Modernize CICS user-security programs as a Spring Boot REST service

[devin-ai-integration]

Summary

New module java/user-security-service/ — a Spring Boot 3.4.5 / Java 17 REST service replacing the interactive CICS user-security programs (COSGN00C, COUSR00C, COUSR01C, COUSR02C, COUSR03C) that read/write the USRSEC VSAM file. H2 in-memory persistence, seeded from app/jcl/ESDSRRDS.jcl, with Swagger UI at /swagger-ui.html.

Mapping from COBOL to REST:

COBOL	Endpoint	Behavior preserved
COSGN00C	POST /api/auth/signon	user missing → 404 User ID NOT found..., bad password → 401 Invalid password..., success → 200 + userType so the caller branches admin vs regular
COUSR00C	GET /api/users	paged, default size 10
—	GET /api/users/{id}	200 / 404
COUSR01C	POST /api/users	all five fields non-empty → 201, else 400; duplicate ID → 409
COUSR02C	PUT /api/users/{id}	200 / 400 / 404
COUSR03C	DELETE /api/users/{id}	204, 404 when ID missing

User mirrors SEC-USER-DATA from app/cpy/CSUSR01Y.cpy (id 8, firstName 20, lastName 20, password, userType). UserType matches CDEMO-USRTYP-ADMIN/CDEMO-USRTYP-USER in app/cpy/COCOM01Y.cpy and is persisted as the single char via an AttributeConverter:

ADMIN("A"), USER("U")   // column length 1; JSON emits ADMIN/USER plus userTypeCode "A"/"U"
                        // input accepts any of A, U, ADMIN, USER

Two deliberate deviations worth knowing:

• Password column is 9 chars, not 8. CSUSR01Y is SEC-USR-PWD PIC X(08) + SEC-USR-TYPE PIC X(01), so the JCL's trailing PASSWORDA is really password PASSWORD + type A. The requested demo credentials are PASSWORDA/PASSWORDU, so those are seeded verbatim and the column widened; the nuance is documented in the module README.
• User IDs are normalized to uppercase on every path (create/read/update/delete/signon), matching the fixed-width uppercase VSAM keys. Passwords are compared exactly — no case folding.

15 MockMvc tests cover signon success / not-found / wrong-password, full CRUD, validation failures, duplicate IDs, and the enum serialization. @ApiResponses declare the real status codes (201/204/400/401/404/409) plus the ApiErrorResponse shape so Swagger doesn't show them as "Undocumented".

Demo

mvn clean package → 15 tests green; service boots on 8080 with the 10 seeded users and Swagger UI reachable. A screen recording of the end-to-end Swagger UI flow is committed at java/user-security-service/docs/demo.mp4 and linked from the module README: admin signon (200, userType: ADMIN) → list 10 seeded users → create DEMO0001 (201) → update it and flip type to ADMIN (200) → delete (204) → follow-up GET (404 User ID NOT found...).

Note: mvn spring-boot:run needs JAVA_HOME on JDK 17 — the box's default resolution launched the Boot plugin under Java 8 (class file version 61 vs 52). Documented in the README.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/e0c9250f47fa4ce6bae1b6b060bccd23
Requested by: @VedantKh

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring