Pr 15

[VonAdamo]

Summary by CodeRabbit

Release Notes

• Security

  • Upgraded authentication to form-based login with encrypted password storage
  • Enhanced endpoint access controls with role-based permissions

• Bug Fixes

  • Improved error handling returns proper HTTP 404 responses for missing resources

• New Features

  • Standardized API response format with timestamps for all endpoints

• Tests

  • Added authentication requirement validation for protected endpoints

[coderabbitai]

Warning

Rate limit exceeded

@VonAdamo has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 53 minutes and 15 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4b598e91-a8e4-4f91-9314-27579a06364e

📥 Commits

Reviewing files that changed from the base of the PR and between 6f80bcd and 07109b5.

📒 Files selected for processing (1)

• src/main/java/org/group1/projectbackend/controller/ActivityLogController.java

📝 Walkthrough

Walkthrough

This PR implements form-login Spring Security authentication with database-backed user credentials and role-based access control, replacing basic auth and in-memory users. It introduces a custom UserDetailsService, encrypts stored passwords with BCrypt, seeds users with roles, adds exception handling to the ActivityLogController with endpoint renaming, creates a generic ApiResponse wrapper, and includes security tests for unauthenticated endpoints.

Changes

Cohort / File(s)	Summary
Security Configuration & User Management src/main/java/org/group1/projectbackend/config/DataInitializer.java, src/main/java/org/group1/projectbackend/security/SecurityConfig.java, src/main/java/org/group1/projectbackend/security/CustomUserDetailsService.java	Migrates from in-memory basic auth to form-login with database-backed credentials; injects PasswordEncoder in DataInitializer to encode seeded user passwords; introduces new CustomUserDetailsService implementing UserDetailsService with role derivation logic; updates SecurityConfig with BCrypt bean, explicit endpoint authorization rules, and removes hardcoded in-memory user provisioning.
API Response & Controller Updates src/main/java/org/group1/projectbackend/dto/ApiResponse.java, src/main/java/org/group1/projectbackend/controller/ActivityLogController.java	Adds new generic ApiResponse<T> DTO with auto-timestamped responses; refactors ActivityLogController to catch ResourceNotFoundException (404 returns), simplifies method implementations, renames endpoints (getActivityLogsBySupportTicketId → getByTicket, getActivityLogsByUserId → getByUser), and changes getByTicket sort default from "desc" to "asc".
Service & Test Updates src/main/java/org/group1/projectbackend/service/ActivityLogService.java, src/test/java/org/group1/projectbackend/controller/DocumentControllerTest.java, src/test/java/org/group1/projectbackend/controller/SupportTicketControllerTest.java	Formats ActivityLogService method spacing; adds security tests verifying unauthenticated requests to document upload and ticket creation endpoints return HTTP 401.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant SecurityFilter as Security Filter<br/>(Form Login)
    participant CustomUserDetailsService
    participant UserRepository
    participant PasswordEncoder
    participant UserDetails as Spring<br/>UserDetails

    Client->>SecurityFilter: POST /login (username, password)
    SecurityFilter->>CustomUserDetailsService: loadUserByUsername(username)
    CustomUserDetailsService->>UserRepository: findByUsername(username)
    UserRepository-->>CustomUserDetailsService: User + Roles
    CustomUserDetailsService->>CustomUserDetailsService: Derive roles (strip "ROLE_" prefix)
    CustomUserDetailsService->>UserDetails: Build UserDetails<br/>(username, password, roles)
    UserDetails-->>CustomUserDetailsService: UserDetails instance
    CustomUserDetailsService-->>SecurityFilter: UserDetails
    SecurityFilter->>PasswordEncoder: matches(input_password, stored_hash)
    PasswordEncoder-->>SecurityFilter: true/false
    alt Password matches
        SecurityFilter->>SecurityFilter: Create authentication token
        SecurityFilter-->>Client: Grant access (set session/token)
    else Password mismatch
        SecurityFilter-->>Client: HTTP 401 Unauthorized
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• PR #1: Introduces UserRepository and role/user persistence that the new CustomUserDetailsService and data seeding logic depend on.
• PR #10: Also modifies DataInitializer.java; potential compatibility concern with password encoding and user seeding approach.
• PR #7: ActivityLogController endpoint renames and behavior changes that correspond to features introduced in that PR.

Poem

🐰 Passwords encoded, roles now flow free,
Form-login blooms where basic auth used to be,
Database users spring forth with BCrypt's grace,
Access gated by role—security's embrace!
🔐✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Pr 15' is vague and non-descriptive, failing to communicate what changes are included in the pull request.	Replace with a concise, descriptive title that summarizes the main change, such as 'Implement Spring Security with BCrypt password encoding and role-based access control' or similar.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pr-15

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}