🔐 Zero-Trust API Gateway

A production-grade API Gateway built with Spring Boot 3.x that implements Zero-Trust security architecture. Every incoming request is verified at multiple levels before reaching backend services.

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                        INCOMING REQUEST                             │
└──────────────────────────────┬──────────────────────────────────────┘
                               │
                               ▼
┌──────────────────────────────────────────────────────────────────────┐
│                    ZERO-TRUST FILTER CHAIN                           │
│                                                                      │
│  ┌──────────┐   ┌──────────────┐   ┌──────────────┐   ┌──────────┐ │
│  │ IP Filter│──▶│JWT Auth Filter│──▶│RateLimit Flt.│──▶│Role Auth │ │
│  │ (Order 1)│   │  (Order 2)   │   │  (Order 3)   │   │(Order 4) │ │
│  └──────────┘   └──────────────┘   └──────────────┘   └──────────┘ │
│   Redis:Block    JWT Validate       Redis:Counter     Role Check    │
│   PostgreSQL:    + Blacklist        + INCR/EXPIRE     ADMIN/PRO/    │
│   Whitelist      Check              Per-User          FREE          │
└──────────────────────────────┬───────────────────────────────────────┘
                               │
                               ▼
┌──────────────────────────────────────────────────────────────────────┐
│                       PROXY / ROUTING LAYER                          │
│                                                                      │
│  /api/users/*    ──▶  User Service    (port 8081)                   │
│  /api/orders/*   ──▶  Order Service   (port 8082)                   │
│  /api/payments/* ──▶  Payment Service (port 8083)                   │
│                                                                      │
│  Headers Added: X-User-ID, X-User-Role, X-Request-ID, X-Forwarded  │
└──────────────────────────────────────────────────────────────────────┘

---

🛠️ Tech Stack

Layer	Technology
Backend	Spring Boot 3.4, Spring Security, WebFlux
Cache	Redis 7 (rate limiting, token blacklist)
Database	PostgreSQL 16 (audit logs, IP rules)
Frontend	React 18, Tailwind CSS, Recharts
Auth	JWT (jjwt) — Access 15m + Refresh 7d
DevOps	Docker, Docker Compose

---

📁 Project Structure

zero-trust-gateway/
├── gateway-service/          # Spring Boot API Gateway
│   └── src/main/java/com/gateway/
│       ├── config/           # SecurityConfig, RedisConfig, RoutingConfig
│       ├── filter/           # IpFilter, JwtAuthFilter, RateLimitFilter, RoleAuthFilter
│       ├── service/          # TokenService, RateLimitService, IpService, AuditLogService
│       ├── controller/       # AuthController, AdminController, ProxyController
│       ├── model/            # User, AuditLog, IpRule
│       └── repository/       # JPA Repositories
├── dummy-backend/            # Simulated microservices
├── admin-dashboard/          # React Admin Dashboard
│   └── src/
│       ├── pages/            # Dashboard, IpManager, TokenMonitor, RateLimitConfig
│       └── components/       # Sidebar, RequestChart, LiveRequestFeed
├── docker-compose.yml
└── init-db.sql

---

🚀 Quick Start

Prerequisites

• Docker & Docker Compose
• Java 17+ (for local development)
• Node.js 18+ (for frontend development)

Run with Docker (recommended)

# Clone & start all services
docker-compose up --build

# Services will be available at:
# Gateway:    http://localhost:8080
# Dashboard:  http://localhost:3000
# PostgreSQL: localhost:5432
# Redis:      localhost:6379

Run Locally (development)

# 1. Start Redis & PostgreSQL
docker-compose up redis postgres -d

# 2. Start the dummy backend
cd dummy-backend
./mvnw spring-boot:run

# 3. Start the gateway
cd gateway-service
./mvnw spring-boot:run

# 4. Start the React dashboard
cd admin-dashboard
npm install && npm run dev

---

🔑 Authentication

Default Credentials

Username	Password	Role
Akhil	Akhil9664	ADMIN
testuser	user12345	FREE

Login

curl -X POST http://localhost:8080/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"Akhil","password":"Akhil9664"}'

Token Refresh

curl -X POST http://localhost:8080/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":"<your-refresh-token>"}'

Logout

curl -X POST http://localhost:8080/auth/logout \
  -H "Authorization: Bearer <your-access-token>"

---

📡 API Endpoints

Auth (Public)

Method	Endpoint	Description
POST	/auth/register	Register new user
POST	/auth/login	Login → tokens
POST	/auth/refresh	Rotate tokens
POST	/auth/logout	Blacklist current token

Admin (ADMIN role only)

Method	Endpoint	Description
GET	/admin/stats	Dashboard metrics
GET	/admin/live-feed	Last 50 requests
GET	/admin/logs	Paginated audit logs
GET	/admin/ip-rules	List IP rules
POST	/admin/ip-rules/block	Block an IP
POST	/admin/ip-rules/unblock	Unblock an IP
POST	/admin/ip-rules/whitelist	Whitelist an IP
POST	/admin/tokens/revoke	Revoke a token
GET	/admin/rate-limits	View rate limits
PUT	/admin/rate-limits	Update rate limits

Proxy (Authenticated)

Pattern	Target
/api/users/**	User Service :8081
/api/orders/**	Order Service :8082
/api/payments/**	Payment Service :8083

---

🗄️ Redis Key Patterns

Key Pattern	Type	TTL	Purpose
rate_limit:{userId}:{yyyyMMddHHmm}	Integer	60s	Request counter per minute
blacklist:token:{tokenHash}	String	Token's remaining TTL	Revoked token flag
ip:blocked:{ipAddress}	String	60min	Blocked IP with reason
ip:failed_attempts:{ipAddress}	Integer	60min	Failed auth attempt counter
refresh_token:{userId}	String	7 days	Latest refresh token hash

---

🛡️ Security Features

• IP Filtering — Redis blocklist + PostgreSQL whitelist, auto-block after 10 failed auth attempts
• JWT Validation — Signature + expiry + blacklist check on every request
• Rate Limiting — Tiered limits (FREE=100, PRO=1000, ADMIN=unlimited), 429 with Retry-After
• Role Authorization — Admin endpoints locked to ADMIN role
• Token Rotation — One-time-use refresh tokens with reuse detection (theft protection)
• Audit Logging — Async logging of every request to PostgreSQL
• CORS — Configured for dashboard origin only

---

📊 Admin Dashboard Pages

1. Live Dashboard — Requests/min chart, error rate, top endpoints, active users, live feed
2. IP Manager — Block/unblock/whitelist IPs, auto-blocked IPs section, search
3. Token Monitor — Active sessions, revoke tokens, audit log viewer
4. Rate Limit Config — View and edit tier limits in real-time

---

📄 License

This project is for educational and demonstration purposes.