[patrickbradley-cog]

Summary

Linear: COG-1152 — W1 forward-compatible refactor on Boot 1.5.4 (no Boot/Java bump).

SecurityConfig:

- @Autowired private Environment env;          // never read
  @Bean
- public BCryptPasswordEncoder passwordEncoder() {
+ public PasswordEncoder passwordEncoder() {
      return new BCryptPasswordEncoder(12, new SecureRandom(SALT.getBytes()));  // unchanged; seeded RNG drops in W2
  }
  PUBLIC_MATCHERS:
-   "/error/**/*",   // invalid under PathPatternParser (** must be last segment)
-   "/console/**",   // no H2 dependency — open path to nothing
+   "/error/**",

UserServiceImpl: field BCryptPasswordEncoder passwordEncoder → PasswordEncoder passwordEncoder (import swapped; encode() call unchanged).

Why the bean type matters: Spring registers @Bean methods under the declared return type. W2 declares PasswordEncoder passwordEncoder(), which would not satisfy a concrete BCryptPasswordEncoder injection point → NoSuchBeanDefinitionException at startup. Decoupling now keeps the W2 pivot structural-only.

Behaviour notes:

• /error/** matches the same paths under today's AntPathMatcher; /error stays permitted.
• /console/** now requires auth (anonymous → 302 /index) instead of an anonymous 404.
• Hash format is unaffected — BCrypt embeds the per-hash salt; existing $2a$12$… rows still verify (verified below).

Merge order: should merge behind the W0 smoke suite (#106, #108, #109). COG-1159 also edits PUBLIC_MATCHERS; this PR's edit to the array is a 2-line → 1-line change so the second to merge rebases trivially.

Verification

JDK: Temurin 1.8.0_504; MySQL 5.7 in docker (useSSL=false override needed because modern JDK 8 disables TLSv1/1.1 used by Connector/J 5.1.42 — environment only, not changed in repo).

SPRING_DATASOURCE_URL='jdbc:mysql://localhost:3306/onlinebanking?useSSL=false' mvn -B -f UserFront/pom.xml verify

Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.UserFrontApplicationTests
[INFO] BUILD SUCCESS

Pre-existing hash compatibility — user created by the master build, then logged in with this branch's build:

# master jar (port 8081)
POST /signup (seeduser)                  HTTP 302 -> /
user: seeduser  $2a$12$ePM3LO6nq3ezXjVvjW3q0.xLeTCZTaM8NpeejeMxI0yWrfvL08vwm

# branch jar (port 8080) — context started, no NoSuchBeanDefinitionException
POST /index seeduser / correct password  HTTP 302 -> /userFront
GET  /userFront (session)                HTTP 200
POST /index seeduser / wrong password    HTTP 302 -> /index?error

New hash via widened PasswordEncoder field (branch jar, fresh DB):

POST /signup newuser                     HTTP 302 -> /
POST /index newuser                      HTTP 302 -> /userFront
GET  /userFront (session)                HTTP 200
user: newuser  $2a$12$q6.mdaCmtC2hPmofslS/6eX5jaMSCJcTaHq.JdkOlhrQXBZKiS.nG

Matchers (anonymous, branch jar):

GET /error       500 (Boot error page rendered, not redirected -> still permitted)
GET /error/foo   404 (permitted)
GET /console     302 -> /index
GET /console/x   302 -> /index
GET /signup      200
GET /userFront   302 -> /index

Unrelated pre-existing issue observed (not touched here): a second signup after an app restart fails with NonUniqueResultException in AccountServiceImpl.createPrimaryAccount because accountGen() restarts its counter per JVM; that's why the new-hash check used a fresh DB. Smoke suite not run (not on master yet).

Link to Devin session: https://app.devin.ai/sessions/cbd67468fca14ee6928abaec5893378c
Open in Devin Desktop: https://app.devin.ai/desktop/session/cbd67468fca14ee6928abaec5893378c?variant=devin
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.