Code review: Spring Boot Security Module

[Copilot]

Comprehensive code review of the Spring Boot JWT + MongoDB security module. No code changes — findings only.

🔴 Critical

• Hardcoded JWT secrets in VCS (application.properties, application-dev.properties) — secrets must be externalised to env vars; application-prod.properties already does this correctly
• Wildcard CORS + credentials — SecurityConfig sets allowedOriginPatterns("*") with allowCredentials(true); any origin can make credentialed requests
• RBAC is broken — UserPrincipal.getAuthorities() hardcodes "USER" regardless of stored roles; @PreAuthorize("hasRole('ADMIN')") will never work
• Unhandled InvalidTokenException in JwtFilter — malformed/expired token throws uncaught exception → 500 instead of 401

🟠 High

• Duplicate conflicting CORS config — CorsConfig.java (WebMvcConfigurer) is dead code; Spring Security's corsConfigurationSource() in SecurityConfig takes precedence
• UserServices creates its own BCryptPasswordEncoder instead of injecting the declared PasswordEncoder bean
• JwtFilter uses ApplicationContext.getBean() to avoid a circular dependency — anti-pattern; restructure with @Lazy or direct injection
• No ownership check on PATCH/DELETE /api/routines/{id} — any authenticated user can mutate any other user's routine
• GET /api/routines exposes all users' data — should be admin-only or removed
• Shop entity missing @Id — private String id is never populated on reads

🟡 Medium

• Inconsistent password validation — RegisterRequest reports "6–100 chars" but ValidationUtils enforces 8-char + complexity; ValidationUtils wins at runtime but client message is wrong
• RegisterRequest has a weaker, unused email regex — confusing alongside ValidationUtils; remove it
• Duplicate audit fields in Users — both @CreatedDate/@LastModifiedDate fields and an embedded AuditDateTime object
• Dead code — UserServices.verify(), commented-out UserController block, entirely commented-out JpaConfig.java
• SQL migration files (V1, V2 Flyway scripts) left in a MongoDB project
• ShopService.updateShop() NPE if auditDateTime is null on the fetched document
• Redundant Lombok — @Getter/@Setter alongside @Data on Users, Routine, RoutineStatusRequest
• Field injection (@Autowired) used inconsistently — RoutineController/RoutineService/ShopController already use constructor injection correctly; apply consistently
• Duplicate repo method — ShopRepository declares both findByUserId and getShopByUserId (same query)