sechmachine/labtimesheet
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(account): add activation and authentication web flow

Browse Source
This commit is contained in:
sechmachine
2026-08-15 00:45:34 +07:00
parent 98a52a1ac2
commit 8e786ba37b
7 changed files with 397 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/lab/labtimesheet/feature/account/controller/AccountController.java
+85
View File
@@ -0,0 +1,85 @@
package com.lab.labtimesheet.feature.account.controller;
import java.security.Principal;
import java.time.LocalDate;
import com.lab.labtimesheet.feature.account.model.GlobalRole;
import com.lab.labtimesheet.feature.account.model.dto.CreateAccountCommand;
import com.lab.labtimesheet.feature.account.service.AccountService;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
@Controller
class AccountController {
private final AccountService accounts;
AccountController(AccountService accounts) {
this.accounts = accounts;
}
@GetMapping("/admin/accounts/new")
String newAccount() {
return "accounts/new";
}
@PostMapping("/admin/accounts")
String create(
@RequestParam String email,
@RequestParam String displayName,
@RequestParam GlobalRole role,
@RequestParam(required = false) String studentCode,
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate internshipStart,
@RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate internshipEnd,
Principal principal,
Model model) {
try {
var result = accounts.create(
new CreateAccountCommand(
email, displayName, role, clean(studentCode), internshipStart, internshipEnd),
accounts.requireActiveAdminId(principal.getName()));
return result.deliverySucceeded()
? "redirect:/admin/accounts/new?created"
: "redirect:/admin/accounts/new?deliveryFailed";
} catch (IllegalArgumentException | IllegalStateException exception) {
model.addAttribute("error", exception.getMessage());
return "accounts/new";
}
}
private static String clean(String value) {
return value == null || value.isBlank() ? null : value.trim();
}
@GetMapping("/activate")
String activationForm(@RequestParam String token, Model model) {
model.addAttribute("token", token);
return "accounts/activate";
}
@PostMapping("/activate")
String activate(
@RequestParam String token,
@RequestParam String password,
@RequestParam String confirmPassword,
Model model) {
if (!password.equals(confirmPassword)) {
model.addAttribute("token", token);
model.addAttribute("error", "Passwords do not match");
return "accounts/activate";
}
try {
if (accounts.activate(token, password)) {
return "redirect:/login?activated";
}
model.addAttribute("error", "This activation link is invalid or no longer usable");
} catch (IllegalArgumentException exception) {
model.addAttribute("error", exception.getMessage());
}
model.addAttribute("token", token);
return "accounts/activate";
}
}
src/main/resources/templates/accounts/activate.html
+16
View File
@@ -0,0 +1,16 @@
<!doctype html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="utf-8"><title>Activate account</title></head>
<body>
<main>
<h1>Choose your password</h1>
<p th:if="${error}" th:text="${error}" role="alert"></p>
<form method="post" th:action="@{/activate}">
<input name="token" type="hidden" th:value="${token}">
<label>Password <input name="password" type="password" minlength="12" maxlength="128" required autocomplete="new-password"></label>
<label>Confirm password <input name="confirmPassword" type="password" minlength="12" maxlength="128" required autocomplete="new-password"></label>
<button type="submit">Activate account</button>
</form>
</main>
</body>
</html>
src/main/resources/templates/accounts/new.html
+30
View File
@@ -0,0 +1,30 @@
<!doctype html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="utf-8"><title>Create account</title></head>
<body>
<main>
<h1>Create account</h1>
<p th:if="${param.created}" role="status">Account created and activation email sent.</p>
<p th:if="${param.deliveryFailed}" role="alert">Account created, but activation delivery failed.</p>
<p th:if="${error}" th:text="${error}" role="alert"></p>
<form method="post" th:action="@{/admin/accounts}">
<label>Email <input name="email" type="email" required autocomplete="off"></label>
<label>Display name <input name="displayName" required autocomplete="off"></label>
<label>Role
<select name="role" required>
<option value="ADMIN">Admin</option>
<option value="MENTOR">Mentor</option>
<option value="INTERN">Intern</option>
</select>
</label>
<fieldset>
<legend>Intern details</legend>
<label>Student code <input name="studentCode" autocomplete="off"></label>
<label>Internship start <input name="internshipStart" type="date"></label>
<label>Internship end <input name="internshipEnd" type="date"></label>
</fieldset>
<button type="submit">Create account</button>
</form>
</main>
</body>
</html>
src/main/resources/templates/home.html
+7 -2
View File
@@ -1,5 +1,10 @@
<!doctype html>
<html lang="en">
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="utf-8"><title>Lab Timesheet</title></head>
<body><main><h1>Lab Timesheet</h1></main></body>
<body>
<main>
<h1>Lab Timesheet</h1>
<form method="post" th:action="@{/logout}"><button type="submit">Sign out</button></form>
</main>
</body>
</html>
src/test/java/com/lab/labtimesheet/feature/account/controller/AccountWebIntegrationTest.java
+173
View File
@@ -0,0 +1,173 @@
package com.lab.labtimesheet.feature.account.controller;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view;
import java.util.ArrayList;
import java.util.List;
import com.lab.labtimesheet.config.TestcontainersConfiguration;
import com.lab.labtimesheet.feature.account.model.AccountStatus;
import com.lab.labtimesheet.feature.account.model.GlobalRole;
import com.lab.labtimesheet.feature.account.service.AccountService;
import com.lab.labtimesheet.feature.account.service.BootstrapService;
import com.lab.labtimesheet.feature.integration.model.SecurityMode;
import com.lab.labtimesheet.feature.integration.model.dto.SmtpConnection;
import com.lab.labtimesheet.feature.integration.model.dto.SmtpDraft;
import com.lab.labtimesheet.feature.integration.service.SmtpConfigurationService;
import com.lab.labtimesheet.feature.integration.service.SmtpProbe;
import jakarta.servlet.http.HttpSession;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.boot.test.context.TestConfiguration;
import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Import;
import org.springframework.context.annotation.Primary;
import org.springframework.test.annotation.DirtiesContext;
import org.springframework.test.context.ActiveProfiles;
import org.springframework.test.web.servlet.MockMvc;
@Import({TestcontainersConfiguration.class, AccountWebIntegrationTest.MailProbeConfiguration.class})
@SpringBootTest
@AutoConfigureMockMvc
@ActiveProfiles("test")
@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
class AccountWebIntegrationTest {
@Autowired
private MockMvc mockMvc;
@Autowired
private BootstrapService bootstrap;
@Autowired
private AccountService accounts;
@Autowired
private SmtpConfigurationService smtp;
@Autowired
private RecordingSmtpProbe mail;
@BeforeEach
void initializeAdminAndSmtp() {
bootstrap.bootstrap("admin@example.com", "Admin", "correct horse battery staple");
long adminId = accounts.requireActiveAdminId("admin@example.com");
long draftId = smtp.saveDraft(adminId, new SmtpDraft(
"mailpit", 1025, SecurityMode.NONE, null, null, "admin@example.com", "Lab Timesheet"));
smtp.testDraft(draftId, adminId, "admin@example.com");
smtp.activate(draftId, adminId);
mail.messages.clear();
}
@Test
void adminCreatesMentorAndInternThenMentorActivatesAuthenticatesAndLogsOut() throws Exception {
mockMvc.perform(get("/admin/accounts/new").with(user("admin@example.com").roles("ADMIN")))
.andExpect(status().isOk())
.andExpect(view().name("accounts/new"))
.andExpect(content().string(org.hamcrest.Matchers.containsString("Internship start")));
mockMvc.perform(post("/admin/accounts")
.with(user("admin@example.com").roles("ADMIN"))
.with(csrf())
.param("email", " MENTOR@EXAMPLE.COM ")
.param("displayName", "Mentor One")
.param("role", "MENTOR")
.param("studentCode", "")
.param("internshipStart", "")
.param("internshipEnd", ""))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("/admin/accounts/new?created"));
mockMvc.perform(post("/admin/accounts")
.with(user("admin@example.com").roles("ADMIN"))
.with(csrf())
.param("email", "intern@example.com")
.param("displayName", "Intern One")
.param("role", "INTERN")
.param("studentCode", "STU-001")
.param("internshipStart", "2026-08-01")
.param("internshipEnd", "2026-12-31"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("/admin/accounts/new?created"));
var pendingMentor = accounts.requireIdentityByEmail("mentor@example.com");
assertThat(pendingMentor.role()).isEqualTo(GlobalRole.MENTOR);
assertThat(pendingMentor.status()).isEqualTo(AccountStatus.PENDING_ACTIVATION);
assertThat(accounts.requireIdentityByEmail("intern@example.com").role()).isEqualTo(GlobalRole.INTERN);
String rawToken = mail.activationTokenFor("mentor@example.com");
mockMvc.perform(get("/activate").param("token", rawToken))
.andExpect(status().isOk())
.andExpect(view().name("accounts/activate"));
mockMvc.perform(post("/activate")
.with(csrf())
.param("token", rawToken)
.param("password", "new secure mentor password")
.param("confirmPassword", "new secure mentor password"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("/login?activated"));
var login = mockMvc.perform(post("/login")
.with(csrf())
.param("username", " MENTOR@EXAMPLE.COM ")
.param("password", "new secure mentor password"))
.andExpect(status().is3xxRedirection())
.andExpect(authenticated().withUsername("mentor@example.com"))
.andReturn();
HttpSession session = login.getRequest().getSession(false);
assertThat(session).isNotNull();
mockMvc.perform(get("/admin/accounts/new").session((org.springframework.mock.web.MockHttpSession) session))
.andExpect(status().isForbidden());
mockMvc.perform(post("/logout")
.session((org.springframework.mock.web.MockHttpSession) session)
.with(csrf()))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("/login?logout"))
.andExpect(unauthenticated());
}
@TestConfiguration(proxyBeanMethods = false)
static class MailProbeConfiguration {
@Bean
@Primary
RecordingSmtpProbe recordingSmtpProbe() {
return new RecordingSmtpProbe();
}
}
static final class RecordingSmtpProbe implements SmtpProbe {
private final List<Message> messages = new ArrayList<>();
@Override
public void send(SmtpConnection connection, String recipient, String subject, String body) {
messages.add(new Message(recipient, body));
}
String activationTokenFor(String recipient) {
String body = messages.stream()
.filter(message -> message.recipient().equals(recipient))
.findFirst()
.orElseThrow()
.body();
int tokenStart = body.indexOf("token=");
assertThat(tokenStart).isGreaterThanOrEqualTo(0);
return body.substring(tokenStart + "token=".length()).trim();
}
}
record Message(String recipient, String body) {
}
}