TP1 - Autenticação por Formulário

Objetivos do TP

Neste TP, você irá:

1. ✅ Criar uma aplicação web segura com Spring Security
2. ✅ Implementar autenticação por formulário
3. ✅ Armazenar usuários no banco de dados
4. ✅ Gerenciar os papéis USER e ADMIN
5. ✅ Personalizar as páginas de login/logout

Duração estimada: 1h30

---

Contexto

Você irá criar uma aplicação de gerenciamento de tarefas com:

• Página inicial pública
• Dashboard acessível para usuários autenticados
• Página de administração reservada para admins

---

Parte 1: Setup do Projeto

1.1 Criar o Projeto

Spring Initializr com:

• Artifact: security-form-demo
• Dependencies:
  • Spring Web
  • Spring Security
  • Spring Data JPA
  • H2 Database
  • Thymeleaf
  • Lombok

1.2 Estrutura

src/main/java/com/example/security/
├── config/
│   └── SecurityConfig.java
├── model/
│   ├── User.java
│   └── Role.java
├── repository/
│   ├── UserRepository.java
│   └── RoleRepository.java
├── service/
│   ├── CustomUserDetailsService.java
│   └── UserService.java
├── controller/
│   ├── HomeController.java
│   └── AdminController.java
└── SecurityFormDemoApplication.java

---

Parte 2: Entidades

2.1 Role

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    public Role(String name) {
        this.name = name;
    }
}

2.2 User

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    @Column(unique = true, nullable = false)
    private String email;

    private boolean enabled = true;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Parte 3: Repositórios e Serviços

3.1 Repositórios

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
    boolean existsByUsername(String username);
}

@Repository
public interface RoleRepository extends JpaRepository<Role, Long> {
    Optional<Role> findByName(String name);
}

3.2 CustomUserDetailsService

@Service
@RequiredArgsConstructor
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("Usuário não encontrado: " + username));

        return org.springframework.security.core.userdetails.User.builder()
            .username(user.getUsername())
            .password(user.getPassword())
            .authorities(user.getRoles().stream()
                .map(role -> new SimpleGrantedAuthority(role.getName()))
                .toList())
            .disabled(!user.isEnabled())
            .build();
    }
}

3.3 UserService

@Service
@RequiredArgsConstructor
public class UserService {

    private final UserRepository userRepository;
    private final RoleRepository roleRepository;
    private final PasswordEncoder passwordEncoder;

    @Transactional
    public User createUser(String username, String email, String password, String roleName) {
        if (userRepository.existsByUsername(username)) {
            throw new RuntimeException("Username já utilizado");
        }

        Role role = roleRepository.findByName(roleName)
            .orElseThrow(() -> new RuntimeException("Papel não encontrado: " + roleName));

        User user = new User();
        user.setUsername(username);
        user.setEmail(email);
        user.setPassword(passwordEncoder.encode(password));
        user.setEnabled(true);
        user.getRoles().add(role);

        return userRepository.save(user);
    }
}

---

Parte 4: Configuração de Segurança

4.1 SecurityConfig

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final CustomUserDetailsService userDetailsService;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/home", "/register", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout=true")
                .deleteCookies("JSESSIONID")
                .permitAll()
            )
            .userDetailsService(userDetailsService)
            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

---

Parte 5: Controllers

5.1 HomeController

@Controller
public class HomeController {

    @GetMapping({"/", "/home"})
    public String home() {
        return "home";
    }

    @GetMapping("/login")
    public String login() {
        return "login";
    }

    @GetMapping("/dashboard")
    public String dashboard(Model model, Principal principal) {
        model.addAttribute("username", principal.getName());
        return "dashboard";
    }

    @GetMapping("/register")
    public String registerForm(Model model) {
        model.addAttribute("user", new User());
        return "register";
    }

    @PostMapping("/register")
    public String register(@ModelAttribute User user, 
                          @RequestParam String password,
                          RedirectAttributes redirectAttributes,
                          UserService userService) {
        try {
            userService.createUser(user.getUsername(), user.getEmail(), password, "ROLE_USER");
            redirectAttributes.addFlashAttribute("success", "Conta criada! Faça login.");
            return "redirect:/login";
        } catch (Exception e) {
            redirectAttributes.addFlashAttribute("error", e.getMessage());
            return "redirect:/register";
        }
    }
}

5.2 AdminController

@Controller
@RequestMapping("/admin")
@RequiredArgsConstructor
public class AdminController {

    private final UserRepository userRepository;

    @GetMapping
    public String adminDashboard(Model model) {
        model.addAttribute("users", userRepository.findAll());
        return "admin/dashboard";
    }

    @PostMapping("/users/{id}/disable")
    public String disableUser(@PathVariable Long id) {
        userRepository.findById(id).ifPresent(user -> {
            user.setEnabled(false);
            userRepository.save(user);
        });
        return "redirect:/admin";
    }
}

---

Parte 6: Templates Thymeleaf

6.1 home.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <title>Início</title>
</head>
<body>
    <h1>Bem-vindo!</h1>
    
    <div sec:authorize="isAnonymous()">
        <p>Você não está autenticado.</p>
        <a href="/login">Entrar</a> | <a href="/register">Registrar</a>
    </div>
    
    <div sec:authorize="isAuthenticated()">
        <p>Olá, <span sec:authentication="name">Usuário</span>!</p>
        <a href="/dashboard">Dashboard</a>
        <div sec:authorize="hasRole('ADMIN')">
            <a href="/admin">Administração</a>
        </div>
        <form th:action="@{/logout}" method="post" style="display:inline;">
            <button type="submit">Sair</button>
        </form>
    </div>
</body>
</html>

6.2 login.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Login</title>
</head>
<body>
    <h1>Login</h1>
    
    <div th:if="${param.error}" style="color:red;">
        Nome de usuário ou senha incorretos.
    </div>
    <div th:if="${param.logout}" style="color:green;">
        Logout realizado com sucesso.
    </div>
    <div th:if="${success}" style="color:green;" th:text="${success}"></div>
    
    <form th:action="@{/login}" method="post">
        <div>
            <label>Nome de usuário:</label>
            <input type="text" name="username" required/>
        </div>
        <div>
            <label>Senha:</label>
            <input type="password" name="password" required/>
        </div>
        <button type="submit">Entrar</button>
    </form>
    
    <p><a href="/register">Não tem conta? Cadastre-se</a></p>
</body>
</html>

6.3 dashboard.html

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
    <title>Dashboard</title>
</head>
<body>
    <h1>Dashboard</h1>
    <p>Bem-vindo, <span th:text="${username}">Usuário</span>!</p>
    
    <h2>Seus papéis:</h2>
    <ul sec:authentication="authorities">
        <!-- Exibe os papéis -->
    </ul>
    
    <a href="/home">Início</a>
    <form th:action="@{/logout}" method="post" style="display:inline;">
        <button type="submit">Sair</button>
    </form>
</body>
</html>

---

Parte 7: Dados Iniciais

DataInitializer

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final RoleRepository roleRepository;
    private final UserService userService;

    @Override
    @Transactional
    public void run(String... args) {
        // Criar papéis
        if (roleRepository.count() == 0) {
            roleRepository.save(new Role("ROLE_USER"));
            roleRepository.save(new Role("ROLE_ADMIN"));
        }

        // Criar admin padrão
        try {
            userService.createUser("admin", "admin@test.com", "admin123", "ROLE_ADMIN");
            userService.createUser("user", "user@test.com", "user123", "ROLE_USER");
        } catch (Exception ignored) {}
    }
}

---

Parte 8: Configuração

# application.properties
spring.datasource.url=jdbc:h2:mem:securitydb
spring.h2.console.enabled=true
spring.jpa.hibernate.ddl-auto=create-drop
spring.jpa.show-sql=true

logging.level.org.springframework.security=DEBUG

---

Testes

Checklist

• Página inicial acessível para todos
• Login com user/user123 → Dashboard
• Login com admin/admin123 → Dashboard + acesso Admin
• User não pode acessar /admin (403)
• Logout funciona
• Cadastro cria novo usuário

Testes manuais

1. http://localhost:8080 → Página inicial
2. Clique em "Entrar" → Página de login
3. Login admin/admin123 → Dashboard
4. Acesso /admin → OK
5. Logout → Retorna para login
6. Login user/user123 → Dashboard
7. Acesso /admin → 403 Forbidden

---

🎯 Próximo Passo

➡️ TP8.2: API REST com JWT

---

⬅️ Voltar ao Módulo 8