The document describes the setup and implementation of user authentication for a Spring Boot based Uber clone application. It defines a User entity and UserService with methods for registering, authenticating, and updating users. The service implements authentication via phone, Facebook, or Google ID and password validation. Security is configured with BCrypt password encoding and authorization of API requests.

1. Creating an Uber Clone - Part XI

2. Setup
✦As before I chose to go with Spring Boot & MySQL
✦I created a new database called uberapp
✦I created a completely new Spring Boot app with the
following dependencies:
✦ spring-boot-starter-data-jpa
✦ spring-boot-starter-jersey
✦ spring-boot-starter-web
✦ spring-boot-starter-websocket
✦ spring-boot-starter-security
✦ mysql-connector-java
✦ braintree-java
© Codename One 2017 all rights reserved

3. Server Requirements
✦Add a new user
✦User authorization
✦Update user information
✦Track cars
✦Hail a car
✦Pair car & user
✦Log historic trip details
✦Provide rating facilities
© Codename One 2017 all rights reserved

4. User Object
© Codename One 2017 all rights reserved

5. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

6. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

7. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

8. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

9. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

10. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

11. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

12. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

13. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

14. @Entity
public class User {
@Id
@GeneratedValue(strategy=GenerationType.AUTO)
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
User

15. private String surname;
private String phone;
private String email;
private String password;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private boolean hailing;
private Long assignedUser;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
@Lob
private byte[] avatar;
@Column(unique=true)
private String authToken;
public User() {
authToken = UUID.randomUUID().toString();
}
User

16. public interface UserRepository extends CrudRepository<User, Long> {
public List<User> findByAuthToken(String authToken);
public List<User> findByPhone(String phone);
public List<User> findByGoogleId(String googleId);
public List<User> findByFacebookId(String facebookId);
@Query("select b from User b where b.driver = true " +
"and b.latitude between ?1 and ?2 and b.longitude " +
"between ?3 and ?4")
public List<User> findByDriver(double minLat, double maxLat,
double minLon, double maxLon);
@Query("select b from User b where b.driver = true " +
"and b.assignedUser is null and b.latitude between " +
"?1 and ?2 and b.longitude between ?3 and ?4")
public List<User> findByAvailableDriver(double minLat,
double maxLat, double minLon, double maxLon);
}
UserRepository

17. public interface UserRepository extends CrudRepository<User, Long> {
public List<User> findByAuthToken(String authToken);
public List<User> findByPhone(String phone);
public List<User> findByGoogleId(String googleId);
public List<User> findByFacebookId(String facebookId);
@Query("select b from User b where b.driver = true " +
"and b.latitude between ?1 and ?2 and b.longitude " +
"between ?3 and ?4")
public List<User> findByDriver(double minLat, double maxLat,
double minLon, double maxLon);
@Query("select b from User b where b.driver = true " +
"and b.assignedUser is null and b.latitude between " +
"?1 and ?2 and b.longitude between ?3 and ?4")
public List<User> findByAvailableDriver(double minLat,
double maxLat, double minLon, double maxLon);
}
UserRepository

18. public class UserDAO implements Serializable {
private Long id;
private String givenName;
private String surname;
private String phone;
private String email;
private String facebookId;
private String googleId;
private boolean driver;
private String car;
private float currentRating;
private double latitude;
private double longitude;
private float direction;
private String authToken;
private String password;
UserDAO

19. public UserDAO getDao() {
return new UserDAO(id, givenName, surname,
phone, email, facebookId, googleId, driver,
car, currentRating, latitude, longitude, direction);
}
public UserDAO getPartialDao() {
return new UserDAO(id, givenName, surname,
null, null, null, null, driver, car, currentRating,
latitude, longitude, direction);
}
User

20. @Service
public class UserService {
@Autowired
private UserRepository users;
@Autowired
private PasswordEncoder encoder;
public String addUser(UserDAO user) {
User u = new User(user);
u.setPassword(encoder.encode(user.getPassword()));
users.save(u);
return u.getAuthToken();
}
public byte[] getAvatar(Long id) {
User u = users.findOne(id);
return u.getAvatar();
}
public void setAvatar(String token, byte[] a) {
User u = users.findByAuthToken(token).get(0);
u.setAvatar(a);
users.save(u);
}
UserService

21. @Service
public class UserService {
@Autowired
private UserRepository users;
@Autowired
private PasswordEncoder encoder;
public String addUser(UserDAO user) {
User u = new User(user);
u.setPassword(encoder.encode(user.getPassword()));
users.save(u);
return u.getAuthToken();
}
public byte[] getAvatar(Long id) {
User u = users.findOne(id);
return u.getAvatar();
}
public void setAvatar(String token, byte[] a) {
User u = users.findByAuthToken(token).get(0);
u.setAvatar(a);
users.save(u);
}
UserService

22. @Service
public class UserService {
@Autowired
private UserRepository users;
@Autowired
private PasswordEncoder encoder;
public String addUser(UserDAO user) {
User u = new User(user);
u.setPassword(encoder.encode(user.getPassword()));
users.save(u);
return u.getAuthToken();
}
public byte[] getAvatar(Long id) {
User u = users.findOne(id);
return u.getAvatar();
}
public void setAvatar(String token, byte[] a) {
User u = users.findByAuthToken(token).get(0);
u.setAvatar(a);
users.save(u);
}
UserService

23. public void setAvatar(String token, byte[] a) {
User u = users.findByAuthToken(token).get(0);
u.setAvatar(a);
users.save(u);
}
public void updateUser(UserDAO user) {
User u = users.findByAuthToken(user.getAuthToken()).get(0);
u.setCar(user.getCar());
u.setEmail(user.getEmail());
u.setFacebookId(user.getFacebookId());
u.setGivenName(user.getGivenName());
u.setSurname(user.getSurname());
u.setGoogleId(user.getGoogleId());
u.setLatitude(user.getLatitude());
u.setLongitude(user.getLongitude());
u.setPhone(user.getPhone());
users.save(u);
}
public UserDAO loginByPhone(String phone,
UserService

24. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

25. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

26. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

27. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

28. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

29. public UserDAO loginByPhone(String phone, String password) throws UserAuthenticationException {
return loginImpl(users.findByPhone(phone), password);
}
public UserDAO loginByFacebook(String facebookId, String password) throws UserAuthenticationException {
return loginImpl(users.findByFacebookId(facebookId), password);
}
public UserDAO loginByGoogle(String googleId, String password) throws UserAuthenticationException {
return loginImpl(users.findByGoogleId(googleId), password);
}
private UserDAO loginImpl(List<User> us, String password) throws UserAuthenticationException {
if(us == null || us.isEmpty()) {
return null;
}
if(us.size() > 1) {
throw new RuntimeException("Illegal state "+us.size()+" users with the same phone are listed!");
}
User u = us.get(0);
if(!encoder.matches(password, u.getPassword())) {
throw new UserAuthenticationException();
}
UserDAO d = u.getDao();
d.setAuthToken(u.getAuthToken());
return d;
}
public boolean existsByPhone(String phone) {
List<User> us = users.findByPhone(phone);
return !us.isEmpty();
}
UserService

30. @Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.authorizeRequests().antMatchers("/").permitAll();
httpSecurity.csrf().disable();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
SecurityConfiguration

31. @Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.authorizeRequests().antMatchers("/").permitAll();
httpSecurity.csrf().disable();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
SecurityConfiguration

32. @Controller
@RequestMapping("/user")
public class UserWebservice {
@Autowired
private UserService users;
@ExceptionHandler(UserAuthenticationException.class)
@ResponseStatus(value = HttpStatus.FORBIDDEN)
public @ResponseBody ErrorDAO handleException(
UserAuthenticationException e) {
return new ErrorDAO("Invalid Password",
ErrorDAO.ERROR_INVALID_PASSWORD);
}
@RequestMapping(method=RequestMethod.GET,value = "/exists")
public @ResponseBody boolean exists(String phone) {
return users.existsByPhone(phone);
}
@RequestMapping(method=RequestMethod.GET,value = "/login")
public @ResponseBody UserDAO login(@RequestParam(
UserWebservice

33. @Controller
@RequestMapping("/user")
public class UserWebservice {
@Autowired
private UserService users;
@ExceptionHandler(UserAuthenticationException.class)
@ResponseStatus(value = HttpStatus.FORBIDDEN)
public @ResponseBody ErrorDAO handleException(
UserAuthenticationException e) {
return new ErrorDAO("Invalid Password",
ErrorDAO.ERROR_INVALID_PASSWORD);
}
@RequestMapping(method=RequestMethod.GET,value = "/exists")
public @ResponseBody boolean exists(String phone) {
return users.existsByPhone(phone);
}
@RequestMapping(method=RequestMethod.GET,value = "/login")
public @ResponseBody UserDAO login(@RequestParam(
UserWebservice

34. @Controller
@RequestMapping("/user")
public class UserWebservice {
@Autowired
private UserService users;
@ExceptionHandler(UserAuthenticationException.class)
@ResponseStatus(value = HttpStatus.FORBIDDEN)
public @ResponseBody ErrorDAO handleException(
UserAuthenticationException e) {
return new ErrorDAO("Invalid Password",
ErrorDAO.ERROR_INVALID_PASSWORD);
}
@RequestMapping(method=RequestMethod.GET,value = "/exists")
public @ResponseBody boolean exists(String phone) {
return users.existsByPhone(phone);
}
@RequestMapping(method=RequestMethod.GET,value = "/login")
public @ResponseBody UserDAO login(@RequestParam(
UserWebservice

35. @RequestMapping(method=RequestMethod.GET,value = "/login")
public @ResponseBody UserDAO login(@RequestParam(
value="password", required=true) String password,String phone, String googleId, String facebookId)
throws UserAuthenticationException {
if(phone != null) {
return users.loginByPhone(phone, password);
}
if(facebookId != null) {
return users.loginByFacebook(facebookId, password);
}
if(googleId != null) {
return users.loginByGoogle(googleId, password);
}
return null;
}
@RequestMapping(value = "/avatar/{id:.+}",
method = RequestMethod.GET)
public ResponseEntity<byte[]> getAvatar(
@PathVariable("id") Long id) {
byte[] av = users.getAvatar(id);
if(av != null) {
return ResponseEntity.ok().
contentType(MediaType.IMAGE_JPEG).body(av);
}
return ResponseEntity.notFound().build();
}
UserWebservice

36. return ResponseEntity.ok().
contentType(MediaType.IMAGE_JPEG).body(av);
}
return ResponseEntity.notFound().build();
}
@RequestMapping(method = RequestMethod.POST,value = "/updateAvatar/{auth:.+}")
public @ResponseBody String updateAvatar(
@PathVariable("auth") String auth,
@RequestParam(name="img", required = true)
MultipartFile img) throws IOException {
users.setAvatar(auth, img.getBytes());
return "OK";
}
@RequestMapping(method = RequestMethod.POST,value = "/add")
public @ResponseBody String addEditUser(
@RequestBody UserDAO ud) throws IOException {
if(ud.getId() != null) {
users.updateUser(ud);
return ud.getId().toString();
} else {
return users.addUser(ud);
}
}
}
UserWebservice

37. return ResponseEntity.ok().
contentType(MediaType.IMAGE_JPEG).body(av);
}
return ResponseEntity.notFound().build();
}
@RequestMapping(method = RequestMethod.POST,value = "/updateAvatar/{auth:.+}")
public @ResponseBody String updateAvatar(
@PathVariable("auth") String auth,
@RequestParam(name="img", required = true)
MultipartFile img) throws IOException {
users.setAvatar(auth, img.getBytes());
return "OK";
}
@RequestMapping(method = RequestMethod.POST,value = "/add")
public @ResponseBody String addEditUser(
@RequestBody UserDAO ud) throws IOException {
if(ud.getId() != null) {
users.updateUser(ud);
return ud.getId().toString();
} else {
return users.addUser(ud);
}
}
}
UserWebservice