Authenticated Notes App

package com.programinds.notesapp.model;

import jakarta.persistence.*;

// Mapped to "app_user", not "user" — "user" is a reserved keyword in several
// SQL dialects (including PostgreSQL), so the table name is changed explicitly.
@Entity
@Table(name = "app_user")
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)   // No two users may register the same username
    private String username;

    @Column(nullable = false)
    private String password;   // Stores a BCrypt hash produced in Step 6 — the raw password is never persisted

    public Long getId() {
        return id;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

package com.programinds.notesapp.model;

import jakarta.persistence.*;

@Entity
public class Note {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false)
    private String content;

    // Many notes belong to one user. LAZY means the owning User row is only
    // loaded from the database the moment something actually calls getOwner() —
    // listing 100 notes does not also trigger 100 extra user lookups.
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "owner_id", nullable = false)
    private User owner;

    public Long getId() {
        return id;
    }

    public String getContent() {
        return content;
    }

    public void setContent(String content) {
        this.content = content;
    }

    public User getOwner() {
        return owner;
    }

    public void setOwner(User owner) {
        this.owner = owner;
    }
}

package com.programinds.notesapp.repository;

import com.programinds.notesapp.model.User;
import org.springframework.data.jpa.repository.JpaRepository;

import java.util.Optional;

public interface UserRepository extends JpaRepository<User, Long> {
    // Derived query method: Spring Data JPA parses the method name and generates
    // "SELECT ... FROM app_user WHERE username = ?" with no SQL written by hand.
    Optional<User> findByUsername(String username);
}

package com.programinds.notesapp.repository;

import com.programinds.notesapp.model.Note;
import org.springframework.data.jpa.repository.JpaRepository;

import java.util.List;
import java.util.Optional;

public interface NoteRepository extends JpaRepository<Note, Long> {
    // Traverses the owner relationship from Step 1: generates a query joining
    // note to app_user and filtering by the owner's username.
    List<Note> findByOwnerUsername(String username);

    // Used by NoteService to load one note while confirming who owns it, in a
    // single query rather than a separate ownership check after the fact.
    Optional<Note> findByIdAndOwnerUsername(Long id, String username);
}

package com.programinds.notesapp.security;

import com.programinds.notesapp.repository.UserRepository;
import org.springframework.security.core.userdetails.*;
import org.springframework.stereotype.Service;

// The one bridge between Spring Security's authentication machinery and this
// app's own User table. Spring Security calls loadUserByUsername on every
// login attempt; everything after that is handled by the framework.
@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        com.programinds.notesapp.model.User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("No user with username: " + username));

        // Spring Security's own User type, built from this app's data. The
        // password passed in is already a BCrypt hash (set at registration in
        // Step 6) — Spring Security hashes the incoming attempt and compares
        // hashes, it never decrypts this value.
        return org.springframework.security.core.userdetails.User
            .withUsername(user.getUsername())
            .password(user.getPassword())
            .roles("USER")
            .build();
    }
}

package com.programinds.notesapp.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    // BCryptPasswordEncoder is a one-way hash: verifying a login means re-hashing
    // the submitted password and comparing hashes, never decrypting the stored
    // value. Declared as a bean so both registration and login share one instance.
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // CSRF protection defends browser form submissions that ride on a
            // logged-in session cookie. This API is stateless and tested with
            // curl/Postman sending credentials on every request, so it is disabled
            // here — a server-rendered form-based app would need to keep it on.
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                // Order matters: this specific rule must be listed before the
                // catch-all below, or registration itself would require being
                // already logged in — an impossible chicken-and-egg situation.
                .requestMatchers(HttpMethod.POST, "/api/auth/register").permitAll()
                .anyRequest().authenticated()   // Every other endpoint requires valid credentials
            )
            .httpBasic(Customizer.withDefaults());   // Credentials sent via the Authorization header on every request

        return http.build();
    }
}

package com.programinds.notesapp.service;

import com.programinds.notesapp.model.Note;
import com.programinds.notesapp.model.User;
import com.programinds.notesapp.repository.NoteRepository;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;

import java.util.List;
import java.util.Optional;

@Service
public class NoteService {

    private final NoteRepository noteRepository;

    public NoteService(NoteRepository noteRepository) {
        this.noteRepository = noteRepository;
    }

    public List<Note> getNotesForCurrentUser() {
        // Only ever returns notes owned by whoever this request authenticated as
        // — never a client-supplied id, which a caller could tamper with.
        return noteRepository.findByOwnerUsername(currentUsername());
    }

    public Optional<Note> getNoteForCurrentUser(Long id) {
        // A single query filtered by both id AND owner username: a note that
        // exists but belongs to someone else comes back empty here, exactly the
        // same as a note that does not exist at all.
        return noteRepository.findByIdAndOwnerUsername(id, currentUsername());
    }

    public Note createNote(String content, User owner) {
        Note note = new Note();
        note.setContent(content);
        note.setOwner(owner);   // Owner is set from the authenticated principal in the controller, never from the request body
        return noteRepository.save(note);
    }

    // Reads the identity Spring Security's filter chain already established for
    // this request. There is no way for a client to make this return someone
    // else's username short of stealing that user's own credentials.
    private String currentUsername() {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return authentication.getName();
    }
}

package com.programinds.notesapp.controller;

import com.programinds.notesapp.dto.RegisterRequest;
import com.programinds.notesapp.model.User;
import com.programinds.notesapp.repository.UserRepository;
import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    public AuthController(UserRepository userRepository, PasswordEncoder passwordEncoder) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @PostMapping("/register")   // Reachable without auth — this is the request SecurityConfig's permitAll() covers
    public ResponseEntity<String> register(@Valid @RequestBody RegisterRequest request) {
        User user = new User();
        user.setUsername(request.getUsername());
        user.setPassword(passwordEncoder.encode(request.getPassword()));   // Hash before saving; the raw password is discarded
        userRepository.save(user);
        return ResponseEntity.status(HttpStatus.CREATED).body("User registered");
    }
}

package com.programinds.notesapp.controller;

import com.programinds.notesapp.dto.NoteRequest;
import com.programinds.notesapp.model.Note;
import com.programinds.notesapp.repository.UserRepository;
import com.programinds.notesapp.service.NoteService;
import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping("/api/notes")   // Every method here requires authentication, per SecurityConfig's anyRequest().authenticated()
public class NoteController {

    private final NoteService noteService;
    private final UserRepository userRepository;

    public NoteController(NoteService noteService, UserRepository userRepository) {
        this.noteService = noteService;
        this.userRepository = userRepository;
    }

    @GetMapping
    public List<Note> getMyNotes() {
        return noteService.getNotesForCurrentUser();   // Already scoped by Step 5 — no id filtering needed here
    }

    @GetMapping("/{id}")
    public ResponseEntity<Note> getOne(@PathVariable Long id) {
        return noteService.getNoteForCurrentUser(id)
            .map(ResponseEntity::ok)
            // Deliberately the same 404 whether the note doesn't exist or belongs
            // to someone else — this endpoint never reveals that another user's
            // note with this id exists at all.
            .orElse(ResponseEntity.notFound().build());
    }

    @PostMapping
    public ResponseEntity<Note> create(@Valid @RequestBody NoteRequest request, Authentication authentication) {
        // authentication.getName() is the identity Spring Security already
        // verified for this request — the owner is never taken from the body.
        var owner = userRepository.findByUsername(authentication.getName()).orElseThrow();
        Note saved = noteService.createNote(request.getContent(), owner);
        return ResponseEntity.status(HttpStatus.CREATED).body(saved);
    }
}

package com.programinds.notesapp.dto;

import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Size;

public class RegisterRequest {

    @NotBlank
    private String username;

    @NotBlank
    @Size(min = 8, message = "Password must be at least 8 characters")   // Enforced before the password is ever hashed
    private String password;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

package com.programinds.notesapp.dto;

import jakarta.validation.constraints.NotBlank;

public class NoteRequest {

    @NotBlank(message = "Content must not be blank")
    private String content;

    public String getContent() {
        return content;
    }

    public void setContent(String content) {
        this.content = content;
    }
}

package com.programinds.notesapp;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class NotesAppApplication {
    public static void main(String[] args) {
        SpringApplication.run(NotesAppApplication.class, args);
    }
}