Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Extend a Spring Boot 3 API with Spring Security 6: a SecurityFilterChain @Bean (NOT WebSecurityConfigurerAdapter) defining public vs authenticated routes, passwords hashed with BCrypt, and STATELESS JWT authentication; protect endpoints with method security (@PreAuthorize) and roles. Back it with Postgres, manage schema via Flyway (not ddl-auto), keep mutations in @Transactional service methods, and split dev/prod with profiles. Add integration tests with @SpringBootTest + MockMvc and a Testcontainers Postgres.
SecurityFilterChain bean (no adapter); BCrypt; working stateless JWT auth; @PreAuthorize role checks.
Postgres via JPA; Flyway migrations (no prod ddl-auto); @Transactional at the service layer.
dev/prod profiles; secrets/config externalized (@ConfigurationProperties / env), not hardcoded.
@SpringBootTest + MockMvc covering auth paths; Testcontainers (or equivalent) for a real DB in tests.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A JWT-secured API on a real database ## Goal Extend a Spring Boot 3 API with Spring Security 6: a SecurityFilterChain @Bean (NOT WebSecurityConfigurerAdapter) defining public vs authenticated routes, passwords hashed with BCrypt, and STATELESS JWT authentication; protect endpoints with method security (@PreAuthorize) and roles. Back it with Postgres, manage schema via Flyway (not ddl-auto), keep mutations in @Transactional service methods, and split dev/prod with profiles. Add integration tests with @SpringBootTest + MockMvc and a Testcontainers Postgres. ## Acceptance criteria - [ ] Security 6 + JWT: SecurityFilterChain bean (no adapter); BCrypt; working stateless JWT auth; @PreAuthorize role checks. - [ ] Data & transactions: Postgres via JPA; Flyway migrations (no prod ddl-auto); @Transactional at the service layer. - [ ] Profiles & config: dev/prod profiles; secrets/config externalized (@ConfigurationProperties / env), not hardcoded. - [ ] Testing: @SpringBootTest + MockMvc covering auth paths; Testcontainers (or equivalent) for a real DB in tests. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.