Authentication System

Relevant source files

The following files were used as context for generating this wiki page:

• src/main/java/com/example/demo/controllers/AuthController.java
• src/main/java/com/example/demo/services/AuthService.java
• src/main/java/com/example/demo/config/SecurityConfig.java
• src/main/java/com/example/demo/security/JwtUtil.java
• src/main/resources/static/js/api.js
• README.md

The Authentication System in the Dashboard Task Management (DTM) project is a dual-layered security architecture designed to handle both RESTful API interactions and traditional web-based form logins. It utilizes JSON Web Tokens (JWT) for stateless session management within the API and standard Spring Security session management for the HTML-based administrative and dashboard views.

The system ensures that users are authenticated before accessing project resources, such as the Kanban board, task analytics, or file management systems. Roles are assigned during registration, defining the level of access a user has across the platform.

Sources: README.md:32-37, src/main/java/com/example/demo/config/SecurityConfig.java:35-71

System Architecture

The security configuration implements two distinct SecurityFilterChain beans to separate API traffic from web view traffic.

Security Filter Chains

1. API Chain (Order(1)): Intercepts requests to /api/**. It is configured as stateless using SessionCreationPolicy.STATELESS. It disables CSRF and injects a JwtFilter before the standard UsernamePasswordAuthenticationFilter.
2. Web Chain (Order(2)): Handles all other requests. It provides a traditional form-based login at /login and redirects successful logins to the /projects page.

JWT Authentication Mechanism

For API-based interactions, the system uses JWT to maintain state. The JwtUtil class is responsible for the lifecycle of these tokens, including generation and validation.

Token Structure and Lifecycle

Tokens are signed using the HS256 algorithm and contain the user's email as the subject and their assigned role as a claim.

Property	Description	Source
Algorithm	HMAC SHA-256	JwtUtil.java:31
Claims	sub (email), role	JwtUtil.java:28-29
Expiration	Configurable via ${jwt.expiration}	JwtUtil.java:19

Authentication API Endpoints

The AuthController provides public endpoints for user entry into the system.

Endpoint Summary

Method	Path	Description	Access
POST	/api/auth/login	Validates credentials and returns a JWT.	PermitAll
POST	/api/auth/register	Creates a new user with a specific role.	PermitAll
GET	/api/auth/me	Returns details of the currently authenticated user.	Authenticated

Sources: src/main/java/com/example/demo/controllers/AuthController.java:18-28, src/main/java/com/example/demo/controllers/AdminController.java:30-47

Registration Logic

During registration, the system checks if the email already exists in the database. If unique, the password is encoded using BCryptPasswordEncoder before persistence. Users are set to active: true by default.
Sources: src/main/java/com/example/demo/services/AuthService.java:35-51, src/main/java/com/example/demo/config/SecurityConfig.java:73-76

Frontend Integration

The frontend, located in api.js, manages the JWT token for all subsequent REST requests.

Token Management

The client application retrieves the token from localStorage using the key dtm_token. It automatically attaches this token to the Authorization header in the format Bearer <token>.

// src/main/resources/static/js/api.js
const getToken = () => localStorage.getItem('dtm_token');

const headers = (extra = {}) => ({
  'Content-Type': 'application/json',
  ...(getToken() ? { 'Authorization': `Bearer ${getToken()}` } : {}),
  ...extra
});

Sources: src/main/resources/static/js/api.js:7-13

Handling Authentication Failures

The system handles 401 Unauthorized responses by clearing the local token and redirecting the user to the login page.
Sources: src/main/resources/static/js/api.js:18-22

Role-Based Access Control (RBAC)

The system enforces roles defined in the Role enum. Access is controlled via @PreAuthorize annotations in controllers.

Role	Permissions Overview
ADMIN	Full system access, department management, user management.
MANAGER	Department-level analytics, project creation, task management.
PM	Project management for assigned projects.
TEAM	Task execution, commenting, and subtask status updates.

Sources: README.md:15-30, src/main/java/com/example/demo/controllers/AdminController.java:24

Summary

The Authentication System provides a robust foundation for securing the DTM platform. By separating API and Web configurations, it allows for modern stateless mobile/SPA interactions while maintaining a secure server-side rendered management interface. The implementation of JWT ensures that the API layer remains scalable, while the integration with Spring Security's method-level security provides granular control over user actions based on their organizational role.