internal API plus brute force security

src/main/java/stirling/software/SPDF/config/security/CustomUserDetailsService.java

@@ -5,6 +5,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
@@ -22,12 +23,18 @@ public class CustomUserDetailsService implements UserDetailsService {
     @Autowired
     private UserRepository userRepository;
 
-   
+    @Autowired
+    private LoginAttemptService loginAttemptService;
+    
     @Override
     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
         User user = userRepository.findByUsername(username)
             .orElseThrow(() -> new UsernameNotFoundException("No user found with username: " + username));
 
+        if (loginAttemptService.isBlocked(username)) {
+            throw new LockedException("Your account has been locked due to too many failed login attempts.");
+        }
+        
         return new org.springframework.security.core.userdetails.User(
             user.getUsername(),
             user.getPassword(),