Stateless auth with JWT

<dependency>
  <groupId>io.jsonwebtoken</groupId><artifactId>jjwt-api</artifactId><version>0.12.6</version>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId><artifactId>jjwt-impl</artifactId><version>0.12.6</version><scope>runtime</scope>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId><artifactId>jjwt-jackson</artifactId><version>0.12.6</version><scope>runtime</scope>
</dependency>

# a long, secret string (>= 32 chars for HS256). In real apps: an env var, never committed.
app.jwt.secret=change-me-to-a-very-long-random-secret-at-least-32-bytes
app.jwt.expiration-ms=3600000     # token valid 1 hour

package com.example.taskflow.security;

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import javax.crypto.SecretKey;
import java.util.Date;

@Service
public class JwtService {

    private final SecretKey key;
    private final long expirationMs;

    public JwtService(@Value("${app.jwt.secret}") String secret, @Value("${app.jwt.expiration-ms}") long expirationMs) {
        this.key = Keys.hmacShaKeyFor(secret.getBytes());   // build the signing key
        this.expirationMs = expirationMs;
    }

    // MINT: called at login
    public String generate(String email, String role) {
        Date now = new Date();
        return Jwts.builder().subject(email)                              // who
        .claim("role", role)                         // their role
        .issuedAt(now).expiration(new Date(now.getTime() + expirationMs)).signWith(key)                               // sign with the secret
        .compact();
    }

    // VERIFY: called on every request; throws if invalid/expired
    public Claims parse(String token) {
        return Jwts.parser().verifyWith(key).build().parseSignedClaims(token).getPayload();
    }
}

package com.example.taskflow.security;

import io.jsonwebtoken.Claims;
import jakarta.servlet.*;
import jakarta.servlet.http.*;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.List;

@Component
public class JwtAuthFilter extends OncePerRequestFilter {

    private final JwtService jwt;
    public JwtAuthFilter(JwtService jwt) { this.jwt = jwt; }

    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws ServletException, IOException {
        String header = req.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            try {
                Claims claims = jwt.parse(header.substring(7));       // drop "Bearer "
                String email = claims.getSubject();
                String role  = claims.get("role", String.class);

                var auth = new UsernamePasswordAuthenticationToken(email, null, List.of(new SimpleGrantedAuthority("ROLE_" + role)));   // grant the role
                SecurityContextHolder.getContext().setAuthentication(auth);     // "logged in"
            } catch (Exception e) {
                SecurityContextHolder.clearContext();   // bad/expired token -> stay anonymous
            }
        }
        chain.doFilter(req, res);                        // continue down the chain
    }
}

@Configuration
public class SecurityConfig {

    private final JwtAuthFilter jwtFilter;
    public SecurityConfig(JwtAuthFilter jwtFilter) { this.jwtFilter = jwtFilter; }

    @Bean PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); }

    @Bean
    public AuthenticationManager authManager(AuthenticationConfiguration cfg) throws Exception {
        return cfg.getAuthenticationManager();          // used by /auth/login
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(AbstractHttpConfigurer::disable).sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS)).authorizeHttpRequests(auth -> auth.requestMatchers("/auth/**").permitAll()                 // register + login public
        .requestMatchers(HttpMethod.DELETE, "/tasks/**").hasRole("ADMIN").requestMatchers("/tasks/**").hasAnyRole("USER", "ADMIN").anyRequest().authenticated()) // run our JWT filter before Spring's username/password filter
        .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();     // note: no httpBasic() now — tokens replace it
    }
}

// AuthService (now also holds AuthenticationManager + JwtService)
public String login(String email, String rawPassword) {
    authManager.authenticate(                              // verifies password via UserDetailsService + BCrypt
    new UsernamePasswordAuthenticationToken(email, rawPassword));
    AppUser u = users.findByEmail(email).orElseThrow();
    return jwt.generate(u.getEmail(), u.getRole().name()); // mint the token
}

// AuthController
public record LoginRequest(String email, String password) { }

@PostMapping("/login")
public Map<String,String> login(@RequestBody LoginRequest req) {
    return Map.of("token", auth.login(req.email(), req.password()));
}