getting ready for production

.project

@@ -5,6 +5,11 @@
 	<projects>
 	</projects>
 	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.wst.common.project.facet.core.builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
 		<buildCommand>
 			<name>org.eclipse.jdt.core.javabuilder</name>
 			<arguments>
@@ -19,5 +24,6 @@
 	<natures>
 		<nature>org.eclipse.jdt.core.javanature</nature>
 		<nature>org.eclipse.m2e.core.maven2Nature</nature>
+		<nature>org.eclipse.wst.common.project.facet.core.nature</nature>
 	</natures>
 </projectDescription>

README.md

@@ -19,9 +19,9 @@ https://letsencrypt.org/getting-started/
 
 
 # TODO
-- umschalten von Ausgabe auf Entnahme möglich? Ansonsten Pseudo-Kategorie aus Edit-Fenster entfernen
+- Server: SSL und logs konfigurieren
-- Auslagen in Modal anzeigen und zurücksetzen
+- Benutzer-Passwörter ändern und Hashing einführen
-- verschiedene Hintergrundfarben für Auslagen, je nach User
+
 - Export als CSV
 - Import von comdirect mit Mustererkennung und Muster-Editor
 

pom.xml

@@ -3,8 +3,8 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>de.tilman</groupId>
 	<artifactId>next-transactions</artifactId>
-	<version>0.0.1-SNAPSHOT</version>
+	<version>1.0.0</version>
-	
+
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
@@ -34,7 +34,6 @@
 		<java.version>1.8</java.version>
 	</properties>
 
-
 	<build>
 		<plugins>
 			<plugin>

src/main/java/de/tilman/transactions/Application.java

@@ -1,67 +1,51 @@
 package de.tilman.transactions;
 
-import javax.annotation.PostConstruct;
-
-import org.h2.server.web.WebServlet;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.embedded.ServletRegistrationBean;
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-import de.tilman.transactions.domain.Account;
-import de.tilman.transactions.domain.User;
-import de.tilman.transactions.repository.AccountRepository;
-import de.tilman.transactions.repository.UserRepository;
 
 @SpringBootApplication
 public class Application {
-
+	
 	public static void main(String[] args) {
 		SpringApplication.run(Application.class);
 	}
 	
-	private static final Logger log = LoggerFactory.getLogger(Application.class);
+//	private static final Logger log = LoggerFactory.getLogger(Application.class);
+//	
+//	@Autowired UserRepository userRepository;
+//	@Autowired AccountRepository accountRepository;
+//
+//	
+//	// XXX for dev
+//	@PostConstruct
+//	public void init() {
+//
+//		/**
+//		 * Due to method-level protections the security context must be loaded
+//		 * with an authentication token containing the necessary privileges.
+//		 */
+//		SecurityContextHolder.getContext().setAuthentication(
+//				new UsernamePasswordAuthenticationToken("system", "system", AuthorityUtils.createAuthorityList("ROLE_ADMIN", "ROLE_USER")));
+//
+//		log.info("Users:");
+//		for (User user : userRepository.findAll()) {
+//			log.info(user.getId() + ", " + user.getName());
+//		}
+//
+//		log.info("Accounts:");
+//		for (Account account : accountRepository.findAll()) {
+//			log.info(account.getId() + ", " + account.getName() /* + ", " + account.getOwner().getName() */);
+//		}
+//		
+//		SecurityContextHolder.clearContext();
+//	}
 	
-	@Autowired UserRepository userRepository;
+//	// XXX for dev - make H2 database available as jdbc:h2:mem:testdb at /console (https://springframework.guru/using-the-h2-database-console-in-spring-boot-with-spring-security/)
-	@Autowired AccountRepository accountRepository;
+//	@Bean
-
+//	public ServletRegistrationBean h2servletRegistration() {
-	
+//	    ServletRegistrationBean registration = new ServletRegistrationBean(new WebServlet());
-	// XXX for dev
+//	    registration.addUrlMappings("/console/*");
-	@PostConstruct
+//	    return registration;
-	public void init() {
+//	}	
-
-		/**
-		 * Due to method-level protections the security context must be loaded
-		 * with an authentication token containing the necessary privileges.
-		 */
-		SecurityContextHolder.getContext().setAuthentication(
-				new UsernamePasswordAuthenticationToken("system", "system", AuthorityUtils.createAuthorityList("ROLE_ADMIN", "ROLE_USER")));
-
-		log.info("Users:");
-		for (User user : userRepository.findAll()) {
-			log.info(user.getId() + ", " + user.getName());
-		}
-
-		log.info("Accounts:");
-		for (Account account : accountRepository.findAll()) {
-			log.info(account.getId() + ", " + account.getName() /* + ", " + account.getOwner().getName() */);
-		}
-		
-		SecurityContextHolder.clearContext();
-	}
-	
-	// XXX for dev - make H2 database available as jdbc:h2:mem:testdb at /console (https://springframework.guru/using-the-h2-database-console-in-spring-boot-with-spring-security/)
-	@Bean
-	public ServletRegistrationBean h2servletRegistration() {
-	    ServletRegistrationBean registration = new ServletRegistrationBean(new WebServlet());
-	    registration.addUrlMappings("/console/*");
-	    return registration;
-	}	
 
 }

src/main/java/de/tilman/transactions/SecurityConfiguration.java

@@ -26,13 +26,13 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 		// Basis-Schutz: Nur autorisierte Zugriffe (feingranulare Steuerung über Assertions)
 		http.authorizeRequests()
 			.antMatchers(HttpMethod.GET, "/public/**").permitAll()
-			.antMatchers("/console/**").permitAll()
+//			.antMatchers("/console/**").permitAll() // H2 console
 			.anyRequest().authenticated();
 		
 		http.httpBasic(); // XXX mit HTTP Basic Auth funktioniert der Logout nicht richtig
 //		http.formLogin();
 		
 		http.csrf().disable(); // XXX später wieder aktivieren
-		http.headers().frameOptions().disable();
+//		http.headers().frameOptions().disable(); // for H2 console
 	}
 }

src/main/resources/application.properties

@@ -1,5 +1,13 @@
 spring.datasource.platform=h2
-security.user.name=sa
+server.port=8084
-security.user.password=
+
+
+# for production
+
+spring.jpa.hibernate.ddl-auto=none
+
+spring.datasource.url=jdbc:h2:tcp://localhost/transactions
+spring.datasource.username=sa
+spring.datasource.password=PASSWORD
+
 
-server.port=8080