Java Spring Boot 3.4 & React 19: Arsitektur Keamanan Enterprise – Stateless JWT, Method-Level RBAC & Pertahanan OWASP Top 10

// backend/src/main/java/com/elearning/security/JwtProvider.java
@Component
public class JwtProvider {

    private final SecretKey secretKey;
    private final long accessTokenExpirationMs;
    private final long refreshTokenExpirationMs;

    public JwtProvider(
            @Value("${app.jwt.secret}") String secret,
            @Value("${app.jwt.access-token-expiration-ms:900000}") long accessTokenExpirationMs,
            @Value("${app.jwt.refresh-token-expiration-ms:604800000}") long refreshTokenExpirationMs
    ) {
        if (secret == null || secret.trim().isEmpty()) {
            throw new IllegalStateException("KRITIS: app.jwt.secret belum dikonfigurasi! Harap isi environment variable JWT_SECRET.");
        }
        byte[] keyBytes = Decoders.BASE64.decode(secret.trim());
        
        // Penegakan Kriptografi Keras: Kunci wajib minimal 256 bit (32 byte) untuk HMAC-SHA256
        if (keyBytes.length < 32) {
            throw new IllegalArgumentException("KRITIS: Kunci rahasia JWT wajib berukuran minimal 256 bit (32 byte) untuk HMAC-SHA256!");
        }
        this.secretKey = Keys.hmacShaKeyFor(keyBytes);
        this.accessTokenExpirationMs = accessTokenExpirationMs; // Default 15 menit
        this.refreshTokenExpirationMs = refreshTokenExpirationMs; // Default 7 hari
    }

    public String generateAccessToken(UserPrincipal userPrincipal) {
        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + accessTokenExpirationMs);

        List<String> roles = userPrincipal.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.toList());

        var builder = Jwts.builder()
                .subject(userPrincipal.getId().toString())
                .claim("email", userPrincipal.getEmail())
                .claim("name", userPrincipal.getName())
                .claim("roles", roles)
                .issuedAt(now)
                .expiration(expiryDate)
                .signWith(secretKey);

        // Sisipkan klaim audit impersonasi admin jika sedang aktif
        if (userPrincipal.getImpersonatorAdminId() != null) {
            builder.claim("impersonatorAdminId", userPrincipal.getImpersonatorAdminId());
        }

        return builder.compact();
    }
}

// backend/src/main/java/com/elearning/security/JwtAuthenticationFilter.java
@Component
@RequiredArgsConstructor
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtProvider jwtProvider;
    private final CustomUserDetailsService userDetailsService;

    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain
    ) throws ServletException, IOException {
        String token = getJwtFromRequest(request);

        if (StringUtils.hasText(token) && jwtProvider.validateToken(token)) {
            Long userId = jwtProvider.getUserIdFromToken(token);
            Long impersonatorAdminId = jwtProvider.getImpersonatorAdminIdFromToken(token);

            // Muat data otorisasi user secara aman
            UserDetails userDetails = userDetailsService.loadUserById(userId, impersonatorAdminId);
            
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                    userDetails,
                    null,
                    userDetails.getAuthorities()
            );
            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

            // Set konteks keamanan pada thread eksekusi saat ini
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }

        filterChain.doFilter(request, response);
    }

    private String getJwtFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7);
        }
        return null;
    }
}

// Pencocokan URL makro (Penting sebagai perimeter awal, namun TIDAK cukup sendirian)
http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
    .requestMatchers("/api/v1/teacher/**").hasAnyRole("ADMIN", "TEACHER")
    .requestMatchers("/api/v1/student/**").hasAnyRole("ADMIN", "STUDENT")
    .anyRequest().authenticated()
);

// backend/src/main/java/com/elearning/config/SecurityConfig.java
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true) // Mengaktifkan evaluasi @PreAuthorize & @PostAuthorize
@RequiredArgsConstructor
public class SecurityConfig {
    // ...
}

// backend/src/main/java/com/elearning/security/UserPrincipal.java
public static UserPrincipal create(User user, Long impersonatorAdminId) {
    Collection<GrantedAuthority> authorities = user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority(role.getName().name())) // contoh: "ROLE_ADMIN", "ROLE_TEACHER"
            .collect(Collectors.toList());

    return new UserPrincipal(
            user.getId(),
            user.getName(),
            user.getEmail(),
            user.getPassword(),
            user.isActive(),
            authorities,
            impersonatorAdminId
    );
}

// backend/src/main/java/com/elearning/modules/exam/controller/ExamController.java
@RestController
@RequestMapping("/api/v1/exams")
@RequiredArgsConstructor
public class ExamController {

    private final ExamService examService;

    // Siswa dan Guru dapat melihat daftar ujian yang relevan (difilter di service)
    @GetMapping
    public ResponseEntity<ApiResponse<List<ExamResponse>>> getExams(
            @AuthenticationPrincipal UserPrincipal principal) {
        return ResponseEntity.ok(ApiResponse.success(examService.getExamsForUser(principal), "Daftar ujian berhasil diambil"));
    }

    // Hanya Guru dan Admin yang diizinkan membuat paket ujian baru
    @PostMapping
    @PreAuthorize("hasAnyRole('ADMIN', 'TEACHER')")
    public ResponseEntity<ApiResponse<ExamResponse>> createExam(
            @Valid @RequestBody ExamDto dto,
            @AuthenticationPrincipal UserPrincipal principal) {
        ExamResponse response = examService.createExam(dto, principal);
        return ResponseEntity.status(HttpStatus.CREATED).body(ApiResponse.success(response, "Ujian berhasil dibuat"));
    }

    // Pembaruan metadata ujian dibatasi hanya untuk Guru dan Admin
    @PutMapping("/{id}")
    @PreAuthorize("hasAnyRole('ADMIN', 'TEACHER')")
    public ResponseEntity<ApiResponse<ExamResponse>> updateExam(
            @PathVariable Long id,
            @Valid @RequestBody ExamDto dto,
            @AuthenticationPrincipal UserPrincipal principal) {
        return ResponseEntity.ok(ApiResponse.success(examService.updateExam(id, dto, principal), "Ujian diperbarui"));
    }

    // Pengelolaan butir bank soal hanya untuk tenaga pengajar
    @PostMapping("/{id}/questions")
    @PreAuthorize("hasAnyRole('ADMIN', 'TEACHER')")
    public ResponseEntity<ApiResponse<QuestionResponse>> addQuestion(
            @PathVariable Long id,
            @Valid @RequestBody QuestionDto dto,
            @AuthenticationPrincipal UserPrincipal principal) {
        return ResponseEntity.status(HttpStatus.CREATED).body(
                ApiResponse.success(examService.addQuestion(id, dto, principal), "Soal berhasil ditambahkan")
        );
    }
}

// backend/src/main/java/com/elearning/modules/exam/service/ExamService.java
@Transactional
public void deleteExam(Long id, UserPrincipal principal) {
    Examination exam = examRepository.findById(id)
            .orElseThrow(() -> new ResourceNotFoundException("Ujian tidak ditemukan dengan id: " + id));

    // Admin dapat menghapus ujian apa pun; Guru hanya boleh menghapus ujian buatannya sendiri
    boolean isAdmin = principal.getAuthorities().stream()
            .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
    boolean isOwner = exam.getTeacher().getId().equals(principal.getId());

    if (!isAdmin && !isOwner) {
        throw new SecurityException("Akses Ditolak: Anda tidak memiliki wewenang untuk menghapus ujian milik pengajar lain.");
    }

    examRepository.delete(exam);
}

// backend/src/main/java/com/elearning/security/RateLimitingFilter.java
@Component
@Slf4j
public class RateLimitingFilter extends OncePerRequestFilter {

    private final Map<String, Bucket> authIpBuckets = new ConcurrentHashMap<>();
    private final Map<String, Bucket> submitIpBuckets = new ConcurrentHashMap<>();
    private final Map<String, Bucket> generalIpBuckets = new ConcurrentHashMap<>();

    // Kapasitas Rate Limiting Per Menit
    private static final int AUTH_CAPACITY = 10;       // Maksimal 10 request login/register per menit per IP
    private static final int SUBMIT_CAPACITY = 60;     // Maksimal 60 request submit/autosave per menit per IP
    private static final int GENERAL_CAPACITY = 120;   // Maksimal 120 request API umum per menit per IP

    private Bucket createBucket(int capacity, Duration duration) {
        Bandwidth limit = Bandwidth.classic(capacity, Refill.greedy(capacity, duration));
        return Bucket.builder().addLimit(limit).build();
    }

    @Override
    protected boolean shouldNotFilter(@NonNull HttpServletRequest request) {
        String path = request.getRequestURI();
        // Lewati rate limiting untuk file dokumentasi, health probe, dan preflight CORS OPTIONS
        return "OPTIONS".equalsIgnoreCase(request.getMethod())
                || path.startsWith("/actuator")
                || path.startsWith("/swagger-ui")
                || path.startsWith("/v3/api-docs")
                || path.startsWith("/ws");
    }

    @Override
    protected void doFilterInternal(
            @NonNull HttpServletRequest request,
            @NonNull HttpServletResponse response,
            @NonNull FilterChain filterChain
    ) throws ServletException, IOException {

        String clientIp = LoginRateLimiterService.getClientIp(request);
        String requestUri = request.getRequestURI();

        // Tier 1: Proteksi ketat pada Endpoint Autentikasi (Login / Register)
        if (requestUri.startsWith("/api/v1/auth/login") || requestUri.startsWith("/api/v1/auth/register")) {
            Bucket authBucket = authIpBuckets.computeIfAbsent(
                    clientIp, k -> createBucket(AUTH_CAPACITY, Duration.ofMinutes(1))
            );
            if (!authBucket.tryConsume(1)) {
                log.warn("Rate limit [AUTH] terlampaui untuk IP {} pada {}", clientIp, requestUri);
                sendRateLimitResponse(response, "Terlalu banyak percobaan autentikasi dari alamat IP ini. Silakan tunggu 1 menit sebelum mencoba lagi.");
                return;
            }
        }

        // Tier 2: Proteksi banjir autosave & submit ujian CBT
        else if (requestUri.contains("/exams/") && (requestUri.endsWith("/submit") || requestUri.endsWith("/answer"))) {
            Bucket submitBucket = submitIpBuckets.computeIfAbsent(
                    clientIp, k -> createBucket(SUBMIT_CAPACITY, Duration.ofMinutes(1))
            );
            if (!submitBucket.tryConsume(1)) {
                log.warn("Rate limit [EXAM SUBMIT] terlampaui untuk IP {} pada {}", clientIp, requestUri);
                sendRateLimitResponse(response, "Terlalu banyak permintaan submit ujian secara bersamaan. Silakan tunggu beberapa saat.");
                return;
            }
        }

        // Tier 3: Rate limit umum untuk seluruh endpoint API lainnya
        else if (requestUri.startsWith("/api/v1")) {
            Bucket generalBucket = generalIpBuckets.computeIfAbsent(
                    clientIp, k -> createBucket(GENERAL_CAPACITY, Duration.ofMinutes(1))
            );
            if (!generalBucket.tryConsume(1)) {
                log.warn("Rate limit [GENERAL API] terlampaui untuk IP {} pada {}", clientIp, requestUri);
                sendRateLimitResponse(response, "Batas permintaan API terlampaui. Silakan kurangi frekuensi permintaan Anda.");
                return;
            }
        }

        filterChain.doFilter(request, response);
    }

    private void sendRateLimitResponse(HttpServletResponse response, String message) throws IOException {
        response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value()); // HTTP 429
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setCharacterEncoding("UTF-8");
        response.setHeader("Retry-After", "60");
        response.setHeader("X-RateLimit-Retry-After-Seconds", "60");

        String jsonPayload = String.format("{\"success\":false,\"message\":\"%s\",\"data\":null}", message);
        response.getWriter().write(jsonPayload);
        response.getWriter().flush();
    }
}

// backend/src/main/java/com/elearning/config/SecurityConfig.java
http
    .addFilterBefore(rateLimitingFilter, LogoutFilter.class)
    .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

@Bean
public FilterRegistrationBean<RateLimitingFilter> rateLimitingFilterRegistration(RateLimitingFilter filter) {
    FilterRegistrationBean<RateLimitingFilter> registration = new FilterRegistrationBean<>(filter);
    registration.setEnabled(false); // Mencegah eksekusi ganda oleh Servlet Container
    return registration;
}

// backend/src/main/java/com/elearning/modules/auth/controller/AuthController.java
@PostMapping("/admin/impersonate/{userId}")
@PreAuthorize("hasRole('ADMIN')")
@Operation(summary = "Mulai Impersonasi", description = "Admin dapat login sebagai siswa atau guru untuk investigasi")
public ResponseEntity<ApiResponse<AuthResponse>> impersonate(
        @PathVariable Long userId,
        @AuthenticationPrincipal UserPrincipal adminPrincipal
) {
    AuthResponse response = authService.impersonate(userId, adminPrincipal);
    return ResponseEntity.ok(ApiResponse.ok(response, "Sesi impersonasi berhasil dimulai"));
}

@PostMapping("/admin/stop-impersonate")
@Operation(summary = "Hentikan Impersonasi", description = "Kembalikan sesi impersonasi ke akun admin semula")
public ResponseEntity<ApiResponse<AuthResponse>> stopImpersonate(
        @AuthenticationPrincipal UserPrincipal currentPrincipal
) {
    AuthResponse response = authService.stopImpersonate(currentPrincipal);
    return ResponseEntity.ok(ApiResponse.ok(response, "Kembali ke sesi admin"));
}