Phase 2 MVP behavior: + *
Policy mapping: + *
Implementation notes: + *
When a {@link MeterRegistry} is available, counters and gauges are published.
+ * Without a registry, methods still work as no-ops for easy testing.
+ */
+@Service
+public class SecurityObservabilityService {
+
+ private final MeterRegistry meterRegistry;
+ private final AtomicInteger activeLoginLocks = new AtomicInteger();
+
+ private SecurityObservabilityService(MeterRegistry meterRegistry) {
+ this.meterRegistry = meterRegistry;
+ if (meterRegistry != null) {
+ Gauge.builder("security.login.active_locks", activeLoginLocks, AtomicInteger::get)
+ .description("Current number of active login lockouts")
+ .register(meterRegistry);
+ }
+ }
+
+ @Autowired
+ public SecurityObservabilityService(ObjectProvider 🎬 Avslut🔄 Enkelt flöde, tydligt ansvar
+
- 👥 Rätt åtkomst för rätt roll
+
- 🧱 Byggt för stabil utveckling
+
- Patient Login
Invalid email or password.
+
+ Too many login attempts. Please try again in a few minutes.
+
You have been logged out.
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/ClientIpResolverTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/ClientIpResolverTest.java
new file mode 100644
index 0000000..06704ca
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/ClientIpResolverTest.java
@@ -0,0 +1,42 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class ClientIpResolverTest {
+
+ @Test
+ void shouldUseForwardedClientIpWhenRemoteAddressIsTrustedProxy() {
+ MockHttpServletRequest request = new MockHttpServletRequest();
+ request.setRemoteAddr("10.0.0.10");
+ request.addHeader("X-Forwarded-For", "203.0.113.9, 10.0.0.10");
+
+ String resolved = ClientIpResolver.resolve(request);
+
+ assertThat(resolved).isEqualTo("203.0.113.9");
+ }
+
+ @Test
+ void shouldIgnoreForwardedHeaderWhenRemoteAddressIsUntrusted() {
+ MockHttpServletRequest request = new MockHttpServletRequest();
+ request.setRemoteAddr("198.51.100.20");
+ request.addHeader("X-Forwarded-For", "203.0.113.9");
+
+ String resolved = ClientIpResolver.resolve(request);
+
+ assertThat(resolved).isEqualTo("198.51.100.20");
+ }
+
+ @Test
+ void shouldFallbackToRemoteAddressWhenForwardedHeaderIsInvalid() {
+ MockHttpServletRequest request = new MockHttpServletRequest();
+ request.setRemoteAddr("127.0.0.1");
+ request.addHeader("X-Forwarded-For", "unknown, invalid-ip");
+
+ String resolved = ClientIpResolver.resolve(request);
+
+ assertThat(resolved).isEqualTo("127.0.0.1");
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAttemptServiceTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAttemptServiceTest.java
new file mode 100644
index 0000000..5da54d5
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAttemptServiceTest.java
@@ -0,0 +1,81 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneId;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LoginAttemptServiceTest {
+
+ @Test
+ void recordFailure_shouldLockAfterThreshold() {
+ MutableClock clock = new MutableClock(Instant.parse("2026-04-24T11:00:00Z"));
+ LoginAttemptService service = new LoginAttemptService(5, 900, 900, clock);
+
+ for (int i = 0; i < 4; i++) {
+ assertThat(service.recordFailure("user@example.com", "127.0.0.1").locked()).isFalse();
+ }
+
+ LoginAttemptService.LockDecision decision = service.recordFailure("user@example.com", "127.0.0.1");
+ assertThat(decision.locked()).isTrue();
+ assertThat(decision.retryAfterSeconds()).isEqualTo(900);
+ }
+
+ @Test
+ void currentLockDecision_shouldUnlockAfterTtlExpires() {
+ MutableClock clock = new MutableClock(Instant.parse("2026-04-24T11:00:00Z"));
+ LoginAttemptService service = new LoginAttemptService(2, 900, 900, clock);
+
+ service.recordFailure("user@example.com", "127.0.0.1");
+ service.recordFailure("user@example.com", "127.0.0.1");
+ assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isTrue();
+
+ clock.advanceSeconds(901);
+ assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isFalse();
+ }
+
+ @Test
+ void recordSuccess_shouldClearFailureState() {
+ MutableClock clock = new MutableClock(Instant.parse("2026-04-24T11:00:00Z"));
+ LoginAttemptService service = new LoginAttemptService(2, 900, 900, clock);
+
+ service.recordFailure("user@example.com", "127.0.0.1");
+ service.recordFailure("user@example.com", "127.0.0.1");
+ assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isTrue();
+
+ service.recordSuccess("user@example.com", "127.0.0.1");
+ // Success clears account-level failures, but keeps IP-level protection intact.
+ assertThat(service.currentLockDecision("user@example.com", "127.0.0.1").locked()).isTrue();
+ assertThat(service.currentLockDecision("user@example.com", "127.0.0.2").locked()).isFalse();
+ }
+
+ private static final class MutableClock extends Clock {
+ private Instant current;
+
+ private MutableClock(Instant initial) {
+ this.current = initial;
+ }
+
+ @Override
+ public ZoneId getZone() {
+ return ZoneId.of("UTC");
+ }
+
+ @Override
+ public Clock withZone(ZoneId zone) {
+ return this;
+ }
+
+ @Override
+ public Instant instant() {
+ return current;
+ }
+
+ private void advanceSeconds(long seconds) {
+ current = current.plusSeconds(seconds);
+ }
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAuthenticationHandlersTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAuthenticationHandlersTest.java
new file mode 100644
index 0000000..d8c403f
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginAuthenticationHandlersTest.java
@@ -0,0 +1,48 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class LoginAuthenticationHandlersTest {
+
+ @Test
+ void failureHandler_shouldRedirectWithLockedFlagWhenThresholdReached() throws Exception {
+ LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+ when(loginAttemptService.recordFailure("user@example.com", "127.0.0.1"))
+ .thenReturn(new LoginAttemptService.LockDecision(true, 300));
+ LoginAuthenticationFailureHandler handler = new LoginAuthenticationFailureHandler(loginAttemptService);
+
+ MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+ request.setRemoteAddr("127.0.0.1");
+ request.addParameter("username", "user@example.com");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+
+ handler.onAuthenticationFailure(request, response, new org.springframework.security.authentication.BadCredentialsException("bad"));
+
+ assertThat(response.getRedirectedUrl()).isEqualTo("/login?error=true&locked=true&retryAfter=300");
+ }
+
+ @Test
+ void successHandler_shouldClearAttemptsAndRedirectHome() throws Exception {
+ LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+ LoginAuthenticationSuccessHandler handler = new LoginAuthenticationSuccessHandler(loginAttemptService);
+
+ MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+ request.setRemoteAddr("127.0.0.1");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ UsernamePasswordAuthenticationToken authentication =
+ new UsernamePasswordAuthenticationToken("user@example.com", "pw");
+
+ handler.onAuthenticationSuccess(request, response, authentication);
+
+ verify(loginAttemptService).recordSuccess("user@example.com", "127.0.0.1");
+ assertThat(response.getRedirectedUrl()).isEqualTo("/home");
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginLockoutFilterTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginLockoutFilterTest.java
new file mode 100644
index 0000000..c3b4497
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/LoginLockoutFilterTest.java
@@ -0,0 +1,50 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class LoginLockoutFilterTest {
+
+ @Test
+ void doFilter_shouldRedirectWhenLockIsActive() throws Exception {
+ LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+ when(loginAttemptService.currentLockDecision("blocked@example.com", "127.0.0.1"))
+ .thenReturn(new LoginAttemptService.LockDecision(true, 120));
+
+ LoginLockoutFilter filter = new LoginLockoutFilter(loginAttemptService);
+ MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+ request.setRemoteAddr("127.0.0.1");
+ request.addParameter("username", "blocked@example.com");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ MockFilterChain chain = new MockFilterChain();
+
+ filter.doFilter(request, response, chain);
+
+ assertThat(response.getRedirectedUrl()).isEqualTo("/login?error=true&locked=true&retryAfter=120");
+ }
+
+ @Test
+ void doFilter_shouldPassWhenNotLocked() throws Exception {
+ LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+ when(loginAttemptService.currentLockDecision("ok@example.com", "10.0.0.10"))
+ .thenReturn(new LoginAttemptService.LockDecision(false, 0));
+
+ LoginLockoutFilter filter = new LoginLockoutFilter(loginAttemptService);
+ MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+ request.setRemoteAddr("10.0.0.10");
+ request.addParameter("username", "ok@example.com");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ MockFilterChain chain = new MockFilterChain();
+
+ filter.doFilter(request, response, chain);
+
+ assertThat(response.getRedirectedUrl()).isNull();
+ assertThat(response.getStatus()).isEqualTo(200);
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitFilterTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitFilterTest.java
new file mode 100644
index 0000000..68bb770
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitFilterTest.java
@@ -0,0 +1,85 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import java.io.IOException;
+import java.util.Optional;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+class RateLimitFilterTest {
+
+ @Test
+ void doFilterInternal_shouldAllowWhenNoPolicyApplies() throws Exception {
+ RateLimitService rateLimitService = mock(RateLimitService.class);
+ when(rateLimitService.policyForPath("/home", "GET")).thenReturn(Optional.empty());
+
+ RateLimitFilter filter = new RateLimitFilter(rateLimitService, SecurityObservabilityService.noop());
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/home");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ MockFilterChain chain = new MockFilterChain();
+
+ filter.doFilter(request, response, chain);
+
+ assertThat(response.getStatus()).isEqualTo(200);
+ verify(rateLimitService).policyForPath("/home", "GET");
+ }
+
+ @Test
+ void doFilterInternal_shouldReturnTooManyRequestsWhenPolicyDenied() throws Exception {
+ RateLimitService rateLimitService = mock(RateLimitService.class);
+ when(rateLimitService.policyForPath("/api/cases", "GET"))
+ .thenReturn(Optional.of(RateLimitService.RateLimitPolicy.GLOBAL_API));
+ when(rateLimitService.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1"))
+ .thenReturn(new RateLimitService.RateLimitDecision(false, 0, 42));
+
+ RateLimitFilter filter = new RateLimitFilter(rateLimitService, SecurityObservabilityService.noop());
+ MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api/cases");
+ request.setRemoteAddr("127.0.0.1");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ MockFilterChain chain = new MockFilterChain();
+
+ filter.doFilter(request, response, chain);
+
+ assertThat(response.getStatus()).isEqualTo(429);
+ assertThat(response.getHeader("Retry-After")).isEqualTo("42");
+ assertThat(response.getContentAsString()).isEqualTo("Too many requests. Please try again later.");
+ verify(rateLimitService).evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+ }
+
+ @Test
+ void doFilterInternal_shouldPassThroughWhenPolicyAllowed() throws Exception {
+ RateLimitService rateLimitService = mock(RateLimitService.class);
+ when(rateLimitService.policyForPath("/login", "POST"))
+ .thenReturn(Optional.of(RateLimitService.RateLimitPolicy.AUTH_ENDPOINT));
+ when(rateLimitService.evaluate(RateLimitService.RateLimitPolicy.AUTH_ENDPOINT, "10.0.0.5"))
+ .thenReturn(new RateLimitService.RateLimitDecision(true, 9, 0));
+
+ RateLimitFilter filter = new RateLimitFilter(rateLimitService, SecurityObservabilityService.noop());
+ MockHttpServletRequest request = new MockHttpServletRequest("POST", "/login");
+ request.setRemoteAddr("10.0.0.5");
+ MockHttpServletResponse response = new MockHttpServletResponse();
+ RecordingFilterChain chain = new RecordingFilterChain();
+
+ filter.doFilter(request, response, chain);
+
+ assertThat(chain.wasCalled).isTrue();
+ assertThat(response.getStatus()).isEqualTo(200);
+ }
+
+ private static final class RecordingFilterChain extends MockFilterChain {
+ private boolean wasCalled;
+
+ @Override
+ public void doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response)
+ throws IOException, jakarta.servlet.ServletException {
+ wasCalled = true;
+ }
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitServiceTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitServiceTest.java
new file mode 100644
index 0000000..e2a74a7
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/RateLimitServiceTest.java
@@ -0,0 +1,80 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.time.Clock;
+import java.time.Instant;
+import java.time.ZoneId;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class RateLimitServiceTest {
+
+ @Test
+ void policyForPath_shouldMapApiAndAuthEndpoints() {
+ RateLimitService service = new RateLimitService(2, 60, 1, 60, new MutableClock(Instant.parse("2026-04-24T10:00:00Z")));
+
+ assertThat(service.policyForPath("/api/patients", "GET"))
+ .contains(RateLimitService.RateLimitPolicy.GLOBAL_API);
+ assertThat(service.policyForPath("/login", "GET")).isEmpty();
+ assertThat(service.policyForPath("/login", "POST"))
+ .contains(RateLimitService.RateLimitPolicy.AUTH_ENDPOINT);
+ assertThat(service.policyForPath("/register", "POST"))
+ .contains(RateLimitService.RateLimitPolicy.AUTH_ENDPOINT);
+ assertThat(service.policyForPath("/app.css", "GET")).isEmpty();
+ }
+
+ @Test
+ void evaluate_shouldAllowUntilLimitAndThenDenyWithRetryAfter() {
+ MutableClock clock = new MutableClock(Instant.parse("2026-04-24T10:00:00Z"));
+ RateLimitService service = new RateLimitService(2, 60, 1, 60, clock);
+
+ var first = service.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+ var second = service.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+ var third = service.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+
+ assertThat(first.allowed()).isTrue();
+ assertThat(first.remainingRequests()).isEqualTo(1);
+ assertThat(second.allowed()).isTrue();
+ assertThat(second.remainingRequests()).isEqualTo(0);
+ assertThat(third.allowed()).isFalse();
+ assertThat(third.retryAfterSeconds()).isGreaterThan(0);
+ }
+
+ @Test
+ void evaluate_shouldUseIndependentCountersPerPolicy() {
+ MutableClock clock = new MutableClock(Instant.parse("2026-04-24T10:00:00Z"));
+ RateLimitService service = new RateLimitService(1, 60, 2, 60, clock);
+
+ var apiAllowed = service.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+ var authAllowed = service.evaluate(RateLimitService.RateLimitPolicy.AUTH_ENDPOINT, "127.0.0.1");
+ var apiDenied = service.evaluate(RateLimitService.RateLimitPolicy.GLOBAL_API, "127.0.0.1");
+
+ assertThat(apiAllowed.allowed()).isTrue();
+ assertThat(authAllowed.allowed()).isTrue();
+ assertThat(apiDenied.allowed()).isFalse();
+ }
+
+ private static final class MutableClock extends Clock {
+ private Instant current;
+
+ private MutableClock(Instant initial) {
+ this.current = initial;
+ }
+
+ @Override
+ public ZoneId getZone() {
+ return ZoneId.of("UTC");
+ }
+
+ @Override
+ public Clock withZone(ZoneId zone) {
+ return this;
+ }
+
+ @Override
+ public Instant instant() {
+ return current;
+ }
+ }
+}
diff --git a/src/test/java/org/example/projektarendehantering/infrastructure/security/SecurityObservabilityServiceTest.java b/src/test/java/org/example/projektarendehantering/infrastructure/security/SecurityObservabilityServiceTest.java
new file mode 100644
index 0000000..274c27c
--- /dev/null
+++ b/src/test/java/org/example/projektarendehantering/infrastructure/security/SecurityObservabilityServiceTest.java
@@ -0,0 +1,33 @@
+package org.example.projektarendehantering.infrastructure.security;
+
+import io.micrometer.core.instrument.simple.SimpleMeterRegistry;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.ObjectProvider;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class SecurityObservabilityServiceTest {
+
+ @Test
+ void shouldRecordCountersAndGauge() {
+ SimpleMeterRegistry meterRegistry = new SimpleMeterRegistry();
+ @SuppressWarnings("unchecked")
+ ObjectProvider