[patrickbradley-cog]

Summary

COG-1150 — W1 forward-compatible refactor on Boot 1.5.4 (no Boot/Java bump). Linear: https://linear.app/cog-gtm/issue/COG-1150/w1-user-userrole-generationtypeidentity-and-jsonignore-on

 // User.java
-    @GeneratedValue(strategy = GenerationType.AUTO)
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long userId;
 ...
     @OneToMany(mappedBy = "user", cascade = CascadeType.ALL, fetch = FetchType.LAZY)
+    @JsonIgnore
     private List<Recipient> recipientList;

 // security/UserRole.java  (wildcard javax.persistence.* import left alone for W3)
-    @GeneratedValue(strategy = GenerationType.AUTO)
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
     private long userRoleId;

• IDENTITY: Boot 2.0 sets use-new-id-generator-mappings=true, which would turn AUTO into a hibernate_sequence table generator and collide with existing AUTO_INCREMENT ids. On Boot 1.5.4 AUTO already resolves to identity for MySQL, so this is a no-op today that takes the hazard out of the W2 pivot. Role is intentionally untouched (roleId is manually assigned).
• @JsonIgnore recipientList: GET /api/user/all (admin listing) no longer serialises every user's recipients (name/email/phone/account number/description), and no longer lazy-loads one recipient query per user. AdminPortal's user.service.ts never read it. Thymeleaf transfer/recipient pages are unaffected (they use TransactionService.findRecipientList, not the JSON).

Golden fixtures (COG-1145)

src/test/resources/golden/boot15/user-all.json does not exist on master yet, so nothing was regenerated here. Depending on merge order, COG-1145's user-all.json fixture must be generated without recipientList (or regenerated after this lands).

Merge order

Should merge behind the W0 smoke suite (COG-1141 harness + #106 / #108 / #109), which is not on master yet. Verified below with the existing test + manual run against MySQL.

Verification (Temurin 1.8.0_504, Boot 1.5.4, mysql:5.7 in docker)

mysql:8.0 can't be used with the Boot 1.5.4-managed connector (5.1.42: Unknown system variable 'query_cache_size'), so a mysql:5.7 container was used with --spring.datasource.url=jdbc:mysql://localhost:3306/onlinebanking?useSSL=false.

1. mvn -B -f UserFront/pom.xml verify

Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.UserFrontApplicationTests
[INFO] Building jar: .../UserFront/target/userFront-0.0.1-SNAPSHOT.jar
[INFO] BUILD SUCCESS

2. Baseline on master — started master jar against an empty DB (ddl-auto=update created the schema), seeded role (0=ROLE_USER, 1=ROLE_ADMIN), signed up u1,u2 via POST /signup, added one recipient each via POST /transfer/recipient/save, granted u1 ROLE_ADMIN, then GET /api/user/all as u1:

HTTP 200, 1234 bytes; "recipientList" present:
  "recipientList": [{"id":1,"name":"Recip1","email":"r1@[REDACTED SECRET].com","phone":"9991","accountNumber":"ACCT-1-0001","description":"Bank of 1"}]
recipient selects issued during GET /api/user/all = 2   (one per user)
user.user_id / user_role.user_role_id: bigint NOT NULL AUTO_INCREMENT; no hibernate_sequence table

3. This branch against the same existing schema — started branch jar, signed up u3 + recipient, then GET /api/user/all as admin u1:

HTTP 200, 1420 bytes; users: [1, 2, 3]
recipientList occurrences: 0
keys: accountNonExpired, accountNonLocked, authorities, credentialsNonExpired, email, enabled,
      firstName, lastName, password, phone, primaryAccount, savingsAccount, userId, username
recipient selects issued during GET /api/user/all = 0

Hibernate: insert into user (email, enabled, first_name, ..., username) values (?, ?, ...)   # no id column -> AUTO_INCREMENT
Hibernate: insert into user_role (role_id, user_id) values (?, ?)
user ids: 1,2,3 (u3 = 3, continues master's sequence); user_role ids: 1,2,3,4
information_schema AUTO_INCREMENT: user=4, user_role=5
SHOW TABLES LIKE 'hibernate_sequence' -> empty; 0 mentions in app log; no DDL emitted by ddl-auto=update

/transfer/recipient and /transfer/toSomeoneElse as u3 still render Recip3.

Unrelated pre-existing issue observed: after an app restart, the first signup fails with NonUniqueResultException because AccountServiceImpl.nextAccountNumber is an in-memory static counter that restarts at 11223145 and collides with existing account numbers; the retry succeeds. Happens identically on master; not touched here.

AdminPortal not touched, so no Angular build needed.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/fc7b925445f049c9a8585720b1951730
Open in Devin Desktop: https://app.devin.ai/desktop/session/fc7b925445f049c9a8585720b1951730?variant=devin
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.