Authentication

@Entity
@Table(name = "users")
public class User {
    private Long userId;
    private UserRole role;              // TOURIST, GUIDE, ADMIN
    private String fullName;
    private String email;               // Unique identifier for login
    private String passwordHash;        // BCrypt hashed password
    private UserAccountStatus accountStatus;
    private LocalDateTime emailVerifiedAt;
    private LocalDateTime lastLoginAt;
    private LocalDateTime createdAt;
    private LocalDateTime updatedAt;
}

public enum UserAccountStatus {
    PENDING,    // Registration complete, email verification pending
    ACTIVE,     // Fully activated account
    SUSPENDED,  // Temporarily disabled by admin
    DELETED     // Soft-deleted account
}

@Entity
@Table(name = "auth_sessions")
public class AuthSession {
    private Long sessionId;
    private Long userId;
    private String tokenHash;          // Hashed session token
    private LocalDateTime expiresAt;   // Session expiration timestamp
    private LocalDateTime revokedAt;   // Manual revocation timestamp
    private String ip;                 // Client IP address
    private String userAgent;          // Browser/client information
    private LocalDateTime createdAt;
}

@Configuration
public class SecurityConfiguration {
    
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) 
            throws Exception {
        httpSecurity.authorizeHttpRequests(
            auth -> auth
                .requestMatchers("/api/**").permitAll()
                .anyRequest().permitAll()
        ).csrf(csrf -> csrf.disable());
        return httpSecurity.build();
    }
}

@Bean
public WebMvcConfigurer corsConfigure() {
    return new WebMvcConfigurer() {
        public void addCorsMappings(CorsRegistry registry) {
            registry.addMapping("/**")
                    .allowedOrigins("*")
                    .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
                    .allowedHeaders("*");
        }
    };
}

private LocalDateTime emailVerifiedAt; // NULL until verified

SELECT * FROM auth_sessions 
WHERE user_id = ? 
  AND revoked_at IS NULL 
  AND expires_at > NOW();

GET /api/tours/123 HTTP/1.1
Host: api.kinconecta.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Content-Type: application/json

public enum UserRole {
    TOURIST,  // Can book tours, review guides
    GUIDE,    // Can create tours, accept bookings
    ADMIN     // Can manage users, moderate content
}