Access Request and Provisioning System

Backend API for submitting, approving, provisioning, revoking, expiring, and auditing access to internal resources such as VPN, GitLab, Jira, and HR systems.

What it does

• employees submit access requests for internal resources
• managers or admins approve or reject submitted requests
• admins provision and revoke approved access
• scheduled expiry marks overdue provisioned access as expired
• audit logs track login attempts and access lifecycle events
• role-based authorization restricts visibility and actions by user type

Roles

• ADMIN
• MANAGER
• EMPLOYEE

Core workflow

1. employee submits a request
2. manager or admin approves or rejects it
3. admin provisions approved access
4. admin can revoke provisioned access
5. scheduler expires overdue provisioned access
6. audit log records key events across the lifecycle

Tech stack

• Java 25
• Spring Boot 3
• Spring Web
• Spring Data JPA
• Spring Security
• PostgreSQL
• Flyway
• springdoc OpenAPI
• JUnit 5
• Mockito
• Testcontainers
• Docker Compose

Local run

Start PostgreSQL

docker compose up -d

Run the app

./mvnw spring-boot:run

On Windows PowerShell:

.\mvnw.cmd spring-boot:run

Open Swagger

• http://localhost:8080/swagger-ui.html

Health endpoint

• http://localhost:8080/actuator/health

Seeded dev accounts

These are created by the dev initializer outside the test profile:

• admin / Password123!
• manager / Password123!
• employee / Password123!

Main endpoints

Auth

• POST /api/auth/login

Users

• GET /api/users
• POST /api/users
• PATCH /api/users/{id}/status
• PATCH /api/users/{id}/manager

Resources

• GET /api/resources
• POST /api/resources
• PATCH /api/resources/{id}

Access requests

• POST /api/requests
• GET /api/requests
• GET /api/requests/{id}
• PATCH /api/requests/{id}/approve
• PATCH /api/requests/{id}/reject
• PATCH /api/requests/{id}/provision
• PATCH /api/requests/{id}/revoke

Audit

• GET /api/audit-logs

Authorization rules

• admins can manage users and resources, provision and revoke access, and view audit logs
• managers can view their own requests and direct reports’ requests, and approve or reject direct reports’ requests
• employees can create requests and view only their own requests

Database

Flyway manages the schema from versioned SQL migrations.

Core tables:

• roles
• app_users
• resources
• access_requests
• approvals
• provisioning_events
• audit_logs

Tests

This project includes:

• unit tests for business rules and expiry logic
• integration tests with Testcontainers and PostgreSQL
• full lifecycle coverage for submit, approve, provision, and revoke
• security and visibility checks by role
• integration tests require Docker/Testcontainers to be available from the environment running Maven

Run tests with:

./mvnw test

On Windows PowerShell:

.\mvnw.cmd test

Example API flow

1. login as employee and create a request
2. login as manager and approve it
3. login as admin and provision it
4. login as admin and revoke it
5. query audit logs as admin

Why this project exists

This project was built to demonstrate real Spring Boot backend work instead of generic CRUD. It focuses on workflow, authorization, state transitions, auditability, scheduled background behavior, validation, SQL schema management, and test coverage.