Feature/oauth2login

.env.template

@@ -0,0 +1,4 @@
+# GitHub OAuth2 Credentials (DO NOT COMMIT THE ACTUAL .env FILE)
+# Get these from GitHub Settings -> Developer settings -> OAuth Apps
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=

.gitignore

@@ -31,3 +31,8 @@ build/
 
 ### VS Code ###
 .vscode/
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local

pom.xml

@@ -100,6 +100,10 @@
             <groupId>org.thymeleaf.extras</groupId>
             <artifactId>thymeleaf-extras-springsecurity6</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-client</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

src/main/java/org/example/projektarendehantering/infrastructure/config/SecurityConfig.java

@@ -0,0 +1,45 @@
+package org.example.projektarendehantering.infrastructure.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .authorizeHttpRequests(authorize -> authorize
+                .requestMatchers("/login**", "/error**", "/static/**", "/app.css", "/app.js").permitAll()
+                .anyRequest().authenticated()
+            )
+            .oauth2Login(oauth2 -> oauth2
+                .defaultSuccessUrl("/", true)
+            )
+            .formLogin(form -> form
+                .defaultSuccessUrl("/", true)
+            )
+            .logout(logout -> logout
+                .logoutSuccessUrl("/")
+            );
+        return http.build();
+    }
+
+    @Bean
+    public UserDetailsService userDetailsService() {
+        UserDetails admin = User.builder()
+            .username("admin")
+            .password("{noop}password") // {noop} means no password encoding (fine for dev)
+            .roles("ADMIN")
+            .build();
+        return new InMemoryUserDetailsManager(admin);
+    }
+}

src/main/resources/application.properties

@@ -6,4 +6,10 @@ spring.datasource.password=arende
 
 spring.jpa.hibernate.ddl-auto=update
 spring.datasource.driver-class-name=org.postgresql.Driver
-spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
+spring.jpa.database-platform=org.hibernate.dialect.PostgreSQLDialect
+
+# GitHub OAuth2 Login
+spring.security.oauth2.client.registration.github.client-id=${GITHUB_CLIENT_ID:none}
+spring.security.oauth2.client.registration.github.client-secret=${GITHUB_CLIENT_SECRET:none}
+spring.security.oauth2.client.registration.github.scope=read:user,user:email
+logging.level.org.springframework.security=DEBUG

src/main/resources/templates/fragments/header.html

@@ -13,20 +13,15 @@
         </nav>
 
         <div class="auth" id="authBar">
-            <label class="auth-field">
-                <span class="auth-label">X-User-Id</span>
-                <input class="auth-input" id="authUserId" placeholder="uuid" />
-            </label>
-            <label class="auth-field">
-                <span class="auth-label">X-Role</span>
-                <select class="auth-input" id="authRole">
-                    <option value="CASE_OWNER">CASE_OWNER</option>
-                    <option value="HANDLER">HANDLER</option>
-                    <option value="ADMIN">ADMIN</option>
-                    <option value="OTHER">OTHER</option>
-                </select>
-            </label>
-            <button class="button button-secondary" type="button" id="authSave">Save</button>
+            <div th:if="${#authorization.expression('isAuthenticated()')}">
+                <span class="auth-label" th:text="'Logged in as: ' + ${#authentication.name}">User</span>
+                <form th:action="@{/logout}" method="post" style="display: inline;">
+                    <button class="button button-secondary" type="submit">Logout</button>
+                </form>
+            </div>
+            <div th:unless="${#authorization.expression('isAuthenticated()')}">
+                <a th:href="@{/login}" class="button button-secondary">Login</a>
+            </div>
         </div>
     </div>
 </header>

src/test/resources/application.properties

@@ -15,3 +15,7 @@ spring.jpa.show-sql=true
 
 # Disable Docker Compose auto-configuration during tests to avoid connection errors in CI
 spring.docker.compose.enabled=false
+
+spring.security.oauth2.client.registration.github.client-id=mock-id                                                                                 ?
+spring.security.oauth2.client.registration.github.client-secret=mock-secret                                                                 ?
+spring.security.oauth2.client.registration.github.scope=read:user,user:email