Merge branch 'main' into personal/heshunme/auth-restart-1

pom.xml

@@ -50,10 +50,25 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-data-jpa</artifactId>
 		</dependency>
-<!--		<dependency>-->
-<!--			<groupId>org.springframework.boot</groupId>-->
-<!--			<artifactId>spring-boot-starter-security</artifactId>-->
-<!--		</dependency>-->
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>io.jsonwebtoken</groupId>
+			<artifactId>jjwt-api</artifactId>
+			<version>0.11.5</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jsonwebtoken</groupId>
+			<artifactId>jjwt-impl</artifactId>
+			<version>0.11.5</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jsonwebtoken</groupId>
+			<artifactId>jjwt-jackson</artifactId>
+			<version>0.11.5</version>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>

src/main/java/org/cmh/backend/Config/CorsConfig.java

@@ -1,26 +0,0 @@
-package org.cmh.backend.Config;
-// CorsConfig.java
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.CorsRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-
-@Configuration
-public class CorsConfig {
-
-    @Bean
-    public WebMvcConfigurer corsConfigurer() {
-        return new WebMvcConfigurer() {
-            @Override
-            public void addCorsMappings(CorsRegistry registry) {
-                registry.addMapping("/**")
-                        .allowedOrigins("http://localhost:8080")
-                        .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
-                        .allowedHeaders("*")
-                        .allowCredentials(true);
-            }
-        };
-    }
-}
-

src/main/java/org/cmh/backend/Config/SecurityConfig.java

@@ -0,0 +1,23 @@
+package org.cmh.backend.Config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        // Use the new API to disable CSRF
+        http.csrf(AbstractHttpConfigurer::disable)
+                // Permit all requests
+                .authorizeHttpRequests(authorize -> authorize
+                        .anyRequest().permitAll()
+                );
+
+        return http.build();
+    }
+}

src/main/java/org/cmh/backend/Utils/JwtUtil.java

@@ -0,0 +1,39 @@
+package org.cmh.backend.Utils;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import io.jsonwebtoken.security.Keys;
+
+import javax.crypto.SecretKey;
+import java.util.Date;
+
+public class JwtUtil {
+
+    private static final SecretKey SECRET_KEY = Keys.hmacShaKeyFor("9cbf491e853995ab73a2a3dcd7206549".getBytes());
+
+    public static String generateToken(String username) {
+        return Jwts.builder()
+                .setSubject(username)
+                .setIssuedAt(new Date())
+                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10)) // 10 hours
+                .signWith(SECRET_KEY, SignatureAlgorithm.HS256)
+                .compact();
+    }
+
+    public static Claims extractClaims(String token) {
+        return Jwts.parserBuilder()
+                .setSigningKey(SECRET_KEY)
+                .build()
+                .parseClaimsJws(token)
+                .getBody();
+    }
+
+    public static boolean isTokenValid(String token, String username) {
+        return username.equals(extractClaims(token).getSubject()) && !isTokenExpired(token);
+    }
+
+    private static boolean isTokenExpired(String token) {
+        return extractClaims(token).getExpiration().before(new Date());
+    }
+}

src/test/java/org/cmh/backend/Utils/JwtUtilTest.java

@@ -0,0 +1,47 @@
+package org.cmh.backend.Utils;
+
+import io.jsonwebtoken.Claims;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.Date;
+
+public class JwtUtilTest {
+
+    @Test
+    public void testGenerateToken() throws InterruptedException {
+        String username = "testUser";
+        String token = JwtUtil.generateToken(username);
+        Thread.sleep(100);
+
+        // Validate token is not empty
+        Assert.assertNotNull("Token should not be null", token);
+        Assert.assertFalse("Token should not be empty", token.isEmpty());
+
+        // Parse the token to check claims
+        Claims claims = JwtUtil.extractClaims(token);
+//        System.out.println(claims.getIssuedAt().toString());
+
+
+        // Validate claims
+        Assert.assertTrue("Token should be valid", JwtUtil.isTokenValid(token, username));
+        Assert.assertEquals("Username in claims should match", username, claims.getSubject());
+        Assert.assertTrue("Token should be issued in the past", new Date().after(claims.getIssuedAt()));
+        Assert.assertTrue("Token expiration should be in the future", new Date().before(claims.getExpiration()));
+    }
+
+    @Test
+    public void testTokenExpiration() {
+        String username = "testUser";
+        String token = JwtUtil.generateToken(username);
+
+        Claims claims = JwtUtil.extractClaims(token);
+
+        long expirationTime = claims.getExpiration().getTime();
+        long currentTime = new Date().getTime();
+
+        // Validate token expires within 10 hours
+        Assert.assertTrue("Token should expire within 10 hours", expirationTime - currentTime <= 1000 * 60 * 60 * 10);
+    }
+}
+