodArgumentNotValidException ex) {
+        return ResponseEntity.status(HttpStatus.BAD_REQUEST)
+                .body(Map.of("error", "Validation failed: " + (ex.getFieldError() != null ? ex.getFieldError().getDefaultMessage() : ex.getMessage())));
+    }
+}