Build path

One rule: a new concept goes into its existing home (a Guide section or a Decision Card), never a new page. New effort goes into Build steps and Lab log entries.

1. 1

   Default gate Done

   Spring Boot secures every endpoint with the default filter chain.

   Done when: Any endpoint without a token returns 401.

   Guide §2 ArchitectureCard: where security runsLevel 1 detail
2. 2

   Authorization server issues JWTs Done

   Spring Authorization Server on :9000 signs RS256 JWTs; users log in with the authorization code flow.

   Done when: A token from Postman decodes on jwt.io with iss http://localhost:9000.

   Guide §10 OAuth2Card: signing algorithmCard: which auth server
3. 3

   Stateless resource servers with scope rules Done

   Services A, B and Notification verify JWTs locally; GET needs payment.read, POST needs payment.write.

   Done when: test-all.ps1: missing token 401, wrong scope 403, right scope 200.

   Guide §9 JWTCard: roles, authorities or scopesLevel 4 detail
4. 4

   Ownership: another user's payment is 404 Done

   Service B takes the owner from the JWT sub and never returns someone else's payment.

   Done when: Alice asking for Nithin's payment id gets 404.

   Guide §7.6 IDORCard: ownershipLevel 5 detail
5. 5

   Service-to-service with client credentials Done

   Service B gets its own token (scope notification.send) to call the Notification Service.

   Done when: A payment triggers the email; B's token has sub = payment-service-b.

   Guide §11 MicroservicesCard: service-to-service
6. 6

   Real users: database + BCrypt Done

   Auth server loads users from a database table with BCrypt hashes instead of in-memory users.

   Done when: Login works after a restart; the stored password starts with {bcrypt}; a disabled user cannot log in.

   Proved by ExA1_DbUsersTest and ExA2_RegisterEndpointTest (H2 in memory): BCrypt hash stored, disabled user refused, POST /register works. Since 18 Oct, /register is admin-only with the first admin seeded from env vars.

   Guide §4 AuthenticationCard: password storageCard: where users come fromLevel 3 detail
7. 7

   Account lockout after failed logins Done

   Lock an account for a few minutes after 5 wrong passwords; reset on success.

   Done when: The 6th wrong password returns "locked"; it unlocks by itself.

   Proved by ExB_LockoutTest, 6 of 6 green: 5 wrong passwords lock the account for 15 minutes (LoginAttemptListener, stored in lockedUntil); the custom LockoutAwareFailureHandler still stores a LockedException, so B1 passes.

   Card: stopping password guessingLevel 3 detail
8. 8

   Security tests for Services A and B Done

   One allowed and one denied test per security rule, with MockMvc and jwt().

   Done when: mvn test is green: no token 401, wrong scope 403, right scope 200, other user's payment 404.

   Proved on 2026-10-18 with mvn test: Service B 30 of 30, Service A 23 of 23. Both BUILD SUCCESS.

   Guide §13 TestingCard: testing approach
9. 9

   Redis: shared login sessions Now

   Spring Session + Redis on the auth server, so a restart or a second instance keeps users logged in.

   Done when: Log in, restart the auth server, refresh: still logged in.

   Guide §6 SessionsCard: sessions across servers
10. 10

    Redis: cache payments without leaking them Next

    Cache GET /payments/{id} in Service B with a TTL and eviction on update; the cache key includes the owner.

    Done when: Second GET is faster; Alice still gets 404 for Nithin's cached payment.

    Card: ownership
11. 11

    Audience check on every service Next

    Each resource server accepts only tokens issued for the clients it expects.

    Done when: Notification rejects a payment-client token with 401.

    Guide §9.3 AudienceCard: audience check
12. 12

    Persist OAuth2 state + hash client secrets Next

    Registered clients, authorizations and consents in the database; client secrets stored with BCrypt.

    Done when: Restart the auth server: consent is remembered; no {noop} secrets left.

    Card: signing keysCard: managing secrets
13. 13

    Refresh tokens with rotation Next

    payment-client gets refresh tokens; each refresh issues a new one and invalidates the old.

    Done when: After 5 minutes the client refreshes without a new login; an old refresh token is rejected.

    Card: revoking tokens
14. 14

    Hardening: JSON errors, rate limits, two chains Later

    401/403 as JSON matching GlobalExceptionHandler; login rate limit; separate API and web chains where needed.

    Done when: 401 and 403 bodies are JSON; request 6 in a burst gets 429.

    Card: what 401 and 403 look likeCard: one chain or severalLevel 6 detail
15. 15

    OAuth2 login with Google or GitHub Later

    Users can sign in with an external identity provider, mapped to local roles.

    Done when: Google login lands on the app with the right roles.

    Guide §10.4 oauth2LoginCard: choosing a grantLevel 7 detail

To update this page, edit skills/concept-explorer/learn/path_data.py and run python3 skills/concept-explorer/learn/build_path.py.