security hardening #12

2026-05-05T17:02:47+02:00

Cedric commented

2026-05-05 17:02:47 +02:00

No description provided.

Cedric added 15 commits 2026-05-05 17:02:48 +02:00

docs: add security hardening design spec e3b8917bfc

Covers input validation, JWT-based authorization enforcement, and
per-user rate limiting via Bucket4j.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add security hardening implementation plan efe84942ff

8-task TDD plan covering input validation, JWT-based authorization
enforcement, and Bucket4j rate limiting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

build: add spring-boot-starter-validation and bucket4j-core b7db35defe

feat: add Bean Validation annotations to request models 3bea06fead

feat: add GlobalExceptionHandler, @Valid to user creation, AuthenticatedUserResolver stub, and rewrite ExpenseListController with authorization a948bca2fc

feat: add ExpenseListController validation and authorization tests bb2a4d70b2

test: add unit tests for AuthenticatedUserResolver 95688e5111

security: enforce JWT-based authorization on AppUserController 457efab452

Added AuthenticatedUserResolver injection and assertSelf guard to
getUser, getUserByGoogleId, and deleteUser endpoints. createUser
remains open for registration. Added 7 controller tests covering
validation failures and 403 enforcement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

security: add per-user/IP rate limiting via Bucket4j 024b3880e7

RateLimitFilter (OncePerRequestFilter) enforces 60 req/min per
authenticated Google ID or client IP, using Bucket4j in-memory
token buckets. Filter is registered after BearerTokenAuthenticationFilter
in the production security chain. Added 4 unit tests covering
allow, block, per-IP isolation, and X-Forwarded-For preference.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test: fix ExpenseListRepositoryTest with H2 and proper save-then-find pattern 9c91da9f30

Added H2 as a test-scoped dependency so @DataJpaTest has an embedded
database. Rewrote the test to save an entity and assert on the returned
ID rather than assuming a record exists at ID=1.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: throw ResourceNotFoundException instead of returning null, replace full-table-scan list queries with JPQL 68783cc892

fix: single-param JPQL queries, ResourceNotFoundException throughout ExpenseListService, remove addExpenseToList loop 906b60d264

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: use ResourceNotFoundException for not-found cases in updateExpense, IllegalArgumentException for ownership mismatch in deleteCustomCategory 797d482ebf

Remove docs from tracking 2bd229cc5e

fix: add /docs/superpowers to .gitignore 9b95741292

Cedric merged commit 19c7e1915f into main

2026-05-05 17:13:54 +02:00

Cedric deleted branch feature/security-hardening

2026-05-05 17:22:36 +02:00

Cedric referenced this issue from a commit

2026-05-10 20:30:02 +02:00

chore: resolve merge conflicts, keep Spring Boot 4.0.6 version

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Cedric/XpenselyServer#12