Add JWT authentication module and static analysis integration

.github/workflows/workastra_server.yaml

@@ -46,9 +46,16 @@ jobs:
           cache: gradle
 
       - name: Run checks
-        run: ./gradlew --no-daemon clean check
+        run: ./gradlew --no-daemon clean check -x test
+
+      - name: Run JVM tests
+        env:
+          SPRING_PROFILES_ACTIVE: test
+        run: ./gradlew --no-daemon clean test
 
       - name: Run native tests
+        env:
+          SPRING_PROFILES_ACTIVE: test
         run: ./gradlew --no-daemon clean nativeTest
 
   build:

.vscode/launch.json

@@ -7,7 +7,8 @@
       "cwd": "${workspaceFolder}",
       "mainClass": "com.workastra.console.WorkastraConsoleApplication",
       "projectName": "console",
-      "env": {}
+      "vmArgs": "-XX:+UseCompactObjectHeaders",
+      "env": { "SPRING_PROFILES_ACTIVE": "dev" }
     }
   ]
 }

build.gradle.kts

@@ -1,10 +1,17 @@
+import net.ltgt.gradle.errorprone.errorprone
+
+val libsCatalog = extensions
+  .getByType(VersionCatalogsExtension::class.java)
+  .named("libs")
+
 plugins {
   java
   checkstyle
   alias(libs.plugins.spring.boot) apply false
   alias(libs.plugins.spring.dependency.management) apply false
   alias(libs.plugins.graalvm.native) apply false
   alias(libs.plugins.spotless)
+  alias(libs.plugins.net.ltgt.errorprone) apply true
 }
 
 group = "com.workastra"
@@ -24,6 +31,7 @@ subprojects {
   apply(plugin = "java")
   apply(plugin = "checkstyle")
   apply(plugin = "com.diffplug.spotless")
+  apply(plugin = "net.ltgt.errorprone")
 
   checkstyle {
     toolVersion = "12.1.2"
@@ -46,4 +54,23 @@ subprojects {
       )).configFile(file("${rootDir}/java.prettierrc.yaml"))
     }
   }
+
+  dependencies {
+    add("errorprone", libsCatalog.findLibrary("error-prone-core").get())
+    add("errorprone", libsCatalog.findLibrary("nullaway").get())
+  }
+
+  tasks.withType<JavaCompile>().configureEach {
+    options.errorprone {
+      disableWarningsInGeneratedCode.set(true)
+      excludedPaths.set(".*/build/generated/.*")
+
+      // Enable nullness checks only in null-marked code
+      option("NullAway:OnlyNullMarked", "true")
+      // Bump checks from warnings (default) to errors
+      error("NullAway")
+      // https://github.com/uber/NullAway/wiki/JSpecify-Support
+      option("NullAway:JSpecifyMode", "true")
+    }
+  }
 }

config/checkstyle/checkstyle.xml

@@ -139,5 +139,11 @@
       <property name="checks" value="HideUtilityClassConstructor" />
       <property name="query" value="//CLASS_DEF[.//ANNOTATION/IDENT[@text='SpringBootApplication']]" />
     </module>
+
+    <!-- @Bean methods must not have any modifier (only package-private allowed). -->
+    <module name="MatchXpath">
+      <property name="query" value="//METHOD_DEF[./MODIFIERS/ANNOTATION/IDENT[@text='Bean'] and count(./MODIFIERS/*) &gt; 1]"/>
+      <message key="matchxpath.match" value="@Bean methods must not declare any modifier (use package-private only)."/>
+    </module>
   </module>
 </module>

gradle/libs.versions.toml

@@ -3,9 +3,12 @@ spring-boot = "4.0.0"
 
 [libraries]
 spring-boot-bom = { module = "org.springframework.boot:spring-boot-dependencies", version.ref = "spring-boot" }
+error-prone-core = { module = "com.google.errorprone:error_prone_core", version = "2.44.0" }
+nullaway = { module = "com.uber.nullaway:nullaway", version = "0.12.12" }
 
 [plugins]
 spring-boot = { id = "org.springframework.boot", version.ref = "spring-boot" }
 spring-dependency-management = { id = "io.spring.dependency-management", version = "1.1.7" }
 graalvm-native = { id = "org.graalvm.buildtools.native", version = "0.11.3" }
 spotless = { id = "com.diffplug.spotless", version = "8.1.0" }
+net-ltgt-errorprone = { id = "net.ltgt.errorprone", version = "4.3.0" }

modules/authentication/build.gradle.kts

@@ -0,0 +1,13 @@
+plugins {
+  `java-library`
+  alias(libs.plugins.spring.dependency.management)
+}
+
+dependencies {
+  implementation(platform(libs.spring.boot.bom))
+  implementation(project(":modules:common"))
+  implementation("org.springframework.boot:spring-boot-starter-security")
+  implementation("org.springframework.boot:spring-boot-starter-security-oauth2-client")
+  testImplementation("org.springframework.boot:spring-boot-starter-security-oauth2-client-test")
+  testImplementation("org.springframework.boot:spring-boot-starter-security-test")
+}

modules/authentication/src/main/java/com/workastra/authentication/AuthenticationModuleConfig.java

@@ -0,0 +1,41 @@
+package com.workastra.authentication;
+
+import com.workastra.authentication.infrastructure.handler.JsonAccessDeniedHandler;
+import com.workastra.authentication.infrastructure.handler.JsonAuthenticationEntryPoint;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * AuthenticationModuleConfig is the module-level bootstrap configuration for the authentication module.
+ *
+ * This configuration is responsible for:
+ * - Registering exception handlers as Spring components
+ * - Providing infrastructure beans needed across the module
+ *
+ * Actual security configuration is delegated to the infrastructure layer:
+ * - SecurityConfig: HTTP security filter chain and authorization rules
+ * - PasswordEncoderConfig: Password encoding and authentication beans
+ * - Various handlers: JSON-based exception and authentication event handling
+ */
+@Configuration
+public class AuthenticationModuleConfig {
+
+    /**
+     * Registers the JsonAuthenticationEntryPoint as a Spring component.
+     * This handler processes 401 Unauthorized responses.
+     */
+    @Bean
+    JsonAuthenticationEntryPoint jsonAuthenticationEntryPoint(ObjectMapper mapper) {
+        return new JsonAuthenticationEntryPoint(mapper);
+    }
+
+    /**
+     * Registers the JsonAccessDeniedHandler as a Spring component.
+     * This handler processes 403 Forbidden responses.
+     */
+    @Bean
+    JsonAccessDeniedHandler jsonAccessDeniedHandler(ObjectMapper mapper) {
+        return new JsonAccessDeniedHandler(mapper);
+    }
+}

modules/authentication/src/main/java/com/workastra/authentication/controller/AuthController.java

@@ -0,0 +1,21 @@
+package com.workastra.authentication.controller;
+
+import com.workastra.common.api.ApiResponse;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.csrf.CsrfToken;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class AuthController {
+
+    @GetMapping(path = "/api/v{version}/csrf", version = "1")
+    public ApiResponse<CsrfToken> getCsrf(CsrfToken csrfToken) {
+        return ApiResponse.ok(csrfToken);
+    }
+
+    @GetMapping(path = "/api/v{version}/auth/me", version = "1")
+    public ApiResponse<Authentication> me(Authentication authentication) {
+        return ApiResponse.ok(authentication);
+    }
+}

modules/authentication/src/main/java/com/workastra/authentication/controller/package-info.java

@@ -0,0 +1,4 @@
+@NullMarked
+package com.workastra.authentication.controller;
+
+import org.jspecify.annotations.NullMarked;

modules/authentication/src/main/java/com/workastra/authentication/infrastructure/config/PasswordEncoderConfig.java

@@ -0,0 +1,58 @@
+package com.workastra.authentication.infrastructure.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+
+/**
+ * PasswordEncoderConfig defines password encoding and authentication-related beans.
+ *
+ * This configuration class sets up:
+ * - BCryptPasswordEncoder for secure password hashing
+ * - AuthenticationManager for delegating authentication
+ * - UserDetailsService with in-memory user store (for demo purposes)
+ */
+@Configuration
+public class PasswordEncoderConfig {
+
+    /**
+     * Provides the BCryptPasswordEncoder bean for password encryption.
+     * BCrypt automatically handles salt generation and secure hashing.
+     */
+    @Bean
+    PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    /**
+     * Provides the AuthenticationManager bean from the AuthenticationConfiguration.
+     * This manager delegates to the configured authentication providers.
+     */
+    @Bean
+    AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
+        return configuration.getAuthenticationManager();
+    }
+
+    /**
+     * Provides an in-memory UserDetailsService with a default admin user.
+     * In production, this should be replaced with a persistent user repository
+     * connected to a database.
+     *
+     * Default user:
+     * - username: "admin"
+     * - password: "admin" (bcrypt encoded)
+     * - roles: "USER"
+     */
+    @Bean
+    UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
+        return new InMemoryUserDetailsManager(
+            User.withUsername("admin").password(passwordEncoder.encode("admin")).roles("USER").build()
+        );
+    }
+}

modules/authentication/src/main/java/com/workastra/authentication/infrastructure/config/SecurityConfig.java

@@ -0,0 +1,88 @@
+package com.workastra.authentication.infrastructure.config;
+
+import com.workastra.authentication.infrastructure.filter.JsonLoginAuthenticationFilter;
+import com.workastra.authentication.infrastructure.handler.JsonAccessDeniedHandler;
+import com.workastra.authentication.infrastructure.handler.JsonAuthFailureHandler;
+import com.workastra.authentication.infrastructure.handler.JsonAuthSuccessHandler;
+import com.workastra.authentication.infrastructure.handler.JsonAuthenticationEntryPoint;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * SecurityConfig configures Spring Security for the authentication module.
+ * It sets up the HTTP security chain, CSRF protection, authorization rules,
+ * and integrates custom JSON-based authentication handlers.
+ */
+@Configuration
+public class SecurityConfig {
+
+    private final JsonAccessDeniedHandler accessDeniedHandler;
+    private final JsonAuthenticationEntryPoint authenticationEntryPoint;
+
+    public SecurityConfig(
+        JsonAuthenticationEntryPoint authenticationEntryPoint,
+        JsonAccessDeniedHandler accessDeniedHandler
+    ) {
+        this.authenticationEntryPoint = authenticationEntryPoint;
+        this.accessDeniedHandler = accessDeniedHandler;
+    }
+
+    /**
+     * Configures the security filter chain for HTTP requests.
+     *
+     * - Enables CSRF protection for Single Page Applications (SPA)
+     * - Permits public endpoints: /actuator/health, /api/v1/csrf, /api/v1/auth/login
+     * - Requires authentication for all other /api/** endpoints
+     * - Denies all other requests
+     * - Uses custom JSON authentication filter instead of form login
+     * - Registers custom exception handlers for unauthorized and forbidden access
+     */
+    @Bean
+    SecurityFilterChain securityFilterChain(
+        HttpSecurity http,
+        AuthenticationManager authenticationManager,
+        ObjectMapper objectMapper
+    ) throws Exception {
+        var jsonLoginAuthenticationFilter = new JsonLoginAuthenticationFilter(authenticationManager, objectMapper);
+        jsonLoginAuthenticationFilter.setFilterProcessesUrl("/api/v1/auth/login");
+        jsonLoginAuthenticationFilter.setAuthenticationSuccessHandler(new JsonAuthSuccessHandler(objectMapper));
+        jsonLoginAuthenticationFilter.setAuthenticationFailureHandler(new JsonAuthFailureHandler(objectMapper));
+
+        var sessionRepo = new HttpSessionSecurityContextRepository();
+        jsonLoginAuthenticationFilter.setSecurityContextRepository(sessionRepo);
+
+        http
+            .csrf((csrf) -> csrf.spa())
+            .authorizeHttpRequests((auth) ->
+                auth
+                    .requestMatchers(HttpMethod.GET, "/actuator/health")
+                    .permitAll()
+                    .requestMatchers("/api/v1/csrf")
+                    .permitAll()
+                    .requestMatchers("/api/v1/auth/login")
+                    .permitAll()
+                    .requestMatchers("/api/**")
+                    .authenticated()
+                    .anyRequest()
+                    .denyAll()
+            )
+            .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED))
+            .formLogin((c) -> c.disable())
+            .httpBasic((c) -> c.disable())
+            .addFilterAt(jsonLoginAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
+            .exceptionHandling((ex) -> {
+                ex.authenticationEntryPoint(this.authenticationEntryPoint);
+                ex.accessDeniedHandler(this.accessDeniedHandler);
+            });
+
+        return http.build();
+    }
+}

modules/authentication/src/main/java/com/workastra/authentication/infrastructure/config/package-info.java

@@ -0,0 +1,10 @@
+/**
+ * Infrastructure layer configuration for authentication and security.
+ *
+ * This package contains Spring configuration classes that set up security beans,
+ * filters, and the HTTP security filter chain.
+ *
+ * - SecurityConfig: Configures the HTTP security filter chain
+ * - PasswordEncoderConfig: Defines password encoding and authentication manager beans
+ */
+package com.workastra.authentication.infrastructure.config;