Spring Security, JWT & OAuth2

<!-- Spring Security -->
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<!-- JWT (JJWT) -->
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-api</artifactId><version>0.12.3</version></dependency>
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-impl</artifactId><version>0.12.3</version><scope>runtime</scope></dependency>
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-jackson</artifactId><version>0.12.3</version><scope>runtime</scope></dependency>

<!-- OAuth2 Resource Server -->
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

# JWT — generate secret with SecureRandom in production
application:
  security:
    jwt:
      secret-key: 404E635266556A586E3272357538782F413F4428472B4B6250645367566B5970
      expiration: 900000          # 15 minutes in ms
      refresh-token:
        expiration: 604800000    # 7 days in ms

# OAuth2 Resource Server — only if using OAuth2
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://accounts.google.com
          # Spring auto-fetches JWKS from /.well-known/openid-configuration

@Service
public class JwtService {

  @Value("${application.security.jwt.secret-key}")
  private String secretKey;

  @Value("${application.security.jwt.expiration}")
  private long jwtExpiration;

  // Extract username (subject) from token
  public String extractUsername(String token) {
    return extractClaim(token, Claims::getSubject);
  }

  public <T> T extractClaim(String token, Function<Claims, T> resolver) {
    return resolver.apply(extractAllClaims(token));
  }

  // Generate access token (no extra claims)
  public String generateToken(UserDetails userDetails) {
    return buildToken(new HashMap<>(), userDetails, jwtExpiration);
  }

  public String generateToken(Map<String, Object> extraClaims, UserDetails userDetails) {
    return buildToken(extraClaims, userDetails, jwtExpiration);
  }

  private String buildToken(Map<String, Object> extra, UserDetails ud, long exp) {
    return Jwts.builder()
        .claims(extra)
        .subject(ud.getUsername())
        .issuedAt(new Date(System.currentTimeMillis()))
        .expiration(new Date(System.currentTimeMillis() + exp))
        .signWith(getSignInKey())
        .compact();
  }

  // Two checks: username matches AND not expired
  public boolean isTokenValid(String token, UserDetails ud) {
    final String username = extractUsername(token);
    return (username.equals(ud.getUsername())) && !isTokenExpired(token);
  }

  private boolean isTokenExpired(String token) {
    return extractClaim(token, Claims::getExpiration).before(new Date());
  }

  private Claims extractAllClaims(String token) {
    return Jwts.parser()
        .verifyWith(getSignInKey())
        .build()
        .parseSignedClaims(token)
        .getPayload();
  }

  private SecretKey getSignInKey() {
    byte[] keyBytes = Decoders.BASE64.decode(secretKey);
    return Keys.hmacShaKeyFor(keyBytes);
  }
}

@Component
@RequiredArgsConstructor
public class JwtAuthFilter extends OncePerRequestFilter {

  private final JwtService jwtService;
  private final UserDetailsService userDetailsService;

  @Override
  protected void doFilterInternal(
      @NonNull HttpServletRequest request,
      @NonNull HttpServletResponse response,
      @NonNull FilterChain filterChain
  ) throws ServletException, IOException {

    final String authHeader = request.getHeader("Authorization");
    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
      filterChain.doFilter(request, response);
      return;  // no token — skip silently
    }

    final String jwt = authHeader.substring(7);  // strip "Bearer "
    final String userEmail = jwtService.extractUsername(jwt);

    // Only authenticate if not already set (idempotency guard)
    if (userEmail != null &&
        SecurityContextHolder.getContext().getAuthentication() == null) {

      UserDetails userDetails = userDetailsService.loadUserByUsername(userEmail);

      if (jwtService.isTokenValid(jwt, userDetails)) {
        UsernamePasswordAuthenticationToken authToken =
          new UsernamePasswordAuthenticationToken(
            userDetails,
            null,                           // credentials not needed post-auth
            userDetails.getAuthorities()   // roles → GrantedAuthority
          );
        authToken.setDetails(
          new WebAuthenticationDetailsSource().buildDetails(request));
        SecurityContextHolder.getContext().setAuthentication(authToken);
      }
    }
    filterChain.doFilter(request, response);
  }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity   // enables @PreAuthorize
@RequiredArgsConstructor
public class SecurityConfig {

  private final JwtAuthFilter jwtAuthFilter;
  private final UserDetailsService userDetailsService;

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
      .csrf(AbstractHttpConfigurer::disable)          // JWT = stateless = no CSRF
      .sessionManagement(s -> s
        .sessionCreationPolicy(SessionCreationPolicy.STATELESS))  // no server sessions
      .authorizeHttpRequests(auth -> auth
        .requestMatchers("/api/v1/auth/**").permitAll()    // public
        .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated()
      )
      .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
      .authenticationProvider(authenticationProvider());
    return http.build();
  }

  @Bean
  public AuthenticationProvider authenticationProvider() {
    var p = new DaoAuthenticationProvider();
    p.setUserDetailsService(userDetailsService);
    p.setPasswordEncoder(passwordEncoder());
    return p;
  }

  @Bean
  public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); }

  @Bean
  public AuthenticationManager authenticationManager(AuthenticationConfiguration cfg)
      throws Exception { return cfg.getAuthenticationManager(); }
}

@RestController
@RequestMapping("/api/v1/auth")
@RequiredArgsConstructor
public class AuthController {

  private final AuthenticationManager authenticationManager;
  private final UserDetailsService userDetailsService;
  private final JwtService jwtService;

  @PostMapping("/login")
  public ResponseEntity<AuthResponse> login(@RequestBody LoginRequest req) {
    // 1. Throws AuthenticationException if credentials wrong
    authenticationManager.authenticate(
      new UsernamePasswordAuthenticationToken(req.email(), req.password()));

    // 2. Load user and generate JWT
    var user  = userDetailsService.loadUserByUsername(req.email());
    var token = jwtService.generateToken(user);

    return ResponseEntity.ok(new AuthResponse(token));
  }
}

// Java Records — clean, zero-boilerplate DTOs (Java 16+)
public record LoginRequest(String email, String password) {}
public record AuthResponse(String accessToken) {}

@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
      .csrf(AbstractHttpConfigurer::disable)
      .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
      .authorizeHttpRequests(auth -> auth
        .requestMatchers("/public/**").permitAll()
        .requestMatchers("/admin/**").hasAuthority("SCOPE_admin")
        .anyRequest().authenticated())
      .oauth2ResourceServer(oauth2 -> oauth2   // ← replaces custom JwtAuthFilter
        .jwt(Customizer::withDefaults));      // auto-validates via JWKS endpoint
    return http.build();
  }

  // Maps custom "roles" claim to Spring GrantedAuthority objects
  @Bean
  public JwtAuthenticationConverter jwtAuthenticationConverter() {
    var c = new JwtGrantedAuthoritiesConverter();
    c.setAuthoritiesClaimName("roles");
    c.setAuthorityPrefix("ROLE_");
    var jc = new JwtAuthenticationConverter();
    jc.setJwtGrantedAuthoritiesConverter(c);
    return jc;
  }
}