Add Spring Security with JWT authentication and environment variable support #19
Conversation
…t and add authentication manager
…te SecurityFilter
… in login response
…for API integration
…rove token validation error handling
…ronment variable management
…ables from .env file
…dEncoder instance
WalkthroughThe changes introduce user authentication and security features using Spring Security and JWT. The documentation and configuration are updated to reflect environment variable-driven settings. New classes and DTOs are added for authentication, JWT token management, and security filtering. The project now supports user registration, login, and protected endpoints, with environment variable management via dotenv. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant AuthController
participant AuthManager
participant UserRepo
participant TokenService
Client->>AuthController: POST /api/auth/login (login, password)
AuthController->>AuthManager: authenticate(login, password)
AuthManager->>UserRepo: findByLogin(login)
UserRepo-->>AuthManager: UserDetails
AuthManager-->>AuthController: Authentication result
AuthController->>TokenService: generateToken(User)
TokenService-->>AuthController: JWT token
AuthController-->>Client: LoginResponseDTO(token, login, role)
sequenceDiagram
participant Client
participant AuthController
participant UserRepo
participant PasswordEncoder
Client->>AuthController: POST /api/auth/register (login, password, role)
AuthController->>UserRepo: findByLogin(login)
UserRepo-->>AuthController: UserDetails/null
alt User exists
AuthController-->>Client: 400 Bad Request
else User does not exist
AuthController->>PasswordEncoder: encode(password)
PasswordEncoder-->>AuthController: hashedPassword
AuthController->>UserRepo: save(new User)
UserRepo-->>AuthController: User
AuthController-->>Client: 200 OK
end
sequenceDiagram
participant Client
participant SecurityFilter
participant TokenService
participant UserRepo
Client->>SecurityFilter: Any protected request with Authorization: Bearer <token>
SecurityFilter->>TokenService: validateToken(token)
TokenService-->>SecurityFilter: username/exception
SecurityFilter->>UserRepo: findByLogin(username)
UserRepo-->>SecurityFilter: UserDetails
SecurityFilter-->>Client: Proceed if authenticated, else unauthorized
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
coderabbitai
bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (10)
src/main/java/com/otavio/aifoodapp/dto/LoginResponseDTO.java (1)
3-3: LGTM! Consider adding field validation.The record implementation is clean and appropriate for a login response DTO. Consider adding field validation annotations for better data integrity.
+import jakarta.validation.constraints.NotBlank; + -public record LoginResponseDTO(String token, String login, String role) { +public record LoginResponseDTO( + @NotBlank String token, + @NotBlank String login, + @NotBlank String role +) {src/main/resources/application.properties (1)
21-21: Consider reducing logging level for production.TRACE level logging for Spring Security can be very verbose and may impact performance in production environments.
-logging.level.org.springframework.security=TRACE +logging.level.org.springframework.security=${LOG_LEVEL_SECURITY:INFO}src/main/java/com/otavio/aifoodapp/config/DotenvEnvironmentPostProcessor.java (2)
17-17: LGTM! Consider adding error handling and logging.The dotenv loading implementation is correct with
ignoreIfMissing()configuration. Consider adding logging for debugging purposes.+import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + public class DotenvEnvironmentPostProcessor implements EnvironmentPostProcessor { + private static final Logger logger = LoggerFactory.getLogger(DotenvEnvironmentPostProcessor.class); + @Override public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) { - Dotenv dotenv = Dotenv.configure().ignoreIfMissing().load(); + try { + Dotenv dotenv = Dotenv.configure().ignoreIfMissing().load(); + logger.debug("Loading dotenv configuration"); + } catch (Exception e) { + logger.warn("Failed to load .env file: {}", e.getMessage()); + }
19-20: Consider filtering sensitive variables.Loading all environment variables with highest priority might override important system properties. Consider filtering or documenting which variables should be loaded.
- dotenv.entries().forEach(entry -> envMap.put(entry.getKey(), entry.getValue())); + dotenv.entries() + .stream() + .filter(entry -> entry.getKey().startsWith("DB_") || + entry.getKey().startsWith("JWT_") || + entry.getKey().startsWith("MARITACA_")) + .forEach(entry -> envMap.put(entry.getKey(), entry.getValue()));src/main/java/com/otavio/aifoodapp/security/SecurityConfig.java (1)
42-50: Consider using more descriptive bean method names.While the functionality is correct, consider renaming
authenticationManagerBeantoauthenticationManagerfor consistency with Spring conventions.@Bean -public AuthenticationManager authenticationManagerBean(AuthenticationConfiguration authenticationConfiguration) throws Exception { +public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); }src/main/java/com/otavio/aifoodapp/security/TokenService.java (2)
24-24: Make issuer configurable.The hardcoded issuer "auth-api" should be configurable to support different environments and deployment scenarios.
Add a configurable issuer property:
@Value("${api.security.token.secret}") private String secret; +@Value("${api.security.token.issuer:auth-api}") +private String issuer;Then update both
generateTokenandvalidateTokenmethods to useissuerinstead of the hardcoded string.
29-31: Improve exception handling specificity.Wrapping all JWT exceptions in generic RuntimeException reduces error handling capabilities for callers. Consider using more specific custom exceptions or letting the original exceptions propagate.
} catch (JWTCreationException creationException) { - throw new RuntimeException("Error while generating token", creationException); + throw new IllegalStateException("Failed to generate JWT token", creationException); } } catch (JWTVerificationException verificationException) { - throw new RuntimeException("Invalid token", verificationException); + return null; // or throw a custom InvalidTokenException }Also applies to: 42-44
src/main/java/com/otavio/aifoodapp/security/SecurityFilter.java (1)
46-50: Improve token extraction robustness.The current token extraction could fail if the header doesn't start with "Bearer " exactly. Consider making it more robust.
private String recoverToken(HttpServletRequest request) { var authHeader = request.getHeader("Authorization"); - if (authHeader == null) return null; - return authHeader.replace("Bearer ", ""); + if (authHeader == null || !authHeader.startsWith("Bearer ")) { + return null; + } + return authHeader.substring(7); // "Bearer ".length() }README.MD (1)
19-19: Minor grammar correction needed.Static analysis detected a potential number agreement error in Portuguese.
-- **Spring Boot**: Framework para aplicações Java +- **Spring Boot**: Framework para aplicações JavaConsider reviewing the Portuguese grammar for consistency throughout the document.
🧰 Tools
🪛 LanguageTool
[grammar] ~19-~19: Possível erro de concordância de número.
Context: ...adas - Spring Boot: Framework para aplicações Java - Spring Data JPA: Persistência de ...(GENERAL_NUMBER_AGREEMENT_ERRORS)
src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.java (1)
20-35: LGTM - Good use of constructor injection and immutable fieldsThe class structure follows Spring Boot best practices with proper dependency injection and final field declarations.
Consider removing extra blank lines for cleaner formatting:
@RestController @RequestMapping("/api/auth") - public class AuthenticationController { - private final AuthenticationManager authenticationManager; - private final UserRepository userRepository;
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
README.MD(1 hunks)pom.xml(1 hunks)src/main/java/com/otavio/aifoodapp/AiFoodAppApplication.java(1 hunks)src/main/java/com/otavio/aifoodapp/config/CorsConfig.java(0 hunks)src/main/java/com/otavio/aifoodapp/config/DotenvEnvironmentPostProcessor.java(1 hunks)src/main/java/com/otavio/aifoodapp/config/SecurityConfig.java(0 hunks)src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.java(1 hunks)src/main/java/com/otavio/aifoodapp/dto/AuthenticationDTO.java(1 hunks)src/main/java/com/otavio/aifoodapp/dto/LoginResponseDTO.java(1 hunks)src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java(1 hunks)src/main/java/com/otavio/aifoodapp/model/User.java(2 hunks)src/main/java/com/otavio/aifoodapp/repository/UserRepository.java(1 hunks)src/main/java/com/otavio/aifoodapp/security/SecurityConfig.java(1 hunks)src/main/java/com/otavio/aifoodapp/security/SecurityFilter.java(1 hunks)src/main/java/com/otavio/aifoodapp/security/TokenService.java(1 hunks)src/main/java/com/otavio/aifoodapp/service/AuthorizationService.java(1 hunks)src/main/resources/META-INF/spring.factories(1 hunks)src/main/resources/application.properties(1 hunks)
💤 Files with no reviewable changes (2)
- src/main/java/com/otavio/aifoodapp/config/CorsConfig.java
- src/main/java/com/otavio/aifoodapp/config/SecurityConfig.java
🧰 Additional context used
🪛 LanguageTool
README.MD
[grammar] ~19-~19: Possível erro de concordância de número.
Context: ...adas - Spring Boot: Framework para aplicações Java - Spring Data JPA: Persistência de ...
(GENERAL_NUMBER_AGREEMENT_ERRORS)
🔇 Additional comments (13)
src/main/java/com/otavio/aifoodapp/AiFoodAppApplication.java (1)
9-9: Minor formatting improvement.The spacing adjustment in the
excludeattribute improves readability.src/main/resources/META-INF/spring.factories (1)
1-2: Correct Spring Boot environment post-processor registration.The registration follows Spring Boot's standard conventions for registering custom environment post-processors. This will enable the
DotenvEnvironmentPostProcessorto load environment variables early in the application lifecycle.src/main/java/com/otavio/aifoodapp/model/User.java (2)
37-41: Well-implemented constructor for user creation.The constructor properly initializes the essential fields for user registration and follows Spring Security UserDetails patterns. This supports the authentication flow nicely.
55-56: Improved readability with explicit conditional formatting.The multi-line format makes the role-based authority assignment more readable and easier to maintain.
src/main/java/com/otavio/aifoodapp/service/AuthorizationService.java (1)
22-27:Details
✅ Verification successful
LGTM! Null handling is correct.
The refactoring from Optional to direct null checking is implemented correctly with proper exception handling. This aligns well with the UserRepository interface change.
Verify that all callers of
userRepository.findByLogin()are updated to handle the new return type:
🏁 Script executed:
#!/bin/bash # Description: Search for all usages of findByLogin to ensure consistency with the new signature rg -A 3 -B 3 "findByLogin"Length of output: 3013
findByLogin null-handling verified
All usages of
userRepository.findByLogin(...)properly handle anullreturn value:
- SecurityFilter.java: Checks
userExists != nullbefore creating the authentication token.- AuthenticationController.java: Uses
findByLogin(...) != nullto guard against duplicate registrations.- AuthorizationService.java: Throws
UsernameNotFoundExceptionwhenuser == null.No further changes are needed.
src/main/java/com/otavio/aifoodapp/repository/UserRepository.java (1)
11-11:Details
✅ Verification successful
Breaking change: Verify all usages handle null returns.
The method signature change from
Optional<UserDetails>toUserDetailsremoves null-safety guarantees. Ensure all callers properly handle potential null returns.
🏁 Script executed:
#!/bin/bash # Description: Find all implementations and usages of findByLogin method ast-grep --pattern 'findByLogin($_)'Length of output: 38
🏁 Script executed:
#!/bin/bash # Search for all usages of findByLogin across Java code rg -n "findByLogin\(" -t javaLength of output: 596
🏁 Script executed:
#!/bin/bash rg -n -A3 -B3 "findByLogin" src/main/java/com/otavio/aifoodapp/security/SecurityFilter.java rg -n -A3 -B3 "findByLogin" src/main/java/com/otavio/aifoodapp/service/AuthorizationService.java rg -n -A3 -B3 "findByLogin" src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.javaLength of output: 1358
All callers already handle null returns – no further action needed
Verification confirms that every usage of
findByLoginperforms a null check before dereferencing:
- SecurityFilter.java (line 35): checks
userExists != null- AuthorizationService.java (line 22): checks
user == nulland throws if absent- AuthenticationController.java (line 51): checks
findByLogin(...) != nullbefore proceedingSince all call sites guard against null, this change does not introduce unchecked NPE risks.
src/main/resources/application.properties (1)
24-24: Ensure JWT secret is properly configured in production.The default JWT secret value indicates it should be defined externally. Verify that production environments have a strong, unique JWT secret configured.
Consider adding startup validation to ensure the JWT secret is not using the default placeholder value in production.
src/main/java/com/otavio/aifoodapp/security/SecurityConfig.java (2)
17-24: LGTM! Proper dependency injection and configuration setup.The constructor injection pattern is correctly implemented, ensuring the SecurityFilter dependency is properly managed by Spring.
27-40: Security configuration is well-structured.The security filter chain correctly:
- Disables CSRF (appropriate for JWT-based APIs)
- Sets stateless session management
- Permits authentication endpoints while protecting others
- Adds the custom filter in the correct position
pom.xml (2)
31-119: Well-organized dependency structure with good categorization.The dependencies are properly categorized and the addition of Spring Security and JWT support aligns with the authentication features being implemented.
92-95:Details
❓ Verification inconclusive
Verify the Flyway version downgrade reason.
The Flyway version was downgraded from 11.8.2 to 11.8.1. Ensure this downgrade is intentional and not due to compatibility issues.
🏁 Script executed:
#!/bin/bash # Check for known issues with Flyway 11.8.2 and Spring Boot 3.5.0 compatibility echo "Checking Flyway version compatibility..." curl -s "https://api.github.com/repos/flyway/flyway/releases" | jq -r '.[] | select(.tag_name | startswith("flyway-")) | .tag_name' | head -5Length of output: 302
Confirm Flyway version downgrade
It looks like pom.xml now pins Flyway to 11.8.1, even though 11.8.2 (and newer 11.9.x) are available. Unless there’s a documented compatibility issue—e.g. with Spring Boot 3.5.0—please verify this downgrade is intentional. If not, consider upgrading to at least 11.8.2 (or the latest patch) to include important bug fixes.• File: pom.xml, lines 92–95
• Current snippet:<artifactId>flyway-database-postgresql</artifactId> <version>11.8.1</version> <scope>runtime</scope>• If no issues are found, update to:
- <version>11.8.1</version> + <version>11.8.2</version>README.MD (1)
15-15: Excellent documentation of new security features.The README comprehensively documents the new JWT authentication system, including:
- Clear security architecture explanation
- Proper warnings about sensitive data
- Good examples of environment variable configuration
- Updated API endpoints with authentication details
Also applies to: 43-95
src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.java (1)
1-19: LGTM - Well-organized importsThe package declaration and imports are properly structured and include all necessary dependencies for authentication functionality.
| public record AuthenticationDTO(String login, String password) { | ||
| } |
There was a problem hiding this comment.
Critical security issue: Password exposure in auto-generated toString() method.
Like RegisterDTO, this record will expose the password in its auto-generated toString() method, creating a security vulnerability when this DTO is logged.
Apply the same solution as recommended for RegisterDTO:
-public record AuthenticationDTO(String login, String password) {
-}
+public class AuthenticationDTO {
+ private final String login;
+ private final String password;
+
+ public AuthenticationDTO(String login, String password) {
+ this.login = login;
+ this.password = password;
+ }
+
+ public String login() { return login; }
+ public String password() { return password; }
+
+ @Override
+ public String toString() {
+ return "AuthenticationDTO{login='" + login + "'}";
+ }
+}Consider adding validation annotations:
public record AuthenticationDTO(
@NotBlank String login,
@NotBlank String password
) {}🤖 Prompt for AI Agents
In src/main/java/com/otavio/aifoodapp/dto/AuthenticationDTO.java at lines 3 to
4, the record's auto-generated toString() method exposes the password, creating
a security risk. To fix this, override the toString() method to exclude the
password field or avoid logging the entire record. Additionally, add validation
annotations like @NotBlank to both login and password fields to ensure they are
not empty or null.
| var token = this.recoverToken(request); | ||
| if (token != null) { | ||
| var login = tokenService.validateToken(token); | ||
| if (login != null && !login.isEmpty()) { | ||
| var userExists = userRepository.findByLogin(login); | ||
| if (userExists != null) { | ||
| UserDetails user = userExists; | ||
| var authentication = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities()); | ||
| SecurityContextHolder.getContext().setAuthentication(authentication); | ||
| } | ||
| } | ||
| } | ||
| filterChain.doFilter(request, response); | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add proper exception handling for token validation.
The current implementation doesn't handle exceptions from tokenService.validateToken(), which could cause the filter to fail unexpectedly. Also, the null check for login could be simplified.
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
var token = this.recoverToken(request);
if (token != null) {
- var login = tokenService.validateToken(token);
- if (login != null && !login.isEmpty()) {
- var userExists = userRepository.findByLogin(login);
- if (userExists != null) {
- UserDetails user = userExists;
- var authentication = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
- SecurityContextHolder.getContext().setAuthentication(authentication);
- }
- }
+ try {
+ var login = tokenService.validateToken(token);
+ if (login != null && !login.isEmpty()) {
+ var user = userRepository.findByLogin(login);
+ if (user != null) {
+ var authentication = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
+ SecurityContextHolder.getContext().setAuthentication(authentication);
+ }
+ }
+ } catch (RuntimeException e) {
+ // Invalid token, continue without authentication
+ }
}
filterChain.doFilter(request, response);
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| var token = this.recoverToken(request); | |
| if (token != null) { | |
| var login = tokenService.validateToken(token); | |
| if (login != null && !login.isEmpty()) { | |
| var userExists = userRepository.findByLogin(login); | |
| if (userExists != null) { | |
| UserDetails user = userExists; | |
| var authentication = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities()); | |
| SecurityContextHolder.getContext().setAuthentication(authentication); | |
| } | |
| } | |
| } | |
| filterChain.doFilter(request, response); | |
| } | |
| @Override | |
| protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { | |
| var token = this.recoverToken(request); | |
| if (token != null) { | |
| try { | |
| var login = tokenService.validateToken(token); | |
| if (login != null && !login.isEmpty()) { | |
| var user = userRepository.findByLogin(login); | |
| if (user != null) { | |
| var authentication = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities()); | |
| SecurityContextHolder.getContext().setAuthentication(authentication); | |
| } | |
| } | |
| } catch (RuntimeException e) { | |
| // Invalid token, continue without authentication | |
| } | |
| } | |
| filterChain.doFilter(request, response); | |
| } |
🤖 Prompt for AI Agents
In src/main/java/com/otavio/aifoodapp/security/SecurityFilter.java around lines
31 to 44, add a try-catch block around the call to
tokenService.validateToken(token) to properly handle any exceptions it might
throw. Inside the catch block, log the exception or handle it appropriately to
prevent the filter from failing unexpectedly. Also, simplify the null and empty
check for the login variable by using a utility method or a concise condition.
src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.java
Show resolved
Hide resolved
src/main/java/com/otavio/aifoodapp/controller/AuthenticationController.java
Show resolved
Hide resolved
Remove unused import Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java (1)
15-18: Getter names deviate from Java-Bean conventionsMethods named
login(),password(),role()will not be recognised automatically by frameworks such as Jackson, MapStruct, Bean Validation, or Spring’s data binding, which expectgetLogin(),getPassword(),getRole(). Either rename the methods or annotate them with@JsonProperty("login"), etc., to keep interoperability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java(1 hunks)
🔇 Additional comments (1)
src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java (1)
21-26: 👍 Good: password excluded fromtoString()The custom
toString()omits the password, eliminating the leakage flagged in the earlier review.
| public class RegisterDTO { | ||
| private final String login; | ||
| private final String password; | ||
| private final UserRoles role; | ||
|
|
||
| public RegisterDTO(String login, String password, UserRoles role) { | ||
| this.login = login; | ||
| this.password = password; | ||
| this.role = role; | ||
| } |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Add validation & JSON-safety annotations on incoming data
login, password, and role arrive from the client and should be validated and handled cautiously.
• Add @NotBlank / @Size(min = 8) on password, @NotBlank on login, and @NotNull on role.
• To avoid the password ever being serialized back to a response, mark it @JsonProperty(access = JsonProperty.Access.WRITE_ONLY) or @JsonIgnore.
+import com.fasterxml.jackson.annotation.JsonProperty;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
...
- private final String login;
- private final String password;
- private final UserRoles role;
+ @NotBlank
+ private final String login;
+
+ @NotBlank
+ @Size(min = 8)
+ @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+ private final String password;
+
+ @NotNull
+ private final UserRoles role;🏁 Script executed:
#!/bin/bash
# Display the first 50 lines of RegisterDTO to inspect current imports and annotations
sed -n '1,50p' src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java
# Search the project for Jackson annotations to confirm JSON mapping library
grep -R "JsonProperty" -n src
grep -R "JsonIgnore" -n src
# Search for existing Jakarta Validation annotations to verify if the dependency is in use
grep -R "NotBlank" -n src
grep -R "Size" -n src
grep -R "jakarta.validation" -n .Length of output: 907
🏁 Script executed:
#!/bin/bash
# List root files to find build configuration
echo "Root files:"
ls -1 .
# Inspect Maven POM for validation and Jackson dependencies
if [ -f pom.xml ]; then
echo "---- pom.xml ----"
grep -n "<artifactId>jakarta.validation-api</artifactId>" -n pom.xml || echo "No Jakarta Validation API dependency found"
grep -n "jackson" -n pom.xml || echo "No Jackson dependencies found"
fi
# Inspect Gradle build for validation and Jackson dependencies
if [ -f build.gradle ]; then
echo "---- build.gradle ----"
grep -n "jakarta.validation" -n build.gradle || echo "No Jakarta Validation in build.gradle"
grep -n "jackson" -n build.gradle || echo "No Jackson dependencies found in build.gradle"
fiLength of output: 455
🏁 Script executed:
#!/bin/bash
# Show the dependencies block in pom.xml
echo "---- Dependencies in pom.xml ----"
sed -n '/<dependencies>/,/<\/dependencies>/p' pom.xml
# Search for Spring Boot starter and Jackson dependencies explicitly
echo "---- Searching for Spring Boot starters ----"
grep -n "spring-boot-starter" -n pom.xml || echo "No Spring Boot starters found"
echo "---- Searching for Jackson groupId ----"
grep -n "<groupId>com.fasterxml.jackson</groupId>" -n pom.xml || echo "No Jackson groupId found"Length of output: 5147
Add Jakarta Validation dependency and field constraints to RegisterDTO
To enforce input validation and prevent password serialization:
• pom.xml
– Add the Spring Boot validation starter to enable @NotBlank, @Size, @NotNull support.
<dependencies>
<!-- existing starters -->
+ <dependency>
+ <groupId>org.springframework.boot</groupId>
+ <artifactId>spring-boot-starter-validation</artifactId>
+ </dependency>
<!-- other dependencies -->
</dependencies>• src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java
– Import the required Jakarta Validation and Jackson annotations.
– Annotate fields:
• @NotBlank on login
• @NotBlank + @Size(min=8) + @JsonProperty(access = WRITE_ONLY) on password
• @NotNull on role
+import com.fasterxml.jackson.annotation.JsonProperty;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
public class RegisterDTO {
- private final String login;
- private final String password;
- private final UserRoles role;
+ @NotBlank
+ private final String login;
+
+ @NotBlank
+ @Size(min = 8)
+ @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+ private final String password;
+
+ @NotNull
+ private final UserRoles role;
public RegisterDTO(String login, String password, UserRoles role) {
this.login = login;
this.password = password;
this.role = role;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| public class RegisterDTO { | |
| private final String login; | |
| private final String password; | |
| private final UserRoles role; | |
| public RegisterDTO(String login, String password, UserRoles role) { | |
| this.login = login; | |
| this.password = password; | |
| this.role = role; | |
| } | |
| // src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java | |
| package com.otavio.aifoodapp.dto; | |
| import com.fasterxml.jackson.annotation.JsonProperty; | |
| import jakarta.validation.constraints.NotBlank; | |
| import jakarta.validation.constraints.Size; | |
| import jakarta.validation.constraints.NotNull; | |
| public class RegisterDTO { | |
| @NotBlank | |
| private final String login; | |
| @NotBlank | |
| @Size(min = 8) | |
| @JsonProperty(access = JsonProperty.Access.WRITE_ONLY) | |
| private final String password; | |
| @NotNull | |
| private final UserRoles role; | |
| public RegisterDTO(String login, String password, UserRoles role) { | |
| this.login = login; | |
| this.password = password; | |
| this.role = role; | |
| } | |
| } |
🤖 Prompt for AI Agents
In src/main/java/com/otavio/aifoodapp/dto/RegisterDTO.java lines 5 to 14, add
Jakarta Validation and Jackson annotations to enforce input validation and
prevent password serialization. Import @NotBlank, @Size, @NotNull from Jakarta
Validation and @JsonProperty from Jackson. Annotate the login field with
@NotBlank, the password field with @NotBlank, @Size(min=8), and
@JsonProperty(access = JsonProperty.Access.WRITE_ONLY), and the role field with
@NotNull. Also, ensure the pom.xml includes the Spring Boot validation starter
dependency to support these annotations.
|
🧙 Sourcery está revisando seu pull request! Dicas e comandosInteragindo com o Sourcery
Personalizando Sua ExperiênciaAcesse seu painel para:
Obtendo Ajuda
Original review guide in English🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Resumo por Sourcery
Adiciona autenticação de usuário baseada em JWT com Spring Security e habilita suporte a variáveis de ambiente, atualizando as dependências do projeto e a documentação
Novas Funcionalidades:
Melhorias:
.envvia um EnvironmentPostProcessor customizado e usa propriedades placeholderBuild:
Documentação:
Original summary in English
Summary by Sourcery
Add JWT-based user authentication with Spring Security and enable environment variable support, updating project dependencies and documentation
New Features:
Enhancements:
.envfile via a custom EnvironmentPostProcessor and use placeholder propertiesBuild:
Documentation:
Summary by CodeRabbit
.envfiles.