Security: hash passwords, remove hardcoded GraphHopper key, validate auth input, guard /internal endpoints

[devin-ai-integration]

Summary

Fixes the critical findings of a security scan of acme-mobility. Full findings list (including issues left unfixed) is in the session message.

1. Passwords were stored and compared in plaintext (AuthService). Now BCrypt-hashed via a PasswordEncoder bean, with an in-place upgrade path so existing rows keep working:

if (isHashed(stored)) return encoder.matches(raw, stored);
// legacy plaintext row: verify once, then rehash and save
if (!stored.equals(raw)) return false;
user.setPassword(encoder.encode(raw)); userRepository.save(user); return true;

authenticate also encodes on the unknown-email path so response time doesn't reveal whether an email exists.

2. Live GraphHopper API key was hardcoded in fm-gateway/application.yml → key: ${GRAPHHOPPER_API_KEY:}, wired through docker-compose; GraphHopperClient.getRoute returns an empty route (linear fallback) when unset instead of calling the API with an empty key. The leaked key 03df4cc7-… is still in git history and must be rotated at GraphHopper.

3. /api/auth/** accepted arbitrary payloads. LoginRequest/RegisterRequest now carry @NotBlank/@Email/@Size(min=8,max=72) and the controller methods use @Valid (spring-boot-starter-validation added). Frontend register form validators were aligned (email format, 8–72 char password) plus a 400 error branch, so client and server agree.

4. Session fixation. Login previously reused the pre-auth session id; loginSuccess now calls HttpServletRequest.changeSessionId() before storing the user. Session cookies get http-only/same-site: lax and secure: ${SESSION_COOKIE_SECURE:false}.

5. /internal/station/events/** was unauthenticated while rental-service publishes port 8080 — any host could inject VEHICLE_RECHARGED messages into running BPMN processes. Added InternalApiKeyFilter requiring X-Internal-Api-Key (constant-time compare) for /internal/**, and stations-service now sends that header on its callback. Both read INTERNAL_API_KEY (set in .env, required by compose); when unset the guard stays open and logs a warning so a bare mvn spring-boot:run still works.

6. Camunda actuator leak. Dropped management.endpoints.configprops.show-values: always from acme-mobility/application.yaml, which exposed configured secret values through /actuator/configprops.

7. Frontend dependencies. npm audit fix (lockfile only): 46 → 32 advisories, all 3 criticals (tar, shell-quote, websocket-driver) and the @angular/core/@angular/common high resolved.

Verification

• mvn test: rental-service 70/70 (incl. new AuthServiceTest, InternalApiKeyFilterTest), stations-service and fm-gateway green.
• Frontend ng build OK; ng test 45/47 — the 2 failures (ActiveRideComponent, rideCompletionGuard) reproduce identically on main.

Link to Devin session: https://app.devin.ai/sessions/474cf914ce04480cb7cf2c6d0e619e3f
Requested by: @NicolasCola7

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring