Application Security Configuration

Relevant source files

The following files were used as context for generating this wiki page:

• Part1/API/src/main/java/com/example/api/security/SecurityConfig.java
• Part1/API/src/main/java/com/example/api/security/CustomUserDetailsService.java
• Part1/API/src/main/java/com/example/api/entity/AppUser.java
• Part1/API/src/main/resources/api-spec.yaml
• Part1/API/src/main/java/com/example/api/config/DataLoader.java

Introduction

The Application Security Configuration for the SafeDispatch HQ Administration API provides a robust framework for managing access to sensitive administrative functions. It implements Role-Based Access Control (RBAC) to ensure that only authorized personnel—specifically users with HR or MANAGER roles—can interact with the system's endpoints. The security architecture is built on Spring Security, utilizing HTTP Basic Authentication and encrypted password storage.

Sources: Part1/API/src/main/resources/api-spec.yaml:1-10, Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:40-52

Authentication Architecture

The system uses a DAO-based authentication provider that verifies credentials against a persistent database. Passwords are secured using the BCrypt hashing algorithm. The authentication flow involves a custom user details service that maps database entities to Spring Security UserDetails objects.

Authentication Flow

The following diagram illustrates the process of a user attempting to authenticate via the API.

Key Components

Component	Responsibility
SecurityConfig	Main configuration class defining the SecurityFilterChain, CSRF settings, and endpoint permissions.
CustomUserDetailsService	Retrieves user credentials and roles from the UserRepository.
BCryptPasswordEncoder	Provides the hashing implementation for secure password storage.
DaoAuthenticationProvider	Integrates the user service and password encoder to validate login attempts.

Sources: Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:16-36, Part1/API/src/main/java/com/example/api/security/CustomUserDetailsService.java:15-20

Role-Based Access Control (RBAC)

The API distinguishes between two primary roles: HR and MANAGER. Access is restricted based on the HTTP method and the endpoint path.

Authorization Rules

The configuration applies a "least privilege" principle where data-modifying operations (POST, PUT, DELETE) are strictly reserved for the HR role.

Endpoint Permissions Table

Path	Method	Required Role
/api/**	GET	HR or MANAGER
/api/**	POST	HR
/api/**	PUT	HR
/api/**	DELETE	HR
All Others	Any	Authenticated

Sources: Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:44-50

Data Security and Initialization

The AppUser entity represents the security principal in the system. To facilitate initial setup, a DataLoader component automatically populates the database with default credentials if no users exist.

Default User Configuration

// Part1/API/src/main/java/com/example/api/config/DataLoader.java:15-28
AppUser hr = new AppUser();
hr.setUsername("hr");
hr.setPassword(passwordEncoder.encode("hr123"));
hr.setRole("HR");
userRepository.save(hr);

AppUser manager = new AppUser();
manager.setUsername("manager");
manager.setPassword(passwordEncoder.encode("manager123"));
manager.setRole("MANAGER");
userRepository.save(manager);

Sources: Part1/API/src/main/java/com/example/api/config/DataLoader.java:15-30

Security Schema (AppUser)

Field	Type	Constraints	Description
username	String	Unique, Non-nullable	The login identifier for the user.
password	String	Non-nullable	BCrypt hashed password string.
role	String	Non-nullable	Either HR or MANAGER.

Sources: Part1/API/src/main/java/com/example/api/entity/AppUser.java:14-22

Summary

The SafeDispatch API security configuration effectively isolates administrative capabilities through Spring Security's filter chain. By enforcing HTTP Basic Auth over HTTPS and strictly separating read/write permissions between HR and Management roles, the system ensures data integrity and operational security for employee and department management.

Sources: Part1/API/src/main/resources/api-spec.yaml:6-15, Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:40-55