feat: add RBAC with role-based endpoint protection and controller refactor

[exeaman]

Overview

This pull request introduces Role-Based Access Control (RBAC) using Spring Security and refactors controllers by moving business logic to the service layer.

The goal is to improve security, maintainability, and align the codebase with standard backend design practices without breaking existing API contracts.

---

Related Issue/Ticket

N/A (feature enhancement)

---

Files Changed

Security

• SecurityConfig.java
• CustomUserDetailsService.java
• JwtRequestFilter.java

Controllers

• AuthController.java
• DepartmentController.java
• EmployeeController.java

Services

• AuthService.java
• DepartmentService.java
• EmployeeService.java

DTOs

• AssignRoleRequestDto.java
• UserResponseDto.java

Documentation

• README.md (updated with RBAC usage and authentication flow)

---

Testing

• Verified endpoints using Swagger and Postman
• Tested JWT authentication flow:
  • Register → Authenticate → Access protected endpoints
• Tested RBAC behavior:
  • ADMIN → full access (create/update/delete)
  • MANAGER → limited update access
  • EMPLOYEE → read-only access
• Verified error handling:
  • 401 Unauthorized (invalid credentials)
  • 403 Forbidden (insufficient permissions)
  • 404 Not Found
  • 409 Conflict (duplicate user, invalid operations)

---

Screenshots (if applicable)

N/A (Backend changes only)

---

Notes to Reviewers

• RBAC is implemented using @PreAuthorize with role-based authorities
• Role is stored in the users table and enforced at the controller level
• Added endpoint for ADMIN to assign roles to users
• Business logic has been moved from controllers to service layer
• Existing API endpoints, request/response structure, and status codes are preserved to avoid breaking changes
• Addressed review feedback:
  • Added duplicate user check during registration
  • Improved authentication error handling
  • Removed redundant controller logic

---

Deployment Notes

• No additional deployment steps required
• Ensure JWT secret and database configuration are properly set

[vercel]

@exeaman is attempting to deploy a commit to the dav nguyen's projects Team on Vercel.

A member of the Team first needs to authorize it.

[netlify]

✅ Deploy Preview for employee-management-fullstack-system canceled.

Name	Link
🔨 Latest commit	33fa44d
🔍 Latest deploy log	https://app.netlify.com/projects/employee-management-fullstack-system/deploys/69e68adf86f0eb00082b77a3

[gemini-code-assist]

Code Review

This pull request implements Role-Based Access Control (RBAC) and refactors the backend architecture by delegating business logic from controllers to service components. Key changes include the integration of JWT-based security, role-based endpoint authorization, and new administrative user management features. Review feedback highlights several improvement opportunities, such as aligning exception types in the authentication service with the global handler, further simplifying controllers by delegating logic, eliminating redundant entity lookups, and adding necessary validation to request DTOs to ensure robustness.

[exeaman]

The basic RBAC implementation has been done along with some architectural improvements in MVC layers.