docs(spec): reader dashboard design exploration and final spec (#447)

Seven HTML mockups covering the full design process for the
permission-gated reader dashboard (issue #447): 3 initial concept
variants (A/B/C), 3 iterations of concept B (B.1 hell, B.2 warm,
B.3 navy), and the final merged spec combining B.1 layout with B.3
person cards. Final spec includes all 4 view variants: desktop light
READ_ALL, desktop light BLOG_WRITE, desktop dark, and mobile (3 phone
frames: light reader, light BLOG_WRITE, dark reader).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/personas/architect.md

@@ -410,23 +410,6 @@ Never Kafka for teams under 10 or <100k events/day. Never gRPC inside a monolith
 4. Identify missing database-layer enforcement (constraints, RLS)
 5. Check transport choices — simpler protocol available?
 6. Propose a concrete simpler alternative, not just a critique
-7. Verify documentation currency. For each category below, check whether the PR triggered the update. Flag missing updates as blockers.
-
-| PR contains | Required doc update |
-|---|---|
-| New Flyway migration adding/removing/renaming a table or column | `docs/architecture/db/db-orm.puml` and `docs/architecture/db/db-relationships.puml` — **except** framework-owned tables (e.g. Spring Session JDBC's `spring_session*`, Flyway's `flyway_schema_history`), which are opaque to app code; reference the relevant ADR if an exclusion is load-bearing |
-| New `@ManyToMany` join table or FK | Both DB diagrams |
-| New backend package or domain module | `CLAUDE.md` package table + matching `docs/architecture/c4/l3-backend-*.puml` |
-| New controller or service in an existing backend domain | Matching `docs/architecture/c4/l3-backend-*.puml` |
-| New SvelteKit route | `CLAUDE.md` route table + matching `docs/architecture/c4/l3-frontend-*.puml` |
-| New Docker service or infrastructure component | `docs/architecture/c4/l2-containers.puml` + `docs/DEPLOYMENT.md` |
-| New external system integrated | `docs/architecture/c4/l1-context.puml` |
-| Auth or upload flow change | `docs/architecture/c4/seq-auth-flow.puml` or `docs/architecture/c4/seq-document-upload.puml` |
-| New `ErrorCode` or `Permission` value | `CLAUDE.md` + `docs/ARCHITECTURE.md` |
-| New domain concept or term | `docs/GLOSSARY.md` |
-| Architectural decision with lasting consequences | New ADR in `docs/adr/` |
-
-A doc omission is a blocker, not a concern — the PR does not merge until the diagram or text matches the code.
 
 ### Designing Systems
 1. Start with the data model — get the schema right before application code

.claude/personas/developer.md

@@ -980,24 +980,6 @@ Mark with `@pytest.mark.asyncio` so pytest runs the coroutine. Without it, the t
 5. Refactor — apply clean code, extract if 3+ duplications, rename for intent
 6. Repeat for the next behavior
 7. When all behaviors are green, review for SOLID violations across the full stack
-8. Update documentation before opening the PR. Use the table below to know which doc to touch.
-
-| What changed in code | Doc(s) to update |
-|---|---|
-| New Flyway migration adds/removes/renames a table or column | `docs/architecture/db/db-orm.puml` (add/remove entity or attribute) **and** `docs/architecture/db/db-relationships.puml` (add/remove relationship line) — **except** framework-owned tables (e.g. Spring Session JDBC's `spring_session*`, Flyway's `flyway_schema_history`), which are opaque to app code; reference the relevant ADR if an exclusion is load-bearing |
-| New `@ManyToMany` join table or FK relationship | Both DB diagrams above |
-| New backend package / domain module | `CLAUDE.md` (package structure table) **and** the matching `docs/architecture/c4/l3-backend-*.puml` diagram for that domain |
-| New Spring Boot controller or service in an existing domain | The matching `docs/architecture/c4/l3-backend-*.puml` for that domain |
-| New SvelteKit route (`+page.svelte`) | `CLAUDE.md` (route structure section) **and** the matching `docs/architecture/c4/l3-frontend-*.puml` diagram |
-| New Docker service / infrastructure component | `docs/architecture/c4/l2-containers.puml` **and** `docs/DEPLOYMENT.md` |
-| New external system integrated (new API, new S3 bucket, etc.) | `docs/architecture/c4/l1-context.puml` |
-| Auth flow or document-upload flow changes | `docs/architecture/c4/seq-auth-flow.puml` or `docs/architecture/c4/seq-document-upload.puml` |
-| New `ErrorCode` enum value | `CLAUDE.md` error handling section **and** `CONTRIBUTING.md` |
-| New `Permission` enum value | `CLAUDE.md` security section **and** `docs/ARCHITECTURE.md` |
-| New domain term introduced (entity name, status, concept) | `docs/GLOSSARY.md` |
-| Architectural decision with lasting consequences (new tech, new transport protocol, new pattern) | New ADR in `docs/adr/` |
-
-Skip a doc only if the change genuinely does not affect what that doc describes.
 
 ### Reviewing Code
 1. TDD evidence — are there tests? Do they precede the implementation?

.env.example

@@ -26,46 +26,6 @@ PORT_MAILPIT_SMTP=1025
 # Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
 OCR_TRAINING_TOKEN=change-me-in-production
 
-# --- Observability ---
-# Optional stack — start with: docker compose -f docker-compose.observability.yml up -d
-# Requires the main stack to already be running (docker compose up -d creates archiv-net).
-# In production the stack is managed from /opt/familienarchiv/ (see docs/DEPLOYMENT.md §4).
-
-# Ports for host access
-PORT_GRAFANA=3003
-PORT_GLITCHTIP=3002
-PORT_PROMETHEUS=9090
-
-# Grafana admin password — change this before exposing Grafana beyond localhost
-GRAFANA_ADMIN_PASSWORD=changeme
-
-# GlitchTip domain — production: use https://glitchtip.archiv.raddatz.cloud (must match Caddy vhost)
-GLITCHTIP_DOMAIN=http://localhost:3002
-
-# GlitchTip secret key — Django SECRET_KEY equivalent, used to sign sessions and tokens.
-# REQUIRED in production — must not be empty or 'changeme'. Fail-closed: GlitchTip will
-# refuse to start with an invalid key.
-# Generate with: python3 -c "import secrets; print(secrets.token_hex(50))"
-GLITCHTIP_SECRET_KEY=changeme-generate-a-real-secret
-
-# PostgreSQL hostname for GlitchTip's db-init job and workers.
-# Override when only the staging stack is running (container name differs from archive-db).
-# Default (archive-db) is correct for production with the full stack up.
-POSTGRES_HOST=archive-db
-
-# $$ escaping note: passwords in /opt/familienarchiv/.env that contain a literal '$' must
-# use '$$' so Docker Compose does not expand them as variable references.
-# Example: a password 'p@$$word' should be written as 'p@$$$$word' in the .env file.
-
-# Error reporting DSNs — leave empty to disable the SDK (safe default).
-# SENTRY_DSN: backend (Spring Boot) — used by the GlitchTip/Sentry Java SDK
-SENTRY_DSN=
-SENTRY_TRACES_SAMPLE_RATE=
-# VITE_SENTRY_DSN: frontend (SvelteKit) — injected at build time via Vite
-VITE_SENTRY_DSN=
-# Sentry/GlitchTip auth token for source map upload at build time (optional)
-SENTRY_AUTH_TOKEN=
-
 # Production SMTP — uncomment and fill in to send real emails instead of catching them
 # APP_BASE_URL=https://your-domain.example.com
 # MAIL_HOST=smtp.example.com

.gitea/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 on:
   push:
-    branches: [main]
   pull_request:
 
 jobs:
@@ -13,7 +12,7 @@ jobs:
     name: Unit & Component Tests
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.60.0-noble
+      image: mcr.microsoft.com/playwright:v1.58.2-noble
     steps:
       - uses: actions/checkout@v4
 
@@ -29,133 +28,27 @@ jobs:
         run: npm ci
         working-directory: frontend
 
-      - name: Security audit (no dev deps)
-        run: npm audit --audit-level=high --omit=dev
-        working-directory: frontend
-
       - name: Compile Paraglide i18n
         run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
         working-directory: frontend
 
-      - name: Sync SvelteKit
-        run: npx svelte-kit sync
-        working-directory: frontend
-
       - name: Lint
         run: npm run lint
         working-directory: frontend
 
-      - name: Assert no banned vi.mock patterns
+      - name: Run unit and component tests
-        shell: bash
+        run: npm test
-        run: |
-          # Literal pdfjs-dist (libLoader pattern — ADR 012)
-          if grep -rF "vi.mock('pdfjs-dist'" frontend/src/; then
-            echo "FAIL: banned vi.mock('pdfjs-dist') pattern found — see ADR 012. Use the libLoader prop injection pattern instead."
-            exit 1
-          fi
-          # Async factory with dynamic import in body (named mechanism — ADR 012 / #553).
-          # Multiline PCRE matches `vi.mock(<arg>, async ... { ... await import(...) ... })`
-          # across line breaks. __meta__ is excluded because it contains fixture strings
-          # demonstrating the very pattern this check is meant to forbid.
-          if grep -rPzln 'vi\.mock\([^)]+,\s*async[^{]*\{[\s\S]*?await\s+import\s*\(' \
-              --include='*.spec.ts' --include='*.test.ts' \
-              --exclude-dir='__meta__' \
-              frontend/src/; then
-            echo "FAIL: banned async vi.mock factory with dynamic import in body — see ADR 012 / #553. Use a synchronous factory + vi.hoisted instead."
-            exit 1
-          fi
-
-      - name: Assert no (upload|download)-artifact past v3
-        shell: bash
-        run: |
-          # Self-test: verify the regex catches v4+ and does not catch v3.
-          tmp=$(mktemp)
-          printf '        uses: actions/upload-artifact@v5\n' > "$tmp"
-          grep -qP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
-            || { echo "FAIL: guard self-test — regex missed upload-artifact@v5"; rm "$tmp"; exit 1; }
-          printf '        uses: actions/upload-artifact@v3\n' > "$tmp"
-          grep -qvP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
-            || { echo "FAIL: guard self-test — regex incorrectly flagged upload-artifact@v3"; rm "$tmp"; exit 1; }
-          rm "$tmp"
-          # Guard: Gitea Actions (act_runner) does not implement the v4 artifact protocol.
-          # Both upload-artifact and download-artifact share the same incompatibility.
-          # Pin to @v3. See ADR-014 / #557.
-          if grep -RPn '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' .gitea/workflows/; then
-            echo "::error::actions/(upload|download)-artifact@v4+ is unsupported on Gitea Actions (act_runner). Pin to @v3. See ADR-014 / #557."
-            exit 1
-          fi
-
-      - name: Run unit and component tests with coverage
-        shell: bash
-        run: |
-          set -eo pipefail
-          npm run test:coverage 2>&1 | tee /tmp/coverage-test-${{ github.run_id }}.log
-        working-directory: frontend
-        env:
-          TZ: Europe/Berlin
-
-      # Diagnostic guard: covers the coverage run only. If `npm test` (above)
-      # exits 1 with a birpc error, the named pattern appears here — not there.
-      - name: Assert no birpc teardown race in coverage run
-        shell: bash
-        if: always()
-        run: |
-          if grep -qF "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}.log 2>/dev/null; then
-            echo "FAIL: [birpc] rpc is closed teardown race detected in coverage run"
-            grep -F "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}.log
-            exit 1
-          fi
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-      - name: Upload coverage reports
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-reports
-          path: |
-            frontend/coverage/
-            /tmp/coverage-test-${{ github.run_id }}.log
-
-      - name: Build frontend
-        run: npm run build
         working-directory: frontend
 
-      # ── Prerender output is exactly the public help page ───────────────────
-      # SvelteKit prerender + crawl follows nav links and bakes "redirect to
-      # /login" HTML for every protected route, served BEFORE runtime hooks
-      # (see #514). With `crawl: false` only the explicit entry should land
-      # in build/prerendered/. Anything else is a regression — fail the build.
-      - name: Assert prerender output is only /hilfe/transkription
-        run: |
-          cd frontend
-          set -e
-          extra=$(find build/prerendered -type f \
-                  -not -path 'build/prerendered/hilfe/*' \
-                  -not -name '*.br' -not -name '*.gz' \
-                  || true)
-          if [ -n "$extra" ]; then
-            echo "FAIL: unexpected prerendered files (would shadow runtime hooks):"
-            echo "$extra"
-            exit 1
-          fi
-          # And the help page must still be there.
-          test -f build/prerendered/hilfe/transkription.html \
-            || { echo "FAIL: /hilfe/transkription.html missing from prerender output"; exit 1; }
-          echo "PASS: only /hilfe/transkription.html prerendered."
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
       - name: Upload screenshots
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: unit-test-screenshots
           path: frontend/test-results/screenshots/
 
   # ─── OCR Service Unit Tests ───────────────────────────────────────────────────
-  # Only stdlib/lightweight tests — no ML stack (PyTorch/Surya/Kraken) required.
+  # Only spell_check.py, test_confidence.py, test_sender_registry.py — no ML stack required.
-  # test_tmpdir.py covers the TMPDIR env var and entrypoint mkdir behaviour (ADR-021).
-  # test_tmpdir_is_inside_persistent_cache_volume is skipped in CI (TMPDIR not
-  # set to /app/cache here); it runs inside the deployed Docker container.
   ocr-tests:
     name: OCR Service Tests
     runs-on: ubuntu-latest
@@ -167,11 +60,11 @@ jobs:
           python-version: '3.11'
 
       - name: Install test dependencies
-        run: pip install "pyspellchecker==0.9.0" "fastapi==0.115.6" pytest pytest-asyncio
+        run: pip install "pyspellchecker==0.9.0" pytest pytest-asyncio
         working-directory: ocr-service
 
       - name: Run OCR unit tests (no ML stack required)
-        run: python -m pytest test_spell_check.py test_confidence.py test_sender_registry.py test_tmpdir.py -v
+        run: python -m pytest test_spell_check.py test_confidence.py test_sender_registry.py -v
         working-directory: ocr-service
 
   # ─── Backend Unit & Slice Tests ───────────────────────────────────────────────
@@ -181,8 +74,6 @@ jobs:
     runs-on: ubuntu-latest
     env:
       DOCKER_API_VERSION: "1.43"  # NAS runner runs Docker 24.x (max API 1.43); Testcontainers 2.x defaults to 1.44
-      DOCKER_HOST: unix:///var/run/docker.sock
-      TESTCONTAINERS_RYUK_DISABLED: "true"
     steps:
       - uses: actions/checkout@v4
 
@@ -201,155 +92,5 @@ jobs:
       - name: Run backend tests
         run: |
           chmod +x mvnw
-          ./mvnw clean verify
+          ./mvnw clean test
-        working-directory: backend
+        working-directory: backend
-
-      - name: Upload surefire reports
-        if: always()
-        # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-        uses: actions/upload-artifact@v3
-        with:
-          name: surefire-reports
-          path: backend/target/surefire-reports/
-
-  # ─── fail2ban Regex Regression ────────────────────────────────────────────────
-  # The filter parses Caddy's JSON access log; a Caddy upgrade that reorders
-  # the JSON keys would silently break it (fail2ban-regex would return
-  # "0 matches", fail2ban would stop banning, no error surface). This job
-  # pins the contract against a deterministic sample line.
-  fail2ban-regex:
-    name: fail2ban Regex
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install fail2ban
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y fail2ban
-
-      - name: Matches /api/auth/login 401
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/login 401"; exit 1; }
-
-      - name: Matches /api/auth/login 429
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":429}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/login 429"; exit 1; }
-
-      - name: Matches /api/auth/forgot-password 401
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/forgot-password"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/forgot-password 401"; exit 1; }
-
-      - name: Does not match /api/auth/login 200
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":200}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '0 matched' \
-            || { echo "expected 0 matches for /api/auth/login 200"; exit 1; }
-
-      - name: Does not match /api/documents (unrelated 401)
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"GET","host":"archiv.raddatz.cloud","uri":"/api/documents"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '0 matched' \
-            || { echo "expected 0 matches for /api/documents 401"; exit 1; }
-
-      # ── Backend resolves to file-polling, not systemd ─────────────────────
-      # The Debian/Ubuntu fail2ban package ships defaults-debian.conf with
-      # `[DEFAULT] backend = systemd`. Without `backend = polling` in our
-      # jail, the daemon loads the jail but reads from journald and never
-      # touches /var/log/caddy/access.log — i.e. the regex above passes in
-      # isolation while the live jail is inert. See issue #503.
-      - name: Jail resolves with polling backend (not inherited systemd)
-        run: |
-          sudo ln -sfn "$PWD/infra/fail2ban/jail.d/familienarchiv.conf"       /etc/fail2ban/jail.d/familienarchiv.conf
-          sudo ln -sfn "$PWD/infra/fail2ban/filter.d/familienarchiv-auth.conf" /etc/fail2ban/filter.d/familienarchiv-auth.conf
-          dump=$(sudo fail2ban-client -d 2>&1)
-          echo "$dump" | grep -E "add.*familienarchiv-auth" || true
-          echo "$dump" | grep -qE "\['add', 'familienarchiv-auth', 'polling'\]" \
-            || { echo "FAIL: familienarchiv-auth jail did not resolve to 'polling' backend"; exit 1; }
-
-  # ─── Semgrep Security Scan ───────────────────────────────────────────────────
-  # Catches XXE-unprotected XML parser factories and similar patterns defined in
-  # .semgrep/security.yml. Runs in parallel with backend-unit-tests for fast feedback.
-  # Uses local rules only (no SEMGREP_APP_TOKEN / OIDC — act_runner does not support it).
-  semgrep-scan:
-    name: Semgrep Security Scan
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-          cache: 'pip'
-
-      - name: Install Semgrep
-        run: pip install semgrep==1.163.0
-
-      - name: Run security rules
-        run: semgrep --config .semgrep/security.yml --error --metrics=off backend/src/
-
-  # ─── Compose Bucket-Bootstrap Idempotency ─────────────────────────────────────
-  # docker-compose.prod.yml's create-buckets service runs on every
-  # `docker compose up` (one-shot, no restart). Must be idempotent — a
-  # re-deploy must not fail just because the bucket / user / policy
-  # already exists. Validated by running create-buckets twice against a
-  # throwaway minio stack and asserting both invocations exit 0.
-  compose-idempotency:
-    name: Compose Bucket Idempotency
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write stub env file
-        run: |
-          cat > .env.test <<'EOF'
-          TAG=test
-          PORT_BACKEND=18080
-          PORT_FRONTEND=13000
-          APP_DOMAIN=localhost
-          POSTGRES_PASSWORD=stub
-          MINIO_PASSWORD=stubrootpassword
-          MINIO_APP_PASSWORD=stubapppassword
-          OCR_TRAINING_TOKEN=stub
-          APP_ADMIN_USERNAME=admin@local
-          APP_ADMIN_PASSWORD=stub
-          MAIL_HOST=mailpit
-          MAIL_PORT=1025
-          APP_MAIL_FROM=noreply@local
-          IMPORT_HOST_DIR=/tmp/dummy-import
-          COMPOSE_NETWORK_NAME=test-idem-archiv-net
-          EOF
-
-      - name: Bring up minio
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test up -d --wait minio
-
-      - name: First create-buckets run
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test run --rm create-buckets
-
-      - name: Second create-buckets run (idempotency check)
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test run --rm create-buckets
-
-      - name: Teardown
-        if: always()
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test down -v
-          rm -f .env.test

.gitea/workflows/coverage-flake-probe.yml

@@ -1,65 +0,0 @@
-name: Coverage Flake Probe
-
-# Manually-triggered probe for the birpc teardown race documented in ADR 012
-# / #553. Runs the full coverage suite 20× in parallel against a single SHA
-# and asserts zero `[birpc] rpc is closed` lines across every cell. Verifies
-# the acceptance criterion that the race no longer surfaces under coverage.
-
-on:
-  workflow_dispatch:
-
-jobs:
-  coverage-flake-probe:
-    name: Coverage flake probe (run ${{ matrix.run }})
-    runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/playwright:v1.58.2-noble
-    strategy:
-      fail-fast: false
-      matrix:
-        run: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Cache node_modules
-        id: node-modules-cache
-        uses: actions/cache@v4
-        with:
-          path: frontend/node_modules
-          key: node-modules-${{ hashFiles('frontend/package-lock.json') }}
-
-      - name: Install dependencies
-        if: steps.node-modules-cache.outputs.cache-hit != 'true'
-        run: npm ci
-        working-directory: frontend
-
-      - name: Compile Paraglide i18n
-        run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
-        working-directory: frontend
-
-      - name: Run unit and component tests with coverage
-        shell: bash
-        run: |
-          set -eo pipefail
-          npm run test:coverage 2>&1 | tee /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log
-        working-directory: frontend
-        env:
-          TZ: Europe/Berlin
-
-      - name: Assert no birpc teardown race
-        shell: bash
-        if: always()
-        run: |
-          if grep -qF "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log 2>/dev/null; then
-            echo "FAIL: [birpc] rpc is closed teardown race detected in run ${{ matrix.run }}"
-            grep -F "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log
-            exit 1
-          fi
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-      - name: Upload coverage log on failure
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-log-run-${{ matrix.run }}
-          path: /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log

.gitea/workflows/nightly.yml

@@ -1,280 +0,0 @@
-name: nightly
-
-# Builds and deploys the staging environment from main every night.
-# Runs on the self-hosted runner using Docker-out-of-Docker (the docker
-# socket is mounted in), so `docker compose build` produces images on
-# the host daemon and `docker compose up` consumes them directly — no
-# registry hop.
-#
-# Operational assumptions (see docs/DEPLOYMENT.md §3 for the full setup):
-#
-#   1. Single-tenant self-hosted runner. The "Write staging env file" step
-#      writes every secret to .env.staging on the runner filesystem; the
-#      `if: always()` cleanup step removes it. A multi-tenant runner
-#      would need to switch to docker compose --env-file <(stdin) instead.
-#
-#   2. Host docker layer cache is authoritative. There is no
-#      actions/cache; we rely on the host daemon to keep Maven and npm
-#      layers warm between runs. A `docker system prune` on the host
-#      will cause the next nightly build to be cold (5–10 min slower).
-#
-# Staging environment isolation:
-#   - project name: archiv-staging
-#   - host ports:   backend 8081, frontend 3001
-#   - profile:      staging (starts mailpit instead of a real SMTP relay)
-#
-# Required Gitea secrets:
-#   STAGING_POSTGRES_PASSWORD
-#   STAGING_MINIO_PASSWORD
-#   STAGING_MINIO_APP_PASSWORD
-#   STAGING_OCR_TRAINING_TOKEN
-#   STAGING_APP_ADMIN_USERNAME
-#   STAGING_APP_ADMIN_PASSWORD
-#   GRAFANA_ADMIN_PASSWORD
-#   GLITCHTIP_SECRET_KEY
-#   SENTRY_DSN                  (set after GlitchTip first-run; empty = Sentry disabled)
-
-on:
-  schedule:
-    - cron: "0 2 * * *"
-  workflow_dispatch:
-
-env:
-  # Ensures the backend Dockerfile's `RUN --mount=type=cache` lines are
-  # honoured (Maven cache survives between runs).
-  DOCKER_BUILDKIT: "1"
-
-jobs:
-  deploy-staging:
-    # `ubuntu-latest` matches our self-hosted runner's advertised label
-    # (the runner has labels: ubuntu-latest / ubuntu-24.04 / ubuntu-22.04).
-    # `self-hosted` would never match — no runner advertises it — so the
-    # job parks in the queue forever. ADR-011's "single-tenant" promise
-    # is at the repo level; sharing this runner between CI and deploys
-    # for the same repo is within that boundary.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write staging env file
-        run: |
-          cat > .env.staging <<EOF
-          TAG=nightly
-          PORT_BACKEND=8081
-          PORT_FRONTEND=3001
-          APP_DOMAIN=staging.raddatz.cloud
-          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
-          MINIO_PASSWORD=${{ secrets.STAGING_MINIO_PASSWORD }}
-          MINIO_APP_PASSWORD=${{ secrets.STAGING_MINIO_APP_PASSWORD }}
-          OCR_TRAINING_TOKEN=${{ secrets.STAGING_OCR_TRAINING_TOKEN }}
-          APP_ADMIN_USERNAME=${{ secrets.STAGING_APP_ADMIN_USERNAME }}
-          APP_ADMIN_PASSWORD=${{ secrets.STAGING_APP_ADMIN_PASSWORD }}
-          MAIL_HOST=mailpit
-          MAIL_PORT=1025
-          MAIL_USERNAME=
-          MAIL_PASSWORD=
-          MAIL_SMTP_AUTH=false
-          MAIL_STARTTLS_ENABLE=false
-          APP_MAIL_FROM=noreply@staging.raddatz.cloud
-          IMPORT_HOST_DIR=/srv/familienarchiv-staging/import
-          POSTGRES_USER=archiv
-          SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-          EOF
-
-      - name: Verify backend /import:ro mount is wired
-        # Regression guard for #526: the /admin/system mass-import card
-        # only works when the backend service mounts the host import
-        # payload at /import (read-only). If a future "compose cleanup"
-        # PR drops the volumes block, mass import silently breaks again.
-        # `compose config` renders both shorthand and longform mounts as
-        # `target: /import` + `read_only: true`, so we assert against
-        # the rendered form rather than the raw source YAML.
-        run: |
-          set -e
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            config > /tmp/compose-rendered.yml
-          grep -q '^[[:space:]]*target: /import$' /tmp/compose-rendered.yml \
-            || { echo "::error::backend is missing the /import bind mount (see #526)"; exit 1; }
-          grep -A2 '^[[:space:]]*target: /import$' /tmp/compose-rendered.yml \
-            | grep -q 'read_only: true' \
-            || { echo "::error::backend /import mount is not read-only (see #526)"; exit 1; }
-
-      - name: Build images
-        # `--pull` forces re-fetching pinned base images so a CVE
-        # re-publication of the same tag (e.g. node:20.19.0-alpine3.21,
-        # postgres:16-alpine) is picked up instead of being served
-        # from the host's stale Docker layer cache.
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            build --pull
-
-      - name: Deploy staging
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            up -d --wait --remove-orphans
-
-      - name: Deploy observability configs
-        # Copies the compose file and config tree from the workspace checkout
-        # into /opt/familienarchiv/ — the permanent location that persists
-        # between CI runs. Containers started in the next step bind-mount
-        # from there, so a future workspace wipe cannot corrupt a running
-        # config file.
-        #
-        # obs-secrets.env is written fresh from Gitea secrets on every run so
-        # Gitea is always the single source of truth for secret rotation.
-        # Non-secret config lives in infra/observability/obs.env (tracked in git).
-        run: |
-          rm -rf /opt/familienarchiv/infra/observability
-          mkdir -p /opt/familienarchiv/infra/observability
-          cp -r infra/observability/. /opt/familienarchiv/infra/observability/
-          cp docker-compose.observability.yml /opt/familienarchiv/
-          cat > /opt/familienarchiv/obs-secrets.env <<'EOF'
-          GRAFANA_ADMIN_PASSWORD=${{ secrets.GRAFANA_ADMIN_PASSWORD }}
-          GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
-          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
-          POSTGRES_HOST=archiv-staging-db-1
-          EOF
-          # Note: POSTGRES_HOST is derived from the Compose project name (archiv-staging)
-          # and service name (db). A project rename requires updating this value.
-          chmod 600 /opt/familienarchiv/obs-secrets.env
-
-      - name: Validate observability compose config
-        # Dry-run: resolves all variable substitutions and reports any missing
-        # required keys before containers start. Catches undefined variables and
-        # YAML errors in config files updated by the previous step.
-        # --env-file order: obs.env first (git-tracked defaults), obs-secrets.env
-        # second (CI-written secrets). Later files win on duplicate keys, so
-        # obs-secrets.env overrides POSTGRES_HOST set in obs.env.
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            config --quiet
-
-      - name: Start observability stack
-        # Runs with absolute paths so bind mounts resolve to stable host paths
-        # that survive workspace wipes between nightly runs (see ADR-016).
-        # Non-secret config from obs.env (git-tracked); secrets from obs-secrets.env
-        # (written fresh from Gitea secrets above). --env-file order: obs.env first,
-        # obs-secrets.env second — later file wins on duplicate keys.
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            up -d --wait --remove-orphans
-
-      - name: Assert observability stack health
-        # docker compose up --wait covers services WITH healthcheck directives only.
-        # obs-promtail, obs-cadvisor, obs-node-exporter, and obs-glitchtip-worker have
-        # no healthcheck — they are considered "started" as soon as the process runs.
-        # This step explicitly asserts the five healthchecked critical services are
-        # healthy before the smoke test proceeds.
-        run: |
-          set -e
-          unhealthy=""
-          for svc in obs-loki obs-prometheus obs-grafana obs-tempo obs-glitchtip; do
-            status=$(docker inspect "$svc" --format '{{.State.Health.Status}}' 2>/dev/null || echo "missing")
-            if [ "$status" != "healthy" ]; then
-              echo "::error::$svc is not healthy (status: $status)"
-              unhealthy="$unhealthy $svc"
-            fi
-          done
-          [ -z "$unhealthy" ] || exit 1
-          echo "All critical observability services are healthy"
-
-      - name: Reload Caddy
-        # Apply any committed Caddyfile changes before smoke-testing the
-        # public surface. Without this step, a Caddyfile edit lands in the
-        # repo but Caddy keeps serving the previous config until someone
-        # reloads it manually — the smoke test would then catch a stale
-        # header or a still-proxied /actuator route rather than confirming
-        # the current config is live.
-        #
-        # The runner executes job steps inside Docker containers (DooD).
-        # `systemctl` is not present in container images and cannot reach
-        # the host's systemd directly. We use the Docker socket (mounted
-        # into every job container via runner-config.yaml) to spin up a
-        # privileged sibling container in the host PID namespace; nsenter
-        # then enters the host's namespaces so systemctl talks to the real
-        # host systemd daemon. No sudoers entry is required — the Docker
-        # socket already grants root-equivalent host access.
-        #
-        # Alpine is used: ~5 MB vs ~70 MB for ubuntu, no unnecessary
-        # tooling, and the digest is pinned so any upstream change requires
-        # an explicit bump PR. util-linux (which ships nsenter) is installed
-        # at run time; apk add takes ~1 s on the warm VPS cache.
-        #
-        # `reload` not `restart`: reload sends SIGHUP so Caddy re-reads its
-        # config in-process without dropping TLS connections. `restart`
-        # would briefly stop the service, losing in-flight requests.
-        #
-        # If Caddy is not running this step fails fast before the smoke test
-        # issues a misleading "port 443 refused" error.
-        run: |
-          docker run --rm --privileged --pid=host \
-            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
-            sh -c 'apk add --no-cache util-linux -q && nsenter -t 1 -m -u -n -p -i -- /bin/systemctl reload caddy'
-
-      - name: Smoke test deployed environment
-        # Healthchecks confirm containers are healthy; they do NOT confirm the
-        # public surface works. This step catches: Caddy not reloaded, HSTS
-        # header dropped, /actuator block bypassed.
-        #
-        # --resolve pins staging.raddatz.cloud to the Docker bridge gateway IP
-        # (the host) so we do NOT depend on hairpin NAT on the host router.
-        # 127.0.0.1 cannot be used: job containers run in bridge network mode
-        # (runner-config.yaml), so 127.0.0.1 is the container's loopback, not
-        # the host's. The bridge gateway IS the host; Caddy binds 0.0.0.0:443
-        # and is therefore reachable from the container via that IP.
-        # SNI still uses the public hostname so the TLS cert validates correctly.
-        #
-        # Gateway detection reads /proc/net/route (always present, no package
-        # required) instead of `ip route` to avoid a dependency on iproute2.
-        # Field $2=="00000000" is the default route; field $3 is the gateway as
-        # a little-endian 32-bit hex value which awk decodes to dotted-decimal.
-        run: |
-          set -e
-          HOST="staging.raddatz.cloud"
-          URL="https://$HOST"
-          HOST_IP=$(awk 'NR>1 && $2=="00000000"{h=$3;printf "%d.%d.%d.%d\n",strtonum("0x"substr(h,7,2)),strtonum("0x"substr(h,5,2)),strtonum("0x"substr(h,3,2)),strtonum("0x"substr(h,1,2));exit}' /proc/net/route)
-          [ -n "$HOST_IP" ] || { echo "ERROR: could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
-          RESOLVE=(--resolve "$HOST:443:$HOST_IP")
-          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
-          curl -fsS "${RESOLVE[@]}" --max-time 10 "$URL/login" -o /dev/null
-          # Pin the preload-list-eligible HSTS value, not just header presence:
-          # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must
-          # fail this check rather than pass it silently.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'strict-transport-security:[[:space:]]*max-age=31536000.*includeSubDomains.*preload'
-          # Permissions-Policy denies APIs the app does not use (camera,
-          # microphone, geolocation). A regression that loosens or drops the
-          # header now fails the smoke step.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'permissions-policy:[[:space:]]*camera=\(\),[[:space:]]*microphone=\(\),[[:space:]]*geolocation=\(\)'
-          status=$(curl -s "${RESOLVE[@]}" -o /dev/null -w "%{http_code}" --max-time 10 "$URL/actuator/health")
-          [ "$status" = "404" ] || { echo "expected 404 from /actuator/health, got $status"; exit 1; }
-          echo "All smoke checks passed"
-
-      - name: Cleanup env file
-        # LOAD-BEARING: `if: always()` is the linchpin of the ADR-011
-        # single-tenant runner trust model. Every secret in .env.staging
-        # is plain text on the runner filesystem until this step runs.
-        # If a future refactor drops `if: always()`, a failed deploy
-        # leaves the env-file behind. Do not remove this conditional
-        # without first re-evaluating ADR-011.
-        if: always()
-        run: rm -f .env.staging

.gitea/workflows/release.yml

@@ -1,220 +0,0 @@
-name: release
-
-# Builds and deploys the production environment on `v*` tag push.
-# Runs on the self-hosted runner via Docker-out-of-Docker; images are
-# tagged with the actual git tag (e.g. v1.0.0) so rollback is
-#   `TAG=<previous> docker compose -f docker-compose.prod.yml -p archiv-production up -d --wait`
-#
-# Operational assumptions (see docs/DEPLOYMENT.md §3 for the full setup):
-#
-#   1. Single-tenant self-hosted runner. The "Write production env file"
-#      step writes every secret to .env.production on the runner
-#      filesystem; the `if: always()` cleanup step removes it. A
-#      multi-tenant runner would need to switch to
-#      `docker compose --env-file <(stdin)` instead.
-#
-#   2. Host docker layer cache is authoritative. There is no
-#      actions/cache; we rely on the host daemon to keep Maven and npm
-#      layers warm between runs. A `docker system prune` on the host
-#      will cause the next release build to be cold (5–10 min slower).
-#
-# Production environment:
-#   - project name: archiv-production
-#   - host ports:   backend 8080, frontend 3000
-#   - profile:      (none) — mailpit is excluded; real SMTP relay is used
-#
-# Required Gitea secrets:
-#   PROD_POSTGRES_PASSWORD
-#   PROD_MINIO_PASSWORD
-#   PROD_MINIO_APP_PASSWORD
-#   PROD_OCR_TRAINING_TOKEN
-#   PROD_APP_ADMIN_USERNAME       (CRITICAL: see docs/DEPLOYMENT.md)
-#   PROD_APP_ADMIN_PASSWORD       (CRITICAL: locked in on first deploy)
-#   MAIL_HOST
-#   MAIL_PORT
-#   MAIL_USERNAME
-#   MAIL_PASSWORD
-#   GRAFANA_ADMIN_PASSWORD
-#   GLITCHTIP_SECRET_KEY
-#   SENTRY_DSN                    (set after GlitchTip first-run; empty = Sentry disabled)
-
-on:
-  push:
-    tags:
-      - "v*"
-
-env:
-  DOCKER_BUILDKIT: "1"
-
-jobs:
-  deploy-production:
-    # See nightly.yml — same rationale: `ubuntu-latest` matches the
-    # advertised label of our single-tenant self-hosted runner.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write production env file
-        run: |
-          cat > .env.production <<EOF
-          TAG=${{ gitea.ref_name }}
-          PORT_BACKEND=8080
-          PORT_FRONTEND=3000
-          APP_DOMAIN=archiv.raddatz.cloud
-          POSTGRES_PASSWORD=${{ secrets.PROD_POSTGRES_PASSWORD }}
-          MINIO_PASSWORD=${{ secrets.PROD_MINIO_PASSWORD }}
-          MINIO_APP_PASSWORD=${{ secrets.PROD_MINIO_APP_PASSWORD }}
-          OCR_TRAINING_TOKEN=${{ secrets.PROD_OCR_TRAINING_TOKEN }}
-          APP_ADMIN_USERNAME=${{ secrets.PROD_APP_ADMIN_USERNAME }}
-          APP_ADMIN_PASSWORD=${{ secrets.PROD_APP_ADMIN_PASSWORD }}
-          MAIL_HOST=${{ secrets.MAIL_HOST }}
-          MAIL_PORT=${{ secrets.MAIL_PORT }}
-          MAIL_USERNAME=${{ secrets.MAIL_USERNAME }}
-          MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
-          MAIL_SMTP_AUTH=true
-          MAIL_STARTTLS_ENABLE=true
-          APP_MAIL_FROM=noreply@raddatz.cloud
-          IMPORT_HOST_DIR=/srv/familienarchiv-production/import
-          POSTGRES_USER=archiv
-          SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-          EOF
-
-      - name: Build images
-        # `--pull` forces re-fetching pinned base images so a CVE
-        # re-publication of the same tag is picked up rather than served
-        # from the host's stale Docker layer cache.
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-production \
-            --env-file .env.production \
-            build --pull
-
-      - name: Deploy production
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-production \
-            --env-file .env.production \
-            up -d --wait --remove-orphans
-
-      - name: Deploy observability configs
-        # Mirrors the nightly approach: copies obs compose file and config tree
-        # to /opt/familienarchiv/ (permanent path, survives workspace wipes — ADR-016),
-        # then writes obs-secrets.env fresh from Gitea secrets.
-        # Non-secret config lives in infra/observability/obs.env (tracked in git).
-        run: |
-          rm -rf /opt/familienarchiv/infra/observability
-          mkdir -p /opt/familienarchiv/infra/observability
-          cp -r infra/observability/. /opt/familienarchiv/infra/observability/
-          cp docker-compose.observability.yml /opt/familienarchiv/
-          cat > /opt/familienarchiv/obs-secrets.env <<'EOF'
-          GRAFANA_ADMIN_PASSWORD=${{ secrets.GRAFANA_ADMIN_PASSWORD }}
-          GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
-          POSTGRES_PASSWORD=${{ secrets.PROD_POSTGRES_PASSWORD }}
-          POSTGRES_HOST=archiv-production-db-1
-          EOF
-          # Note: POSTGRES_HOST is derived from the Compose project name (archiv-production)
-          # and service name (db). A project rename requires updating this value.
-          chmod 600 /opt/familienarchiv/obs-secrets.env
-
-      - name: Validate observability compose config
-        # Dry-run: resolves all variable substitutions and reports any missing
-        # required keys before containers start. Catches undefined variables and
-        # YAML errors in config files updated by the previous step.
-        # --env-file order: obs.env first (git-tracked defaults), obs-secrets.env
-        # second (CI-written secrets). Later files win on duplicate keys, so
-        # obs-secrets.env overrides POSTGRES_HOST set in obs.env.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            config --quiet
-
-      - name: Start observability stack
-        # Runs with absolute paths so bind mounts resolve to stable host paths
-        # that survive workspace wipes between runs (see ADR-016).
-        # Non-secret config from obs.env (git-tracked); secrets from obs-secrets.env
-        # (written fresh from Gitea secrets above). --env-file order: obs.env first,
-        # obs-secrets.env second — later file wins on duplicate keys.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            up -d --wait --remove-orphans
-
-      - name: Assert observability stack health
-        # docker compose up --wait covers services WITH healthcheck directives only.
-        # obs-promtail, obs-cadvisor, obs-node-exporter, and obs-glitchtip-worker have
-        # no healthcheck — they are considered "started" as soon as the process runs.
-        # This step explicitly asserts the five healthchecked critical services are
-        # healthy before the smoke test proceeds.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          set -e
-          unhealthy=""
-          for svc in obs-loki obs-prometheus obs-grafana obs-tempo obs-glitchtip; do
-            status=$(docker inspect "$svc" --format '{{.State.Health.Status}}' 2>/dev/null || echo "missing")
-            if [ "$status" != "healthy" ]; then
-              echo "::error::$svc is not healthy (status: $status)"
-              unhealthy="$unhealthy $svc"
-            fi
-          done
-          [ -z "$unhealthy" ] || exit 1
-          echo "All critical observability services are healthy"
-
-      - name: Reload Caddy
-        # See nightly.yml — same rationale and mechanism: DooD job containers
-        # cannot call systemctl directly; nsenter via a privileged sibling
-        # container reaches the host systemd. Must run after deploy (so the
-        # latest Caddyfile is on disk) and before the smoke test (so the
-        # public surface reflects the current config). Alpine with pinned
-        # digest; reload not restart — see nightly.yml for full rationale.
-        run: |
-          docker run --rm --privileged --pid=host \
-            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
-            sh -c 'apk add --no-cache util-linux -q && nsenter -t 1 -m -u -n -p -i -- /bin/systemctl reload caddy'
-
-      - name: Smoke test deployed environment
-        # See nightly.yml — same three checks, against the prod vhost.
-        # --resolve stored as a Bash array so "${RESOLVE[@]}" expands to two
-        # separate arguments; a quoted string would pass the flag and its value
-        # as one token and curl would reject it as an unknown option.
-        # Gateway detection via /proc/net/route — no iproute2 dependency.
-        # See nightly.yml for the full network topology explanation.
-        run: |
-          set -e
-          HOST="archiv.raddatz.cloud"
-          URL="https://$HOST"
-          HOST_IP=$(awk 'NR>1 && $2=="00000000"{h=$3;printf "%d.%d.%d.%d\n",strtonum("0x"substr(h,7,2)),strtonum("0x"substr(h,5,2)),strtonum("0x"substr(h,3,2)),strtonum("0x"substr(h,1,2));exit}' /proc/net/route)
-          [ -n "$HOST_IP" ] || { echo "ERROR: could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
-          RESOLVE=(--resolve "$HOST:443:$HOST_IP")
-          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
-          curl -fsS "${RESOLVE[@]}" --max-time 10 "$URL/login" -o /dev/null
-          # Pin the preload-list-eligible HSTS value, not just header presence:
-          # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must
-          # fail this check rather than pass it silently.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'strict-transport-security:[[:space:]]*max-age=31536000.*includeSubDomains.*preload'
-          # Permissions-Policy denies APIs the app does not use (camera,
-          # microphone, geolocation). A regression that loosens or drops the
-          # header now fails the smoke step.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'permissions-policy:[[:space:]]*camera=\(\),[[:space:]]*microphone=\(\),[[:space:]]*geolocation=\(\)'
-          status=$(curl -s "${RESOLVE[@]}" -o /dev/null -w "%{http_code}" --max-time 10 "$URL/actuator/health")
-          [ "$status" = "404" ] || { echo "expected 404 from /actuator/health, got $status"; exit 1; }
-          echo "All smoke checks passed"
-
-      - name: Cleanup env file
-        # LOAD-BEARING: `if: always()` is the linchpin of the ADR-011
-        # single-tenant runner trust model. Every secret in
-        # .env.production is plain text on the runner filesystem until
-        # this step runs. If a future refactor drops `if: always()`, a
-        # failed deploy leaves the env-file behind. Do not remove this
-        # conditional without first re-evaluating ADR-011.
-        if: always()
-        run: rm -f .env.production

.gitignore

@@ -18,11 +18,5 @@ scripts/large-data.sql
 .claude/worktrees/
 .claude/scheduled_tasks.lock
 
-# Run artifacts from verification tooling
-proofshot-artifacts/
-
-# Root-level Node.js tooling artifacts
-node_modules/
-
 # Repo uses npm; yarn.lock is ignored to avoid double-lockfile drift.
 frontend/yarn.lock

.semgrep/security.yml

@@ -1,54 +0,0 @@
-# Semgrep security rules for Familienarchiv backend.
-# These rules catch the absence of XXE protection on XML parser factories.
-# CWE-611: Improper Restriction of XML External Entity Reference.
-# Run: semgrep --config .semgrep/security.yml --error backend/src/
-
-rules:
-
-  # DocumentBuilderFactory without XXE hardening.
-  # All call sites must call setFeature("…disallow-doctype-decl", true) before use.
-  - id: dbf-xxe-default
-    patterns:
-      - pattern: $X = DocumentBuilderFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-          ...
-    message: >
-      DocumentBuilderFactory without XXE protection (CWE-611).
-      Call XxeSafeXmlParser.hardenedFactory() instead of DocumentBuilderFactory.newInstance().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR
-
-  # SAXParserFactory without XXE hardening.
-  - id: sax-xxe-default
-    patterns:
-      - pattern: $X = SAXParserFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-          ...
-    message: >
-      SAXParserFactory without XXE protection (CWE-611).
-      Set disallow-doctype-decl=true, external-general-entities=false, external-parameter-entities=false,
-      and load-external-dtd=false before use. Follow the pattern in XxeSafeXmlParser.hardenedFactory().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR
-
-  # XMLInputFactory without XXE hardening (StAX parser).
-  - id: stax-xxe-default
-    patterns:
-      - pattern: $X = XMLInputFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-          ...
-    message: >
-      XMLInputFactory without XXE protection (CWE-611).
-      Set IS_SUPPORTING_EXTERNAL_ENTITIES=false and SUPPORT_DTD=false before use.
-      Follow the pattern in XxeSafeXmlParser.hardenedFactory().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR

.vscode/settings.json

@@ -1,6 +1,4 @@
 {
     "java.configuration.updateBuildConfiguration": "interactive",
-    "java.compile.nullAnalysis.mode": "automatic",
+    "java.compile.nullAnalysis.mode": "automatic"
-    "plantuml.render": "PlantUMLServer",
-    "plantuml.server": "http://heim-nas:8500"
 }

CLAUDE.md

@@ -77,7 +77,6 @@ npm run generate:api  # Regenerate TypeScript API types from OpenAPI spec
 ```
 backend/src/main/java/org/raddatz/familienarchiv/
 ├── audit/               Audit logging
-├── auth/                AuthService, AuthSessionController, LoginRequest, LoginRateLimiter, RateLimitProperties (Spring Session JDBC)
 ├── config/              Infrastructure config (Minio, Async, Web)
 ├── dashboard/           Dashboard analytics + StatsController/StatsService
 ├── document/            Document domain (entities, controller, service, repository, DTOs)
@@ -94,7 +93,7 @@ backend/src/main/java/org/raddatz/familienarchiv/
 │   └── relationship/    PersonRelationship sub-domain
 ├── security/            SecurityConfig, Permission, @RequirePermission, PermissionAspect
 ├── tag/                 Tag domain
-└── user/                User domain — AppUser, UserGroup, UserService
+└── user/                User domain — AppUser, UserGroup, UserService, auth controllers
 ```
 
 ### Layering Rules
@@ -160,7 +159,7 @@ Input DTOs live flat in the domain package. Response types are the model entitie
 
 → See [CONTRIBUTING.md §Error handling](./CONTRIBUTING.md#error-handling)
 
-**LLM reminder:** use `DomainException.notFound/forbidden/conflict/internal()` from service methods — never throw raw exceptions. When adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`. Valid error codes include: `TOO_MANY_LOGIN_ATTEMPTS` (returned by `LoginRateLimiter` as HTTP 429 when a brute-force threshold is exceeded).
+**LLM reminder:** use `DomainException.notFound/forbidden/conflict/internal()` from service methods — never throw raw exceptions. When adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) mirror in `frontend/src/lib/shared/errors.ts`, (3) add i18n keys in `messages/{de,en,es}.json`.
 
 ### Security / Permissions
 
@@ -203,7 +202,8 @@ frontend/src/routes/
 ├── profile/                User profile settings
 ├── users/[id]/             Public user profile page
 ├── login/ logout/ register/
-└── forgot-password/ reset-password/
+├── forgot-password/ reset-password/
+└── demo/                   Dev-only demos
 ```
 
 ### API Client Pattern
@@ -267,7 +267,7 @@ Back button pattern — use the shared `<BackButton>` component from `$lib/share
 
 → See [CONTRIBUTING.md §Error handling](./CONTRIBUTING.md#error-handling)
 
-**LLM reminder:** when adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`. Valid error codes include: `TOO_MANY_LOGIN_ATTEMPTS` (returned by `LoginRateLimiter` as HTTP 429 when a brute-force threshold is exceeded).
+**LLM reminder:** when adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`.
 
 ---
 
@@ -275,35 +275,6 @@ Back button pattern — use the shared `<BackButton>` component from `$lib/share
 
 → See [docs/DEPLOYMENT.md](./docs/DEPLOYMENT.md)
 
-### Observability stack (separate compose file)
-
-Run via `docker-compose.observability.yml` — requires the main stack to be running first. Full setup procedure: [docs/DEPLOYMENT.md §4](./docs/DEPLOYMENT.md#4-logs--observability).
-
-| Service | Container | Default Port | Purpose |
-|---------|-----------|-------------|---------|
-| Grafana | `obs-grafana` | 3003 | Metrics / logs / traces dashboard |
-| Prometheus | `obs-prometheus` | 9090 (dev only — `127.0.0.1` bound) | Metrics store |
-| Loki | `obs-loki` | — (internal) | Log store |
-| Tempo | `obs-tempo` | — (internal) | Trace store |
-| GlitchTip | `obs-glitchtip` | 3002 | Error tracking (Sentry-compatible) |
-
-### Observability env vars
-
-| Variable | Purpose |
-|----------|---------|
-| `PORT_GRAFANA` | Host port for Grafana UI (default: `3003`) |
-| `PORT_GLITCHTIP` | Host port for GlitchTip UI (default: `3002`) |
-| `PORT_PROMETHEUS` | Host port for Prometheus UI (default: `9090`) |
-| `GRAFANA_ADMIN_PASSWORD` | Grafana `admin` login password — generate with `openssl rand -hex 32` |
-| `GLITCHTIP_SECRET_KEY` | Django secret key for GlitchTip — generate with `python3 -c "import secrets; print(secrets.token_hex(32))"` |
-| `GLITCHTIP_DOMAIN` | Public-facing base URL for GlitchTip (email links, CORS), e.g. `https://glitchtip.example.com` |
-| `SENTRY_DSN` | GlitchTip/Sentry DSN for the backend (Spring Boot) — leave empty to disable |
-| `VITE_SENTRY_DSN` | GlitchTip/Sentry DSN for the frontend (SvelteKit) — injected at build time via Vite |
-
-## Observability
-
-→ See [docs/OBSERVABILITY.md](./docs/OBSERVABILITY.md) — where to look for logs, traces, metrics, and errors.
-
 ## API Testing
 
 HTTP test files are in `backend/api_tests/` for use with the VS Code REST Client extension.

CONTRIBUTING.md

@@ -263,7 +263,7 @@ if (!result.response.ok) {
 return { person: result.data! }; // non-null assertion is safe after the ok check
 ```
 
-For multipart/form-data (file uploads): bypass the typed client and use `event.fetch` directly — never global `fetch`. The typed client cannot handle multipart bodies, but `event.fetch` is still required so that `handleFetch` injects the session cookie.
+For multipart/form-data (file uploads): bypass the typed client and use raw `fetch` — the client cannot handle it.
 
 ### Date handling
 

backend/CLAUDE.md

@@ -24,7 +24,6 @@ Spring Boot 4.0 monolith serving the Familienarchiv REST API. Handles document m
 ```
 src/main/java/org/raddatz/familienarchiv/
 ├── audit/               # Audit logging (AuditService, AuditLogQueryService)
-├── auth/                # AuthService, AuthSessionController, LoginRequest (Spring Session JDBC — ADR-020)
 ├── config/              # Infrastructure config (MinioConfig, AsyncConfig, WebConfig)
 ├── dashboard/           # Dashboard analytics + StatsController/StatsService
 ├── document/            # Document domain — entities, controller, service, repository, DTOs
@@ -41,7 +40,7 @@ src/main/java/org/raddatz/familienarchiv/
 │   └── relationship/    # PersonRelationship sub-domain
 ├── security/            # SecurityConfig, Permission, @RequirePermission, PermissionAspect
 ├── tag/                 # Tag domain — Tag, TagService, TagController
-└── user/                # User domain — AppUser, UserGroup, UserService
+└── user/                # User domain — AppUser, UserGroup, UserService, auth controllers
 ```
 
 For per-domain ownership and public surface, see each domain's `README.md`.
@@ -97,10 +96,7 @@ public class MyEntity {
 
 - Annotated with `@Service`, `@RequiredArgsConstructor`, optionally `@Slf4j`.
 - Write methods: `@Transactional`.
-- Read methods: no annotation (default non-transactional) — **except** when the method returns
+- Read methods: no annotation (default non-transactional).
-  an entity whose lazy associations must remain accessible to the caller after the method
-  returns. In that case, use `@Transactional(readOnly = true)` to keep the Hibernate session
-  open. Removing this annotation causes `LazyInitializationException` in production. See ADR-022.
 - Cross-domain access goes through the other domain's service, never its repository.
 
 ## Error Handling

backend/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>4.0.6</version>
+		<version>4.0.0</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>org.raddatz</groupId>
@@ -29,30 +29,11 @@
 	<properties>
 		<java.version>21</java.version>
 	</properties>
-	<dependencyManagement>
-		<dependencies>
-			<!-- opentelemetry-spring-boot-starter:2.27.0 was built against opentelemetry-api:1.61.0,
-			     but Spring Boot 4.0.0 BOM only manages 1.55.0 (missing GlobalOpenTelemetry.getOrNoop()).
-			     Import the core OTel BOM here to override it before the Spring Boot BOM applies. -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.61.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-actuator</artifactId>
 		</dependency>
-		<!-- Spring Boot 4.0 splits Micrometer metrics export (incl. Prometheus scrape endpoint) into its own starter -->
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-micrometer-metrics</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-validation</artifactId>
@@ -69,10 +50,6 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-security</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-session-jdbc</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-webmvc</artifactId>
@@ -180,16 +157,11 @@
 			<artifactId>flyway-database-postgresql</artifactId>
 		</dependency>
 
-		<!-- Caffeine cache + Bucket4j for in-memory rate limiting -->
+		<!-- Caffeine cache for in-memory rate limiting -->
 		<dependency>
 			<groupId>com.github.ben-manes.caffeine</groupId>
 			<artifactId>caffeine</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>com.bucket4j</groupId>
-			<artifactId>bucket4j-core</artifactId>
-			<version>8.10.1</version>
-		</dependency>
 
 		<!-- OpenAPI / Swagger UI — enabled only in the dev Spring profile -->
 		<dependency>
@@ -216,50 +188,7 @@
 		<dependency>
 			<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
 			<artifactId>owasp-java-html-sanitizer</artifactId>
-			<version>20260101.1</version>
+			<version>20240325.1</version>
-		</dependency>
-
-		<!-- HTML → plain-text extraction for comment previews -->
-		<dependency>
-			<groupId>org.jsoup</groupId>
-			<artifactId>jsoup</artifactId>
-			<version>1.18.1</version>
-		</dependency>
-
-		<!-- Observability: Prometheus metrics scrape endpoint (version managed by Spring Boot BOM) -->
-		<dependency>
-			<groupId>io.micrometer</groupId>
-			<artifactId>micrometer-registry-prometheus</artifactId>
-		</dependency>
-
-		<!-- Observability: Micrometer → OpenTelemetry tracing bridge (version managed by Spring Boot BOM) -->
-		<dependency>
-			<groupId>io.micrometer</groupId>
-			<artifactId>micrometer-tracing-bridge-otel</artifactId>
-		</dependency>
-
-		<!-- Observability: OTel Spring Boot auto-instrumentation — NOT in Spring Boot BOM, pinned explicitly -->
-		<dependency>
-			<groupId>io.opentelemetry.instrumentation</groupId>
-			<artifactId>opentelemetry-spring-boot-starter</artifactId>
-			<version>2.27.0</version>
-			<exclusions>
-				<!-- Excludes AzureAppServiceResourceProvider which references ServiceAttributes.SERVICE_INSTANCE_ID
-				     that does not exist in the semconv version pulled by this project. -->
-				<exclusion>
-					<groupId>io.opentelemetry.contrib</groupId>
-					<artifactId>opentelemetry-azure-resources</artifactId>
-				</exclusion>
-			</exclusions>
-		</dependency>
-
-		<!-- Sentry error reporting (GlitchTip-compatible) — sentry-spring-boot-4 is the
-		     Spring Boot 4 / Spring Framework 7 compatible module (replaces the jakarta starter
-		     which crashes with SF7 due to bean-name generation for triply-nested @Import classes) -->
-		<dependency>
-			<groupId>io.sentry</groupId>
-			<artifactId>sentry-spring-boot-4</artifactId>
-			<version>8.41.0</version>
 		</dependency>
 	</dependencies>
 
@@ -306,7 +235,7 @@
 						<phase>verify</phase>
 						<goals><goal>report</goal></goals>
 					</execution>
-					<!-- Gate: ratchet at 0.77 — actual measured coverage after drift; raise via #496 -->
+					<!-- Gate: baseline 89.4% overall / service 90.2% / controller 80.0% -->
 					<execution>
 						<id>check</id>
 						<phase>verify</phase>
@@ -319,7 +248,7 @@
 										<limit>
 											<counter>BRANCH</counter>
 											<value>COVEREDRATIO</value>
-											<minimum>0.77</minimum>
+											<minimum>0.88</minimum>
 										</limit>
 									</limits>
 								</rule>
@@ -337,16 +266,6 @@
 					</profiles>
 				</configuration>
 			</plugin>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-surefire-plugin</artifactId>
-				<configuration>
-					<forkedProcessTimeoutInSeconds>600</forkedProcessTimeoutInSeconds>
-					<systemPropertyVariables>
-						<junit.jupiter.execution.timeout.default>90 s</junit.jupiter.execution.timeout.default>
-					</systemPropertyVariables>
-				</configuration>
-			</plugin>
 		</plugins>
 	</build>
 

backend/src/main/java/org/raddatz/familienarchiv/audit/AuditKind.java

@@ -35,22 +35,7 @@ public enum AuditKind {
     USER_DELETED,
 
     /** Payload: {@code {"userId": "uuid", "email": "addr", "addedGroups": ["Admin"], "removedGroups": []}} */
-    GROUP_MEMBERSHIP_CHANGED,
+    GROUP_MEMBERSHIP_CHANGED;
-
-    /** Payload: {@code {"userId": "uuid", "ip": "1.2.3.4", "ua": "Mozilla/5.0..."}} */
-    LOGIN_SUCCESS,
-
-    /** Payload: {@code {"email": "addr", "ip": "1.2.3.4", "ua": "Mozilla/5.0..."}} — password NEVER included */
-    LOGIN_FAILED,
-
-    /** Payload: {@code {"userId": "uuid", "ip": "1.2.3.4", "ua": "Mozilla/5.0...", "reason": "password_change|password_reset|admin_force_logout", "revokedCount": 3}} */
-    LOGOUT,
-
-    /** Payload: {@code {"actorId": "uuid", "targetUserId": "uuid", "revokedCount": 3}} */
-    ADMIN_FORCE_LOGOUT,
-
-    /** Payload: {@code {"ip": "1.2.3.4", "email": "addr"}} — password NEVER included */
-    LOGIN_RATE_LIMITED;
 
     public static final Set<AuditKind> ROLLUP_ELIGIBLE = Set.of(
             TEXT_SAVED, FILE_UPLOADED, ANNOTATION_CREATED,

backend/src/main/java/org/raddatz/familienarchiv/auth/AuthService.java

@@ -1,84 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.UserService;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.stereotype.Service;
-
-import java.util.Map;
-import java.util.UUID;
-
-@Service
-@RequiredArgsConstructor
-@Slf4j
-public class AuthService {
-
-    private final AuthenticationManager authenticationManager;
-    private final UserService userService;
-    private final AuditService auditService;
-    private final LoginRateLimiter loginRateLimiter;
-    private final SessionRevocationPort sessionRevocationPort;
-
-    public LoginResult login(String email, String password, String ip, String ua) {
-        try {
-            loginRateLimiter.checkAndConsume(ip, email);
-        } catch (DomainException ex) {
-            auditService.log(AuditKind.LOGIN_RATE_LIMITED, null, null, Map.of(
-                    "ip", ip,
-                    "email", email));
-            throw ex;
-        }
-        try {
-            Authentication auth = authenticationManager.authenticate(
-                    new UsernamePasswordAuthenticationToken(email, password));
-
-            AppUser user = userService.findByEmail(email);
-            auditService.log(AuditKind.LOGIN_SUCCESS, user.getId(), null, Map.of(
-                    "userId", user.getId().toString(),
-                    "ip", ip,
-                    "ua", truncateUa(ua)));
-            loginRateLimiter.invalidateOnSuccess(ip, email);
-            return new LoginResult(user, auth);
-        } catch (AuthenticationException ex) {
-            // Audit login failure — intentionally does NOT log the attempted password.
-            // DaoAuthenticationProvider already runs a dummy BCrypt on unknown users to
-            // equalise timing between "user not found" and "wrong password" paths.
-            auditService.log(AuditKind.LOGIN_FAILED, null, null, Map.of(
-                    "email", email,
-                    "ip", ip,
-                    "ua", truncateUa(ua)));
-            throw DomainException.invalidCredentials();
-        }
-    }
-
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        return sessionRevocationPort.revokeOtherSessions(currentSessionId, principalName);
-    }
-
-    public int revokeAllSessions(String principalName) {
-        return sessionRevocationPort.revokeAllSessions(principalName);
-    }
-
-    public void logout(String email, String ip, String ua) {
-        AppUser user = userService.findByEmail(email);
-        auditService.log(AuditKind.LOGOUT, user.getId(), null, Map.of(
-                "userId", user.getId().toString(),
-                "ip", ip,
-                "ua", truncateUa(ua)));
-    }
-
-    private static String truncateUa(String ua) {
-        if (ua == null) return "";
-        return ua.length() > 200 ? ua.substring(0, 200) : ua;
-    }
-
-    public record LoginResult(AppUser user, Authentication authentication) {}
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/AuthSessionController.java

@@ -1,102 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
-import org.springframework.web.bind.annotation.*;
-
-// @RequirePermission is intentionally absent: login is unauthenticated by design;
-// logout requires an authenticated session (enforced by SecurityConfig), not a specific permission.
-@RestController
-@RequestMapping("/api/auth")
-@RequiredArgsConstructor
-@Slf4j
-public class AuthSessionController {
-
-    private final AuthService authService;
-    private final SessionAuthenticationStrategy sessionAuthenticationStrategy;
-
-    @PostMapping("/login")
-    public ResponseEntity<AppUser> login(
-            @RequestBody LoginRequest request,
-            HttpServletRequest httpRequest,
-            HttpServletResponse httpResponse) {
-
-        String ip = resolveClientIp(httpRequest);
-        String ua = resolveUserAgent(httpRequest);
-
-        AuthService.LoginResult result = authService.login(request.email(), request.password(), ip, ua);
-
-        // Session-fixation defense (CWE-384): rotate the session ID at the authentication
-        // boundary. ChangeSessionIdAuthenticationStrategy invalidates any pre-auth session ID
-        // an attacker may have planted and mints a fresh one before we attach the SecurityContext.
-        httpRequest.getSession(true);
-        sessionAuthenticationStrategy.onAuthentication(result.authentication(), httpRequest, httpResponse);
-
-        // Spring Session JDBC intercepts setAttribute() and persists the record under the
-        // (now rotated) opaque ID; the Set-Cookie: fa_session=<opaque-id> is added automatically.
-        SecurityContext context = SecurityContextHolder.createEmptyContext();
-        context.setAuthentication(result.authentication());
-        SecurityContextHolder.setContext(context);
-        httpRequest.getSession()
-                .setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, context);
-
-        return ResponseEntity.ok(result.user());
-    }
-
-    @PostMapping("/logout")
-    public ResponseEntity<Void> logout(Authentication authentication, HttpServletRequest httpRequest) {
-        String email = authentication.getName();
-        String ip = resolveClientIp(httpRequest);
-        String ua = resolveUserAgent(httpRequest);
-
-        // CWE-613 defense: invalidate the session first — that is the contract the user
-        // is relying on when they click "Log out." Audit is best-effort and must not
-        // bubble up: if the user record was deleted while the session was live, the
-        // audit lookup throws, but the session row in spring_session must still die.
-        HttpSession session = httpRequest.getSession(false);
-        if (session != null) {
-            session.invalidate();
-        }
-        SecurityContextHolder.clearContext();
-
-        try {
-            authService.logout(email, ip, ua);
-        } catch (Exception ex) {
-            log.warn("Audit logout failed for {}; session was already invalidated", email, ex);
-        }
-
-        return ResponseEntity.noContent().build();
-    }
-
-    /**
-     * Resolves the client IP for audit-log purposes.
-     *
-     * <p>Trust model: the leftmost {@code X-Forwarded-For} value is taken at face value.
-     * This is correct <em>only</em> if the ingress (Caddy in production) strips any
-     * client-supplied XFF before forwarding — otherwise an attacker can pin audit-log
-     * IPs to whatever they want. Verify the reverse-proxy config before exposing this
-     * service behind a different ingress.
-     */
-    private static String resolveClientIp(HttpServletRequest request) {
-        String forwarded = request.getHeader("X-Forwarded-For");
-        if (forwarded != null && !forwarded.isBlank()) {
-            return forwarded.split(",")[0].trim();
-        }
-        return request.getRemoteAddr();
-    }
-
-    private static String resolveUserAgent(HttpServletRequest request) {
-        String ua = request.getHeader("User-Agent");
-        return ua != null ? ua : "";
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapter.java

@@ -1,29 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.RequiredArgsConstructor;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-@RequiredArgsConstructor
-class JdbcSessionRevocationAdapter implements SessionRevocationPort {
-
-    private final JdbcIndexedSessionRepository sessionRepository;
-
-    @Override
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        int count = 0;
-        for (String id : sessionRepository.findByPrincipalName(principalName).keySet()) {
-            if (!id.equals(currentSessionId)) {
-                sessionRepository.deleteById(id);
-                count++;
-            }
-        }
-        return count;
-    }
-
-    @Override
-    public int revokeAllSessions(String principalName) {
-        var sessions = sessionRepository.findByPrincipalName(principalName);
-        sessions.keySet().forEach(sessionRepository::deleteById);
-        return sessions.size();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/LoginRateLimiter.java

@@ -1,72 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import com.github.benmanes.caffeine.cache.Caffeine;
-import com.github.benmanes.caffeine.cache.LoadingCache;
-import io.github.bucket4j.Bandwidth;
-import io.github.bucket4j.Bucket;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.springframework.stereotype.Service;
-
-import java.time.Duration;
-import java.util.Locale;
-import java.util.concurrent.TimeUnit;
-
-@Service
-@Slf4j
-public class LoginRateLimiter {
-
-    private final LoadingCache<String, Bucket> byIpEmail;
-    private final LoadingCache<String, Bucket> byIp;
-    private final int maxPerIpEmail;
-    private final int maxPerIp;
-    private final int windowMinutes;
-
-    public LoginRateLimiter(RateLimitProperties props) {
-        this.maxPerIpEmail = props.getMaxAttemptsPerIpEmail();
-        this.maxPerIp = props.getMaxAttemptsPerIp();
-        this.windowMinutes = props.getWindowMinutes();
-
-        this.byIpEmail = Caffeine.newBuilder()
-                .expireAfterAccess(windowMinutes, TimeUnit.MINUTES)
-                .build(key -> newBucket(maxPerIpEmail, windowMinutes));
-
-        this.byIp = Caffeine.newBuilder()
-                .expireAfterAccess(windowMinutes, TimeUnit.MINUTES)
-                .build(key -> newBucket(maxPerIp, windowMinutes));
-    }
-
-    // NOTE: This cache is node-local (in-memory). In a multi-replica deployment,
-    // effective limits would be multiplied by replica count.
-    // For the current single-VPS setup this is the correct, simplest implementation.
-
-    public void checkAndConsume(String ip, String email) {
-        long retryAfterSeconds = windowMinutes * 60L;
-        String key = ip + ":" + email.toLowerCase(Locale.ROOT);
-        if (!byIpEmail.get(key).tryConsume(1)) {
-            throw DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS,
-                    "Too many login attempts from " + ip, retryAfterSeconds);
-        }
-        if (!byIp.get(ip).tryConsume(1)) {
-            // Refund the ipEmail token so IP-level blocking does not erode the per-email quota.
-            byIpEmail.get(key).addTokens(1);
-            throw DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS,
-                    "Too many login attempts from " + ip, retryAfterSeconds);
-        }
-    }
-
-    public void invalidateOnSuccess(String ip, String email) {
-        byIpEmail.invalidate(ip + ":" + email.toLowerCase(Locale.ROOT));
-        byIp.invalidate(ip);
-    }
-
-    private static Bucket newBucket(int limit, int minutes) {
-        return Bucket.builder()
-                .addLimit(Bandwidth.builder()
-                        .capacity(limit)
-                        .refillGreedy(limit, Duration.ofMinutes(minutes))
-                        .build())
-                .build();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/LoginRequest.java

@@ -1,3 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-public record LoginRequest(String email, String password) {}

backend/src/main/java/org/raddatz/familienarchiv/auth/NoOpSessionRevocationAdapter.java

@@ -1,14 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-class NoOpSessionRevocationAdapter implements SessionRevocationPort {
-
-    @Override
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        return 0;
-    }
-
-    @Override
-    public int revokeAllSessions(String principalName) {
-        return 0;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/RateLimitProperties.java

@@ -1,14 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.Data;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.stereotype.Component;
-
-@Component
-@ConfigurationProperties("rate-limit.login")
-@Data
-public class RateLimitProperties {
-    private int maxAttemptsPerIpEmail = 10;
-    private int maxAttemptsPerIp = 20;
-    private int windowMinutes = 15;
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/SessionRevocationConfig.java

@@ -1,19 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-@Configuration
-class SessionRevocationConfig {
-
-    @Bean
-    SessionRevocationPort sessionRevocationPort(
-            @Autowired(required = false) JdbcIndexedSessionRepository sessionRepository) {
-        if (sessionRepository != null) {
-            return new JdbcSessionRevocationAdapter(sessionRepository);
-        }
-        return new NoOpSessionRevocationAdapter();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/SessionRevocationPort.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-public interface SessionRevocationPort {
-    int revokeOtherSessions(String currentSessionId, String principalName);
-    int revokeAllSessions(String principalName);
-}

backend/src/main/java/org/raddatz/familienarchiv/config/RateLimitInterceptor.java

@@ -28,7 +28,6 @@ public class RateLimitInterceptor implements HandlerInterceptor {
         AtomicInteger count = requestCounts.get(ip, k -> new AtomicInteger(0));
         if (count.incrementAndGet() > MAX_REQUESTS_PER_MINUTE) {
             response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
-            response.setHeader("Retry-After", "60");
             response.getWriter().write("{\"code\":\"RATE_LIMIT_EXCEEDED\",\"message\":\"Too many requests\"}");
             return false;
         }

backend/src/main/java/org/raddatz/familienarchiv/config/SpringSessionConfig.java

@@ -1,22 +0,0 @@
-package org.raddatz.familienarchiv.config;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.session.web.http.CookieSerializer;
-import org.springframework.session.web.http.DefaultCookieSerializer;
-
-@Configuration
-public class SpringSessionConfig {
-
-    @Bean
-    public CookieSerializer cookieSerializer() {
-        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
-        serializer.setCookieName("fa_session");
-        serializer.setSameSite("Strict");
-        // cookieHttpOnly: true is the DefaultCookieSerializer default
-        // useSecureCookie not set: auto-detects from request.isSecure().
-        // With forward-headers-strategy: native, Caddy's X-Forwarded-Proto: https
-        // causes isSecure() → true in production; direct HTTP in dev/tests → false.
-        return serializer;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/dashboard/ActivityFeedItemDTO.java

@@ -29,11 +29,5 @@ public record ActivityFeedItemDTO(
                 requiredMode = Schema.RequiredMode.NOT_REQUIRED,
                 description = "Annotation associated with the comment; populated only for COMMENT_ADDED and MENTION_CREATED kinds."
         )
-        UUID annotationId,
+        UUID annotationId
-        @Nullable
-        @Schema(
-                requiredMode = Schema.RequiredMode.NOT_REQUIRED,
-                description = "Plain-text preview of the comment body (HTML stripped server-side, truncated to 120 chars); null for non-comment feed items or deleted comments."
-        )
-        String commentPreview
 ) {}

backend/src/main/java/org/raddatz/familienarchiv/dashboard/DashboardService.java

@@ -12,7 +12,6 @@ import org.raddatz.familienarchiv.document.Document;
 import org.raddatz.familienarchiv.person.Person;
 import org.raddatz.familienarchiv.document.transcription.TranscriptionBlock;
 import org.raddatz.familienarchiv.document.comment.CommentService;
-import org.raddatz.familienarchiv.document.comment.CommentData;
 import org.raddatz.familienarchiv.document.DocumentService;
 import org.raddatz.familienarchiv.document.transcription.TranscriptionService;
 import org.raddatz.familienarchiv.user.UserService;
@@ -134,9 +133,9 @@ public class DashboardService {
                 .filter(Objects::nonNull)
                 .distinct()
                 .toList();
-        Map<UUID, CommentData> commentDataByComment = commentIds.isEmpty()
+        Map<UUID, UUID> annotationByComment = commentIds.isEmpty()
                 ? Map.of()
-                : commentService.findDataByIds(commentIds);
+                : commentService.findAnnotationIdsByIds(commentIds);
 
         return rows.stream().map(row -> {
             ActivityActorDTO actor = row.getActorId() != null
@@ -147,10 +146,7 @@ public class DashboardService {
                     ? row.getHappenedAtUntil().atOffset(ZoneOffset.UTC)
                     : null;
             UUID commentId = row.getCommentId();
-            CommentData commentData = commentId != null ? commentDataByComment.get(commentId) : null;
+            UUID annotationId = commentId != null ? annotationByComment.get(commentId) : null;
-            UUID annotationId = commentData != null ? commentData.annotationId() : null;
-            String commentPreview = commentData != null && !commentData.preview().isBlank()
-                    ? commentData.preview() : null;
             return new ActivityFeedItemDTO(
                     org.raddatz.familienarchiv.audit.AuditKind.valueOf(row.getKind()),
                     actor,
@@ -162,8 +158,7 @@ public class DashboardService {
                     row.getCount(),
                     happenedAtUntil,
                     commentId,
-                    annotationId,
+                    annotationId
-                    commentPreview
             );
         }).toList();
     }

backend/src/main/java/org/raddatz/familienarchiv/dashboard/StatsDTO.java

@@ -1,12 +1,7 @@
 package org.raddatz.familienarchiv.dashboard;
 
-import io.swagger.v3.oas.annotations.media.Schema;
-
 /**
  * Aggregate counts for the dashboard/persons stats bar.
  */
-public record StatsDTO(
+public record StatsDTO(long totalPersons, long totalDocuments) {
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED) long totalPersons,
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED) long totalDocuments,
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED) long totalStories) {
 }

backend/src/main/java/org/raddatz/familienarchiv/dashboard/StatsService.java

@@ -2,7 +2,6 @@ package org.raddatz.familienarchiv.dashboard;
 
 import lombok.RequiredArgsConstructor;
 import org.raddatz.familienarchiv.document.DocumentService;
-import org.raddatz.familienarchiv.geschichte.GeschichteService;
 import org.raddatz.familienarchiv.person.PersonService;
 import org.raddatz.familienarchiv.dashboard.StatsDTO;
 import org.springframework.stereotype.Service;
@@ -13,9 +12,8 @@ public class StatsService {
 
     private final PersonService personService;
     private final DocumentService documentService;
-    private final GeschichteService geschichteService;
 
     public StatsDTO getStats() {
-        return new StatsDTO(personService.count(), documentService.count(), geschichteService.countPublished());
+        return new StatsDTO(personService.count(), documentService.count());
     }
 }

backend/src/main/java/org/raddatz/familienarchiv/document/DensityFilters.java

@@ -1,23 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import org.raddatz.familienarchiv.tag.TagOperator;
-
-import java.util.List;
-import java.util.UUID;
-
-/**
- * The non-date filters honoured by {@link DocumentService#getDensity(DensityFilters)}.
- * Date bounds (from/to) are deliberately excluded — see the service Javadoc for why.
- *
- * Kept as a record so the seven values are passed as one named bundle instead of a
- * positional argument list where two UUIDs (sender vs. receiver) can be swapped by
- * accident at the call site.
- */
-public record DensityFilters(
-        String text,
-        UUID sender,
-        UUID receiver,
-        List<String> tags,
-        String tagQ,
-        DocumentStatus status,
-        TagOperator tagOperator) {}

backend/src/main/java/org/raddatz/familienarchiv/document/Document.java

@@ -2,7 +2,6 @@ package org.raddatz.familienarchiv.document;
 
 import jakarta.persistence.*;
 import lombok.*;
-import org.hibernate.annotations.BatchSize;
 import org.hibernate.annotations.CreationTimestamp;
 import org.hibernate.annotations.UpdateTimestamp;
 
@@ -22,15 +21,6 @@ import java.util.HashSet;
 import java.util.Set;
 import java.util.UUID;
 
-@NamedEntityGraph(name = "Document.full", attributeNodes = {
-        @NamedAttributeNode("sender"),
-        @NamedAttributeNode("receivers"),
-        @NamedAttributeNode("tags")
-})
-@NamedEntityGraph(name = "Document.list", attributeNodes = {
-        @NamedAttributeNode("sender"),
-        @NamedAttributeNode("tags")
-})
 @Entity
 @Table(name = "documents")
 @Data // Lombok: Generiert Getter, Setter, ToString, etc.
@@ -128,27 +118,24 @@ public class Document {
     @Builder.Default
     private ScriptType scriptType = ScriptType.UNKNOWN;
 
-    @ManyToMany(fetch = FetchType.LAZY)
+    @ManyToMany(fetch = FetchType.EAGER)
     @JoinTable(name = "document_receivers", joinColumns = @JoinColumn(name = "document_id"), inverseJoinColumns = @JoinColumn(name = "person_id"))
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<Person> receivers = new HashSet<>();
 
-    @ManyToOne(fetch = FetchType.LAZY)
+    @ManyToOne
     @JoinColumn(name = "sender_id")
     private Person sender;
 
-    @ManyToMany(fetch = FetchType.LAZY)
+    @ManyToMany(fetch = FetchType.EAGER)
     @JoinTable(name = "document_tags", joinColumns = @JoinColumn(name = "document_id"), inverseJoinColumns = @JoinColumn(name = "tag_id"))
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<Tag> tags = new HashSet<>();
 
-    @ElementCollection(fetch = FetchType.LAZY)
+    @ElementCollection(fetch = FetchType.EAGER)
     @CollectionTable(name = "document_training_labels", joinColumns = @JoinColumn(name = "document_id"))
     @Column(name = "label")
     @Enumerated(EnumType.STRING)
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<TrainingLabel> trainingLabels = new HashSet<>();
 

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentController.java

@@ -3,7 +3,6 @@ package org.raddatz.familienarchiv.document;
 import java.io.IOException;
 import java.time.LocalDate;
 import java.util.ArrayList;
-import java.util.concurrent.TimeUnit;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
@@ -49,7 +48,6 @@ import org.raddatz.familienarchiv.filestorage.FileService;
 import org.raddatz.familienarchiv.user.UserService;
 import org.springframework.data.domain.Sort;
 import org.springframework.security.core.Authentication;
-import org.springframework.http.CacheControl;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -390,23 +388,6 @@ public class DocumentController {
         return ResponseEntity.ok(documentService.searchDocuments(q, from, to, senderId, receiverId, tags, tagQ, status, sort, dir, operator, pageable));
     }
 
-    @GetMapping(value = "/density", produces = MediaType.APPLICATION_JSON_VALUE)
-    public ResponseEntity<DocumentDensityResult> density(
-            @RequestParam(required = false) String q,
-            @RequestParam(required = false) UUID senderId,
-            @RequestParam(required = false) UUID receiverId,
-            @RequestParam(required = false, name = "tag") List<String> tags,
-            @RequestParam(required = false) String tagQ,
-            @Parameter(description = "Filter by document status") @RequestParam(required = false) DocumentStatus status,
-            @Parameter(description = "Tag operator: AND (default) or OR") @RequestParam(required = false) String tagOp) {
-        TagOperator operator = "OR".equalsIgnoreCase(tagOp) ? TagOperator.OR : TagOperator.AND;
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(q, senderId, receiverId, tags, tagQ, status, operator));
-        return ResponseEntity.ok()
-                .cacheControl(CacheControl.maxAge(5, TimeUnit.MINUTES).cachePrivate())
-                .body(result);
-    }
-
     // --- TRAINING LABELS ---
 
     public record TrainingLabelRequest(String label, boolean enrolled) {}

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentDensityResult.java

@@ -1,27 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import java.time.LocalDate;
-import java.util.List;
-
-/**
- * Result of the timeline density aggregation.
- *
- * <p>{@code minDate} / {@code maxDate} are intentionally not marked
- * {@code @Schema(requiredMode = REQUIRED)} — the empty-result case (no
- * documents match the filter) returns them as {@code null}, which surfaces in
- * the generated TypeScript as {@code minDate?: string | null}. Frontend code
- * must treat them as optional.
- */
-public record DocumentDensityResult(
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
-        List<MonthBucket> buckets,
-        LocalDate minDate,
-        LocalDate maxDate
-) {
-    /** The "no documents match the filter" result, with no buckets and null date bounds. */
-    public static DocumentDensityResult empty() {
-        return new DocumentDensityResult(List.of(), null, null);
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentRepository.java

@@ -7,8 +7,6 @@ import org.raddatz.familienarchiv.document.DocumentStatus;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
-import org.springframework.data.jpa.domain.Specification;
-import org.springframework.data.jpa.repository.EntityGraph;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 import org.springframework.data.jpa.repository.Query;
@@ -25,18 +23,6 @@ import java.util.UUID;
 @Repository
 public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSpecificationExecutor<Document> {
 
-    @EntityGraph("Document.full")
-    Optional<Document> findById(UUID id);
-
-    @EntityGraph("Document.list")
-    Page<Document> findAll(Specification<Document> spec, Pageable pageable);
-
-    @EntityGraph("Document.list")
-    List<Document> findAll(Specification<Document> spec);
-
-    @EntityGraph("Document.list")
-    Page<Document> findAll(Pageable pageable);
-
     // Findet ein Dokument anhand des ursprünglichen Dateinamens
     // Wichtig für den Abgleich beim Excel-Import & Datei-Upload
     Optional<Document> findByOriginalFilename(String originalFilename);
@@ -44,21 +30,17 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
     // Wie oben, gibt aber nur das erste Ergebnis zurück — sicher wenn doppelte Dateinamen existieren
     Optional<Document> findFirstByOriginalFilename(String originalFilename);
 
-    // Callers access only status/id scalar fields — no graph needed.
+    // Findet alle Dokumente mit einem bestimmten Status
+    // z.B. um alle offenen "PLACEHOLDER" zu finden
     List<Document> findByStatus(DocumentStatus status);
 
     // Prüft effizient, ob ein Dateiname schon existiert (gibt true/false zurück)
     boolean existsByOriginalFilename(String originalFilename);
 
-    // lazy – @BatchSize(50) fallback active; see ADR-022
-    @EntityGraph("Document.full")
     List<Document> findBySenderId(UUID senderId);
 
-    // lazy – @BatchSize(50) fallback active; see ADR-022
-    @EntityGraph("Document.full")
     List<Document> findByReceiversId(UUID receiverId);
 
-    // Callers access only doc.getTags() to mutate the set — receivers/sender not touched; no graph needed.
     List<Document> findByTags_Id(UUID tagId);
 
     @Query("SELECT d FROM Document d WHERE d.id NOT IN (SELECT DISTINCT dv.documentId FROM DocumentVersion dv)")
@@ -73,15 +55,12 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
 
     long countByMetadataCompleteFalse();
 
-    // No production callers — only used if a future export path iterates the full list; no graph needed.
     List<Document> findByMetadataCompleteFalse(Sort sort);
 
-    // Callers map to IncompleteDocumentDTO using only scalar fields (id, title, createdAt) — no graph needed.
     Page<Document> findByMetadataCompleteFalse(Pageable pageable);
 
     Optional<Document> findFirstByMetadataCompleteFalseAndIdNot(UUID id, Sort sort);
 
-    @EntityGraph("Document.full")
     @Query("SELECT DISTINCT d FROM Document d " +
             "JOIN d.receivers r " +
             "WHERE " +
@@ -96,7 +75,6 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             @Param("to") LocalDate to,
             Sort sort);
 
-    @EntityGraph("Document.full")
     @Query("SELECT DISTINCT d FROM Document d " +
             "LEFT JOIN d.receivers r " +
             "WHERE (d.sender.id = :personId OR r.id = :personId) " +
@@ -122,45 +100,7 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             ORDER BY ts_rank(d.search_vector, q.pq) DESC,
                      d.meta_date DESC NULLS LAST
             """)
-    // Unpaged path — for bulk-edit "select all" and density chart
+    List<UUID> findRankedIdsByFts(@Param("query") String query);
-    List<UUID> findAllMatchingIdsByFts(@Param("query") String query);
-
-    /**
-     * Returns one page of FTS-ranked document IDs with the total match count.
-     *
-     * <p>Each row contains (in column order):
-     * <ol>
-     *   <li>UUID   — document id</li>
-     *   <li>double — ts_rank score</li>
-     *   <li>long   — COUNT(*) OVER () — full match count, not page count</li>
-     * </ol>
-     *
-     * <p>Returns an empty list when the query matches no documents (including
-     * stopword-only queries where websearch_to_tsquery returns an empty tsquery).
-     * Use findAllMatchingIdsByFts for the unpaged bulk-edit path.
-     */
-    @Query(nativeQuery = true, value = """
-            WITH q AS (
-                SELECT CASE WHEN websearch_to_tsquery('german', :query)::text <> ''
-                            THEN to_tsquery('simple', regexp_replace(
-                                     websearch_to_tsquery('german', :query)::text,
-                                     '''([^'']+)''',
-                                     '''\\1'':*',
-                                     'g'))
-                       END AS pq
-            ), matches AS (
-                SELECT d.id, ts_rank(d.search_vector, q.pq) AS rank
-                FROM documents d, q
-                WHERE d.search_vector @@ q.pq
-            )
-            SELECT id, rank, COUNT(*) OVER () AS total
-            FROM matches
-            ORDER BY rank DESC, id
-            OFFSET :offset LIMIT :limit
-            """)
-    List<Object[]> findFtsPageRaw(@Param("query") String query,
-                                  @Param("offset") int offset,
-                                  @Param("limit") int limit);
 
     /**
      * Returns match-enrichment data for a set of documents identified by their IDs.

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java

@@ -48,7 +48,6 @@ import java.io.IOException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.time.LocalDate;
-import java.time.YearMonth;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -126,74 +125,6 @@ public class DocumentService {
         return titles;
     }
 
-    /**
-     * Per-month document counts for the timeline density widget (issue #385).
-     *
-     * <p>Filter-reactive: the chart recomputes when other filters (sender,
-     * receiver, tag, q, status) change so it always matches the list it sits
-     * above. Date bounds (`from`/`to`) are deliberately omitted — the chart is
-     * the surface for picking those, so it must always span the broader space
-     * the user is selecting within.
-     *
-     * <p>Implementation note: groups in memory rather than via SQL GROUP BY
-     * because the existing {@link Specification} predicates compose easily
-     * with {@code findAll(spec)} and the archive size (≈5k docs) keeps this
-     * well under the 200ms p95 target. Cache-Control: max-age=300 on the
-     * controller layer absorbs repeated browse loads.
-     *
-     * <p>Tracked in issue #481 for re-evaluation when {@code documents > 50k}
-     * — at that scale move the aggregation into SQL (GROUP BY TO_CHAR(meta_date,
-     * 'YYYY-MM')) and accept that the criteria/specification surface needs a
-     * parallel native-query path.
-     */
-    public DocumentDensityResult getDensity(DensityFilters filters) {
-        List<UUID> ftsIds = resolveFtsIds(filters.text());
-        if (ftsIds != null && ftsIds.isEmpty()) {
-            return DocumentDensityResult.empty();
-        }
-        List<LocalDate> dates = loadFilteredDates(filters, ftsIds);
-        return aggregateByMonth(dates);
-    }
-
-    /**
-     * Returns the FTS-ranked document IDs when {@code text} is non-blank, or {@code null}
-     * when no full-text query is active. An empty list means the FTS query ran but
-     * matched zero documents — the caller short-circuits on that signal.
-     */
-    private List<UUID> resolveFtsIds(String text) {
-        if (!StringUtils.hasText(text)) return null;
-        return documentRepository.findAllMatchingIdsByFts(text);
-    }
-
-    /** Loads matching documents and projects to non-null {@link LocalDate}s. */
-    private List<LocalDate> loadFilteredDates(DensityFilters filters, List<UUID> ftsIds) {
-        boolean hasFts = ftsIds != null;
-        Specification<Document> spec = buildSearchSpec(
-                hasFts, ftsIds, null, null,
-                filters.sender(), filters.receiver(),
-                filters.tags(), filters.tagQ(),
-                filters.status(), filters.tagOperator());
-        return documentRepository.findAll(spec).stream()
-                .map(Document::getDocumentDate)
-                .filter(Objects::nonNull)
-                .toList();
-    }
-
-    /** Buckets {@code dates} into one {@link MonthBucket} per YYYY-MM and computes min/max. */
-    private DocumentDensityResult aggregateByMonth(List<LocalDate> dates) {
-        if (dates.isEmpty()) return DocumentDensityResult.empty();
-        Map<String, Integer> counts = new java.util.TreeMap<>();
-        for (LocalDate d : dates) {
-            counts.merge(YearMonth.from(d).toString(), 1, Integer::sum);
-        }
-        List<MonthBucket> buckets = counts.entrySet().stream()
-                .map(e -> new MonthBucket(e.getKey(), e.getValue()))
-                .toList();
-        LocalDate minDate = dates.stream().min(LocalDate::compareTo).orElse(null);
-        LocalDate maxDate = dates.stream().max(LocalDate::compareTo).orElse(null);
-        return new DocumentDensityResult(buckets, minDate, maxDate);
-    }
-
     /**
      * Lädt eine Datei hoch.
      * - Prüft, ob ein Eintrag (aus Excel) schon existiert.
@@ -447,7 +378,6 @@ public class DocumentService {
         return saved;
     }
 
-    @Transactional
     public Document updateDocumentTags(UUID docId, List<String> tagNames) {
         Document doc = documentRepository.findById(docId)
                 .orElseThrow(() -> DomainException.notFound(ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + docId));
@@ -486,7 +416,7 @@ public class DocumentService {
         boolean hasText = StringUtils.hasText(text);
         List<UUID> rankedIds = null;
         if (hasText) {
-            rankedIds = documentRepository.findAllMatchingIdsByFts(text);
+            rankedIds = documentRepository.findRankedIdsByFts(text);
             if (rankedIds.isEmpty()) return List.of();
         }
 
@@ -636,7 +566,7 @@ public class DocumentService {
         return saved;
     }
 
-    @Transactional(readOnly = true)
+    // 0. Zuletzt aktive Dokumente (sortiert nach updatedAt DESC)
     public List<Document> getRecentActivity(int size) {
         return documentRepository.findAll(
                 PageRequest.of(0, size, Sort.by(Sort.Direction.DESC, "updatedAt"))
@@ -646,43 +576,39 @@ public class DocumentService {
     // 1. Allgemeine Suche (für das Suchfeld im Frontend)
     public DocumentSearchResult searchDocuments(String text, LocalDate from, LocalDate to, UUID sender, UUID receiver, List<String> tags, String tagQ, DocumentStatus status, DocumentSort sort, String dir, TagOperator tagOperator, Pageable pageable) {
         boolean hasText = StringUtils.hasText(text);
-
-        // Pure-text RELEVANCE: push pagination into SQL — skip findAllMatchingIdsByFts entirely (ADR-008).
-        if (isPureTextRelevance(hasText, sort, from, to, sender, receiver, tags, tagQ, status)) {
-            return relevanceSortedPageFromSql(text, pageable);
-        }
-
         List<UUID> rankedIds = null;
+
         if (hasText) {
-            rankedIds = documentRepository.findAllMatchingIdsByFts(text);
+            rankedIds = documentRepository.findRankedIdsByFts(text);
             if (rankedIds.isEmpty()) return DocumentSearchResult.of(List.of());
         }
 
         Specification<Document> spec = buildSearchSpec(
                 hasText, rankedIds, from, to, sender, receiver, tags, tagQ, status, tagOperator);
 
-        // SENDER and RECEIVER sorts load the full match set and slice in-memory.
+        // SENDER, RECEIVER and RELEVANCE sorts load the full match set and slice in memory.
         // JPA's Sort.by("sender.lastName") generates an INNER JOIN that silently drops
-        // documents with null sender/receivers. Cost scales with match count —
+        // documents with null sender/receivers; RELEVANCE maps a DB order to an external
-        // acceptable while documents stays under ~10k rows. (ADR-008)
+        // rank list. Cost scales linearly with match count — acceptable while documents
+        // stays under ~10k rows. Past that, replace with SQL-level LEFT JOIN sort.
         if (sort == DocumentSort.RECEIVER) {
-            // In-memory sort on page slice (≤ page size rows) — acceptable
             List<Document> sorted = sortByFirstReceiver(documentRepository.findAll(spec), dir);
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
         if (sort == DocumentSort.SENDER) {
-            // In-memory sort on page slice (≤ page size rows) — acceptable
             List<Document> sorted = sortBySender(documentRepository.findAll(spec), dir);
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
 
-        // RELEVANCE with active filters: load filtered subset and sort in-memory by rank.
+        // RELEVANCE: default when text present and no explicit sort given
         boolean useRankOrder = hasText && (sort == null || sort == DocumentSort.RELEVANCE);
         if (useRankOrder) {
+            List<Document> results = documentRepository.findAll(spec);
             Map<UUID, Integer> rankMap = new HashMap<>();
             for (int i = 0; i < rankedIds.size(); i++) rankMap.put(rankedIds.get(i), i);
-            List<Document> sorted = documentRepository.findAll(spec).stream()
+            List<Document> sorted = results.stream()
-                    .sorted(Comparator.comparingInt(doc -> rankMap.getOrDefault(doc.getId(), Integer.MAX_VALUE)))
+                    .sorted(Comparator.comparingInt(
+                            doc -> rankMap.getOrDefault(doc.getId(), Integer.MAX_VALUE)))
                     .toList();
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
@@ -693,39 +619,6 @@ public class DocumentService {
         return buildResultPaged(page.getContent(), text, pageable, page.getTotalElements());
     }
 
-    private static boolean isPureTextRelevance(boolean hasText, DocumentSort sort,
-            LocalDate from, LocalDate to, UUID sender, UUID receiver,
-            List<String> tags, String tagQ, DocumentStatus status) {
-        return hasText && (sort == null || sort == DocumentSort.RELEVANCE)
-                && from == null && to == null && sender == null && receiver == null
-                && (tags == null || tags.isEmpty()) && (tagQ == null || tagQ.isBlank()) && status == null;
-    }
-
-    /**
-     * Pure-text RELEVANCE path — pagination and ts_rank ordering pushed into SQL.
-     * Called when no non-text filters are active (ADR-008).
-     */
-    private DocumentSearchResult relevanceSortedPageFromSql(String text, Pageable pageable) {
-        long rawOffset = pageable.getOffset();
-        if (rawOffset > Integer.MAX_VALUE) return DocumentSearchResult.of(List.of());
-        int offset = (int) rawOffset;
-        int limit = pageable.getPageSize();
-        FtsPage ftsPage = toFtsPage(documentRepository.findFtsPageRaw(text, offset, limit));
-        if (ftsPage.hits().isEmpty()) return DocumentSearchResult.of(List.of());
-
-        // Preserve ts_rank order from SQL across the JPA findAllById call.
-        Map<UUID, Integer> rankMap = new HashMap<>();
-        List<UUID> pageIds = new ArrayList<>();
-        for (int i = 0; i < ftsPage.hits().size(); i++) {
-            rankMap.put(ftsPage.hits().get(i).id(), i);
-            pageIds.add(ftsPage.hits().get(i).id());
-        }
-        List<Document> docs = documentRepository.findAllById(pageIds).stream()
-                .sorted(Comparator.comparingInt(d -> rankMap.getOrDefault(d.getId(), Integer.MAX_VALUE)))
-                .toList();
-        return buildResultPaged(docs, text, pageable, ftsPage.total());
-    }
-
     private static <T> List<T> pageSlice(List<T> sorted, Pageable pageable) {
         int from = Math.min((int) pageable.getOffset(), sorted.size());
         int to = Math.min(from + pageable.getPageSize(), sorted.size());
@@ -765,7 +658,6 @@ public class DocumentService {
         return switch (sort) {
             case TITLE -> Sort.by(direction, "title");
             case UPLOAD_DATE -> Sort.by(direction, "createdAt");
-            case UPDATED_AT -> Sort.by(direction, "updatedAt");
             default -> Sort.by(direction, "documentDate");
         };
     }
@@ -844,7 +736,6 @@ public class DocumentService {
         documentRepository.save(doc);
     }
 
-    @Transactional(readOnly = true)
     public Document getDocumentById(UUID id) {
         Document doc = documentRepository.findById(id)
                 .orElseThrow(() -> DomainException.notFound(ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + id));
@@ -1052,28 +943,6 @@ public class DocumentService {
         return result;
     }
 
-    private static final int COL_ID = 0;
-    private static final int COL_RANK = 1;
-    private static final int COL_TOTAL = 2;
-
-    /**
-     * Maps raw Object[] rows from {@link DocumentRepository#findFtsPageRaw} to an
-     * {@link FtsPage}. Uses pattern-matching UUID cast to guard against driver-level
-     * type variance (some JDBC drivers return UUID as String).
-     */
-    private static FtsPage toFtsPage(List<Object[]> rows) {
-        if (rows.isEmpty()) return new FtsPage(List.of(), 0);
-        long total = ((Number) rows.get(0)[COL_TOTAL]).longValue();
-        List<FtsHit> hits = rows.stream()
-                .map(r -> {
-                    UUID id = r[COL_ID] instanceof UUID u ? u : UUID.fromString(r[COL_ID].toString());
-                    double rank = ((Number) r[COL_RANK]).doubleValue();
-                    return new FtsHit(id, rank);
-                })
-                .toList();
-        return new FtsPage(hits, total);
-    }
-
     /** Clean text + highlight offsets parsed from a {@code ts_headline} sentinel-delimited string. */
     public record ParsedHighlight(String cleanText, List<MatchOffset> offsets) {}
 

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentSort.java

@@ -1,5 +1,5 @@
 package org.raddatz.familienarchiv.document;
 
 public enum DocumentSort {
-    DATE, TITLE, SENDER, RECEIVER, UPLOAD_DATE, UPDATED_AT, RELEVANCE
+    DATE, TITLE, SENDER, RECEIVER, UPLOAD_DATE, RELEVANCE
 }

backend/src/main/java/org/raddatz/familienarchiv/document/FtsHit.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import java.util.UUID;
-
-/** A single document hit from a paginated FTS query — id and its ts_rank score. */
-record FtsHit(UUID id, double rank) {}

backend/src/main/java/org/raddatz/familienarchiv/document/FtsPage.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import java.util.List;
-
-/** One page of FTS results — the ranked hit list for this page and the total match count. */
-record FtsPage(List<FtsHit> hits, long total) {}

backend/src/main/java/org/raddatz/familienarchiv/document/MonthBucket.java

@@ -1,10 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-
-public record MonthBucket(
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED, example = "1915-08")
-        String month,
-        @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
-        int count
-) {}

backend/src/main/java/org/raddatz/familienarchiv/document/comment/CommentController.java

@@ -27,9 +27,7 @@ public class CommentController {
     // ─── Block (transcription) comments ────────────────────────────────────────
 
     @GetMapping("/api/documents/{documentId}/transcription-blocks/{blockId}/comments")
-    public List<DocumentComment> getBlockComments(
+    public List<DocumentComment> getBlockComments(@PathVariable UUID blockId) {
-            @PathVariable UUID documentId,
-            @PathVariable UUID blockId) {
         return commentService.getCommentsForBlock(blockId);
     }
 
@@ -50,7 +48,6 @@ public class CommentController {
     @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public DocumentComment replyToBlockComment(
             @PathVariable UUID documentId,
-            @PathVariable UUID blockId,
             @PathVariable UUID commentId,
             @RequestBody CreateCommentDTO dto,
             Authentication authentication) {

backend/src/main/java/org/raddatz/familienarchiv/document/comment/CommentData.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.document.comment;
-
-import jakarta.annotation.Nullable;
-import java.util.UUID;
-
-public record CommentData(@Nullable UUID annotationId, String preview) {}

backend/src/main/java/org/raddatz/familienarchiv/document/comment/CommentService.java

@@ -13,7 +13,6 @@ import org.raddatz.familienarchiv.document.comment.DocumentComment;
 import org.raddatz.familienarchiv.document.transcription.TranscriptionBlock;
 import org.raddatz.familienarchiv.document.comment.CommentRepository;
 import org.raddatz.familienarchiv.notification.NotificationService;
-import org.jsoup.Jsoup;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -29,29 +28,21 @@ import java.util.UUID;
 @RequiredArgsConstructor
 public class CommentService {
 
-    private static final int PREVIEW_MAX_CHARS = 120;
-
     private final CommentRepository commentRepository;
     private final UserService userService;
     private final NotificationService notificationService;
     private final AuditService auditService;
     private final TranscriptionService transcriptionService;
 
-    public Map<UUID, CommentData> findDataByIds(Collection<UUID> commentIds) {
+    public Map<UUID, UUID> findAnnotationIdsByIds(Collection<UUID> commentIds) {
         if (commentIds == null || commentIds.isEmpty()) return Map.of();
-        Map<UUID, CommentData> result = new HashMap<>();
+        Map<UUID, UUID> result = new HashMap<>();
         for (DocumentComment c : commentRepository.findAllById(commentIds)) {
-            result.put(c.getId(), new CommentData(c.getAnnotationId(), stripAndTruncate(c.getContent())));
+            if (c.getAnnotationId() != null) result.put(c.getId(), c.getAnnotationId());
         }
         return result;
     }
 
-    private String stripAndTruncate(String html) {
-        if (html == null || html.isBlank()) return "";
-        String text = Jsoup.parse(html).text().trim();
-        return text.length() > PREVIEW_MAX_CHARS ? text.substring(0, PREVIEW_MAX_CHARS) : text;
-    }
-
     public List<DocumentComment> getCommentsForBlock(UUID blockId) {
         List<DocumentComment> roots = commentRepository.findByBlockIdAndParentIdIsNull(blockId);
         return withRepliesAndMentions(roots);

backend/src/main/java/org/raddatz/familienarchiv/exception/DomainException.java

@@ -10,21 +10,11 @@ public class DomainException extends RuntimeException {
 
     private final ErrorCode code;
     private final HttpStatus status;
-    /** Seconds until the rate-limit window resets; {@code null} when not applicable. */
-    private final Long retryAfterSeconds;
 
     public DomainException(ErrorCode code, HttpStatus status, String developerMessage) {
         super(developerMessage);
         this.code = code;
         this.status = status;
-        this.retryAfterSeconds = null;
-    }
-
-    private DomainException(ErrorCode code, HttpStatus status, String developerMessage, Long retryAfterSeconds) {
-        super(developerMessage);
-        this.code = code;
-        this.status = status;
-        this.retryAfterSeconds = retryAfterSeconds;
     }
 
     public ErrorCode getCode() {
@@ -35,11 +25,6 @@ public class DomainException extends RuntimeException {
         return status;
     }
 
-    /** Returns the {@code Retry-After} value in seconds, or {@code null} if not set. */
-    public Long getRetryAfterSeconds() {
-        return retryAfterSeconds;
-    }
-
     // --- Static factories for common cases ---
 
     public static DomainException notFound(ErrorCode code, String message) {
@@ -54,11 +39,6 @@ public class DomainException extends RuntimeException {
         return new DomainException(ErrorCode.UNAUTHORIZED, HttpStatus.UNAUTHORIZED, message);
     }
 
-    public static DomainException invalidCredentials() {
-        return new DomainException(ErrorCode.INVALID_CREDENTIALS, HttpStatus.UNAUTHORIZED,
-                "Invalid email or password");
-    }
-
     public static DomainException conflict(ErrorCode code, String message) {
         return new DomainException(code, HttpStatus.CONFLICT, message);
     }
@@ -70,12 +50,4 @@ public class DomainException extends RuntimeException {
     public static DomainException internal(ErrorCode code, String message) {
         return new DomainException(code, HttpStatus.INTERNAL_SERVER_ERROR, message);
     }
-
-    public static DomainException tooManyRequests(ErrorCode code, String message) {
-        return new DomainException(code, HttpStatus.TOO_MANY_REQUESTS, message);
-    }
-
-    public static DomainException tooManyRequests(ErrorCode code, String message, long retryAfterSeconds) {
-        return new DomainException(code, HttpStatus.TOO_MANY_REQUESTS, message, retryAfterSeconds);
-    }
 }

backend/src/main/java/org/raddatz/familienarchiv/exception/ErrorCode.java

@@ -30,8 +30,6 @@ public enum ErrorCode {
     // --- Users ---
     /** A user with the given ID or username does not exist. 404 */
     USER_NOT_FOUND,
-    /** A group with the given ID does not exist. 404 */
-    GROUP_NOT_FOUND,
     /** The supplied email address is already used by another account. 409 */
     EMAIL_ALREADY_IN_USE,
     /** The supplied current password does not match the stored hash. 400 */
@@ -54,24 +52,14 @@ public enum ErrorCode {
     INVITE_REVOKED,
     /** The invite has passed its expiry date. 410 */
     INVITE_EXPIRED,
-    /** A group cannot be deleted because one or more active invites reference it. 409 */
-    GROUP_HAS_ACTIVE_INVITES,
 
     // --- Auth ---
     /** The request is not authenticated. 401 */
     UNAUTHORIZED,
     /** The authenticated user lacks the required permission. 403 */
     FORBIDDEN,
-    /** The supplied email/password combination does not match any active account. 401 */
-    INVALID_CREDENTIALS,
-    /** The session has expired or been invalidated. 401 */
-    SESSION_EXPIRED,
     /** The password-reset token is missing, expired, or already used. 400 */
     INVALID_RESET_TOKEN,
-    /** CSRF token is missing or does not match the expected value. 403 */
-    CSRF_TOKEN_MISSING,
-    /** The login rate limit has been exceeded for this IP/email combination. 429 */
-    TOO_MANY_LOGIN_ATTEMPTS,
 
     // --- Annotations ---
     /** The annotation with the given ID does not exist. 404 */

backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java

@@ -2,7 +2,6 @@ package org.raddatz.familienarchiv.exception;
 
 import java.util.stream.Collectors;
 
-import io.sentry.Sentry;
 import jakarta.validation.ConstraintViolationException;
 import org.raddatz.familienarchiv.exception.DomainException;
 import org.raddatz.familienarchiv.exception.ErrorCode;
@@ -16,18 +15,15 @@ import org.springframework.web.server.ResponseStatusException;
 
 import lombok.extern.slf4j.Slf4j;
 
-// "Handler" is Spring's @RestControllerAdvice naming convention — not a generic suffix.
 @RestControllerAdvice
 @Slf4j
 public class GlobalExceptionHandler {
 
     @ExceptionHandler(DomainException.class)
     public ResponseEntity<ErrorResponse> handleDomain(DomainException ex) {
-        var builder = ResponseEntity.status(ex.getStatus());
+        return ResponseEntity
-        if (ex.getRetryAfterSeconds() != null) {
+            .status(ex.getStatus())
-            builder = builder.header("Retry-After", String.valueOf(ex.getRetryAfterSeconds()));
+            .body(new ErrorResponse(ex.getCode(), ex.getMessage()));
-        }
-        return builder.body(new ErrorResponse(ex.getCode(), ex.getMessage()));
     }
 
     @ExceptionHandler(MethodArgumentNotValidException.class)
@@ -66,7 +62,6 @@ public class GlobalExceptionHandler {
 
     @ExceptionHandler(Exception.class)
     public ResponseEntity<ErrorResponse> handleGeneric(Exception ex) {
-        Sentry.captureException(ex);
         log.error("Unhandled exception", ex);
         return ResponseEntity.internalServerError()
             .body(new ErrorResponse(ErrorCode.INTERNAL_ERROR, "An unexpected error occurred"));

backend/src/main/java/org/raddatz/familienarchiv/geschichte/GeschichteService.java

@@ -56,10 +56,6 @@ public class GeschichteService {
 
     // ─── Read API ────────────────────────────────────────────────────────────
 
-    public long countPublished() {
-        return geschichteRepository.count(GeschichteSpecifications.hasStatus(GeschichteStatus.PUBLISHED));
-    }
-
     public Geschichte getById(UUID id) {
         Geschichte g = geschichteRepository.findById(id)
                 .orElseThrow(() -> DomainException.notFound(
@@ -81,10 +77,8 @@ public class GeschichteService {
         GeschichteStatus effective = currentUserHasBlogWrite() ? status : GeschichteStatus.PUBLISHED;
         int safeLimit = limit <= 0 ? DEFAULT_LIMIT : Math.min(limit, MAX_LIMIT);
 
-        UUID authorId = effective == GeschichteStatus.DRAFT ? currentUser().getId() : null;
         Specification<Geschichte> spec = Specification.allOf(
                 GeschichteSpecifications.hasStatus(effective),
-                GeschichteSpecifications.hasAuthor(authorId),
                 GeschichteSpecifications.hasAllPersons(personIds),
                 GeschichteSpecifications.hasDocument(documentId),
                 GeschichteSpecifications.orderByDisplayDateDesc()

backend/src/main/java/org/raddatz/familienarchiv/geschichte/GeschichteSpecifications.java

@@ -42,12 +42,6 @@ public final class GeschichteSpecifications {
         };
     }
 
-    // null authorId → no restriction (PUBLISHED path passes null; Spring Data skips null predicates)
-    public static Specification<Geschichte> hasAuthor(UUID authorId) {
-        return (root, query, cb) ->
-                authorId == null ? null : cb.equal(root.get("author").get("id"), authorId);
-    }
-
     public static Specification<Geschichte> hasDocument(UUID documentId) {
         return (root, query, cb) -> {
             if (documentId == null) return null;

backend/src/main/java/org/raddatz/familienarchiv/importing/MassImportService.java

@@ -1,8 +1,5 @@
 package org.raddatz.familienarchiv.importing;
 
-import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.poi.ss.usermodel.*;
@@ -33,7 +30,6 @@ import javax.xml.parsers.DocumentBuilderFactory;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -56,33 +52,9 @@ public class MassImportService {
 
     public enum State { IDLE, RUNNING, DONE, FAILED }
 
-    public record SkippedFile(
+    public record ImportStatus(State state, String message, int processed, LocalDateTime startedAt) {}
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String filename,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String reason
-    ) {}
 
-    public record ImportStatus(
+    private volatile ImportStatus currentStatus = new ImportStatus(State.IDLE, "Kein Import gestartet.", 0, null);
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) State state,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String statusCode,
-            @JsonIgnore String message,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) int processed,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) List<SkippedFile> skippedFiles,
-            LocalDateTime startedAt
-    ) {
-        // Note: @Schema on a record accessor method is not picked up by SpringDoc; the
-        // "skipped" count is a computed convenience field derived from skippedFiles.size().
-        @JsonProperty("skipped")
-        public int skipped() { return skippedFiles.size(); }
-
-        /** Defensive-copy constructor — callers cannot mutate the stored list after construction. */
-        public ImportStatus {
-            skippedFiles = List.copyOf(skippedFiles);
-        }
-    }
-
-    record ProcessResult(int processed, List<SkippedFile> skippedFiles) {}
-
-    private volatile ImportStatus currentStatus = new ImportStatus(State.IDLE, "IMPORT_IDLE", "Kein Import gestartet.", 0, List.of(), null);
 
     public ImportStatus getStatus() {
         return currentStatus;
@@ -127,9 +99,7 @@ public class MassImportService {
     @Value("${app.import.col.transcription:13}")
     private int colTranscription;
 
-    @Value("${app.import.dir:/import}")
+    private static final String IMPORT_DIR = "/import";
-    private String importDir;
-
     private static final DateTimeFormatter GERMAN_DATE = DateTimeFormatter.ofPattern("d. MMMM yyyy", Locale.GERMAN);
 
     // ODS XML namespaces
@@ -144,39 +114,30 @@ public class MassImportService {
         if (currentStatus.state() == State.RUNNING) {
             throw DomainException.conflict(ErrorCode.IMPORT_ALREADY_RUNNING, "A mass import is already in progress");
         }
-        currentStatus = new ImportStatus(State.RUNNING, "IMPORT_RUNNING", "Import läuft...", 0, List.of(), LocalDateTime.now());
+        currentStatus = new ImportStatus(State.RUNNING, "Import läuft...", 0, LocalDateTime.now());
         try {
             File spreadsheet = findSpreadsheetFile();
             log.info("Starte Massenimport aus: {}", spreadsheet.getAbsolutePath());
-            ProcessResult result = processRows(readSpreadsheet(spreadsheet));
+            int processed = processRows(readSpreadsheet(spreadsheet));
-            currentStatus = new ImportStatus(State.DONE, "IMPORT_DONE",
+            currentStatus = new ImportStatus(State.DONE,
-                    "Import abgeschlossen. " + result.processed() + " Dokumente verarbeitet.",
+                    "Import abgeschlossen. " + processed + " Dokumente verarbeitet.",
-                    result.processed(), result.skippedFiles(), currentStatus.startedAt());
+                    processed, currentStatus.startedAt());
-        } catch (NoSpreadsheetException e) {
-            log.error("Massenimport fehlgeschlagen: keine Tabellendatei", e);
-            currentStatus = new ImportStatus(State.FAILED, "IMPORT_FAILED_NO_SPREADSHEET",
-                    "Fehler: " + e.getMessage(), 0, List.of(), currentStatus.startedAt());
         } catch (Exception e) {
             log.error("Massenimport fehlgeschlagen", e);
-            currentStatus = new ImportStatus(State.FAILED, "IMPORT_FAILED_INTERNAL",
+            currentStatus = new ImportStatus(State.FAILED, "Fehler: " + e.getMessage(), 0, currentStatus.startedAt());
-                    "Fehler: " + e.getMessage(), 0, List.of(), currentStatus.startedAt());
         }
     }
 
-    private static class NoSpreadsheetException extends RuntimeException {
-        NoSpreadsheetException(String message) { super(message); }
-    }
-
     private File findSpreadsheetFile() throws IOException {
-        try (Stream<Path> files = Files.list(Paths.get(importDir))) {
+        try (Stream<Path> files = Files.list(Paths.get(IMPORT_DIR))) {
             return files
                     .filter(p -> {
                         String name = p.toString().toLowerCase();
                         return name.endsWith(".ods") || name.endsWith(".xlsx") || name.endsWith(".xls");
                     })
                     .findFirst()
-                    .orElseThrow(() -> new NoSpreadsheetException(
+                    .orElseThrow(() -> new RuntimeException(
-                            "Keine Tabellendatei (.ods/.xlsx/.xls) in " + importDir + " gefunden!"))
+                            "Keine Tabellendatei (.ods/.xlsx/.xls) in " + IMPORT_DIR + " gefunden!"))
                     .toFile();
         }
     }
@@ -195,14 +156,14 @@ public class MassImportService {
      * Reads an ODS file by parsing its content.xml directly (no extra library needed).
      * ODS is a ZIP archive; content.xml holds the spreadsheet data as XML.
      */
-    List<List<String>> readOds(File file) throws Exception {
+    private List<List<String>> readOds(File file) throws Exception {
         List<List<String>> result = new ArrayList<>();
 
         try (ZipFile zip = new ZipFile(file)) {
             var entry = zip.getEntry("content.xml");
             if (entry == null) throw new RuntimeException("Ungültige ODS-Datei: content.xml fehlt");
 
-            var factory = XxeSafeXmlParser.hardenedFactory();
+            var factory = DocumentBuilderFactory.newInstance();
             factory.setNamespaceAware(true);
             var builder = factory.newDocumentBuilder();
             var doc = builder.parse(zip.getInputStream(entry));
@@ -281,10 +242,8 @@ public class MassImportService {
 
     // --- Import logic (works on neutral List<String> rows) ---
 
-    private ProcessResult processRows(List<List<String>> rows) {
+    private int processRows(List<List<String>> rows) {
-        int processed = 0;
+        int count = 0;
-        List<SkippedFile> skippedFiles = new ArrayList<>();
-
         for (int i = 1; i < rows.size(); i++) { // skip header row
             List<String> cells = rows.get(i);
             String index = getCell(cells, colIndex);
@@ -295,58 +254,18 @@ public class MassImportService {
             if (fileOnDisk.isEmpty()) {
                 log.warn("Datei nicht gefunden, importiere nur Metadaten: {}", filename);
             }
-
+            importSingleDocument(cells, fileOnDisk, filename, index);
-            if (fileOnDisk.isPresent()) {
+            count++;
-                try {
-                    if (!isPdfMagicBytes(fileOnDisk.get())) {
-                        log.warn("Überspringe {}: Datei beginnt nicht mit %PDF-Signatur", filename);
-                        skippedFiles.add(new SkippedFile(filename, "INVALID_PDF_SIGNATURE"));
-                        continue;
-                    }
-                } catch (IOException e) {
-                    log.error("Fehler beim Prüfen der Magic-Bytes für {}", filename, e);
-                    skippedFiles.add(new SkippedFile(filename, "FILE_READ_ERROR"));
-                    continue;
-                }
-            }
-
-            Optional<String> skipReason = importSingleDocument(cells, fileOnDisk, filename, index);
-            if (skipReason.isPresent()) {
-                skippedFiles.add(new SkippedFile(filename, skipReason.get()));
-            } else {
-                processed++;
-            }
         }
-        return new ProcessResult(processed, skippedFiles);
+        return count;
     }
 
-    // package-private: Mockito spy in tests can override to inject IOException
-    InputStream openFileStream(File file) throws IOException {
-        return new FileInputStream(file);
-    }
-
-    private boolean isPdfMagicBytes(File file) throws IOException {
-        try (InputStream is = openFileStream(file)) {
-            byte[] header = is.readNBytes(4);
-            return header.length == 4
-                    && header[0] == 0x25  // %
-                    && header[1] == 0x50  // P
-                    && header[2] == 0x44  // D
-                    && header[3] == 0x46; // F
-        }
-    }
-
-    /**
-     * Imports a single document row.
-     *
-     * @return empty Optional on success; an Optional containing the skip reason on failure/skip.
-     */
     @Transactional
-    protected Optional<String> importSingleDocument(List<String> cells, Optional<File> file, String originalFilename, String index) {
+    protected void importSingleDocument(List<String> cells, Optional<File> file, String originalFilename, String index) {
         Optional<Document> existing = documentService.findByOriginalFilename(originalFilename);
         if (existing.isPresent() && existing.get().getStatus() != DocumentStatus.PLACEHOLDER) {
             log.info("Dokument {} existiert bereits, überspringe.", originalFilename);
-            return Optional.of("ALREADY_EXISTS");
+            return;
         }
 
         String archiveBox    = getCell(cells, colBox);
@@ -382,7 +301,7 @@ public class MassImportService {
                 status = DocumentStatus.UPLOADED;
             } catch (Exception e) {
                 log.error("S3 Upload Fehler für {}", file.get().getName(), e);
-                return Optional.of("S3_UPLOAD_FAILED");
+                return;
             }
         }
 
@@ -424,7 +343,6 @@ public class MassImportService {
             thumbnailAsyncRunner.dispatchAfterCommit(saved.getId());
         }
         log.info("Importiert{}: {}", file.isEmpty() ? " (nur Metadaten)" : "", originalFilename);
-        return Optional.empty();
     }
 
     // --- Helpers ---
@@ -460,7 +378,7 @@ public class MassImportService {
     }
 
     private Optional<File> findFileRecursive(String filename) {
-        try (Stream<Path> walk = Files.walk(Paths.get(importDir))) {
+        try (Stream<Path> walk = Files.walk(Paths.get(IMPORT_DIR))) {
             return walk.filter(p -> !Files.isDirectory(p))
                     .filter(p -> p.getFileName().toString().equals(filename))
                     .map(Path::toFile)

backend/src/main/java/org/raddatz/familienarchiv/importing/XxeSafeXmlParser.java

@@ -1,20 +0,0 @@
-package org.raddatz.familienarchiv.importing;
-
-import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.parsers.ParserConfigurationException;
-
-class XxeSafeXmlParser {
-
-    private XxeSafeXmlParser() {}
-
-    static DocumentBuilderFactory hardenedFactory() throws ParserConfigurationException {
-        var factory = DocumentBuilderFactory.newInstance();
-        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
-        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
-        factory.setXIncludeAware(false);
-        factory.setExpandEntityReferences(false);
-        return factory;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/person/Person.java

@@ -1,7 +1,6 @@
 package org.raddatz.familienarchiv.person;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.persistence.*;
 import lombok.*;
@@ -10,9 +9,6 @@ import org.raddatz.familienarchiv.user.DisplayNameFormatter;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
-
-// prevents infinite recursion in JSON serialization; see ADR-022 for lazy-fetch context
-@JsonIgnoreProperties({"hibernateLazyInitializer", "handler"})
 @Entity
 @Table(name = "persons")
 @Data

backend/src/main/java/org/raddatz/familienarchiv/person/PersonController.java

@@ -35,14 +35,7 @@ public class PersonController {
 
     @GetMapping
     @RequirePermission(Permission.READ_ALL)
-    public ResponseEntity<List<PersonSummaryDTO>> getPersons(
+    public ResponseEntity<List<PersonSummaryDTO>> getPersons(@RequestParam(required = false) String q) {
-            @RequestParam(required = false) String q,
-            @RequestParam(required = false, defaultValue = "0") int size,
-            @RequestParam(required = false) String sort) {
-        if ("documentCount".equals(sort) && size > 0 && q == null) {
-            int safeSize = Math.min(size, 50);
-            return ResponseEntity.ok(personService.findTopByDocumentCount(safeSize));
-        }
         return ResponseEntity.ok(personService.findAll(q));
     }
 

backend/src/main/java/org/raddatz/familienarchiv/person/PersonRepository.java

@@ -69,22 +69,6 @@ public interface PersonRepository extends JpaRepository<Person, UUID> {
             nativeQuery = true)
     List<PersonSummaryDTO> searchWithDocumentCount(@Param("query") String query);
 
-    // ORDER BY uses the computed alias "documentCount" — valid PostgreSQL (aliases allowed in ORDER BY,
-    // unlike WHERE/HAVING). This is intentional; it would silently fail on MySQL or H2.
-    @Query(value = """
-            SELECT p.id, p.title, p.first_name AS firstName, p.last_name AS lastName,
-                   p.person_type AS personType,
-                   p.alias, p.birth_year AS birthYear, p.death_year AS deathYear, p.notes,
-                   p.family_member AS familyMember,
-                   (SELECT COUNT(*) FROM documents d WHERE d.sender_id = p.id)
-                   + (SELECT COUNT(*) FROM document_receivers dr WHERE dr.person_id = p.id) AS documentCount
-            FROM persons p
-            ORDER BY documentCount DESC
-            LIMIT :limit
-            """,
-            nativeQuery = true)
-    List<PersonSummaryDTO> findTopByDocumentCount(@Param("limit") int limit);
-
     // --- Correspondent queries ---
 
     @Query(value = """

backend/src/main/java/org/raddatz/familienarchiv/person/PersonService.java

@@ -41,10 +41,6 @@ public class PersonService {
         return personRepository.searchWithDocumentCount(q.trim());
     }
 
-    public List<PersonSummaryDTO> findTopByDocumentCount(int limit) {
-        return personRepository.findTopByDocumentCount(limit);
-    }
-
     public Person getById(UUID id) {
         return personRepository.findById(id)
                 .orElseThrow(() -> DomainException.notFound(ErrorCode.PERSON_NOT_FOUND, "Person not found: " + id));

backend/src/main/java/org/raddatz/familienarchiv/security/SecurityConfig.java

@@ -1,42 +1,24 @@
 package org.raddatz.familienarchiv.security;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.RequiredArgsConstructor;
 
-import org.raddatz.familienarchiv.exception.ErrorCode;
 import org.raddatz.familienarchiv.user.CustomUserDetailsService;
-import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.core.annotation.Order;
 import org.springframework.core.env.Environment;
-import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
-import org.springframework.security.web.csrf.CsrfException;
-import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
-
-import java.util.Map;
 
 @Configuration
 @EnableWebSecurity
 @RequiredArgsConstructor
 public class SecurityConfig {
 
-    // @WebMvcTest slices do not include JacksonAutoConfiguration, so ObjectMapper
-    // cannot be injected here. A static instance is safe because the response
-    // only serializes fixed String keys — no custom naming strategy or module needed.
-    private static final ObjectMapper ERROR_WRITER = new ObjectMapper();
-
     private final CustomUserDetailsService userDetailsService;
     private final Environment environment;
 
@@ -52,57 +34,20 @@ public class SecurityConfig {
         return authProvider;
     }
 
-    @Bean
-    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
-        return config.getAuthenticationManager();
-    }
-
-    @Bean
-    public SessionAuthenticationStrategy sessionAuthenticationStrategy() {
-        // ChangeSessionIdAuthenticationStrategy rotates the session ID via the Servlet 3.1+
-        // HttpServletRequest.changeSessionId() — preserves attributes, mints a fresh ID.
-        // Used by AuthSessionController.login to defend against session fixation (CWE-384).
-        return new ChangeSessionIdAuthenticationStrategy();
-    }
-
-    @Bean
-    @Order(1)
-    public SecurityFilterChain managementFilterChain(HttpSecurity http) throws Exception {
-        http
-                .securityMatcher("/actuator/**")
-                .authorizeHttpRequests(auth -> {
-                    // Health and Prometheus are open — Docker health checks and Prometheus scraping need no credentials.
-                    auth.requestMatchers("/actuator/health", "/actuator/prometheus").permitAll();
-                    // All other actuator endpoints (metrics, info, env, heapdump…) require authentication.
-                    auth.anyRequest().authenticated();
-                })
-                // Explicitly return 401 for any unauthenticated actuator request.
-                // Without this override, Spring Security's DelegatingAuthenticationEntryPoint
-                // would redirect browser-like clients to the form-login page (302 → /login),
-                // making it impossible to distinguish "not authenticated" from "not found" in tests.
-                .exceptionHandling(ex -> ex.authenticationEntryPoint(
-                        (req, res, e) -> res.setStatus(HttpServletResponse.SC_UNAUTHORIZED)))
-                .formLogin(AbstractHttpConfigurer::disable)
-                .csrf(AbstractHttpConfigurer::disable);
-        return http.build();
-    }
-
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         http
-                // CSRF protection via CookieCsrfTokenRepository (NFR-SEC-103).
+                // CSRF is intentionally disabled: every request from the SvelteKit frontend
-                // The backend sets an XSRF-TOKEN cookie (not HttpOnly so JS can read it).
+                // carries an explicit Authorization header (Basic Auth token injected by
-                // All state-changing requests must include X-XSRF-TOKEN matching the cookie.
+                // hooks.server.ts). Browsers block cross-origin requests from setting custom
-                // See ADR-022 and issue #524 for the full security rationale.
+                // headers, so cross-site request forgery via a third-party page is not
-                .csrf(csrf -> csrf
+                // possible with this auth scheme. If the auth model ever changes to
-                        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                // cookie-based sessions, CSRF protection must be re-enabled.
-                        .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler()))
+                .csrf(csrf -> csrf.disable())
 
                 .authorizeHttpRequests(auth -> {
-                    // Actuator endpoints are governed by managementFilterChain (@Order(1)) above.
+                    // Health endpoint must be open so CI/Docker health checks work without credentials
-                    auth.requestMatchers("/actuator/health", "/actuator/prometheus").permitAll();
+                    auth.requestMatchers("/actuator/health").permitAll();
-                    // Login is unauthenticated by definition
-                    auth.requestMatchers("/api/auth/login").permitAll();
                     // Password reset endpoints are unauthenticated by nature
                     auth.requestMatchers("/api/auth/forgot-password", "/api/auth/reset-password").permitAll();
                     // Invite-based registration endpoints are public
@@ -122,18 +67,9 @@ public class SecurityConfig {
                 // erlaubt pdf im Iframe
                 .headers(headers -> headers
                         .frameOptions(frameOptions -> frameOptions.sameOrigin()))
-                // Return 401 for unauthenticated requests; 403+CSRF_TOKEN_MISSING for CSRF failures.
+                // Erlaubt Login via Browser-Popup oder REST-Header (Authorization: Basic ...)
-                .exceptionHandling(ex -> ex
+                .httpBasic(Customizer.withDefaults())
-                        .authenticationEntryPoint(
+                .formLogin(form -> form.usernameParameter("email"));
-                                (req, res, e) -> res.setStatus(HttpServletResponse.SC_UNAUTHORIZED))
-                        .accessDeniedHandler((req, res, e) -> {
-                            res.setStatus(HttpServletResponse.SC_FORBIDDEN);
-                            res.setContentType("application/json;charset=UTF-8");
-                            ErrorCode code = (e instanceof CsrfException)
-                                    ? ErrorCode.CSRF_TOKEN_MISSING
-                                    : ErrorCode.FORBIDDEN;
-                            res.getWriter().write(ERROR_WRITER.writeValueAsString(Map.of("code", code.name())));
-                        }));
 
         return http.build();
     }

backend/src/main/java/org/raddatz/familienarchiv/security/SecurityUtils.java

@@ -7,7 +7,6 @@ import org.springframework.security.core.Authentication;
 
 import java.util.UUID;
 
-// Cross-cutting auth helper; no domain home — "Utils" is the correct suffix here.
 public final class SecurityUtils {
 
     private SecurityUtils() {}

backend/src/main/java/org/raddatz/familienarchiv/tag/Tag.java

@@ -2,13 +2,10 @@ package org.raddatz.familienarchiv.tag;
 
 import java.util.UUID;
 
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.persistence.*;
 import lombok.*;
 
-// prevents infinite recursion in JSON serialization; see ADR-022 for lazy-fetch context
-@JsonIgnoreProperties({"hibernateLazyInitializer", "handler"})
 @Entity
 @Data
 @NoArgsConstructor

backend/src/main/java/org/raddatz/familienarchiv/user/AppUser.java

@@ -88,8 +88,7 @@ public class AppUser {
     };
 
     public static String computeColor(UUID id) {
-        // Math.floorMod avoids the Integer.MIN_VALUE overflow trap in Math.abs(hashCode())
+        return PALETTE[Math.abs(id.hashCode()) % PALETTE.length];
-        return PALETTE[Math.floorMod(id.hashCode(), PALETTE.length)];
     }
 
     @PrePersist

backend/src/main/java/org/raddatz/familienarchiv/user/InviteListItemDTO.java

@@ -31,6 +31,5 @@ public class InviteListItemDTO {
     private String status;
     @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
     private LocalDateTime createdAt;
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
     private String shareableUrl;
 }

backend/src/main/java/org/raddatz/familienarchiv/user/InviteService.java

@@ -52,11 +52,7 @@ public class InviteService {
     public InviteToken createInvite(CreateInviteRequest dto, AppUser creator) {
         Set<UUID> groupIds = new HashSet<>();
         if (dto.getGroupIds() != null && !dto.getGroupIds().isEmpty()) {
-            Set<UUID> uniqueIds = new HashSet<>(dto.getGroupIds());
+            List<UserGroup> groups = userService.findGroupsByIds(dto.getGroupIds());
-            List<UserGroup> groups = userService.findGroupsByIds(new ArrayList<>(uniqueIds));
-            if (groups.size() != uniqueIds.size()) {
-                throw DomainException.notFound(ErrorCode.GROUP_NOT_FOUND, "One or more group IDs do not exist");
-            }
             groups.forEach(g -> groupIds.add(g.getId()));
         }
 

backend/src/main/java/org/raddatz/familienarchiv/user/InviteTokenRepository.java

@@ -24,7 +24,4 @@ public interface InviteTokenRepository extends JpaRepository<InviteToken, UUID>
 
     @Query("SELECT t FROM InviteToken t ORDER BY t.createdAt DESC")
     List<InviteToken> findAllOrderedByCreatedAt();
-
-    @Query("SELECT CASE WHEN COUNT(t) > 0 THEN true ELSE false END FROM InviteToken t JOIN t.groupIds g WHERE g = :groupId AND t.revoked = false AND (t.expiresAt IS NULL OR t.expiresAt > CURRENT_TIMESTAMP) AND (t.maxUses IS NULL OR t.useCount < t.maxUses)")
-    boolean existsActiveWithGroupId(@Param("groupId") UUID groupId);
 }

backend/src/main/java/org/raddatz/familienarchiv/user/PasswordResetService.java

@@ -5,7 +5,6 @@ import java.time.LocalDateTime;
 import java.util.HexFormat;
 import java.util.Optional;
 
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.raddatz.familienarchiv.user.ResetPasswordRequest;
 import org.raddatz.familienarchiv.exception.DomainException;
 import org.raddatz.familienarchiv.exception.ErrorCode;
@@ -33,7 +32,6 @@ public class PasswordResetService {
     private final UserService userService;
     private final PasswordResetTokenRepository tokenRepository;
     private final PasswordEncoder passwordEncoder;
-    private final AuthService authService;
 
     @Autowired(required = false)
     private JavaMailSender mailSender;
@@ -87,8 +85,6 @@ public class PasswordResetService {
 
         resetToken.setUsed(true);
         tokenRepository.save(resetToken);
-
-        authService.revokeAllSessions(user.getEmail());
     }
 
     /**

backend/src/main/java/org/raddatz/familienarchiv/user/UserController.java

@@ -4,11 +4,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 
-import jakarta.servlet.http.HttpSession;
 import jakarta.validation.Valid;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.raddatz.familienarchiv.user.AdminUpdateUserRequest;
 import org.raddatz.familienarchiv.user.ChangePasswordDTO;
 import org.raddatz.familienarchiv.user.CreateUserRequest;
@@ -30,15 +26,13 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 
-import lombok.RequiredArgsConstructor;
+import lombok.AllArgsConstructor;
 
 @RestController
 @RequestMapping("/api/")
-@RequiredArgsConstructor
+@AllArgsConstructor
 public class UserController {
-    private final UserService userService;
+    private UserService userService;
-    private final AuthService authService;
-    private final AuditService auditService;
 
     @GetMapping("users/me")
     public ResponseEntity<AppUser> getCurrentUser(Authentication authentication) {
@@ -62,14 +56,9 @@ public class UserController {
     @PostMapping("users/me/password")
     @ResponseStatus(HttpStatus.NO_CONTENT)
     public void changePassword(Authentication authentication,
-                               HttpSession session,
                                @RequestBody ChangePasswordDTO dto) {
         AppUser current = userService.findByEmail(authentication.getName());
         userService.changePassword(current.getId(), dto);
-        int revoked = authService.revokeOtherSessions(session.getId(), authentication.getName());
-        auditService.log(AuditKind.LOGOUT, current.getId(), null, Map.of(
-                "reason", "password_change",
-                "revokedCount", revoked));
     }
 
     @GetMapping("users/{id}")
@@ -112,18 +101,6 @@ public class UserController {
         return ResponseEntity.ok().build();
     }
 
-    @PostMapping("/users/{id}/force-logout")
-    @RequirePermission(Permission.ADMIN_USER)
-    public ResponseEntity<Map<String, Object>> forceLogout(Authentication authentication,
-                                                            @PathVariable UUID id) {
-        AppUser target = userService.getById(id);
-        int revoked = authService.revokeAllSessions(target.getEmail());
-        auditService.log(AuditKind.ADMIN_FORCE_LOGOUT, actorId(authentication), null, Map.of(
-                "targetUserId", target.getId().toString(),
-                "revokedCount", revoked));
-        return ResponseEntity.ok(Map.of("revokedCount", revoked));
-    }
-
     private UUID actorId(Authentication auth) {
         return userService.findByEmail(auth.getName()).getId();
     }

backend/src/main/java/org/raddatz/familienarchiv/user/UserDataInitializer.java

@@ -20,7 +20,6 @@ import org.springframework.boot.CommandLineRunner;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
-import org.springframework.core.env.Environment;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import java.time.LocalDate;
@@ -32,51 +31,26 @@ import java.util.Set;
 @DependsOn("flyway")
 public class UserDataInitializer {
 
-    static final String DEFAULT_ADMIN_EMAIL = "admin@familienarchiv.local";
+    @Value("${app.admin.email:admin@familyarchive.local}")
-    static final String DEFAULT_ADMIN_PASSWORD = "admin123";
-
-    @Value("${app.admin.email:" + DEFAULT_ADMIN_EMAIL + "}")
     private String adminEmail;
 
-    @Value("${app.admin.password:" + DEFAULT_ADMIN_PASSWORD + "}")
+    @Value("${app.admin.password:admin123}")
     private String adminPassword;
 
     private final AppUserRepository userRepository;
     private final UserGroupRepository groupRepository;
-    private final Environment environment;
 
     @Bean
     public CommandLineRunner initAdminUser(PasswordEncoder passwordEncoder) {
         return args -> {
             if (userRepository.findByEmail(adminEmail).isEmpty()) {
-                // Fail-closed in production: refuse to seed with the well-known
-                // defaults. Otherwise an operator who forgets APP_ADMIN_USERNAME
-                // / APP_ADMIN_PASSWORD locks production to admin@…/admin123 PERMANENTLY
-                // (UserDataInitializer only seeds when the row is missing — see #513).
-                // Allowed in dev/test/e2e because those run without secrets configured.
-                boolean isLocalProfile = environment.matchesProfiles("dev", "test", "e2e");
-                if (!isLocalProfile
-                    && (DEFAULT_ADMIN_EMAIL.equals(adminEmail)
-                        || DEFAULT_ADMIN_PASSWORD.equals(adminPassword))) {
-                    throw new IllegalStateException(
-                        "Refusing to seed admin user with default credentials outside "
-                        + "the dev/test/e2e profiles. Set APP_ADMIN_USERNAME and "
-                        + "APP_ADMIN_PASSWORD to non-default values before first boot — "
-                        + "this lock-in is permanent."
-                    );
-                }
                 log.info("Kein Admin-User '{}' gefunden. Erstelle Default-Admin...", adminEmail);
 
-                // Reuse the Administrators group if it already exists (e.g. a
+                UserGroup adminGroup = UserGroup.builder()
-                // previous boot seeded the group but failed before creating
+                        .name("Administrators")
-                // the admin user, or the operator deleted just the user row
+                        .permissions(Set.of("ADMIN", "READ_ALL", "WRITE_ALL", "ANNOTATE_ALL", "ADMIN_USER", "ADMIN_TAG", "ADMIN_PERMISSION"))
-                // to retry the seed with a new email). Blind-INSERTing would
+                        .build();
-                // violate user_groups_name_key and abort the context. See #518.
+                groupRepository.save(adminGroup);
-                UserGroup adminGroup = groupRepository.findByName("Administrators")
-                        .orElseGet(() -> groupRepository.save(UserGroup.builder()
-                                .name("Administrators")
-                                .permissions(Set.of("ADMIN", "READ_ALL", "WRITE_ALL", "ANNOTATE_ALL", "ADMIN_USER", "ADMIN_TAG", "ADMIN_PERMISSION"))
-                                .build()));
 
                 AppUser admin = AppUser.builder()
                         .email(adminEmail)

backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java

@@ -37,9 +37,6 @@ public class UserService {
 
     private final AppUserRepository userRepository;
     private final UserGroupRepository groupRepository;
-    // Injected directly (not via InviteService) to avoid a constructor injection cycle:
-    // InviteService → UserService → InviteService. Spring Framework 7 forbids such cycles.
-    private final InviteTokenRepository inviteTokenRepository;
     private final PasswordEncoder passwordEncoder;
     private final AuditService auditService;
 
@@ -274,10 +271,9 @@ public class UserService {
 
     @Transactional
     public UserGroup createGroup(GroupDTO dto) {
-        UserGroup group = UserGroup.builder()
+        UserGroup group = new UserGroup();
-                .name(dto.getName())
+        group.setName(dto.getName());
-                .permissions(dto.getPermissions() != null ? dto.getPermissions() : new HashSet<>())
+        group.setPermissions(dto.getPermissions());
-                .build();
         return groupRepository.save(group);
     }
 
@@ -291,10 +287,6 @@ public class UserService {
 
     @Transactional
     public void deleteGroup(UUID id) {
-        if (inviteTokenRepository.existsActiveWithGroupId(id)) {
-            throw DomainException.conflict(ErrorCode.GROUP_HAS_ACTIVE_INVITES,
-                    "Cannot delete group " + id + " — referenced by one or more active invites");
-        }
         groupRepository.deleteById(id);
     }
 }

backend/src/main/resources/application-dev.yaml

@@ -1,9 +1,6 @@
 spring:
   jpa:
     show-sql: true
-  # spring.session.cookie.secure is no longer a supported Boot 4.x property.
-  # DefaultCookieSerializer auto-detects Secure from request.isSecure().
-  # Direct HTTP in dev → isSecure()=false → cookie sent without Secure attribute.
 
 springdoc:
   api-docs:

backend/src/main/resources/application.yaml

@@ -38,64 +38,10 @@ spring:
           starttls:
             enable: true
 
-  session:
-    timeout: 28800s  # 8 h idle timeout (MaxInactiveIntervalInSeconds)
-    jdbc:
-      initialize-schema: never  # Flyway owns schema creation (V67)
-    # Cookie name, SameSite, and Secure are configured via SpringSessionConfig#cookieSerializer
-    # (spring.session.cookie.* is not supported in Spring Boot 4.x).
-
-server:
-  # Behind Caddy/reverse proxy: trust X-Forwarded-{Proto,For,Host} so that
-  # request.getScheme(), redirect URLs, and Spring Session "Secure" cookies
-  # reflect the original https client request, not the http hop from Caddy.
-  forward-headers-strategy: native
-
 management:
-  server:
-    # Management port is separate from the app port so that:
-    # (a) Caddy never proxies /actuator/* (it only routes :8080 → the app port)
-    # (b) Prometheus scrapes backend:8081 directly inside archiv-net, not via Caddy
-    # Note: in Spring Boot 4.0 the management port shares the security filter chain; /actuator/health
-    # and /actuator/prometheus must be explicitly permitted in SecurityConfig — see SecurityConfig.java.
-    port: 8081
-  endpoints:
-    web:
-      exposure:
-        include: health,info,prometheus,metrics
-  endpoint:
-    prometheus:
-      enabled: true
-  # Spring Boot 4.0: metrics export is disabled by default — explicitly opt in for Prometheus
-  prometheus:
-    metrics:
-      export:
-        enabled: true
-  metrics:
-    tags:
-      # Common tag applied to every metric so Grafana's Spring Boot dashboard can filter by application name.
-      # Override via MANAGEMENT_METRICS_TAGS_APPLICATION env var.
-      application: ${spring.application.name}
   health:
     mail:
       enabled: false
-  tracing:
-    sampling:
-      probability: 1.0   # 100% in dev; override via MANAGEMENT_TRACING_SAMPLING_PROBABILITY in prod compose
-
-# OpenTelemetry trace export — failures are non-fatal (app starts cleanly without Tempo running)
-# Port 4318 = OTLP HTTP (the default transport for Spring Boot's HttpExporter).
-# Port 4317 is gRPC-only; sending HTTP/1.1 to it produces "Connection reset".
-otel:
-  service:
-    name: familienarchiv-backend
-  exporter:
-    otlp:
-      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:http://localhost:4318}
-  logs:
-    exporter: none   # Promtail captures Docker logs; disable OTLP log export (Tempo only accepts traces)
-  metrics:
-    exporter: none   # Prometheus scrapes /actuator/prometheus; disable OTLP metric export to Tempo
 
 springdoc:
   api-docs:
@@ -117,11 +63,7 @@ app:
     from: ${APP_MAIL_FROM:noreply@familienarchiv.local}
 
   admin:
-    # Key must be `email`, not `username` — UserDataInitializer reads
+    username: ${APP_ADMIN_USERNAME:admin}
-    # `${app.admin.email:...}`. The env-var name stays APP_ADMIN_USERNAME
-    # to match the existing Gitea secrets and DEPLOYMENT.md §3.3.
-    # See #513.
-    email: ${APP_ADMIN_USERNAME:admin@familienarchiv.local}
     password: ${APP_ADMIN_PASSWORD:admin123}
 
   import:
@@ -141,18 +83,3 @@ ocr:
   sender-model:
     activation-threshold: 100
     retrain-delta: 50
-
-sentry:
-  dsn: ${SENTRY_DSN:}
-  environment: ${SPRING_PROFILES_ACTIVE:dev}
-  traces-sample-rate: ${SENTRY_TRACES_SAMPLE_RATE:1.0}
-  send-default-pii: false
-  enable-tracing: true
-  ignored-exceptions-for-type:
-    - org.raddatz.familienarchiv.exception.DomainException
-
-rate-limit:
-  login:
-    max-attempts-per-ip-email: 10
-    max-attempts-per-ip: 20
-    window-minutes: 15

backend/src/main/resources/db/migration/V61__add_idx_documents_updated_at.sql

@@ -1 +0,0 @@
-CREATE INDEX IF NOT EXISTS idx_documents_updated_at ON documents(updated_at DESC);

backend/src/main/resources/db/migration/V62__index_fk_columns.sql

@@ -1,8 +0,0 @@
--- Speeds up "documents by sender" queries used on /persons/[id] Korrespondenz-Überblick (#306),
--- /briefwechsel, and bulk-edit flows.
-CREATE INDEX IF NOT EXISTS idx_documents_sender_id
-    ON documents(sender_id);
-
--- Speeds up "comments by author" queries on admin user detail and (future) contributor profile.
-CREATE INDEX IF NOT EXISTS idx_comments_author_id
-    ON document_comments(author_id);

backend/src/main/resources/db/migration/V63__deduplicate_group_permissions.sql

@@ -1,7 +0,0 @@
--- Remove duplicate (group_id, permission) rows that accumulated without a UNIQUE constraint.
--- Keeps the row with the smallest ctid (earliest physical insertion order).
-DELETE FROM group_permissions a
-USING group_permissions b
-WHERE a.ctid < b.ctid
-  AND a.group_id = b.group_id
-  AND a.permission = b.permission;

backend/src/main/resources/db/migration/V64__group_permissions_primary_key.sql

@@ -1,11 +0,0 @@
--- Add NOT NULL and PRIMARY KEY to group_permissions.
--- Requires V63 to have run first (no duplicates can remain).
---
--- After this migration, future seed migrations can use:
---   INSERT INTO group_permissions ... ON CONFLICT DO NOTHING
--- instead of the INSERT ... WHERE NOT EXISTS pattern used before V64.
-ALTER TABLE group_permissions
-    ALTER COLUMN permission SET NOT NULL;
-
-ALTER TABLE group_permissions
-    ADD CONSTRAINT pk_group_permissions PRIMARY KEY (group_id, permission);

backend/src/main/resources/db/migration/V65__tbmp_promote_unique_to_pk.sql

@@ -1,8 +0,0 @@
--- Promote the de-facto unique constraint on transcription_block_mentioned_persons to a named PK.
--- uq_tbmp_block_person (added in V57) is backed by a B-tree index identical to a PK;
--- this rename makes the naming convention explicit (pk_* vs uq_*).
-ALTER TABLE transcription_block_mentioned_persons
-    DROP CONSTRAINT uq_tbmp_block_person;
-
-ALTER TABLE transcription_block_mentioned_persons
-    ADD CONSTRAINT pk_tbmp PRIMARY KEY (block_id, person_id);

backend/src/main/resources/db/migration/V66__add_invite_token_group_id_index.sql

@@ -1,3 +0,0 @@
--- The composite PK (invite_token_id, group_id) does not support efficient lookups by group_id alone.
--- Add a dedicated index to support existsActiveWithGroupId queries.
-CREATE INDEX idx_itg_group_id ON invite_token_group_ids (group_id);

backend/src/main/resources/db/migration/V67__recreate_spring_session_tables.sql

@@ -1,27 +0,0 @@
--- Re-introduces the Spring Session JDBC tables that were dropped by V2 as unused.
--- DDL copied verbatim from Spring Session 3.x schema-postgresql.sql.
--- See ADR-020 and issue #523.
-
-CREATE TABLE spring_session (
-    PRIMARY_ID            CHAR(36) NOT NULL,
-    SESSION_ID            CHAR(36) NOT NULL,
-    CREATION_TIME         BIGINT   NOT NULL,
-    LAST_ACCESS_TIME      BIGINT   NOT NULL,
-    MAX_INACTIVE_INTERVAL INT      NOT NULL,
-    EXPIRY_TIME           BIGINT   NOT NULL,
-    PRINCIPAL_NAME        VARCHAR(100),
-    CONSTRAINT spring_session_pk PRIMARY KEY (PRIMARY_ID)
-);
-
-CREATE UNIQUE INDEX spring_session_ix1 ON spring_session (SESSION_ID);
-CREATE INDEX        spring_session_ix2 ON spring_session (EXPIRY_TIME);
-CREATE INDEX        spring_session_ix3 ON spring_session (PRINCIPAL_NAME);
-
-CREATE TABLE spring_session_attributes (
-    SESSION_PRIMARY_ID CHAR(36)     NOT NULL,
-    ATTRIBUTE_NAME     VARCHAR(200) NOT NULL,
-    ATTRIBUTE_BYTES    BYTEA        NOT NULL,
-    CONSTRAINT spring_session_attributes_pk PRIMARY KEY (SESSION_PRIMARY_ID, ATTRIBUTE_NAME),
-    CONSTRAINT spring_session_attributes_fk FOREIGN KEY (SESSION_PRIMARY_ID)
-        REFERENCES spring_session (PRIMARY_ID) ON DELETE CASCADE
-);

backend/src/test/java/org/raddatz/familienarchiv/ActuatorPrometheusIT.java

@@ -1,63 +0,0 @@
-package org.raddatz.familienarchiv;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalManagementPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.ResponseEntity;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class ActuatorPrometheusIT {
-
-    @LocalManagementPort
-    private int managementPort;
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Test
-    void prometheus_endpoint_returns_200_without_credentials() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void prometheus_endpoint_returns_jvm_metrics() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
-
-        assertThat(response.getBody()).contains("jvm_memory_used_bytes");
-    }
-
-    @Test
-    void actuator_metrics_requires_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/metrics", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(401);
-    }
-
-    private RestTemplate noThrowTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(org.springframework.http.client.ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/ActuatorSecurityTest.java

@@ -1,55 +0,0 @@
-package org.raddatz.familienarchiv;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalManagementPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.ResponseEntity;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class ActuatorSecurityTest {
-
-    @LocalManagementPort
-    private int managementPort;
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Test
-    void actuator_health_is_accessible_without_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/health", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void actuator_env_requires_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/env", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(401);
-    }
-
-    private RestTemplate noThrowTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(org.springframework.http.client.ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/ApplicationContextTest.java

@@ -1,18 +1,14 @@
 package org.raddatz.familienarchiv;
 
 import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
-import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Import;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.testcontainers.containers.PostgreSQLContainer;
 import software.amazon.awssdk.services.s3.S3Client;
 
-import static org.assertj.core.api.Assertions.assertThat;
-
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
@@ -21,18 +17,9 @@ class ApplicationContextTest {
     @MockitoBean
     S3Client s3Client;
 
-    @Autowired
-    ApplicationContext ctx;
-
     @Test
     void contextLoads() {
         // verifies that the Spring context starts successfully with all beans wired,
         // Flyway migrations applied, and no configuration errors
     }
-
-    @Test
-    void sentry_is_disabled_when_no_dsn_is_configured() {
-        // application-test.yaml has no sentry.dsn — SDK must stay inactive so tests are clean
-        assertThat(io.sentry.Sentry.isEnabled()).isFalse();
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/MigrationIntegrationTest.java

@@ -399,86 +399,6 @@ class MigrationIntegrationTest {
               AND dc.annotation_id IS NOT NULL
             """;
 
-    // ─── V62: indexes on FK columns ──────────────────────────────────────────
-
-    @Test
-    void v62_idx_documents_sender_id_exists() {
-        Integer count = jdbc.queryForObject(
-                "SELECT COUNT(*) FROM pg_catalog.pg_indexes WHERE tablename = 'documents' AND indexname = 'idx_documents_sender_id'",
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    void v62_idx_comments_author_id_exists() {
-        Integer count = jdbc.queryForObject(
-                "SELECT COUNT(*) FROM pg_catalog.pg_indexes WHERE tablename = 'document_comments' AND indexname = 'idx_comments_author_id'",
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    // ─── V63+V64: group_permissions dedup + primary key ──────────────────────
-
-    @Test
-    void v64_pk_group_permissions_exists() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM pg_catalog.pg_constraint c
-                JOIN pg_catalog.pg_class t ON c.conrelid = t.oid
-                WHERE t.relname = 'group_permissions'
-                  AND c.conname = 'pk_group_permissions'
-                  AND c.contype = 'p'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    void v64_permission_column_isNotNullable() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM information_schema.columns
-                WHERE table_schema = 'public'
-                  AND table_name = 'group_permissions'
-                  AND column_name = 'permission'
-                  AND is_nullable = 'NO'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    @Transactional(propagation = Propagation.NOT_SUPPORTED)
-    void v64_rejectsDuplicateGroupPermission() {
-        UUID groupId = createUserGroup("DuplicateTestGroup-" + UUID.randomUUID());
-        try {
-            jdbc.update("INSERT INTO group_permissions (group_id, permission) VALUES (?, 'READ_ALL')", groupId);
-
-            assertThatThrownBy(() ->
-                    jdbc.update("INSERT INTO group_permissions (group_id, permission) VALUES (?, 'READ_ALL')", groupId)
-            ).isInstanceOf(DataIntegrityViolationException.class);
-        } finally {
-            jdbc.update("DELETE FROM group_permissions WHERE group_id = ?", groupId);
-            jdbc.update("DELETE FROM user_groups WHERE id = ?", groupId);
-        }
-    }
-
-    // ─── V65: tbmp UNIQUE promoted to PRIMARY KEY ─────────────────────────────
-
-    @Test
-    void v65_pk_tbmp_exists() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM pg_catalog.pg_constraint c
-                JOIN pg_catalog.pg_class t ON c.conrelid = t.oid
-                WHERE t.relname = 'transcription_block_mentioned_persons'
-                  AND c.conname = 'pk_tbmp'
-                  AND c.contype = 'p'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
     // ─── helpers ─────────────────────────────────────────────────────────────
 
     private UUID createPerson(String firstName, String lastName) {
@@ -562,10 +482,4 @@ class MigrationIntegrationTest {
                 """, id, recipientId, docId, commentId);
         return id;
     }
-
-    private UUID createUserGroup(String name) {
-        UUID id = UUID.randomUUID();
-        jdbc.update("INSERT INTO user_groups (id, name) VALUES (?, ?)", id, name);
-        return id;
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/audit/AuditServiceIntegrationTest.java

@@ -1,11 +1,11 @@
 package org.raddatz.familienarchiv.audit;
 
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.raddatz.familienarchiv.PostgresContainerConfig;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.transaction.support.TransactionTemplate;
@@ -18,6 +18,7 @@ import static org.awaitility.Awaitility.await;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class AuditServiceIntegrationTest {
 
     @MockitoBean S3Client s3Client;
@@ -25,11 +26,6 @@ class AuditServiceIntegrationTest {
     @Autowired AuditLogRepository auditLogRepository;
     @Autowired TransactionTemplate transactionTemplate;
 
-    @BeforeEach
-    void resetAuditLog() {
-        auditLogRepository.deleteAll();
-    }
-
     @Test
     void logAfterCommit_writes_ANNOTATION_CREATED_row_after_transaction_commits() {
         transactionTemplate.execute(status -> {

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthServiceTest.java

@@ -1,191 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.UserService;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.*;
-import static org.mockito.Mockito.*;
-
-@ExtendWith(MockitoExtension.class)
-class AuthServiceTest {
-
-    @Mock AuthenticationManager authenticationManager;
-    @Mock UserService userService;
-    @Mock AuditService auditService;
-    @Mock LoginRateLimiter loginRateLimiter;
-    @Mock SessionRevocationPort sessionRevocationPort;
-    @InjectMocks AuthService authService;
-
-    private static final String IP = "127.0.0.1";
-    private static final String UA = "Mozilla/5.0 (Test)";
-
-    @Test
-    void login_returns_user_on_valid_credentials() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        AuthService.LoginResult result = authService.login("user@test.de", "pass123", IP, UA);
-
-        assertThat(result.user()).isEqualTo(user);
-        assertThat(result.authentication()).isEqualTo(auth);
-    }
-
-    @Test
-    void login_fires_LOGIN_SUCCESS_audit_on_valid_credentials() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.login("user@test.de", "pass123", IP, UA);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGIN_SUCCESS),
-            eq(userId),
-            isNull(),
-            argThat(payload -> userId.toString().equals(payload.get("userId").toString())
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password"))
-        );
-    }
-
-    @Test
-    void login_throws_INVALID_CREDENTIALS_on_bad_password() {
-        when(authenticationManager.authenticate(any())).thenThrow(new BadCredentialsException("bad"));
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "wrong", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.INVALID_CREDENTIALS));
-    }
-
-    @Test
-    void login_fires_LOGIN_FAILED_audit_on_bad_credentials_without_password_in_payload() {
-        when(authenticationManager.authenticate(any())).thenThrow(new BadCredentialsException("bad"));
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "wrong", IP, UA))
-            .isInstanceOf(DomainException.class);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGIN_FAILED),
-            isNull(),
-            isNull(),
-            argThat(payload -> "user@test.de".equals(payload.get("email"))
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password")
-                && !payload.containsKey("pwd")
-                && !payload.containsKey("passwordAttempt"))
-        );
-    }
-
-    @Test
-    void login_treats_unknown_user_identically_to_bad_password() {
-        when(authenticationManager.authenticate(any()))
-            .thenThrow(new BadCredentialsException("unknown user hidden as bad creds"));
-
-        assertThatThrownBy(() -> authService.login("unknown@test.de", "any", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.INVALID_CREDENTIALS));
-
-        verify(auditService).log(eq(AuditKind.LOGIN_FAILED), isNull(), isNull(), anyMap());
-    }
-
-    @Test
-    void logout_fires_LOGOUT_audit() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.logout("user@test.de", IP, UA);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGOUT),
-            eq(userId),
-            isNull(),
-            argThat(payload -> userId.toString().equals(payload.get("userId").toString())
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password"))
-        );
-    }
-
-    @Test
-    void login_checks_rate_limit_before_authenticating() {
-        doThrow(DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS, "rate limited"))
-            .when(loginRateLimiter).checkAndConsume(IP, "user@test.de");
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "pass", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-
-        verify(authenticationManager, never()).authenticate(any());
-    }
-
-    @Test
-    void login_fires_LOGIN_RATE_LIMITED_audit_when_rate_limited() {
-        doThrow(DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS, "rate limited"))
-            .when(loginRateLimiter).checkAndConsume(IP, "user@test.de");
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "pass", IP, UA))
-            .isInstanceOf(DomainException.class);
-
-        verify(auditService).log(eq(AuditKind.LOGIN_RATE_LIMITED), isNull(), isNull(),
-            argThat(payload -> IP.equals(payload.get("ip")) && "user@test.de".equals(payload.get("email"))));
-    }
-
-    @Test
-    void login_invalidates_rate_limit_on_success() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.login("user@test.de", "pass123", IP, UA);
-
-        verify(loginRateLimiter).invalidateOnSuccess(IP, "user@test.de");
-    }
-
-    @Test
-    void revokeOtherSessions_delegates_to_port() {
-        when(sessionRevocationPort.revokeOtherSessions("session-keep", "user@test.de")).thenReturn(2);
-
-        int count = authService.revokeOtherSessions("session-keep", "user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRevocationPort).revokeOtherSessions("session-keep", "user@test.de");
-    }
-
-    @Test
-    void revokeAllSessions_delegates_to_port() {
-        when(sessionRevocationPort.revokeAllSessions("user@test.de")).thenReturn(3);
-
-        int count = authService.revokeAllSessions("user@test.de");
-
-        assertThat(count).isEqualTo(3);
-        verify(sessionRevocationPort).revokeAllSessions("user@test.de");
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthSessionControllerTest.java

@@ -1,191 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.auth.AuthService.LoginResult;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.raddatz.familienarchiv.security.SecurityConfig;
-import org.raddatz.familienarchiv.security.PermissionAspect;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.CustomUserDetailsService;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.aop.AopAutoConfiguration;
-import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.MediaType;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.test.web.servlet.MockMvc;
-
-import java.util.UUID;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-
-@WebMvcTest(AuthSessionController.class)
-@Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
-class AuthSessionControllerTest {
-
-    @Autowired MockMvc mockMvc;
-
-    @MockitoBean AuthService authService;
-    @MockitoBean CustomUserDetailsService customUserDetailsService;
-    @MockitoBean SessionAuthenticationStrategy sessionAuthenticationStrategy;
-
-    // ─── POST /api/auth/login ──────────────────────────────────────────────────
-
-    @Test
-    void login_returns_200_with_user_on_valid_credentials() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"pass123\"}"))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.email").value("user@test.de"))
-            .andExpect(jsonPath("$.id").value(userId.toString()));
-    }
-
-    @Test
-    void login_returns_401_with_INVALID_CREDENTIALS_on_bad_credentials() throws Exception {
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenThrow(DomainException.invalidCredentials());
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
-            .andExpect(status().isUnauthorized())
-            .andExpect(jsonPath("$.code").value(ErrorCode.INVALID_CREDENTIALS.name()));
-    }
-
-    @Test
-    void login_is_public_no_session_required() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("pub@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        // No WithMockUser — must be reachable without an active session
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"pub@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk());
-    }
-
-    @Test
-    void login_delegates_to_SessionAuthenticationStrategy_for_fixation_protection() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("fix@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"fix@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk());
-
-        // Session-fixation defense (CWE-384): the controller must hand the new
-        // Authentication to Spring Security's strategy, which rotates the session ID.
-        verify(sessionAuthenticationStrategy).onAuthentication(eq(auth), any(), any());
-    }
-
-    @Test
-    void login_response_body_does_not_contain_password_field() throws Exception {
-        // Regression guard: AppUser.password is @JsonProperty(WRITE_ONLY). If anyone
-        // ever drops that annotation, this assertion catches the credential leak on
-        // the very next CI run.
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder()
-            .id(userId)
-            .email("leak@test.de")
-            .password("$2a$10$shouldnotappearinresponse")
-            .build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"leak@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.password").doesNotExist())
-            .andExpect(jsonPath("$.pwd").doesNotExist())
-            .andExpect(content().string(org.hamcrest.Matchers.not(
-                org.hamcrest.Matchers.containsString("$2a$10$shouldnotappearinresponse"))));
-    }
-
-    @Test
-    void login_does_not_set_cookie_on_failure() throws Exception {
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenThrow(DomainException.invalidCredentials());
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
-            .andExpect(status().isUnauthorized())
-            .andExpect(header().doesNotExist("Set-Cookie"));
-    }
-
-    // ─── CSRF protection ──────────────────────────────────────────────────────
-
-    @Test
-    void authenticated_post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        // Red test: CSRF disabled → returns 204; after re-enabling returns 403.
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("user@test.de")))   // authenticated but no CSRF token
-            .andExpect(status().isForbidden())
-            .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
-
-    // ─── POST /api/auth/logout ─────────────────────────────────────────────────
-
-    @Test
-    void logout_returns_204_when_authenticated() throws Exception {
-        doNothing().when(authService).logout(anyString(), anyString(), anyString());
-
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("user@test.de"))
-                .with(csrf()))
-            .andExpect(status().isNoContent());
-    }
-
-    @Test
-    void logout_without_session_returns_403() throws Exception {
-        // CsrfFilter runs before AnonymousAuthenticationFilter. When authentication is null,
-        // ExceptionTranslationFilter routes CSRF AccessDeniedException to accessDeniedHandler → 403.
-        mockMvc.perform(post("/api/auth/logout"))
-            .andExpect(status().isForbidden())
-            .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
-
-    @Test
-    void logout_returns_204_even_when_audit_throws() throws Exception {
-        // CWE-613 defense: the session MUST be invalidated even if the audit lookup
-        // explodes (e.g. user deleted between login and logout). Audit is best-effort.
-        doThrow(new RuntimeException("audit DB down"))
-            .when(authService).logout(anyString(), anyString(), anyString());
-
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("ghost@test.de"))
-                .with(csrf()))
-            .andExpect(status().isNoContent());
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthSessionIntegrationTest.java

@@ -1,192 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.AppUserRepository;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalServerPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.HttpEntity;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpMethod;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.http.client.ClientHttpResponse;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class AuthSessionIntegrationTest {
-
-    @LocalServerPort int port;
-    @MockitoBean S3Client s3Client;
-    @Autowired AppUserRepository userRepository;
-    @Autowired PasswordEncoder passwordEncoder;
-    @Autowired JdbcTemplate jdbcTemplate;
-
-    private RestTemplate http;
-    private String baseUrl;
-
-    private static final String TEST_EMAIL = "session-it@test.de";
-    private static final String TEST_PASSWORD = "pass4Session!";
-
-    @BeforeEach
-    void setUp() {
-        http = noThrowRestTemplate();
-        baseUrl = "http://localhost:" + port;
-        // spring_session_attributes cascades on delete — removing the parent row is enough
-        jdbcTemplate.update("DELETE FROM spring_session");
-        jdbcTemplate.update("DELETE FROM app_users WHERE email = ?", TEST_EMAIL);
-        userRepository.save(AppUser.builder()
-                .email(TEST_EMAIL)
-                .password(passwordEncoder.encode(TEST_PASSWORD))
-                .build());
-    }
-
-    // ─── Task 13: full session lifecycle ──────────────────────────────────────
-
-    @Test
-    void login_sets_opaque_fa_session_cookie() {
-        String xsrf = fetchXsrfToken();
-        ResponseEntity<String> response = doLogin(xsrf);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-        String cookie = extractFaSessionCookie(response);
-        assertThat(cookie).isNotBlank();
-        // Opaque token — must not look like Basic-auth credentials (email:password)
-        assertThat(cookie).doesNotContain(":");
-    }
-
-    @Test
-    void session_cookie_authenticates_subsequent_request() {
-        String xsrf = fetchXsrfToken();
-        String cookie = extractFaSessionCookie(doLogin(xsrf));
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(cookie)), String.class);
-
-        assertThat(me.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void logout_invalidates_session_and_cookie_returns_401_on_reuse() {
-        String xsrf = fetchXsrfToken();
-        String sessionCookie = extractFaSessionCookie(doLogin(xsrf));
-
-        ResponseEntity<Void> logout = http.postForEntity(
-                baseUrl + "/api/auth/logout",
-                new HttpEntity<>(csrfAndSessionHeaders(sessionCookie, xsrf)), Void.class);
-        assertThat(logout.getStatusCode().value()).isEqualTo(204);
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(sessionCookie)), String.class);
-        assertThat(me.getStatusCode().value()).isEqualTo(401);
-    }
-
-    // ─── Task 14: idle-timeout ────────────────────────────────────────────────
-
-    @Test
-    void session_expired_by_idle_timeout_returns_401() {
-        String xsrf = fetchXsrfToken();
-        String cookie = extractFaSessionCookie(doLogin(xsrf));
-
-        // Backdate LAST_ACCESS_TIME by 9 hours so lastAccess + maxInactiveInterval(8h) < now
-        long nineHoursAgoMs = System.currentTimeMillis() - 9L * 3600 * 1000;
-        jdbcTemplate.update(
-                "UPDATE spring_session SET LAST_ACCESS_TIME = ?, EXPIRY_TIME = ?",
-                nineHoursAgoMs, nineHoursAgoMs);
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(cookie)), String.class);
-        assertThat(me.getStatusCode().value()).isEqualTo(401);
-    }
-
-    // ─── Task: CSRF rejection at integration layer ────────────────────────────
-
-    @Test
-    void post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() {
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_JSON);
-        // Deliberately omit XSRF-TOKEN cookie and X-XSRF-TOKEN header
-        ResponseEntity<String> response = http.postForEntity(
-                baseUrl + "/api/auth/logout",
-                new HttpEntity<>("{}", headers), String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(403);
-        assertThat(response.getBody()).contains("CSRF_TOKEN_MISSING");
-    }
-
-    // ─── helpers ─────────────────────────────────────────────────────────────
-
-    /**
-     * Generates an XSRF token for use in integration tests.
-     * CookieCsrfTokenRepository validates that Cookie: XSRF-TOKEN=X matches X-XSRF-TOKEN: X.
-     * By supplying both with the same value we simulate exactly what a browser does.
-     */
-    private String fetchXsrfToken() {
-        return java.util.UUID.randomUUID().toString();
-    }
-
-    private ResponseEntity<String> doLogin(String xsrfToken) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_JSON);
-        headers.set("Cookie", "XSRF-TOKEN=" + xsrfToken);
-        headers.set("X-XSRF-TOKEN", xsrfToken);
-        String body = "{\"email\":\"" + TEST_EMAIL + "\",\"password\":\"" + TEST_PASSWORD + "\"}";
-        return http.postForEntity(baseUrl + "/api/auth/login",
-                new HttpEntity<>(body, headers), String.class);
-    }
-
-    private HttpHeaders cookieHeaders(String sessionId) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.set("Cookie", "fa_session=" + sessionId);
-        return headers;
-    }
-
-    private HttpHeaders csrfAndSessionHeaders(String sessionId, String xsrfToken) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.set("Cookie", "fa_session=" + sessionId + "; XSRF-TOKEN=" + xsrfToken);
-        headers.set("X-XSRF-TOKEN", xsrfToken);
-        return headers;
-    }
-
-    private String extractFaSessionCookie(ResponseEntity<?> response) {
-        List<String> setCookieHeader = response.getHeaders().get("Set-Cookie");
-        if (setCookieHeader == null) return "";
-        return setCookieHeader.stream()
-                .filter(c -> c.startsWith("fa_session="))
-                .map(c -> c.split(";")[0].substring("fa_session=".length()))
-                .findFirst()
-                .orElse("");
-    }
-
-
-    private RestTemplate noThrowRestTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapterIntegrationTest.java

@@ -1,136 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.support.TransactionTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.time.Instant;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Integration test for {@link JdbcSessionRevocationAdapter} that verifies
- * session rows are actually written to / removed from the {@code spring_session}
- * table backed by a real PostgreSQL container.
- *
- * <p>Sessions are inserted via raw JDBC to avoid the module-access restriction on
- * {@code JdbcIndexedSessionRepository.JdbcSession}. The {@link SessionRevocationPort}
- * bean injected here is the real {@link JdbcSessionRevocationAdapter} wired by Spring.
- */
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class JdbcSessionRevocationAdapterIntegrationTest {
-
-    @MockitoBean S3Client s3Client;
-
-    @Autowired SessionRevocationPort adapter;
-    @Autowired JdbcTemplate jdbcTemplate;
-    @Autowired TransactionTemplate transactionTemplate;
-
-    private static final String PRINCIPAL = "revocation-it@test.de";
-
-    @BeforeEach
-    void clearSessions() {
-        // spring_session_attributes cascades on delete
-        transactionTemplate.execute(status -> {
-            jdbcTemplate.update("DELETE FROM spring_session");
-            return null;
-        });
-    }
-
-    // ── helper ─────────────────────────────────────────────────────────────────
-
-    /**
-     * Inserts a minimal {@code spring_session} row attributed to {@value #PRINCIPAL}
-     * and returns its opaque primary-key ID (the value the repository uses as the
-     * session identifier, not the {@code SESSION_ID} column which holds the public token).
-     *
-     * <p>Column layout mirrors the Flyway-managed schema shipped with the app:
-     * PRIMARY_ID, SESSION_ID, CREATION_TIME, LAST_ACCESS_TIME, MAX_INACTIVE_INTERVAL,
-     * EXPIRY_TIME, PRINCIPAL_NAME.
-     */
-    /**
-     * Inserts a persisted session row for {@value #PRINCIPAL} and returns the
-     * {@code SESSION_ID} column value — this is the opaque identifier that
-     * {@link JdbcIndexedSessionRepository} uses as the session's public key
-     * (returned by {@code JdbcSession.getId()} and expected by
-     * {@link JdbcIndexedSessionRepository#deleteById}).
-     *
-     * <p>The inserts run inside a {@link TransactionTemplate} so the rows are
-     * committed before {@code findByPrincipalName} opens its own transaction and
-     * can see the data via Read Committed isolation.
-     */
-    private String insertSession() {
-        String primaryId = UUID.randomUUID().toString();
-        // SESSION_ID is the value used by JdbcSession.getId() and findByPrincipalName map keys.
-        String sessionId  = UUID.randomUUID().toString();
-        long   now        = Instant.now().toEpochMilli();
-        long   expiry     = now + 8L * 3600 * 1000; // 8-hour TTL
-        transactionTemplate.execute(status -> {
-            jdbcTemplate.update("""
-                    INSERT INTO spring_session
-                        (PRIMARY_ID, SESSION_ID, CREATION_TIME, LAST_ACCESS_TIME,
-                         MAX_INACTIVE_INTERVAL, EXPIRY_TIME, PRINCIPAL_NAME)
-                    VALUES (?, ?, ?, ?, ?, ?, ?)
-                    """,
-                    primaryId, sessionId, now, now, 28800, expiry, PRINCIPAL);
-            // Spring Session's listSessionsByPrincipalName query joins spring_session_attributes;
-            // insert a minimal attribute row so the session appears in the result set.
-            jdbcTemplate.update("""
-                    INSERT INTO spring_session_attributes
-                        (SESSION_PRIMARY_ID, ATTRIBUTE_NAME, ATTRIBUTE_BYTES)
-                    VALUES (?, ?, ?)
-                    """,
-                    primaryId, "test_attr", new byte[]{0});
-            return null;
-        });
-        return sessionId;  // the public key used by JdbcSession.getId() and deleteById()
-    }
-
-    // ── tests ──────────────────────────────────────────────────────────────────
-
-    @Test
-    void revokeAllSessions_removes_every_row_from_spring_session_table() {
-        insertSession();
-        insertSession();
-
-        int count = adapter.revokeAllSessions(PRINCIPAL);
-
-        assertThat(count).isEqualTo(2);
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE PRINCIPAL_NAME = ?",
-                Long.class, PRINCIPAL))
-            .isZero();
-    }
-
-    @Test
-    void revokeOtherSessions_deletes_non_current_rows_and_keeps_current_session() {
-        String keepId = insertSession();
-        insertSession();
-        insertSession();
-
-        int count = adapter.revokeOtherSessions(keepId, PRINCIPAL);
-
-        assertThat(count).isEqualTo(2);
-        // The current session row must still be present (keyed by SESSION_ID)
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE SESSION_ID = ?",
-                Long.class, keepId))
-            .isEqualTo(1L);
-        // The total for this principal is now exactly 1
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE PRINCIPAL_NAME = ?",
-                Long.class, PRINCIPAL))
-            .isEqualTo(1L);
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapterTest.java

@@ -1,52 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-import java.util.HashMap;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.Mockito.*;
-
-@ExtendWith(MockitoExtension.class)
-class JdbcSessionRevocationAdapterTest {
-
-    @Mock JdbcIndexedSessionRepository sessionRepository;
-    @InjectMocks JdbcSessionRevocationAdapter adapter;
-
-    @SuppressWarnings("unchecked")
-    @Test
-    void revokeOtherSessions_preserves_current_and_deletes_N_minus_1() {
-        var sessions = new HashMap<String, Object>();
-        sessions.put("session-keep", null);
-        sessions.put("session-del-1", null);
-        sessions.put("session-del-2", null);
-        doReturn(sessions).when(sessionRepository).findByPrincipalName("user@test.de");
-
-        int count = adapter.revokeOtherSessions("session-keep", "user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRepository, never()).deleteById("session-keep");
-        verify(sessionRepository).deleteById("session-del-1");
-        verify(sessionRepository).deleteById("session-del-2");
-    }
-
-    @SuppressWarnings("unchecked")
-    @Test
-    void revokeAllSessions_deletes_all_sessions_for_principal() {
-        var sessions = new HashMap<String, Object>();
-        sessions.put("session-1", null);
-        sessions.put("session-2", null);
-        doReturn(sessions).when(sessionRepository).findByPrincipalName("user@test.de");
-
-        int count = adapter.revokeAllSessions("user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRepository).deleteById("session-1");
-        verify(sessionRepository).deleteById("session-2");
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/LoginRateLimiterTest.java

@@ -1,148 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatNoException;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-class LoginRateLimiterTest {
-
-    private LoginRateLimiter rateLimiter;
-
-    @BeforeEach
-    void setUp() {
-        RateLimitProperties props = new RateLimitProperties();
-        props.setMaxAttemptsPerIpEmail(10);
-        props.setMaxAttemptsPerIp(20);
-        props.setWindowMinutes(15);
-        rateLimiter = new LoginRateLimiter(props);
-    }
-
-    @Test
-    void tenth_attempt_from_same_ip_email_succeeds() {
-        for (int i = 0; i < 10; i++) {
-            assertThatNoException().isThrownBy(
-                () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-        }
-    }
-
-    @Test
-    void eleventh_attempt_from_same_ip_email_throws_TOO_MANY_LOGIN_ATTEMPTS() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void blocked_attempt_carries_retry_after_seconds_equal_to_window_duration() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getRetryAfterSeconds())
-                .isEqualTo(15 * 60L));  // windowMinutes=15 → 900 seconds
-    }
-
-    @Test
-    void success_after_10_failures_resets_ip_email_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        rateLimiter.invalidateOnSuccess("1.2.3.4", "user@example.com");
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-    }
-
-    @Test
-    void twentyfirst_attempt_from_same_ip_across_different_emails_throws() {
-        for (int i = 0; i < 20; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user" + i + "@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "attacker@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void different_email_from_same_ip_not_blocked_by_sibling_email_exhaustion() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class);
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "other@example.com"));
-    }
-
-    @Test
-    void email_lookup_is_case_insensitive_so_mixed_case_shares_the_same_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "User@Example.COM");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void invalidateOnSuccess_is_case_insensitive_so_mixed_case_clears_the_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        rateLimiter.invalidateOnSuccess("1.2.3.4", "User@Example.COM");
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-    }
-
-    @Test
-    void ip_exhaustion_does_not_consume_ipEmail_tokens_for_blocked_attempts() {
-        // Use a tighter limiter so the phantom-consumption effect is observable.
-        // ipEmail=3, IP=3: exhausting IP via one email burns the other email's quota with the old code.
-        RateLimitProperties props = new RateLimitProperties();
-        props.setMaxAttemptsPerIpEmail(3);
-        props.setMaxAttemptsPerIp(3);
-        props.setWindowMinutes(15);
-        LoginRateLimiter tightLimiter = new LoginRateLimiter(props);
-
-        // Exhaust the per-IP bucket using "user@"
-        for (int i = 0; i < 3; i++) {
-            tightLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        // Three blocked attempts for "target@" while IP is exhausted
-        for (int i = 0; i < 3; i++) {
-            assertThatThrownBy(() -> tightLimiter.checkAndConsume("1.2.3.4", "target@example.com"))
-                .isInstanceOf(DomainException.class);
-        }
-
-        // A successful login for "user@" resets the IP bucket but NOT target@'s ipEmail bucket
-        tightLimiter.invalidateOnSuccess("1.2.3.4", "user@example.com");
-
-        // After IP reset: "target@" must NOT be blocked by an exhausted ipEmail bucket.
-        // With the old code, 3 blocked attempts burned all 3 ipEmail tokens → blocked here.
-        // With the fix, tokens are refunded on each blocked attempt → still has capacity.
-        assertThatNoException().isThrownBy(
-            () -> tightLimiter.checkAndConsume("1.2.3.4", "target@example.com"));
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/config/ForwardHeadersConfigurationTest.java

@@ -1,48 +0,0 @@
-package org.raddatz.familienarchiv.config;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.config.YamlPropertiesFactoryBean;
-import org.springframework.boot.web.server.autoconfigure.ServerProperties.ForwardHeadersStrategy;
-import org.springframework.boot.context.properties.bind.Binder;
-import org.springframework.boot.context.properties.source.ConfigurationPropertySources;
-import org.springframework.core.env.PropertiesPropertySource;
-import org.springframework.core.io.ClassPathResource;
-
-import java.util.Properties;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Binds {@code server.forward-headers-strategy} from {@code application.yaml} into
- * Spring Boot's typed {@link ForwardHeadersStrategy} enum. The binder rejects any
- * value that is not a valid enum constant ({@code BindException}), so a typo
- * ({@code "nativ"}, {@code "Native"}, {@code "framework "}) or a future Spring
- * rename of the property fails the test, not silently degrades to {@code NONE}.
- *
- * <p>No Spring context, no embedded server, no Testcontainers — this is the
- * cheapest test that pins the contract "Caddy's X-Forwarded-Proto is trusted".
- */
-class ForwardHeadersConfigurationTest {
-
-    @Test
-    void forward_headers_strategy_binds_to_NATIVE() {
-        YamlPropertiesFactoryBean yaml = new YamlPropertiesFactoryBean();
-        yaml.setResources(new ClassPathResource("application.yaml"));
-        Properties props = yaml.getObject();
-        assertThat(props).as("application.yaml must be on the classpath").isNotNull();
-
-        Binder binder = new Binder(ConfigurationPropertySources.from(
-            new PropertiesPropertySource("application", props)));
-
-        ForwardHeadersStrategy strategy = binder
-            .bind("server.forward-headers-strategy", ForwardHeadersStrategy.class)
-            .orElseThrow(() -> new AssertionError(
-                "server.forward-headers-strategy is missing from application.yaml"));
-
-        assertThat(strategy)
-            .as("Spring must trust X-Forwarded-Proto from Caddy so that "
-                + "request.getScheme(), redirect URLs, and the Spring Session "
-                + "'Secure' cookie reflect the original https client request.")
-            .isEqualTo(ForwardHeadersStrategy.NATIVE);
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/config/RateLimitInterceptorTest.java

@@ -45,15 +45,6 @@ class RateLimitInterceptorTest {
         verify(response).setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
     }
 
-    @Test
-    void blocked_response_includes_retry_after_header() throws Exception {
-        for (int i = 0; i < 10; i++) {
-            interceptor.preHandle(request, response, null);
-        }
-        interceptor.preHandle(request, response, null);
-        verify(response).setHeader("Retry-After", "60");
-    }
-
     @Test
     void different_ips_have_independent_limits() throws Exception {
         HttpServletRequest other = mock(HttpServletRequest.class);

backend/src/test/java/org/raddatz/familienarchiv/dashboard/DashboardServiceTest.java

@@ -13,7 +13,6 @@ import org.raddatz.familienarchiv.user.AppUser;
 import org.raddatz.familienarchiv.document.Document;
 import org.raddatz.familienarchiv.document.transcription.TranscriptionBlock;
 import org.raddatz.familienarchiv.document.comment.CommentService;
-import org.raddatz.familienarchiv.document.comment.CommentData;
 import org.raddatz.familienarchiv.document.DocumentService;
 import org.raddatz.familienarchiv.document.transcription.TranscriptionService;
 import org.raddatz.familienarchiv.user.UserService;
@@ -143,8 +142,7 @@ class DashboardServiceTest {
         when(documentService.getDocumentsByIds(List.of(docId))).thenReturn(List.of(
                 Document.builder().id(docId).title("B").originalFilename("b.pdf").receivers(new HashSet<>()).build()
         ));
-        when(commentService.findDataByIds(List.of(commentId)))
+        when(commentService.findAnnotationIdsByIds(List.of(commentId))).thenReturn(Map.of());
-                .thenReturn(Map.of(commentId, new CommentData(null, "preview text")));
 
         List<ActivityFeedItemDTO> items = dashboardService.getActivity(userId, 5, AuditKind.ROLLUP_ELIGIBLE);
 
@@ -164,8 +162,8 @@ class DashboardServiceTest {
         when(documentService.getDocumentsByIds(List.of(docId))).thenReturn(List.of(
                 Document.builder().id(docId).title("B").originalFilename("b.pdf").receivers(new HashSet<>()).build()
         ));
-        when(commentService.findDataByIds(List.of(commentId)))
+        when(commentService.findAnnotationIdsByIds(List.of(commentId)))
-                .thenReturn(Map.of(commentId, new CommentData(annotationId, "preview text")));
+                .thenReturn(Map.of(commentId, annotationId));
 
         List<ActivityFeedItemDTO> items = dashboardService.getActivity(userId, 5, AuditKind.ROLLUP_ELIGIBLE);
 
@@ -189,62 +187,7 @@ class DashboardServiceTest {
         assertThat(items).hasSize(1);
         assertThat(items.get(0).commentId()).isNull();
         assertThat(items.get(0).annotationId()).isNull();
-        verify(commentService, never()).findDataByIds(anyList());
+        verify(commentService, never()).findAnnotationIdsByIds(anyList());
-    }
-
-    // ─── getActivity commentPreview ───────────────────────────────────────────
-
-    @Test
-    void getActivity_populates_commentPreview_for_COMMENT_ADDED_rows() {
-        UUID userId = UUID.randomUUID();
-        UUID docId = UUID.randomUUID();
-        UUID commentId = UUID.randomUUID();
-
-        ActivityFeedRow row = mockFeedRow(docId, "COMMENT_ADDED", commentId);
-        when(auditLogQueryService.findActivityFeed(userId, 5, AuditKind.ROLLUP_ELIGIBLE)).thenReturn(List.of(row));
-        when(documentService.getDocumentsByIds(List.of(docId))).thenReturn(List.of(
-                Document.builder().id(docId).title("B").originalFilename("b.pdf").receivers(new HashSet<>()).build()
-        ));
-        when(commentService.findDataByIds(List.of(commentId)))
-                .thenReturn(Map.of(commentId, new CommentData(null, "Hello family!")));
-
-        List<ActivityFeedItemDTO> items = dashboardService.getActivity(userId, 5, AuditKind.ROLLUP_ELIGIBLE);
-
-        assertThat(items.get(0).commentPreview()).isEqualTo("Hello family!");
-    }
-
-    @Test
-    void getActivity_leaves_commentPreview_null_for_TEXT_SAVED_rows() {
-        UUID userId = UUID.randomUUID();
-        UUID docId = UUID.randomUUID();
-
-        ActivityFeedRow row = mockFeedRow(docId, "TEXT_SAVED", null);
-        when(auditLogQueryService.findActivityFeed(userId, 5, AuditKind.ROLLUP_ELIGIBLE)).thenReturn(List.of(row));
-        when(documentService.getDocumentsByIds(List.of(docId))).thenReturn(List.of(
-                Document.builder().id(docId).title("B").originalFilename("b.pdf").receivers(new HashSet<>()).build()
-        ));
-
-        List<ActivityFeedItemDTO> items = dashboardService.getActivity(userId, 5, AuditKind.ROLLUP_ELIGIBLE);
-
-        assertThat(items.get(0).commentPreview()).isNull();
-    }
-
-    @Test
-    void getActivity_leaves_commentPreview_null_when_comment_is_deleted() {
-        UUID userId = UUID.randomUUID();
-        UUID docId = UUID.randomUUID();
-        UUID deletedCommentId = UUID.randomUUID();
-
-        ActivityFeedRow row = mockFeedRow(docId, "COMMENT_ADDED", deletedCommentId);
-        when(auditLogQueryService.findActivityFeed(userId, 5, AuditKind.ROLLUP_ELIGIBLE)).thenReturn(List.of(row));
-        when(documentService.getDocumentsByIds(List.of(docId))).thenReturn(List.of(
-                Document.builder().id(docId).title("B").originalFilename("b.pdf").receivers(new HashSet<>()).build()
-        ));
-        when(commentService.findDataByIds(List.of(deletedCommentId))).thenReturn(Map.of());
-
-        List<ActivityFeedItemDTO> items = dashboardService.getActivity(userId, 5, AuditKind.ROLLUP_ELIGIBLE);
-
-        assertThat(items.get(0).commentPreview()).isNull();
     }
 
     // ─── getPulse — always uses full ROLLUP_ELIGIBLE set ─────────────────────

backend/src/test/java/org/raddatz/familienarchiv/dashboard/StatsControllerTest.java

@@ -44,7 +44,7 @@ class StatsControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void getStats_returns200_withCorrectCounts() throws Exception {
-        when(statsService.getStats()).thenReturn(new StatsDTO(4L, 12L, 2L));
+        when(statsService.getStats()).thenReturn(new StatsDTO(4L, 12L));
 
         mockMvc.perform(get("/api/stats"))
                 .andExpect(status().isOk())
@@ -55,7 +55,7 @@ class StatsControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void getStats_returns200_withZeroCounts() throws Exception {
-        when(statsService.getStats()).thenReturn(new StatsDTO(0L, 0L, 0L));
+        when(statsService.getStats()).thenReturn(new StatsDTO(0L, 0L));
 
         mockMvc.perform(get("/api/stats"))
                 .andExpect(status().isOk())

backend/src/test/java/org/raddatz/familienarchiv/dashboard/StatsServiceTest.java

@@ -7,7 +7,6 @@ import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.raddatz.familienarchiv.document.DocumentService;
 import org.raddatz.familienarchiv.dashboard.StatsDTO;
-import org.raddatz.familienarchiv.geschichte.GeschichteService;
 import org.raddatz.familienarchiv.person.PersonService;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -18,7 +17,6 @@ class StatsServiceTest {
 
     @Mock PersonService personService;
     @Mock DocumentService documentService;
-    @Mock GeschichteService geschichteService;
     @InjectMocks StatsService statsService;
 
     @Test
@@ -32,17 +30,6 @@ class StatsServiceTest {
         assertThat(stats.totalDocuments()).isEqualTo(12L);
     }
 
-    @Test
-    void getStats_includes_totalStories() {
-        when(personService.count()).thenReturn(3L);
-        when(documentService.count()).thenReturn(7L);
-        when(geschichteService.countPublished()).thenReturn(5L);
-
-        StatsDTO stats = statsService.getStats();
-
-        assertThat(stats.totalStories()).isEqualTo(5L);
-    }
-
     @Test
     void getStats_returnsZero_whenNoEntities() {
         when(personService.count()).thenReturn(0L);

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java

@@ -44,12 +44,9 @@ import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.patch;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(DocumentController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -216,14 +213,14 @@ class DocumentControllerTest {
 
     @Test
     void createDocument_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void createDocument_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isForbidden());
     }
 
@@ -237,7 +234,7 @@ class DocumentControllerTest {
                 .build();
         when(documentService.createDocument(any(), any())).thenReturn(doc);
 
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isOk());
     }
 
@@ -246,7 +243,7 @@ class DocumentControllerTest {
     @Test
     void updateDocument_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID())
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -254,7 +251,7 @@ class DocumentControllerTest {
     @WithMockUser
     void updateDocument_returns403_whenMissingWritePermission() throws Exception {
         mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID())
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isForbidden());
     }
 
@@ -271,7 +268,7 @@ class DocumentControllerTest {
         when(documentService.updateDocument(any(), any(), any(), any())).thenReturn(doc);
 
         mockMvc.perform(multipart("/api/documents/" + id)
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isOk());
     }
 
@@ -280,7 +277,7 @@ class DocumentControllerTest {
     @Test
     void deleteDocument_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + UUID.randomUUID()).with(csrf()))
+                        .delete("/api/documents/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -288,7 +285,7 @@ class DocumentControllerTest {
     @WithMockUser
     void deleteDocument_returns403_whenMissingWritePermission() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + UUID.randomUUID()).with(csrf()))
+                        .delete("/api/documents/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
@@ -297,7 +294,7 @@ class DocumentControllerTest {
     void deleteDocument_returns204_whenHasWritePermission() throws Exception {
         UUID id = UUID.randomUUID();
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + id).with(csrf()))
+                        .delete("/api/documents/" + id))
                 .andExpect(status().isNoContent());
     }
 
@@ -305,14 +302,14 @@ class DocumentControllerTest {
 
     @Test
     void quickUpload_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void quickUpload_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isForbidden());
     }
 
@@ -328,7 +325,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("files", "scan001.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created[0].title").value("scan001"))
                 .andExpect(jsonPath("$.updated").isEmpty())
@@ -347,7 +344,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("files", "scan001.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated[0].title").value("Alter Brief"))
@@ -362,7 +359,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("files", "report.docx",
                         "application/vnd.openxmlformats-officedocument.wordprocessingml.document", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.errors[0].filename").value("report.docx"))
@@ -492,7 +489,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void quickUpload_returnsEmptyResult_whenNoFilesPartProvided() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated").isEmpty())
@@ -642,7 +639,7 @@ class DocumentControllerTest {
 
     @Test
     void patchTrainingLabels_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isUnauthorized());
@@ -651,7 +648,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser
     void patchTrainingLabels_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isForbidden());
@@ -661,7 +658,7 @@ class DocumentControllerTest {
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns204_whenAddingLabel() throws Exception {
         UUID id = UUID.randomUUID();
-        mockMvc.perform(patch("/api/documents/" + id + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + id + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isNoContent());
@@ -673,7 +670,7 @@ class DocumentControllerTest {
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns204_whenRemovingLabel() throws Exception {
         UUID id = UUID.randomUUID();
-        mockMvc.perform(patch("/api/documents/" + id + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + id + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_SEGMENTATION\",\"enrolled\":false}"))
                 .andExpect(status().isNoContent());
@@ -684,7 +681,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns400_whenUnknownLabel() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"UNKNOWN_GARBAGE\",\"enrolled\":true}"))
                 .andExpect(status().isBadRequest());
@@ -698,7 +695,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(file))
                 .andExpect(status().isForbidden());
     }
 
@@ -715,7 +712,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.id").value(id.toString()))
                 .andExpect(jsonPath("$.status").value("UPLOADED"));
@@ -728,7 +725,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile(
                         "file", "evil.html", "text/html", "<script>alert(1)</script>".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(htmlFile).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(htmlFile))
                 .andExpect(status().isBadRequest());
     }
 
@@ -745,7 +742,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file))
                 .andExpect(status().isNotFound());
     }
 
@@ -802,7 +799,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         ("{\"senderId\":\"" + senderId + "\"}").getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created.length()").value(3))
                 .andExpect(jsonPath("$.created[0].sender.id").value(senderId.toString()))
@@ -829,7 +826,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         ("{\"senderId\":\"" + senderId + "\"}").getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated[0].sender.id").value(senderId.toString()))
@@ -861,7 +858,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"titles\":[\"Alpha\",\"Beta\",\"Gamma\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created[0].title").value("Alpha"))
                 .andExpect(jsonPath("$.created[1].title").value("Beta"))
@@ -885,7 +882,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"titles\":[\"A\",\"B\",\"C\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(metadata))
                 .andExpect(status().isBadRequest());
     }
 
@@ -906,7 +903,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"tagNames\":[\"Briefwechsel\",\"Krieg\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata))
                 .andExpect(status().isOk());
 
         org.assertj.core.api.Assertions.assertThat(captor.getValue().getTagNames())
@@ -928,7 +925,7 @@ class DocumentControllerTest {
                     "files", "f" + i + ".pdf", "application/pdf", new byte[]{1}));
         }
 
-        mockMvc.perform(builder.with(csrf()))
+        mockMvc.perform(builder)
                 .andExpect(status().isBadRequest())
                 .andExpect(jsonPath("$.code").value("BATCH_TOO_LARGE"));
     }
@@ -947,7 +944,7 @@ class DocumentControllerTest {
 
     @Test
     void patchBulk_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(UUID.randomUUID().toString())))
                 .andExpect(status().isUnauthorized());
@@ -956,7 +953,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser
     void patchBulk_returns403_forReadAllUser() throws Exception {
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(UUID.randomUUID().toString())))
                 .andExpect(status().isForbidden());
@@ -967,7 +964,7 @@ class DocumentControllerTest {
     void patchBulk_returns400_whenDocumentIdsIsEmpty() throws Exception {
         when(userService.findByEmail(any())).thenReturn(AppUser.builder().id(UUID.randomUUID()).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"documentIds\":[]}"))
                 .andExpect(status().isBadRequest());
@@ -978,7 +975,7 @@ class DocumentControllerTest {
     void patchBulk_returns400_whenDocumentIdsIsMissing() throws Exception {
         when(userService.findByEmail(any())).thenReturn(AppUser.builder().id(UUID.randomUUID()).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isBadRequest());
@@ -992,7 +989,7 @@ class DocumentControllerTest {
         String[] ids = new String[501];
         for (int i = 0; i < 501; i++) ids[i] = UUID.randomUUID().toString();
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(ids)))
                 .andExpect(status().isBadRequest())
@@ -1011,7 +1008,7 @@ class DocumentControllerTest {
         String tooLong = "x".repeat(256);
 
         String body = "{\"documentIds\":[\"" + id + "\"],\"archiveBox\":\"" + tooLong + "\"}";
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest());
@@ -1027,7 +1024,7 @@ class DocumentControllerTest {
         String[] ids = new String[500];
         for (int i = 0; i < 500; i++) ids[i] = UUID.randomUUID().toString();
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(ids)))
                 .andExpect(status().isOk())
@@ -1044,7 +1041,7 @@ class DocumentControllerTest {
 
         // Same id sent three times — controller should dedupe and call the
         // service exactly once, returning updated=1, not 3.
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(id.toString(), id.toString(), id.toString())))
                 .andExpect(status().isOk())
@@ -1063,7 +1060,7 @@ class DocumentControllerTest {
         when(documentService.applyBulkEditToDocument(any(), any(), any()))
                 .thenAnswer(inv -> Document.builder().id(inv.getArgument(0)).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(id1.toString(), id2.toString())))
                 .andExpect(status().isOk())
@@ -1139,7 +1136,7 @@ class DocumentControllerTest {
     void batchMetadata_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}"))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -1148,7 +1145,7 @@ class DocumentControllerTest {
     void batchMetadata_returns403_forUserWithoutReadAll() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}"))
                 .andExpect(status().isForbidden());
     }
 
@@ -1157,7 +1154,7 @@ class DocumentControllerTest {
     void batchMetadata_returns400_whenIdsEmpty() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[]}").with(csrf()))
+                        .content("{\"ids\":[]}"))
                 .andExpect(status().isBadRequest());
     }
 
@@ -1174,7 +1171,7 @@ class DocumentControllerTest {
 
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(sb.toString()).with(csrf()))
+                        .content(sb.toString()))
                 .andExpect(status().isBadRequest())
                 .andExpect(jsonPath("$.code").value("BULK_EDIT_TOO_MANY_IDS"));
     }
@@ -1189,7 +1186,7 @@ class DocumentControllerTest {
 
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + id + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + id + "\"]}"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$[0].id").value(id.toString()))
                 .andExpect(jsonPath("$[0].title").value("Brief"))
@@ -1210,7 +1207,7 @@ class DocumentControllerTest {
                         org.raddatz.familienarchiv.exception.ErrorCode.DOCUMENT_NOT_FOUND,
                         "evil\r\nFAKE LOG ENTRY: admin logged in"));
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(badId.toString())))
                 .andExpect(status().isOk())
@@ -1234,7 +1231,7 @@ class DocumentControllerTest {
                 .thenThrow(org.raddatz.familienarchiv.exception.DomainException.notFound(
                         org.raddatz.familienarchiv.exception.ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + badId));
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(okId.toString(), badId.toString())))
                 .andExpect(status().isOk())
@@ -1243,112 +1240,4 @@ class DocumentControllerTest {
                 .andExpect(jsonPath("$.errors[0].message").value(
                         org.hamcrest.Matchers.containsString("not found")));
     }
-
-    // ─── GET /api/documents/density ───────────────────────────────────────────
-
-    @Test
-    void density_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(get("/api/documents/density"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    @WithMockUser
-    void density_returns200_withResultBody_whenAuthenticated() throws Exception {
-        when(documentService.getDensity(any())).thenReturn(
-                new DocumentDensityResult(
-                        List.of(new MonthBucket("1915-08", 2), new MonthBucket("1915-09", 1)),
-                        java.time.LocalDate.of(1915, 8, 3),
-                        java.time.LocalDate.of(1915, 9, 1)));
-
-        mockMvc.perform(get("/api/documents/density"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.buckets").isArray())
-                .andExpect(jsonPath("$.buckets[0].month").value("1915-08"))
-                .andExpect(jsonPath("$.buckets[0].count").value(2))
-                .andExpect(jsonPath("$.minDate").value("1915-08-03"))
-                .andExpect(jsonPath("$.maxDate").value("1915-09-01"));
-    }
-
-    // Pins produces=APPLICATION_JSON_VALUE on the density mapping so the OpenAPI/TypeScript
-    // codegen records application/json instead of the wildcard. Without produces= the
-    // request-mapping accepts any Accept header and the OpenAPI emit falls back to the
-    // wildcard. Sending an Accept header that JSON cannot satisfy must NOT return 200 —
-    // Spring rejects with 406 (HttpMediaTypeNotAcceptableException), which our
-    // GlobalExceptionHandler may surface as 400. Either way it proves the route is
-    // locked to JSON.
-    @Test
-    @WithMockUser
-    void density_declaresApplicationJsonContentType() throws Exception {
-        when(documentService.getDensity(any())).thenReturn(
-                new DocumentDensityResult(List.of(), null, null));
-
-        mockMvc.perform(get("/api/documents/density")
-                        .accept(MediaType.APPLICATION_XML))
-                .andExpect(status().is4xxClientError());
-    }
-
-    @Test
-    @WithMockUser
-    void density_emitsPrivateCacheControlHeader() throws Exception {
-        when(documentService.getDensity(any())).thenReturn(
-                new DocumentDensityResult(List.of(), null, null));
-
-        mockMvc.perform(get("/api/documents/density"))
-                .andExpect(status().isOk())
-                .andExpect(header().string("Cache-Control",
-                        org.hamcrest.Matchers.containsString("max-age=300")))
-                .andExpect(header().string("Cache-Control",
-                        org.hamcrest.Matchers.containsString("private")));
-    }
-
-    @Test
-    @WithMockUser
-    void density_forwardsSenderAndTagFilters() throws Exception {
-        when(documentService.getDensity(any())).thenReturn(
-                new DocumentDensityResult(List.of(), null, null));
-        UUID senderId = UUID.randomUUID();
-
-        mockMvc.perform(get("/api/documents/density")
-                        .param("senderId", senderId.toString())
-                        .param("tag", "Familie")
-                        .param("tag", "Urlaub")
-                        .param("tagOp", "OR"))
-                .andExpect(status().isOk());
-
-        verify(documentService).getDensity(eq(new DensityFilters(
-                null, senderId, null,
-                List.of("Familie", "Urlaub"),
-                null, null,
-                org.raddatz.familienarchiv.tag.TagOperator.OR)));
-    }
-
-    @Test
-    @WithMockUser
-    void density_forwardsStatusAndQueryText() throws Exception {
-        when(documentService.getDensity(any())).thenReturn(
-                new DocumentDensityResult(List.of(), null, null));
-
-        mockMvc.perform(get("/api/documents/density")
-                        .param("q", "Brief")
-                        .param("status", "REVIEWED"))
-                .andExpect(status().isOk());
-
-        verify(documentService).getDensity(eq(new DensityFilters(
-                "Brief", null, null, null, null,
-                DocumentStatus.REVIEWED,
-                org.raddatz.familienarchiv.tag.TagOperator.AND)));
-    }
-
-    // ─── CSRF protection ──────────────────────────────────────────────────────
-
-    @Test
-    @WithMockUser
-    void post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        mockMvc.perform(post("/api/documents")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{}"))
-                .andExpect(status().isForbidden())
-                .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentDensityIntegrationTest.java

@@ -1,162 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.person.Person;
-import org.raddatz.familienarchiv.person.PersonRepository;
-import org.raddatz.familienarchiv.tag.Tag;
-import org.raddatz.familienarchiv.tag.TagRepository;
-import org.raddatz.familienarchiv.tag.TagOperator;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.annotation.Transactional;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.time.LocalDate;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * End-to-end test for the filter-reactive density aggregation.
- * Density bars must recompute as the user changes other filters (sender, tag,
- * status, …). The endpoint deliberately does NOT honour `from`/`to` — the chart
- * is the surface for picking those, so it must always span the broader space
- * the user is selecting within.
- */
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-@Transactional
-class DocumentDensityIntegrationTest {
-
-    @MockitoBean S3Client s3Client;
-    @Autowired DocumentService documentService;
-    @Autowired DocumentRepository documentRepository;
-    @Autowired PersonRepository personRepository;
-    @Autowired TagRepository tagRepository;
-
-    private Person hans;
-    private Person anna;
-    private Tag familieTag;
-    private Tag urlaubTag;
-
-    @BeforeEach
-    void seed() {
-        hans = personRepository.save(Person.builder().firstName("Hans").lastName("Müller").build());
-        anna = personRepository.save(Person.builder().firstName("Anna").lastName("Weber").build());
-        familieTag = tagRepository.save(Tag.builder().name("Familie").build());
-        urlaubTag = tagRepository.save(Tag.builder().name("Urlaub").build());
-    }
-
-    private static DensityFilters noFilters() {
-        return new DensityFilters(null, null, null, null, null, null, null);
-    }
-
-    @Test
-    void getDensity_returnsAllMonths_whenNoFiltersApplied() {
-        save("a", LocalDate.of(1915, 8, 3), null, Set.of());
-        save("b", LocalDate.of(1915, 8, 17), null, Set.of());
-        save("c", LocalDate.of(1915, 9, 1), null, Set.of());
-
-        DocumentDensityResult result = documentService.getDensity(noFilters());
-
-        assertThat(result.buckets()).extracting(MonthBucket::month)
-                .containsExactly("1915-08", "1915-09");
-        assertThat(result.buckets()).extracting(MonthBucket::count).containsExactly(2, 1);
-        assertThat(result.minDate()).isEqualTo(LocalDate.of(1915, 8, 3));
-        assertThat(result.maxDate()).isEqualTo(LocalDate.of(1915, 9, 1));
-    }
-
-    @Test
-    void getDensity_filtersBySender() {
-        save("a", LocalDate.of(1915, 8, 3), hans, Set.of());
-        save("b", LocalDate.of(1916, 1, 4), hans, Set.of());
-        save("c", LocalDate.of(1920, 5, 1), anna, Set.of());
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(null, hans.getId(), null, null, null, null, null));
-
-        assertThat(result.buckets()).extracting(MonthBucket::month)
-                .containsExactly("1915-08", "1916-01");
-        assertThat(result.maxDate()).isEqualTo(LocalDate.of(1916, 1, 4));
-    }
-
-    @Test
-    void getDensity_filtersByTag() {
-        save("a", LocalDate.of(1915, 8, 3), null, Set.of(familieTag));
-        save("b", LocalDate.of(1920, 5, 1), null, Set.of(urlaubTag));
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(null, null, null, List.of("Familie"), null, null, TagOperator.AND));
-
-        assertThat(result.buckets()).extracting(MonthBucket::month).containsExactly("1915-08");
-    }
-
-    @Test
-    void getDensity_combinesSenderAndTag() {
-        save("a", LocalDate.of(1915, 8, 3), hans, Set.of(familieTag));
-        save("b", LocalDate.of(1916, 1, 4), hans, Set.of(urlaubTag));
-        save("c", LocalDate.of(1920, 5, 1), anna, Set.of(familieTag));
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(null, hans.getId(), null, List.of("Familie"), null, null, TagOperator.AND));
-
-        assertThat(result.buckets()).extracting(MonthBucket::month).containsExactly("1915-08");
-    }
-
-    @Test
-    void getDensity_filtersByStatus() {
-        save("a", LocalDate.of(1915, 8, 3), null, Set.of(), DocumentStatus.UPLOADED);
-        save("b", LocalDate.of(1916, 1, 4), null, Set.of(), DocumentStatus.PLACEHOLDER);
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(null, null, null, null, null, DocumentStatus.UPLOADED, null));
-
-        assertThat(result.buckets()).extracting(MonthBucket::month).containsExactly("1915-08");
-    }
-
-    @Test
-    void getDensity_returnsEmpty_whenNoDocumentsMatch() {
-        save("a", LocalDate.of(1915, 8, 3), hans, Set.of());
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters(null, anna.getId(), null, null, null, null, null));
-
-        assertThat(result.buckets()).isEmpty();
-        assertThat(result.minDate()).isNull();
-        assertThat(result.maxDate()).isNull();
-    }
-
-    @Test
-    void getDensity_excludesDocumentsWithNullDate() {
-        save("dated", LocalDate.of(1915, 8, 3), null, Set.of());
-        save("undated", null, null, Set.of());
-
-        DocumentDensityResult result = documentService.getDensity(noFilters());
-
-        assertThat(result.buckets()).extracting(MonthBucket::count).containsExactly(1);
-    }
-
-    private void save(String suffix, LocalDate date, Person sender, Set<Tag> tags) {
-        save(suffix, date, sender, tags, DocumentStatus.UPLOADED);
-    }
-
-    private void save(String suffix, LocalDate date, Person sender, Set<Tag> tags, DocumentStatus status) {
-        documentRepository.save(Document.builder()
-                .title("Doc " + suffix)
-                .originalFilename("doc-" + suffix + "-" + UUID.randomUUID() + ".pdf")
-                .status(status)
-                .documentDate(date)
-                .sender(sender)
-                .tags(new HashSet<>(tags))
-                .build());
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentFtsPagedIntegrationTest.java

@@ -1,109 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import jakarta.persistence.EntityManager;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.config.FlywayConfig;
-import org.raddatz.familienarchiv.document.DocumentRepository;
-import org.raddatz.familienarchiv.document.Document;
-import org.raddatz.familienarchiv.document.DocumentStatus;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
-import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
-import org.springframework.context.annotation.Import;
-import org.springframework.test.annotation.DirtiesContext;
-
-import java.util.List;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatNoException;
-
-/**
- * Repository-level integration tests for {@code findFtsPageRaw}: verifies that the
- * paginated FTS query returns exactly page-size rows and that the window-function
- * total reflects the full match count, not just the page count.
- *
- * <p>Uses real Postgres via Testcontainers so the GIN index, tsvector trigger, and
- * {@code websearch_to_tsquery} semantics are identical to production.
- *
- * <p>{@code AFTER_CLASS} dirty-context keeps the Spring context alive for all tests
- * in this class and rebuilds it once at the end, rather than after every test.
- */
-@DataJpaTest
-@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
-@Import({PostgresContainerConfig.class, FlywayConfig.class})
-@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
-class DocumentFtsPagedIntegrationTest {
-
-    @Autowired DocumentRepository documentRepository;
-    @Autowired EntityManager em;
-
-    // 60 docs match "Walter"; 10 docs with "Hans" do not.
-    private static final int WALTER_COUNT = 60;
-    private static final int PAGE_SIZE = 50;
-
-    @BeforeEach
-    void seed() {
-        documentRepository.deleteAll();
-        em.flush();
-        for (int i = 0; i < WALTER_COUNT; i++) {
-            documentRepository.saveAndFlush(doc("Brief von Walter Nr. " + i));
-        }
-        for (int i = 0; i < 10; i++) {
-            documentRepository.saveAndFlush(doc("Brief von Hans Nr. " + i));
-        }
-        em.clear();
-    }
-
-    @Test
-    void findFtsPageRaw_firstPage_returnsPageSizeRows() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", 0, PAGE_SIZE);
-
-        assertThat(rows).hasSize(PAGE_SIZE);
-    }
-
-    @Test
-    void findFtsPageRaw_windowTotal_equalsFullMatchCount_notPageSize() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", 0, PAGE_SIZE);
-
-        long total = ((Number) rows.get(0)[2]).longValue();
-        assertThat(total).isEqualTo(WALTER_COUNT);
-    }
-
-    @Test
-    void findFtsPageRaw_lastPage_returnsRemainder() {
-        int remainder = WALTER_COUNT % PAGE_SIZE; // 60 % 50 = 10
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", PAGE_SIZE, PAGE_SIZE);
-
-        assertThat(rows).hasSize(remainder);
-        long total = ((Number) rows.get(0)[2]).longValue();
-        assertThat(total).isEqualTo(WALTER_COUNT);
-    }
-
-    @Test
-    void findFtsPageRaw_noMatches_returnsEmptyList() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("XYZ_KEIN_TREFFER", 0, PAGE_SIZE);
-
-        assertThat(rows).isEmpty();
-    }
-
-    @Test
-    void findFtsPageRaw_stopwordOnlyQuery_returnsEmptyList_noException() {
-        assertThatNoException().isThrownBy(() -> {
-            List<Object[]> rows = documentRepository.findFtsPageRaw("der die das und", 0, PAGE_SIZE);
-            assertThat(rows).isEmpty();
-        });
-    }
-
-    // ─── Helper ───────────────────────────────────────────────────────────────
-
-    private Document doc(String title) {
-        return Document.builder()
-                .title(title)
-                .originalFilename(title.replace(" ", "_") + ".pdf")
-                .status(DocumentStatus.UPLOADED)
-                .build();
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentFtsTest.java

@@ -69,7 +69,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Alter Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Brief");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Brief");
 
         assertThat(ids).hasSize(1);
     }
@@ -79,7 +79,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Alter Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Briefe");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Briefe");
 
         assertThat(ids).hasSize(1);
     }
@@ -89,7 +89,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Ein furchtbarer Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("furchtb");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("furchtb");
 
         assertThat(ids).hasSize(1);
     }
@@ -99,7 +99,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Familienfoto"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Brief");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Brief");
 
         assertThat(ids).isEmpty();
     }
@@ -115,7 +115,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("schreiben");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("schreiben");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -125,14 +125,14 @@ class DocumentFtsTest {
         Document doc = documentRepository.saveAndFlush(document("Leeres Dokument"));
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).isEmpty();
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).isEmpty();
 
         UUID annotationId = annotation(doc.getId());
         blockRepository.saveAndFlush(block(doc.getId(), annotationId, "Grundbuch Eintrag 1923", 0));
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).contains(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).contains(doc.getId());
     }
 
     @Test
@@ -144,13 +144,13 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).contains(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).contains(doc.getId());
 
         blockRepository.deleteById(block.getId());
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).doesNotContain(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).doesNotContain(doc.getId());
     }
 
     // ─── Ranking ───────────────────────────────────────────────────────────────
@@ -166,7 +166,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Grundbuch");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Grundbuch");
 
         assertThat(ids).hasSize(2);
         assertThat(ids.get(0)).isEqualTo(docA.getId());
@@ -179,7 +179,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Ein Brief von der Oma"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("der die das und");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("der die das und");
 
         assertThat(ids).isEmpty();
     }
@@ -195,7 +195,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Wille");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Wille");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -205,7 +205,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Brief"));
         em.clear();
 
-        assertThatNoException().isThrownBy(() -> documentRepository.findAllMatchingIdsByFts("((("));
+        assertThatNoException().isThrownBy(() -> documentRepository.findRankedIdsByFts("((("));
     }
 
     // ─── Weight C: sender/receiver names ───────────────────────────────────────
@@ -223,7 +223,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Schmidt");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Schmidt");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -241,7 +241,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Raddatz");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Raddatz");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -260,7 +260,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Familiengeschichte");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Familiengeschichte");
 
         assertThat(ids).hasSize(1);
     }
@@ -278,7 +278,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> rankedIds = documentRepository.findAllMatchingIdsByFts("Grundbuch");
+        List<UUID> rankedIds = documentRepository.findRankedIdsByFts("Grundbuch");
         Specification<Document> spec = Specification.where(hasIds(rankedIds))
                 .and(hasStatus(DocumentStatus.UPLOADED));
 

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentLazyLoadingTest.java

@@ -1,178 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.audit.AuditLogQueryService;
-import org.raddatz.familienarchiv.dashboard.DashboardService;
-import org.raddatz.familienarchiv.person.Person;
-import org.raddatz.familienarchiv.person.PersonRepository;
-import org.raddatz.familienarchiv.tag.Tag;
-import org.raddatz.familienarchiv.tag.TagRepository;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.data.domain.PageRequest;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.util.HashSet;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.when;
-
-/**
- * Verifies that lazy-loaded associations on {@link Document} are accessible after a service
- * method returns — i.e. no {@link org.hibernate.LazyInitializationException} is thrown outside
- * the Hibernate session that loaded the entity.
- *
- * <p><b>Known limitation:</b> calling {@code getDocumentById} (or any other service method) from
- * within an already-open transaction is not covered here. When an outer transaction is active,
- * the service's own {@code @Transactional} merges into it and Hibernate keeps the same session
- * open, so the lazy-init guard behaves differently than in a non-transactional caller. This is a
- * known constraint of the test setup, not a bug in the production code.
- */
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class DocumentLazyLoadingTest {
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Autowired
-    DocumentRepository documentRepository;
-
-    @Autowired
-    PersonRepository personRepository;
-
-    @Autowired
-    TagRepository tagRepository;
-
-    @Autowired
-    DocumentService documentService;
-
-    @Autowired
-    DashboardService dashboardService;
-
-    @MockitoBean
-    AuditLogQueryService auditLogQueryService;
-
-    @AfterEach
-    void cleanup() {
-        documentRepository.deleteAll();
-        tagRepository.deleteAll();
-        personRepository.deleteAll();
-    }
-
-    @Test
-    void getDocumentById_tagsAndReceiversAccessible_afterReturnFromService() {
-        Person sender = savedPerson("Max", "LzSender");
-        Person receiver = savedPerson("Anna", "LzReceiver");
-        Tag tag = savedTag("LzTag");
-        Document doc = savedDocument("LazyTest", "lazy_test.pdf", sender, Set.of(receiver), Set.of(tag));
-
-        Document result = documentService.getDocumentById(doc.getId());
-
-        // Only the collection access itself is in assertThatCode — guards against LazyInitializationException.
-        // Value assertions live outside so failures surface as AssertionError, not as unexpected exception.
-        assertThatCode(() -> {
-            result.getTags().size();
-            result.getReceivers().size();
-        }).doesNotThrowAnyException();
-        assertThat(result.getTags()).isNotEmpty();
-        result.getTags().forEach(t -> assertThat(t.getName()).isNotNull());
-        assertThat(result.getReceivers()).isNotEmpty();
-        result.getReceivers().forEach(r -> assertThat(r.getLastName()).isNotNull());
-    }
-
-    @Test
-    void getRecentActivity_collectionsAccessibleAfterReturn() {
-        Person sender = savedPerson("Hans", "RaSender");
-        Tag tag = savedTag("RaTag");
-        for (int i = 0; i < 3; i++) {
-            savedDocument("RaDoc " + i, "ra_doc" + i + ".pdf", sender, Set.of(), Set.of(tag));
-        }
-
-        List<Document> results = documentService.getRecentActivity(3);
-
-        // Access lazy fields inside assertThatCode — guards against LazyInitializationException.
-        // Value assertions live outside so failures surface as AssertionError, not as unexpected exception.
-        assertThatCode(() -> {
-            results.forEach(d -> d.getSender().getLastName());
-            results.forEach(d -> d.getTags().size());
-        }).doesNotThrowAnyException();
-        results.forEach(d -> assertThat(d.getSender()).isNotNull());
-        results.forEach(d -> assertThat(d.getSender().getLastName()).isNotNull());
-        results.forEach(d -> assertThat(d.getTags()).isNotEmpty());
-    }
-
-    @Test
-    void searchDocuments_receiverSort_doesNotThrowLazyInitializationException() {
-        Person sender = savedPerson("Hans", "SrSender");
-        Person receiver = savedPerson("Anna", "SrReceiver");
-        Tag tag = savedTag("SrTag");
-        savedDocument("SrDoc", "sr_doc.pdf", sender, Set.of(receiver), Set.of(tag));
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                null, null, null, null, null, null, null, null,
-                DocumentSort.RECEIVER, "asc", null,
-                PageRequest.of(0, 20));
-        assertThat(result.totalElements()).isGreaterThan(0);
-        assertThatCode(() ->
-                result.items().forEach(i -> i.document().getSender().getLastName()))
-                .doesNotThrowAnyException();
-    }
-
-    @Test
-    void searchDocuments_senderSort_doesNotThrowLazyInitializationException() {
-        Person sender = savedPerson("Hans", "SsSender");
-        Tag tag = savedTag("SsTag");
-        savedDocument("SsDoc", "ss_doc.pdf", sender, Set.of(), Set.of(tag));
-
-        assertThatCode(() -> documentService.searchDocuments(
-                null, null, null, null, null, null, null, null,
-                DocumentSort.SENDER, "asc", null,
-                PageRequest.of(0, 20)))
-                .doesNotThrowAnyException();
-    }
-
-    @Test
-    void dashboardService_getResume_accessesReceiversViaGetDocumentById_withoutException() {
-        Person sender = savedPerson("Max", "DsSender");
-        Person receiver = savedPerson("Anna", "DsReceiver");
-        Document doc = savedDocument("DashboardTest", "dashboard_test.pdf", sender, Set.of(receiver), Set.of());
-        UUID fakeUserId = UUID.randomUUID();
-        when(auditLogQueryService.findMostRecentDocumentForUser(any())).thenReturn(Optional.of(doc.getId()));
-        when(auditLogQueryService.findRecentContributorsPerDocument(any())).thenReturn(java.util.Map.of());
-
-        assertThatCode(() -> dashboardService.getResume(fakeUserId))
-                .doesNotThrowAnyException();
-    }
-
-    private Person savedPerson(String firstName, String lastName) {
-        return personRepository.save(Person.builder().firstName(firstName).lastName(lastName).build());
-    }
-
-    private Tag savedTag(String name) {
-        return tagRepository.save(Tag.builder().name(name).build());
-    }
-
-    private Document savedDocument(String title, String filename, Person sender,
-                                   Set<Person> receivers, Set<Tag> tags) {
-        return documentRepository.save(Document.builder()
-                .title(title).originalFilename(filename)
-                .status(DocumentStatus.UPLOADED)
-                .sender(sender)
-                .receivers(new HashSet<>(receivers))
-                .tags(new HashSet<>(tags))
-                .build());
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentRepositoryTest.java

@@ -1,9 +1,5 @@
 package org.raddatz.familienarchiv.document;
 
-import jakarta.persistence.EntityManager;
-import jakarta.persistence.EntityManagerFactory;
-import org.hibernate.SessionFactory;
-import org.hibernate.stat.Statistics;
 import org.junit.jupiter.api.Test;
 import org.raddatz.familienarchiv.PostgresContainerConfig;
 import org.raddatz.familienarchiv.config.FlywayConfig;
@@ -25,7 +21,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
 import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
 import org.springframework.context.annotation.Import;
-import org.springframework.data.jpa.domain.Specification;
 
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
@@ -60,12 +55,6 @@ class DocumentRepositoryTest {
     @Autowired
     private TranscriptionBlockRepository transcriptionBlockRepository;
 
-    @Autowired
-    private EntityManagerFactory entityManagerFactory;
-
-    @Autowired
-    private EntityManager entityManager;
-
     // ─── save and findById ────────────────────────────────────────────────────
 
     @Test
@@ -501,117 +490,6 @@ class DocumentRepositoryTest {
         assertThat(ids).containsExactlyInAnyOrder(grandparent.getId(), parent2.getId(), child2.getId());
     }
 
-    // ─── query-count — entity-graph assertions ────────────────────────────────
-
-    @Test
-    void findAll_withSpecAndPageable_loadsDocumentsInAtMostFiveStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Hans").lastName("QcSender").build());
-        Person receiver = personRepository.save(Person.builder().firstName("Anna").lastName("QcReceiver").build());
-        Tag tag = tagRepository.save(Tag.builder().name("QcTag").build());
-        for (int i = 0; i < 10; i++) {
-            documentRepository.save(Document.builder()
-                    .title("QcDoc " + i).originalFilename("qcdoc" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .receivers(new HashSet<>(Set.of(receiver)))
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        Specification<Document> allDocs = (root, query, cb) -> null;
-        documentRepository.findAll(allDocs, PageRequest.of(0, 10));
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) must load 10 docs in ≤5 statements, not N+1")
-                .isLessThanOrEqualTo(5);
-    }
-
-    @Test
-    void findById_loadsSenderReceiversAndTagsInAtMostTwoStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Max").lastName("FbSender").build());
-        Set<Person> receivers = new HashSet<>();
-        for (int i = 0; i < 3; i++) {
-            receivers.add(personRepository.save(
-                    Person.builder().firstName("R" + i).lastName("FbReceiver").build()));
-        }
-        Set<Tag> tags = new HashSet<>();
-        for (int i = 0; i < 5; i++) {
-            tags.add(tagRepository.save(Tag.builder().name("FbTag" + i).build()));
-        }
-        Document doc = documentRepository.save(Document.builder()
-                .title("FindByIdQc").originalFilename("findbyid_qc.pdf")
-                .status(DocumentStatus.UPLOADED)
-                .sender(sender).receivers(receivers).tags(tags)
-                .build());
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        documentRepository.findById(doc.getId());
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.full) must load sender+receivers+tags in ≤2 statements, not 4")
-                .isLessThanOrEqualTo(2);
-    }
-
-    @Test
-    void findAll_withPageable_loadsSenderWithoutNPlusOne() {
-        Person sender = personRepository.save(Person.builder().firstName("Maria").lastName("RaSender").build());
-        Tag tag = tagRepository.save(Tag.builder().name("RaTag2").build());
-        for (int i = 0; i < 5; i++) {
-            documentRepository.save(Document.builder()
-                    .title("RaDoc2 " + i).originalFilename("radoc2_" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        documentRepository.findAll(PageRequest.of(0, 5, Sort.by(Sort.Direction.DESC, "updatedAt")));
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) via findAll(Pageable) must not N+1 sender for 5 docs")
-                .isLessThanOrEqualTo(5);
-    }
-
-    @Test
-    void findAll_withSpecOnly_appliesEntityGraphInAtMostFiveStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Otto").lastName("SoSender").build());
-        Tag tag = tagRepository.save(Tag.builder().name("SoTag").build());
-        for (int i = 0; i < 5; i++) {
-            documentRepository.save(Document.builder()
-                    .title("SoDoc " + i).originalFilename("sodoc_" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        Specification<Document> allDocs = (root, query, cb) -> null;
-        documentRepository.findAll(allDocs);
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) via findAll(Spec) must not N+1 sender for 5 docs")
-                .isLessThanOrEqualTo(5);
-    }
-
     // ─── seeding helpers ─────────────────────────────────────────────────────
 
     private Document uploaded(String title) {

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentSearchPagedIntegrationTest.java

@@ -12,9 +12,9 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
 import org.springframework.data.domain.PageRequest;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.annotation.Transactional;
 import software.amazon.awssdk.services.s3.S3Client;
 
 import java.time.LocalDate;
@@ -33,7 +33,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
-@Transactional
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class DocumentSearchPagedIntegrationTest {
 
     private static final int FIXTURE_SIZE = 120;

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentServiceSortTest.java

@@ -21,22 +21,17 @@ import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.domain.Specification;
 
 import java.time.LocalDate;
-import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyInt;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class DocumentServiceSortTest {
 
-    private static final Pageable PAGE = org.springframework.data.domain.PageRequest.of(0, 10_000);
+    private static final Pageable UNPAGED = org.springframework.data.domain.PageRequest.of(0, 10_000);
 
     @Mock DocumentRepository documentRepository;
     @Mock PersonService personService;
@@ -48,12 +43,12 @@ class DocumentServiceSortTest {
     @Mock TranscriptionBlockQueryService transcriptionBlockQueryService;
     @InjectMocks DocumentService documentService;
 
-    // ─── DATE sort ────────────────────────────────────────────────────────────
+    // ─── searchDocuments — DATE sort ──────────────────────────────────────────
 
     @Test
     void searchDocuments_with_DATE_sort_and_text_sorts_chronologically_not_by_relevance() {
-        UUID id1 = UUID.randomUUID();  // higher relevance, older doc
+        UUID id1 = UUID.randomUUID();  // rank position 0 (higher relevance, older doc)
-        UUID id2 = UUID.randomUUID();  // lower relevance, newer doc
+        UUID id2 = UUID.randomUUID();  // rank position 1 (lower relevance, newer doc)
 
         Document older = Document.builder().id(id1)
                 .title("Brief").status(DocumentStatus.UPLOADED)
@@ -62,48 +57,38 @@ class DocumentServiceSortTest {
                 .title("Brief").status(DocumentStatus.UPLOADED)
                 .documentDate(LocalDate.of(1960, 1, 1)).build();
 
-        when(documentRepository.findAllMatchingIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        // FTS returns id1 first (higher rank), id2 second
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        // findAll(spec, pageable) — the correct date path — returns date-DESC order
         when(documentRepository.findAll(any(Specification.class), any(Pageable.class)))
                 .thenReturn(new PageImpl<>(List.of(newer, older)));
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.DATE, "DESC", null, PAGE);
+                "Brief", null, null, null, null, null, null, null, DocumentSort.DATE, "DESC", null, UNPAGED);
 
+        // Expect: date order (newer 1960 first), NOT rank order (older 1940 first)
         assertThat(result.items()).hasSize(2);
-        assertThat(result.items().get(0).document().getId()).isEqualTo(id2);  // newer first
+        assertThat(result.items().get(0).document().getId()).isEqualTo(id2);  // newer doc first
     }
 
-    // ─── RELEVANCE sort — pure text (no filters) ──────────────────────────────
+    // ─── searchDocuments — RELEVANCE sort ─────────────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_pureText_calls_findFtsPageRaw_not_findAllMatchingIds() {
-        UUID id1 = UUID.randomUUID();
-        List<Object[]> ftsRows = ftsRows(id1, 0.5d, 1L);
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any()))
-                .thenReturn(List.of(doc(id1)));
-
-        documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
-
-        verify(documentRepository).findFtsPageRaw(anyString(), anyInt(), anyInt());
-        verify(documentRepository, never()).findAllMatchingIdsByFts(anyString());
-    }
 
     @Test
     void searchDocuments_with_RELEVANCE_sort_and_text_preserves_fts_rank_order() {
-        UUID id1 = UUID.randomUUID();  // higher rank — must appear first
+        UUID id1 = UUID.randomUUID();  // rank position 0
-        UUID id2 = UUID.randomUUID();  // lower rank
+        UUID id2 = UUID.randomUUID();  // rank position 1
 
-        List<Object[]> ftsRows = new ArrayList<>();
+        Document doc1 = Document.builder().id(id1).title("Brief").status(DocumentStatus.UPLOADED).build();
-        ftsRows.add(new Object[]{id1, 0.8d, 2L});
+        Document doc2 = Document.builder().id(id2).title("Brief").status(DocumentStatus.UPLOADED).build();
-        ftsRows.add(new Object[]{id2, 0.3d, 2L});
+
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(id2), doc(id1))); // unordered from JPA
+        when(documentRepository.findAll(any(Specification.class)))
+                .thenReturn(List.of(doc2, doc1));  // unordered from DB
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
+                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, UNPAGED);
 
+        // Expect: rank order restored (id1 first)
         assertThat(result.items().get(0).document().getId()).isEqualTo(id1);
     }
 
@@ -112,82 +97,16 @@ class DocumentServiceSortTest {
         UUID id1 = UUID.randomUUID();
         UUID id2 = UUID.randomUUID();
 
-        List<Object[]> ftsRows = new ArrayList<>();
+        Document doc1 = Document.builder().id(id1).title("Brief").status(DocumentStatus.UPLOADED).build();
-        ftsRows.add(new Object[]{id1, 0.8d, 2L});
+        Document doc2 = Document.builder().id(id2).title("Brief").status(DocumentStatus.UPLOADED).build();
-        ftsRows.add(new Object[]{id2, 0.3d, 2L});
+
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(id2), doc(id1)));
+        when(documentRepository.findAll(any(Specification.class)))
+                .thenReturn(List.of(doc2, doc1));
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, null, null, null, PAGE);
+                "Brief", null, null, null, null, null, null, null, null, null, null, UNPAGED);
 
         assertThat(result.items().get(0).document().getId()).isEqualTo(id1);
     }
-
-    // ─── RELEVANCE sort — overflow guard ─────────────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_returns_empty_when_offset_exceeds_maxInt() {
-        // offset = pageNumber * pageSize; choose values so offset > Integer.MAX_VALUE
-        Pageable hugePage = org.springframework.data.domain.PageRequest.of(Integer.MAX_VALUE / 10 + 1, 10);
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null,
-                DocumentSort.RELEVANCE, null, null, hugePage);
-
-        assertThat(result.items()).isEmpty();
-        verify(documentRepository, never()).findFtsPageRaw(anyString(), anyInt(), anyInt());
-    }
-
-    // ─── toFtsPage — UUID-as-String JDBC driver variance ────────────────────
-
-    @Test
-    void searchDocuments_relevance_handles_string_uuid_from_jdbc_driver() {
-        String stringId = "11111111-1111-1111-1111-111111111111";
-        UUID uuidId = UUID.fromString(stringId);
-        // Simulate a JDBC driver that returns the id column as String instead of UUID
-        List<Object[]> ftsRows = new ArrayList<>();
-        ftsRows.add(new Object[]{stringId, 0.5d, 1L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(uuidId)));
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null,
-                DocumentSort.RELEVANCE, null, null, PAGE);
-
-        assertThat(result.items()).hasSize(1);
-        assertThat(result.items().get(0).document().getId()).isEqualTo(uuidId);
-    }
-
-    // ─── RELEVANCE sort — text + active filter ────────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_with_active_filter_uses_inMemory_path() {
-        UUID id1 = UUID.randomUUID();
-        UUID id2 = UUID.randomUUID();
-
-        when(documentRepository.findAllMatchingIdsByFts("Brief")).thenReturn(List.of(id1, id2));
-        when(documentRepository.findAll(any(Specification.class)))
-                .thenReturn(List.of(doc(id2), doc(id1)));
-
-        // sender filter is active → triggers in-memory path, not findFtsPageRaw
-        LocalDate from = LocalDate.of(1900, 1, 1);
-        documentService.searchDocuments(
-                "Brief", from, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
-
-        verify(documentRepository, never()).findFtsPageRaw(anyString(), anyInt(), anyInt());
-        verify(documentRepository).findAllMatchingIdsByFts("Brief");
-    }
-
-    // ─── Helpers ──────────────────────────────────────────────────────────────
-
-    private static Document doc(UUID id) {
-        return Document.builder().id(id).title("Brief").status(DocumentStatus.UPLOADED).build();
-    }
-
-    private static List<Object[]> ftsRows(UUID id, double rank, long total) {
-        List<Object[]> rows = new ArrayList<>();
-        rows.add(new Object[]{id, rank, total});
-        return rows;
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentServiceTest.java

@@ -33,7 +33,6 @@ import org.springframework.data.domain.PageImpl;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
-import org.springframework.data.jpa.domain.Specification;
 import org.springframework.mock.web.MockMultipartFile;
 
 import java.time.LocalDate;
@@ -1403,21 +1402,6 @@ class DocumentServiceTest {
         assertThat(result.items()).hasSize(1); // only the slice is enriched
     }
 
-    @Test
-    void searchDocuments_UPDATED_AT_sort_resolves_to_updatedAt_field() {
-        ArgumentCaptor<Pageable> captor = ArgumentCaptor.forClass(Pageable.class);
-        when(documentRepository.findAll(any(org.springframework.data.jpa.domain.Specification.class), any(Pageable.class)))
-                .thenReturn(new PageImpl<>(List.of()));
-
-        documentService.searchDocuments(null, null, null, null, null, null, null, null,
-                DocumentSort.UPDATED_AT, "DESC", null,
-                org.springframework.data.domain.PageRequest.of(0, 5));
-
-        verify(documentRepository).findAll(any(org.springframework.data.jpa.domain.Specification.class), captor.capture());
-        assertThat(captor.getValue().getSort())
-                .isEqualTo(Sort.by(Sort.Direction.DESC, "updatedAt"));
-    }
-
     @Test
     void searchDocuments_senderSort_slicesInMemoryAndReportsFullTotal() {
         // Fixture: 120 docs with senders; request page 1, size 50 → expect 50 items
@@ -1620,10 +1604,9 @@ class DocumentServiceTest {
         // chr(1)=\u0001 marks start, chr(2)=\u0002 marks end of highlighted term
         List<Object[]> rows = Collections.singletonList(new Object[]{docId, "\u0001Brief\u0002 an Anna", null, false, null, null, null});
 
-        List<Object[]> ftsRows = new java.util.ArrayList<>();
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(docId));
-        ftsRows.add(new Object[]{docId, 0.5d, 1L});
+        when(documentRepository.findAll(any(org.springframework.data.jpa.domain.Specification.class)))
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
+                .thenReturn(List.of(doc));
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc));
         when(documentRepository.findEnrichmentData(any(), eq("Brief"))).thenReturn(rows);
 
         DocumentSearchResult result = documentService.searchDocuments(
@@ -1655,10 +1638,9 @@ class DocumentServiceTest {
         String snippetHeadline = "Hier ist der \u0001Brief\u0002 aus Berlin";
         List<Object[]> rows = Collections.singletonList(new Object[]{docId, "Dok", snippetHeadline, false, null, null, null});
 
-        List<Object[]> snippetFtsRows = new java.util.ArrayList<>();
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(docId));
-        snippetFtsRows.add(new Object[]{docId, 0.5d, 1L});
+        when(documentRepository.findAll(any(org.springframework.data.jpa.domain.Specification.class)))
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(snippetFtsRows);
+                .thenReturn(List.of(doc));
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc));
         when(documentRepository.findEnrichmentData(any(), eq("Brief"))).thenReturn(rows);
 
         DocumentSearchResult result = documentService.searchDocuments(
@@ -2204,7 +2186,7 @@ class DocumentServiceTest {
 
     @Test
     void findIdsForFilter_returnsEmpty_whenFtsHasNoMatches() {
-        when(documentRepository.findAllMatchingIdsByFts("xyz")).thenReturn(List.of());
+        when(documentRepository.findRankedIdsByFts("xyz")).thenReturn(List.of());
 
         List<UUID> result = documentService.findIdsForFilter(
                 "xyz", null, null, null, null, null, null, null, null);
@@ -2339,61 +2321,4 @@ class DocumentServiceTest {
         assertThat(documentService.save(doc)).isEqualTo(doc);
         verify(documentRepository).save(doc);
     }
-
-    // ─── getDensity ────────────────────────────────────────────────────────────
-
-    private static DensityFilters anyFilters() {
-        return new DensityFilters(null, null, null, null, null, null, null);
-    }
-
-    @Test
-    void getDensity_returnsEmptyResult_whenNoDocumentsMatch() {
-        when(documentRepository.findAll(any(Specification.class))).thenReturn(List.of());
-
-        DocumentDensityResult result = documentService.getDensity(anyFilters());
-
-        assertThat(result.buckets()).isEmpty();
-        assertThat(result.minDate()).isNull();
-        assertThat(result.maxDate()).isNull();
-    }
-
-    @Test
-    void getDensity_groupsMatchingDocumentsByMonth() {
-        Document a = Document.builder().documentDate(LocalDate.of(1915, 8, 3)).build();
-        Document b = Document.builder().documentDate(LocalDate.of(1915, 8, 17)).build();
-        Document c = Document.builder().documentDate(LocalDate.of(1915, 9, 1)).build();
-        when(documentRepository.findAll(any(Specification.class))).thenReturn(List.of(a, b, c));
-        when(tagService.expandTagNamesToDescendantIdSets(any())).thenReturn(List.of());
-
-        DocumentDensityResult result = documentService.getDensity(anyFilters());
-
-        assertThat(result.buckets()).extracting(MonthBucket::month)
-                .containsExactly("1915-08", "1915-09");
-        assertThat(result.buckets()).extracting(MonthBucket::count).containsExactly(2, 1);
-        assertThat(result.minDate()).isEqualTo(LocalDate.of(1915, 8, 3));
-        assertThat(result.maxDate()).isEqualTo(LocalDate.of(1915, 9, 1));
-    }
-
-    @Test
-    void getDensity_excludesDocumentsWithNullDate() {
-        Document dated = Document.builder().documentDate(LocalDate.of(1915, 8, 3)).build();
-        Document undated = Document.builder().documentDate(null).build();
-        when(documentRepository.findAll(any(Specification.class))).thenReturn(List.of(dated, undated));
-        when(tagService.expandTagNamesToDescendantIdSets(any())).thenReturn(List.of());
-
-        DocumentDensityResult result = documentService.getDensity(anyFilters());
-
-        assertThat(result.buckets()).extracting(MonthBucket::count).containsExactly(1);
-    }
-
-    @Test
-    void getDensity_shortCircuits_whenFtsReturnsNoMatches() {
-        when(documentRepository.findAllMatchingIdsByFts("xyz")).thenReturn(List.of());
-
-        DocumentDensityResult result = documentService.getDensity(
-                new DensityFilters("xyz", null, null, null, null, null, null));
-
-        assertThat(result.buckets()).isEmpty();
-        verify(documentRepository, org.mockito.Mockito.never()).findAll(any(Specification.class));
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/ThumbnailServiceIntegrationTest.java

@@ -10,7 +10,6 @@ import org.raddatz.familienarchiv.document.DocumentStatus;
 import org.raddatz.familienarchiv.document.DocumentRepository;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.test.context.ActiveProfiles;
 import org.springframework.context.annotation.Import;
 import org.springframework.test.context.DynamicPropertyRegistry;
 import org.springframework.test.context.DynamicPropertySource;
@@ -42,7 +41,6 @@ import static org.assertj.core.api.Assertions.assertThat;
  * test pyramid mocks at the FileService boundary.
  */
 @SpringBootTest
-@ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
 class ThumbnailServiceIntegrationTest {