Feature/password validation fixes

[devondragon]

This pull request introduces several important changes to improve password validation and security in the SpringUserFramework, especially around password reset and update flows. The main updates include adding a dedicated endpoint for saving new passwords after a reset, enforcing password policy and history checks, improving error handling and messaging, and enhancing the demo application's forms for better usability and consistency.

Key changes are grouped below:

Password Reset Flow Improvements

• Added a new /user/savePassword endpoint in UserAPI.java to handle saving a new password after a password reset token is validated. This endpoint checks for password match, validates the reset token, enforces password policy (including history and strength), saves the new password, and deletes the token after use.
• Introduced SavePasswordDto as a new DTO to carry the token, new password, and confirmation password for the password reset flow.
• Implemented deletePasswordResetToken in UserService.java to remove used tokens and prevent reuse.

Password Policy and History Enforcement

• Updated password policy enforcement to clarify that history checks are only applied to existing users (not during registration), and improved JavaDoc comments for clarity. [1] [2]
• Made the password history relation in User entity explicit and set to LAZY loading. Also, changed the fetch type for PasswordHistoryEntry.user to LAZY for efficiency. [1] [2]
• Added a @Transactional(isolation = Isolation.SERIALIZABLE) annotation to cleanUpPasswordHistory to prevent race conditions when updating password history.

Demo Application and User Experience

• Provided a comprehensive guide (DEMO_APP_CHANGES_REQUIRED.md) outlining necessary changes in the demo app, including fixing the password reset form to use the correct endpoint and field names, and suggestions for reusing the password strength meter across all password-related forms.

Error Handling and Messaging

• Added new localized error messages for password mismatch and reset success in dsspringusermessages.properties.
• Improved error handling and logging throughout the password reset and update flows, including audit logging for both success and failure cases. [1] [2]

---

References:
[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

[Copilot]

Pull Request Overview

This pull request implements comprehensive security improvements to the password reset and update flows, addressing critical validation gaps and enforcing password policies consistently throughout the user authentication system. The changes introduce a new dedicated password reset endpoint, enhance password policy enforcement with history checking, improve database performance through optimized lazy loading, and provide clear documentation for required demo application updates.

Key Changes:

• Added /user/savePassword endpoint with full password policy validation and token management for the password reset flow
• Enhanced password update endpoint to validate new passwords against policy rules including history checking
• Optimized password history relationship loading and added transaction isolation to prevent race conditions

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
SavePasswordDto.java	New DTO to support password reset flow with token and password fields
UserAPI.java	Added savePassword endpoint and enhanced updatePassword with policy validation
UserService.java	Added token deletion method and SERIALIZABLE isolation for history cleanup
PasswordPolicyService.java	Clarified documentation that history checks skip new user registrations
User.java	Added explicit LAZY-loaded password history relationship
PasswordHistoryEntry.java	Changed user relationship to LAZY loading for performance
dsspringusermessages.properties	Added password mismatch and reset success messages
IMPLEMENTATION_PLAN_PASSWORD_FIXES.md	Comprehensive implementation guide and testing strategy
DEMO_APP_CHANGES_REQUIRED.md	Documentation of required demo app form fixes

Comments suppressed due to low confidence (1)

src/main/java/com/digitalsanctuary/spring/user/dto/SavePasswordDto.java:1

• The @NotEmpty annotation already validates for null and empty strings, making @NotNull redundant. Consider removing @NotNull annotations or use @NotBlank which is more appropriate for trimming whitespace in string fields.

package com.digitalsanctuary.spring.user.dto;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The method fetches the entire PasswordResetToken entity just to delete it. Consider adding a deleteByToken(String token) method to the repository to execute a direct DELETE query, avoiding the unnecessary SELECT and reducing database roundtrips.

Suggested change

	PasswordResetToken resetToken = passwordTokenRepository.findByToken(token);
	if (resetToken != null) {
	passwordTokenRepository.delete(resetToken);
	log.debug("Deleted password reset token for user: {}", resetToken.getUser().getEmail());
	}
	passwordTokenRepository.deleteByToken(token);
	log.debug("Deleted password reset token with token: {}", token);

[devondragon]

Will fix.