security: sanitize codebase by removing hardcoded default secrets and enforcing environment variables

README.md

@@ -4,6 +4,22 @@
 
 This branch represents a major security milestone for the Canteen Automation system, transitioning from open/unprotected endpoints to a robust **JWT-based Authentication** architecture.
 
+### 🔐 Critical: Security Configuration
+
+To run this application securely, you **MUST** configure the following environment variables. Do **NOT** commit real secrets to the repository.
+
+#### Required Environment Variables
+| Variable | Description | Example/Hint |
+| :--- | :--- | :--- |
+| `JWT_SECRET` | Secret key for signing tokens | `openssl rand -base64 32` |
+| `DB_PASSWORD` | Database user password | Your PostgreSQL password |
+| `MASTER_USER` | Initial admin email | `admin@example.com` |
+| `MASTER_PASSWORD` | Initial admin password | `SecurePassword123` |
+
+#### How to set them:
+- **Local Development**: Create a `.env` file (if using a loader) or set them in your IDE (IntelliJ/Eclipse) Run Configurations.
+- **Production**: Set them as System Environment Variables on your server or CI/CD platform (e.g., GitHub Secrets, Railway, Docker).
+
 ### 🏗️ Ecosystem Architecture
 - **Backend (Java/Spring Boot)**: Now fully protected by JWT guards. Includes `JwtAuthFilter`, `JwtUtil`, and enhanced `SecurityConfig`.
 - **Frontend (Counter/Admin)**: Migrated to use an authenticated API wrapper (`src/api.ts`).

backend/src/main/java/com/rit/canteen/sales/service/SystemUserService.java

@@ -20,10 +20,10 @@ public class SystemUserService {
     @Autowired
     private BCryptPasswordEncoder passwordEncoder;
 
-    @Value("${app.master.username:admin}")
+    @Value("${app.master.username}")
     private String masterUsername;
 
-    @Value("${app.master.password:admin}")
+    @Value("${app.master.password}")
     private String masterPassword;
 
     @PostConstruct

backend/src/main/resources/application.properties

@@ -2,12 +2,12 @@ spring.application.name=backend
 server.address=0.0.0.0
 
 # ============================================================
-# DATABASE — use environment variables in production
+# DATABASE — REQUIRED environment variables
-# Set DB_URL, DB_USER, DB_PASSWORD as env vars before running
+# Set these in your environment or a .env file
 # ============================================================
 spring.datasource.url=${DB_URL:jdbc:postgresql://localhost:5432/positeasy}
 spring.datasource.username=${DB_USER:postgres}
-spring.datasource.password=${DB_PASSWORD:sidharth}
+spring.datasource.password=${DB_PASSWORD}
 spring.datasource.driver-class-name=org.postgresql.Driver
 
 spring.jpa.hibernate.ddl-auto=update
@@ -16,17 +16,17 @@ spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
 spring.jpa.properties.hibernate.jdbc.time_zone=Asia/Kolkata
 
 # ============================================================
-# JWT — CHANGE THIS SECRET IN PRODUCTION (min 256-bit key)
+# JWT — REQUIRED environment variables
-# Set JWT_SECRET as an environment variable before running
+# MUST provide a secure random key (min 256-bit)
 # ============================================================
-app.jwt.secret=${JWT_SECRET:3RiTCaNtEeNsUpErSeCrEtKeY2026!!xYzAbCdEfGhIjKlMn}
+app.jwt.secret=${JWT_SECRET}
 app.jwt.expiration-ms=86400000
 
 # ============================================================
-# Master Account — use environment variables in production
+# Master Account — REQUIRED environment variables
 # ============================================================
-app.master.username=${MASTER_USER:admin}
+app.master.username=${MASTER_USER}
-app.master.password=${MASTER_PASSWORD:admin}
+app.master.password=${MASTER_PASSWORD}
 
 # File upload configuration
 spring.servlet.multipart.max-file-size=10MB
@@ -34,6 +34,5 @@ spring.servlet.multipart.max-request-size=10MB
 
 # ============================================================
 # CORS — comma-separated list of allowed frontend origins
-# Set APP_CORS_ORIGINS as env var in production
 # ============================================================
 app.cors.allowed-origins=${APP_CORS_ORIGINS:http://localhost:5173,http://localhost:5174,http://localhost:3000}