kid-bank VS Java_SpringBoot_Gym_Backend

I created "Kid Money Manager", a tool to help manage my son's virtual account. He wasn't old enough to open his own bank account when I started, but we needed some way to track his "earnings" (returning bottles for their deposits or gifts from grandparents) and spending. It has both a Web UI and access via SMS text messages. We mainly use the text messaging—entering transactions at the store, etc.— since I didn't want to write a dedicated phone app for such a simple interaction.

Created it from scratch, live coding it on my (JitterTed.Stream) Twitch channel (and some videos on my YouTube channel at JitterTed.TV). Written using TDD in Java + Spring Boot, deployed on Heroku and open-source at https://github.com/tedyoung/kid-bank.

I also recently wrote "Format Hero" (https://formathero.dev), because I could never remember which letters to use in Java's DateTimeFormatter. Was also a good demonstration of Hexagonal Architecture and, of course, I live coded it, TDDing all the way. Source is at https://github.com/jitterted/format-hero. Still some work to do on that one, but filled my immediate need.

My Spring Boot code is up here (version here is before any attempts to get allow requests from the same origin).

I'm confident that requests to this endpoint are being filtered and authenticated in the way I want but as soon as authentication / authorisation is determined (lines 39 - 44 in my WebFilter Class), line 40 ("Member is authorised. Allow through.") appears to be the last line evaluated. I put println commands in my restcontroller and service for the update member use case and they aren't getting hit at all.