Refactor and secure backend configuration, DTOs, and authentication flow

- Updated pom.xml: removed redundant tags, grouped dependencies, added scopes, and upgraded plugins
- Enhanced RegisterUserDto with validation annotations and added missing fields (username, fullname)
- Updated User entity with builder constructor and removed redundant getters/setters
- Completed FileMetadata entity with Lombok and required setters/getters
- Improved HDFSConfig with correct annotation and clearer exception message
- Adjusted HTTP to HTTPS redirect port (8085 -> 8443)
- Allowed /actuator/** in SecurityConfig and disabled deprecated XSS protection
- Skipped JWT filter for /api/auth and /actuator paths
- Refactored AuthenticationService to use builder pattern and RSA key injection
- Fixed application.properties for static MySQL connection (removed ${MYSQL_PASSWORD})

src/main/java/com/skycrate/backend/skycrateBackend/config/HDFSConfig.java

@@ -1,6 +1,6 @@
 package com.skycrate.backend.skycrateBackend.config;
 
-import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.conf.Configuration; // Hadoop Configuration
 import org.apache.hadoop.fs.FileSystem;
 import org.apache.hadoop.security.UserGroupInformation;
 import org.springframework.context.annotation.Bean;
@@ -8,20 +8,17 @@ import org.springframework.context.annotation.Bean;
 import java.net.URI;
 import java.security.PrivilegedExceptionAction;
 
- // HDFS configuration bean to securely connect to a remote Hadoop cluster.
-@Configuration
+@org.springframework.context.annotation.Configuration
 public class HDFSConfig {
 
-    private static final String HDFS_URI = System.getenv("HDFS_URI"); // export HDFS_URI=hdfs://192.168.29.30:9000
-    private static final String HDFS_USER = System.getenv("HDFS_USER"); // Hadoop user (if needed)
+    private static final String HDFS_URI = System.getenv("HDFS_URI"); // e.g., hdfs://namenode:9000
+    private static final String HDFS_USER = System.getenv("HDFS_USER"); // e.g., hdfsuser
 
-     // Configures and returns a secured HDFS FileSystem instance.
     @Bean
     public FileSystem fileSystem() throws Exception {
-        return getHDFS(); // use the static method internally
+        return getHDFS();
     }
 
-     // Static method to get a FileSystem instance. Used by other classes like HDFSController.
     public static FileSystem getHDFS() throws Exception {
         if (HDFS_URI == null || HDFS_URI.isBlank()) {
             throw new IllegalStateException("HDFS_URI environment variable not set.");

src/main/java/com/skycrate/backend/skycrateBackend/config/HttpToHttpsRedirectConfig.java

@@ -14,10 +14,10 @@ public class HttpToHttpsRedirectConfig {
         return factory -> {
             Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
             connector.setScheme("http");
-            connector.setPort(8080); // HTTP port
+            connector.setPort(8085); // HTTP port
             connector.setSecure(false);
             connector.setRedirectPort(8443); // HTTPS port
             factory.addAdditionalTomcatConnectors(connector);
         };
     }
-}
+}

src/main/java/com/skycrate/backend/skycrateBackend/config/JwtAuthenticationFilter.java

@@ -1,74 +0,0 @@
-package com.skycrate.backend.skycrateBackend.config;
-
-import java.io.IOException;
-
-import org.springframework.lang.NonNull;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.core.userdetails.UserDetailsService;
-import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
-import org.springframework.stereotype.Component;
-import org.springframework.web.filter.OncePerRequestFilter;
-import org.springframework.web.servlet.HandlerExceptionResolver;
-
-import com.skycrate.backend.skycrateBackend.services.JwtService;
-
-import jakarta.servlet.FilterChain;
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-
-@Component
-public class JwtAuthenticationFilter extends OncePerRequestFilter {
-    
-
-        private final HandlerExceptionResolver handlerExceptionResolver;
-        private JwtService jwtService;
-        private UserDetailsService userDetailsService;
-
-        public JwtAuthenticationFilter(JwtService jwtService,UserDetailsService userDetailsService,HandlerExceptionResolver handlerExceptionResolver){
-
-            this.handlerExceptionResolver=handlerExceptionResolver;
-            this.jwtService=jwtService;
-            this.userDetailsService=userDetailsService;
-        }
-
-        @Override
-    protected void doFilterInternal(
-        @NonNull HttpServletRequest request,
-        @NonNull HttpServletResponse response,
-        @NonNull FilterChain filterChain) throws ServletException, IOException {
-        final String authHeader=request.getHeader("Authorization");
-        if (authHeader==null || !authHeader.startsWith("Bearer")){
-            filterChain.doFilter(request, response);
-            return;
-        }
-        try {
-            final String userjwt=authHeader.substring(7);
-            final String userEmail=jwtService.extractUsername(userjwt);
-            Authentication authentication=SecurityContextHolder.getContext().getAuthentication();
-            if(userEmail!=null && authentication==null){
-
-                UserDetails userDetails=this.userDetailsService.loadUserByUsername(userEmail);
-                if (jwtService.isTokenValid(userjwt, userDetails)) {
-                    
-                    UsernamePasswordAuthenticationToken authenticationToken=new UsernamePasswordAuthenticationToken(
-                        userDetails, null, userDetails.getAuthorities()
-                        );
-                    authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
-                    SecurityContextHolder.getContext().setAuthentication(authenticationToken);
-                }
-
-            }
-            filterChain.doFilter(request, response);
-            } 
-        catch (Exception err) {
-            handlerExceptionResolver.resolveException(request, response, null, err);
-        }
-
-        }
-
-
-}

src/main/java/com/skycrate/backend/skycrateBackend/config/SecurityConfig.java

@@ -29,7 +29,7 @@ public class SecurityConfig {
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authenticationProvider(authenticationProvider)
                 .authorizeHttpRequests(auth -> auth
-                        .requestMatchers("/api/auth/**").permitAll()
+                        .requestMatchers("/api/auth/**", "/actuator/**").permitAll()
                         .requestMatchers(HttpMethod.GET, "/public/**").permitAll()
                         .anyRequest().authenticated()
                 )
@@ -41,7 +41,8 @@ public class SecurityConfig {
                                 .includeSubDomains(true)
                                 .maxAgeInSeconds(31536000)
                         )
-                        .xssProtection(xss -> xss.block(true))
+                        // Spring Security 6+ no longer supports xss.block(true), so we just enable or disable it.
+                        .xssProtection(xss -> xss.disable())
                         .frameOptions(frame -> frame.deny())
                 )
                 .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);