Locking it down — Spring Security & Basic Auth

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

package com.example.taskflow.model;

import jakarta.persistence.*;
import lombok.*;

@Entity @Table(name = "users")
@Getter @Setter @NoArgsConstructor @AllArgsConstructor
public class AppUser {

    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, unique = true)
    private String email;

    @Column(nullable = false)
    private String password;          // stored as a BCrypt hash, never plaintext

    @Enumerated(EnumType.STRING)
    @Column(nullable = false)
    private Role role;                // USER or ADMIN
}

package com.example.taskflow.model;

public enum Role { USER, ADMIN }

package com.example.taskflow.repository;

import com.example.taskflow.model.AppUser;
import org.springframework.data.jpa.repository.JpaRepository;
import java.util.Optional;

public interface AppUserRepository extends JpaRepository<AppUser, Long> {
    Optional<AppUser> findByEmail(String email);   // login looks users up by email
}

package com.example.taskflow.security;

import com.example.taskflow.model.AppUser;
import com.example.taskflow.repository.AppUserRepository;
import org.springframework.security.core.userdetails.*;
import org.springframework.stereotype.Service;

@Service
public class AppUserDetailsService implements UserDetailsService {

    private final AppUserRepository users;
    public AppUserDetailsService(AppUserRepository users) { this.users = users; }

    @Override
    public UserDetails loadUserByUsername(String email) {
        AppUser u = users.findByEmail(email).orElseThrow(() -> new UsernameNotFoundException("No user: " + email));

        // hand Security the email, the stored hash, and the role as an authority
        return User.withUsername(u.getEmail()).password(u.getPassword())            // the BCrypt hash
        .roles(u.getRole().name())            // "USER" -> authority ROLE_USER
        .build();
    }
}

package com.example.taskflow.security;

import org.springframework.context.annotation.*;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.config.Customizer;

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();          // the hashing algorithm, as a bean
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http // APIs don't use browser form sessions/CSRF; turn CSRF off for a stateless JSON API
        .csrf(AbstractHttpConfigurer::disable).authorizeHttpRequests(auth -> auth // PUBLIC: anyone can register
        .requestMatchers(HttpMethod.POST, "/auth/register").permitAll() // ADMIN only: deleting tasks
        .requestMatchers(HttpMethod.DELETE, "/tasks/**").hasRole("ADMIN") // any logged-in user: everything else under /tasks
        .requestMatchers("/tasks/**").hasAnyRole("USER", "ADMIN") // everything not matched above must at least be authenticated
        .anyRequest().authenticated()).httpBasic(Customizer.withDefaults());     // use HTTP Basic Auth

        return http.build();
    }
}

package com.example.taskflow.service;

import com.example.taskflow.model.*;
import com.example.taskflow.repository.AppUserRepository;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

@Service
public class AuthService {

    private final AppUserRepository users;
    private final PasswordEncoder encoder;      // injected bean from SecurityConfig

    public AuthService(AppUserRepository users, PasswordEncoder encoder) {
        this.users = users; this.encoder = encoder;
    }

    public AppUser register(String email, String rawPassword, Role role) {
        if (users.findByEmail(email).isPresent()) throw new IllegalStateException("Email already registered");

        AppUser u = new AppUser();
        u.setEmail(email);
        u.setPassword(encoder.encode(rawPassword));       // hash it — the key line
        u.setRole(role == null ? Role.USER : role);       // default USER
        return users.save(u);
    }
}

public record RegisterRequest(String email, String password, Role role) { }

@RestController
@RequestMapping("/auth")
public class AuthController {
    private final AuthService auth;
    public AuthController(AuthService auth) { this.auth = auth; }

    @PostMapping("/register")
    public Map<String,String> register(@RequestBody RegisterRequest req) {
        auth.register(req.email(), req.password(), req.role());
        return Map.of("status", "registered", "email", req.email());
    }
}

@WebMvcTest(TaskController.class)
class TaskSecurityTest {

    @Autowired MockMvc mvc;
    @MockitoBean TaskService service;

    @Test
    @WithMockUser(roles = "USER")            // pretend a logged-in USER
    void user_cannot_delete() throws Exception {
        mvc.perform(delete("/tasks/1")).andExpect(status().isForbidden());
    }

    @Test
    @WithMockUser(roles = "ADMIN")           // pretend a logged-in ADMIN
    void admin_can_delete() throws Exception {
        mvc.perform(delete("/tasks/1")).andExpect(status().isOk());
    }
}