Bump Springboot@3.5.0, fixes JWT issues with refreshToken and others

petruki · petruki · commit 69e4877692fb · 2025-06-01T01:57:00.000-07:00
diff --git a/pom.xml b/pom.xml
@@ -24,7 +24,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>3.4.4</version>
+		<version>3.5.0</version>
 		<relativePath />
 	</parent>
 	
@@ -34,12 +34,12 @@
 		<maven.compiler.target>${java.version}</maven.compiler.target>
 
 		<!-- Test-->
-		<flapdoodle.embed.mongo.version>4.18.0</flapdoodle.embed.mongo.version>
+		<flapdoodle.embed.mongo.version>4.20.0</flapdoodle.embed.mongo.version>
 
 		<!-- Plugins -->
 		<maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
-		<sonar-maven-plugin.version>3.10.0.2594</sonar-maven-plugin.version>
-		<jacoco-maven-plugin.version>0.8.12</jacoco-maven-plugin.version>
+		<sonar-maven-plugin.version>5.1.0.4751</sonar-maven-plugin.version>
+		<jacoco-maven-plugin.version>0.8.13</jacoco-maven-plugin.version>
 		
 		<!-- Sonar -->
 		<sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantJwtRequestFilter.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantJwtRequestFilter.java
@@ -8,6 +8,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import lombok.NonNull;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
@@ -23,7 +24,8 @@
 public class MultiTenantJwtRequestFilter extends JwtRequestFilter {
 
 	@Override
-	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+	protected void doFilterInternal(@NonNull HttpServletRequest request,
+									@NonNull HttpServletResponse response, @NonNull FilterChain filterChain)
 			throws ServletException, IOException {
 		
 		final Optional<String> jwt = getJwtFromRequest(request);
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantSecurityConfig.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantSecurityConfig.java
@@ -29,12 +29,12 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
 		http.sessionManagement(auth -> auth.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 		http.csrf(AbstractHttpConfigurer::disable);
 
+		http.addFilterBefore(corsFilter(), UsernamePasswordAuthenticationFilter.class);
 		http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
 
 		return http.build();
 	}
 
-	@Bean
 	public CorsFilter corsFilter() {
 		var source = new UrlBasedCorsConfigurationSource();
 		var config = new CorsConfiguration();
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantServiceConfig.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/MultiTenantServiceConfig.java
@@ -1,18 +1,19 @@
 package com.trackerforce.common.tenant.config;
 
-import org.springframework.beans.factory.annotation.Autowired;
+import com.trackerforce.common.tenant.interceptor.TenantInterceptor;
+import com.trackerforce.common.tenant.service.IdentityService;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
-import com.trackerforce.common.tenant.interceptor.TenantInterceptor;
-import com.trackerforce.common.tenant.service.IdentityService;
-
 @Configuration
 public class MultiTenantServiceConfig implements WebMvcConfigurer  {
-	
-	@Autowired
-	private IdentityService identityService;
+
+	private final IdentityService identityService;
+
+	public MultiTenantServiceConfig(IdentityService identityService) {
+		this.identityService = identityService;
+	}
 
 	@Override
 	public void addInterceptors(InterceptorRegistry registry) {
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/mongodb/MultitenantMongoDbConfiguration.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/mongodb/MultitenantMongoDbConfiguration.java
@@ -1,34 +1,50 @@
 package com.trackerforce.common.tenant.config.mongodb;
 
-import java.net.UnknownHostException;
-
+import com.mongodb.ConnectionString;
+import com.mongodb.MongoClientSettings;
+import com.mongodb.client.MongoClient;
+import com.mongodb.client.MongoClients;
+import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.data.mongodb.MongoDatabaseFactory;
 
-import com.mongodb.client.MongoClient;
-import com.mongodb.client.MongoClients;
-
 @Configuration
 @ConditionalOnProperty(name = "spring.boot.multitenant.mongodb.enabled", havingValue = "true", matchIfMissing = true)
 public class MultitenantMongoDbConfiguration {
-	
-	@Value("${spring.data.mongodb.uri}")
-	private String connectionString;
-	
-	@Value("${spring.data.mongodb.tenant-prefix:${spring.data.mongodb.database}}-")
-	private String databasePrefix;
 
-    @Bean
-    public MongoClient createMongoClient() throws UnknownHostException {
-    	return MongoClients.create(connectionString);
-    }
+	private final String connectionString;
+
+	private final String databasePrefix;
+
+	private final HttpServletRequest request;
+
+	public MultitenantMongoDbConfiguration(
+			@Value("${spring.data.mongodb.uri}") String connectionString,
+			@Value("${spring.data.mongodb.tenant-prefix:${spring.data.mongodb.database}}-") String databasePrefix,
+			HttpServletRequest request) {
+		this.connectionString = connectionString;
+		this.databasePrefix = databasePrefix;
+		this.request = request;
+	}
 
     @Bean
-    public MongoDatabaseFactory mongoDbFactory() throws UnknownHostException {
-        return new MultitenantMongoDbFactory(createMongoClient(), databasePrefix);
+    public MongoDatabaseFactory mongoDbFactory() {
+        return new MultitenantMongoDbFactory(createMongoClient(), databasePrefix, request);
     }
 
+	@Bean
+	public MongoClient createMongoClient() {
+		return MongoClients.create(connectionString);
+	}
+
+	@Bean
+	public MongoClientSettings mongoClientSettings() {
+		return MongoClientSettings.builder()
+				.applyConnectionString(new ConnectionString(connectionString))
+				.build();
+	}
+
 }
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/mongodb/MultitenantMongoDbFactory.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/config/mongodb/MultitenantMongoDbFactory.java
@@ -1,35 +1,35 @@
 package com.trackerforce.common.tenant.config.mongodb;
 
-import java.util.Optional;
-
+import com.mongodb.client.MongoClient;
+import com.mongodb.client.MongoDatabase;
+import com.trackerforce.common.tenant.interceptor.TenantInterceptor;
 import jakarta.servlet.http.HttpServletRequest;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
+import lombok.NonNull;
 import org.springframework.dao.DataAccessException;
 import org.springframework.dao.InvalidDataAccessResourceUsageException;
 import org.springframework.data.mongodb.core.SimpleMongoClientDatabaseFactory;
 
-import com.mongodb.client.MongoClient;
-import com.mongodb.client.MongoDatabase;
-import com.trackerforce.common.tenant.interceptor.TenantInterceptor;
+import java.util.Optional;
 
 public class MultitenantMongoDbFactory extends SimpleMongoClientDatabaseFactory {
 
-	@Autowired
-	private HttpServletRequest request;
+	private final HttpServletRequest request;
 
-	@Value("${spring.data.mongodb.tenant-prefix:${spring.data.mongodb.database}}-")
-	private String databasePrefix;
+	private final String databasePrefix;
 
-	public MultitenantMongoDbFactory(MongoClient mongoClient, String databaseName) {
-		super(mongoClient, databaseName);
+	public MultitenantMongoDbFactory(MongoClient mongoClient,
+									 String databasePrefix, HttpServletRequest request) {
+		super(mongoClient, databasePrefix);
+		this.databasePrefix = databasePrefix;
+		this.request = request;
 	}
 
 	@Override
+	@NonNull
 	public MongoDatabase getMongoDatabase() throws DataAccessException {
 		final var tenantId = Optional.ofNullable(request.getAttribute(TenantInterceptor.TENANT_ID));
 
-		if (!tenantId.isPresent())
+		if (tenantId.isEmpty())
 			throw new InvalidDataAccessResourceUsageException("X-Tenant is missing");
 
 		return super.getMongoDatabase(String.format("%s%s", databasePrefix, tenantId.get()));
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/interceptor/TenantInterceptor.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/interceptor/TenantInterceptor.java
@@ -5,6 +5,7 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import lombok.NonNull;
 import org.springframework.util.StringUtils;
 import org.springframework.web.servlet.HandlerInterceptor;
 
@@ -29,8 +30,8 @@ public TenantInterceptor(IdentityService identityService) {
 	}
 	
 	@Override
-	public boolean preHandle(HttpServletRequest request,
-							 HttpServletResponse response, Object handler) throws Exception {
+	public boolean preHandle(@NonNull HttpServletRequest request,
+							 @NonNull HttpServletResponse response, @NonNull Object handler) throws Exception {
 		
 		var allowedEndpoint = isAllowedEndpoint(request);
 		var tenant = Optional.ofNullable(request.getHeader(RequestHeader.TENANT_HEADER.toString()));
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/model/ComponentHelper.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/model/ComponentHelper.java
@@ -1,5 +1,6 @@
 package com.trackerforce.common.tenant.model;
 
+import com.trackerforce.common.tenant.model.type.RenderType;
 import lombok.Data;
 
 @Data
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/model/exception/InvalidStatusChangeException.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/model/exception/InvalidStatusChangeException.java
@@ -2,11 +2,9 @@
 
 import com.trackerforce.common.model.exception.BusinessException;
 
-@SuppressWarnings("serial")
 public class InvalidStatusChangeException extends BusinessException {
 
 	public InvalidStatusChangeException(String from, String to) {
 		super(String.format("Cannot change status from '%s' to '%s'", from, to));
 	}
-
 }
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/repository/AbstractProjectedDao.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/repository/AbstractProjectedDao.java
@@ -13,7 +13,6 @@
 
 import java.util.Arrays;
 import java.util.Map;
-import java.util.Optional;
 
 public abstract class AbstractProjectedDao<T extends AbstractDocument, R extends MongoRepository<T, String>> {
 
@@ -38,7 +37,7 @@ public T save(T entity) {
     }
 
     /**
-     * Find one element by Id
+     * Find one element by ID
      */
     public T findByIdProjectedBy(String id, Class<T> entityClass, String... fields) {
         var query = Query.query(Criteria.where("id").is(id));
diff --git a/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/service/IdentityService.java b/trackerforce-common-tenancy/src/main/java/com/trackerforce/common/tenant/service/IdentityService.java
@@ -1,6 +1,8 @@
 package com.trackerforce.common.tenant.service;
 
+import com.trackerforce.common.model.type.RequestHeader;
 import jakarta.servlet.http.HttpServletRequest;
+import lombok.Getter;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpHeaders;
@@ -9,21 +11,26 @@
 import org.springframework.web.client.RestClientException;
 import org.springframework.web.client.RestTemplate;
 
-import com.trackerforce.common.model.type.RequestHeader;;
+import java.util.Optional;
 
 @Service
 public class IdentityService {
 	
-	private RestTemplate restTemplate = new RestTemplate();
-	
-	@Value("${service.identity.url}/identity/v1/valid")
-	private String serviceUrl;
-	
-	@Value("${service.endpoint.allowed-endpoints}")
-	protected String[] allowedEndpoints;
+	private final RestTemplate restTemplate = new RestTemplate();
+
+	private final String serviceUrl;
 	
+	@Getter
+	protected final String[] allowedEndpoints;
+
+	public IdentityService(@Value("${service.identity.url}/identity/v1/valid") String serviceUrl,
+			@Value("${service.endpoint.allowed-endpoints}") String[] allowedEndpoints) {
+		this.serviceUrl = serviceUrl;
+		this.allowedEndpoints = allowedEndpoints;
+	}
+
 	public boolean validateIdentity(HttpServletRequest request) {
-		HttpHeaders headers = new HttpHeaders();
+		var headers = new HttpHeaders();
 		headers.add(RequestHeader.AUTHORIZATION.toString(), 
 				request.getHeader(RequestHeader.AUTHORIZATION.toString()));
 		headers.add(RequestHeader.TENANT_HEADER.toString(), 
@@ -34,15 +41,14 @@ public boolean validateIdentity(HttpServletRequest request) {
 					HttpMethod.GET, 
 					new HttpEntity<>(headers), 
 					Boolean.class);
-			
-			return response.getBody().booleanValue();			
+
+			return Optional.of(response)
+					.map(resp -> resp.getStatusCode().is2xxSuccessful() &&
+							Optional.ofNullable(resp.getBody()).orElse(false))
+					.orElse(false);
 		} catch (RestClientException e) {
 			return false;
 		}
 	}
 
-	public String[] getAllowedEndpoints() {
-		return allowedEndpoints;
-	}
-
 }
diff --git a/trackerforce-common/pom.xml b/trackerforce-common/pom.xml
@@ -29,7 +29,7 @@
 
 	<properties>
 		<jsonwebtoken.version>0.12.6</jsonwebtoken.version>
-		<springdoc-openapi-starter-webmvc-ui.version>2.8.6</springdoc-openapi-starter-webmvc-ui.version>
+		<springdoc-openapi-starter-webmvc-ui.version>2.8.8</springdoc-openapi-starter-webmvc-ui.version>
 	</properties>
 
 	<dependencies>
diff --git a/trackerforce-identity/src/main/java/com/trackerforce/identity/config/IdentityJwtRequestFilter.java b/trackerforce-identity/src/main/java/com/trackerforce/identity/config/IdentityJwtRequestFilter.java
@@ -8,23 +8,34 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import lombok.NonNull;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.stereotype.Component;
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.List;
 import java.util.Optional;
 
 @Component
 public class IdentityJwtRequestFilter extends JwtRequestFilter {
 
+	private final List<String> allowedPaths = List.of("/refresh");
+
 	@Override
-    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+    protected void doFilterInternal(@NonNull HttpServletRequest request,
+									@NonNull HttpServletResponse response, @NonNull FilterChain filterChain)
 			throws ServletException, IOException {
 
+		if (isPathAllowed(request.getServletPath())) {
+			filterChain.doFilter(request, response);
+			return;
+		}
+
 		final Optional<String> jwt = getJwtFromRequest(request);
+
 		try {
 			jwt.ifPresent(token -> {
 				String username = jwtTokenService.getUsernameFromToken(token);
@@ -42,4 +53,13 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 		filterChain.doFilter(request, response);
 	}
 
+	private boolean isPathAllowed(String path) {
+		for (String allowedPath : allowedPaths) {
+			if (path.endsWith(allowedPath)) {
+				return true;
+			}
+		}
+		return false;
+	}
+
 }
diff --git a/trackerforce-identity/src/main/java/com/trackerforce/identity/service/AuthenticationService.java b/trackerforce-identity/src/main/java/com/trackerforce/identity/service/AuthenticationService.java

Original file line number	Diff line number	Diff line change
`@@ -2,11 +2,9 @@`
`2`	`2`
`3`	`3`	`import com.trackerforce.common.model.exception.BusinessException;`
`4`	`4`
`5`		`-@SuppressWarnings("serial")`
`6`	`5`	`public class InvalidStatusChangeException extends BusinessException {`
`7`	`6`
`8`	`7`	`public InvalidStatusChangeException(String from, String to) {`
`9`	`8`	`super(String.format("Cannot change status from '%s' to '%s'", from, to));`
`10`	`9`	`}`
`11`		`-`
`12`	`10`	`}`