JWT-Based Authentication for REST APIs

1. Client sends POST /login with {username, password}
2. Server verifies credentials
3. Server creates a session and stores it in memory (or Redis)
4. Server sends back a session ID in a cookie: Set-Cookie: JSESSIONID=abc123
5. Client automatically sends the cookie with every subsequent request
6. Server looks up the session by ID to identify the user

1. Client sends POST /api/auth/login with {username, password}
2. Server verifies credentials
3. Server generates a JWT token containing user info + expiration
4. Server sends the token back in the response body
5. Client stores the token (localStorage, memory, or secure storage)
6. Client sends the token in the Authorization header with every request:
   Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
7. Server validates the token — no session lookup needed

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhbGljZSIsInJvbGUiOiJST0xFX0FVVEhPUiIsImlhdCI6MTcwNTMxMjAwMCwiZXhwIjoxNzA1Mzk4NDAwfQ.K7G_2nRt0z5F9Y8fqpXhV3cR2dJ6kL_mB8QwN1XnYz4

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "alice",
  "role": "ROLE_AUTHOR",
  "iat": 1705312000,
  "exp": 1705398400
}

HMAC-SHA256(
    base64UrlEncode(header) + "." + base64UrlEncode(payload),
    secret_key
)

Client                              Server
  |                                    |
  |  POST /api/auth/login             |
  |  {"username":"alice",              |
  |   "password":"secret123"}          |
  |  ─────────────────────────────────>|
  |                                    |
  |                 1. Verify credentials (UserDetailsService + BCrypt)
  |                 2. Generate JWT token with claims (sub, role, exp)
  |                 3. Generate refresh token
  |                                    |
  |  200 OK                            |
  |  {"accessToken":"eyJ...",          |
  |   "refreshToken":"eyJ...",         |
  |   "expiresIn":86400}              |
  |  <─────────────────────────────────|
  |                                    |
  |  Client stores tokens              |

Client                              Server
  |                                    |
  |  GET /api/posts                    |
  |  Authorization: Bearer eyJ...      |
  |  ─────────────────────────────────>|
  |                                    |
  |               1. JWT Filter extracts token from header
  |               2. Validate token (check signature, expiration)
  |               3. Extract username and role from claims
  |               4. Set SecurityContext with user details
  |               5. Request reaches controller
  |                                    |
  |  200 OK                            |
  |  [{"id":1,"title":"..."}]          |
  |  <─────────────────────────────────|

Client                              Server
  |                                    |
  |  POST /api/auth/refresh            |
  |  {"refreshToken":"eyJ..."}         |
  |  ─────────────────────────────────>|
  |                                    |
  |               1. Validate refresh token
  |               2. Generate new access token
  |                                    |
  |  200 OK                            |
  |  {"accessToken":"eyJ_new...",      |
  |   "expiresIn":86400}              |
  |  <─────────────────────────────────|

<!-- JWT dependencies -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.12.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.12.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.12.5</version>
    <scope>runtime</scope>
</dependency>

# JWT Configuration
# The secret key used to sign tokens — MUST be at least 256 bits (32 chars) for HS256.
# In production, use an environment variable: ${JWT_SECRET}
jwt.secret=my-super-secret-key-that-is-at-least-32-characters-long-for-hs256

# Access token expiration: 24 hours (in milliseconds)
jwt.access-token-expiration=86400000

# Refresh token expiration: 7 days (in milliseconds)
jwt.refresh-token-expiration=604800000

package com.example.blogapi.security;

import io.jsonwebtoken.*;
import io.jsonwebtoken.io.Decoders;
import io.jsonwebtoken.security.Keys;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Component;

import javax.crypto.SecretKey;
import java.util.Date;
import java.util.stream.Collectors;

@Component
public class JwtTokenProvider {

    private static final Logger log = LoggerFactory.getLogger(JwtTokenProvider.class);

    private final SecretKey signingKey;
    private final long accessTokenExpiration;
    private final long refreshTokenExpiration;

    // Spring injects values from application.properties.
    public JwtTokenProvider(
            @Value("${jwt.secret}") String secret,
            @Value("${jwt.access-token-expiration}") long accessTokenExpiration,
            @Value("${jwt.refresh-token-expiration}") long refreshTokenExpiration) {

        // Create the signing key from the secret string.
        // Keys.hmacShaKeyFor() requires at least 256 bits (32 bytes).
        this.signingKey = Keys.hmacShaKeyFor(secret.getBytes());
        this.accessTokenExpiration = accessTokenExpiration;
        this.refreshTokenExpiration = refreshTokenExpiration;
    }

    // Generate an access token from a Spring Security Authentication object.
    public String generateAccessToken(Authentication authentication) {
        String username = authentication.getName();
        String roles = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(","));

        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + accessTokenExpiration);

        return Jwts.builder()
                .subject(username)                  // "sub" claim — who this token is for
                .claim("roles", roles)              // Custom claim — user roles
                .issuedAt(now)                      // "iat" claim — when token was created
                .expiration(expiryDate)             // "exp" claim — when token expires
                .signWith(signingKey)               // Sign with our secret key
                .compact();                         // Build the token string
    }

    // Generate a refresh token (longer-lived, fewer claims).
    public String generateRefreshToken(Authentication authentication) {
        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + refreshTokenExpiration);

        return Jwts.builder()
                .subject(authentication.getName())
                .claim("type", "refresh")           // Mark as refresh token
                .issuedAt(now)
                .expiration(expiryDate)
                .signWith(signingKey)
                .compact();
    }

    // Extract the username from a token.
    public String getUsernameFromToken(String token) {
        Claims claims = parseToken(token);
        return claims.getSubject();
    }

    // Extract roles from a token.
    public String getRolesFromToken(String token) {
        Claims claims = parseToken(token);
        return claims.get("roles", String.class);
    }

    // Validate a token — checks signature, expiration, and format.
    public boolean validateToken(String token) {
        try {
            parseToken(token);
            return true;
        } catch (ExpiredJwtException ex) {
            log.warn("JWT token expired: {}", ex.getMessage());
        } catch (MalformedJwtException ex) {
            log.warn("Invalid JWT token: {}", ex.getMessage());
        } catch (UnsupportedJwtException ex) {
            log.warn("Unsupported JWT token: {}", ex.getMessage());
        } catch (IllegalArgumentException ex) {
            log.warn("JWT claims string is empty: {}", ex.getMessage());
        } catch (SecurityException ex) {
            log.warn("JWT signature validation failed: {}", ex.getMessage());
        }
        return false;
    }

    // Parse and verify a token. Throws exceptions if invalid.
    private Claims parseToken(String token) {
        return Jwts.parser()
                .verifyWith(signingKey)    // Verify the signature
                .build()
                .parseSignedClaims(token)  // Parse and validate
                .getPayload();             // Extract claims
    }

    public long getAccessTokenExpiration() {
        return accessTokenExpiration;
    }
}

package com.example.blogapi.dto;

import com.fasterxml.jackson.annotation.JsonInclude;

@JsonInclude(JsonInclude.Include.NON_NULL)
public class AuthResponse {

    private String message;
    private String accessToken;
    private String refreshToken;
    private String tokenType = "Bearer";
    private Long expiresIn;    // Seconds until access token expires
    private String username;
    private String role;

    public AuthResponse() { }

    // Constructor for login/refresh responses
    public AuthResponse(String accessToken, String refreshToken, 
                        Long expiresIn, String username, String role) {
        this.message = "Authentication successful";
        this.accessToken = accessToken;
        this.refreshToken = refreshToken;
        this.expiresIn = expiresIn;
        this.username = username;
        this.role = role;
    }

    // Constructor for registration (no tokens yet)
    public AuthResponse(String message, String username, String role) {
        this.message = message;
        this.username = username;
        this.role = role;
    }

    // --- Getters and Setters ---
    public String getMessage() { return message; }
    public void setMessage(String message) { this.message = message; }
    public String getAccessToken() { return accessToken; }
    public void setAccessToken(String accessToken) { this.accessToken = accessToken; }
    public String getRefreshToken() { return refreshToken; }
    public void setRefreshToken(String refreshToken) { this.refreshToken = refreshToken; }
    public String getTokenType() { return tokenType; }
    public void setTokenType(String tokenType) { this.tokenType = tokenType; }
    public Long getExpiresIn() { return expiresIn; }
    public void setExpiresIn(Long expiresIn) { this.expiresIn = expiresIn; }
    public String getUsername() { return username; }
    public void setUsername(String username) { this.username = username; }
    public String getRole() { return role; }
    public void setRole(String role) { this.role = role; }
}

@Service
public class AuthService {

    private static final Logger log = LoggerFactory.getLogger(AuthService.class);

    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final AuthenticationManager authenticationManager;
    private final JwtTokenProvider jwtTokenProvider;

    public AuthService(UserRepository userRepository,
                       PasswordEncoder passwordEncoder,
                       AuthenticationManager authenticationManager,
                       JwtTokenProvider jwtTokenProvider) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
        this.authenticationManager = authenticationManager;
        this.jwtTokenProvider = jwtTokenProvider;
    }

    // Registration — same as Lecture 11 (no tokens returned)
    @Transactional
    public AuthResponse register(RegisterRequest request) {
        log.info("Registering new user: username='{}'", request.getUsername());

        if (userRepository.existsByUsername(request.getUsername())) {
            throw new DuplicateResourceException("User", "username", request.getUsername());
        }
        if (userRepository.existsByEmail(request.getEmail())) {
            throw new DuplicateResourceException("User", "email", request.getEmail());
        }

        User user = new User(
                request.getUsername(),
                request.getEmail().toLowerCase(),
                passwordEncoder.encode(request.getPassword())
        );
        user.setFullName(request.getFullName());
        user.setRole("ROLE_USER");
        userRepository.save(user);

        log.info("User registered: username='{}', id={}", user.getUsername(), user.getId());
        return new AuthResponse("Registration successful", user.getUsername(), user.getRole());
    }

    // Login — now returns JWT tokens
    public AuthResponse login(LoginRequest request) {
        log.info("Login attempt: username='{}'", request.getUsername());

        try {
            // Authenticate with Spring Security
            Authentication authentication = authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            request.getUsername(),
                            request.getPassword()
                    )
            );

            // Generate tokens
            String accessToken = jwtTokenProvider.generateAccessToken(authentication);
            String refreshToken = jwtTokenProvider.generateRefreshToken(authentication);

            User user = userRepository.findByUsername(request.getUsername()).orElseThrow();
            long expiresInSeconds = jwtTokenProvider.getAccessTokenExpiration() / 1000;

            log.info("Login successful: username='{}'", request.getUsername());

            return new AuthResponse(
                    accessToken,
                    refreshToken,
                    expiresInSeconds,
                    user.getUsername(),
                    user.getRole()
            );

        } catch (AuthenticationException ex) {
            log.warn("Login failed for username='{}': {}", request.getUsername(), ex.getMessage());
            throw new BadRequestException("Invalid username or password");
        }
    }

    // Refresh — generate a new access token using a valid refresh token
    public AuthResponse refreshToken(String refreshToken) {
        log.info("Token refresh attempt");

        if (!jwtTokenProvider.validateToken(refreshToken)) {
            throw new BadRequestException("Invalid or expired refresh token");
        }

        String username = jwtTokenProvider.getUsernameFromToken(refreshToken);
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new BadRequestException("User not found"));

        if (!user.isActive()) {
            throw new BadRequestException("User account is deactivated");
        }

        // Create a minimal Authentication object for token generation
        var authorities = Collections.singletonList(
                new SimpleGrantedAuthority(user.getRole()));
        var auth = new UsernamePasswordAuthenticationToken(username, null, authorities);

        String newAccessToken = jwtTokenProvider.generateAccessToken(auth);
        long expiresInSeconds = jwtTokenProvider.getAccessTokenExpiration() / 1000;

        log.info("Token refreshed for username='{}'", username);

        AuthResponse response = new AuthResponse();
        response.setMessage("Token refreshed successfully");
        response.setAccessToken(newAccessToken);
        response.setExpiresIn(expiresInSeconds);
        response.setUsername(username);
        response.setRole(user.getRole());
        return response;
    }
}

package com.example.blogapi.security;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;

// OncePerRequestFilter guarantees this filter runs exactly once per request,
// even if the request is forwarded internally.
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtTokenProvider jwtTokenProvider;

    public JwtAuthenticationFilter(JwtTokenProvider jwtTokenProvider) {
        this.jwtTokenProvider = jwtTokenProvider;
    }

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain) throws ServletException, IOException {

        // Step 1: Extract the token from the Authorization header.
        String token = extractTokenFromRequest(request);

        // Step 2: If token exists and is valid, set up authentication.
        if (StringUtils.hasText(token) && jwtTokenProvider.validateToken(token)) {

            // Step 3: Extract user information from the token.
            String username = jwtTokenProvider.getUsernameFromToken(token);
            String roles = jwtTokenProvider.getRolesFromToken(token);

            // Step 4: Convert roles string to GrantedAuthority list.
            List<SimpleGrantedAuthority> authorities = Arrays.stream(roles.split(","))
                    .map(SimpleGrantedAuthority::new)
                    .collect(Collectors.toList());

            // Step 5: Create an authentication object.
            // The first argument is the principal (username).
            // The second is credentials (null — we already verified via the token).
            // The third is the list of authorities (roles).
            UsernamePasswordAuthenticationToken authentication =
                    new UsernamePasswordAuthenticationToken(username, null, authorities);

            authentication.setDetails(
                    new WebAuthenticationDetailsSource().buildDetails(request));

            // Step 6: Set the authentication in the SecurityContext.
            // From this point on, Spring Security knows who the user is
            // and what roles they have. @PreAuthorize and other security
            // checks will work correctly.
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }

        // Step 7: Continue the filter chain.
        // If the token was invalid or missing, the SecurityContext remains empty,
        // and Spring Security will return 401 for protected endpoints.
        filterChain.doFilter(request, response);
    }

    // Extract token from "Authorization: Bearer <token>" header.
    private String extractTokenFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);  // Remove "Bearer " prefix
        }
        return null;
    }
}

Incoming request: GET /api/posts  (with Authorization: Bearer eyJ...)

1. extractTokenFromRequest() → extracts "eyJ..." from the header
2. jwtTokenProvider.validateToken("eyJ...") → verifies signature + expiration → true
3. getUsernameFromToken() → parses claims → "alice"
4. getRolesFromToken() → parses claims → "ROLE_AUTHOR"
5. Creates UsernamePasswordAuthenticationToken("alice", null, [ROLE_AUTHOR])
6. Sets SecurityContext → Spring Security now knows this is "alice" with ROLE_AUTHOR
7. filterChain.doFilter() → request continues to the controller

Incoming request: GET /api/posts  (no Authorization header)

1. extractTokenFromRequest() → returns null
2. Token is null → skip authentication setup
3. filterChain.doFilter() → SecurityContext is empty
4. If endpoint is permitAll() → request reaches controller (anonymous access)
5. If endpoint is authenticated() → Spring Security returns 401

package com.example.blogapi.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter) {
        this.jwtAuthenticationFilter = jwtAuthenticationFilter;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())

            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

            .authorizeHttpRequests(auth -> auth
                // Auth endpoints — public
                .requestMatchers("/api/auth/**").permitAll()

                // Read endpoints — public
                .requestMatchers(HttpMethod.GET, "/api/posts/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/categories/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/tags/**").permitAll()

                // Write endpoints — require authentication (roles checked via @PreAuthorize)
                .requestMatchers(HttpMethod.POST, "/api/posts/**").authenticated()
                .requestMatchers(HttpMethod.PUT, "/api/posts/**").authenticated()
                .requestMatchers(HttpMethod.PATCH, "/api/posts/**").authenticated()
                .requestMatchers(HttpMethod.DELETE, "/api/posts/**").authenticated()

                // Admin endpoints
                .requestMatchers("/api/admin/**").hasRole("ADMIN")

                // Everything else — require authentication
                .anyRequest().authenticated()
            )

            // Register our JWT filter BEFORE Spring's default auth filter.
            // This ensures the JWT filter runs first and sets up the SecurityContext
            // before any authorization checks happen.
            .addFilterBefore(jwtAuthenticationFilter,
                    UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

package com.example.blogapi.controller;

import com.example.blogapi.dto.AuthResponse;
import com.example.blogapi.dto.LoginRequest;
import com.example.blogapi.dto.RegisterRequest;
import com.example.blogapi.service.AuthService;
import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.util.Map;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthService authService;

    public AuthController(AuthService authService) {
        this.authService = authService;
    }

    // POST /api/auth/register — create a new account
    @PostMapping("/register")
    public ResponseEntity<AuthResponse> register(
            @Valid @RequestBody RegisterRequest request) {
        AuthResponse response = authService.register(request);
        return ResponseEntity.status(HttpStatus.CREATED).body(response);
    }

    // POST /api/auth/login — get access + refresh tokens
    @PostMapping("/login")
    public ResponseEntity<AuthResponse> login(
            @Valid @RequestBody LoginRequest request) {
        AuthResponse response = authService.login(request);
        return ResponseEntity.ok(response);
    }

    // POST /api/auth/refresh — get a new access token using a refresh token
    @PostMapping("/refresh")
    public ResponseEntity<AuthResponse> refreshToken(
            @RequestBody Map<String, String> request) {
        String refreshToken = request.get("refreshToken");
        if (refreshToken == null || refreshToken.isBlank()) {
            return ResponseEntity.badRequest().build();
        }
        AuthResponse response = authService.refreshToken(refreshToken);
        return ResponseEntity.ok(response);
    }
}

Time 0h:   Login → receive accessToken (24h) + refreshToken (7d)

Time 0-24h: Use accessToken for all API requests
            Authorization: Bearer <accessToken>

Time 24h:  Access token expires → API returns 401

Time 24h:  Client sends refreshToken to /api/auth/refresh
           → receives new accessToken (24h more)

Time 0-7d: Can keep refreshing as long as refreshToken is valid

Time 7d:   Refresh token expires → user must log in again

package com.example.blogapi.security;

import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.MediaType;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.stereotype.Component;

import java.io.IOException;
import java.time.LocalDateTime;
import java.util.Map;

// This is called when an unauthenticated user tries to access a protected endpoint.
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {

    private final ObjectMapper objectMapper = new ObjectMapper();

    @Override
    public void commence(HttpServletRequest request,
                         HttpServletResponse response,
                         AuthenticationException authException) throws IOException {

        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

        Map<String, Object> error = Map.of(
                "status", 401,
                "error", "Unauthorized",
                "message", "Authentication required. Please provide a valid JWT token.",
                "path", request.getRequestURI(),
                "timestamp", LocalDateTime.now().toString()
        );

        objectMapper.writeValue(response.getOutputStream(), error);
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        // ... existing config ...

        // Custom 401 response
        .exceptionHandling(exceptions -> exceptions
            .authenticationEntryPoint(jwtAuthenticationEntryPoint)
        )

        .addFilterBefore(jwtAuthenticationFilter,
                UsernamePasswordAuthenticationFilter.class);

    return http.build();
}

curl -X POST http://localhost:8080/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "alice",
    "email": "alice@example.com",
    "password": "securepass123",
    "fullName": "Alice Johnson"
  }'

# Response (201 Created):
# {
#   "message": "Registration successful",
#   "username": "alice",
#   "role": "ROLE_USER"
# }

curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "alice", "password": "securepass123"}'

# Response (200 OK):
# {
#   "message": "Authentication successful",
#   "accessToken": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbGljZSIs...",
#   "refreshToken": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbGljZSIs...",
#   "tokenType": "Bearer",
#   "expiresIn": 86400,
#   "username": "alice",
#   "role": "ROLE_USER"
# }

TOKEN="eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbGljZSIs..."

# Public endpoint — works without any token
curl http://localhost:8080/api/posts

# Expected: 200 OK with list of posts

# With valid token — succeeds
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8080/api/posts/1

# Without token — 401
curl http://localhost:8080/api/posts/1/comments

# Expected 401:
# {
#   "status": 401,
#   "error": "Unauthorized",
#   "message": "Authentication required. Please provide a valid JWT token.",
#   "path": "/api/posts/1/comments"
# }

# Create a comment (requires authentication)
curl -X POST http://localhost:8080/api/posts/1/comments \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"content": "Great article!", "authorId": 1}'

# Expected: 201 Created

# Alice has ROLE_USER — cannot create posts (requires ROLE_AUTHOR)
curl -X POST http://localhost:8080/api/posts \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Test","content":"Test content...","authorId":1}'

# Expected: 403 Forbidden (authenticated but wrong role)

REFRESH_TOKEN="eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbGljZSIs..."

curl -X POST http://localhost:8080/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d "{\"refreshToken\": \"$REFRESH_TOKEN\"}"

# Response (200 OK):
# {
#   "message": "Token refreshed successfully",
#   "accessToken": "eyJ_NEW_TOKEN...",
#   "expiresIn": 86400,
#   "username": "alice",
#   "role": "ROLE_USER"
# }

# Expired/tampered token
curl -H "Authorization: Bearer invalid.token.here" \
  http://localhost:8080/api/posts/1/comments

# Expected: 401 Unauthorized

# Missing "Bearer" prefix
curl -H "Authorization: eyJhbGciOiJIUzI1NiJ9..." \
  http://localhost:8080/api/posts/1/comments

# Expected: 401 Unauthorized (filter doesn't recognize the format)