5 Commits

Include renames

Author	SHA1	Message	Date
darroyo	6a7f01289b	fix(auth): move SecureRandom out of static field for native-image compat ... GraalVM native-image rejects static fields of type Random/SecureRandom (their internal state is captured at build time and can't be replayed deterministically). Move the instance into generatePassword() as a local variable - it is only used once at startup anyway.	2026-08-14 22:16:36 -04:00
darroyo	a171943f98	feat(auth): admin UI for user management + change-password frontend ... Backend additions: - User.lastLoginAt column (updated on each successful login) - AdminUserSummary DTO (id, username, createdAt, lastLoginAt, isAdmin, mustChangePassword) - GET /api/auth/admin/users (RolesAllowed("admin")) -> array of summaries - AuthService.listUsersForAdmin() + AuthService.authenticate() now @Transactional and bumps lastLoginAt Frontend (Phase 1): - User type extended with mustChangePassword + isAdmin - api.changePassword() / api.adminResetPassword() / api.adminListUsers() - AuthContext exposes changePassword - ChangePasswordPage.tsx (full-page, current + new + confirm, errors inline) - App.tsx routes LoginPage -> ChangePasswordPage -> AuthenticatedApp Frontend (Phase 2): - TabBar supports optional 'usuarios' tab (shown only if user.isAdmin) - UsersAdminPage.tsx: lista todos los usuarios con badges de rol y estado, botón "Resetear contraseña" con modal inline que llama adminResetPassword - Header de AuthenticatedApp muestra un badge 'admin' al lado del username Both mvn compile and npm tsc + vite build pass clean.	2026-08-14 20:07:12 -04:00
darroyo	1d6fc08a25	feat(auth): bootstrap admin on first boot + forced password change + admin reset ... Backend changes (no frontend yet): Schema (User entity) - + mustChange_password (boolean NOT NULL, default false) - + is_admin (boolean NOT NULL, default false) Hibernate update mode adds both columns automatically. BootstrapAdmin (new, ApplicationScoped, @Observes StartupEvent) - runs only when User.count() == 0 and app.bootstrap.admin.enabled=true - generates a 20-char random password (alphabet without 0/o/O/1/l/I) - persists the user with isAdmin=true, mustChangePassword=true - prints a banner to stdout AND to the JBoss logger so docker logs picks it up: BOOTSTRAP-ADMIN-USERNAME admin BOOTSTRAP-ADMIN-PASSWORD <random> BOOTSTRAP-ADMIN-CHANGE This password MUST be changed on first login ... - idempotent: skips if any user already exists MustChangePasswordFilter (new, @Provider ContainerRequestFilter) - runs after JWT auth (Priorities.AUTHENTICATION + 100) - for authenticated requests with mustChangePassword=true, returns 403 with {error, mustChangePassword:true} unless the path is /api/auth/change-password or /api/auth/logout Change-password endpoint (POST /api/auth/change-password) - @Authenticated, body {currentPassword, newPassword} - verifies currentPassword via bcrypt, validates newPassword>=8 chars, updates hash and sets mustChangePassword=false - returns updated AuthMeResponse and re-issues the auth cookie Admin reset endpoint (POST /api/auth/admin/reset-password) - @RolesAllowed("admin") - body {username, newPassword} - sets target's passwordHash and mustChangePassword=true (forces change on next login) - security: only users in the JWT 'admin' group can hit it; isAdmin is stored on the user record so a stale token can't promote itself JWT groups now include 'admin' for isAdmin users; previously everyone was just 'user'. Config (application.properties) - app.bootstrap.admin.enabled=true - app.bootstrap.admin.username=admin	2026-08-14 20:04:44 -04:00
darroyo	7b89066ef3	fix(ci): gitignore was excluding src/frontend/src/data/defaults.ts ... The .gitignore had 'data/' which matches any 'data' directory at any depth. That excluded src/frontend/src/data/ from git, so the file defaults.ts (with DEFAULT_INSUMOS, DEFAULT_FORMULAS, etc.) was never committed. CI was failing with TS2307 because the file was in the local working tree but not in the git checkout. Tighten the rule to '/data/' so only the root runtime H2 database folder is ignored, not the source data directory.	2026-08-12 17:57:23 -04:00
darroyo	9c9fb3a2ca	feat: shot-crafter-calculator with H2 persistence and production history ... Quarkus 3.20.1 monolith serving React 18 + TypeScript + Tailwind SPA. Features: - Three-tab calculator (Insumos, Fórmulas, Calculadora) for Soulshot, Spiritshot and Blessed Spiritshot crafting in Lineage 2 Interlude/Clásico with all 15 grades and pre-loaded recipes - Real-time profitability computation (cristales → ore → crafteos → shots → cost → sale → ganancia) - Multi-user auth with JWT in httpOnly cookie (bcrypt + RSA 2048) - H2 file-based persistence in ./data/shots.mv.db (file-based, H2) - Auto-save on state changes (debounced 500ms) - Production history with stats (total/avg/best/worst/last5avg) and per-run detail modal with snapshot of insumos+formulas Stack: - Backend: Quarkus REST + Hibernate ORM Panache + smallrye-jwt - Frontend: React 18 + TypeScript + Vite + Tailwind 3 - Build: Maven runs frontend-maven-plugin (Node 22 + npm ci) then copies dist to META-INF/resources for Quarkus to serve Verified: - 5 backend endpoints + 5 history endpoints with curl - 35/35 browser tests via Playwright + Chromium - All TS strict, all builds green	2026-08-12 16:03:51 -04:00