digital-rmb-backend/docs/superpowers/plans/2026-08-04-current-user-context.md

Current User Context Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Add no-argument current-user access for backend code and return the same complete profile from GET /api/v1/auth/me.

Architecture: PlatformTokenVerifier parses verified profile claims into VerifiedPlatformToken. LocalSsoAccountService saves the profile in platform_user_snapshot. CurrentUserService reads that snapshot from the Jwt in SecurityContext, and AuthController delegates to it.

Tech Stack: Java 8, Spring Boot 2.7, Spring Security, MyBatis-Plus, H2, JUnit 5, MockMvc.

Global Constraints

• Keep Java 8 and ApiResponse.
• userId and raw roleid are long; school, college, major, class, and student identifiers are String.
• Do not put profile data in application JWTs or expose passwords or Tokens.
• Business requests only read the local snapshot.

---

Task 1: Parse complete profile claims

Files:

• Modify: src/main/java/com/yau/digitalrmb/platformintegration/application/VerifiedPlatformToken.java
• Modify: src/main/java/com/yau/digitalrmb/platformintegration/application/PlatformTokenVerifier.java
• Modify: src/test/java/com/yau/digitalrmb/platformintegration/application/PlatformTokenVerifierTest.java

Interfaces: VerifiedPlatformToken gains schoolId, schoolName, collegeId, collegeName, majorId, majorName, roleId, name, classId, className, studentId.

• Step 1: Write the failing test

@Test
void parsesCompleteUserProfileFromVerifiedToken() throws Exception {
    VerifiedPlatformToken token = verifier.verify(token(487L, "tzs001", "new-password", 2L,
            now.plus(Duration.ofMinutes(5)), completeProfile()));

    assertThat(token.getSchoolId()).isEqualTo("610000");
    assertThat(token.getCollegeName()).isEqualTo("Computer College");
    assertThat(token.getMajorName()).isEqualTo("Software Engineering");
    assertThat(token.getRoleId()).isEqualTo(2L);
    assertThat(token.getName()).isEqualTo("Test Student");
    assertThat(token.getClassId()).isEqualTo("202401");
    assertThat(token.getStudentId()).isEqualTo("20240001");
}

• Step 2: Verify red

Run: mvn -Dtest=PlatformTokenVerifierTest test -DforkCount=0 -B Expected: FAIL because the new getters do not exist.

• Step 3: Minimal implementation

Add immutable fields and a full constructor to VerifiedPlatformToken while retaining the old constructor for existing callers. In PlatformTokenVerifier, preserve parsed roleid as roleId; parse name with username fallback and all remaining profile fields via:

private String optionalText(JsonNode payload, String field) {
    JsonNode node = payload.path(field);
    return node.isMissingNode() || node.isNull() ? null : node.asText();
}

• Step 4: Verify green

Run: mvn -Dtest=PlatformTokenVerifierTest test -DforkCount=0 -B Expected: PASS.

Task 2: Persist the profile snapshot

Files:

• Modify: src/main/resources/schema.sql
• Modify: src/main/java/com/yau/digitalrmb/identity/infrastructure/persistence/entity/PlatformUserSnapshotEntity.java
• Modify: src/main/java/com/yau/digitalrmb/identity/application/LocalSsoAccountService.java
• Modify: src/test/java/com/yau/digitalrmb/identity/LocalSsoAccountServiceTest.java

Interfaces: synchronize(VerifiedPlatformToken) upserts every complete profile field in platform_user_snapshot.

• Step 1: Write the failing test

@Test
void synchronizesCompleteProfileIntoLocalSnapshot() {
    service.synchronize(completeToken(603L, "sso603", 2L));

    Map<String, Object> row = new JdbcTemplate(dataSource).queryForMap(
            "SELECT school_id, college_name, major_name, role_id, class_name, student_id "
                    + "FROM platform_user_snapshot WHERE platform_user_id = 603");
    assertThat(row).containsEntry("school_id", "610000")
            .containsEntry("college_name", "Computer College")
            .containsEntry("major_name", "Software Engineering")
            .containsEntry("role_id", 2L)
            .containsEntry("class_name", "Class 1")
            .containsEntry("student_id", "20240001");
}

• Step 2: Verify red

Run: mvn -Dtest=LocalSsoAccountServiceTest test -DforkCount=0 -B Expected: FAIL because the columns do not exist.

• Step 3: Minimal implementation

Add nullable school_id, school_name, college_id, college_name, major_id, major_name, role_id, class_id, class_name, student_id columns to the table creation and idempotent ADD COLUMN IF NOT EXISTS statements afterward. Map them with TableField in the snapshot Entity and copy token fields in upsertSnapshot.

• Step 4: Verify green

Run: mvn -Dtest=LocalSsoAccountServiceTest test -DforkCount=0 -B Expected: PASS.

Task 3: Implement the common current-user service

Files:

• Create: src/main/java/com/yau/digitalrmb/security/application/CurrentUser.java
• Create: src/main/java/com/yau/digitalrmb/security/application/CurrentUserService.java
• Create: src/test/java/com/yau/digitalrmb/security/CurrentUserServiceTest.java

Interfaces: CurrentUserService.getCurrentUser() returns schoolId, schoolName, collegeId, collegeName, majorId, majorName, roleid, userId, username, name, classId, className, studentid.

• Step 1: Write the failing test

Synchronize a complete profile, put JwtAuthenticationToken for that user into SecurityContextHolder, call currentUserService.getCurrentUser(), and assert all fields. Also test no snapshot and assert BusinessException ErrorCode.UNAUTHORIZED. Clear SecurityContextHolder in AfterEach.

• Step 2: Verify red

Run: mvn -Dtest=CurrentUserServiceTest test -DforkCount=0 -B Expected: FAIL because the service does not exist.

• Step 3: Minimal implementation

public CurrentUser getCurrentUser() {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication == null || !(authentication.getPrincipal() instanceof Jwt)) {
        throw new BusinessException(ErrorCode.UNAUTHORIZED, "用户身份无效");
    }
    long userId = parseUserId((Jwt) authentication.getPrincipal());
    PlatformUserSnapshotEntity snapshot = snapshotMapper.selectById(userId);
    if (snapshot == null) {
        throw new BusinessException(ErrorCode.UNAUTHORIZED, "用户身份不存在");
    }
    return map(snapshot);
}

map converts the complete snapshot, and parseUserId maps malformed subjects to UNAUTHORIZED.

• Step 4: Verify green

Run: mvn -Dtest=CurrentUserServiceTest test -DforkCount=0 -B Expected: PASS.

Task 4: Extend /auth/me

Files:

• Modify: src/main/java/com/yau/digitalrmb/security/interfaces/CurrentUserResponse.java
• Modify: src/main/java/com/yau/digitalrmb/security/interfaces/AuthController.java
• Modify: src/test/java/com/yau/digitalrmb/security/CurrentUserAndLogoutTest.java
• Modify: src/test/java/com/yau/digitalrmb/security/AuthControllerTest.java

Interfaces: GET /api/v1/auth/me returns exactly the 13 CurrentUser fields in data.

• Step 1: Write the failing endpoint test

Synchronize complete Token data and assert data.userId, username, name, schoolId, schoolName, collegeId, collegeName, majorId, majorName, roleid, classId, className, studentid. Update local login assertion to username.

• Step 2: Verify red

Run: mvn -Dtest=CurrentUserAndLogoutTest,AuthControllerTest test -DforkCount=0 -B Expected: FAIL because the response DTO lacks the fields.

• Step 3: Minimal implementation

Replace CurrentUserResponse with the 13 CurrentUser fields. Inject CurrentUserService and have /me map currentUserService.getCurrentUser() into the response; do not query the Mapper in that method.

• Step 4: Verify green and build

Run: mvn -Dtest=CurrentUserAndLogoutTest,AuthControllerTest test -DforkCount=0 -B Expected: PASS.

Run: mvn test -DforkCount=0 -B Expected: PASS.

Run: mvn package -DskipTests -B Expected: BUILD SUCCESS.