Fix/login logout endpoints #94

GuilhermeOchoa · 2025-09-13T17:41:08Z

📍 Título: Correção de endpoints de autenticação JWT (login, logout e refresh token)

📌 Descrição:
Esta PR corrige problemas de validação nos endpoints de autenticação JWT, garantindo o funcionamento adequado dos fluxos de login, logout e refresh token. Inclui correções na validação de tokens, organização dos filtros de segurança e melhorias na cobertura de testes.

🛠️ O que foi feito?

Correção de bug
Melhoria de testes
Implementação de nova funcionalidade
Refatoração de código

🔍 Arquivos modificados:

pointtils/src/main/java/com/pointtils/pointtils/src/application/controllers/JwtController.java
pointtils/src/main/java/com/pointtils/pointtils/src/application/dto/RefreshTokenRequestDTO.java
pointtils/src/main/java/com/pointtils/pointtils/src/application/dto/TokensDTO.java
pointtils/src/test/java/com/pointtils/pointtils/src/application/controllers/AuthControllerTest.java
pointtils/src/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtAuthenticationFilter.java
pointtils/src/main/java/com/pointtils/pointtils/src/infrastructure/configs/SecurityConfiguration.java

🧪 Testes realizados:

Testes unitários do AuthController (20 testes passando)
Testes manuais com curl para verificar respostas HTTP
Validação de tokens de acesso e refresh
Testes de logout com blacklist de tokens
Cobertura de testes: 91% instruções, 70% branches

👀 Problemas resolvidos:

Validação incorreta de tokens no endpoint de logout
Organização inadequada dos filtros de segurança
Respostas HTTP inconsistentes (200/401)
Permissão para logout com tokens já invalidados

✅ Checklist

Testes foram atualizados e passando
Endpoints retornam códigos HTTP corretos
Tokens são invalidados corretamente na blacklist
Fluxo completo de autenticação validado

📎 Referências

Resolve: US03 - Criar endpoint de login e logout #35 US03 - Criar endpoint de login e logout
Documentação Spring Security
JWT Best Practices
REST API Authentication Patterns

Status dos endpoints:

✅ POST /v1/auth/login - 200 OK
✅ POST /v1/auth/refresh - 200 OK
✅ POST /v1/auth/logout - 200 OK (1ª vez), 401 Unauthorized (reações)
✅ Validação adequada de tokens JWT
✅ Blacklist funcionando corretamente

…tamente - Corrigir problema de validação no endpoint de logout - Reorganizar ordem dos filtros no SecurityConfiguration - Permitir logout mesmo com tokens na blacklist - Garantir respostas HTTP adequadas (200 OK/401 Unauthorized) - Melhorar cobertura de testes dos endpoints de autenticação Resolve: #35 US03 - Criar endpoint de login e logout

- Corrigir problema de validação no endpoint de logout - Reorganizar ordem dos filtros no SecurityConfiguration - Permitir logout mesmo com tokens na blacklist - Garantir respostas HTTP adequadas (200 OK/401 Unauthorized) - Melhorar cobertura de testes dos endpoints de autenticação - Adequar DTOs para validação correta dos tokens Resolve: #35 US03 - Criar endpoint de login e logout

Copilot

Pull Request Overview

This PR fixes JWT authentication endpoints by standardizing token field names to snake_case format and improving token validation logic. The changes ensure consistency between API contracts and improve the authentication flow for login, logout, and refresh token operations.

Key changes:

Standardized JSON field names from camelCase to snake_case for token fields
Enhanced refresh token validation with proper null checks and expiration validation
Fixed JWT filter ordering and blacklist checking logic for logout endpoints

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
AuthControllerTest.java	Updated test assertions to use snake_case token field names (access_token, refresh_token)
SecurityConfiguration.java	Moved JWT filter registration after authorization rules configuration
JwtAuthenticationFilter.java	Added logic to skip blacklist validation for logout endpoint requests
TokensDTO.java	Added @JsonProperty annotations to map camelCase fields to snake_case JSON
RefreshTokenRequestDTO.java	Added @JsonProperty annotation for refresh_token field mapping
JwtController.java	Enhanced refresh token validation with null checks and token expiration validation
AuthController.java	Updated refresh endpoint to accept RefreshTokenRequestDTO with validation

Copilot · 2025-09-13T17:42:10Z

...rc/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtAuthenticationFilter.java

+        // Verificar se o token está na blacklist apenas se não for uma requisição de logout
+        String requestURI = request.getRequestURI();
+        if (!requestURI.equals("/v1/auth/logout")) {
+            String token = authHeader.substring(7);
+            if (memoryBlacklistService.isBlacklisted(token)) {


The hardcoded URI path comparison creates a security vulnerability. If the logout endpoint path changes or if there are other logout-related endpoints, tokens could bypass blacklist validation. Consider using a more robust approach like checking if the request matches logout endpoints using Spring's RequestMatcher or maintaining a list of excluded paths.

Copilot · 2025-09-13T17:42:10Z

pointtils/src/main/java/com/pointtils/pointtils/src/application/controllers/JwtController.java

+            throw new com.pointtils.pointtils.src.core.domain.exceptions.AuthenticationException("Refresh token não fornecido");
+        }
+
+        if (!jwtService.validateToken(request.getRefreshToken()) || jwtService.isTokenExpired(request.getRefreshToken())) {


The refresh token is being validated twice - once in validateToken() and again in isTokenExpired(). This causes redundant token parsing and validation. Consider combining these checks or using a single method that returns validation details including expiration status.

Copilot · 2025-09-13T17:42:11Z

...rc/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtAuthenticationFilter.java

+            String token = authHeader.substring(7);
+            if (memoryBlacklistService.isBlacklisted(token)) {
+                response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+                response.getWriter().write("Token inválido");
+                return;
+            }


The token extraction logic authHeader.substring(7) is duplicated on lines 44 and 53. Extract this to a variable at the beginning of the method to avoid duplication and ensure consistency.

- Corrigir problema de validação no endpoint de logout - Reorganizar ordem dos filtros no SecurityConfiguration - Permitir logout mesmo com tokens na blacklist - Garantir respostas HTTP adequadas (200 OK/401 Unauthorized) - Melhorar cobertura de testes dos endpoints de autenticação - Adequar DTOs para validação correta dos tokens Resolve: #35 US03 - Criar endpoint de login e logout

2. AuthService.java - Consolidated token validation 3. JwtAuthenticationFilter.java - Extracted duplicated token extraction logic (my change) 4. JwtService.java - Added new isTokenValid() method 5. AuthServiceTest.java - Updated tests

Copilot

Pull Request Overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Copilot · 2025-09-13T22:37:52Z

pointtils/src/test/java/com/pointtils/pointtils/src/application/services/AuthServiceTest.java


        // O método logout deve chamar addToBlacklist internamente
-        // Podemos verificar isso através do comportamento esperado
+        // Podemos verificar isso através del comportamento esperado


There's a typo in the Portuguese comment. 'del' should be 'do' (meaning 'of the' in Portuguese).

Suggested change

// Podemos verificar isso através del comportamento esperado

// Podemos verificar isso através do comportamento esperado

Copilot · 2025-09-13T22:37:52Z

...rc/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtAuthenticationFilter.java

+        return requestURI != null && (
+            requestURI.equals("/v1/auth/logout") ||
+            requestURI.startsWith("/v1/auth/logout/") ||
+            requestURI.matches(".*/logout.*")


The regex pattern .*/logout.* is too permissive and could match unintended endpoints like /v1/some-logout-data/protected. Consider using a more specific pattern like ^/v\\d+/auth/logout/?$ to only match exact logout endpoints.

Suggested change

requestURI.matches(".*/logout.*")

requestURI.matches("^/v\\d+/auth/logout/?$")

Copilot · 2025-09-13T22:37:52Z

pointtils/src/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtService.java

+    public boolean isTokenValid(String token) {
+        try {
+            Claims claims = Jwts.parserBuilder()
+                    .setSigningKey(getSignInKey())
+                    .build()
+                    .parseClaimsJws(token)
+                    .getBody();
+
+            // Check if token is expired
+            return !claims.getExpiration().before(new Date());
+        } catch (Exception e) {
+            return false;
+        }
+    }


The method catches all exceptions with a generic Exception which may hide specific JWT validation issues. Consider catching specific JWT exceptions (JwtException, ExpiredJwtException, etc.) and logging the specific error for better debugging while still returning false.

…utenticação - Substitui regex vulnerável .*/logout.* por contains() mais seguro - Adiciona 5 novos testes para JwtAuthenticationFilter - Corrige teste de logout para verificar ambos tokens na blacklist - Garante que access e refresh tokens sejam adicionados à blacklist no logout

Copilot

Pull Request Overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Copilot · 2025-09-18T12:51:40Z

...rc/main/java/com/pointtils/pointtils/src/infrastructure/configs/JwtAuthenticationFilter.java

+            requestURI.startsWith("/v1/auth/logout/") ||
+            requestURI.contains("/logout")


A verificação requestURI.contains("/logout") é muito permissiva e pode ser explorada por atacantes criando URIs como /malicious/logout/endpoint que passariam pela validação. Recomendo usar verificação mais específica como requestURI.matches("^/v\\d+/auth/logout/?$") ou manter apenas as comparações exatas.

Suggested change

requestURI.startsWith("/v1/auth/logout/") ||

requestURI.contains("/logout")

requestURI.startsWith("/v1/auth/logout/")

Copilot · 2025-09-18T12:51:41Z

pointtils/src/main/java/com/pointtils/pointtils/src/application/controllers/JwtController.java

+            throw new com.pointtils.pointtils.src.core.domain.exceptions.AuthenticationException("Refresh token inválido ou expirado");
+        }
+
+        String username = jwtService.getEmailFromToken(request.getRefreshToken());


O método getEmailFromToken() não é chamado após a validação do token em isTokenValid(). Se o token for inválido, este método pode falhar ou retornar dados incorretos. Recomendo validar se o método getEmailFromToken() trata adequadamente tokens inválidos ou mover esta chamada para dentro de um bloco try-catch.

Suggested change

String username = jwtService.getEmailFromToken(request.getRefreshToken());

String username;

try {

username = jwtService.getEmailFromToken(request.getRefreshToken());

} catch (Exception e) {

throw new com.pointtils.pointtils.src.core.domain.exceptions.AuthenticationException("Falha ao extrair usuário do refresh token: " + e.getMessage());

}

Copilot · 2025-09-18T12:51:41Z

pointtils/src/main/java/com/pointtils/pointtils/src/application/services/AuthService.java

        }

        memoryBlacklistService.addToBlacklist(accessToken);
+        memoryBlacklistService.addToBlacklist(refreshToken);


Adicionar o refresh token à blacklist pode ser problemático se o mesmo refresh token for usado para gerar novos access tokens. Considere se é necessário invalidar o refresh token imediatamente ou se deveria ser invalidado apenas quando expirar naturalmente, dependendo da estratégia de rotação de tokens do sistema.

Suggested change

memoryBlacklistService.addToBlacklist(refreshToken);

// Do not blacklist the refresh token here; let it expire naturally or handle via rotation if needed.

Bialves · 2025-09-20T21:49:09Z

@GuilhermeOchoa tudo bem?

Preciso das correções desse PR o quanto antes em dev, pois ela tem ajustes cruciais do login que está barrando outras tarefas (difícil acessar certas telas do frontend sem o fluxo de login funcionando, o que torna necessário nós alterarmos manualmente o código - hardcoded)

pointtils/src/main/java/com/pointtils/pointtils/src/application/dto/TokensDTO.java

sonarqubecloud · 2025-09-20T22:09:01Z

Quality Gate failed

Failed conditions
61.7% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

Fix/login logout endpoints

GuilhermeOchoa added 2 commits September 13, 2025 17:28

GuilhermeOchoa requested a review from a team as a code owner September 13, 2025 17:41

Copilot AI review requested due to automatic review settings September 13, 2025 17:41

Copilot AI reviewed Sep 13, 2025

View reviewed changes

GuilhermeOchoa added 2 commits September 13, 2025 19:31

GuilhermeOchoa requested a review from Copilot September 13, 2025 22:36

Copilot AI reviewed Sep 13, 2025

View reviewed changes

GuilhermeOchoa added 2 commits September 16, 2025 22:52

GuilhermeOchoa requested a review from Copilot September 18, 2025 12:50

GuilhermeOchoa added this to the Sprint 2 milestone Sep 18, 2025

Copilot AI reviewed Sep 18, 2025

View reviewed changes

GuilhermeOchoa assigned femelloffm, Bialves and AugustoPBaldino Sep 18, 2025

GuilhermeOchoa added the dívida técnica label Sep 19, 2025

femelloffm approved these changes Sep 20, 2025

View reviewed changes

Bialves requested changes Sep 20, 2025

View reviewed changes

pointtils/src/main/java/com/pointtils/pointtils/src/application/dto/TokensDTO.java Show resolved Hide resolved

Adiciona JsonProperty em TokensDTO para manter padrao snake case no JSON

f4bf553

femelloffm merged commit 6d62bdb into dev Sep 20, 2025
2 of 3 checks passed

femelloffm linked an issue Sep 20, 2025 that may be closed by this pull request

Criar endpoint para verificar se as credenciais do usuário são válidas #93

Closed

GuilhermeOchoa pushed a commit that referenced this pull request Sep 22, 2025

Merge pull request #94 from PointTils/fix/login-logout-endpoints

3e90dc3

Fix/login logout endpoints

	// Podemos verificar isso através del comportamento esperado
	// Podemos verificar isso através do comportamento esperado

	requestURI.matches("./logout.")
	requestURI.matches("^/v\\d+/auth/logout/?$")

		requestURI.startsWith("/v1/auth/logout/") \|\|
		requestURI.contains("/logout")

	memoryBlacklistService.addToBlacklist(refreshToken);
	// Do not blacklist the refresh token here; let it expire naturally or handle via rotation if needed.

Fix/login logout endpoints #94

Fix/login logout endpoints #94

Uh oh!

Conversation

GuilhermeOchoa commented Sep 13, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

Bialves commented Sep 20, 2025

Uh oh!

Uh oh!

sonarqubecloud bot commented Sep 20, 2025

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants