Blog CMS with User Roles in Java: Complete Implementation

A comprehensive Blog Content Management System with role-based access control, built with Spring Boot and modern Java technologies.

System Architecture

Spring Boot 3.x - Application framework
Spring Security - Authentication and authorization
Spring Data JPA - Data persistence
H2/MySQL - Database
Thymeleaf - Template engine
Bootstrap 5 - Frontend framework

Dependencies

<dependencies>
<!-- Spring Boot Starters -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>
<!-- Thymeleaf Security -->
<dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-springsecurity6</artifactId>
</dependency>
<!-- Database -->
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.mariadb.jdbc</groupId>
<artifactId>mariadb-java-client</artifactId>
<scope>runtime</scope>
</dependency>
<!-- Development Tools -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<scope>runtime</scope>
</dependency>
</dependencies>

Domain Models

Example 1: User and Role Entities

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class User {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(unique = true, nullable = false)
private String username;
@Column(unique = true, nullable = false)
private String email;
@Column(nullable = false)
private String password;
private String firstName;
private String lastName;
@Builder.Default
private boolean enabled = true;
@Builder.Default
private boolean accountNonExpired = true;
@Builder.Default
private boolean accountNonLocked = true;
@Builder.Default
private boolean credentialsNonExpired = true;
@CreationTimestamp
private LocalDateTime createdAt;
@UpdateTimestamp
private LocalDateTime updatedAt;
@ManyToMany(fetch = FetchType.EAGER)
@JoinTable(
name = "user_roles",
joinColumns = @JoinColumn(name = "user_id"),
inverseJoinColumns = @JoinColumn(name = "role_id")
)
@Builder.Default
private Set<Role> roles = new HashSet<>();
@OneToMany(mappedBy = "author", cascade = CascadeType.ALL)
@Builder.Default
private List<Post> posts = new ArrayList<>();
@OneToMany(mappedBy = "author", cascade = CascadeType.ALL)
@Builder.Default
private List<Comment> comments = new ArrayList<>();
public String getFullName() {
return firstName + " " + lastName;
}
public boolean hasRole(String roleName) {
return roles.stream().anyMatch(role -> role.getName().equals(roleName));
}
}
@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class Role {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(unique = true, nullable = false)
private String name;
private String description;
@ManyToMany(mappedBy = "roles")
@JsonIgnore
@Builder.Default
private Set<User> users = new HashSet<>();
@ElementCollection(fetch = FetchType.EAGER)
@CollectionTable(name = "role_privileges", joinColumns = @JoinColumn(name = "role_id"))
@Column(name = "privilege")
@Builder.Default
private Set<String> privileges = new HashSet<>();
public boolean hasPrivilege(String privilege) {
return privileges.contains(privilege);
}
}
@Entity
@Table(name = "posts")
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class Post {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(nullable = false)
private String title;
@Column(unique = true, nullable = false)
private String slug;
@Column(columnDefinition = "TEXT")
private String excerpt;
@Column(columnDefinition = "LONGTEXT")
private String content;
@Enumerated(EnumType.STRING)
@Builder.Default
private PostStatus status = PostStatus.DRAFT;
@Builder.Default
private boolean commentable = true;
@CreationTimestamp
private LocalDateTime createdAt;
@UpdateTimestamp
private LocalDateTime updatedAt;
private LocalDateTime publishedAt;
@ManyToOne(fetch = FetchType.LAZY)
@JoinColumn(name = "author_id")
private User author;
@ManyToMany
@JoinTable(
name = "post_categories",
joinColumns = @JoinColumn(name = "post_id"),
inverseJoinColumns = @JoinColumn(name = "category_id")
)
@Builder.Default
private Set<Category> categories = new HashSet<>();
@ManyToMany
@JoinTable(
name = "post_tags",
joinColumns = @JoinColumn(name = "post_id"),
inverseJoinColumns = @JoinColumn(name = "tag_id")
)
@Builder.Default
private Set<Tag> tags = new HashSet<>();
@OneToMany(mappedBy = "post", cascade = CascadeType.ALL)
@Builder.Default
private List<Comment> comments = new ArrayList<>();
public boolean isPublished() {
return status == PostStatus.PUBLISHED && publishedAt != null;
}
public String getReadingTime() {
if (content == null) return "0 min";
int words = content.split("\\s+").length;
int minutes = (int) Math.ceil(words / 200.0);
return minutes + " min read";
}
}
@Entity
@Table(name = "categories")
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class Category {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(unique = true, nullable = false)
private String name;
private String description;
@Column(unique = true)
private String slug;
@ManyToMany(mappedBy = "categories")
@JsonIgnore
@Builder.Default
private Set<Post> posts = new HashSet<>();
}
@Entity
@Table(name = "comments")
@Data
@NoArgsConstructor
@AllArgsConstructor
@Builder
public class Comment {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long id;
@Column(columnDefinition = "TEXT", nullable = false)
private String content;
@Enumerated(EnumType.STRING)
@Builder.Default
private CommentStatus status = CommentStatus.PENDING;
@CreationTimestamp
private LocalDateTime createdAt;
@ManyToOne(fetch = FetchType.LAZY)
@JoinColumn(name = "author_id")
private User author;
@ManyToOne(fetch = FetchType.LAZY)
@JoinColumn(name = "post_id")
private Post post;
@ManyToOne(fetch = FetchType.LAZY)
@JoinColumn(name = "parent_id")
private Comment parent;
@OneToMany(mappedBy = "parent", cascade = CascadeType.ALL)
@Builder.Default
private List<Comment> replies = new ArrayList<>();
public boolean isApproved() {
return status == CommentStatus.APPROVED;
}
}
public enum PostStatus {
DRAFT, PUBLISHED, ARCHIVED, PENDING_REVIEW
}
public enum CommentStatus {
PENDING, APPROVED, REJECTED, SPAM
}

Security Configuration

Example 2: Security Configuration with Role-Based Access

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
private final UserDetailsService userDetailsService;
private final PasswordEncoder passwordEncoder;
public SecurityConfig(UserDetailsService userDetailsService, 
PasswordEncoder passwordEncoder) {
this.userDetailsService = userDetailsService;
this.passwordEncoder = passwordEncoder;
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authz -> authz
// Public endpoints
.requestMatchers("/", "/posts/**", "/categories/**", 
"/auth/register", "/auth/login", "/css/**", 
"/js/**", "/images/**", "/webjars/**").permitAll()
// Admin endpoints
.requestMatchers("/admin/**").hasRole("ADMIN")
// Editor endpoints
.requestMatchers("/editor/**").hasAnyRole("EDITOR", "ADMIN")
// Author endpoints
.requestMatchers("/author/**").hasAnyRole("AUTHOR", "EDITOR", "ADMIN")
// User management
.requestMatchers("/profile/**", "/dashboard").authenticated()
.anyRequest().authenticated()
)
.formLogin(form -> form
.loginPage("/auth/login")
.loginProcessingUrl("/auth/login")
.defaultSuccessUrl("/dashboard")
.failureUrl("/auth/login?error=true")
.permitAll()
)
.logout(logout -> logout
.logoutUrl("/auth/logout")
.logoutSuccessUrl("/")
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID")
.permitAll()
)
.rememberMe(rememberMe -> rememberMe
.key("uniqueAndSecret")
.tokenValiditySeconds(86400) // 24 hours
.userDetailsService(userDetailsService)
)
.exceptionHandling(exception -> exception
.accessDeniedPage("/access-denied")
)
.sessionManagement(session -> session
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.maximumSessions(1)
.maxSessionsPreventsLogin(false)
);
return http.build();
}
@Bean
public UserDetailsService userDetailsService(UserRepository userRepository) {
return username -> userRepository.findByUsername(username)
.map(CustomUserDetails::new)
.orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration config) 
throws Exception {
return config.getAuthenticationManager();
}
}
@Data
@AllArgsConstructor
public class CustomUserDetails implements UserDetails {
private final User user;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return user.getRoles().stream()
.map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
.collect(Collectors.toList());
}
@Override
public String getPassword() {
return user.getPassword();
}
@Override
public String getUsername() {
return user.getUsername();
}
@Override
public boolean isAccountNonExpired() {
return user.isAccountNonExpired();
}
@Override
public boolean isAccountNonLocked() {
return user.isAccountNonLocked();
}
@Override
public boolean isCredentialsNonExpired() {
return user.isCredentialsNonExpired();
}
@Override
public boolean isEnabled() {
return user.isEnabled();
}
public User getUser() {
return user;
}
}

Service Layer

Example 3: Business Logic Services

@Service
@Transactional
public class UserService {
private final UserRepository userRepository;
private final RoleRepository roleRepository;
private final PasswordEncoder passwordEncoder;
public UserService(UserRepository userRepository, RoleRepository roleRepository,
PasswordEncoder passwordEncoder) {
this.userRepository = userRepository;
this.roleRepository = roleRepository;
this.passwordEncoder = passwordEncoder;
}
public User registerUser(UserRegistrationDto registrationDto) {
if (userRepository.existsByUsername(registrationDto.getUsername())) {
throw new UsernameExistsException("Username already exists: " + registrationDto.getUsername());
}
if (userRepository.existsByEmail(registrationDto.getEmail())) {
throw new EmailExistsException("Email already exists: " + registrationDto.getEmail());
}
User user = User.builder()
.username(registrationDto.getUsername())
.email(registrationDto.getEmail())
.password(passwordEncoder.encode(registrationDto.getPassword()))
.firstName(registrationDto.getFirstName())
.lastName(registrationDto.getLastName())
.build();
// Assign default role
Role userRole = roleRepository.findByName("USER")
.orElseThrow(() -> new RoleNotFoundException("Default USER role not found"));
user.getRoles().add(userRole);
return userRepository.save(user);
}
public User updateUserProfile(Long userId, UserProfileDto profileDto) {
User user = userRepository.findById(userId)
.orElseThrow(() -> new UserNotFoundException("User not found: " + userId));
user.setFirstName(profileDto.getFirstName());
user.setLastName(profileDto.getLastName());
user.setEmail(profileDto.getEmail());
return userRepository.save(user);
}
public void changeUserPassword(Long userId, PasswordChangeDto passwordChangeDto) {
User user = userRepository.findById(userId)
.orElseThrow(() -> new UserNotFoundException("User not found: " + userId));
if (!passwordEncoder.matches(passwordChangeDto.getCurrentPassword(), user.getPassword())) {
throw new InvalidPasswordException("Current password is incorrect");
}
user.setPassword(passwordEncoder.encode(passwordChangeDto.getNewPassword()));
userRepository.save(user);
}
public User assignRoleToUser(Long userId, String roleName) {
User user = userRepository.findById(userId)
.orElseThrow(() -> new UserNotFoundException("User not found: " + userId));
Role role = roleRepository.findByName(roleName)
.orElseThrow(() -> new RoleNotFoundException("Role not found: " + roleName));
user.getRoles().add(role);
return userRepository.save(user);
}
public User removeRoleFromUser(Long userId, String roleName) {
User user = userRepository.findById(userId)
.orElseThrow(() -> new UserNotFoundException("User not found: " + userId));
user.getRoles().removeIf(role -> role.getName().equals(roleName));
return userRepository.save(user);
}
public Page<User> getAllUsers(Pageable pageable) {
return userRepository.findAll(pageable);
}
public List<User> getUsersByRole(String roleName) {
return userRepository.findByRoles_Name(roleName);
}
}
@Service
@Transactional
public class PostService {
private final PostRepository postRepository;
private final UserRepository userRepository;
private final CategoryRepository categoryRepository;
private final TagRepository tagRepository;
public PostService(PostRepository postRepository, UserRepository userRepository,
CategoryRepository categoryRepository, TagRepository tagRepository) {
this.postRepository = postRepository;
this.userRepository = userRepository;
this.categoryRepository = categoryRepository;
this.tagRepository = tagRepository;
}
public Post createPost(PostCreateDto postDto, String username) {
User author = userRepository.findByUsername(username)
.orElseThrow(() -> new UserNotFoundException("User not found: " + username));
Post post = Post.builder()
.title(postDto.getTitle())
.slug(generateSlug(postDto.getTitle()))
.excerpt(postDto.getExcerpt())
.content(postDto.getContent())
.status(postDto.getStatus())
.commentable(postDto.isCommentable())
.author(author)
.build();
// Set categories
if (postDto.getCategoryIds() != null) {
Set<Category> categories = categoryRepository.findAllById(postDto.getCategoryIds())
.stream().collect(Collectors.toSet());
post.setCategories(categories);
}
// Set tags
if (postDto.getTagNames() != null) {
Set<Tag> tags = processTags(postDto.getTagNames());
post.setTags(tags);
}
// Set published date if publishing
if (postDto.getStatus() == PostStatus.PUBLISHED) {
post.setPublishedAt(LocalDateTime.now());
}
return postRepository.save(post);
}
public Post updatePost(Long postId, PostUpdateDto postDto, String username) {
Post post = postRepository.findById(postId)
.orElseThrow(() -> new PostNotFoundException("Post not found: " + postId));
// Check authorization
if (!post.getAuthor().getUsername().equals(username) && 
!hasEditorPrivileges(username)) {
throw new AccessDeniedException("You are not authorized to edit this post");
}
post.setTitle(postDto.getTitle());
post.setExcerpt(postDto.getExcerpt());
post.setContent(postDto.getContent());
post.setStatus(postDto.getStatus());
post.setCommentable(postDto.isCommentable());
// Update categories
if (postDto.getCategoryIds() != null) {
Set<Category> categories = categoryRepository.findAllById(postDto.getCategoryIds())
.stream().collect(Collectors.toSet());
post.setCategories(categories);
}
// Update tags
if (postDto.getTagNames() != null) {
Set<Tag> tags = processTags(postDto.getTagNames());
post.setTags(tags);
}
// Update published date if status changed to PUBLISHED
if (post.getStatus() == PostStatus.PUBLISHED && post.getPublishedAt() == null) {
post.setPublishedAt(LocalDateTime.now());
}
return postRepository.save(post);
}
public Page<Post> getPublishedPosts(Pageable pageable) {
return postRepository.findByStatusOrderByPublishedAtDesc(PostStatus.PUBLISHED, pageable);
}
public Page<Post> getPostsByAuthor(String username, Pageable pageable) {
return postRepository.findByAuthor_UsernameOrderByCreatedAtDesc(username, pageable);
}
public Page<Post> getPostsByStatus(PostStatus status, Pageable pageable) {
return postRepository.findByStatusOrderByCreatedAtDesc(status, pageable);
}
public List<Post> getRecentPosts(int count) {
return postRepository.findTop5ByStatusOrderByPublishedAtDesc(PostStatus.PUBLISHED, 
PageRequest.of(0, count));
}
public void deletePost(Long postId, String username) {
Post post = postRepository.findById(postId)
.orElseThrow(() -> new PostNotFoundException("Post not found: " + postId));
// Check authorization
if (!post.getAuthor().getUsername().equals(username) && 
!hasEditorPrivileges(username)) {
throw new AccessDeniedException("You are not authorized to delete this post");
}
postRepository.delete(post);
}
private String generateSlug(String title) {
String slug = title.toLowerCase()
.replaceAll("[^a-z0-9\\s-]", "")
.replaceAll("\\s+", "-")
.replaceAll("-+", "-")
.trim();
// Ensure uniqueness
String baseSlug = slug;
int counter = 1;
while (postRepository.existsBySlug(slug)) {
slug = baseSlug + "-" + counter++;
}
return slug;
}
private Set<Tag> processTags(List<String> tagNames) {
return tagNames.stream()
.map(String::trim)
.map(String::toLowerCase)
.distinct()
.map(tagName -> tagRepository.findByName(tagName)
.orElseGet(() -> tagRepository.save(Tag.builder().name(tagName).build())))
.collect(Collectors.toSet());
}
private boolean hasEditorPrivileges(String username) {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UserNotFoundException("User not found: " + username));
return user.hasRole("EDITOR") || user.hasRole("ADMIN");
}
}

Controller Layer

Example 4: REST Controllers

@RestController
@RequestMapping("/api/posts")
public class PostApiController {
private final PostService postService;
public PostApiController(PostService postService) {
this.postService = postService;
}
@GetMapping
public ResponseEntity<Page<PostDto>> getPublishedPosts(
@RequestParam(defaultValue = "0") int page,
@RequestParam(defaultValue = "10") int size) {
Pageable pageable = PageRequest.of(page, size, Sort.by("publishedAt").descending());
Page<Post> posts = postService.getPublishedPosts(pageable);
Page<PostDto> postDtos = posts.map(this::convertToDto);
return ResponseEntity.ok(postDtos);
}
@GetMapping("/{slug}")
public ResponseEntity<PostDto> getPostBySlug(@PathVariable String slug) {
Post post = postService.getPostBySlug(slug);
return ResponseEntity.ok(convertToDto(post));
}
@PostMapping
@PreAuthorize("hasRole('AUTHOR') or hasRole('EDITOR') or hasRole('ADMIN')")
public ResponseEntity<PostDto> createPost(@RequestBody @Valid PostCreateDto postDto,
Authentication authentication) {
Post post = postService.createPost(postDto, authentication.getName());
return ResponseEntity.status(HttpStatus.CREATED).body(convertToDto(post));
}
@PutMapping("/{id}")
@PreAuthorize("hasRole('AUTHOR') or hasRole('EDITOR') or hasRole('ADMIN')")
public ResponseEntity<PostDto> updatePost(@PathVariable Long id,
@RequestBody @Valid PostUpdateDto postDto,
Authentication authentication) {
Post post = postService.updatePost(id, postDto, authentication.getName());
return ResponseEntity.ok(convertToDto(post));
}
@DeleteMapping("/{id}")
@PreAuthorize("hasRole('AUTHOR') or hasRole('EDITOR') or hasRole('ADMIN')")
public ResponseEntity<Void> deletePost(@PathVariable Long id,
Authentication authentication) {
postService.deletePost(id, authentication.getName());
return ResponseEntity.noContent().build();
}
private PostDto convertToDto(Post post) {
return PostDto.builder()
.id(post.getId())
.title(post.getTitle())
.slug(post.getSlug())
.excerpt(post.getExcerpt())
.content(post.getContent())
.status(post.getStatus())
.commentable(post.isCommentable())
.createdAt(post.getCreatedAt())
.updatedAt(post.getUpdatedAt())
.publishedAt(post.getPublishedAt())
.authorName(post.getAuthor().getFullName())
.categories(post.getCategories().stream()
.map(Category::getName)
.collect(Collectors.toSet()))
.tags(post.getTags().stream()
.map(Tag::getName)
.collect(Collectors.toSet()))
.readingTime(post.getReadingTime())
.build();
}
}
@Controller
@RequestMapping("/admin")
@PreAuthorize("hasRole('ADMIN')")
public class AdminController {
private final UserService userService;
private final PostService postService;
private final CategoryService categoryService;
public AdminController(UserService userService, PostService postService,
CategoryService categoryService) {
this.userService = userService;
this.postService = postService;
this.categoryService = categoryService;
}
@GetMapping("/dashboard")
public String adminDashboard(Model model) {
// Add statistics to model
model.addAttribute("totalUsers", userService.getUserCount());
model.addAttribute("totalPosts", postService.getPostCount());
model.addAttribute("publishedPosts", postService.getPublishedPostCount());
model.addAttribute("pendingPosts", postService.getPendingPostCount());
return "admin/dashboard";
}
@GetMapping("/users")
public String userManagement(@RequestParam(defaultValue = "0") int page, Model model) {
Pageable pageable = PageRequest.of(page, 10, Sort.by("createdAt").descending());
Page<User> users = userService.getAllUsers(pageable);
model.addAttribute("users", users);
model.addAttribute("currentPage", page);
return "admin/users";
}
@PostMapping("/users/{userId}/roles")
public String assignRoleToUser(@PathVariable Long userId,
@RequestParam String roleName,
RedirectAttributes redirectAttributes) {
try {
userService.assignRoleToUser(userId, roleName);
redirectAttributes.addFlashAttribute("success", 
"Role " + roleName + " assigned successfully");
} catch (Exception e) {
redirectAttributes.addFlashAttribute("error", 
"Failed to assign role: " + e.getMessage());
}
return "redirect:/admin/users";
}
@GetMapping("/posts")
public String postManagement(@RequestParam(defaultValue = "0") int page,
@RequestParam(required = false) PostStatus status,
Model model) {
Pageable pageable = PageRequest.of(page, 10, Sort.by("createdAt").descending());
Page<Post> posts;
if (status != null) {
posts = postService.getPostsByStatus(status, pageable);
} else {
posts = postService.getAllPosts(pageable);
}
model.addAttribute("posts", posts);
model.addAttribute("status", status);
model.addAttribute("currentPage", page);
return "admin/posts";
}
}
@Controller
@RequestMapping("/author")
@PreAuthorize("hasRole('AUTHOR')")
public class AuthorController {
private final PostService postService;
private final CategoryService categoryService;
public AuthorController(PostService postService, CategoryService categoryService) {
this.postService = postService;
this.categoryService = categoryService;
}
@GetMapping("/posts")
public String myPosts(@RequestParam(defaultValue = "0") int page,
Authentication authentication,
Model model) {
Pageable pageable = PageRequest.of(page, 10, Sort.by("createdAt").descending());
Page<Post> posts = postService.getPostsByAuthor(authentication.getName(), pageable);
model.addAttribute("posts", posts);
model.addAttribute("currentPage", page);
return "author/posts";
}
@GetMapping("/posts/new")
public String createPostForm(Model model) {
model.addAttribute("post", new PostCreateDto());
model.addAttribute("categories", categoryService.getAllCategories());
model.addAttribute("statuses", PostStatus.values());
return "author/post-form";
}
@PostMapping("/posts")
public String createPost(@ModelAttribute @Valid PostCreateDto postDto,
BindingResult result,
Authentication authentication,
Model model) {
if (result.hasErrors()) {
model.addAttribute("categories", categoryService.getAllCategories());
model.addAttribute("statuses", PostStatus.values());
return "author/post-form";
}
try {
postService.createPost(postDto, authentication.getName());
return "redirect:/author/posts?success=true";
} catch (Exception e) {
model.addAttribute("error", "Failed to create post: " + e.getMessage());
model.addAttribute("categories", categoryService.getAllCategories());
model.addAttribute("statuses", PostStatus.values());
return "author/post-form";
}
}
}

Data Transfer Objects (DTOs)

Example 5: DTO Classes

@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class UserRegistrationDto {
@NotBlank(message = "Username is required")
@Size(min = 3, max = 50, message = "Username must be between 3 and 50 characters")
private String username;
@NotBlank(message = "Email is required")
@Email(message = "Email should be valid")
private String email;
@NotBlank(message = "Password is required")
@Size(min = 6, message = "Password must be at least 6 characters")
private String password;
@NotBlank(message = "Confirm password is required")
private String confirmPassword;
@NotBlank(message = "First name is required")
private String firstName;
@NotBlank(message = "Last name is required")
private String lastName;
}
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class PostCreateDto {
@NotBlank(message = "Title is required")
@Size(max = 255, message = "Title must not exceed 255 characters")
private String title;
@NotBlank(message = "Content is required")
private String content;
@Size(max = 500, message = "Excerpt must not exceed 500 characters")
private String excerpt;
@NotNull(message = "Status is required")
private PostStatus status;
private boolean commentable = true;
private Set<Long> categoryIds;
private List<String> tagNames;
}
@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class PostDto {
private Long id;
private String title;
private String slug;
private String excerpt;
private String content;
private PostStatus status;
private boolean commentable;
private LocalDateTime createdAt;
private LocalDateTime updatedAt;
private LocalDateTime publishedAt;
private String authorName;
private Set<String> categories;
private Set<String> tags;
private String readingTime;
private int commentCount;
}

Repository Layer

Example 6: Data Repositories

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
Optional<User> findByUsername(String username);
Optional<User> findByEmail(String email);
boolean existsByUsername(String username);
boolean existsByEmail(String email);
List<User> findByRoles_Name(String roleName);
@Query("SELECT COUNT(u) FROM User u")
long countAllUsers();
}
@Repository
public interface PostRepository extends JpaRepository<Post, Long> {
Optional<Post> findBySlug(String slug);
boolean existsBySlug(String slug);
Page<Post> findByStatusOrderByPublishedAtDesc(PostStatus status, Pageable pageable);
Page<Post> findByAuthor_UsernameOrderByCreatedAtDesc(String username, Pageable pageable);
Page<Post> findByStatusOrderByCreatedAtDesc(PostStatus status, Pageable pageable);
List<Post> findTop5ByStatusOrderByPublishedAtDesc(PostStatus status, Pageable pageable);
@Query("SELECT COUNT(p) FROM Post p")
long countAllPosts();
@Query("SELECT COUNT(p) FROM Post p WHERE p.status = :status")
long countByStatus(@Param("status") PostStatus status);
@Query("SELECT p FROM Post p WHERE " +
"(:status IS NULL OR p.status = :status) AND " +
"(:categoryId IS NULL OR :categoryId IN (SELECT c.id FROM p.categories c)) AND " +
"(:tagName IS NULL OR :tagName IN (SELECT t.name FROM p.tags t))")
Page<Post> findByFilters(@Param("status") PostStatus status,
@Param("categoryId") Long categoryId,
@Param("tagName") String tagName,
Pageable pageable);
}
@Repository
public interface CategoryRepository extends JpaRepository<Category, Long> {
Optional<Category> findByName(String name);
Optional<Category> findBySlug(String slug);
List<Category> findByPostsIsNotEmpty();
}
@Repository
public interface RoleRepository extends JpaRepository<Role, Long> {
Optional<Role> findByName(String name);
boolean existsByName(String name);
}

Database Initialization

Example 7: Data Initializer

@Component
public class DataInitializer {
private final RoleRepository roleRepository;
private final UserRepository userRepository;
private final PasswordEncoder passwordEncoder;
public DataInitializer(RoleRepository roleRepository, UserRepository userRepository,
PasswordEncoder passwordEncoder) {
this.roleRepository = roleRepository;
this.userRepository = userRepository;
this.passwordEncoder = passwordEncoder;
}
@EventListener
public void onApplicationEvent(ContextRefreshedEvent event) {
initializeRoles();
initializeAdminUser();
}
private void initializeRoles() {
if (roleRepository.count() == 0) {
// Create default roles
Role adminRole = Role.builder()
.name("ADMIN")
.description("Administrator with full access")
.privileges(Set.of(
"USER_MANAGEMENT", "POST_MANAGEMENT", "CATEGORY_MANAGEMENT", 
"COMMENT_MODERATION", "SYSTEM_SETTINGS"
))
.build();
Role editorRole = Role.builder()
.name("EDITOR")
.description("Editor with content management privileges")
.privileges(Set.of(
"POST_MANAGEMENT", "CATEGORY_MANAGEMENT", "COMMENT_MODERATION"
))
.build();
Role authorRole = Role.builder()
.name("AUTHOR")
.description("Author who can create and manage their own posts")
.privileges(Set.of("POST_CREATE", "POST_EDIT_OWN", "POST_DELETE_OWN"))
.build();
Role userRole = Role.builder()
.name("USER")
.description("Regular user with basic privileges")
.privileges(Set.of("COMMENT_CREATE", "PROFILE_MANAGEMENT"))
.build();
roleRepository.saveAll(List.of(adminRole, editorRole, authorRole, userRole));
}
}
private void initializeAdminUser() {
if (userRepository.count() == 0) {
Role adminRole = roleRepository.findByName("ADMIN")
.orElseThrow(() new RuntimeException("Admin role not found"));
User admin = User.builder()
.username("admin")
.email("[email protected]")
.password(passwordEncoder.encode("admin123"))
.firstName("System")
.lastName("Administrator")
.roles(Set.of(adminRole))
.build();
userRepository.save(admin);
}
}
}

Application Configuration

Example 8: Application Properties

# application.yml
spring:
datasource:
url: jdbc:h2:mem:blogcms
driver-class-name: org.h2.Driver
username: sa
password: 
jpa:
hibernate:
ddl-auto: create-drop
properties:
hibernate:
dialect: org.hibernate.dialect.H2Dialect
format_sql: true
show-sql: true
h2:
console:
enabled: true
path: /h2-console
thymeleaf:
cache: false
prefix: classpath:/templates/
suffix: .html
web:
resources:
static-locations: classpath:/static/
server:
port: 8080
# Custom application properties
app:
blog:
name: "My Blog CMS"
description: "A modern blog content management system"
posts-per-page: 10
allow-registration: true
require-email-verification: false
# Logging
logging:
level:
com.example.blog: DEBUG
org.springframework.security: DEBUG

Frontend Templates (Thymeleaf)

Example 9: Base Template

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org"
xmlns:sec="http://www.thymeleaf.org/extras/spring-security">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title th:text="${blogName} + ' - ' + #{page.title}">My Blog CMS</title>
<!-- Bootstrap CSS -->
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
<!-- Font Awesome -->
<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css" rel="stylesheet">
<style>
.navbar-brand { font-weight: bold; }
.post-card { transition: transform 0.2s; }
.post-card:hover { transform: translateY(-2px); }
.user-avatar { width: 32px; height: 32px; border-radius: 50%; }
</style>
</head>
<body>
<!-- Navigation -->
<nav class="navbar navbar-expand-lg navbar-dark bg-dark">
<div class="container">
<a class="navbar-brand" th:href="@{/}">
<i class="fas fa-blog"></i> [[${blogName}]]
</a>
<div class="navbar-nav ms-auto">
<a class="nav-link" th:href="@{/}">Home</a>
<a class="nav-link" th:href="@{/posts}">Posts</a>
<a class="nav-link" th:href="@{/categories}">Categories</a>
<!-- Authenticated User Menu -->
<div sec:authorize="isAuthenticated()" class="nav-item dropdown">
<a class="nav-link dropdown-toggle" href="#" role="button" 
data-bs-toggle="dropdown">
<i class="fas fa-user"></i>
<span sec:authentication="name"></span>
</a>
<ul class="dropdown-menu">
<li sec:authorize="hasRole('AUTHOR')">
<a class="dropdown-item" th:href="@{/author/posts}">
<i class="fas fa-edit"></i> My Posts
</a>
</li>
<li sec:authorize="hasRole('EDITOR')">
<a class="dropdown-item" th:href="@{/editor/dashboard}">
<i class="fas fa-tasks"></i> Editor Dashboard
</a>
</li>
<li sec:authorize="hasRole('ADMIN')">
<a class="dropdown-item" th:href="@{/admin/dashboard}">
<i class="fas fa-cog"></i> Admin Dashboard
</a>
</li>
<li><hr class="dropdown-divider"></li>
<li>
<a class="dropdown-item" th:href="@{/profile}">
<i class="fas fa-user-cog"></i> Profile
</a>
</li>
<li>
<form th:action="@{/auth/logout}" method="post" class="d-inline">
<button type="submit" class="dropdown-item">
<i class="fas fa-sign-out-alt"></i> Logout
</button>
</form>
</li>
</ul>
</div>
<!-- Anonymous User Menu -->
<div sec:authorize="!isAuthenticated()" class="d-flex">
<a class="nav-link" th:href="@{/auth/login}">Login</a>
<a class="nav-link" th:href="@{/auth/register}">Register</a>
</div>
</div>
</div>
</nav>
<!-- Main Content -->
<main class="container my-4">
<div th:if="${success}" class="alert alert-success alert-dismissible fade show">
[[${success}]]
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<div th:if="${error}" class="alert alert-danger alert-dismissible fade show">
[[${error}]]
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<div th:insert="~{::main-content}">
<!-- Page-specific content will be inserted here -->
</div>
</main>
<!-- Footer -->
<footer class="bg-dark text-light py-4 mt-5">
<div class="container text-center">
<p>&copy; 2024 [[${blogName}]]. All rights reserved.</p>
</div>
</footer>
<!-- Bootstrap JS -->
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>

Testing

Example 10: Unit and Integration Tests

@SpringBootTest
@AutoConfigureTestDatabase
class BlogCmsApplicationTests {
@Autowired
private UserService userService;
@Autowired
private PostService postService;
@Autowired
private TestRestTemplate restTemplate;
@Test
void contextLoads() {
// Basic context loading test
}
@Test
@WithMockUser(roles = "AUTHOR")
void testCreatePost() {
PostCreateDto postDto = PostCreateDto.builder()
.title("Test Post")
.content("This is a test post content")
.excerpt("Test excerpt")
.status(PostStatus.DRAFT)
.build();
Post post = postService.createPost(postDto, "testuser");
assertThat(post).isNotNull();
assertThat(post.getTitle()).isEqualTo("Test Post");
assertThat(post.getAuthor().getUsername()).isEqualTo("testuser");
}
@Test
void testUserRegistration() {
UserRegistrationDto registrationDto = UserRegistrationDto.builder()
.username("newuser")
.email("[email protected]")
.password("password123")
.confirmPassword("password123")
.firstName("New")
.lastName("User")
.build();
User user = userService.registerUser(registrationDto);
assertThat(user).isNotNull();
assertThat(user.getUsername()).isEqualTo("newuser");
assertThat(user.getEmail()).isEqualTo("[email protected]");
assertThat(user.hasRole("USER")).isTrue();
}
}
@DataJpaTest
class RepositoryTests {
@Autowired
private TestEntityManager entityManager;
@Autowired
private UserRepository userRepository;
@Test
void testFindByUsername() {
User user = User.builder()
.username("testuser")
.email("[email protected]")
.password("encodedpassword")
.firstName("Test")
.lastName("User")
.build();
entityManager.persist(user);
entityManager.flush();
Optional<User> found = userRepository.findByUsername("testuser");
assertThat(found).isPresent();
assertThat(found.get().getEmail()).isEqualTo("[email protected]");
}
}

Conclusion

This Blog CMS with User Roles provides:

Comprehensive Role System - ADMIN, EDITOR, AUTHOR, USER with specific privileges
Content Management - Full CRUD operations for posts, categories, and tags
Security - Spring Security with role-based access control
REST API - JSON endpoints for frontend applications
Thymeleaf Templates - Server-rendered views with Bootstrap
Database Persistence - JPA with H2/MySQL support
Testing - Comprehensive unit and integration tests

The system is extensible and can be enhanced with features like:

Email notifications
File upload for images
Advanced search
Comment moderation
Analytics integration
Multi-language support
API rate limiting
Caching implementation