protect `/api/users/by-username` with service-to-service authentication

[simonforsberg]

Currently permits unauthenticated access to password-hash lookup endpoint. Requires OAuth2 client credentials flow between authService and userService.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

authService/src/main/java/org/example/authservice/client/UserServiceClient.java (1)

26-31: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

Protect password-hash lookup behind service authentication.

Line 29 fetches UserAuthResponse (includes passwordHash) from /api/users/by-username, while provided context shows userService/src/main/java/org/example/userservice/config/SecurityConfig.java permits unauthenticated GET access to this route and userService/src/main/java/org/example/userservice/controller/UserController.java returns that payload. This enables unauthenticated hash disclosure.

Require authenticated service-to-service access for that endpoint (and send credentials from this client) before release.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 282b28f3-0544-4468-847d-8d1e9a279f20

📥 Commits

Reviewing files that changed from the base of the PR and between cc53c2e and 11e29cf.

📒 Files selected for processing (12)

• authService/src/main/java/org/example/authservice/client/UserServiceClient.java
• authService/src/main/java/org/example/authservice/config/TokenCustomizerConfig.java
• authService/src/main/java/org/example/authservice/dto/UserAuthResponse.java
• authService/src/main/java/org/example/authservice/exception/GlobalExceptionHandler.java
• authService/src/main/java/org/example/authservice/exception/UserServiceUnavailableException.java
• authService/src/main/java/org/example/authservice/model/ErrorResponse.java
• messageService/src/main/java/org/example/messageservice/controller/MessageController.java
• messageService/src/main/java/org/example/messageservice/service/MessageService.java
• userService/src/main/java/org/example/userservice/dto/UserAuthResponse.java
• userService/src/main/java/org/example/userservice/init/DataInitializer.java
• userService/src/main/java/org/example/userservice/service/UserService.java
• userService/src/main/resources/application.properties

💤 Files with no reviewable changes (3)

• authService/src/main/java/org/example/authservice/dto/UserAuthResponse.java
• userService/src/main/java/org/example/userservice/dto/UserAuthResponse.java
• userService/src/main/java/org/example/userservice/service/UserService.java

✅ Files skipped from review due to trivial changes (1)

• userService/src/main/resources/application.properties

Originally posted by @coderabbitai[bot] in #9 (review)