Add Spring Boot user-security service modernizing the CardDemo USRSEC programs

[devin-ai-integration]

Summary

New self-contained Spring Boot 3 / Java 17 service in java/user-security-service/ that replaces the CICS user-security module (COSGN00C, COUSR00C–COUSR03C) operating on the USRSEC VSAM file. H2 in-memory DB, seeded on startup from the in-stream records of app/jcl/ESDSRRDS.jcl.

Legacy	Endpoint	Notes
COSGN00C	POST /api/signon (alias /api/auth/login)	200 with admin + nextProgram (COADM01C/COMEN01C), 401 wrong password, 404 unknown ID
COUSR00C	GET /api/users?page&size	default size=10, ordered by user ID
COUSR02C lookup	GET /api/users/{userId}
COUSR01C	POST /api/users	201, 409 on duplicate key
COUSR02C	PUT /api/users/{userId}	rewrites first/last name, password, type
COUSR03C	DELETE /api/users/{userId}	204

Error bodies carry the original BMS message text ("User ID NOT found...", "Wrong Password. Try again ...", "User ID already exist...", "First Name can NOT be empty..."), so a UI can render the same strings the 3270 screens did. Passwords are never present in any response DTO.

Seed layout correction. The record is SEC-USER-DATA from CSUSR01Y, so SEC-USR-PWD is PIC X(08) at columns 49-56 and column 57 is SEC-USR-TYPE:

ADMIN001MARGARET            GOLD                PASSWORDA
^ID 1-8 ^first 9-28         ^last 29-48         ^pwd 49-56
                                                        ^type 57

Reading columns 49-57 as the password would yield a 9-character value that violates PIC X(08) (and the repo root README.md documents the credential as ADMIN001/PASSWORD). The seeder therefore parses type from column 57, falling back to the ADMIN ID prefix if that column is blank.

Because the BMS maps handed the COBOL programs uppercase, space-padded fields, UserService normalizes (trim().toUpperCase()) user IDs, passwords and user types on the way in — so {"userId":"user0001","password":"password"} signs on exactly as the terminal did.

src/main/resources/static/index.html serves a small terminal-styled operator screen (signon / paginated list / add-update-delete) mirroring the legacy maps, used for end-to-end verification.

Testing

24 tests, all green (mvn test): UsrsecSeederTest (fixed-width parsing), UserServiceTest (signon success/failure, pagination, CRUD, not-found/duplicate), UserSecurityApiTest (MockMvc over every endpoint incl. status codes and validation messages). Also verified against a running jar with curl for all endpoints and error paths, plus a browser walkthrough of the operator screen.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/716a33e2c9d04bad86527f18bdebe8f3
Requested by: @VedantKh

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring