From f30e089739497f6dd23ff19a0cbe8012fbe83aa2 Mon Sep 17 00:00:00 2001 From: Andreas Dahm Date: Mon, 11 May 2026 14:40:54 +0200 Subject: [PATCH] Changed readme.md --- readme.md | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/readme.md b/readme.md index 6a33bc3..397b4d0 100644 --- a/readme.md +++ b/readme.md @@ -34,7 +34,7 @@ The project strictly follows a Domain-Driven / Clean Architecture (Ports & Adapt * Implements the interfaces defined in the Domain layer. * **Rule:** Entities never leak into the API layer. -*Note: Future implementations will include ArchUnit tests to automatically enforce these architectural boundaries during the CI pipeline.* +Architectural boundaries are enforced via ArchUnit (`src/test/java/auth_service/architecture/ArchitectureTest.java`), which runs as part of the standard `./mvnw test` quality gate. Abstract test bases live under `auth_service.shared.test` (`AbstractUnitTest`, `AbstractIntegrationTest`, `AbstractPersistenceTest`, `AbstractWebMvcTest`, `AbstractArchitectureTest`). ## βš™οΈ Local Development @@ -79,4 +79,25 @@ Metrics and health checks are exposed out-of-the-box via Spring Boot Actuator: Health: http://localhost:8080/actuator/health -Prometheus Metrics: http://localhost:8080/actuator/prometheus \ No newline at end of file +Prometheus Metrics: http://localhost:8080/actuator/prometheus + +## πŸ—ΊοΈ Roadmap / Open Topics + +Tracking known work that is not yet implemented. Each item is independently actionable. + +### Security + +- **Switch JWT signing from HS256 β†’ EdDSA (Ed25519).** Today Auth and Core share a symmetric `JWT_SECRET`, which means a Core compromise lets an attacker forge tokens. Move to an asymmetric keypair: Auth holds the private key and signs, Core only holds the public key and verifies. `jjwt 0.13` supports this via `Jwts.SIG.EdDSA`; JDK 25 has native `Ed25519` `KeyFactory`. Touches `JwtService`, `JwtConfig`, `application.yml`, `JwtServiceTest`, and the deployment env vars (`JWT_PRIVATE_KEY`, `JWT_PUBLIC_KEY` replace `JWT_SECRET`). Add a `kid` header so future rotation is possible. +- **Refresh-token rotation.** Current access tokens last 24h with no revocation path. Split into a short-lived (5–15 min) access token and a long-lived (7–30 day) refresh token, rotated on every use, persisted server-side so logout / password change / "log out everywhere" actually revoke. Add a `token_version` column on `users` (or a `jti` blacklist table) checked on each refresh. +- **Move JWT delivery to an httpOnly `Secure` cookie.** Tokens are currently returned in the response body and stored by the frontend in `localStorage`, exposing them to any XSS payload. Set the cookie server-side, scope it to `.tbp.andreas-dahm.eu`, and add CSRF protection (Spring Security's `CookieCsrfTokenRepository.withHttpOnlyFalse()`). +- **Tighten CORS for cookie auth.** Restrict allowed origins to `https://tbp.andreas-dahm.eu` (plus the local dev origin) and set `allowCredentials=true`. Required before switching to cookie-based JWT. +- **Rate-limit `/api/auth/login` and `/api/registration/**`.** Currently no brake on credential stuffing or registration spam. Bucket4j or Spring Security's built-in `RateLimiter` are both options; key by IP + email. + +### Observability and API + +- **Publish a JWKS endpoint** (`GET /.well-known/jwks.json`) once on EdDSA. Lets Core (and any future verifier) fetch the public key automatically and supports key rotation without redeploying every consumer. +- **API versioning review.** Query-parameter versioning (`?v=1`) is unusual; path- or `Accept`-header-based versioning is more conventional and plays better with HTTP caches. Worth a deliberate decision before more endpoints accumulate. + +### Testing + +- The abstract test bases under `auth_service.shared.test` already cover unit / integration / persistence / WebMvc slices. Continue adding controller-level `AbstractWebMvcTest` coverage for any new endpoint and persistence-layer tests for any new repository. \ No newline at end of file