mini-auth/
├─ pom.xml
├─ src/main/java/
│  └─ com/exemplo/auth/
│     ├─ model/User.java
│     ├─ dao/UserDAO.java
│     ├─ servlet/LoginServlet.java
│     ├─ servlet/LogoutServlet.java
│     └─ filter/AuthFilter.java
├─ src/main/resources/
│  └─ data.sql
└─ src/main/webapp/
   ├─ index.jsp
   ├─ login.jsp
   ├─ home.jsp
   ├─ restrito.jsp
   └─ WEB-INF/web.xml

<project xmlns="http://maven.apache.org/POM/4.0.0"  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0  http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.exemplo</groupId>
  <artifactId>mini-auth</artifactId>
  <version>1.0.0</version>
  <packaging>war</packaging>

  <properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <jstl.version>1.2</jstl.version>
  </properties>

  <dependencies>
    <!-- Servlet API (provided pelo Tomcat 9) -->
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>4.0.1</version>
      <scope>provided</scope>
    </dependency>

    <!-- JSTL para JSP -->
    <dependency>
      <groupId>jstl</groupId>
      <artifactId>jstl</artifactId>
      <version>${jstl.version}</version>
    </dependency>

    <!-- H2 Database -->
    <dependency>
      <groupId>com.h2database</groupId>
      <artifactId>h2</artifactId>
      <version>2.2.224</version>
      <scope>runtime</scope>
    </dependency>

    <!-- BCrypt para senhas (opcional, mas recomendado) -->
    <dependency>
      <groupId>org.mindrot</groupId>
      <artifactId>jbcrypt</artifactId>
      <version>0.4</version>
    </dependency>
  </dependencies>

  <build>
    <finalName>mini-auth</finalName>
    <plugins>
      <plugin>
        <artifactId>maven-war-plugin</artifactId>
        <version>3.4.0</version>
      </plugin>
    </plugins>
  </build>
</project>

DROP TABLE IF EXISTS users;
CREATE TABLE users (
  id IDENTITY PRIMARY KEY,
  username VARCHAR(50) UNIQUE NOT NULL,
  password_hash VARCHAR(100) NOT NULL,
  name VARCHAR(100) NOT NULL
);

-- username: alice / senha: 123456
INSERT INTO users (username, password_hash, name)
VALUES ('alice', '$2a$10$TnXfX2kq1Tq5z7x4wTQhBec0R2v3s2m2m8xvXqZQyq3V2a3s3mKx2', 'Alice Silva');

package com.exemplo.auth.model;

public class User {
    private Long id;
    private String username;
    private String name;

    public User(Long id, String username, String name) {
        this.id = id;
        this.username = username;
        this.name = name;
    }
    public Long getId() { return id; }
    public String getUsername() { return username; }
    public String getName() { return name; }
}

package com.exemplo.auth.dao;

import com.exemplo.auth.model.User;
import org.mindrot.jbcrypt.BCrypt;

import java.sql.*;

public class UserDAO {
    private static final String JDBC_URL = "jdbc:h2:mem:authdb;DB_CLOSE_DELAY=-1";
    private static final String JDBC_USER = "sa";
    private static final String JDBC_PASS = "";

    static {
        // Carrega o script data.sql ao iniciar a classe
        try (Connection conn = getConnection()) {
            String sql = new String(UserDAO.class.getResourceAsStream("/data.sql").readAllBytes());
            for (String stmt : sql.split(";")) {
                if (!stmt.trim().isEmpty()) {
                    try (PreparedStatement ps = conn.prepareStatement(stmt)) {
                        ps.execute();
                    }
                }
            }
        } catch (Exception e) {
            throw new RuntimeException("Erro inicializando H2/data.sql", e);
        }
    }

    public static Connection getConnection() throws SQLException {
        return DriverManager.getConnection(JDBC_URL, JDBC_USER, JDBC_PASS);
    }

    public User authenticate(String username, String passwordPlain) {
        String q = "SELECT id, username, password_hash, name FROM users WHERE username = ?";
        try (Connection c = getConnection();
             PreparedStatement ps = c.prepareStatement(q)) {
            ps.setString(1, username);
            try (ResultSet rs = ps.executeQuery()) {
                if (rs.next()) {
                    String hash = rs.getString("password_hash");
                    if (BCrypt.checkpw(passwordPlain, hash)) {
                        return new User(rs.getLong("id"), rs.getString("username"), rs.getString("name"));
                    }
                }
            }
        } catch (SQLException e) {
            throw new RuntimeException("Erro ao autenticar", e);
        }
        return null;
    }
}

package com.exemplo.auth.servlet;

import com.exemplo.auth.dao.UserDAO;
import com.exemplo.auth.model.User;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.*;
import java.io.IOException;

@WebServlet("/login")
public class LoginServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        req.getRequestDispatcher("/login.jsp").forward(req, resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        String u = req.getParameter("username");
        String p = req.getParameter("password");

        User user = new UserDAO().authenticate(u, p);
        if (user != null) {
            HttpSession session = req.getSession(true);
            session.setAttribute("user", user);
            session.setMaxInactiveInterval(15 * 60); // 15 minutos
            resp.sendRedirect(req.getContextPath() + "/restrito");
        } else {
            req.setAttribute("erro", "Usuário ou senha inválidos.");
            req.getRequestDispatcher("/login.jsp").forward(req, resp);
        }
    }
}

package com.exemplo.auth.servlet;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.*;
import java.io.IOException;

@WebServlet("/logout")
public class LogoutServlet extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        HttpSession s = req.getSession(false);
        if (s != null) s.invalidate();
        resp.sendRedirect(req.getContextPath() + "/");
    }
}

package com.exemplo.auth.filter;

import com.exemplo.auth.model.User;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.*;
import java.io.IOException;

@WebFilter("/restrito/*") // protege tudo sob /restrito/*
public class AuthFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;

        HttpSession session = req.getSession(false);
        User user = (session == null) ? null : (User) session.getAttribute("user");

        if (user == null) {
            resp.sendRedirect(req.getContextPath() + "/login");
            return;
        }
        chain.doFilter(request, response);
    }
}

@WebFilter("/restrito.jsp")

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
         http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">

  <display-name>mini-auth</display-name>

  <!-- Força UTF-8 -->
  <filter>
    <filter-name>EncodingFilter</filter-name>
    <filter-class>org.apache.catalina.filters.SetCharacterEncodingFilter</filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
      <param-name>ignore</param-name>
      <param-value>false</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>EncodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- Página inicial -->
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>
</web-app>

<%@ page contentType="text/html; charset=UTF-8" %>
<html>
<head><title>Mini Auth</title></head>
<body>
<h2>Bem-vindo ao Mini-Auth</h2>
<p><a href="home.jsp">Home (pública)</a></p>
<p><a href="restrito.jsp">Área restrita</a></p>
<p><a href="login">Login</a></p>
<form action="logout" method="post" style="margin-top:12px;">
  <button type="submit">Logout</button>
</form>
</body>
</html>

<%@ page contentType="text/html; charset=UTF-8" %>
<html>
<head><title>Home</title></head>
<body>
<h2>Página pública</h2>
<p>Qualquer pessoa pode acessar.</p>
<p><a href="index.jsp">Voltar</a></p>
</body>
</html>

<%@ page contentType="text/html; charset=UTF-8" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<head><title>Login</title></head>
<body>
<h2>Login</h2>
<c:if test="${not empty erro}">
  <p style="color:red">${erro}</p>
</c:if>
<form method="post" action="login">
  <label>Usuário: <input type="text" name="username" required /></label><br/>
  <label>Senha: <input type="password" name="password" required /></label><br/>
  <button type="submit">Entrar</button>
</form>
<p>Teste com: <b>alice</b> / <b>123456</b></p>
<p><a href="index.jsp">Voltar</a></p>
</body>
</html>

<%@ page contentType="text/html; charset=UTF-8" %>
<%@ page import="com.exemplo.auth.model.User" %>
<%
  User user = (User) session.getAttribute("user");
  if (user == null) {
    response.sendRedirect(request.getContextPath() + "/login");
    return;
  }
%>
<html>
<head><title>Área Restrita</title></head>
<body>
<h2>Área restrita</h2>
<p>Olá, <b><%= user.getName() %></b> (@<%= user.getUsername() %>)!</p>
<form action="logout" method="post">
  <button type="submit">Sair</button>
</form>
<p><a href="index.jsp">Início</a></p>
</body>
</html>