Authentication and JWT

Authentication and JWT

The API uses stateless JWT bearer authentication (Spring Security resource server). There is no registration — login is the only entry point, and accounts are seeded by Flyway.

Login

POST /api/auth/login with { username, password }:

1. AuthService loads the user (AppUserDetailsService / AppUserRepository).
2. The password is verified with BCrypt, run off the event loop (Dispatchers.Default) so the reactive threads aren't blocked.
3. On success, JwtService mints an HS256 JWT.

Response: { accessToken, tokenType: "Bearer", expiresIn, username, role }. Bad credentials return 401 (Invalid username or password) — the same response whether or not the user exists, to avoid user enumeration.

The token

Claims: sub (username), roles (e.g. ["ADMIN"]), iss (customermanagement), iat, exp (1 hour). Signed with HS256 using JWT_SECRET (must be ≥ 32 bytes, or the app fails fast at startup).

Validating a request

Send Authorization: Bearer <token>. The resource server's NimbusReactiveJwtDecoder:

• verifies the signature (HS256),
• enforces expiry and the issuer (customermanagement),
• maps the roles claim to Spring authorities ROLE_USER / ROLE_ADMIN (via JwtGrantedAuthoritiesConverter).

Missing/invalid token → 401; valid token but insufficient role → 403.

Authorization

Per-endpoint roles are enforced with method security (@PreAuthorize + @EnableReactiveMethodSecurity):

• ADMIN — create / update / delete customers, /api/admin/**.
• USER + ADMIN — read customers, /api/me.

Self-service password change

POST /api/auth/change-password with { currentPassword, newPassword } — any authenticated user, for their own account (the username comes from the token, never the body). Verifies the current password, requires the new one to differ and be 8–100 chars, updates with a targeted UPDATE, returns 204. 400 for wrong-current / reused / too-short.

Seeded accounts

Username	Password	Role
admin	admin123	ADMIN
user	user123	USER

See Architecture for the end-to-end auth sequence diagram, and Rate Limiting for the strict limit on the login endpoint.