Refactor account activation and password reset

Closes #47

See merge request !146

Account activation is now using the ban logic as used for login failure
logic.

The account activation and reset mail now only contain the code. String
placeholders are numbered correctly again. The activation and reset
keys' length has been reduced to 8 characters.

Fixes #47.

Fix multiple bugs and code smells

See merge request !147

Removed unused legacy forwards.

Implement RFC 6750 instead of custom header for JWT

See merge request !144

Daniel Gerhardt authored 5 years ago and Daniel Gerhardt committed 5 years ago

The JWT is now read from the Authorization header:
	Authorization: Bearer <JWT>
The Arsnova-Auth-Token header is no longer supported.

Using a standard header simplifies integration of the API with other
services and HTTP/REST libraries and tools.

RFC 6750:
https://tools.ietf.org/html/rfc6750

Add /management endpoint provided via Spring Actuator

See merge request !140

Daniel Gerhardt authored 5 years ago and Daniel Gerhardt committed 5 years ago

We do not use any data sources at the moment and the auto config causes
problems when the application is deployed to Tomcat.

Daniel Gerhardt authored 5 years ago and Daniel Gerhardt committed 5 years ago

Methods annotated with @Timed now use Micrometers annotation. The @Gauge
annotation has been remove without replacement for now.

While configuration for the use of Micrometer's TimedAspect has been
prepared, it is not yet active because of compatibility issues with
compile-time weaving.
See https://github.com/micrometer-metrics/micrometer/issues/1149.

Daniel Gerhardt authored 5 years ago and Daniel Gerhardt committed 5 years ago

The new endpoint provide metrics including information about application
health, environment, configuration, beans, caches and performance via
Spring Actuator. Additional custom endpoints for version info and
statistics are available.

Content type `application/json` may not be set for the `Accept` header
of requests to the management API. Otherwise, only a JSON stub is
returned. `application/vnd.spring-boot.actuator.v2+json` or `*/*` should
be used instead.

To allow monitoring of metrics, a Prometheus endpoint is provided via
Micrometer.

Web API documentation:
https://docs.spring.io/spring-boot/docs/2.1.x/actuator-api/html/

Enable Jacoco for GitLab unit test job

See merge request !145

Use constants for HTTP methods and header names

See merge request !143

Add support to build and run on Java 11

See merge request !142

Daniel Gerhardt authored 5 years ago and Tom Käsler committed 5 years ago

The Nashorn ScriptEngine is deprecated since JDK 11 as described by
JEP 335. We now include GraalJS as a replacement.

Related docs:
* https://github.com/graalvm/graaljs.
* https://openjdk.java.net/jeps/174.
* https://openjdk.java.net/jeps/335.

Daniel Gerhardt authored 5 years ago and Tom Käsler committed 5 years ago

This workaround can be removed when a new plugin version is released.

Daniel Gerhardt authored 5 years ago and Tom Käsler committed 5 years ago

Java 11 removes Java EE modules as described by JEP 320. Since we depend
on some of those modules those have now to be added explicitly.

The following affected APIs are used by us directly or indirectly:
* javax.annotation
* javax.xml.bind

Some workarounds had to be added for now to fix issues caused by
dependencies which include conflicting APIs.

See https://openjdk.java.net/jeps/320.

Add tracing on incoming messages

See merge request !139

Add bean validation for entity classes

See merge request !138

Validation is performed before entities are persisted using Hibernate
Validator, the reference implementation for Bean Validation 2.0
(JSR 380).

Refs #23.

Use YAML instead of properties format for config

See merge request !137

The location of `application.yml` can now be set via environment
variable `ARSNOVA_CONFIG_DIR` or Java system property
`arsnova.config-dir`.

For most of the configuration property classes are now used instead of
using property injection via @Value.

Apply code conventions based on Google's Java conventions and enforce them via Checkstyle

See merge request !136

Checks for missing Javadocs are run separately and do not cause build
failures for now.

* Removed obsolete commented-out code.
* Fixed indentation of commented out code.
* Added FIXME comments where old code still has to be migrated.

Rules:
* (naming) ParameterName
* (naming) LocalVariableName
* (naming) MemberName
* (naming) InterfaceTypeParameterName
* (naming) AbbreviationAsWordInName
* (modifier) ModifierOrder
* (blocks) NeedBraces
* (coding) OneStatementPerLine
* (coding) MultipleVariableDeclarations
* (coding) VariableDeclarationUsageDistance
* (coding) MissingSwitchDefault
* (coding) OverloadMethodsDeclarationOrder
* (extension) RightCurlySame
* (misc) ArrayTypeStyle