Repository navigation
Post entries through /api/entry and handle two-factor login - #5
Merged
Merged
Conversation
The client logged in with POST /api/login but still posted entries to the old /updateJournal servlet, sending the username and password with every post. Desktop clients are moving to the documented JSON API. - Entry sends a JSON POST /api/entry with the session cookie from the login. Every field is sent, including an empty tags list, since the server fails after saving when tags is missing. - Auth.restLogin() only succeeds on status JJ.LOGIN.OK instead of any 200. Accounts with two-factor login get JJ.LOGIN.2FA, and the new verifySecondFactor() finishes the login at /api/login/2fa; the GUI prompts for the code. - Remove the unused Auth.secureCheckAccount() and the form-post helpers in HttpUtils that nothing else used. Closes #4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's GuideMigrates authentication and journal posting to the JSON REST API with in-memory session-cookie management, adds a complete two-factor login flow and GUI integration, removes obsolete form helpers, and substantially expands endpoint-level test coverage. Sequence diagram for two-factor login and session managementsequenceDiagram
actor User
participant FormGui
participant Auth
participant LoginAPI
participant TwoFactorAPI
User->>FormGui: login()
FormGui->>Auth: restLogin()
Auth->>LoginAPI: POST /api/login
LoginAPI-->>Auth: JJ.LOGIN.2FA + Set-Cookie
Auth->>Auth: keepCookies()
Auth-->>FormGui: isSecondFactorRequired()
FormGui->>User: verifySecondFactor(code)
User-->>FormGui: code
FormGui->>Auth: verifySecondFactor(code)
Auth->>TwoFactorAPI: POST /api/login/2fa + Cookie
TwoFactorAPI-->>Auth: JJ.LOGIN.OK + Set-Cookie
Auth->>Auth: keepCookies()
Auth-->>FormGui: isLoggedIn()
Sequence diagram for authenticated journal entry postingsequenceDiagram
actor User
participant FormGui
participant Entry
participant Auth
participant EntryAPI
User->>FormGui: submit entry
FormGui->>Entry: update(...)
Entry->>Auth: request(client, api/entry)
Auth-->>Entry: request with Cookie header
Entry->>EntryAPI: POST /api/entry + JSON EntryTo
EntryAPI-->>Entry: status + JSON reply
alt status is 200 and reply status is ok
Entry-->>FormGui: success
else status is 403 or 401
Entry-->>FormGui: SESSION_EXPIRED
else status is 400
Entry-->>FormGui: server error text
end
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Collaborator
Author
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Contributor
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Java |  |
Nov 3, 2026 8:45a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Linked issues
#4 Post entries through `/api/entry` instead of `/updateJournal` · 3 of 3 met
| # | Requirement | Status | Notes |
|---|---|---|---|
| 1 | Post entries as JSON to /api/entry using the /api/login session, with the specified field mappings; only body is required. | ✅ Met | Entry sends the JSON model with the requested mappings, uses the logged-in Auth session, and rejects a blank body before sending. |
| 2 | Check the /api/login status for JJ.LOGIN.OK and handle two-factor login by prompting for a code or showing a clear error. | ✅ Met | Auth checks the response status and handles /api/login/2fa; FormGui prompts for a code and distinguishes e-mail from authenticator codes. |
| 3 | Remove the unused Auth.secureCheckAccount() method. | ✅ Met | The method is removed, and no usages remain. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4
Changes
POST /api/entrywith the session cookie from/api/login, so the username and password no longer go with each post. Every field is sent explicitly (security0/1/2,mood/locationids,format: "TEXT",draft: false,tags: []). The server fails after saving whentagsis missing, which is why it is always sent. A blank body is rejected before sending. 403 is reported as an expired login, and 400 shows the server'serrortext.status: "JJ.LOGIN.OK", not on any 200.JJ.LOGIN.2FAsetsisSecondFactorRequired(), and the newverifySecondFactor(code)finishes the login atPOST /api/login/2faon the same session:JJ.LOGIN.NONEor a 429 means the user has to log in again.Cookieheader is built as plainname=valuepairs, because JAX-RSCookieobjects serialize in the RFC 2109$Versionform.Auth, posts with it, and prompts for the 2FA code (the wording depends on whether the code was e-mailed or comes from an authenticator app).Auth.secureCheckAccount()(/loginAccount) and the form-post helpers inHttpUtils.The request formats come from the server source (
LoginController,TwoFactorLoginController,EntryController,EntryTo) and fromjj_rest.cin the unix client.Testing
./mvnw verify: 56 tests pass (the live-server test is still@Ignored), and the JaCoCo gate and shaded jar build pass.StubServernow supports a reply per path andSet-Cookie. The tests cover the cookie carried from login to post, every JSON field, the 2FA success/wrong-code/locked/forgotten cases, and the error replies.Not included
GET /api/mood(optional in the issue); the built-in table stays.🤖 Generated with Claude Code
Summary by Sourcery
Migrate authentication and entry submission to the REST API with session cookies and complete two-factor login support.
New Features:
/api/entry.Bug Fixes:
Enhancements:
Tests: