PR-Feat: week 3 checkout #42

ArchILLtect · 2025-10-17T03:56:45Z

This pull request introduces several backend hardening features focused on authentication, session management, and documentation. The most important changes are the addition of password complexity enforcement during registration, in-memory login rate limiting with a new error code, scheduled session pruning, and comprehensive documentation updates reflecting these improvements. Integration tests have been added for all major new features.

Authentication & Security Enhancements

Password complexity is now enforced on registration (minimum 8 characters, must include upper, lower, and digit), with validation errors mapped to VALIDATION_ERROR. Documentation and sample requests have been updated accordingly. [1] [2] [3] [4] [5] [6]
Login attempts are rate limited (5 failures per 5 minutes per email+IP); excessive attempts return HTTP 429 with the new RATE_LIMITED error code. This is reflected in error code documentation and integration tests. [1] [2] [3] [4] [5] [6] [7]

Session Management

Hourly scheduled session pruning job implemented using JPQL bulk delete and transactional execution. Expiry is enforced both at request time and via scheduled cleanup. [1] [2] [3]

Documentation & Error Handling

Documentation updated throughout: new password policy, rate limiting, session pruning, and error codes. New risk analysis (docs/RISKS.md) and JWT session tradeoff spike added. [1] [2] [3] [4]
Error envelope and code catalog expanded to include RATE_LIMITED; sample requests and responses now demonstrate new behaviors. [1] [2] [3] [4] [5]

Configuration & CI

Spring profiles for development and production now configure cookies, CORS, and database usage appropriately. CI release job builds and attaches JARs to GitHub Releases on tag push.

Reference: See CHANGELOG.md, docs/RISKS.md, and updated API documentation for a full narrative of changes.This pull request focuses on backend authentication and session management hardening. It introduces password complexity enforcement for registration, login rate limiting with a new error code, scheduled session pruning, and updates documentation to reflect these changes. Risk mitigations and architectural tradeoffs are also documented to guide future improvements.

Authentication & Security Enhancements

Password complexity is now enforced on registration: minimum 8 characters, at least one uppercase, one lowercase, and one digit. Documentation and sample requests have been updated to reflect this policy. [1] [2] [3]
Login attempts are rate limited (5 failures per 5 minutes). Excessive failures return a new RATE_LIMITED error code (HTTP 429), with documentation and error code catalog updated. [1] [2] [3] [4] [5] [6]

Session Management

Scheduled session pruning job runs hourly to delete expired sessions, with expiry also enforced at request time. Documentation and risk mitigations are updated. [1] [2] [3] [4]

Documentation & Risk Tracking

API and architecture docs now describe the new password policy, rate limiting, session pruning, and error codes. A new docs/RISKS.md file catalogs current backend risks and mitigations. (F5230f71L2R2, [1] [2]
A spike document (docs/spikes/jwt-session-tradeoffs.md) discusses JWT vs. opaque session token strategies for future reference.

Project Tracking

Completed items log and blocking items in TTD.md updated to reflect the new features and their implementation status.

These changes collectively improve authentication robustness, error handling clarity, and operational security for the backend.

Closes #35
Closes #34
Closes #31
Closes #30
Closes #29
Closes #28
Closes #25
Closes #23

…xity

Copilot

Pull Request Overview

This pull request implements backend authentication and session management hardening for Week 3, introducing password complexity enforcement, login rate limiting, and scheduled session pruning with comprehensive documentation updates.

Key Changes

Added password complexity validation requiring minimum 8 characters with uppercase, lowercase, and digit requirements
Implemented in-memory rate limiting for login attempts (5 failures per 5 minutes) returning HTTP 429 with RATE_LIMITED error code
Added scheduled hourly session pruning job to automatically clean up expired sessions

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/main/java/com/sameboat/backend/auth/dto/RegisterRequest.java`	Enhanced password validation with complexity requirements using Bean Validation pattern
`src/main/java/com/sameboat/backend/auth/RateLimiterService.java`	New in-memory rate limiting service with sliding window implementation
`src/main/java/com/sameboat/backend/auth/AuthController.java`	Integrated rate limiting into login flow with proper error handling
`src/main/java/com/sameboat/backend/SameboatBackendApplication.java`	Enabled Spring scheduling for session pruning jobs
`src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java`	Integration test for rate limiting behavior
`src/test/java/com/sameboat/backend/auth/PasswordComplexityValidationTest.java`	Test for password complexity validation
`docs/RISKS.md`	New risk documentation cataloging security considerations and mitigations
`docs/spikes/jwt-session-tradeoffs.md`	Architecture spike comparing JWT vs opaque session strategies
`docs/api.md`	Updated API documentation with new error codes and password requirements
`docs/Architecture.md`	Updated architecture documentation reflecting authentication changes
Various other files	Documentation updates and project tracking changes

src/main/java/com/sameboat/backend/auth/dto/RegisterRequest.java

src/main/java/com/sameboat/backend/auth/RateLimiterService.java

github-actions · 2025-10-17T03:57:29Z

Coverage (Instructions): 100%
Covered: 33 / 33
(Missed: 0)

@SiZe

The regex pattern duplicates the minimum length constraint already enforced by @SiZe(min = 8). The pattern should be simplified to remove the redundant length check: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d).*$ Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

src/main/java/com/sameboat/backend/auth/RateLimiterService.java

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java

The comment 'not dev' references a hardcoded stub password assumption. This creates a dependency on knowing internal test configuration. Consider making the test password selection more explicit or document the dev auto-create behavior. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java

…on pruning functionality

…tion logic

Copilot

Pull Request Overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java

The variable email is not defined in this test class. This should use a hardcoded email address like 'ratelimit@example.com' as mentioned in the comment on line 25. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java

src/main/java/com/sameboat/backend/auth/RateLimiterService.java

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java

Using fixedDelayString means the next execution waits 1 hour after the previous execution completes. For a cleanup job, fixedRateString might be more appropriate to ensure consistent hourly execution regardless of processing time. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

@transactional

The use of ObjectProvider<SessionPruner> self to obtain a proxy for @transactional method calls is a complex pattern. Consider using @async with @EnableAsync or extracting the transactional logic to a separate service to improve maintainability and reduce the need for self-injection. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java

…gration test to use prune service

…gration plan

Copilot

Pull Request Overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java

ArchILLtect added 6 commits October 16, 2025 22:42

feat: implement in-memory rate limiter for login endpoints

3b7f780

feat: add integration tests for password complexity and rate limiting

7635bd8

feat: enable scheduling support in the backend application

e6b021f

feat: implement rate limiting for login attempts

d1e1143

feat: update password validation to require minimum length and comple…

dbd1012

…xity

docs: update documentation to coincide with week 3 wrap up

7761bd1

ArchILLtect added this to the 0.1.1 milestone Oct 17, 2025

ArchILLtect self-assigned this Oct 17, 2025

Copilot AI review requested due to automatic review settings October 17, 2025 03:56

Copilot AI reviewed Oct 17, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings October 17, 2025 03:58

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/main/java/com/sameboat/backend/auth/RateLimiterService.java Outdated Show resolved Hide resolved

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings October 17, 2025 04:05

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java Outdated Show resolved Hide resolved

ArchILLtect added 2 commits October 16, 2025 23:18

feat: enhance rate limiting with thread-safe operations and add sessi…

ea068f0

…on pruning functionality

feat: add method to delete expired sessions in SessionRepository

f23bc92

Copilot AI review requested due to automatic review settings October 17, 2025 04:19

ArchILLtect added 3 commits October 16, 2025 23:19

feat: add integration test for SessionPruner to validate session dele…

2e3d501

…tion logic

feat: refactor loginRateLimited test to use email variable for clarity

8e253ce

feat: add changelog to document notable changes and updates

4b13e74

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java Outdated Show resolved Hide resolved

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java Show resolved Hide resolved

refactor: remove redundant var

2f50f8d

The variable email is not defined in this test class. This should use a hardcoded email address like 'ratelimit@example.com' as mentioned in the comment on line 25. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings October 17, 2025 04:21

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java Outdated Show resolved Hide resolved

src/main/java/com/sameboat/backend/auth/RateLimiterService.java Show resolved Hide resolved

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java Show resolved Hide resolved

Copilot AI review requested due to automatic review settings October 17, 2025 04:23

Copilot AI reviewed Oct 17, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings October 17, 2025 04:27

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java Show resolved Hide resolved

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java Show resolved Hide resolved

ArchILLtect added 2 commits October 16, 2025 23:43

feat: add scheduled task for pruning expired sessions and update inte…

c41c6b5

…gration test to use prune service

feat: add decision record for JWT vs extended opaque sessions with mi…

83b526d

…gration plan

Copilot AI review requested due to automatic review settings October 17, 2025 05:08

Copilot AI reviewed Oct 17, 2025

View reviewed changes

src/main/java/com/sameboat/backend/auth/session/SessionPruner.java Show resolved Hide resolved

src/test/java/com/sameboat/backend/auth/RateLimitingIntegrationTest.java Show resolved Hide resolved

feat: add endpoint to retrieve deployed backend version

6e4f231

ArchILLtect merged commit 4b12eda into main Oct 17, 2025
4 checks passed

ArchILLtect deleted the feat/week-3-checkout branch October 17, 2025 05:13

PR-Feat: week 3 checkout #42

PR-Feat: week 3 checkout #42

Uh oh!

Conversation

ArchILLtect commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ArchILLtect commented Oct 17, 2025 •

edited

Loading

github-actions bot commented Oct 17, 2025 •

edited

Loading