Add password to user

Author: jordivilagut

README.md

@@ -5,3 +5,15 @@ Seed is a RESTful API template.
 `docker-compose -f docker-compose.yml up -d`
 
 Make sure your .env variables are properly set in your IDE before running the app.
+
+## Password Encryption
+
+This application uses BCrypt for password encryption. All passwords are automatically encrypted before being stored in the database.
+
+### Features:
+- **Automatic Encryption**: Passwords are encrypted using BCrypt when creating users
+- **Secure Hashing**: BCrypt provides salt and cost factor for enhanced security
+- **Password Verification**: Built-in methods to verify passwords during login
+
+### Security Configuration
+The application includes a `SecurityConfig` that disables default Spring Security authentication while keeping BCrypt available for password encoding.

build.gradle.kts

@@ -23,6 +23,7 @@ dependencies {
     implementation("org.springframework.boot:spring-boot-starter")
     implementation("org.springframework.boot:spring-boot-starter-web")
     implementation("org.springframework.boot:spring-boot-starter-data-jpa")
+    implementation("org.springframework.boot:spring-boot-starter-security")
     implementation("org.jetbrains.kotlin:kotlin-reflect")
     implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
     runtimeOnly("org.postgresql:postgresql")

src/main/kotlin/studio/vitr/seed/adapter/UserAdapter.kt

@@ -4,19 +4,23 @@ import org.springframework.stereotype.Component
 import studio.vitr.seed.constants.Properties.ID
 import studio.vitr.seed.errors.InvalidParameter
 import studio.vitr.seed.model.User
-import studio.vitr.seed.model.api.UserRequest
+import studio.vitr.seed.model.api.CreateUserRequest
 import studio.vitr.seed.model.api.UserResponse
+import studio.vitr.seed.service.PasswordEncoderService
 
 @Component
-class UserAdapter {
+class UserAdapter(
+    private val passwordEncoderService: PasswordEncoderService
+) {
 
-    fun toUser(request: UserRequest) = User(
-        githubUserId = request.githubUserId
+    fun toUser(r: CreateUserRequest) = User(
+        email = r.email,
+        password = passwordEncoderService.encodePassword(r.password),
     )
 
-    fun toUserResponse(user: User) = UserResponse(
-        id = user.id ?: throw InvalidParameter(ID),
-        githubUserId = user.githubUserId,
-        createdAt = user.createdAt,
+    fun toUserResponse(u: User) = UserResponse(
+        id = u.id ?: throw InvalidParameter(ID),
+        email = u.email,
+        createdAt = u.createdAt,
     )
 }

src/main/kotlin/studio/vitr/seed/config/SecurityConfig.kt

@@ -0,0 +1,18 @@
+package studio.vitr.seed.config
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.web.SecurityFilterChain
+
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    fun filterChain(http: HttpSecurity): SecurityFilterChain = http
+        .csrf { it.disable() }
+        .authorizeHttpRequests { it.anyRequest().permitAll() }
+        .build()
+}

src/main/kotlin/studio/vitr/seed/controller/UserController.kt

@@ -4,7 +4,9 @@ import org.springframework.web.bind.annotation.*
 import studio.vitr.seed.adapter.UserAdapter
 import studio.vitr.seed.constants.Properties.USER
 import studio.vitr.seed.errors.NotFound
-import studio.vitr.seed.model.api.UserRequest
+import studio.vitr.seed.model.api.CreateUserRequest
+import studio.vitr.seed.model.api.PasswordVerificationRequest
+import studio.vitr.seed.model.api.PasswordVerificationResponse
 import studio.vitr.seed.service.UserService
 import java.util.UUID
 
@@ -25,10 +27,19 @@ class UserController(
         ?: throw NotFound(USER, userId.toString())
 
     @PostMapping
-    fun createUser(@RequestBody request: UserRequest) = userAdapter
+    fun createUser(@RequestBody request: CreateUserRequest) = userAdapter
         .toUser(request)
         .let { userService.create(it) }
 
     @DeleteMapping("/{userId}")
     fun deleteUser(@PathVariable userId: UUID) = userService.delete(userId)
-}
+        
+    @PostMapping("/{userId}/verify-password")
+    fun verifyPassword(
+        @PathVariable userId: UUID,
+        @RequestBody request: PasswordVerificationRequest
+    ): PasswordVerificationResponse {
+        val isValid = userService.verifyPassword(userId, request.password)
+        return PasswordVerificationResponse(isValid = isValid)
+    }
+}

src/main/kotlin/studio/vitr/seed/model/User.kt

@@ -12,5 +12,6 @@ import jakarta.persistence.GenerationType.UUID as UUIDX
 data class User(
     @Id @GeneratedValue(strategy = UUIDX) val id: UUID? = null,
     val email: String,
+    val password: String,
     val createdAt: Long = System.currentTimeMillis(),
 )

src/main/kotlin/studio/vitr/seed/model/api/CreateUserRequest.kt

@@ -0,0 +1,6 @@
+package studio.vitr.seed.model.api
+
+class CreateUserRequest(
+    val email: String,
+    val password: String,
+)

src/main/kotlin/studio/vitr/seed/model/api/PasswordVerificationRequest.kt

@@ -0,0 +1,5 @@
+package studio.vitr.seed.model.api
+
+data class PasswordVerificationRequest(
+    val password: String
+)

src/main/kotlin/studio/vitr/seed/model/api/PasswordVerificationResponse.kt

@@ -0,0 +1,5 @@
+package studio.vitr.seed.model.api
+
+data class PasswordVerificationResponse(
+    val isValid: Boolean
+)