Endpoints under {@code /api/access-requests/**}: + *
Endpoints under {@code /api/admin/**} — enforced by + * {@code .requestMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN")} in {@link + * de.platesoft.auth.config.SecurityConfig SecurityConfig}. + * + *
Note: The Envers revision browser ({@code GET /api/admin/audit/revisions}) is
+ * added in W11 alongside the {@code RevInfo}/{@code RevInfoListener} implementation.
+ */
+@RestController
+@RequestMapping("/api/admin")
+@RequiredArgsConstructor
+public class AdminAuditController {
+
+ private final LoginEventRepository loginEventRepository;
+
+ /**
+ * Paginated login event audit log. Newest first.
+ *
+ * @param page zero-based page index (default 0)
+ * @param size page size (default 50, max 200)
+ */
+ @GetMapping("/login-events")
+ public ResponseEntity Endpoints mounted under {@code /api/auth/**} (scoped by plate-auth's SecurityFilterChain):
+ * Endpoints under {@code /api/invitations/**}:
+ * Set by {@link OrgContextResolver} from the {@code X-Org-Id} header and stored in
+ * {@link OrgContextHolder} for downstream services to read.
+ */
+public record OrgContext(OrgType orgType, UUID orgId) {
+}
diff --git a/plate-auth-starter/src/main/java/de/platesoft/auth/filter/OrgContextHolder.java b/plate-auth-starter/src/main/java/de/platesoft/auth/filter/OrgContextHolder.java
new file mode 100644
index 0000000..b543906
--- /dev/null
+++ b/plate-auth-starter/src/main/java/de/platesoft/auth/filter/OrgContextHolder.java
@@ -0,0 +1,28 @@
+package de.platesoft.auth.filter;
+
+/**
+ * Thread-local holder for the {@link OrgContext} resolved on the current request.
+ *
+ * Set by {@link OrgContextResolver} and cleared after the request completes.
+ * Downstream services read it via {@link #get()} to know which org the current
+ * request is scoped to.
+ */
+public final class OrgContextHolder {
+
+ private static final ThreadLocal When the header is present AND the authenticated user has an active membership for that org,
+ * the {@link OrgContext} is stored in {@link OrgContextHolder} for downstream services. When the
+ * header is absent or the membership is invalid, no context is set — the request proceeds normally
+ * (some endpoints don't need org scoping).
+ *
+ * The thread-local is always cleared in {@code finally} to prevent leakage across pooled threads.
+ */
+@Slf4j
+@RequiredArgsConstructor
+public class OrgContextResolver extends OncePerRequestFilter {
+
+ private final MembershipService membershipService;
+
+ @Override
+ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
+ FilterChain filterChain) throws ServletException, IOException {
+ try {
+ resolveOrgContext(request);
+ filterChain.doFilter(request, response);
+ } finally {
+ OrgContextHolder.clear();
+ }
+ }
+
+ private void resolveOrgContext(HttpServletRequest request) {
+ String orgIdHeader = request.getHeader("X-Org-Id");
+ if (orgIdHeader == null || orgIdHeader.isBlank()) {
+ return; // No org selected — fine, not all requests need org context
+ }
+
+ Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+ if (auth == null || auth.getName() == null) {
+ return; // Not authenticated — JwtAuthenticationFilter hasn't run or failed
+ }
+
+ UUID userId;
+ try {
+ userId = UUID.fromString(auth.getName());
+ } catch (IllegalArgumentException e) {
+ log.warn("Could not parse userId from principal: {}", auth.getName());
+ return;
+ }
+
+ UUID orgId;
+ try {
+ orgId = UUID.fromString(orgIdHeader);
+ } catch (IllegalArgumentException e) {
+ log.warn("Invalid X-Org-Id header format: {}", orgIdHeader);
+ return;
+ }
+
+ // Determine org type: from header or by searching user's memberships
+ String orgTypeHeader = request.getHeader("X-Org-Type");
+ final OrgType resolvedOrgType;
+ if (orgTypeHeader != null && !orgTypeHeader.isBlank()) {
+ try {
+ resolvedOrgType = OrgType.valueOf(orgTypeHeader.toUpperCase());
+ } catch (IllegalArgumentException e) {
+ log.warn("Unknown X-Org-Type header value: {}", orgTypeHeader);
+ return;
+ }
+ } else {
+ resolvedOrgType = null;
+ }
+
+ // Validate membership
+ if (resolvedOrgType != null) {
+ membershipService.resolve(userId, resolvedOrgType, orgId)
+ .ifPresent(m -> OrgContextHolder.set(new OrgContext(resolvedOrgType, orgId)));
+ } else {
+ // No org type specified — find by orgId across user's active memberships
+ membershipService.activeForUser(userId).stream()
+ .filter(m -> m.getOrgId().equals(orgId))
+ .findFirst()
+ .ifPresent(m -> OrgContextHolder.set(new OrgContext(m.getOrgType(), orgId)));
+ }
+ }
+}
diff --git a/plate-auth-starter/src/main/java/de/platesoft/auth/service/AccessRequestService.java b/plate-auth-starter/src/main/java/de/platesoft/auth/service/AccessRequestService.java
new file mode 100644
index 0000000..e2fd869
--- /dev/null
+++ b/plate-auth-starter/src/main/java/de/platesoft/auth/service/AccessRequestService.java
@@ -0,0 +1,130 @@
+package de.platesoft.auth.service;
+
+import de.platesoft.auth.entity.*;
+import de.platesoft.auth.repository.AccessRequestRepository;
+import de.platesoft.auth.repository.UserRepository;
+import de.platesoft.auth.spi.AccessRequestMailer;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.UUID;
+
+/**
+ * Access request lifecycle service.
+ *
+ * Manages self-service access requests: a user requests access to an org,
+ * admins review, approve (→ membership granted) or deny.
+ *
+ * Rate limiting (§10 threat model): Max 3 pending requests per user per day
+ * to prevent access-request DoS.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AccessRequestService {
+
+ private static final long MAX_PENDING_PER_USER = 3;
+
+ private final AccessRequestRepository requestRepository;
+ private final MembershipService membershipService;
+ private final AccessRequestMailer accessRequestMailer;
+ private final UserRepository userRepository;
+
+ /**
+ * Submit a new access request.
+ *
+ * @throws IllegalStateException if the user already has MAX_PENDING_PER_USER pending requests.
+ */
+ @Transactional
+ public AccessRequest submitRequest(User requester, OrgType orgType, UUID orgId,
+ MembershipRole requestedRole, String justification) {
+ long pendingCount = requestRepository.countByRequesterIdAndStatus(
+ requester.getId(), AccessRequestStatus.PENDING);
+ if (pendingCount >= MAX_PENDING_PER_USER) {
+ throw new IllegalStateException(
+ "Too many pending access requests (max " + MAX_PENDING_PER_USER + ")");
+ }
+
+ AccessRequest request = AccessRequest.builder()
+ .requester(requester)
+ .orgType(orgType)
+ .orgId(orgId)
+ .requestedRole(requestedRole)
+ .justification(justification)
+ .status(AccessRequestStatus.PENDING)
+ .build();
+ request = requestRepository.save(request);
+
+ accessRequestMailer.notifyAdmins(request);
+ log.info("Access request submitted: requester={} org={}:{} role={}",
+ requester.getId(), orgType, orgId, requestedRole);
+ return request;
+ }
+
+ /**
+ * Approve a pending access request — grants the requested membership.
+ */
+ @Transactional
+ public Membership approveRequest(UUID requestId, UUID reviewerId, String decisionReason) {
+ AccessRequest request = requestRepository.findById(requestId)
+ .orElseThrow(() -> new IllegalArgumentException("Access request not found: " + requestId));
+ if (request.getStatus() != AccessRequestStatus.PENDING) {
+ throw new IllegalStateException("Request is not pending (status=" + request.getStatus() + ")");
+ }
+
+ User requester = request.getRequester();
+ Membership membership = membershipService.grant(
+ requester, request.getOrgType(), request.getOrgId(),
+ request.getRequestedRole(), reviewerId,
+ "Access request approved: " + decisionReason);
+
+ request.setStatus(AccessRequestStatus.APPROVED);
+ request.setReviewerId(reviewerId);
+ request.setDecisionReason(decisionReason);
+ request.setDecidedAt(Instant.now());
+
+ accessRequestMailer.notifyRequester(request);
+ log.info("Access request approved: id={} requester={} by={}", requestId, requester.getId(), reviewerId);
+ return membership;
+ }
+
+ /**
+ * Deny a pending access request.
+ */
+ @Transactional
+ public void denyRequest(UUID requestId, UUID reviewerId, String decisionReason) {
+ AccessRequest request = requestRepository.findById(requestId)
+ .orElseThrow(() -> new IllegalArgumentException("Access request not found: " + requestId));
+ if (request.getStatus() != AccessRequestStatus.PENDING) {
+ throw new IllegalStateException("Request is not pending (status=" + request.getStatus() + ")");
+ }
+
+ request.setStatus(AccessRequestStatus.DENIED);
+ request.setReviewerId(reviewerId);
+ request.setDecisionReason(decisionReason);
+ request.setDecidedAt(Instant.now());
+
+ accessRequestMailer.notifyRequester(request);
+ log.info("Access request denied: id={} requester={} by={}", requestId, request.getRequester().getId(), reviewerId);
+ }
+
+ /**
+ * List pending access requests for an org.
+ */
+ @Transactional(readOnly = true)
+ public List Handles login (credential verification), registration (if enabled), refresh-token rotation,
+ * and the "current user" lookup for {@code GET /api/auth/me}.
+ *
+ * Security note (§9.6 of Sprint-0-Plan). Failed login returns a generic
+ * "invalid credentials" message — never reveals whether the email exists or not.
+ * All login attempts (success + failure) are recorded via {@link LoginEventService}.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AuthService {
+
+ private final UserRepository userRepository;
+ private final PasswordEncoder passwordEncoder;
+ private final JwtService jwtService;
+ private final LoginEventService loginEventService;
+ private final MembershipService membershipService;
+ private final PlateAuthProperties props;
+
+ /**
+ * Authenticate with email + password.
+ *
+ * @throws BadCredentialsException if the email doesn't exist or the password is wrong.
+ * The exception message is intentionally generic — no "user exists" leak.
+ */
+ @Transactional
+ public TokenResponse login(String email, String password, String ipAddress, String userAgent) {
+ User user = userRepository.findByEmail(email).orElse(null);
+
+ if (user == null || user.getPasswordHash() == null
+ || !passwordEncoder.matches(password, user.getPasswordHash())) {
+ loginEventService.recordFailure(email, "password", "BAD_CREDENTIALS", ipAddress, userAgent);
+ throw new BadCredentialsException("Invalid email or password");
+ }
+
+ if (!user.isActive()) {
+ loginEventService.recordFailure(email, "password", "LOCKED", ipAddress, userAgent);
+ throw new BadCredentialsException("Account is deactivated");
+ }
+
+ user.setLastProvider("password");
+ user.setLastLogin(OffsetDateTime.now());
+ loginEventService.recordSuccess(user, "password", ipAddress, userAgent);
+ return jwtService.issueTokensFor(user);
+ }
+
+ /**
+ * Register a new user with email + password.
+ *
+ * @throws IllegalStateException if registration is disabled or the email is already in use.
+ */
+ @Transactional
+ public TokenResponse register(String email, String password, String firstName, String lastName,
+ String ipAddress, String userAgent) {
+ if (!props.getRegistration().isEnabled()) {
+ throw new IllegalStateException("Registration is disabled");
+ }
+ if (userRepository.existsByEmail(email)) {
+ throw new IllegalStateException("Email already registered");
+ }
+
+ User user = User.builder()
+ .email(email)
+ .passwordHash(passwordEncoder.encode(password))
+ .firstName(firstName)
+ .lastName(lastName)
+ .role(Role.ROLE_USER)
+ .active(true)
+ .lastProvider("password")
+ .build();
+ user = userRepository.save(user);
+
+ loginEventService.recordSuccess(user, "password", ipAddress, userAgent);
+ return jwtService.issueTokensFor(user);
+ }
+
+ /**
+ * Refresh an access token using a valid refresh token.
+ *
+ * @throws BadCredentialsException if the refresh token is invalid, expired, or not a refresh-type token.
+ */
+ public TokenResponse refresh(String refreshToken) {
+ if (!jwtService.isTokenValid(refreshToken)) {
+ throw new BadCredentialsException("Invalid refresh token");
+ }
+ Claims claims = jwtService.extractClaims(refreshToken);
+ if (!"refresh".equals(claims.get("type", String.class))) {
+ throw new BadCredentialsException("Token is not a refresh token");
+ }
+
+ UUID userId = UUID.fromString(claims.getSubject());
+ User user = userRepository.findById(userId)
+ .orElseThrow(() -> new BadCredentialsException("User not found for refresh token"));
+ if (!user.isActive()) {
+ throw new BadCredentialsException("Account is deactivated");
+ }
+ return jwtService.issueTokensFor(user);
+ }
+
+ /**
+ * Get the current user + active memberships for {@code GET /api/auth/me}.
+ */
+ @Transactional(readOnly = true)
+ public CurrentUserInfo getCurrentUser(UUID userId) {
+ User user = userRepository.findById(userId)
+ .orElseThrow(() -> new IllegalArgumentException("User not found: " + userId));
+ List Manages the full invitation workflow: create (generate token, store hash, mail),
+ * accept (validate token, grant membership, mark accepted), revoke, and list.
+ *
+ * Security: Invitation tokens are 64-char URL-safe random values. Only the
+ * SHA-256 hash is stored in the database — the plaintext token is returned to the caller
+ * exactly once and sent to the invitee via the {@link InvitationMailer} SPI.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class InvitationService {
+
+ private static final Duration DEFAULT_EXPIRATION = Duration.ofDays(7);
+ private static final int TOKEN_LENGTH = 48; // bytes → 64-char Base64 string
+
+ private final InvitationRepository invitationRepository;
+ private final MembershipService membershipService;
+ private final InvitationMailer invitationMailer;
+ private final OrgDisplayNameResolver orgDisplayNameResolver;
+
+ /**
+ * Create a new invitation.
+ *
+ * @param email the invitee's email
+ * @param orgType the org type (COMPANY, WORKSPACE, etc.)
+ * @param orgId the org UUID
+ * @param role the role to grant on acceptance
+ * @param createdBy the inviting user's UUID
+ * @return the created invitation with the plaintext token (returned once — not stored)
+ */
+ @Transactional
+ public Invitation createInvitation(String email, OrgType orgType, UUID orgId,
+ MembershipRole role, UUID createdBy) {
+ // Generate token
+ byte[] tokenBytes = new byte[TOKEN_LENGTH];
+ new SecureRandom().nextBytes(tokenBytes);
+ String plaintextToken = Base64.getUrlEncoder().withoutPadding().encodeToString(tokenBytes);
+ String tokenHash = sha256Hex(plaintextToken);
+
+ Invitation invitation = Invitation.builder()
+ .token(tokenHash)
+ .email(email)
+ .orgType(orgType)
+ .orgId(orgId)
+ .role(role)
+ .status(InvitationStatus.PENDING)
+ .createdBy(createdBy)
+ .createdAt(Instant.now())
+ .expiresAt(Instant.now().plus(DEFAULT_EXPIRATION))
+ .build();
+ invitation = invitationRepository.save(invitation);
+
+ // Mail the invitee with the plaintext token URL
+ String orgName = orgDisplayNameResolver.displayName(orgType, orgId);
+ invitationMailer.sendInvitation(invitation, plaintextToken);
+ log.info("Invitation created: email={} org={}:{} role={} by={}",
+ email, orgType, orgId, role, createdBy);
+
+ // Return a copy with the plaintext token so the caller can see it once
+ var withToken = Invitation.builder()
+ .id(invitation.getId())
+ .token(plaintextToken) // plaintext, not the hash
+ .email(invitation.getEmail())
+ .orgType(invitation.getOrgType())
+ .orgId(invitation.getOrgId())
+ .role(invitation.getRole())
+ .status(invitation.getStatus())
+ .createdBy(invitation.getCreatedBy())
+ .createdAt(invitation.getCreatedAt())
+ .expiresAt(invitation.getExpiresAt())
+ .build();
+ return withToken;
+ }
+
+ /**
+ * Accept an invitation using the plaintext token.
+ *
+ * @param plaintextToken the token from the invitation email
+ * @param user the accepting user
+ * @throws IllegalArgumentException if the token is invalid, expired, already accepted, or revoked
+ */
+ @Transactional
+ public Membership acceptInvitation(String plaintextToken, User user) {
+ String tokenHash = sha256Hex(plaintextToken);
+ Invitation invitation = invitationRepository.findByToken(tokenHash)
+ .orElseThrow(() -> new IllegalArgumentException("Invalid invitation token"));
+
+ if (invitation.getStatus() == InvitationStatus.ACCEPTED) {
+ throw new IllegalStateException("Invitation already accepted");
+ }
+ if (invitation.getStatus() == InvitationStatus.REVOKED) {
+ throw new IllegalStateException("Invitation has been revoked");
+ }
+ if (invitation.getExpiresAt().isBefore(Instant.now())) {
+ invitation.setStatus(InvitationStatus.EXPIRED);
+ throw new IllegalStateException("Invitation has expired");
+ }
+
+ // Grant membership
+ Membership membership = membershipService.grant(
+ user, invitation.getOrgType(), invitation.getOrgId(),
+ invitation.getRole(), invitation.getCreatedBy(),
+ "Invitation accepted");
+
+ // Mark invitation as accepted
+ invitation.setStatus(InvitationStatus.ACCEPTED);
+ invitation.setAcceptedAt(Instant.now());
+ invitation.setAcceptedBy(user.getId());
+
+ log.info("Invitation accepted: email={} org={}:{} user={}",
+ invitation.getEmail(), invitation.getOrgType(), invitation.getOrgId(), user.getId());
+ return membership;
+ }
+
+ /**
+ * Revoke a pending invitation.
+ */
+ @Transactional
+ public void revokeInvitation(UUID invitationId, UUID revokedBy) {
+ Invitation invitation = invitationRepository.findById(invitationId)
+ .orElseThrow(() -> new IllegalArgumentException("Invitation not found: " + invitationId));
+ if (invitation.getStatus() != InvitationStatus.PENDING) {
+ throw new IllegalStateException("Can only revoke pending invitations");
+ }
+ invitation.setStatus(InvitationStatus.REVOKED);
+ invitation.setRevokedAt(Instant.now());
+ invitation.setRevokedBy(revokedBy);
+ log.info("Invitation revoked: id={} by={}", invitationId, revokedBy);
+ }
+
+ /**
+ * List pending invitations for an org.
+ */
+ @Transactional(readOnly = true)
+ public List
+ *
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/auth")
+@RequiredArgsConstructor
+public class AuthController {
+
+ private final AuthService authService;
+ private final PlateAuthProperties props;
+
+ @PostMapping("/login")
+ public ResponseEntity
+ *
+ */
+@RestController
+@RequestMapping("/api/invitations")
+@RequiredArgsConstructor
+public class InvitationController {
+
+ private final InvitationService invitationService;
+ private final UserRepository userRepository;
+
+ @PostMapping
+ public ResponseEntity