Implement onboarding authentication resolver and related classes

[jeyongsong]

This pull request refactors the authentication and onboarding flow, introducing a clearer separation between general authenticated requests and onboarding-specific authentication. It removes the old JWT authentication filter and argument resolver, replacing them with two new argument resolvers: one for onboarding endpoints and one for fully onboarded members. The onboarding process is now enforced at the argument resolver level, and related annotations and configuration are updated accordingly.

Authentication and Onboarding Refactor:

• Removed the old JwtAuthenticationFilter and AuthenticatedMemberResolver, along with the now-unused AuthConstants object. This eliminates the previous approach of setting member IDs as request attributes and handling JWT validation in a filter. [1] [2] [3]
• Added OnboardingAuth annotation and OnboardingAuthMemberResolver, which validates JWT tokens and allows access to onboarding endpoints for any authenticated user, regardless of onboarding completion. [1] [2]
• Added AuthMemberResolver, which validates JWT tokens and enforces onboarding completion by checking profile, payroll, work policy, and required terms agreements before allowing access to endpoints requiring full authentication. Throws a specific exception if onboarding is incomplete.
• Updated WebConfig to register both new argument resolvers, ensuring the correct resolver is used based on the annotation present in controller methods.

Controller and Annotation Usage:

• Updated OnboardingController to use the new @OnboardingAuth annotation instead of @Auth, ensuring onboarding endpoints are accessible to users who have not yet completed onboarding. [1] [2] [3]

Exception and Error Handling:

• Replaced the generic FORBIDDEN error code with a more specific ONBOARDING_INCOMPLETE error code for cases where onboarding is not finished, and updated ForbiddenException to require an explicit error code. [1] [2]

Swagger/OpenAPI Configuration:

• Updated SwaggerConfig to ignore the new OnboardingAuth annotation in API documentation, similar to the existing handling for Auth. [1] [2]

Other:

• Moved the AuthenticatedMemberInfo data class to its own file for clarity and reuse. [1] [2]

These changes provide a more robust and maintainable authentication system, clearly distinguishing between onboarding and fully authenticated flows.

[github-actions]

Test Results

8 tests   8 ✅  0s ⏱️
1 suites  0 💤
1 files    0 ❌

Results for commit 3f8a8af.

[subsub97]

GOOD