[patrickbradley-cog]

Summary

COG-1156 — W1 forward-compatible refactor on Boot 1.5.4 (no Boot/Java bump). In AccountController and HomeController, every method-level @RequestMapping becomes @GetMapping / @PostMapping; the unused RequestMethod import is dropped (and RequestMapping in HomeController, which no longer uses it). The class-level @RequestMapping("/account") on AccountController stays. Only annotations and imports change.

Merge behind the W0 smoke suite (#106, #108, #109 / COG-1141). Those aren't on master yet, so this was checked with the existing test, mvn verify and manual runs against MySQL (below).

Mappings that had no method (these now accept fewer verbs)

The ticket says to check callers rather than default these to GET. I checked, and every caller uses GET:

Mapping	Callers	Verb picked
GET /	signup.html Cancel link th:href="@{/}"; signupPost returns redirect:/	GET
GET /index	Spring Security loginPage("/index") redirects and failureUrl("/index?error") / logoutSuccessUrl("/index?logout"); home() returns redirect:/index. POST /index is the form-login processing URL. Both index.html and AdminPortal login.service.ts post to it, and UsernamePasswordAuthenticationFilter handles it before DispatcherServlet, so the controller method never saw a POST	GET
GET /userFront	defaultSuccessUrl("/userFront") redirect; header.html Home link; redirect:/userFront in Account/Transfer/Appointment controllers	GET
GET /account/primaryAccount	<a th:href> links in userFront.html and common/header.html	GET
GET /account/savingsAccount	<a th:href> links in userFront.html and common/header.html	GET

AdminPortal calls only /index (POST, handled by the security filter), /logout and /api/**. It never calls the routes above. CORS preflight OPTIONS is answered by RequestFilter and never reaches these controllers.

So the only change in behaviour: POST/PUT/DELETE on these five routes now return 405 instead of rendering the page or redirecting. No caller sends those verbs. GET and HEAD are unchanged.

Verification

Environment: Temurin 8 (1.8), MySQL 5.7 in docker. The Boot 1.5.4 connector mysql-connector-java 5.1.42 cannot talk to MySQL 8. SPRING_DATASOURCE_URL=...?useSSL=false is needed because current Temurin 8 turns off the TLS versions that the 5.1 connector negotiates. Both are environment problems and would hit master the same way.

$ SPRING_DATASOURCE_URL='jdbc:mysql://localhost:3306/onlinebanking?useSSL=false' mvn -B -f UserFront/pom.xml clean verify
[INFO] Compiling 37 source files ...
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.UserFrontApplicationTests
[INFO] BUILD SUCCESS

Behavioural probe: build the jar, start it against a fresh DB, sign up, log in, then send each verb to each route with a fresh login before every request. After that, deposit 100, withdraw 40, check the balance and render the primary account page. I ran it on master (before) and on this branch (after):

before (master)

signup POST /signup -> 302 http://localhost:8080/
login  POST /index  -> 302 http://localhost:8080/userFront
(authenticated; fresh login before every request)
PATH                       GET    HEAD   POST   PUT    DELETE
/                          302    302    302    302    302   
/index                     200    200    302    200    200   
/signup                    200    200    200    405    405   
/userFront                 200    200    200    200    200   
/account/primaryAccount    200    200    200    200    200   
/account/savingsAccount    200    200    200    200    200   
/account/deposit           200    200    200    405    405   
/account/withdraw          200    200    200    405    405   
deposit  POST amount=100 Primary -> 302 http://localhost:8080/userFront
withdraw POST amount=40  Primary -> 302 http://localhost:8080/userFront
primary balance (DB): 60.00
GET /account/primaryAccount rows: 2
--- handler mappings registered at startup ---
{[/]} -> HomeController.home
{[/account/deposit],methods=[GET]} -> AccountController.deposit
{[/account/deposit],methods=[POST]} -> AccountController.depositPOST
{[/account/primaryAccount]} -> AccountController.primaryAccount
{[/account/savingsAccount]} -> AccountController.savingsAccount
{[/account/withdraw],methods=[GET]} -> AccountController.withdraw
{[/account/withdraw],methods=[POST]} -> AccountController.withdrawPOST
{[/index]} -> HomeController.index
{[/signup],methods=[GET]} -> HomeController.signup
{[/signup],methods=[POST]} -> HomeController.signupPost
{[/userFront]} -> HomeController.userFront

after (this branch)

signup POST /signup -> 302 http://localhost:8080/
login  POST /index  -> 302 http://localhost:8080/userFront
(authenticated; fresh login before every request)
PATH                       GET    HEAD   POST   PUT    DELETE
/                          302    302    405    405    405   
/index                     200    200    302    405    405   
/signup                    200    200    200    405    405   
/userFront                 200    200    405    405    405   
/account/primaryAccount    200    200    405    405    405   
/account/savingsAccount    200    200    405    405    405   
/account/deposit           200    200    200    405    405   
/account/withdraw          200    200    200    405    405   
deposit  POST amount=100 Primary -> 302 http://localhost:8080/userFront
withdraw POST amount=40  Primary -> 302 http://localhost:8080/userFront
primary balance (DB): 60.00
GET /account/primaryAccount rows: 2
--- handler mappings registered at startup ---
{[/],methods=[GET]} -> HomeController.home
{[/account/deposit],methods=[GET]} -> AccountController.deposit
{[/account/deposit],methods=[POST]} -> AccountController.depositPOST
{[/account/primaryAccount],methods=[GET]} -> AccountController.primaryAccount
{[/account/savingsAccount],methods=[GET]} -> AccountController.savingsAccount
{[/account/withdraw],methods=[GET]} -> AccountController.withdraw
{[/account/withdraw],methods=[POST]} -> AccountController.withdrawPOST
{[/index],methods=[GET]} -> HomeController.index
{[/signup],methods=[GET]} -> HomeController.signup
{[/signup],methods=[POST]} -> HomeController.signupPost
{[/userFront],methods=[GET]} -> HomeController.userFront

diff before.txt after.txt, which shows only the verb narrowing described above:

@@ -2,12 +2,12 @@
 login  POST /index  -> 302 http://localhost:8080/userFront
 (authenticated; fresh login before every request)
 PATH                       GET    HEAD   POST   PUT    DELETE
-/                          302    302    302    302    302   
-/index                     200    200    302    200    200   
+/                          302    302    405    405    405   
+/index                     200    200    302    405    405   
 /signup                    200    200    200    405    405   
-/userFront                 200    200    200    200    200   
-/account/primaryAccount    200    200    200    200    200   
-/account/savingsAccount    200    200    200    200    200   
+/userFront                 200    200    405    405    405   
+/account/primaryAccount    200    200    405    405    405   
+/account/savingsAccount    200    200    405    405    405   
 /account/deposit           200    200    200    405    405   
 /account/withdraw          200    200    200    405    405   
 deposit  POST amount=100 Primary -> 302 http://localhost:8080/userFront
@@ -15,14 +15,14 @@
 primary balance (DB): 60.00
 GET /account/primaryAccount rows: 2
 --- handler mappings registered at startup ---
-{[/]} -> HomeController.home
+{[/],methods=[GET]} -> HomeController.home
 {[/account/deposit],methods=[GET]} -> AccountController.deposit
 {[/account/deposit],methods=[POST]} -> AccountController.depositPOST
-{[/account/primaryAccount]} -> AccountController.primaryAccount
-{[/account/savingsAccount]} -> AccountController.savingsAccount
+{[/account/primaryAccount],methods=[GET]} -> AccountController.primaryAccount
+{[/account/savingsAccount],methods=[GET]} -> AccountController.savingsAccount
 {[/account/withdraw],methods=[GET]} -> AccountController.withdraw
 {[/account/withdraw],methods=[POST]} -> AccountController.withdrawPOST
-{[/index]} -> HomeController.index
+{[/index],methods=[GET]} -> HomeController.index
 {[/signup],methods=[GET]} -> HomeController.signup
 {[/signup],methods=[POST]} -> HomeController.signupPost
-{[/userFront]} -> HomeController.userFront
+{[/userFront],methods=[GET]} -> HomeController.userFront

Signup (POST /signup), login (POST /index → /userFront), deposit/withdraw POSTs (→ redirect:/userFront, primary balance 60.00) and the GET pages behave the same before and after.

No CI is configured on this repo. AdminPortal was not touched.

Link to Devin session: https://app.devin.ai/sessions/74e7c201a8f24a65ac8390dbae253389
Open in Devin Desktop: https://app.devin.ai/desktop/session/74e7c201a8f24a65ac8390dbae253389?variant=devin
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Browser regression check (golden path)

I ran the golden path in Chrome against this branch's jar (Temurin 8, fresh MySQL 5.7), and every step passed:

• / goes to /index. Signup, then form login (POST /index), lands on /userFront.
• Primary and Savings pages open from both the header dropdown and the dashboard "View Details" links. These are the GET-only routes now.
• Deposit 100 into Primary shows $100.00. Withdraw 40 shows $60.00. The Primary page lists both Finished transactions, and they survive a refresh.
• Logout goes to /index?logout.

This run did not retry unsupported verbs. For those, see the before/after verb matrix in the PR description.

Initial dashboard	Final dashboard

Savings account	Primary transactions after refresh

Recording