added security and fix edit profile

src/main/java/com/krylov/refound/security/JwtService.java

@@ -0,0 +1,77 @@
+package com.krylov.refound.security;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Keys;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Function;
+import javax.crypto.SecretKey;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+
+@Service
+public class JwtService {
+
+  @Value("${jwt.secret}")
+  private String secret;
+
+  @Value("${jwt.expiration}")
+  private long expiration;
+
+  public String generateToken(String login) {
+    Map<String, Object> claims = new HashMap<>();
+    return generateToken(claims, login);
+  }
+
+  public String generateToken(Map<String, Object> extraClaims, String login) {
+    return Jwts.builder()
+        .claims(extraClaims)
+        .subject(login)
+        .issuedAt(new Date(System.currentTimeMillis()))
+        .expiration(new Date(System.currentTimeMillis() + expiration))
+        .signWith(getSigningKey())
+        .compact();
+  }
+
+  public String extractLogin(String token) {
+    return extractClaim(token, Claims::getSubject);
+  }
+
+  public boolean isTokenValid(String token) {
+    try {
+      String login = extractLogin(token);
+      return login != null && !isTokenExpired(token);
+    } catch (Exception e) {
+      return false;
+    }
+  }
+
+  private boolean isTokenExpired(String token) {
+    return extractExpiration(token).before(new Date());
+  }
+
+  private Date extractExpiration(String token) {
+    return extractClaim(token, Claims::getExpiration);
+  }
+
+  private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
+    final Claims claims = extractAllClaims(token);
+    return claimsResolver.apply(claims);
+  }
+
+  private Claims extractAllClaims(String token) {
+    return Jwts.parser()
+        .verifyWith(getSigningKey())
+        .build()
+        .parseSignedClaims(token)
+        .getPayload();
+  }
+
+  private SecretKey getSigningKey() {
+    byte[] keyBytes = secret.getBytes(StandardCharsets.UTF_8);
+    return Keys.hmacShaKeyFor(keyBytes);
+  }
+}