Skip to content

Commit 89d0ede

Browse files
SiyamuddinSiyamuddin
committed
Add configurable caching feature and comprehensive documentation
- Add app.caching.enabled property to toggle Redis caching on/off - Create CachingToggleConfig for conditional caching enablement - Update CacheConfig to respect caching toggle - Add comprehensive README with user guides and workflows - Add Docker support with docker-compose.yml and Dockerfile - Add environment variable examples in env.example - Refactor payloads into PostPayloads and UserPayload packages - Add security enhancements: audit logging, session tracking, token blacklist - Add email verification and password reset services - Add rate limiting configuration and properties - Update application properties with caching configuration
1 parent 592ce56 commit 89d0ede

File tree

90 files changed

+2932
-1122
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

90 files changed

+2932
-1122
lines changed

‎.cursor/plans/saas-starter-kit-conversion-6526307d.plan.md‎

Lines changed: 344 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,344 @@
1+
<!-- 6526307d-4081-43ff-bdf3-bda71c6ebf1f 5950f52b-27dc-4e18-bce2-70c92e466f7c -->
2+
# SAAS Spring Boot Starter Kit Conversion Plan
3+
4+
## Overview
5+
6+
Transform the current blog application into a reusable SAAS starter kit with advanced user management, clean architecture, and best practices for rapid development of new SAAS applications. No need of 2 factorauthentication for now.
7+
8+
## Phase 1: Core Architecture Refactoring
9+
10+
### 1.1 Package Structure Reorganization
11+
12+
- **Current**: `com.siyamuddin.blog.blogappapis`
13+
- **New**: `com.saas.starter` or `com.yourcompany.saas`
14+
- Create modular package structure:
15+
```
16+
├── core/
17+
│ ├── config/
18+
│ ├── security/
19+
│ ├── exception/
20+
│ └── common/
21+
├── modules/
22+
│ └── user/
23+
│ ├── controller/
24+
│ ├── service/
25+
│ ├── repository/
26+
│ ├── entity/
27+
│ └── dto/
28+
└── shared/
29+
├── utils/
30+
└── constants/
31+
```
32+
33+
34+
### 1.2 Remove Blog-Specific Features
35+
36+
- Delete `PostController`, `PostService`, `PostServiceImpl`, `PostRepo`, `Post` entity
37+
- Delete `CommentController`, `CommentService`, `CommentServiceImpl`, `CommentRepo`, `Comment` entity
38+
- Delete `CategoryController`, `CategoryService`, `CategoryServiceImpl`, `CategoryRepo`, `Category` entity
39+
- Remove blog-related DTOs from `PostPayloads/` package
40+
- Clean up references in `AuthorizationService` (remove `canModifyPost`, `canModifyComment`)
41+
- Update `SecurityConfig` to remove blog-related public URLs
42+
43+
### 1.3 Base Entity Pattern
44+
45+
- Create `BaseEntity` with common fields:
46+
- `id` (UUID or Long)
47+
- `createdAt`, `updatedAt` (audit fields)
48+
- `createdBy`, `updatedBy` (user tracking)
49+
- `version` (optimistic locking)
50+
- All entities extend `BaseEntity`
51+
52+
## Phase 2: Advanced User Management
53+
54+
### 2.1 Enhanced User Entity
55+
56+
- Add fields:
57+
- `emailVerified` (boolean)
58+
- `emailVerificationToken` (String)
59+
- `emailVerificationTokenExpiry` (Date)
60+
- `passwordResetToken` (String)
61+
- `passwordResetTokenExpiry` (Date)
62+
- `failedLoginAttempts` (int)
63+
- `accountLockedUntil` (Date)
64+
- `lastLoginDate` (Date)
65+
- `profileImageUrl` (String)
66+
- `phoneNumber` (String, optional)
67+
- `timezone` (String)
68+
- `locale` (String)
69+
70+
### 2.2 User Service Enhancements
71+
72+
- **Email Verification Service**:
73+
- `sendVerificationEmail(User user)`
74+
- `verifyEmail(String token)`
75+
- `resendVerificationEmail(String email)`
76+
- **Password Reset Service**:
77+
- `requestPasswordReset(String email)`
78+
- `resetPassword(String token, String newPassword)`
79+
- `validateResetToken(String token)`
80+
- **Account Security Service**:
81+
- `lockAccount(String email, int durationMinutes)`
82+
- `unlockAccount(String email)`
83+
- `incrementFailedLoginAttempts(String email)`
84+
- `resetFailedLoginAttempts(String email)`
85+
- **2FA Service**:
86+
- `enable2FA(Integer userId)`
87+
- `disable2FA(Integer userId)`
88+
- `verify2FACode(Integer userId, String code)`
89+
- `generateQRCode(Integer userId)`
90+
- **OAuth Integration Service**:
91+
- Support Google, GitHub, Microsoft OAuth
92+
- `linkOAuthAccount(User user, String provider, String providerId)`
93+
- `unlinkOAuthAccount(User user, String provider)`
94+
95+
### 2.3 Session Management
96+
97+
- Create `UserSession` entity:
98+
- `sessionId` (UUID)
99+
- `userId` (FK to User)
100+
- `ipAddress`, `userAgent`
101+
- `loginTime`, `lastActivity`
102+
- `expiresAt`
103+
- `isActive`
104+
- Session service:
105+
- `createSession(User user, HttpServletRequest)`
106+
- `invalidateSession(String sessionId)`
107+
- `invalidateAllUserSessions(Integer userId)`
108+
- `getActiveSessions(Integer userId)`
109+
- `refreshSession(String sessionId)`
110+
111+
### 2.4 Audit Logging
112+
113+
- Create `AuditLog` entity:
114+
- `userId`, `action`, `resourceType`, `resourceId`
115+
- `ipAddress`, `userAgent`, `timestamp`
116+
- `success`, `errorMessage` (optional)
117+
- Audit service:
118+
- `logUserAction(User user, String action, String resourceType, Object resourceId)`
119+
- `logSecurityEvent(User user, String event, boolean success)`
120+
- Query methods for audit trail
121+
122+
## Phase 3: Security Enhancements
123+
124+
### 3.1 JWT Improvements
125+
126+
- Add refresh token mechanism:
127+
- `JwtTokenPair` (access + refresh tokens)
128+
- `refreshToken(String refreshToken)` endpoint
129+
- Store refresh tokens in database with expiry
130+
- Token revocation:
131+
- `TokenBlacklist` entity/service
132+
- Check blacklist in `JwtAuthenticationFilter`
133+
- Configurable token expiry (access: 15min, refresh: 7 days)
134+
135+
### 3.2 Enhanced Security Config
136+
137+
- Add password policy configuration:
138+
- Min length, complexity requirements
139+
- Password history (prevent reuse)
140+
- Account lockout policy:
141+
- Max failed attempts, lockout duration
142+
- Session timeout configuration
143+
- CSRF protection for state-changing operations
144+
145+
### 3.3 Rate Limiting Improvements
146+
147+
- Per-user rate limiting (not just global)
148+
- Rate limit storage in Redis (for distributed systems)
149+
- Different limits for different user roles
150+
- Rate limit headers in responses
151+
152+
## Phase 4: API Structure & Documentation
153+
154+
### 4.1 RESTful API Best Practices
155+
156+
- Standardize response format:
157+
- `ApiResponse<T>` wrapper with `data`, `message`, `status`, `timestamp`
158+
- Pagination response wrapper
159+
- Version API endpoints: `/api/v1/`
160+
- Consistent error codes and messages
161+
- API versioning strategy
162+
163+
### 4.2 Enhanced Swagger Documentation
164+
165+
- Complete OpenAPI 3.0 documentation
166+
- Security scheme documentation
167+
- Request/response examples
168+
- Error response documentation
169+
- API grouping by modules
170+
171+
### 4.3 User Controller Enhancements
172+
173+
- `GET /api/v1/users/me` - Get current user profile
174+
- `PUT /api/v1/users/me` - Update own profile
175+
- `POST /api/v1/users/me/change-password` - Change password
176+
- `POST /api/v1/users/me/enable-2fa` - Enable 2FA
177+
- `POST /api/v1/users/me/verify-2fa` - Verify 2FA setup
178+
- `GET /api/v1/users/me/sessions` - Get active sessions
179+
- `DELETE /api/v1/users/me/sessions/{sessionId}` - Revoke session
180+
- `POST /api/v1/auth/verify-email` - Verify email
181+
- `POST /api/v1/auth/resend-verification` - Resend verification
182+
- `POST /api/v1/auth/forgot-password` - Request password reset
183+
- `POST /api/v1/auth/reset-password` - Reset password
184+
- `POST /api/v1/auth/refresh-token` - Refresh access token
185+
- `POST /api/v1/auth/logout` - Logout (revoke token)
186+
187+
## Phase 5: Configuration & Environment
188+
189+
### 5.1 Externalized Configuration
190+
191+
- Move all hardcoded values to `application.properties`
192+
- Environment-specific configs:
193+
- `application-dev.properties`
194+
- `application-staging.properties`
195+
- `application-prod.properties`
196+
- Configuration properties classes:
197+
- `JwtProperties`
198+
- `EmailProperties`
199+
- `SecurityProperties`
200+
- `RateLimitProperties`
201+
202+
### 5.2 Feature Flags
203+
204+
- Create feature flag system:
205+
- `FeatureFlag` entity/service
206+
- Enable/disable features per environment
207+
- Examples: `EMAIL_VERIFICATION_ENABLED`, `2FA_ENABLED`, `OAUTH_ENABLED`
208+
209+
## Phase 6: Email Service
210+
211+
### 6.1 Email Service Implementation
212+
213+
- Create `EmailService` interface and implementation
214+
- Support multiple providers (SMTP, SendGrid, AWS SES)
215+
- Email templates:
216+
- Welcome email
217+
- Email verification
218+
- Password reset
219+
- Account locked notification
220+
- 2FA setup instructions
221+
- Async email sending (use `@Async`)
222+
223+
## Phase 7: Database & Persistence
224+
225+
### 7.1 Database Migrations
226+
227+
- Add Flyway or Liquibase for schema versioning
228+
- Initial migration scripts
229+
- Seed data for roles, default admin user
230+
231+
### 7.2 Query Optimization
232+
233+
- Add database indexes:
234+
- `email` (unique)
235+
- `emailVerificationToken`
236+
- `passwordResetToken`
237+
- `createdAt`, `updatedAt`
238+
- Use `@Query` annotations for complex queries
239+
- Implement soft delete pattern (optional)
240+
241+
## Phase 8: Testing Infrastructure
242+
243+
### 8.1 Test Structure
244+
245+
- Unit tests for services
246+
- Integration tests for controllers
247+
- Security test utilities
248+
- Test data builders
249+
- Mock email service for tests
250+
251+
## Phase 9: Documentation & Examples
252+
253+
### 9.1 README Updates
254+
255+
- Project overview
256+
- Setup instructions
257+
- Configuration guide
258+
- API documentation link
259+
- Architecture overview
260+
- How to add new modules
261+
262+
### 9.2 Code Examples
263+
264+
- Example module structure
265+
- How to add new features
266+
- How to extend user management
267+
- Integration examples
268+
269+
## Phase 10: Scalability Considerations
270+
271+
### 10.1 Caching Strategy
272+
273+
- Redis integration for:
274+
- Session storage
275+
- Rate limiting
276+
- Token blacklist
277+
- User cache
278+
- Cache configuration classes
279+
280+
### 10.2 Async Processing
281+
282+
- Spring `@Async` for:
283+
- Email sending
284+
- Audit logging
285+
- Heavy computations
286+
- Task executor configuration
287+
288+
### 10.3 Database Connection Pooling
289+
290+
- HikariCP configuration
291+
- Connection pool tuning
292+
- Read/write replica support (optional)
293+
294+
## Implementation Order
295+
296+
1. **Phase 1**: Remove blog features, reorganize structure
297+
2. **Phase 2**: Enhance User entity and core user services
298+
3. **Phase 3**: Security enhancements (JWT refresh, token revocation)
299+
4. **Phase 4**: API structure and documentation
300+
5. **Phase 5**: Configuration externalization
301+
6. **Phase 6**: Email service
302+
7. **Phase 7**: Database migrations
303+
8. **Phase 8**: Testing infrastructure
304+
9. **Phase 9**: Documentation
305+
10. **Phase 10**: Scalability features
306+
307+
## Key Files to Modify/Create
308+
309+
### Delete:
310+
311+
- `PostController.java`, `PostService.java`, `PostServiceImpl.java`, `PostRepo.java`, `Post.java`
312+
- `CommentController.java`, `CommentService.java`, `CommentServiceImpl.java`, `CommentRepo.java`, `Comment.java`
313+
- `CategoryController.java`, `CategoryService.java`, `CategoryServiceImpl.java`, `CategoryRepo.java`, `Category.java`
314+
- `PostPayloads/` package
315+
- Blog-related methods in `AuthorizationService.java`
316+
317+
### Create:
318+
319+
- `BaseEntity.java` - Base entity class
320+
- `UserSession.java` - Session entity
321+
- `AuditLog.java` - Audit log entity
322+
- `TokenBlacklist.java` - Token blacklist entity
323+
- `EmailService.java` - Email service interface/impl
324+
- `EmailVerificationService.java`
325+
- `PasswordResetService.java`
326+
- `TwoFactorService.java`
327+
- `OAuthService.java`
328+
- `SessionService.java`
329+
- `AuditService.java`
330+
- Configuration property classes
331+
- Enhanced DTOs for user management
332+
333+
### Modify:
334+
335+
- `User.java` - Add new fields
336+
- `UserService.java` / `UserServiceImpl.java` - Add new methods
337+
- `UserController.java` - Add new endpoints
338+
- `AuthController.java` - Add email verification, password reset, refresh token
339+
- `SecurityConfig.java` - Update security rules
340+
- `JwtHelper.java` - Add refresh token support
341+
- `JwtAuthenticationFilter.java` - Add token blacklist check
342+
- `AuthorizationService.java` - Remove blog methods, keep user methods
343+
- `GlobalExceptionHandler.java` - Add new exception handlers
344+
- `application.properties` - Externalize all configs

‎.dockerignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
target
2+
.git
3+
.idea
4+
.mvn
5+
mvnw
6+
.DS_Store
7+
node_modules
8+
*.iml
9+

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ target/
55
!**/src/test/**/target/
66

77
### STS ###
8+
.env
89
.apt_generated
910
.classpath
1011
.factorypath

‎Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM maven:3.9.6-eclipse-temurin-17 AS build
2+
WORKDIR /app
3+
COPY pom.xml .
4+
COPY src ./src
5+
RUN mvn -ntp -DskipTests clean package
6+
7+
FROM eclipse-temurin:17-jre
8+
WORKDIR /app
9+
COPY --from=build /app/target/blog-app-apis-0.0.1-SNAPSHOT.jar app.jar
10+
EXPOSE 9090
11+
ENTRYPOINT ["java","-jar","/app/app.jar"]
12+

0 commit comments

Comments
 (0)