Authentication & User Details

Relevant source files

The following files were used as context for generating this wiki page:

• Part1/API/src/main/java/com/example/api/security/CustomUserDetailsService.java
• Part1/API/src/main/java/com/example/api/entity/AppUser.java
• Part1/API/src/main/java/com/example/api/security/SecurityConfig.java
• Part1/API/src/main/java/com/example/api/config/DataLoader.java
• Part1/API/src/main/java/com/example/api/repository/UserRepository.java
• Part1/API/src/main/resources/api-spec.yaml

Introduction

The Authentication and User Details system provides a secure foundation for the SafeDispatch HQ Administration API. It implements Role-Based Access Control (RBAC) to ensure that only authorized administrative personnel can access sensitive organizational data. The system is built using Spring Security and utilizes HTTP Basic Authentication over HTTPS to protect credentials.

The scope of this module covers user identity persistence, credential verification through password hashing, and the enforcement of authorization rules across various API endpoints. Access is primarily divided between two administrative roles: HR and MANAGER.
Sources: Part1/API/src/main/resources/api-spec.yaml:4-8, Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:44-49

Security Architecture & Configuration

The security infrastructure is defined in the SecurityConfig class, which establishes the authentication provider and the security filter chain. The system uses a DaoAuthenticationProvider integrated with a custom user details service and BCrypt password encoding.

Authentication Flow

The following sequence diagram illustrates the authentication process when a user attempts to access a protected resource:

The system leverages DaoAuthenticationProvider to bridge the gap between the stored user entities and Spring Security's requirement for UserDetails.
Sources: Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:31-36, Part1/API/src/main/java/com/example/api/security/CustomUserDetailsService.java:27-37

User Data Model

The system distinguishes between application users (AppUser) and organizational employees. AppUser entities are specifically designated for Spring Security authentication.

AppUser Entity Fields

Field	Type	Constraints	Description
id	Long	Primary Key, Identity	Unique identifier for the security user.
username	String	Unique, Non-nullable	The login identifier for the administrator.
password	String	Non-nullable	BCrypt hashed password.
role	String	Non-nullable	Permission level: HR or MANAGER.

Sources: Part1/API/src/main/java/com/example/api/entity/AppUser.java:10-23

Role-Based Access Control (RBAC)

Authorization is enforced at the request level, with specific HTTP methods and URL patterns mapped to required roles.

Access Control Matrix

Resource Path	HTTP Method	Required Role	Description
/api/**	GET	MANAGER or HR	Viewing employees, departments, and assignments.
/api/**	POST	HR	Creating new records.
/api/**	PUT	HR	Updating existing records or promoting employees.
/api/**	DELETE	HR	Removing records.
All other paths	ANY	Authenticated	Fallback for any other system requests.

Sources: Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:44-49, Part1/API/src/main/resources/api-spec.yaml:104-120

User Provisioning

The system includes a DataLoader component that automatically initializes the database with default administrative accounts if no users exist. This ensures the API is immediately accessible upon deployment.

// Default users created during initialization
AppUser hr = new AppUser();
hr.setUsername("hr");
hr.setPassword(passwordEncoder.encode("hr123"));
hr.setRole("HR");

AppUser manager = new AppUser();
manager.setUsername("manager");
manager.setPassword(passwordEncoder.encode("manager123"));
manager.setRole("MANAGER");

Sources: Part1/API/src/main/java/com/example/api/config/DataLoader.java:18-32

Error Handling

Authentication failures are handled by returning a 401 Unauthorized status code. This is configured via a HttpStatusEntryPoint in the security filter chain to prevent standard browser login redirects and provide clean API responses.
Sources: Part1/API/src/main/java/com/example/api/security/SecurityConfig.java:52-54

Summary

The Authentication & User Details system ensures that SafeDispatch HQ data is protected through a robust implementation of Spring Security. By separating authentication users (AppUser) from employee records and enforcing strict RBAC via SecurityConfig, the system limits sensitive operations like creation, modification, and deletion to users with the HR role, while allowing MANAGERS read-only visibility into organization operations.