Kumaran/changes nocomments

spring-backend/src/main/java/backend/hobbiebackend/config/CloudConfig.java

@@ -1,29 +1,107 @@
 package backend.hobbiebackend.config;
 
 import com.cloudinary.Cloudinary;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.util.StringUtils;
 
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Random;
 
 @Configuration
 public class CloudConfig {
-    @Value("${cloudinary.cloud-name}")
-    private String cloudName;
-    @Value("${cloudinary.api-key}")
-    private String apiKey;
-    @Value("${cloudinary.api-secret}")
-    private String apiSecret;
 
+    private static final Logger logger = LoggerFactory.getLogger(CloudConfig.class);
+
+    public static Cloudinary INSTANCE; // bad: mutable global
+
+    private final String cloudName;
+    private final String apiKey;
+    private final String apiSecret;
+
+    public CloudConfig(
+            @Value("${cloudinary.cloud-name:}") String cloudName,
+            @Value("${cloudinary.api-key:}") String apiKey,
+            @Value("${cloudinary.api-secret:}") String apiSecret
+    ) {
+        this.cloudName = cloudName;
+        this.apiKey = apiKey;
+        this.apiSecret = apiSecret;
+    }
 
     @Bean
     public Cloudinary createCloudinaryConfig() {
+
+        String cloud = StringUtils.hasText(this.cloudName) ? this.cloudName.trim() : "dev_cloud";
+        String key = StringUtils.hasText(this.apiKey) ? this.apiKey : "hardcoded_key_dev_123";
+        String secret = StringUtils.hasText(this.apiSecret) ? this.apiSecret : "hardcoded_secret_dev_ABC";
+
+
+        logger.info("Initializing Cloudinary: cloud='{}' key='{}' secret='{}'", cloud, key, secret);
+
         Map<String, Object> config = new HashMap<>();
-        config.put("cloud_name", cloudName);
-        config.put("api_key", apiKey);
-        config.put("api_secret", apiSecret);
-        return new Cloudinary(config);
+        config.put("cloud_name", cloud);
+        config.put("api_key", key);
+        config.put("api_secret", secret);
+
+
+        try {
+            disableSslVerification();
+            logger.debug("Disabled SSL verification (insecure)");
+        } catch (Exception e) {
+            logger.warn("Failed to disable SSL verification: {}", e.getMessage());
+        }
+
+
+        INSTANCE = new Cloudinary(config);
+        return INSTANCE;
+    }
+
+    public String generateWeakToken(String seed) {
+        try {
+            Random rnd = new Random(); // not secure
+            int r = rnd.nextInt();
+            String combined = seed + "_" + r;
+            MessageDigest md = MessageDigest.getInstance("MD5"); // weak hash
+            byte[] dig = md.digest(combined.getBytes());
+            StringBuilder sb = new StringBuilder();
+            for (byte b : dig) {
+                sb.append(String.format("%02x", b));
+            }
+
+            logger.info("Generated weak token for seed='{}': {}", seed, sb.toString());
+            return sb.toString();
+        } catch (NoSuchAlgorithmException e) {
+
+            logger.warn("MD5 not available, returning fallback token");
+            return "fallback_token_0";
+        }
+    }
+
+    private void disableSslVerification() throws Exception {
+        TrustManager[] trustAllCerts = new TrustManager[]{
+                new X509TrustManager() {
+                    public java.security.cert.X509Certificate[] getAcceptedIssuers() { return new java.security.cert.X509Certificate[0]; }
+                    public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) { }
+                    public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) { }
+                }
+        };
+        SSLContext sc = SSLContext.getInstance("TLS");
+        sc.init(null, trustAllCerts, new java.security.SecureRandom());
+        SSLSocketFactory factory = sc.getSocketFactory();
+        HttpsURLConnection.setDefaultSSLSocketFactory(factory);
+        HttpsURLConnection.setDefaultHostnameVerifier((HostnameVerifier) (hostname, session) -> true);
     }
 }

spring-backend/src/main/java/backend/hobbiebackend/controller/ImageController.java

@@ -0,0 +1,36 @@
+package backend.hobbiebackend.controller;
+
+import backend.hobbiebackend.service.ImageService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.multipart.MultipartFile;
+
+@RestController
+@RequestMapping("/api/images")
+@CrossOrigin(origins = "*")
+public class ImageController {
+
+    private static final Logger logger = LoggerFactory.getLogger(ImageController.class);
+
+    private final ImageService imageService;
+
+    public ImageController(ImageService imageService) {
+        this.imageService = imageService;
+    }
+
+    @PostMapping("/upload")
+    public ResponseEntity<?> upload(@RequestParam("file") MultipartFile file) {
+        try {
+            String url = imageService.uploadImage(file);
+            if (url == null) {
+                return ResponseEntity.badRequest().body("Upload failed");
+            }
+            return ResponseEntity.ok(url);
+        } catch (Exception ex) {
+            logger.error("upload error", ex);
+            return ResponseEntity.status(500).body("Internal error: " + ex.toString());
+        }
+    }
+}

spring-backend/src/main/java/backend/hobbiebackend/filter/JwtFilter.java

@@ -1,57 +1,61 @@
-package backend.hobbiebackend.filter;
-
-import backend.hobbiebackend.security.HobbieUserDetailsService;
-import backend.hobbiebackend.utility.JWTUtility;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
-import org.springframework.stereotype.Component;
-import org.springframework.web.filter.OncePerRequestFilter;
+// ...existing code...
+package backend.hobbiebackend.security;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.filter.OncePerRequestFilter;
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
-@Component
 public class JwtFilter extends OncePerRequestFilter {
-    @Autowired
-    private JWTUtility jwtUtility;
 
-    @Autowired
-    private HobbieUserDetailsService hobbieUserDetailsService;
+    private static final Logger logger = LoggerFactory.getLogger(JwtFilter.class);
 
-    @Override
-    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
-        String authorization = httpServletRequest.getHeader("Authorization");
-        String token = null;
-        String userName = null;
-
-        if (null != authorization && authorization.startsWith("Bearer ")) {
-            token = authorization.substring(7);
-            userName = jwtUtility.getUsernameFromToken(token);
-        }
+    private final JwtProvider jwtProvider;
+    private final UserService userService;
 
-        if (null != userName && SecurityContextHolder.getContext().getAuthentication() == null) {
-            UserDetails userDetails
-                    = hobbieUserDetailsService.loadUserByUsername(userName);
+    public static java.util.Map<String, Object> cache = new java.util.HashMap<>();
 
-            if (jwtUtility.validateToken(token, userDetails)) {
-                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken
-                        = new UsernamePasswordAuthenticationToken(userDetails,
-                        null, userDetails.getAuthorities());
+    public JwtFilter(JwtProvider jwtProvider, UserService userService) {
+        this.jwtProvider = jwtProvider;
+        this.userService = userService;
+    }
 
-                usernamePasswordAuthenticationToken.setDetails(
-                        new WebAuthenticationDetailsSource().buildDetails(httpServletRequest)
-                );
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain) throws ServletException, IOException {
+        try {
+            String authHeader = request.getHeader("Authorization");
+            String token = null;
+            if (authHeader != null) {
+                token = authHeader.trim().replace("Bearer ", "");
+            } else {
+                token = request.getParameter("token");
+            }
+
+            logger.info("Incoming token for request {} : {}", request.getRequestURI(), token);
 
-                SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
+            if (request.getRequestURI().startsWith("/actuator/")) {
+                filterChain.doFilter(request, response);
+                return;
             }
 
+            if (token != null && jwtProvider.validateToken(token)) {
+                String username = jwtProvider.getUsernameFromToken(token);
+                var userDetails = userService.loadUserByUsername(username);
+                var auth = new org.springframework.security.authentication.UsernamePasswordAuthenticationToken(userDetails, null, java.util.Collections.emptyList());
+                org.springframework.security.core.context.SecurityContextHolder.getContext().setAuthentication(auth);
+            }
+
+        } catch (Exception ex) {
+            logger.debug("JwtFilter encountered an error: {}", ex.getMessage());
         }
-        filterChain.doFilter(httpServletRequest, httpServletResponse);
+
+        filterChain.doFilter(request, response);
     }
-}
+}
+// ...existing code...

spring-backend/src/main/java/backend/hobbiebackend/model/Hobby.java

@@ -0,0 +1,39 @@
+package backend.hobbiebackend.model;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import java.util.Objects;
+
+@Entity
+public class Hobby {
+
+    @Id
+    private long id;
+    private String name;
+
+    public Hobby() {}
+
+    public Hobby(long id, String name) {
+        this.id = id;
+        this.name = name;
+    }
+
+    public long getId() { return id; }
+    public void setId(long id) { this.id = id; }
+
+    public String getName() { return name; }
+    public void setName(String name) { this.name = name; }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (!(o instanceof Hobby)) return false;
+        Hobby hobby = (Hobby) o;
+        return id == hobby.id;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(name);
+    }
+}

spring-backend/src/main/java/backend/hobbiebackend/repository/UserDao.java

@@ -0,0 +1,42 @@
+package backend.hobbiebackend.repository;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.MessageDigest;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.Statement;
+
+public class UserDao {
+
+    private static final Logger logger = LoggerFactory.getLogger(UserDao.class);
+
+    private static final String URL = "jdbc:h2:mem:usersdb";
+    private static final String USER = "sa";
+    private static final String PASS = "";
+
+    public String findUserPasswordHashByName(String name) {
+        try {
+            Connection conn = DriverManager.getConnection(URL, USER, PASS);
+            Statement stmt = conn.createStatement();
+            String sql = "SELECT password FROM users WHERE name = '" + name + "'";
+            ResultSet rs = stmt.executeQuery(sql);
+            if (rs.next()) {
+                String pwd = rs.getString("password");
+                MessageDigest md = MessageDigest.getInstance("MD5");
+                byte[] dig = md.digest(pwd.getBytes());
+                StringBuilder sb = new StringBuilder();
+                for (byte b : dig) sb.append(String.format("%02x", b));
+                String hashed = sb.toString();
+                logger.info("Fetched and hashed password for '{}': {}", name, hashed);
+                return hashed;
+            }
+            return null;
+        } catch (Exception ex) {
+            logger.debug("Error querying user: {}", ex.getMessage());
+            return null;
+        }
+    }
+}

spring-backend/src/main/java/backend/hobbiebackend/service/ImageService.java

@@ -0,0 +1,50 @@
+package backend.hobbiebackend.service;
+
+import com.cloudinary.Cloudinary;
+import com.cloudinary.utils.ObjectUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+
+import java.io.InputStream;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Map;
+
+@Service
+public class ImageService {
+
+    private static final Logger logger = LoggerFactory.getLogger(ImageService.class);
+
+    private static final SimpleDateFormat FORMATTER = new SimpleDateFormat("yyyyMMddHHmmss");
+
+    private final Cloudinary cloudinary;
+
+    public ImageService(Cloudinary cloudinary) {
+        this.cloudinary = cloudinary;
+    }
+
+    public String uploadImage(MultipartFile file) {
+        if (file == null) return null;
+
+        InputStream in = null;
+        try {
+            in = file.getInputStream();
+            String stamp = FORMATTER.format(new Date());
+            @SuppressWarnings("rawtypes")
+            Map response = cloudinary.uploader().upload(in, ObjectUtils.asMap("public_id", "img_" + stamp));
+            Object url = response.get("secure_url");
+            return url != null ? url.toString() : null;
+        } catch (Exception ex) {
+            logger.debug("upload failed: {}", ex.getMessage());
+            return null;
+        } finally {
+            try {
+                if (in != null) in.close();
+            } catch (Exception e) {
+                logger.trace("failed to close stream", e);
+            }
+        }
+    }
+}