RBAC & JWT Security

Relevant source files

The following files were used as context for generating this wiki page:

• src/main/java/com/example/demo/config/SecurityConfig.java
• src/main/java/com/example/demo/security/JwtUtil.java
• src/main/java/com/example/demo/security/JwtFilter.java
• src/main/java/com/example/demo/controllers/AdminController.java
• src/main/java/com/example/demo/services/AdminService.java
• src/main/java/com/example/demo/controllers/ProjectController.java
• src/main/java/com/example/demo/services/AttachmentService.java
• README.md

The security architecture of the Dashboard Task Management (DTM) system is built on a dual-layer strategy using Spring Security. It employs Role-Based Access Control (RBAC) to manage granular permissions across different user types and JSON Web Tokens (JWT) for stateless authentication of REST API requests.

The system distinguishes between traditional web-based form login for HTML templates and token-based authentication for the /api/** endpoints. This ensures that the frontend (Vue.js) can interact securely with the backend while maintaining a standard session-based approach for server-side rendered pages if necessary.

Sources: src/main/java/com/example/demo/config/SecurityConfig.java:34-66, README.md:144-156

Security Architecture Overview

The system implements two distinct SecurityFilterChain beans to handle different types of traffic with specific security requirements.

Dual Filter Chain Configuration

1. API Chain (Order(1)): Specifically targets the /api/** path. It is configured as stateless using SessionCreationPolicy.STATELESS and disables CSRF. It injects a custom JwtFilter before the standard UsernamePasswordAuthenticationFilter.
2. Web Chain (Order(2)): Handles all other requests, including standard login/registration pages and static resources. It uses form-based login and manages sessions for HTML page navigation.

Sources: src/main/java/com/example/demo/config/SecurityConfig.java:38-66

The diagram above illustrates how Spring Security routes requests to the appropriate filter chain based on the URL pattern.

JWT Implementation

JWT is used to facilitate stateless communication. The process involves generating a token upon successful login, which the client stores and sends in subsequent request headers.

Token Lifecycle and Utility

The JwtUtil class is responsible for the technical details of the token, including signing with HS256 and extracting claims.

Feature	Implementation Detail
Algorithm	HMAC SHA-256 (HS256)
Claims	sub (Email), role
Storage	Client-side localStorage
Header	Authorization: Bearer <token>

Sources: src/main/java/com/example/demo/security/JwtUtil.java:13-43, README.md:144-156

Authentication Flow

The JwtFilter intercepts requests to the API, extracts the token, validates it, and sets the security context.

Role-Based Access Control (RBAC)

The application defines specific roles: ADMIN, MANAGER, PM, and TEAM. Access is controlled via @PreAuthorize annotations on controllers and services.

Permission Matrix

Function	ADMIN	MANAGER	PM	TEAM
Manage Departments	✅	❌	❌	❌
Create Projects	✅	✅	❌	❌
Create Tasks	✅	✅	❌	❌
View Analytics	✅	✅	❌	❌
Manage Users	✅	❌	❌	❌
Comment	✅	✅	✅	✅

Sources: README.md:18-42, src/main/java/com/example/demo/controllers/AdminController.java:23-25

Data Scope & Ownership

Security logic extends beyond simple role checks to include data "scope" validation, especially for file attachments and project visibility.

• ADMIN: Full global access to all entities.
• MANAGER: Access restricted to their specific department.
• PM: Access restricted to projects they manage.
• TEAM: Access restricted to tasks specifically assigned to them.

Sources: src/main/java/com/example/demo/services/AttachmentService.java:214-255, src/main/java/com/example/demo/services/AdminService.java:199-211

Controller Security Example

The AdminController is restricted at the class level to the ADMIN role, while others like ProjectController use method-level checks.

@RestController
@RequestMapping("/api/admin")
@PreAuthorize("hasRole('ADMIN')") // Global class restriction
public class AdminController {
    // ... endpoints
}

Sources: src/main/java/com/example/demo/controllers/AdminController.java:23-26

Password Security

User passwords are never stored in plain text. The system uses BCryptPasswordEncoder to hash passwords during registration and user creation.

• Encoder: BCryptPasswordEncoder bean is defined in the security configuration.
• Usage: During createUser in AdminService, the raw password from the DTO is encoded before being set on the User entity.

Sources: src/main/java/com/example/demo/config/SecurityConfig.java:70-73, src/main/java/com/example/demo/services/AdminService.java:108-111

Conclusion

The RBAC & JWT security system provides a robust framework for multi-tenant task management. By separating API and Web security concerns and enforcing strict role/department boundaries in the service layer, the project ensures that sensitive corporate data remains accessible only to authorized personnel based on their specific organizational role.