ci: track act_runner config with Docker socket mount

Documents the NAS runner configuration needed for Testcontainers.
Must be deployed to the runner host alongside the act_runner binary.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/personas/architect.md

@@ -414,7 +414,7 @@ Never Kafka for teams under 10 or <100k events/day. Never gRPC inside a monolith
 
 | PR contains | Required doc update |
 |---|---|
-| New Flyway migration adding/removing/renaming a table or column | `docs/architecture/db/db-orm.puml` and `docs/architecture/db/db-relationships.puml` — **except** framework-owned tables (e.g. Spring Session JDBC's `spring_session*`, Flyway's `flyway_schema_history`), which are opaque to app code; reference the relevant ADR if an exclusion is load-bearing |
+| New Flyway migration adding/removing/renaming a table or column | `docs/architecture/db/db-orm.puml` and `docs/architecture/db/db-relationships.puml` |
 | New `@ManyToMany` join table or FK | Both DB diagrams |
 | New backend package or domain module | `CLAUDE.md` package table + matching `docs/architecture/c4/l3-backend-*.puml` |
 | New controller or service in an existing backend domain | Matching `docs/architecture/c4/l3-backend-*.puml` |

.claude/personas/developer.md

@@ -984,7 +984,7 @@ Mark with `@pytest.mark.asyncio` so pytest runs the coroutine. Without it, the t
 
 | What changed in code | Doc(s) to update |
 |---|---|
-| New Flyway migration adds/removes/renames a table or column | `docs/architecture/db/db-orm.puml` (add/remove entity or attribute) **and** `docs/architecture/db/db-relationships.puml` (add/remove relationship line) — **except** framework-owned tables (e.g. Spring Session JDBC's `spring_session*`, Flyway's `flyway_schema_history`), which are opaque to app code; reference the relevant ADR if an exclusion is load-bearing |
+| New Flyway migration adds/removes/renames a table or column | `docs/architecture/db/db-orm.puml` (add/remove entity or attribute) **and** `docs/architecture/db/db-relationships.puml` (add/remove relationship line) |
 | New `@ManyToMany` join table or FK relationship | Both DB diagrams above |
 | New backend package / domain module | `CLAUDE.md` (package structure table) **and** the matching `docs/architecture/c4/l3-backend-*.puml` diagram for that domain |
 | New Spring Boot controller or service in an existing domain | The matching `docs/architecture/c4/l3-backend-*.puml` for that domain |

.env.example

@@ -26,46 +26,6 @@ PORT_MAILPIT_SMTP=1025
 # Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
 OCR_TRAINING_TOKEN=change-me-in-production
 
-# --- Observability ---
-# Optional stack — start with: docker compose -f docker-compose.observability.yml up -d
-# Requires the main stack to already be running (docker compose up -d creates archiv-net).
-# In production the stack is managed from /opt/familienarchiv/ (see docs/DEPLOYMENT.md §4).
-
-# Ports for host access
-PORT_GRAFANA=3003
-PORT_GLITCHTIP=3002
-PORT_PROMETHEUS=9090
-
-# Grafana admin password — change this before exposing Grafana beyond localhost
-GRAFANA_ADMIN_PASSWORD=changeme
-
-# GlitchTip domain — production: use https://glitchtip.archiv.raddatz.cloud (must match Caddy vhost)
-GLITCHTIP_DOMAIN=http://localhost:3002
-
-# GlitchTip secret key — Django SECRET_KEY equivalent, used to sign sessions and tokens.
-# REQUIRED in production — must not be empty or 'changeme'. Fail-closed: GlitchTip will
-# refuse to start with an invalid key.
-# Generate with: python3 -c "import secrets; print(secrets.token_hex(50))"
-GLITCHTIP_SECRET_KEY=changeme-generate-a-real-secret
-
-# PostgreSQL hostname for GlitchTip's db-init job and workers.
-# Override when only the staging stack is running (container name differs from archive-db).
-# Default (archive-db) is correct for production with the full stack up.
-POSTGRES_HOST=archive-db
-
-# $$ escaping note: passwords in /opt/familienarchiv/.env that contain a literal '$' must
-# use '$$' so Docker Compose does not expand them as variable references.
-# Example: a password 'p@$$word' should be written as 'p@$$$$word' in the .env file.
-
-# Error reporting DSNs — leave empty to disable the SDK (safe default).
-# SENTRY_DSN: backend (Spring Boot) — used by the GlitchTip/Sentry Java SDK
-SENTRY_DSN=
-SENTRY_TRACES_SAMPLE_RATE=
-# VITE_SENTRY_DSN: frontend (SvelteKit) — injected at build time via Vite
-VITE_SENTRY_DSN=
-# Sentry/GlitchTip auth token for source map upload at build time (optional)
-SENTRY_AUTH_TOKEN=
-
 # Production SMTP — uncomment and fill in to send real emails instead of catching them
 # APP_BASE_URL=https://your-domain.example.com
 # MAIL_HOST=smtp.example.com

.gitea/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 on:
   push:
-    branches: [main]
   pull_request:
 
 jobs:
@@ -13,7 +12,7 @@ jobs:
     name: Unit & Component Tests
     runs-on: ubuntu-latest
     container:
-      image: mcr.microsoft.com/playwright:v1.60.0-noble
+      image: mcr.microsoft.com/playwright:v1.58.2-noble
     steps:
       - uses: actions/checkout@v4
 
@@ -29,133 +28,33 @@ jobs:
         run: npm ci
         working-directory: frontend
 
-      - name: Security audit (no dev deps)
-        run: npm audit --audit-level=high --omit=dev
-        working-directory: frontend
-
       - name: Compile Paraglide i18n
         run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
         working-directory: frontend
 
-      - name: Sync SvelteKit
-        run: npx svelte-kit sync
-        working-directory: frontend
-
       - name: Lint
         run: npm run lint
         working-directory: frontend
 
-      - name: Assert no banned vi.mock patterns
-        shell: bash
-        run: |
-          # Literal pdfjs-dist (libLoader pattern — ADR 012)
-          if grep -rF "vi.mock('pdfjs-dist'" frontend/src/; then
-            echo "FAIL: banned vi.mock('pdfjs-dist') pattern found — see ADR 012. Use the libLoader prop injection pattern instead."
-            exit 1
-          fi
-          # Async factory with dynamic import in body (named mechanism — ADR 012 / #553).
-          # Multiline PCRE matches `vi.mock(<arg>, async ... { ... await import(...) ... })`
-          # across line breaks. __meta__ is excluded because it contains fixture strings
-          # demonstrating the very pattern this check is meant to forbid.
-          if grep -rPzln 'vi\.mock\([^)]+,\s*async[^{]*\{[\s\S]*?await\s+import\s*\(' \
-              --include='*.spec.ts' --include='*.test.ts' \
-              --exclude-dir='__meta__' \
-              frontend/src/; then
-            echo "FAIL: banned async vi.mock factory with dynamic import in body — see ADR 012 / #553. Use a synchronous factory + vi.hoisted instead."
-            exit 1
-          fi
-
-      - name: Assert no (upload|download)-artifact past v3
-        shell: bash
-        run: |
-          # Self-test: verify the regex catches v4+ and does not catch v3.
-          tmp=$(mktemp)
-          printf '        uses: actions/upload-artifact@v5\n' > "$tmp"
-          grep -qP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
-            || { echo "FAIL: guard self-test — regex missed upload-artifact@v5"; rm "$tmp"; exit 1; }
-          printf '        uses: actions/upload-artifact@v3\n' > "$tmp"
-          grep -qvP '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' "$tmp" \
-            || { echo "FAIL: guard self-test — regex incorrectly flagged upload-artifact@v3"; rm "$tmp"; exit 1; }
-          rm "$tmp"
-          # Guard: Gitea Actions (act_runner) does not implement the v4 artifact protocol.
-          # Both upload-artifact and download-artifact share the same incompatibility.
-          # Pin to @v3. See ADR-014 / #557.
-          if grep -RPn '^\s+uses:\s+actions/(upload|download)-artifact@v[4-9]' .gitea/workflows/; then
-            echo "::error::actions/(upload|download)-artifact@v4+ is unsupported on Gitea Actions (act_runner). Pin to @v3. See ADR-014 / #557."
-            exit 1
-          fi
-
-      - name: Run unit and component tests with coverage
-        shell: bash
-        run: |
-          set -eo pipefail
-          npm run test:coverage 2>&1 | tee /tmp/coverage-test-${{ github.run_id }}.log
+      - name: Run unit and component tests
+        run: npm test
         working-directory: frontend
         env:
           TZ: Europe/Berlin
 
-      # Diagnostic guard: covers the coverage run only. If `npm test` (above)
-      # exits 1 with a birpc error, the named pattern appears here — not there.
-      - name: Assert no birpc teardown race in coverage run
-        shell: bash
-        if: always()
-        run: |
-          if grep -qF "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}.log 2>/dev/null; then
-            echo "FAIL: [birpc] rpc is closed teardown race detected in coverage run"
-            grep -F "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}.log
-            exit 1
-          fi
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-      - name: Upload coverage reports
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-reports
-          path: |
-            frontend/coverage/
-            /tmp/coverage-test-${{ github.run_id }}.log
-
       - name: Build frontend
         run: npm run build
         working-directory: frontend
 
-      # ── Prerender output is exactly the public help page ───────────────────
-      # SvelteKit prerender + crawl follows nav links and bakes "redirect to
-      # /login" HTML for every protected route, served BEFORE runtime hooks
-      # (see #514). With `crawl: false` only the explicit entry should land
-      # in build/prerendered/. Anything else is a regression — fail the build.
-      - name: Assert prerender output is only /hilfe/transkription
-        run: |
-          cd frontend
-          set -e
-          extra=$(find build/prerendered -type f \
-                  -not -path 'build/prerendered/hilfe/*' \
-                  -not -name '*.br' -not -name '*.gz' \
-                  || true)
-          if [ -n "$extra" ]; then
-            echo "FAIL: unexpected prerendered files (would shadow runtime hooks):"
-            echo "$extra"
-            exit 1
-          fi
-          # And the help page must still be there.
-          test -f build/prerendered/hilfe/transkription.html \
-            || { echo "FAIL: /hilfe/transkription.html missing from prerender output"; exit 1; }
-          echo "PASS: only /hilfe/transkription.html prerendered."
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
       - name: Upload screenshots
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: unit-test-screenshots
           path: frontend/test-results/screenshots/
 
   # ─── OCR Service Unit Tests ───────────────────────────────────────────────────
-  # Only stdlib/lightweight tests — no ML stack (PyTorch/Surya/Kraken) required.
-  # test_tmpdir.py covers the TMPDIR env var and entrypoint mkdir behaviour (ADR-021).
-  # test_tmpdir_is_inside_persistent_cache_volume is skipped in CI (TMPDIR not
-  # set to /app/cache here); it runs inside the deployed Docker container.
+  # Only spell_check.py, test_confidence.py, test_sender_registry.py — no ML stack required.
   ocr-tests:
     name: OCR Service Tests
     runs-on: ubuntu-latest
@@ -167,11 +66,11 @@ jobs:
           python-version: '3.11'
 
       - name: Install test dependencies
-        run: pip install "pyspellchecker==0.9.0" "fastapi==0.115.6" pytest pytest-asyncio
+        run: pip install "pyspellchecker==0.9.0" pytest pytest-asyncio
         working-directory: ocr-service
 
       - name: Run OCR unit tests (no ML stack required)
-        run: python -m pytest test_spell_check.py test_confidence.py test_sender_registry.py test_tmpdir.py -v
+        run: python -m pytest test_spell_check.py test_confidence.py test_sender_registry.py -v
         working-directory: ocr-service
 
   # ─── Backend Unit & Slice Tests ───────────────────────────────────────────────
@@ -201,155 +100,5 @@ jobs:
       - name: Run backend tests
         run: |
           chmod +x mvnw
-          ./mvnw clean verify
-        working-directory: backend
-
-      - name: Upload surefire reports
-        if: always()
-        # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-        uses: actions/upload-artifact@v3
-        with:
-          name: surefire-reports
-          path: backend/target/surefire-reports/
-
-  # ─── fail2ban Regex Regression ────────────────────────────────────────────────
-  # The filter parses Caddy's JSON access log; a Caddy upgrade that reorders
-  # the JSON keys would silently break it (fail2ban-regex would return
-  # "0 matches", fail2ban would stop banning, no error surface). This job
-  # pins the contract against a deterministic sample line.
-  fail2ban-regex:
-    name: fail2ban Regex
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install fail2ban
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y fail2ban
-
-      - name: Matches /api/auth/login 401
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/login 401"; exit 1; }
-
-      - name: Matches /api/auth/login 429
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":429}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/login 429"; exit 1; }
-
-      - name: Matches /api/auth/forgot-password 401
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/forgot-password"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '1 matched' \
-            || { echo "expected 1 match for /api/auth/forgot-password 401"; exit 1; }
-
-      - name: Does not match /api/auth/login 200
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"POST","host":"archiv.raddatz.cloud","uri":"/api/auth/login"},"status":200}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '0 matched' \
-            || { echo "expected 0 matches for /api/auth/login 200"; exit 1; }
-
-      - name: Does not match /api/documents (unrelated 401)
-        run: |
-          echo '{"level":"info","ts":1700000000.12,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.42","method":"GET","host":"archiv.raddatz.cloud","uri":"/api/documents"},"status":401}' > /tmp/sample.log
-          out=$(fail2ban-regex /tmp/sample.log infra/fail2ban/filter.d/familienarchiv-auth.conf)
-          echo "$out"
-          echo "$out" | grep -qE '0 matched' \
-            || { echo "expected 0 matches for /api/documents 401"; exit 1; }
-
-      # ── Backend resolves to file-polling, not systemd ─────────────────────
-      # The Debian/Ubuntu fail2ban package ships defaults-debian.conf with
-      # `[DEFAULT] backend = systemd`. Without `backend = polling` in our
-      # jail, the daemon loads the jail but reads from journald and never
-      # touches /var/log/caddy/access.log — i.e. the regex above passes in
-      # isolation while the live jail is inert. See issue #503.
-      - name: Jail resolves with polling backend (not inherited systemd)
-        run: |
-          sudo ln -sfn "$PWD/infra/fail2ban/jail.d/familienarchiv.conf"       /etc/fail2ban/jail.d/familienarchiv.conf
-          sudo ln -sfn "$PWD/infra/fail2ban/filter.d/familienarchiv-auth.conf" /etc/fail2ban/filter.d/familienarchiv-auth.conf
-          dump=$(sudo fail2ban-client -d 2>&1)
-          echo "$dump" | grep -E "add.*familienarchiv-auth" || true
-          echo "$dump" | grep -qE "\['add', 'familienarchiv-auth', 'polling'\]" \
-            || { echo "FAIL: familienarchiv-auth jail did not resolve to 'polling' backend"; exit 1; }
-
-  # ─── Semgrep Security Scan ───────────────────────────────────────────────────
-  # Catches XXE-unprotected XML parser factories and similar patterns defined in
-  # .semgrep/security.yml. Runs in parallel with backend-unit-tests for fast feedback.
-  # Uses local rules only (no SEMGREP_APP_TOKEN / OIDC — act_runner does not support it).
-  semgrep-scan:
-    name: Semgrep Security Scan
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-          cache: 'pip'
-
-      - name: Install Semgrep
-        run: pip install semgrep==1.163.0
-
-      - name: Run security rules
-        run: semgrep --config .semgrep/security.yml --error --metrics=off backend/src/
-
-  # ─── Compose Bucket-Bootstrap Idempotency ─────────────────────────────────────
-  # docker-compose.prod.yml's create-buckets service runs on every
-  # `docker compose up` (one-shot, no restart). Must be idempotent — a
-  # re-deploy must not fail just because the bucket / user / policy
-  # already exists. Validated by running create-buckets twice against a
-  # throwaway minio stack and asserting both invocations exit 0.
-  compose-idempotency:
-    name: Compose Bucket Idempotency
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write stub env file
-        run: |
-          cat > .env.test <<'EOF'
-          TAG=test
-          PORT_BACKEND=18080
-          PORT_FRONTEND=13000
-          APP_DOMAIN=localhost
-          POSTGRES_PASSWORD=stub
-          MINIO_PASSWORD=stubrootpassword
-          MINIO_APP_PASSWORD=stubapppassword
-          OCR_TRAINING_TOKEN=stub
-          APP_ADMIN_USERNAME=admin@local
-          APP_ADMIN_PASSWORD=stub
-          MAIL_HOST=mailpit
-          MAIL_PORT=1025
-          APP_MAIL_FROM=noreply@local
-          IMPORT_HOST_DIR=/tmp/dummy-import
-          COMPOSE_NETWORK_NAME=test-idem-archiv-net
-          EOF
-
-      - name: Bring up minio
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test up -d --wait minio
-
-      - name: First create-buckets run
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test run --rm create-buckets
-
-      - name: Second create-buckets run (idempotency check)
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test run --rm create-buckets
-
-      - name: Teardown
-        if: always()
-        run: |
-          docker compose -f docker-compose.prod.yml -p test-idem --env-file .env.test down -v
-          rm -f .env.test
+          ./mvnw clean test
+        working-directory: backend

.gitea/workflows/coverage-flake-probe.yml

@@ -1,65 +0,0 @@
-name: Coverage Flake Probe
-
-# Manually-triggered probe for the birpc teardown race documented in ADR 012
-# / #553. Runs the full coverage suite 20× in parallel against a single SHA
-# and asserts zero `[birpc] rpc is closed` lines across every cell. Verifies
-# the acceptance criterion that the race no longer surfaces under coverage.
-
-on:
-  workflow_dispatch:
-
-jobs:
-  coverage-flake-probe:
-    name: Coverage flake probe (run ${{ matrix.run }})
-    runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/playwright:v1.58.2-noble
-    strategy:
-      fail-fast: false
-      matrix:
-        run: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Cache node_modules
-        id: node-modules-cache
-        uses: actions/cache@v4
-        with:
-          path: frontend/node_modules
-          key: node-modules-${{ hashFiles('frontend/package-lock.json') }}
-
-      - name: Install dependencies
-        if: steps.node-modules-cache.outputs.cache-hit != 'true'
-        run: npm ci
-        working-directory: frontend
-
-      - name: Compile Paraglide i18n
-        run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
-        working-directory: frontend
-
-      - name: Run unit and component tests with coverage
-        shell: bash
-        run: |
-          set -eo pipefail
-          npm run test:coverage 2>&1 | tee /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log
-        working-directory: frontend
-        env:
-          TZ: Europe/Berlin
-
-      - name: Assert no birpc teardown race
-        shell: bash
-        if: always()
-        run: |
-          if grep -qF "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log 2>/dev/null; then
-            echo "FAIL: [birpc] rpc is closed teardown race detected in run ${{ matrix.run }}"
-            grep -F "[birpc] rpc is closed" /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log
-            exit 1
-          fi
-
-      # Gitea Actions (act_runner) does not implement upload-artifact v4 protocol — pinned per ADR-014. Do NOT upgrade. See #557.
-      - name: Upload coverage log on failure
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-log-run-${{ matrix.run }}
-          path: /tmp/coverage-test-${{ github.run_id }}-${{ matrix.run }}.log

.gitea/workflows/nightly.yml

@@ -1,280 +0,0 @@
-name: nightly
-
-# Builds and deploys the staging environment from main every night.
-# Runs on the self-hosted runner using Docker-out-of-Docker (the docker
-# socket is mounted in), so `docker compose build` produces images on
-# the host daemon and `docker compose up` consumes them directly — no
-# registry hop.
-#
-# Operational assumptions (see docs/DEPLOYMENT.md §3 for the full setup):
-#
-#   1. Single-tenant self-hosted runner. The "Write staging env file" step
-#      writes every secret to .env.staging on the runner filesystem; the
-#      `if: always()` cleanup step removes it. A multi-tenant runner
-#      would need to switch to docker compose --env-file <(stdin) instead.
-#
-#   2. Host docker layer cache is authoritative. There is no
-#      actions/cache; we rely on the host daemon to keep Maven and npm
-#      layers warm between runs. A `docker system prune` on the host
-#      will cause the next nightly build to be cold (5–10 min slower).
-#
-# Staging environment isolation:
-#   - project name: archiv-staging
-#   - host ports:   backend 8081, frontend 3001
-#   - profile:      staging (starts mailpit instead of a real SMTP relay)
-#
-# Required Gitea secrets:
-#   STAGING_POSTGRES_PASSWORD
-#   STAGING_MINIO_PASSWORD
-#   STAGING_MINIO_APP_PASSWORD
-#   STAGING_OCR_TRAINING_TOKEN
-#   STAGING_APP_ADMIN_USERNAME
-#   STAGING_APP_ADMIN_PASSWORD
-#   GRAFANA_ADMIN_PASSWORD
-#   GLITCHTIP_SECRET_KEY
-#   SENTRY_DSN                  (set after GlitchTip first-run; empty = Sentry disabled)
-
-on:
-  schedule:
-    - cron: "0 2 * * *"
-  workflow_dispatch:
-
-env:
-  # Ensures the backend Dockerfile's `RUN --mount=type=cache` lines are
-  # honoured (Maven cache survives between runs).
-  DOCKER_BUILDKIT: "1"
-
-jobs:
-  deploy-staging:
-    # `ubuntu-latest` matches our self-hosted runner's advertised label
-    # (the runner has labels: ubuntu-latest / ubuntu-24.04 / ubuntu-22.04).
-    # `self-hosted` would never match — no runner advertises it — so the
-    # job parks in the queue forever. ADR-011's "single-tenant" promise
-    # is at the repo level; sharing this runner between CI and deploys
-    # for the same repo is within that boundary.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write staging env file
-        run: |
-          cat > .env.staging <<EOF
-          TAG=nightly
-          PORT_BACKEND=8081
-          PORT_FRONTEND=3001
-          APP_DOMAIN=staging.raddatz.cloud
-          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
-          MINIO_PASSWORD=${{ secrets.STAGING_MINIO_PASSWORD }}
-          MINIO_APP_PASSWORD=${{ secrets.STAGING_MINIO_APP_PASSWORD }}
-          OCR_TRAINING_TOKEN=${{ secrets.STAGING_OCR_TRAINING_TOKEN }}
-          APP_ADMIN_USERNAME=${{ secrets.STAGING_APP_ADMIN_USERNAME }}
-          APP_ADMIN_PASSWORD=${{ secrets.STAGING_APP_ADMIN_PASSWORD }}
-          MAIL_HOST=mailpit
-          MAIL_PORT=1025
-          MAIL_USERNAME=
-          MAIL_PASSWORD=
-          MAIL_SMTP_AUTH=false
-          MAIL_STARTTLS_ENABLE=false
-          APP_MAIL_FROM=noreply@staging.raddatz.cloud
-          IMPORT_HOST_DIR=/srv/familienarchiv-staging/import
-          POSTGRES_USER=archiv
-          SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-          EOF
-
-      - name: Verify backend /import:ro mount is wired
-        # Regression guard for #526: the /admin/system mass-import card
-        # only works when the backend service mounts the host import
-        # payload at /import (read-only). If a future "compose cleanup"
-        # PR drops the volumes block, mass import silently breaks again.
-        # `compose config` renders both shorthand and longform mounts as
-        # `target: /import` + `read_only: true`, so we assert against
-        # the rendered form rather than the raw source YAML.
-        run: |
-          set -e
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            config > /tmp/compose-rendered.yml
-          grep -q '^[[:space:]]*target: /import$' /tmp/compose-rendered.yml \
-            || { echo "::error::backend is missing the /import bind mount (see #526)"; exit 1; }
-          grep -A2 '^[[:space:]]*target: /import$' /tmp/compose-rendered.yml \
-            | grep -q 'read_only: true' \
-            || { echo "::error::backend /import mount is not read-only (see #526)"; exit 1; }
-
-      - name: Build images
-        # `--pull` forces re-fetching pinned base images so a CVE
-        # re-publication of the same tag (e.g. node:20.19.0-alpine3.21,
-        # postgres:16-alpine) is picked up instead of being served
-        # from the host's stale Docker layer cache.
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            build --pull
-
-      - name: Deploy staging
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-staging \
-            --env-file .env.staging \
-            --profile staging \
-            up -d --wait --remove-orphans
-
-      - name: Deploy observability configs
-        # Copies the compose file and config tree from the workspace checkout
-        # into /opt/familienarchiv/ — the permanent location that persists
-        # between CI runs. Containers started in the next step bind-mount
-        # from there, so a future workspace wipe cannot corrupt a running
-        # config file.
-        #
-        # obs-secrets.env is written fresh from Gitea secrets on every run so
-        # Gitea is always the single source of truth for secret rotation.
-        # Non-secret config lives in infra/observability/obs.env (tracked in git).
-        run: |
-          rm -rf /opt/familienarchiv/infra/observability
-          mkdir -p /opt/familienarchiv/infra/observability
-          cp -r infra/observability/. /opt/familienarchiv/infra/observability/
-          cp docker-compose.observability.yml /opt/familienarchiv/
-          cat > /opt/familienarchiv/obs-secrets.env <<'EOF'
-          GRAFANA_ADMIN_PASSWORD=${{ secrets.GRAFANA_ADMIN_PASSWORD }}
-          GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
-          POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
-          POSTGRES_HOST=archiv-staging-db-1
-          EOF
-          # Note: POSTGRES_HOST is derived from the Compose project name (archiv-staging)
-          # and service name (db). A project rename requires updating this value.
-          chmod 600 /opt/familienarchiv/obs-secrets.env
-
-      - name: Validate observability compose config
-        # Dry-run: resolves all variable substitutions and reports any missing
-        # required keys before containers start. Catches undefined variables and
-        # YAML errors in config files updated by the previous step.
-        # --env-file order: obs.env first (git-tracked defaults), obs-secrets.env
-        # second (CI-written secrets). Later files win on duplicate keys, so
-        # obs-secrets.env overrides POSTGRES_HOST set in obs.env.
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            config --quiet
-
-      - name: Start observability stack
-        # Runs with absolute paths so bind mounts resolve to stable host paths
-        # that survive workspace wipes between nightly runs (see ADR-016).
-        # Non-secret config from obs.env (git-tracked); secrets from obs-secrets.env
-        # (written fresh from Gitea secrets above). --env-file order: obs.env first,
-        # obs-secrets.env second — later file wins on duplicate keys.
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            up -d --wait --remove-orphans
-
-      - name: Assert observability stack health
-        # docker compose up --wait covers services WITH healthcheck directives only.
-        # obs-promtail, obs-cadvisor, obs-node-exporter, and obs-glitchtip-worker have
-        # no healthcheck — they are considered "started" as soon as the process runs.
-        # This step explicitly asserts the five healthchecked critical services are
-        # healthy before the smoke test proceeds.
-        run: |
-          set -e
-          unhealthy=""
-          for svc in obs-loki obs-prometheus obs-grafana obs-tempo obs-glitchtip; do
-            status=$(docker inspect "$svc" --format '{{.State.Health.Status}}' 2>/dev/null || echo "missing")
-            if [ "$status" != "healthy" ]; then
-              echo "::error::$svc is not healthy (status: $status)"
-              unhealthy="$unhealthy $svc"
-            fi
-          done
-          [ -z "$unhealthy" ] || exit 1
-          echo "All critical observability services are healthy"
-
-      - name: Reload Caddy
-        # Apply any committed Caddyfile changes before smoke-testing the
-        # public surface. Without this step, a Caddyfile edit lands in the
-        # repo but Caddy keeps serving the previous config until someone
-        # reloads it manually — the smoke test would then catch a stale
-        # header or a still-proxied /actuator route rather than confirming
-        # the current config is live.
-        #
-        # The runner executes job steps inside Docker containers (DooD).
-        # `systemctl` is not present in container images and cannot reach
-        # the host's systemd directly. We use the Docker socket (mounted
-        # into every job container via runner-config.yaml) to spin up a
-        # privileged sibling container in the host PID namespace; nsenter
-        # then enters the host's namespaces so systemctl talks to the real
-        # host systemd daemon. No sudoers entry is required — the Docker
-        # socket already grants root-equivalent host access.
-        #
-        # Alpine is used: ~5 MB vs ~70 MB for ubuntu, no unnecessary
-        # tooling, and the digest is pinned so any upstream change requires
-        # an explicit bump PR. util-linux (which ships nsenter) is installed
-        # at run time; apk add takes ~1 s on the warm VPS cache.
-        #
-        # `reload` not `restart`: reload sends SIGHUP so Caddy re-reads its
-        # config in-process without dropping TLS connections. `restart`
-        # would briefly stop the service, losing in-flight requests.
-        #
-        # If Caddy is not running this step fails fast before the smoke test
-        # issues a misleading "port 443 refused" error.
-        run: |
-          docker run --rm --privileged --pid=host \
-            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
-            sh -c 'apk add --no-cache util-linux -q && nsenter -t 1 -m -u -n -p -i -- /bin/systemctl reload caddy'
-
-      - name: Smoke test deployed environment
-        # Healthchecks confirm containers are healthy; they do NOT confirm the
-        # public surface works. This step catches: Caddy not reloaded, HSTS
-        # header dropped, /actuator block bypassed.
-        #
-        # --resolve pins staging.raddatz.cloud to the Docker bridge gateway IP
-        # (the host) so we do NOT depend on hairpin NAT on the host router.
-        # 127.0.0.1 cannot be used: job containers run in bridge network mode
-        # (runner-config.yaml), so 127.0.0.1 is the container's loopback, not
-        # the host's. The bridge gateway IS the host; Caddy binds 0.0.0.0:443
-        # and is therefore reachable from the container via that IP.
-        # SNI still uses the public hostname so the TLS cert validates correctly.
-        #
-        # Gateway detection reads /proc/net/route (always present, no package
-        # required) instead of `ip route` to avoid a dependency on iproute2.
-        # Field $2=="00000000" is the default route; field $3 is the gateway as
-        # a little-endian 32-bit hex value which awk decodes to dotted-decimal.
-        run: |
-          set -e
-          HOST="staging.raddatz.cloud"
-          URL="https://$HOST"
-          HOST_IP=$(awk 'NR>1 && $2=="00000000"{h=$3;printf "%d.%d.%d.%d\n",strtonum("0x"substr(h,7,2)),strtonum("0x"substr(h,5,2)),strtonum("0x"substr(h,3,2)),strtonum("0x"substr(h,1,2));exit}' /proc/net/route)
-          [ -n "$HOST_IP" ] || { echo "ERROR: could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
-          RESOLVE=(--resolve "$HOST:443:$HOST_IP")
-          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
-          curl -fsS "${RESOLVE[@]}" --max-time 10 "$URL/login" -o /dev/null
-          # Pin the preload-list-eligible HSTS value, not just header presence:
-          # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must
-          # fail this check rather than pass it silently.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'strict-transport-security:[[:space:]]*max-age=31536000.*includeSubDomains.*preload'
-          # Permissions-Policy denies APIs the app does not use (camera,
-          # microphone, geolocation). A regression that loosens or drops the
-          # header now fails the smoke step.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'permissions-policy:[[:space:]]*camera=\(\),[[:space:]]*microphone=\(\),[[:space:]]*geolocation=\(\)'
-          status=$(curl -s "${RESOLVE[@]}" -o /dev/null -w "%{http_code}" --max-time 10 "$URL/actuator/health")
-          [ "$status" = "404" ] || { echo "expected 404 from /actuator/health, got $status"; exit 1; }
-          echo "All smoke checks passed"
-
-      - name: Cleanup env file
-        # LOAD-BEARING: `if: always()` is the linchpin of the ADR-011
-        # single-tenant runner trust model. Every secret in .env.staging
-        # is plain text on the runner filesystem until this step runs.
-        # If a future refactor drops `if: always()`, a failed deploy
-        # leaves the env-file behind. Do not remove this conditional
-        # without first re-evaluating ADR-011.
-        if: always()
-        run: rm -f .env.staging

.gitea/workflows/release.yml

@@ -1,220 +0,0 @@
-name: release
-
-# Builds and deploys the production environment on `v*` tag push.
-# Runs on the self-hosted runner via Docker-out-of-Docker; images are
-# tagged with the actual git tag (e.g. v1.0.0) so rollback is
-#   `TAG=<previous> docker compose -f docker-compose.prod.yml -p archiv-production up -d --wait`
-#
-# Operational assumptions (see docs/DEPLOYMENT.md §3 for the full setup):
-#
-#   1. Single-tenant self-hosted runner. The "Write production env file"
-#      step writes every secret to .env.production on the runner
-#      filesystem; the `if: always()` cleanup step removes it. A
-#      multi-tenant runner would need to switch to
-#      `docker compose --env-file <(stdin)` instead.
-#
-#   2. Host docker layer cache is authoritative. There is no
-#      actions/cache; we rely on the host daemon to keep Maven and npm
-#      layers warm between runs. A `docker system prune` on the host
-#      will cause the next release build to be cold (5–10 min slower).
-#
-# Production environment:
-#   - project name: archiv-production
-#   - host ports:   backend 8080, frontend 3000
-#   - profile:      (none) — mailpit is excluded; real SMTP relay is used
-#
-# Required Gitea secrets:
-#   PROD_POSTGRES_PASSWORD
-#   PROD_MINIO_PASSWORD
-#   PROD_MINIO_APP_PASSWORD
-#   PROD_OCR_TRAINING_TOKEN
-#   PROD_APP_ADMIN_USERNAME       (CRITICAL: see docs/DEPLOYMENT.md)
-#   PROD_APP_ADMIN_PASSWORD       (CRITICAL: locked in on first deploy)
-#   MAIL_HOST
-#   MAIL_PORT
-#   MAIL_USERNAME
-#   MAIL_PASSWORD
-#   GRAFANA_ADMIN_PASSWORD
-#   GLITCHTIP_SECRET_KEY
-#   SENTRY_DSN                    (set after GlitchTip first-run; empty = Sentry disabled)
-
-on:
-  push:
-    tags:
-      - "v*"
-
-env:
-  DOCKER_BUILDKIT: "1"
-
-jobs:
-  deploy-production:
-    # See nightly.yml — same rationale: `ubuntu-latest` matches the
-    # advertised label of our single-tenant self-hosted runner.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Write production env file
-        run: |
-          cat > .env.production <<EOF
-          TAG=${{ gitea.ref_name }}
-          PORT_BACKEND=8080
-          PORT_FRONTEND=3000
-          APP_DOMAIN=archiv.raddatz.cloud
-          POSTGRES_PASSWORD=${{ secrets.PROD_POSTGRES_PASSWORD }}
-          MINIO_PASSWORD=${{ secrets.PROD_MINIO_PASSWORD }}
-          MINIO_APP_PASSWORD=${{ secrets.PROD_MINIO_APP_PASSWORD }}
-          OCR_TRAINING_TOKEN=${{ secrets.PROD_OCR_TRAINING_TOKEN }}
-          APP_ADMIN_USERNAME=${{ secrets.PROD_APP_ADMIN_USERNAME }}
-          APP_ADMIN_PASSWORD=${{ secrets.PROD_APP_ADMIN_PASSWORD }}
-          MAIL_HOST=${{ secrets.MAIL_HOST }}
-          MAIL_PORT=${{ secrets.MAIL_PORT }}
-          MAIL_USERNAME=${{ secrets.MAIL_USERNAME }}
-          MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
-          MAIL_SMTP_AUTH=true
-          MAIL_STARTTLS_ENABLE=true
-          APP_MAIL_FROM=noreply@raddatz.cloud
-          IMPORT_HOST_DIR=/srv/familienarchiv-production/import
-          POSTGRES_USER=archiv
-          SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-          EOF
-
-      - name: Build images
-        # `--pull` forces re-fetching pinned base images so a CVE
-        # re-publication of the same tag is picked up rather than served
-        # from the host's stale Docker layer cache.
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-production \
-            --env-file .env.production \
-            build --pull
-
-      - name: Deploy production
-        run: |
-          docker compose \
-            -f docker-compose.prod.yml \
-            -p archiv-production \
-            --env-file .env.production \
-            up -d --wait --remove-orphans
-
-      - name: Deploy observability configs
-        # Mirrors the nightly approach: copies obs compose file and config tree
-        # to /opt/familienarchiv/ (permanent path, survives workspace wipes — ADR-016),
-        # then writes obs-secrets.env fresh from Gitea secrets.
-        # Non-secret config lives in infra/observability/obs.env (tracked in git).
-        run: |
-          rm -rf /opt/familienarchiv/infra/observability
-          mkdir -p /opt/familienarchiv/infra/observability
-          cp -r infra/observability/. /opt/familienarchiv/infra/observability/
-          cp docker-compose.observability.yml /opt/familienarchiv/
-          cat > /opt/familienarchiv/obs-secrets.env <<'EOF'
-          GRAFANA_ADMIN_PASSWORD=${{ secrets.GRAFANA_ADMIN_PASSWORD }}
-          GLITCHTIP_SECRET_KEY=${{ secrets.GLITCHTIP_SECRET_KEY }}
-          POSTGRES_PASSWORD=${{ secrets.PROD_POSTGRES_PASSWORD }}
-          POSTGRES_HOST=archiv-production-db-1
-          EOF
-          # Note: POSTGRES_HOST is derived from the Compose project name (archiv-production)
-          # and service name (db). A project rename requires updating this value.
-          chmod 600 /opt/familienarchiv/obs-secrets.env
-
-      - name: Validate observability compose config
-        # Dry-run: resolves all variable substitutions and reports any missing
-        # required keys before containers start. Catches undefined variables and
-        # YAML errors in config files updated by the previous step.
-        # --env-file order: obs.env first (git-tracked defaults), obs-secrets.env
-        # second (CI-written secrets). Later files win on duplicate keys, so
-        # obs-secrets.env overrides POSTGRES_HOST set in obs.env.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            config --quiet
-
-      - name: Start observability stack
-        # Runs with absolute paths so bind mounts resolve to stable host paths
-        # that survive workspace wipes between runs (see ADR-016).
-        # Non-secret config from obs.env (git-tracked); secrets from obs-secrets.env
-        # (written fresh from Gitea secrets above). --env-file order: obs.env first,
-        # obs-secrets.env second — later file wins on duplicate keys.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          docker compose \
-            -f /opt/familienarchiv/docker-compose.observability.yml \
-            --env-file /opt/familienarchiv/infra/observability/obs.env \
-            --env-file /opt/familienarchiv/obs-secrets.env \
-            up -d --wait --remove-orphans
-
-      - name: Assert observability stack health
-        # docker compose up --wait covers services WITH healthcheck directives only.
-        # obs-promtail, obs-cadvisor, obs-node-exporter, and obs-glitchtip-worker have
-        # no healthcheck — they are considered "started" as soon as the process runs.
-        # This step explicitly asserts the five healthchecked critical services are
-        # healthy before the smoke test proceeds.
-        # Keep in sync with the equivalent step in nightly.yml (#603).
-        run: |
-          set -e
-          unhealthy=""
-          for svc in obs-loki obs-prometheus obs-grafana obs-tempo obs-glitchtip; do
-            status=$(docker inspect "$svc" --format '{{.State.Health.Status}}' 2>/dev/null || echo "missing")
-            if [ "$status" != "healthy" ]; then
-              echo "::error::$svc is not healthy (status: $status)"
-              unhealthy="$unhealthy $svc"
-            fi
-          done
-          [ -z "$unhealthy" ] || exit 1
-          echo "All critical observability services are healthy"
-
-      - name: Reload Caddy
-        # See nightly.yml — same rationale and mechanism: DooD job containers
-        # cannot call systemctl directly; nsenter via a privileged sibling
-        # container reaches the host systemd. Must run after deploy (so the
-        # latest Caddyfile is on disk) and before the smoke test (so the
-        # public surface reflects the current config). Alpine with pinned
-        # digest; reload not restart — see nightly.yml for full rationale.
-        run: |
-          docker run --rm --privileged --pid=host \
-            alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d \
-            sh -c 'apk add --no-cache util-linux -q && nsenter -t 1 -m -u -n -p -i -- /bin/systemctl reload caddy'
-
-      - name: Smoke test deployed environment
-        # See nightly.yml — same three checks, against the prod vhost.
-        # --resolve stored as a Bash array so "${RESOLVE[@]}" expands to two
-        # separate arguments; a quoted string would pass the flag and its value
-        # as one token and curl would reject it as an unknown option.
-        # Gateway detection via /proc/net/route — no iproute2 dependency.
-        # See nightly.yml for the full network topology explanation.
-        run: |
-          set -e
-          HOST="archiv.raddatz.cloud"
-          URL="https://$HOST"
-          HOST_IP=$(awk 'NR>1 && $2=="00000000"{h=$3;printf "%d.%d.%d.%d\n",strtonum("0x"substr(h,7,2)),strtonum("0x"substr(h,5,2)),strtonum("0x"substr(h,3,2)),strtonum("0x"substr(h,1,2));exit}' /proc/net/route)
-          [ -n "$HOST_IP" ] || { echo "ERROR: could not detect Docker bridge gateway via /proc/net/route"; exit 1; }
-          RESOLVE=(--resolve "$HOST:443:$HOST_IP")
-          echo "Smoke test: $URL (pinned to $HOST_IP via bridge gateway)"
-          curl -fsS "${RESOLVE[@]}" --max-time 10 "$URL/login" -o /dev/null
-          # Pin the preload-list-eligible HSTS value, not just header presence:
-          # a degraded `max-age=1` or a dropped `includeSubDomains; preload` must
-          # fail this check rather than pass it silently.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'strict-transport-security:[[:space:]]*max-age=31536000.*includeSubDomains.*preload'
-          # Permissions-Policy denies APIs the app does not use (camera,
-          # microphone, geolocation). A regression that loosens or drops the
-          # header now fails the smoke step.
-          curl -fsS "${RESOLVE[@]}" --max-time 10 -I "$URL/" \
-            | grep -Eqi 'permissions-policy:[[:space:]]*camera=\(\),[[:space:]]*microphone=\(\),[[:space:]]*geolocation=\(\)'
-          status=$(curl -s "${RESOLVE[@]}" -o /dev/null -w "%{http_code}" --max-time 10 "$URL/actuator/health")
-          [ "$status" = "404" ] || { echo "expected 404 from /actuator/health, got $status"; exit 1; }
-          echo "All smoke checks passed"
-
-      - name: Cleanup env file
-        # LOAD-BEARING: `if: always()` is the linchpin of the ADR-011
-        # single-tenant runner trust model. Every secret in
-        # .env.production is plain text on the runner filesystem until
-        # this step runs. If a future refactor drops `if: always()`, a
-        # failed deploy leaves the env-file behind. Do not remove this
-        # conditional without first re-evaluating ADR-011.
-        if: always()
-        run: rm -f .env.production

.semgrep/security.yml

@@ -1,54 +0,0 @@
-# Semgrep security rules for Familienarchiv backend.
-# These rules catch the absence of XXE protection on XML parser factories.
-# CWE-611: Improper Restriction of XML External Entity Reference.
-# Run: semgrep --config .semgrep/security.yml --error backend/src/
-
-rules:
-
-  # DocumentBuilderFactory without XXE hardening.
-  # All call sites must call setFeature("…disallow-doctype-decl", true) before use.
-  - id: dbf-xxe-default
-    patterns:
-      - pattern: $X = DocumentBuilderFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-          ...
-    message: >
-      DocumentBuilderFactory without XXE protection (CWE-611).
-      Call XxeSafeXmlParser.hardenedFactory() instead of DocumentBuilderFactory.newInstance().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR
-
-  # SAXParserFactory without XXE hardening.
-  - id: sax-xxe-default
-    patterns:
-      - pattern: $X = SAXParserFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-          ...
-    message: >
-      SAXParserFactory without XXE protection (CWE-611).
-      Set disallow-doctype-decl=true, external-general-entities=false, external-parameter-entities=false,
-      and load-external-dtd=false before use. Follow the pattern in XxeSafeXmlParser.hardenedFactory().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR
-
-  # XMLInputFactory without XXE hardening (StAX parser).
-  - id: stax-xxe-default
-    patterns:
-      - pattern: $X = XMLInputFactory.newInstance();
-      - pattern-not-inside: |
-          ...
-          $X.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-          ...
-    message: >
-      XMLInputFactory without XXE protection (CWE-611).
-      Set IS_SUPPORTING_EXTERNAL_ENTITIES=false and SUPPORT_DTD=false before use.
-      Follow the pattern in XxeSafeXmlParser.hardenedFactory().
-      See: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-    languages: [java]
-    severity: ERROR

CLAUDE.md

@@ -77,7 +77,6 @@ npm run generate:api  # Regenerate TypeScript API types from OpenAPI spec
 ```
 backend/src/main/java/org/raddatz/familienarchiv/
 ├── audit/               Audit logging
-├── auth/                AuthService, AuthSessionController, LoginRequest, LoginRateLimiter, RateLimitProperties (Spring Session JDBC)
 ├── config/              Infrastructure config (Minio, Async, Web)
 ├── dashboard/           Dashboard analytics + StatsController/StatsService
 ├── document/            Document domain (entities, controller, service, repository, DTOs)
@@ -94,7 +93,7 @@ backend/src/main/java/org/raddatz/familienarchiv/
 │   └── relationship/    PersonRelationship sub-domain
 ├── security/            SecurityConfig, Permission, @RequirePermission, PermissionAspect
 ├── tag/                 Tag domain
-└── user/                User domain — AppUser, UserGroup, UserService
+└── user/                User domain — AppUser, UserGroup, UserService, auth controllers
 ```
 
 ### Layering Rules
@@ -160,7 +159,7 @@ Input DTOs live flat in the domain package. Response types are the model entitie
 
 → See [CONTRIBUTING.md §Error handling](./CONTRIBUTING.md#error-handling)
 
-**LLM reminder:** use `DomainException.notFound/forbidden/conflict/internal()` from service methods — never throw raw exceptions. When adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`. Valid error codes include: `TOO_MANY_LOGIN_ATTEMPTS` (returned by `LoginRateLimiter` as HTTP 429 when a brute-force threshold is exceeded).
+**LLM reminder:** use `DomainException.notFound/forbidden/conflict/internal()` from service methods — never throw raw exceptions. When adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) mirror in `frontend/src/lib/shared/errors.ts`, (3) add i18n keys in `messages/{de,en,es}.json`.
 
 ### Security / Permissions
 
@@ -203,7 +202,8 @@ frontend/src/routes/
 ├── profile/                User profile settings
 ├── users/[id]/             Public user profile page
 ├── login/ logout/ register/
-└── forgot-password/ reset-password/
+├── forgot-password/ reset-password/
+└── demo/                   Dev-only demos
 ```
 
 ### API Client Pattern
@@ -267,7 +267,7 @@ Back button pattern — use the shared `<BackButton>` component from `$lib/share
 
 → See [CONTRIBUTING.md §Error handling](./CONTRIBUTING.md#error-handling)
 
-**LLM reminder:** when adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`. Valid error codes include: `TOO_MANY_LOGIN_ATTEMPTS` (returned by `LoginRateLimiter` as HTTP 429 when a brute-force threshold is exceeded).
+**LLM reminder:** when adding a new `ErrorCode`: (1) add to `ErrorCode.java`, (2) add to `ErrorCode` type in `frontend/src/lib/shared/errors.ts`, (3) add a `case` in `getErrorMessage()`, (4) add i18n keys in `messages/{de,en,es}.json`.
 
 ---
 
@@ -275,35 +275,6 @@ Back button pattern — use the shared `<BackButton>` component from `$lib/share
 
 → See [docs/DEPLOYMENT.md](./docs/DEPLOYMENT.md)
 
-### Observability stack (separate compose file)
-
-Run via `docker-compose.observability.yml` — requires the main stack to be running first. Full setup procedure: [docs/DEPLOYMENT.md §4](./docs/DEPLOYMENT.md#4-logs--observability).
-
-| Service | Container | Default Port | Purpose |
-|---------|-----------|-------------|---------|
-| Grafana | `obs-grafana` | 3003 | Metrics / logs / traces dashboard |
-| Prometheus | `obs-prometheus` | 9090 (dev only — `127.0.0.1` bound) | Metrics store |
-| Loki | `obs-loki` | — (internal) | Log store |
-| Tempo | `obs-tempo` | — (internal) | Trace store |
-| GlitchTip | `obs-glitchtip` | 3002 | Error tracking (Sentry-compatible) |
-
-### Observability env vars
-
-| Variable | Purpose |
-|----------|---------|
-| `PORT_GRAFANA` | Host port for Grafana UI (default: `3003`) |
-| `PORT_GLITCHTIP` | Host port for GlitchTip UI (default: `3002`) |
-| `PORT_PROMETHEUS` | Host port for Prometheus UI (default: `9090`) |
-| `GRAFANA_ADMIN_PASSWORD` | Grafana `admin` login password — generate with `openssl rand -hex 32` |
-| `GLITCHTIP_SECRET_KEY` | Django secret key for GlitchTip — generate with `python3 -c "import secrets; print(secrets.token_hex(32))"` |
-| `GLITCHTIP_DOMAIN` | Public-facing base URL for GlitchTip (email links, CORS), e.g. `https://glitchtip.example.com` |
-| `SENTRY_DSN` | GlitchTip/Sentry DSN for the backend (Spring Boot) — leave empty to disable |
-| `VITE_SENTRY_DSN` | GlitchTip/Sentry DSN for the frontend (SvelteKit) — injected at build time via Vite |
-
-## Observability
-
-→ See [docs/OBSERVABILITY.md](./docs/OBSERVABILITY.md) — where to look for logs, traces, metrics, and errors.
-
 ## API Testing
 
 HTTP test files are in `backend/api_tests/` for use with the VS Code REST Client extension.

CONTRIBUTING.md

@@ -263,7 +263,7 @@ if (!result.response.ok) {
 return { person: result.data! }; // non-null assertion is safe after the ok check
 ```
 
-For multipart/form-data (file uploads): bypass the typed client and use `event.fetch` directly — never global `fetch`. The typed client cannot handle multipart bodies, but `event.fetch` is still required so that `handleFetch` injects the session cookie.
+For multipart/form-data (file uploads): bypass the typed client and use raw `fetch` — the client cannot handle it.
 
 ### Date handling
 

backend/CLAUDE.md

@@ -24,7 +24,6 @@ Spring Boot 4.0 monolith serving the Familienarchiv REST API. Handles document m
 ```
 src/main/java/org/raddatz/familienarchiv/
 ├── audit/               # Audit logging (AuditService, AuditLogQueryService)
-├── auth/                # AuthService, AuthSessionController, LoginRequest (Spring Session JDBC — ADR-020)
 ├── config/              # Infrastructure config (MinioConfig, AsyncConfig, WebConfig)
 ├── dashboard/           # Dashboard analytics + StatsController/StatsService
 ├── document/            # Document domain — entities, controller, service, repository, DTOs
@@ -41,7 +40,7 @@ src/main/java/org/raddatz/familienarchiv/
 │   └── relationship/    # PersonRelationship sub-domain
 ├── security/            # SecurityConfig, Permission, @RequirePermission, PermissionAspect
 ├── tag/                 # Tag domain — Tag, TagService, TagController
-└── user/                # User domain — AppUser, UserGroup, UserService
+└── user/                # User domain — AppUser, UserGroup, UserService, auth controllers
 ```
 
 For per-domain ownership and public surface, see each domain's `README.md`.
@@ -97,10 +96,7 @@ public class MyEntity {
 
 - Annotated with `@Service`, `@RequiredArgsConstructor`, optionally `@Slf4j`.
 - Write methods: `@Transactional`.
-- Read methods: no annotation (default non-transactional) — **except** when the method returns
-  an entity whose lazy associations must remain accessible to the caller after the method
-  returns. In that case, use `@Transactional(readOnly = true)` to keep the Hibernate session
-  open. Removing this annotation causes `LazyInitializationException` in production. See ADR-022.
+- Read methods: no annotation (default non-transactional).
 - Cross-domain access goes through the other domain's service, never its repository.
 
 ## Error Handling

backend/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>4.0.6</version>
+		<version>4.0.0</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>org.raddatz</groupId>
@@ -29,30 +29,11 @@
 	<properties>
 		<java.version>21</java.version>
 	</properties>
-	<dependencyManagement>
-		<dependencies>
-			<!-- opentelemetry-spring-boot-starter:2.27.0 was built against opentelemetry-api:1.61.0,
-			     but Spring Boot 4.0.0 BOM only manages 1.55.0 (missing GlobalOpenTelemetry.getOrNoop()).
-			     Import the core OTel BOM here to override it before the Spring Boot BOM applies. -->
-			<dependency>
-				<groupId>io.opentelemetry</groupId>
-				<artifactId>opentelemetry-bom</artifactId>
-				<version>1.61.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-actuator</artifactId>
 		</dependency>
-		<!-- Spring Boot 4.0 splits Micrometer metrics export (incl. Prometheus scrape endpoint) into its own starter -->
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-micrometer-metrics</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-validation</artifactId>
@@ -69,10 +50,6 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-security</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-session-jdbc</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-webmvc</artifactId>
@@ -180,16 +157,11 @@
 			<artifactId>flyway-database-postgresql</artifactId>
 		</dependency>
 
-		<!-- Caffeine cache + Bucket4j for in-memory rate limiting -->
+		<!-- Caffeine cache for in-memory rate limiting -->
 		<dependency>
 			<groupId>com.github.ben-manes.caffeine</groupId>
 			<artifactId>caffeine</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>com.bucket4j</groupId>
-			<artifactId>bucket4j-core</artifactId>
-			<version>8.10.1</version>
-		</dependency>
 
 		<!-- OpenAPI / Swagger UI — enabled only in the dev Spring profile -->
 		<dependency>
@@ -216,7 +188,7 @@
 		<dependency>
 			<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
 			<artifactId>owasp-java-html-sanitizer</artifactId>
-			<version>20260101.1</version>
+			<version>20240325.1</version>
 		</dependency>
 
 		<!-- HTML → plain-text extraction for comment previews -->
@@ -225,42 +197,6 @@
 			<artifactId>jsoup</artifactId>
 			<version>1.18.1</version>
 		</dependency>
-
-		<!-- Observability: Prometheus metrics scrape endpoint (version managed by Spring Boot BOM) -->
-		<dependency>
-			<groupId>io.micrometer</groupId>
-			<artifactId>micrometer-registry-prometheus</artifactId>
-		</dependency>
-
-		<!-- Observability: Micrometer → OpenTelemetry tracing bridge (version managed by Spring Boot BOM) -->
-		<dependency>
-			<groupId>io.micrometer</groupId>
-			<artifactId>micrometer-tracing-bridge-otel</artifactId>
-		</dependency>
-
-		<!-- Observability: OTel Spring Boot auto-instrumentation — NOT in Spring Boot BOM, pinned explicitly -->
-		<dependency>
-			<groupId>io.opentelemetry.instrumentation</groupId>
-			<artifactId>opentelemetry-spring-boot-starter</artifactId>
-			<version>2.27.0</version>
-			<exclusions>
-				<!-- Excludes AzureAppServiceResourceProvider which references ServiceAttributes.SERVICE_INSTANCE_ID
-				     that does not exist in the semconv version pulled by this project. -->
-				<exclusion>
-					<groupId>io.opentelemetry.contrib</groupId>
-					<artifactId>opentelemetry-azure-resources</artifactId>
-				</exclusion>
-			</exclusions>
-		</dependency>
-
-		<!-- Sentry error reporting (GlitchTip-compatible) — sentry-spring-boot-4 is the
-		     Spring Boot 4 / Spring Framework 7 compatible module (replaces the jakarta starter
-		     which crashes with SF7 due to bean-name generation for triply-nested @Import classes) -->
-		<dependency>
-			<groupId>io.sentry</groupId>
-			<artifactId>sentry-spring-boot-4</artifactId>
-			<version>8.41.0</version>
-		</dependency>
 	</dependencies>
 
 
@@ -306,7 +242,7 @@
 						<phase>verify</phase>
 						<goals><goal>report</goal></goals>
 					</execution>
-					<!-- Gate: ratchet at 0.77 — actual measured coverage after drift; raise via #496 -->
+					<!-- Gate: baseline 89.4% overall / service 90.2% / controller 80.0% -->
 					<execution>
 						<id>check</id>
 						<phase>verify</phase>
@@ -319,7 +255,7 @@
 										<limit>
 											<counter>BRANCH</counter>
 											<value>COVEREDRATIO</value>
-											<minimum>0.77</minimum>
+											<minimum>0.88</minimum>
 										</limit>
 									</limits>
 								</rule>
@@ -337,16 +273,6 @@
 					</profiles>
 				</configuration>
 			</plugin>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-surefire-plugin</artifactId>
-				<configuration>
-					<forkedProcessTimeoutInSeconds>600</forkedProcessTimeoutInSeconds>
-					<systemPropertyVariables>
-						<junit.jupiter.execution.timeout.default>90 s</junit.jupiter.execution.timeout.default>
-					</systemPropertyVariables>
-				</configuration>
-			</plugin>
 		</plugins>
 	</build>
 

backend/src/main/java/org/raddatz/familienarchiv/audit/AuditKind.java

@@ -35,22 +35,7 @@ public enum AuditKind {
     USER_DELETED,
 
     /** Payload: {@code {"userId": "uuid", "email": "addr", "addedGroups": ["Admin"], "removedGroups": []}} */
-    GROUP_MEMBERSHIP_CHANGED,
-
-    /** Payload: {@code {"userId": "uuid", "ip": "1.2.3.4", "ua": "Mozilla/5.0..."}} */
-    LOGIN_SUCCESS,
-
-    /** Payload: {@code {"email": "addr", "ip": "1.2.3.4", "ua": "Mozilla/5.0..."}} — password NEVER included */
-    LOGIN_FAILED,
-
-    /** Payload: {@code {"userId": "uuid", "ip": "1.2.3.4", "ua": "Mozilla/5.0...", "reason": "password_change|password_reset|admin_force_logout", "revokedCount": 3}} */
-    LOGOUT,
-
-    /** Payload: {@code {"actorId": "uuid", "targetUserId": "uuid", "revokedCount": 3}} */
-    ADMIN_FORCE_LOGOUT,
-
-    /** Payload: {@code {"ip": "1.2.3.4", "email": "addr"}} — password NEVER included */
-    LOGIN_RATE_LIMITED;
+    GROUP_MEMBERSHIP_CHANGED;
 
     public static final Set<AuditKind> ROLLUP_ELIGIBLE = Set.of(
             TEXT_SAVED, FILE_UPLOADED, ANNOTATION_CREATED,

backend/src/main/java/org/raddatz/familienarchiv/auth/AuthService.java

@@ -1,84 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.UserService;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.stereotype.Service;
-
-import java.util.Map;
-import java.util.UUID;
-
-@Service
-@RequiredArgsConstructor
-@Slf4j
-public class AuthService {
-
-    private final AuthenticationManager authenticationManager;
-    private final UserService userService;
-    private final AuditService auditService;
-    private final LoginRateLimiter loginRateLimiter;
-    private final SessionRevocationPort sessionRevocationPort;
-
-    public LoginResult login(String email, String password, String ip, String ua) {
-        try {
-            loginRateLimiter.checkAndConsume(ip, email);
-        } catch (DomainException ex) {
-            auditService.log(AuditKind.LOGIN_RATE_LIMITED, null, null, Map.of(
-                    "ip", ip,
-                    "email", email));
-            throw ex;
-        }
-        try {
-            Authentication auth = authenticationManager.authenticate(
-                    new UsernamePasswordAuthenticationToken(email, password));
-
-            AppUser user = userService.findByEmail(email);
-            auditService.log(AuditKind.LOGIN_SUCCESS, user.getId(), null, Map.of(
-                    "userId", user.getId().toString(),
-                    "ip", ip,
-                    "ua", truncateUa(ua)));
-            loginRateLimiter.invalidateOnSuccess(ip, email);
-            return new LoginResult(user, auth);
-        } catch (AuthenticationException ex) {
-            // Audit login failure — intentionally does NOT log the attempted password.
-            // DaoAuthenticationProvider already runs a dummy BCrypt on unknown users to
-            // equalise timing between "user not found" and "wrong password" paths.
-            auditService.log(AuditKind.LOGIN_FAILED, null, null, Map.of(
-                    "email", email,
-                    "ip", ip,
-                    "ua", truncateUa(ua)));
-            throw DomainException.invalidCredentials();
-        }
-    }
-
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        return sessionRevocationPort.revokeOtherSessions(currentSessionId, principalName);
-    }
-
-    public int revokeAllSessions(String principalName) {
-        return sessionRevocationPort.revokeAllSessions(principalName);
-    }
-
-    public void logout(String email, String ip, String ua) {
-        AppUser user = userService.findByEmail(email);
-        auditService.log(AuditKind.LOGOUT, user.getId(), null, Map.of(
-                "userId", user.getId().toString(),
-                "ip", ip,
-                "ua", truncateUa(ua)));
-    }
-
-    private static String truncateUa(String ua) {
-        if (ua == null) return "";
-        return ua.length() > 200 ? ua.substring(0, 200) : ua;
-    }
-
-    public record LoginResult(AppUser user, Authentication authentication) {}
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/AuthSessionController.java

@@ -1,102 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import jakarta.servlet.http.HttpSession;
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
-import org.springframework.web.bind.annotation.*;
-
-// @RequirePermission is intentionally absent: login is unauthenticated by design;
-// logout requires an authenticated session (enforced by SecurityConfig), not a specific permission.
-@RestController
-@RequestMapping("/api/auth")
-@RequiredArgsConstructor
-@Slf4j
-public class AuthSessionController {
-
-    private final AuthService authService;
-    private final SessionAuthenticationStrategy sessionAuthenticationStrategy;
-
-    @PostMapping("/login")
-    public ResponseEntity<AppUser> login(
-            @RequestBody LoginRequest request,
-            HttpServletRequest httpRequest,
-            HttpServletResponse httpResponse) {
-
-        String ip = resolveClientIp(httpRequest);
-        String ua = resolveUserAgent(httpRequest);
-
-        AuthService.LoginResult result = authService.login(request.email(), request.password(), ip, ua);
-
-        // Session-fixation defense (CWE-384): rotate the session ID at the authentication
-        // boundary. ChangeSessionIdAuthenticationStrategy invalidates any pre-auth session ID
-        // an attacker may have planted and mints a fresh one before we attach the SecurityContext.
-        httpRequest.getSession(true);
-        sessionAuthenticationStrategy.onAuthentication(result.authentication(), httpRequest, httpResponse);
-
-        // Spring Session JDBC intercepts setAttribute() and persists the record under the
-        // (now rotated) opaque ID; the Set-Cookie: fa_session=<opaque-id> is added automatically.
-        SecurityContext context = SecurityContextHolder.createEmptyContext();
-        context.setAuthentication(result.authentication());
-        SecurityContextHolder.setContext(context);
-        httpRequest.getSession()
-                .setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, context);
-
-        return ResponseEntity.ok(result.user());
-    }
-
-    @PostMapping("/logout")
-    public ResponseEntity<Void> logout(Authentication authentication, HttpServletRequest httpRequest) {
-        String email = authentication.getName();
-        String ip = resolveClientIp(httpRequest);
-        String ua = resolveUserAgent(httpRequest);
-
-        // CWE-613 defense: invalidate the session first — that is the contract the user
-        // is relying on when they click "Log out." Audit is best-effort and must not
-        // bubble up: if the user record was deleted while the session was live, the
-        // audit lookup throws, but the session row in spring_session must still die.
-        HttpSession session = httpRequest.getSession(false);
-        if (session != null) {
-            session.invalidate();
-        }
-        SecurityContextHolder.clearContext();
-
-        try {
-            authService.logout(email, ip, ua);
-        } catch (Exception ex) {
-            log.warn("Audit logout failed for {}; session was already invalidated", email, ex);
-        }
-
-        return ResponseEntity.noContent().build();
-    }
-
-    /**
-     * Resolves the client IP for audit-log purposes.
-     *
-     * <p>Trust model: the leftmost {@code X-Forwarded-For} value is taken at face value.
-     * This is correct <em>only</em> if the ingress (Caddy in production) strips any
-     * client-supplied XFF before forwarding — otherwise an attacker can pin audit-log
-     * IPs to whatever they want. Verify the reverse-proxy config before exposing this
-     * service behind a different ingress.
-     */
-    private static String resolveClientIp(HttpServletRequest request) {
-        String forwarded = request.getHeader("X-Forwarded-For");
-        if (forwarded != null && !forwarded.isBlank()) {
-            return forwarded.split(",")[0].trim();
-        }
-        return request.getRemoteAddr();
-    }
-
-    private static String resolveUserAgent(HttpServletRequest request) {
-        String ua = request.getHeader("User-Agent");
-        return ua != null ? ua : "";
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapter.java

@@ -1,29 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.RequiredArgsConstructor;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-@RequiredArgsConstructor
-class JdbcSessionRevocationAdapter implements SessionRevocationPort {
-
-    private final JdbcIndexedSessionRepository sessionRepository;
-
-    @Override
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        int count = 0;
-        for (String id : sessionRepository.findByPrincipalName(principalName).keySet()) {
-            if (!id.equals(currentSessionId)) {
-                sessionRepository.deleteById(id);
-                count++;
-            }
-        }
-        return count;
-    }
-
-    @Override
-    public int revokeAllSessions(String principalName) {
-        var sessions = sessionRepository.findByPrincipalName(principalName);
-        sessions.keySet().forEach(sessionRepository::deleteById);
-        return sessions.size();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/LoginRateLimiter.java

@@ -1,72 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import com.github.benmanes.caffeine.cache.Caffeine;
-import com.github.benmanes.caffeine.cache.LoadingCache;
-import io.github.bucket4j.Bandwidth;
-import io.github.bucket4j.Bucket;
-import lombok.extern.slf4j.Slf4j;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.springframework.stereotype.Service;
-
-import java.time.Duration;
-import java.util.Locale;
-import java.util.concurrent.TimeUnit;
-
-@Service
-@Slf4j
-public class LoginRateLimiter {
-
-    private final LoadingCache<String, Bucket> byIpEmail;
-    private final LoadingCache<String, Bucket> byIp;
-    private final int maxPerIpEmail;
-    private final int maxPerIp;
-    private final int windowMinutes;
-
-    public LoginRateLimiter(RateLimitProperties props) {
-        this.maxPerIpEmail = props.getMaxAttemptsPerIpEmail();
-        this.maxPerIp = props.getMaxAttemptsPerIp();
-        this.windowMinutes = props.getWindowMinutes();
-
-        this.byIpEmail = Caffeine.newBuilder()
-                .expireAfterAccess(windowMinutes, TimeUnit.MINUTES)
-                .build(key -> newBucket(maxPerIpEmail, windowMinutes));
-
-        this.byIp = Caffeine.newBuilder()
-                .expireAfterAccess(windowMinutes, TimeUnit.MINUTES)
-                .build(key -> newBucket(maxPerIp, windowMinutes));
-    }
-
-    // NOTE: This cache is node-local (in-memory). In a multi-replica deployment,
-    // effective limits would be multiplied by replica count.
-    // For the current single-VPS setup this is the correct, simplest implementation.
-
-    public void checkAndConsume(String ip, String email) {
-        long retryAfterSeconds = windowMinutes * 60L;
-        String key = ip + ":" + email.toLowerCase(Locale.ROOT);
-        if (!byIpEmail.get(key).tryConsume(1)) {
-            throw DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS,
-                    "Too many login attempts from " + ip, retryAfterSeconds);
-        }
-        if (!byIp.get(ip).tryConsume(1)) {
-            // Refund the ipEmail token so IP-level blocking does not erode the per-email quota.
-            byIpEmail.get(key).addTokens(1);
-            throw DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS,
-                    "Too many login attempts from " + ip, retryAfterSeconds);
-        }
-    }
-
-    public void invalidateOnSuccess(String ip, String email) {
-        byIpEmail.invalidate(ip + ":" + email.toLowerCase(Locale.ROOT));
-        byIp.invalidate(ip);
-    }
-
-    private static Bucket newBucket(int limit, int minutes) {
-        return Bucket.builder()
-                .addLimit(Bandwidth.builder()
-                        .capacity(limit)
-                        .refillGreedy(limit, Duration.ofMinutes(minutes))
-                        .build())
-                .build();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/LoginRequest.java

@@ -1,3 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-public record LoginRequest(String email, String password) {}

backend/src/main/java/org/raddatz/familienarchiv/auth/NoOpSessionRevocationAdapter.java

@@ -1,14 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-class NoOpSessionRevocationAdapter implements SessionRevocationPort {
-
-    @Override
-    public int revokeOtherSessions(String currentSessionId, String principalName) {
-        return 0;
-    }
-
-    @Override
-    public int revokeAllSessions(String principalName) {
-        return 0;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/RateLimitProperties.java

@@ -1,14 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import lombok.Data;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.stereotype.Component;
-
-@Component
-@ConfigurationProperties("rate-limit.login")
-@Data
-public class RateLimitProperties {
-    private int maxAttemptsPerIpEmail = 10;
-    private int maxAttemptsPerIp = 20;
-    private int windowMinutes = 15;
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/SessionRevocationConfig.java

@@ -1,19 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-@Configuration
-class SessionRevocationConfig {
-
-    @Bean
-    SessionRevocationPort sessionRevocationPort(
-            @Autowired(required = false) JdbcIndexedSessionRepository sessionRepository) {
-        if (sessionRepository != null) {
-            return new JdbcSessionRevocationAdapter(sessionRepository);
-        }
-        return new NoOpSessionRevocationAdapter();
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/auth/SessionRevocationPort.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-public interface SessionRevocationPort {
-    int revokeOtherSessions(String currentSessionId, String principalName);
-    int revokeAllSessions(String principalName);
-}

backend/src/main/java/org/raddatz/familienarchiv/config/RateLimitInterceptor.java

@@ -28,7 +28,6 @@ public class RateLimitInterceptor implements HandlerInterceptor {
         AtomicInteger count = requestCounts.get(ip, k -> new AtomicInteger(0));
         if (count.incrementAndGet() > MAX_REQUESTS_PER_MINUTE) {
             response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
-            response.setHeader("Retry-After", "60");
             response.getWriter().write("{\"code\":\"RATE_LIMIT_EXCEEDED\",\"message\":\"Too many requests\"}");
             return false;
         }

backend/src/main/java/org/raddatz/familienarchiv/config/SpringSessionConfig.java

@@ -1,22 +0,0 @@
-package org.raddatz.familienarchiv.config;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.session.web.http.CookieSerializer;
-import org.springframework.session.web.http.DefaultCookieSerializer;
-
-@Configuration
-public class SpringSessionConfig {
-
-    @Bean
-    public CookieSerializer cookieSerializer() {
-        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
-        serializer.setCookieName("fa_session");
-        serializer.setSameSite("Strict");
-        // cookieHttpOnly: true is the DefaultCookieSerializer default
-        // useSecureCookie not set: auto-detects from request.isSecure().
-        // With forward-headers-strategy: native, Caddy's X-Forwarded-Proto: https
-        // causes isSecure() → true in production; direct HTTP in dev/tests → false.
-        return serializer;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/document/Document.java

@@ -2,7 +2,6 @@ package org.raddatz.familienarchiv.document;
 
 import jakarta.persistence.*;
 import lombok.*;
-import org.hibernate.annotations.BatchSize;
 import org.hibernate.annotations.CreationTimestamp;
 import org.hibernate.annotations.UpdateTimestamp;
 
@@ -22,15 +21,6 @@ import java.util.HashSet;
 import java.util.Set;
 import java.util.UUID;
 
-@NamedEntityGraph(name = "Document.full", attributeNodes = {
-        @NamedAttributeNode("sender"),
-        @NamedAttributeNode("receivers"),
-        @NamedAttributeNode("tags")
-})
-@NamedEntityGraph(name = "Document.list", attributeNodes = {
-        @NamedAttributeNode("sender"),
-        @NamedAttributeNode("tags")
-})
 @Entity
 @Table(name = "documents")
 @Data // Lombok: Generiert Getter, Setter, ToString, etc.
@@ -128,27 +118,24 @@ public class Document {
     @Builder.Default
     private ScriptType scriptType = ScriptType.UNKNOWN;
 
-    @ManyToMany(fetch = FetchType.LAZY)
+    @ManyToMany(fetch = FetchType.EAGER)
     @JoinTable(name = "document_receivers", joinColumns = @JoinColumn(name = "document_id"), inverseJoinColumns = @JoinColumn(name = "person_id"))
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<Person> receivers = new HashSet<>();
 
-    @ManyToOne(fetch = FetchType.LAZY)
+    @ManyToOne
     @JoinColumn(name = "sender_id")
     private Person sender;
 
-    @ManyToMany(fetch = FetchType.LAZY)
+    @ManyToMany(fetch = FetchType.EAGER)
     @JoinTable(name = "document_tags", joinColumns = @JoinColumn(name = "document_id"), inverseJoinColumns = @JoinColumn(name = "tag_id"))
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<Tag> tags = new HashSet<>();
 
-    @ElementCollection(fetch = FetchType.LAZY)
+    @ElementCollection(fetch = FetchType.EAGER)
     @CollectionTable(name = "document_training_labels", joinColumns = @JoinColumn(name = "document_id"))
     @Column(name = "label")
     @Enumerated(EnumType.STRING)
-    @BatchSize(size = 50)
     @Builder.Default
     private Set<TrainingLabel> trainingLabels = new HashSet<>();
 

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentRepository.java

@@ -7,8 +7,6 @@ import org.raddatz.familienarchiv.document.DocumentStatus;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
-import org.springframework.data.jpa.domain.Specification;
-import org.springframework.data.jpa.repository.EntityGraph;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 import org.springframework.data.jpa.repository.Query;
@@ -25,18 +23,6 @@ import java.util.UUID;
 @Repository
 public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSpecificationExecutor<Document> {
 
-    @EntityGraph("Document.full")
-    Optional<Document> findById(UUID id);
-
-    @EntityGraph("Document.list")
-    Page<Document> findAll(Specification<Document> spec, Pageable pageable);
-
-    @EntityGraph("Document.list")
-    List<Document> findAll(Specification<Document> spec);
-
-    @EntityGraph("Document.list")
-    Page<Document> findAll(Pageable pageable);
-
     // Findet ein Dokument anhand des ursprünglichen Dateinamens
     // Wichtig für den Abgleich beim Excel-Import & Datei-Upload
     Optional<Document> findByOriginalFilename(String originalFilename);
@@ -44,21 +30,17 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
     // Wie oben, gibt aber nur das erste Ergebnis zurück — sicher wenn doppelte Dateinamen existieren
     Optional<Document> findFirstByOriginalFilename(String originalFilename);
 
-    // Callers access only status/id scalar fields — no graph needed.
+    // Findet alle Dokumente mit einem bestimmten Status
+    // z.B. um alle offenen "PLACEHOLDER" zu finden
     List<Document> findByStatus(DocumentStatus status);
 
     // Prüft effizient, ob ein Dateiname schon existiert (gibt true/false zurück)
     boolean existsByOriginalFilename(String originalFilename);
 
-    // lazy – @BatchSize(50) fallback active; see ADR-022
-    @EntityGraph("Document.full")
     List<Document> findBySenderId(UUID senderId);
 
-    // lazy – @BatchSize(50) fallback active; see ADR-022
-    @EntityGraph("Document.full")
     List<Document> findByReceiversId(UUID receiverId);
 
-    // Callers access only doc.getTags() to mutate the set — receivers/sender not touched; no graph needed.
     List<Document> findByTags_Id(UUID tagId);
 
     @Query("SELECT d FROM Document d WHERE d.id NOT IN (SELECT DISTINCT dv.documentId FROM DocumentVersion dv)")
@@ -73,15 +55,12 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
 
     long countByMetadataCompleteFalse();
 
-    // No production callers — only used if a future export path iterates the full list; no graph needed.
     List<Document> findByMetadataCompleteFalse(Sort sort);
 
-    // Callers map to IncompleteDocumentDTO using only scalar fields (id, title, createdAt) — no graph needed.
     Page<Document> findByMetadataCompleteFalse(Pageable pageable);
 
     Optional<Document> findFirstByMetadataCompleteFalseAndIdNot(UUID id, Sort sort);
 
-    @EntityGraph("Document.full")
     @Query("SELECT DISTINCT d FROM Document d " +
             "JOIN d.receivers r " +
             "WHERE " +
@@ -96,7 +75,6 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             @Param("to") LocalDate to,
             Sort sort);
 
-    @EntityGraph("Document.full")
     @Query("SELECT DISTINCT d FROM Document d " +
             "LEFT JOIN d.receivers r " +
             "WHERE (d.sender.id = :personId OR r.id = :personId) " +
@@ -122,45 +100,7 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             ORDER BY ts_rank(d.search_vector, q.pq) DESC,
                      d.meta_date DESC NULLS LAST
             """)
-    // Unpaged path — for bulk-edit "select all" and density chart
-    List<UUID> findAllMatchingIdsByFts(@Param("query") String query);
-
-    /**
-     * Returns one page of FTS-ranked document IDs with the total match count.
-     *
-     * <p>Each row contains (in column order):
-     * <ol>
-     *   <li>UUID   — document id</li>
-     *   <li>double — ts_rank score</li>
-     *   <li>long   — COUNT(*) OVER () — full match count, not page count</li>
-     * </ol>
-     *
-     * <p>Returns an empty list when the query matches no documents (including
-     * stopword-only queries where websearch_to_tsquery returns an empty tsquery).
-     * Use findAllMatchingIdsByFts for the unpaged bulk-edit path.
-     */
-    @Query(nativeQuery = true, value = """
-            WITH q AS (
-                SELECT CASE WHEN websearch_to_tsquery('german', :query)::text <> ''
-                            THEN to_tsquery('simple', regexp_replace(
-                                     websearch_to_tsquery('german', :query)::text,
-                                     '''([^'']+)''',
-                                     '''\\1'':*',
-                                     'g'))
-                       END AS pq
-            ), matches AS (
-                SELECT d.id, ts_rank(d.search_vector, q.pq) AS rank
-                FROM documents d, q
-                WHERE d.search_vector @@ q.pq
-            )
-            SELECT id, rank, COUNT(*) OVER () AS total
-            FROM matches
-            ORDER BY rank DESC, id
-            OFFSET :offset LIMIT :limit
-            """)
-    List<Object[]> findFtsPageRaw(@Param("query") String query,
-                                  @Param("offset") int offset,
-                                  @Param("limit") int limit);
+    List<UUID> findRankedIdsByFts(@Param("query") String query);
 
     /**
      * Returns match-enrichment data for a set of documents identified by their IDs.

backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java

@@ -162,7 +162,7 @@ public class DocumentService {
      */
     private List<UUID> resolveFtsIds(String text) {
         if (!StringUtils.hasText(text)) return null;
-        return documentRepository.findAllMatchingIdsByFts(text);
+        return documentRepository.findRankedIdsByFts(text);
     }
 
     /** Loads matching documents and projects to non-null {@link LocalDate}s. */
@@ -447,7 +447,6 @@ public class DocumentService {
         return saved;
     }
 
-    @Transactional
     public Document updateDocumentTags(UUID docId, List<String> tagNames) {
         Document doc = documentRepository.findById(docId)
                 .orElseThrow(() -> DomainException.notFound(ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + docId));
@@ -486,7 +485,7 @@ public class DocumentService {
         boolean hasText = StringUtils.hasText(text);
         List<UUID> rankedIds = null;
         if (hasText) {
-            rankedIds = documentRepository.findAllMatchingIdsByFts(text);
+            rankedIds = documentRepository.findRankedIdsByFts(text);
             if (rankedIds.isEmpty()) return List.of();
         }
 
@@ -636,7 +635,7 @@ public class DocumentService {
         return saved;
     }
 
-    @Transactional(readOnly = true)
+    // 0. Zuletzt aktive Dokumente (sortiert nach updatedAt DESC)
     public List<Document> getRecentActivity(int size) {
         return documentRepository.findAll(
                 PageRequest.of(0, size, Sort.by(Sort.Direction.DESC, "updatedAt"))
@@ -646,43 +645,39 @@ public class DocumentService {
     // 1. Allgemeine Suche (für das Suchfeld im Frontend)
     public DocumentSearchResult searchDocuments(String text, LocalDate from, LocalDate to, UUID sender, UUID receiver, List<String> tags, String tagQ, DocumentStatus status, DocumentSort sort, String dir, TagOperator tagOperator, Pageable pageable) {
         boolean hasText = StringUtils.hasText(text);
-
-        // Pure-text RELEVANCE: push pagination into SQL — skip findAllMatchingIdsByFts entirely (ADR-008).
-        if (isPureTextRelevance(hasText, sort, from, to, sender, receiver, tags, tagQ, status)) {
-            return relevanceSortedPageFromSql(text, pageable);
-        }
-
         List<UUID> rankedIds = null;
+
         if (hasText) {
-            rankedIds = documentRepository.findAllMatchingIdsByFts(text);
+            rankedIds = documentRepository.findRankedIdsByFts(text);
             if (rankedIds.isEmpty()) return DocumentSearchResult.of(List.of());
         }
 
         Specification<Document> spec = buildSearchSpec(
                 hasText, rankedIds, from, to, sender, receiver, tags, tagQ, status, tagOperator);
 
-        // SENDER and RECEIVER sorts load the full match set and slice in-memory.
+        // SENDER, RECEIVER and RELEVANCE sorts load the full match set and slice in memory.
         // JPA's Sort.by("sender.lastName") generates an INNER JOIN that silently drops
-        // documents with null sender/receivers. Cost scales with match count —
-        // acceptable while documents stays under ~10k rows. (ADR-008)
+        // documents with null sender/receivers; RELEVANCE maps a DB order to an external
+        // rank list. Cost scales linearly with match count — acceptable while documents
+        // stays under ~10k rows. Past that, replace with SQL-level LEFT JOIN sort.
         if (sort == DocumentSort.RECEIVER) {
-            // In-memory sort on page slice (≤ page size rows) — acceptable
             List<Document> sorted = sortByFirstReceiver(documentRepository.findAll(spec), dir);
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
         if (sort == DocumentSort.SENDER) {
-            // In-memory sort on page slice (≤ page size rows) — acceptable
             List<Document> sorted = sortBySender(documentRepository.findAll(spec), dir);
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
 
-        // RELEVANCE with active filters: load filtered subset and sort in-memory by rank.
+        // RELEVANCE: default when text present and no explicit sort given
         boolean useRankOrder = hasText && (sort == null || sort == DocumentSort.RELEVANCE);
         if (useRankOrder) {
+            List<Document> results = documentRepository.findAll(spec);
             Map<UUID, Integer> rankMap = new HashMap<>();
             for (int i = 0; i < rankedIds.size(); i++) rankMap.put(rankedIds.get(i), i);
-            List<Document> sorted = documentRepository.findAll(spec).stream()
-                    .sorted(Comparator.comparingInt(doc -> rankMap.getOrDefault(doc.getId(), Integer.MAX_VALUE)))
+            List<Document> sorted = results.stream()
+                    .sorted(Comparator.comparingInt(
+                            doc -> rankMap.getOrDefault(doc.getId(), Integer.MAX_VALUE)))
                     .toList();
             return buildResultPaged(pageSlice(sorted, pageable), text, pageable, sorted.size());
         }
@@ -693,39 +688,6 @@ public class DocumentService {
         return buildResultPaged(page.getContent(), text, pageable, page.getTotalElements());
     }
 
-    private static boolean isPureTextRelevance(boolean hasText, DocumentSort sort,
-            LocalDate from, LocalDate to, UUID sender, UUID receiver,
-            List<String> tags, String tagQ, DocumentStatus status) {
-        return hasText && (sort == null || sort == DocumentSort.RELEVANCE)
-                && from == null && to == null && sender == null && receiver == null
-                && (tags == null || tags.isEmpty()) && (tagQ == null || tagQ.isBlank()) && status == null;
-    }
-
-    /**
-     * Pure-text RELEVANCE path — pagination and ts_rank ordering pushed into SQL.
-     * Called when no non-text filters are active (ADR-008).
-     */
-    private DocumentSearchResult relevanceSortedPageFromSql(String text, Pageable pageable) {
-        long rawOffset = pageable.getOffset();
-        if (rawOffset > Integer.MAX_VALUE) return DocumentSearchResult.of(List.of());
-        int offset = (int) rawOffset;
-        int limit = pageable.getPageSize();
-        FtsPage ftsPage = toFtsPage(documentRepository.findFtsPageRaw(text, offset, limit));
-        if (ftsPage.hits().isEmpty()) return DocumentSearchResult.of(List.of());
-
-        // Preserve ts_rank order from SQL across the JPA findAllById call.
-        Map<UUID, Integer> rankMap = new HashMap<>();
-        List<UUID> pageIds = new ArrayList<>();
-        for (int i = 0; i < ftsPage.hits().size(); i++) {
-            rankMap.put(ftsPage.hits().get(i).id(), i);
-            pageIds.add(ftsPage.hits().get(i).id());
-        }
-        List<Document> docs = documentRepository.findAllById(pageIds).stream()
-                .sorted(Comparator.comparingInt(d -> rankMap.getOrDefault(d.getId(), Integer.MAX_VALUE)))
-                .toList();
-        return buildResultPaged(docs, text, pageable, ftsPage.total());
-    }
-
     private static <T> List<T> pageSlice(List<T> sorted, Pageable pageable) {
         int from = Math.min((int) pageable.getOffset(), sorted.size());
         int to = Math.min(from + pageable.getPageSize(), sorted.size());
@@ -844,7 +806,6 @@ public class DocumentService {
         documentRepository.save(doc);
     }
 
-    @Transactional(readOnly = true)
     public Document getDocumentById(UUID id) {
         Document doc = documentRepository.findById(id)
                 .orElseThrow(() -> DomainException.notFound(ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + id));
@@ -1052,28 +1013,6 @@ public class DocumentService {
         return result;
     }
 
-    private static final int COL_ID = 0;
-    private static final int COL_RANK = 1;
-    private static final int COL_TOTAL = 2;
-
-    /**
-     * Maps raw Object[] rows from {@link DocumentRepository#findFtsPageRaw} to an
-     * {@link FtsPage}. Uses pattern-matching UUID cast to guard against driver-level
-     * type variance (some JDBC drivers return UUID as String).
-     */
-    private static FtsPage toFtsPage(List<Object[]> rows) {
-        if (rows.isEmpty()) return new FtsPage(List.of(), 0);
-        long total = ((Number) rows.get(0)[COL_TOTAL]).longValue();
-        List<FtsHit> hits = rows.stream()
-                .map(r -> {
-                    UUID id = r[COL_ID] instanceof UUID u ? u : UUID.fromString(r[COL_ID].toString());
-                    double rank = ((Number) r[COL_RANK]).doubleValue();
-                    return new FtsHit(id, rank);
-                })
-                .toList();
-        return new FtsPage(hits, total);
-    }
-
     /** Clean text + highlight offsets parsed from a {@code ts_headline} sentinel-delimited string. */
     public record ParsedHighlight(String cleanText, List<MatchOffset> offsets) {}
 

backend/src/main/java/org/raddatz/familienarchiv/document/FtsHit.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import java.util.UUID;
-
-/** A single document hit from a paginated FTS query — id and its ts_rank score. */
-record FtsHit(UUID id, double rank) {}

backend/src/main/java/org/raddatz/familienarchiv/document/FtsPage.java

@@ -1,6 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import java.util.List;
-
-/** One page of FTS results — the ranked hit list for this page and the total match count. */
-record FtsPage(List<FtsHit> hits, long total) {}

backend/src/main/java/org/raddatz/familienarchiv/document/comment/CommentController.java

@@ -27,9 +27,7 @@ public class CommentController {
     // ─── Block (transcription) comments ────────────────────────────────────────
 
     @GetMapping("/api/documents/{documentId}/transcription-blocks/{blockId}/comments")
-    public List<DocumentComment> getBlockComments(
-            @PathVariable UUID documentId,
-            @PathVariable UUID blockId) {
+    public List<DocumentComment> getBlockComments(@PathVariable UUID blockId) {
         return commentService.getCommentsForBlock(blockId);
     }
 
@@ -50,7 +48,6 @@ public class CommentController {
     @RequirePermission({Permission.ANNOTATE_ALL, Permission.WRITE_ALL})
     public DocumentComment replyToBlockComment(
             @PathVariable UUID documentId,
-            @PathVariable UUID blockId,
             @PathVariable UUID commentId,
             @RequestBody CreateCommentDTO dto,
             Authentication authentication) {

backend/src/main/java/org/raddatz/familienarchiv/exception/DomainException.java

@@ -10,21 +10,11 @@ public class DomainException extends RuntimeException {
 
     private final ErrorCode code;
     private final HttpStatus status;
-    /** Seconds until the rate-limit window resets; {@code null} when not applicable. */
-    private final Long retryAfterSeconds;
 
     public DomainException(ErrorCode code, HttpStatus status, String developerMessage) {
         super(developerMessage);
         this.code = code;
         this.status = status;
-        this.retryAfterSeconds = null;
-    }
-
-    private DomainException(ErrorCode code, HttpStatus status, String developerMessage, Long retryAfterSeconds) {
-        super(developerMessage);
-        this.code = code;
-        this.status = status;
-        this.retryAfterSeconds = retryAfterSeconds;
     }
 
     public ErrorCode getCode() {
@@ -35,11 +25,6 @@ public class DomainException extends RuntimeException {
         return status;
     }
 
-    /** Returns the {@code Retry-After} value in seconds, or {@code null} if not set. */
-    public Long getRetryAfterSeconds() {
-        return retryAfterSeconds;
-    }
-
     // --- Static factories for common cases ---
 
     public static DomainException notFound(ErrorCode code, String message) {
@@ -54,11 +39,6 @@ public class DomainException extends RuntimeException {
         return new DomainException(ErrorCode.UNAUTHORIZED, HttpStatus.UNAUTHORIZED, message);
     }
 
-    public static DomainException invalidCredentials() {
-        return new DomainException(ErrorCode.INVALID_CREDENTIALS, HttpStatus.UNAUTHORIZED,
-                "Invalid email or password");
-    }
-
     public static DomainException conflict(ErrorCode code, String message) {
         return new DomainException(code, HttpStatus.CONFLICT, message);
     }
@@ -70,12 +50,4 @@ public class DomainException extends RuntimeException {
     public static DomainException internal(ErrorCode code, String message) {
         return new DomainException(code, HttpStatus.INTERNAL_SERVER_ERROR, message);
     }
-
-    public static DomainException tooManyRequests(ErrorCode code, String message) {
-        return new DomainException(code, HttpStatus.TOO_MANY_REQUESTS, message);
-    }
-
-    public static DomainException tooManyRequests(ErrorCode code, String message, long retryAfterSeconds) {
-        return new DomainException(code, HttpStatus.TOO_MANY_REQUESTS, message, retryAfterSeconds);
-    }
 }

backend/src/main/java/org/raddatz/familienarchiv/exception/ErrorCode.java

@@ -30,8 +30,6 @@ public enum ErrorCode {
     // --- Users ---
     /** A user with the given ID or username does not exist. 404 */
     USER_NOT_FOUND,
-    /** A group with the given ID does not exist. 404 */
-    GROUP_NOT_FOUND,
     /** The supplied email address is already used by another account. 409 */
     EMAIL_ALREADY_IN_USE,
     /** The supplied current password does not match the stored hash. 400 */
@@ -54,24 +52,14 @@ public enum ErrorCode {
     INVITE_REVOKED,
     /** The invite has passed its expiry date. 410 */
     INVITE_EXPIRED,
-    /** A group cannot be deleted because one or more active invites reference it. 409 */
-    GROUP_HAS_ACTIVE_INVITES,
 
     // --- Auth ---
     /** The request is not authenticated. 401 */
     UNAUTHORIZED,
     /** The authenticated user lacks the required permission. 403 */
     FORBIDDEN,
-    /** The supplied email/password combination does not match any active account. 401 */
-    INVALID_CREDENTIALS,
-    /** The session has expired or been invalidated. 401 */
-    SESSION_EXPIRED,
     /** The password-reset token is missing, expired, or already used. 400 */
     INVALID_RESET_TOKEN,
-    /** CSRF token is missing or does not match the expected value. 403 */
-    CSRF_TOKEN_MISSING,
-    /** The login rate limit has been exceeded for this IP/email combination. 429 */
-    TOO_MANY_LOGIN_ATTEMPTS,
 
     // --- Annotations ---
     /** The annotation with the given ID does not exist. 404 */

backend/src/main/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandler.java

@@ -2,7 +2,6 @@ package org.raddatz.familienarchiv.exception;
 
 import java.util.stream.Collectors;
 
-import io.sentry.Sentry;
 import jakarta.validation.ConstraintViolationException;
 import org.raddatz.familienarchiv.exception.DomainException;
 import org.raddatz.familienarchiv.exception.ErrorCode;
@@ -23,11 +22,9 @@ public class GlobalExceptionHandler {
 
     @ExceptionHandler(DomainException.class)
     public ResponseEntity<ErrorResponse> handleDomain(DomainException ex) {
-        var builder = ResponseEntity.status(ex.getStatus());
-        if (ex.getRetryAfterSeconds() != null) {
-            builder = builder.header("Retry-After", String.valueOf(ex.getRetryAfterSeconds()));
-        }
-        return builder.body(new ErrorResponse(ex.getCode(), ex.getMessage()));
+        return ResponseEntity
+            .status(ex.getStatus())
+            .body(new ErrorResponse(ex.getCode(), ex.getMessage()));
     }
 
     @ExceptionHandler(MethodArgumentNotValidException.class)
@@ -66,7 +63,6 @@ public class GlobalExceptionHandler {
 
     @ExceptionHandler(Exception.class)
     public ResponseEntity<ErrorResponse> handleGeneric(Exception ex) {
-        Sentry.captureException(ex);
         log.error("Unhandled exception", ex);
         return ResponseEntity.internalServerError()
             .body(new ErrorResponse(ErrorCode.INTERNAL_ERROR, "An unexpected error occurred"));

backend/src/main/java/org/raddatz/familienarchiv/importing/MassImportService.java

@@ -1,8 +1,5 @@
 package org.raddatz.familienarchiv.importing;
 
-import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.poi.ss.usermodel.*;
@@ -33,7 +30,6 @@ import javax.xml.parsers.DocumentBuilderFactory;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -56,33 +52,9 @@ public class MassImportService {
 
     public enum State { IDLE, RUNNING, DONE, FAILED }
 
-    public record SkippedFile(
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String filename,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String reason
-    ) {}
+    public record ImportStatus(State state, String message, int processed, LocalDateTime startedAt) {}
 
-    public record ImportStatus(
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) State state,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) String statusCode,
-            @JsonIgnore String message,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) int processed,
-            @Schema(requiredMode = Schema.RequiredMode.REQUIRED) List<SkippedFile> skippedFiles,
-            LocalDateTime startedAt
-    ) {
-        // Note: @Schema on a record accessor method is not picked up by SpringDoc; the
-        // "skipped" count is a computed convenience field derived from skippedFiles.size().
-        @JsonProperty("skipped")
-        public int skipped() { return skippedFiles.size(); }
-
-        /** Defensive-copy constructor — callers cannot mutate the stored list after construction. */
-        public ImportStatus {
-            skippedFiles = List.copyOf(skippedFiles);
-        }
-    }
-
-    record ProcessResult(int processed, List<SkippedFile> skippedFiles) {}
-
-    private volatile ImportStatus currentStatus = new ImportStatus(State.IDLE, "IMPORT_IDLE", "Kein Import gestartet.", 0, List.of(), null);
+    private volatile ImportStatus currentStatus = new ImportStatus(State.IDLE, "Kein Import gestartet.", 0, null);
 
     public ImportStatus getStatus() {
         return currentStatus;
@@ -127,9 +99,7 @@ public class MassImportService {
     @Value("${app.import.col.transcription:13}")
     private int colTranscription;
 
-    @Value("${app.import.dir:/import}")
-    private String importDir;
-
+    private static final String IMPORT_DIR = "/import";
     private static final DateTimeFormatter GERMAN_DATE = DateTimeFormatter.ofPattern("d. MMMM yyyy", Locale.GERMAN);
 
     // ODS XML namespaces
@@ -144,39 +114,30 @@ public class MassImportService {
         if (currentStatus.state() == State.RUNNING) {
             throw DomainException.conflict(ErrorCode.IMPORT_ALREADY_RUNNING, "A mass import is already in progress");
         }
-        currentStatus = new ImportStatus(State.RUNNING, "IMPORT_RUNNING", "Import läuft...", 0, List.of(), LocalDateTime.now());
+        currentStatus = new ImportStatus(State.RUNNING, "Import läuft...", 0, LocalDateTime.now());
         try {
             File spreadsheet = findSpreadsheetFile();
             log.info("Starte Massenimport aus: {}", spreadsheet.getAbsolutePath());
-            ProcessResult result = processRows(readSpreadsheet(spreadsheet));
-            currentStatus = new ImportStatus(State.DONE, "IMPORT_DONE",
-                    "Import abgeschlossen. " + result.processed() + " Dokumente verarbeitet.",
-                    result.processed(), result.skippedFiles(), currentStatus.startedAt());
-        } catch (NoSpreadsheetException e) {
-            log.error("Massenimport fehlgeschlagen: keine Tabellendatei", e);
-            currentStatus = new ImportStatus(State.FAILED, "IMPORT_FAILED_NO_SPREADSHEET",
-                    "Fehler: " + e.getMessage(), 0, List.of(), currentStatus.startedAt());
+            int processed = processRows(readSpreadsheet(spreadsheet));
+            currentStatus = new ImportStatus(State.DONE,
+                    "Import abgeschlossen. " + processed + " Dokumente verarbeitet.",
+                    processed, currentStatus.startedAt());
         } catch (Exception e) {
             log.error("Massenimport fehlgeschlagen", e);
-            currentStatus = new ImportStatus(State.FAILED, "IMPORT_FAILED_INTERNAL",
-                    "Fehler: " + e.getMessage(), 0, List.of(), currentStatus.startedAt());
+            currentStatus = new ImportStatus(State.FAILED, "Fehler: " + e.getMessage(), 0, currentStatus.startedAt());
         }
     }
 
-    private static class NoSpreadsheetException extends RuntimeException {
-        NoSpreadsheetException(String message) { super(message); }
-    }
-
     private File findSpreadsheetFile() throws IOException {
-        try (Stream<Path> files = Files.list(Paths.get(importDir))) {
+        try (Stream<Path> files = Files.list(Paths.get(IMPORT_DIR))) {
             return files
                     .filter(p -> {
                         String name = p.toString().toLowerCase();
                         return name.endsWith(".ods") || name.endsWith(".xlsx") || name.endsWith(".xls");
                     })
                     .findFirst()
-                    .orElseThrow(() -> new NoSpreadsheetException(
-                            "Keine Tabellendatei (.ods/.xlsx/.xls) in " + importDir + " gefunden!"))
+                    .orElseThrow(() -> new RuntimeException(
+                            "Keine Tabellendatei (.ods/.xlsx/.xls) in " + IMPORT_DIR + " gefunden!"))
                     .toFile();
         }
     }
@@ -195,14 +156,14 @@ public class MassImportService {
      * Reads an ODS file by parsing its content.xml directly (no extra library needed).
      * ODS is a ZIP archive; content.xml holds the spreadsheet data as XML.
      */
-    List<List<String>> readOds(File file) throws Exception {
+    private List<List<String>> readOds(File file) throws Exception {
         List<List<String>> result = new ArrayList<>();
 
         try (ZipFile zip = new ZipFile(file)) {
             var entry = zip.getEntry("content.xml");
             if (entry == null) throw new RuntimeException("Ungültige ODS-Datei: content.xml fehlt");
 
-            var factory = XxeSafeXmlParser.hardenedFactory();
+            var factory = DocumentBuilderFactory.newInstance();
             factory.setNamespaceAware(true);
             var builder = factory.newDocumentBuilder();
             var doc = builder.parse(zip.getInputStream(entry));
@@ -281,10 +242,8 @@ public class MassImportService {
 
     // --- Import logic (works on neutral List<String> rows) ---
 
-    private ProcessResult processRows(List<List<String>> rows) {
-        int processed = 0;
-        List<SkippedFile> skippedFiles = new ArrayList<>();
-
+    private int processRows(List<List<String>> rows) {
+        int count = 0;
         for (int i = 1; i < rows.size(); i++) { // skip header row
             List<String> cells = rows.get(i);
             String index = getCell(cells, colIndex);
@@ -295,58 +254,18 @@ public class MassImportService {
             if (fileOnDisk.isEmpty()) {
                 log.warn("Datei nicht gefunden, importiere nur Metadaten: {}", filename);
             }
-
-            if (fileOnDisk.isPresent()) {
-                try {
-                    if (!isPdfMagicBytes(fileOnDisk.get())) {
-                        log.warn("Überspringe {}: Datei beginnt nicht mit %PDF-Signatur", filename);
-                        skippedFiles.add(new SkippedFile(filename, "INVALID_PDF_SIGNATURE"));
-                        continue;
-                    }
-                } catch (IOException e) {
-                    log.error("Fehler beim Prüfen der Magic-Bytes für {}", filename, e);
-                    skippedFiles.add(new SkippedFile(filename, "FILE_READ_ERROR"));
-                    continue;
-                }
-            }
-
-            Optional<String> skipReason = importSingleDocument(cells, fileOnDisk, filename, index);
-            if (skipReason.isPresent()) {
-                skippedFiles.add(new SkippedFile(filename, skipReason.get()));
-            } else {
-                processed++;
-            }
+            importSingleDocument(cells, fileOnDisk, filename, index);
+            count++;
         }
-        return new ProcessResult(processed, skippedFiles);
+        return count;
     }
 
-    // package-private: Mockito spy in tests can override to inject IOException
-    InputStream openFileStream(File file) throws IOException {
-        return new FileInputStream(file);
-    }
-
-    private boolean isPdfMagicBytes(File file) throws IOException {
-        try (InputStream is = openFileStream(file)) {
-            byte[] header = is.readNBytes(4);
-            return header.length == 4
-                    && header[0] == 0x25  // %
-                    && header[1] == 0x50  // P
-                    && header[2] == 0x44  // D
-                    && header[3] == 0x46; // F
-        }
-    }
-
-    /**
-     * Imports a single document row.
-     *
-     * @return empty Optional on success; an Optional containing the skip reason on failure/skip.
-     */
     @Transactional
-    protected Optional<String> importSingleDocument(List<String> cells, Optional<File> file, String originalFilename, String index) {
+    protected void importSingleDocument(List<String> cells, Optional<File> file, String originalFilename, String index) {
         Optional<Document> existing = documentService.findByOriginalFilename(originalFilename);
         if (existing.isPresent() && existing.get().getStatus() != DocumentStatus.PLACEHOLDER) {
             log.info("Dokument {} existiert bereits, überspringe.", originalFilename);
-            return Optional.of("ALREADY_EXISTS");
+            return;
         }
 
         String archiveBox    = getCell(cells, colBox);
@@ -382,7 +301,7 @@ public class MassImportService {
                 status = DocumentStatus.UPLOADED;
             } catch (Exception e) {
                 log.error("S3 Upload Fehler für {}", file.get().getName(), e);
-                return Optional.of("S3_UPLOAD_FAILED");
+                return;
             }
         }
 
@@ -424,7 +343,6 @@ public class MassImportService {
             thumbnailAsyncRunner.dispatchAfterCommit(saved.getId());
         }
         log.info("Importiert{}: {}", file.isEmpty() ? " (nur Metadaten)" : "", originalFilename);
-        return Optional.empty();
     }
 
     // --- Helpers ---
@@ -460,7 +378,7 @@ public class MassImportService {
     }
 
     private Optional<File> findFileRecursive(String filename) {
-        try (Stream<Path> walk = Files.walk(Paths.get(importDir))) {
+        try (Stream<Path> walk = Files.walk(Paths.get(IMPORT_DIR))) {
             return walk.filter(p -> !Files.isDirectory(p))
                     .filter(p -> p.getFileName().toString().equals(filename))
                     .map(Path::toFile)

backend/src/main/java/org/raddatz/familienarchiv/importing/XxeSafeXmlParser.java

@@ -1,20 +0,0 @@
-package org.raddatz.familienarchiv.importing;
-
-import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.parsers.ParserConfigurationException;
-
-class XxeSafeXmlParser {
-
-    private XxeSafeXmlParser() {}
-
-    static DocumentBuilderFactory hardenedFactory() throws ParserConfigurationException {
-        var factory = DocumentBuilderFactory.newInstance();
-        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
-        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
-        factory.setXIncludeAware(false);
-        factory.setExpandEntityReferences(false);
-        return factory;
-    }
-}

backend/src/main/java/org/raddatz/familienarchiv/person/Person.java

@@ -1,7 +1,6 @@
 package org.raddatz.familienarchiv.person;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.persistence.*;
 import lombok.*;
@@ -10,9 +9,6 @@ import org.raddatz.familienarchiv.user.DisplayNameFormatter;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
-
-// prevents infinite recursion in JSON serialization; see ADR-022 for lazy-fetch context
-@JsonIgnoreProperties({"hibernateLazyInitializer", "handler"})
 @Entity
 @Table(name = "persons")
 @Data

backend/src/main/java/org/raddatz/familienarchiv/security/SecurityConfig.java

@@ -1,42 +1,24 @@
 package org.raddatz.familienarchiv.security;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.RequiredArgsConstructor;
 
-import org.raddatz.familienarchiv.exception.ErrorCode;
 import org.raddatz.familienarchiv.user.CustomUserDetailsService;
-import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.core.annotation.Order;
 import org.springframework.core.env.Environment;
-import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
-import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
-import org.springframework.security.web.csrf.CsrfException;
-import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
-
-import java.util.Map;
 
 @Configuration
 @EnableWebSecurity
 @RequiredArgsConstructor
 public class SecurityConfig {
 
-    // @WebMvcTest slices do not include JacksonAutoConfiguration, so ObjectMapper
-    // cannot be injected here. A static instance is safe because the response
-    // only serializes fixed String keys — no custom naming strategy or module needed.
-    private static final ObjectMapper ERROR_WRITER = new ObjectMapper();
-
     private final CustomUserDetailsService userDetailsService;
     private final Environment environment;
 
@@ -52,57 +34,20 @@ public class SecurityConfig {
         return authProvider;
     }
 
-    @Bean
-    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
-        return config.getAuthenticationManager();
-    }
-
-    @Bean
-    public SessionAuthenticationStrategy sessionAuthenticationStrategy() {
-        // ChangeSessionIdAuthenticationStrategy rotates the session ID via the Servlet 3.1+
-        // HttpServletRequest.changeSessionId() — preserves attributes, mints a fresh ID.
-        // Used by AuthSessionController.login to defend against session fixation (CWE-384).
-        return new ChangeSessionIdAuthenticationStrategy();
-    }
-
-    @Bean
-    @Order(1)
-    public SecurityFilterChain managementFilterChain(HttpSecurity http) throws Exception {
-        http
-                .securityMatcher("/actuator/**")
-                .authorizeHttpRequests(auth -> {
-                    // Health and Prometheus are open — Docker health checks and Prometheus scraping need no credentials.
-                    auth.requestMatchers("/actuator/health", "/actuator/prometheus").permitAll();
-                    // All other actuator endpoints (metrics, info, env, heapdump…) require authentication.
-                    auth.anyRequest().authenticated();
-                })
-                // Explicitly return 401 for any unauthenticated actuator request.
-                // Without this override, Spring Security's DelegatingAuthenticationEntryPoint
-                // would redirect browser-like clients to the form-login page (302 → /login),
-                // making it impossible to distinguish "not authenticated" from "not found" in tests.
-                .exceptionHandling(ex -> ex.authenticationEntryPoint(
-                        (req, res, e) -> res.setStatus(HttpServletResponse.SC_UNAUTHORIZED)))
-                .formLogin(AbstractHttpConfigurer::disable)
-                .csrf(AbstractHttpConfigurer::disable);
-        return http.build();
-    }
-
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         http
-                // CSRF protection via CookieCsrfTokenRepository (NFR-SEC-103).
-                // The backend sets an XSRF-TOKEN cookie (not HttpOnly so JS can read it).
-                // All state-changing requests must include X-XSRF-TOKEN matching the cookie.
-                // See ADR-022 and issue #524 for the full security rationale.
-                .csrf(csrf -> csrf
-                        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
-                        .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler()))
+                // CSRF is intentionally disabled: every request from the SvelteKit frontend
+                // carries an explicit Authorization header (Basic Auth token injected by
+                // hooks.server.ts). Browsers block cross-origin requests from setting custom
+                // headers, so cross-site request forgery via a third-party page is not
+                // possible with this auth scheme. If the auth model ever changes to
+                // cookie-based sessions, CSRF protection must be re-enabled.
+                .csrf(csrf -> csrf.disable())
 
                 .authorizeHttpRequests(auth -> {
-                    // Actuator endpoints are governed by managementFilterChain (@Order(1)) above.
-                    auth.requestMatchers("/actuator/health", "/actuator/prometheus").permitAll();
-                    // Login is unauthenticated by definition
-                    auth.requestMatchers("/api/auth/login").permitAll();
+                    // Health endpoint must be open so CI/Docker health checks work without credentials
+                    auth.requestMatchers("/actuator/health").permitAll();
                     // Password reset endpoints are unauthenticated by nature
                     auth.requestMatchers("/api/auth/forgot-password", "/api/auth/reset-password").permitAll();
                     // Invite-based registration endpoints are public
@@ -122,18 +67,9 @@ public class SecurityConfig {
                 // erlaubt pdf im Iframe
                 .headers(headers -> headers
                         .frameOptions(frameOptions -> frameOptions.sameOrigin()))
-                // Return 401 for unauthenticated requests; 403+CSRF_TOKEN_MISSING for CSRF failures.
-                .exceptionHandling(ex -> ex
-                        .authenticationEntryPoint(
-                                (req, res, e) -> res.setStatus(HttpServletResponse.SC_UNAUTHORIZED))
-                        .accessDeniedHandler((req, res, e) -> {
-                            res.setStatus(HttpServletResponse.SC_FORBIDDEN);
-                            res.setContentType("application/json;charset=UTF-8");
-                            ErrorCode code = (e instanceof CsrfException)
-                                    ? ErrorCode.CSRF_TOKEN_MISSING
-                                    : ErrorCode.FORBIDDEN;
-                            res.getWriter().write(ERROR_WRITER.writeValueAsString(Map.of("code", code.name())));
-                        }));
+                // Erlaubt Login via Browser-Popup oder REST-Header (Authorization: Basic ...)
+                .httpBasic(Customizer.withDefaults())
+                .formLogin(form -> form.usernameParameter("email"));
 
         return http.build();
     }

backend/src/main/java/org/raddatz/familienarchiv/tag/Tag.java

@@ -2,13 +2,10 @@ package org.raddatz.familienarchiv.tag;
 
 import java.util.UUID;
 
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.persistence.*;
 import lombok.*;
 
-// prevents infinite recursion in JSON serialization; see ADR-022 for lazy-fetch context
-@JsonIgnoreProperties({"hibernateLazyInitializer", "handler"})
 @Entity
 @Data
 @NoArgsConstructor

backend/src/main/java/org/raddatz/familienarchiv/user/AppUser.java

@@ -88,8 +88,7 @@ public class AppUser {
     };
 
     public static String computeColor(UUID id) {
-        // Math.floorMod avoids the Integer.MIN_VALUE overflow trap in Math.abs(hashCode())
-        return PALETTE[Math.floorMod(id.hashCode(), PALETTE.length)];
+        return PALETTE[Math.abs(id.hashCode()) % PALETTE.length];
     }
 
     @PrePersist

backend/src/main/java/org/raddatz/familienarchiv/user/InviteListItemDTO.java

@@ -31,6 +31,5 @@ public class InviteListItemDTO {
     private String status;
     @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
     private LocalDateTime createdAt;
-    @Schema(requiredMode = Schema.RequiredMode.REQUIRED)
     private String shareableUrl;
 }

backend/src/main/java/org/raddatz/familienarchiv/user/InviteService.java

@@ -52,11 +52,7 @@ public class InviteService {
     public InviteToken createInvite(CreateInviteRequest dto, AppUser creator) {
         Set<UUID> groupIds = new HashSet<>();
         if (dto.getGroupIds() != null && !dto.getGroupIds().isEmpty()) {
-            Set<UUID> uniqueIds = new HashSet<>(dto.getGroupIds());
-            List<UserGroup> groups = userService.findGroupsByIds(new ArrayList<>(uniqueIds));
-            if (groups.size() != uniqueIds.size()) {
-                throw DomainException.notFound(ErrorCode.GROUP_NOT_FOUND, "One or more group IDs do not exist");
-            }
+            List<UserGroup> groups = userService.findGroupsByIds(dto.getGroupIds());
             groups.forEach(g -> groupIds.add(g.getId()));
         }
 

backend/src/main/java/org/raddatz/familienarchiv/user/InviteTokenRepository.java

@@ -24,7 +24,4 @@ public interface InviteTokenRepository extends JpaRepository<InviteToken, UUID>
 
     @Query("SELECT t FROM InviteToken t ORDER BY t.createdAt DESC")
     List<InviteToken> findAllOrderedByCreatedAt();
-
-    @Query("SELECT CASE WHEN COUNT(t) > 0 THEN true ELSE false END FROM InviteToken t JOIN t.groupIds g WHERE g = :groupId AND t.revoked = false AND (t.expiresAt IS NULL OR t.expiresAt > CURRENT_TIMESTAMP) AND (t.maxUses IS NULL OR t.useCount < t.maxUses)")
-    boolean existsActiveWithGroupId(@Param("groupId") UUID groupId);
 }

backend/src/main/java/org/raddatz/familienarchiv/user/PasswordResetService.java

@@ -5,7 +5,6 @@ import java.time.LocalDateTime;
 import java.util.HexFormat;
 import java.util.Optional;
 
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.raddatz.familienarchiv.user.ResetPasswordRequest;
 import org.raddatz.familienarchiv.exception.DomainException;
 import org.raddatz.familienarchiv.exception.ErrorCode;
@@ -33,7 +32,6 @@ public class PasswordResetService {
     private final UserService userService;
     private final PasswordResetTokenRepository tokenRepository;
     private final PasswordEncoder passwordEncoder;
-    private final AuthService authService;
 
     @Autowired(required = false)
     private JavaMailSender mailSender;
@@ -87,8 +85,6 @@ public class PasswordResetService {
 
         resetToken.setUsed(true);
         tokenRepository.save(resetToken);
-
-        authService.revokeAllSessions(user.getEmail());
     }
 
     /**

backend/src/main/java/org/raddatz/familienarchiv/user/UserController.java

@@ -4,11 +4,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 
-import jakarta.servlet.http.HttpSession;
 import jakarta.validation.Valid;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.raddatz.familienarchiv.user.AdminUpdateUserRequest;
 import org.raddatz.familienarchiv.user.ChangePasswordDTO;
 import org.raddatz.familienarchiv.user.CreateUserRequest;
@@ -30,15 +26,13 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestController;
 
-import lombok.RequiredArgsConstructor;
+import lombok.AllArgsConstructor;
 
 @RestController
 @RequestMapping("/api/")
-@RequiredArgsConstructor
+@AllArgsConstructor
 public class UserController {
-    private final UserService userService;
-    private final AuthService authService;
-    private final AuditService auditService;
+    private UserService userService;
 
     @GetMapping("users/me")
     public ResponseEntity<AppUser> getCurrentUser(Authentication authentication) {
@@ -62,14 +56,9 @@ public class UserController {
     @PostMapping("users/me/password")
     @ResponseStatus(HttpStatus.NO_CONTENT)
     public void changePassword(Authentication authentication,
-                               HttpSession session,
                                @RequestBody ChangePasswordDTO dto) {
         AppUser current = userService.findByEmail(authentication.getName());
         userService.changePassword(current.getId(), dto);
-        int revoked = authService.revokeOtherSessions(session.getId(), authentication.getName());
-        auditService.log(AuditKind.LOGOUT, current.getId(), null, Map.of(
-                "reason", "password_change",
-                "revokedCount", revoked));
     }
 
     @GetMapping("users/{id}")
@@ -112,18 +101,6 @@ public class UserController {
         return ResponseEntity.ok().build();
     }
 
-    @PostMapping("/users/{id}/force-logout")
-    @RequirePermission(Permission.ADMIN_USER)
-    public ResponseEntity<Map<String, Object>> forceLogout(Authentication authentication,
-                                                            @PathVariable UUID id) {
-        AppUser target = userService.getById(id);
-        int revoked = authService.revokeAllSessions(target.getEmail());
-        auditService.log(AuditKind.ADMIN_FORCE_LOGOUT, actorId(authentication), null, Map.of(
-                "targetUserId", target.getId().toString(),
-                "revokedCount", revoked));
-        return ResponseEntity.ok(Map.of("revokedCount", revoked));
-    }
-
     private UUID actorId(Authentication auth) {
         return userService.findByEmail(auth.getName()).getId();
     }

backend/src/main/java/org/raddatz/familienarchiv/user/UserDataInitializer.java

@@ -20,7 +20,6 @@ import org.springframework.boot.CommandLineRunner;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
-import org.springframework.core.env.Environment;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import java.time.LocalDate;
@@ -32,51 +31,26 @@ import java.util.Set;
 @DependsOn("flyway")
 public class UserDataInitializer {
 
-    static final String DEFAULT_ADMIN_EMAIL = "admin@familienarchiv.local";
-    static final String DEFAULT_ADMIN_PASSWORD = "admin123";
-
-    @Value("${app.admin.email:" + DEFAULT_ADMIN_EMAIL + "}")
+    @Value("${app.admin.email:admin@familyarchive.local}")
     private String adminEmail;
 
-    @Value("${app.admin.password:" + DEFAULT_ADMIN_PASSWORD + "}")
+    @Value("${app.admin.password:admin123}")
     private String adminPassword;
 
     private final AppUserRepository userRepository;
     private final UserGroupRepository groupRepository;
-    private final Environment environment;
 
     @Bean
     public CommandLineRunner initAdminUser(PasswordEncoder passwordEncoder) {
         return args -> {
             if (userRepository.findByEmail(adminEmail).isEmpty()) {
-                // Fail-closed in production: refuse to seed with the well-known
-                // defaults. Otherwise an operator who forgets APP_ADMIN_USERNAME
-                // / APP_ADMIN_PASSWORD locks production to admin@…/admin123 PERMANENTLY
-                // (UserDataInitializer only seeds when the row is missing — see #513).
-                // Allowed in dev/test/e2e because those run without secrets configured.
-                boolean isLocalProfile = environment.matchesProfiles("dev", "test", "e2e");
-                if (!isLocalProfile
-                    && (DEFAULT_ADMIN_EMAIL.equals(adminEmail)
-                        || DEFAULT_ADMIN_PASSWORD.equals(adminPassword))) {
-                    throw new IllegalStateException(
-                        "Refusing to seed admin user with default credentials outside "
-                        + "the dev/test/e2e profiles. Set APP_ADMIN_USERNAME and "
-                        + "APP_ADMIN_PASSWORD to non-default values before first boot — "
-                        + "this lock-in is permanent."
-                    );
-                }
                 log.info("Kein Admin-User '{}' gefunden. Erstelle Default-Admin...", adminEmail);
 
-                // Reuse the Administrators group if it already exists (e.g. a
-                // previous boot seeded the group but failed before creating
-                // the admin user, or the operator deleted just the user row
-                // to retry the seed with a new email). Blind-INSERTing would
-                // violate user_groups_name_key and abort the context. See #518.
-                UserGroup adminGroup = groupRepository.findByName("Administrators")
-                        .orElseGet(() -> groupRepository.save(UserGroup.builder()
-                                .name("Administrators")
-                                .permissions(Set.of("ADMIN", "READ_ALL", "WRITE_ALL", "ANNOTATE_ALL", "ADMIN_USER", "ADMIN_TAG", "ADMIN_PERMISSION"))
-                                .build()));
+                UserGroup adminGroup = UserGroup.builder()
+                        .name("Administrators")
+                        .permissions(Set.of("ADMIN", "READ_ALL", "WRITE_ALL", "ANNOTATE_ALL", "ADMIN_USER", "ADMIN_TAG", "ADMIN_PERMISSION"))
+                        .build();
+                groupRepository.save(adminGroup);
 
                 AppUser admin = AppUser.builder()
                         .email(adminEmail)

backend/src/main/java/org/raddatz/familienarchiv/user/UserService.java

@@ -37,9 +37,6 @@ public class UserService {
 
     private final AppUserRepository userRepository;
     private final UserGroupRepository groupRepository;
-    // Injected directly (not via InviteService) to avoid a constructor injection cycle:
-    // InviteService → UserService → InviteService. Spring Framework 7 forbids such cycles.
-    private final InviteTokenRepository inviteTokenRepository;
     private final PasswordEncoder passwordEncoder;
     private final AuditService auditService;
 
@@ -274,10 +271,9 @@ public class UserService {
 
     @Transactional
     public UserGroup createGroup(GroupDTO dto) {
-        UserGroup group = UserGroup.builder()
-                .name(dto.getName())
-                .permissions(dto.getPermissions() != null ? dto.getPermissions() : new HashSet<>())
-                .build();
+        UserGroup group = new UserGroup();
+        group.setName(dto.getName());
+        group.setPermissions(dto.getPermissions());
         return groupRepository.save(group);
     }
 
@@ -291,10 +287,6 @@ public class UserService {
 
     @Transactional
     public void deleteGroup(UUID id) {
-        if (inviteTokenRepository.existsActiveWithGroupId(id)) {
-            throw DomainException.conflict(ErrorCode.GROUP_HAS_ACTIVE_INVITES,
-                    "Cannot delete group " + id + " — referenced by one or more active invites");
-        }
         groupRepository.deleteById(id);
     }
 }

backend/src/main/resources/application-dev.yaml

@@ -1,9 +1,6 @@
 spring:
   jpa:
     show-sql: true
-  # spring.session.cookie.secure is no longer a supported Boot 4.x property.
-  # DefaultCookieSerializer auto-detects Secure from request.isSecure().
-  # Direct HTTP in dev → isSecure()=false → cookie sent without Secure attribute.
 
 springdoc:
   api-docs:

backend/src/main/resources/application.yaml

@@ -38,64 +38,10 @@ spring:
           starttls:
             enable: true
 
-  session:
-    timeout: 28800s  # 8 h idle timeout (MaxInactiveIntervalInSeconds)
-    jdbc:
-      initialize-schema: never  # Flyway owns schema creation (V67)
-    # Cookie name, SameSite, and Secure are configured via SpringSessionConfig#cookieSerializer
-    # (spring.session.cookie.* is not supported in Spring Boot 4.x).
-
-server:
-  # Behind Caddy/reverse proxy: trust X-Forwarded-{Proto,For,Host} so that
-  # request.getScheme(), redirect URLs, and Spring Session "Secure" cookies
-  # reflect the original https client request, not the http hop from Caddy.
-  forward-headers-strategy: native
-
 management:
-  server:
-    # Management port is separate from the app port so that:
-    # (a) Caddy never proxies /actuator/* (it only routes :8080 → the app port)
-    # (b) Prometheus scrapes backend:8081 directly inside archiv-net, not via Caddy
-    # Note: in Spring Boot 4.0 the management port shares the security filter chain; /actuator/health
-    # and /actuator/prometheus must be explicitly permitted in SecurityConfig — see SecurityConfig.java.
-    port: 8081
-  endpoints:
-    web:
-      exposure:
-        include: health,info,prometheus,metrics
-  endpoint:
-    prometheus:
-      enabled: true
-  # Spring Boot 4.0: metrics export is disabled by default — explicitly opt in for Prometheus
-  prometheus:
-    metrics:
-      export:
-        enabled: true
-  metrics:
-    tags:
-      # Common tag applied to every metric so Grafana's Spring Boot dashboard can filter by application name.
-      # Override via MANAGEMENT_METRICS_TAGS_APPLICATION env var.
-      application: ${spring.application.name}
   health:
     mail:
       enabled: false
-  tracing:
-    sampling:
-      probability: 1.0   # 100% in dev; override via MANAGEMENT_TRACING_SAMPLING_PROBABILITY in prod compose
-
-# OpenTelemetry trace export — failures are non-fatal (app starts cleanly without Tempo running)
-# Port 4318 = OTLP HTTP (the default transport for Spring Boot's HttpExporter).
-# Port 4317 is gRPC-only; sending HTTP/1.1 to it produces "Connection reset".
-otel:
-  service:
-    name: familienarchiv-backend
-  exporter:
-    otlp:
-      endpoint: ${OTEL_EXPORTER_OTLP_ENDPOINT:http://localhost:4318}
-  logs:
-    exporter: none   # Promtail captures Docker logs; disable OTLP log export (Tempo only accepts traces)
-  metrics:
-    exporter: none   # Prometheus scrapes /actuator/prometheus; disable OTLP metric export to Tempo
 
 springdoc:
   api-docs:
@@ -117,11 +63,7 @@ app:
     from: ${APP_MAIL_FROM:noreply@familienarchiv.local}
 
   admin:
-    # Key must be `email`, not `username` — UserDataInitializer reads
-    # `${app.admin.email:...}`. The env-var name stays APP_ADMIN_USERNAME
-    # to match the existing Gitea secrets and DEPLOYMENT.md §3.3.
-    # See #513.
-    email: ${APP_ADMIN_USERNAME:admin@familienarchiv.local}
+    username: ${APP_ADMIN_USERNAME:admin}
     password: ${APP_ADMIN_PASSWORD:admin123}
 
   import:
@@ -141,18 +83,3 @@ ocr:
   sender-model:
     activation-threshold: 100
     retrain-delta: 50
-
-sentry:
-  dsn: ${SENTRY_DSN:}
-  environment: ${SPRING_PROFILES_ACTIVE:dev}
-  traces-sample-rate: ${SENTRY_TRACES_SAMPLE_RATE:1.0}
-  send-default-pii: false
-  enable-tracing: true
-  ignored-exceptions-for-type:
-    - org.raddatz.familienarchiv.exception.DomainException
-
-rate-limit:
-  login:
-    max-attempts-per-ip-email: 10
-    max-attempts-per-ip: 20
-    window-minutes: 15

backend/src/main/resources/db/migration/V62__index_fk_columns.sql

@@ -1,8 +0,0 @@
--- Speeds up "documents by sender" queries used on /persons/[id] Korrespondenz-Überblick (#306),
--- /briefwechsel, and bulk-edit flows.
-CREATE INDEX IF NOT EXISTS idx_documents_sender_id
-    ON documents(sender_id);
-
--- Speeds up "comments by author" queries on admin user detail and (future) contributor profile.
-CREATE INDEX IF NOT EXISTS idx_comments_author_id
-    ON document_comments(author_id);

backend/src/main/resources/db/migration/V63__deduplicate_group_permissions.sql

@@ -1,7 +0,0 @@
--- Remove duplicate (group_id, permission) rows that accumulated without a UNIQUE constraint.
--- Keeps the row with the smallest ctid (earliest physical insertion order).
-DELETE FROM group_permissions a
-USING group_permissions b
-WHERE a.ctid < b.ctid
-  AND a.group_id = b.group_id
-  AND a.permission = b.permission;

backend/src/main/resources/db/migration/V64__group_permissions_primary_key.sql

@@ -1,11 +0,0 @@
--- Add NOT NULL and PRIMARY KEY to group_permissions.
--- Requires V63 to have run first (no duplicates can remain).
---
--- After this migration, future seed migrations can use:
---   INSERT INTO group_permissions ... ON CONFLICT DO NOTHING
--- instead of the INSERT ... WHERE NOT EXISTS pattern used before V64.
-ALTER TABLE group_permissions
-    ALTER COLUMN permission SET NOT NULL;
-
-ALTER TABLE group_permissions
-    ADD CONSTRAINT pk_group_permissions PRIMARY KEY (group_id, permission);

backend/src/main/resources/db/migration/V65__tbmp_promote_unique_to_pk.sql

@@ -1,8 +0,0 @@
--- Promote the de-facto unique constraint on transcription_block_mentioned_persons to a named PK.
--- uq_tbmp_block_person (added in V57) is backed by a B-tree index identical to a PK;
--- this rename makes the naming convention explicit (pk_* vs uq_*).
-ALTER TABLE transcription_block_mentioned_persons
-    DROP CONSTRAINT uq_tbmp_block_person;
-
-ALTER TABLE transcription_block_mentioned_persons
-    ADD CONSTRAINT pk_tbmp PRIMARY KEY (block_id, person_id);

backend/src/main/resources/db/migration/V66__add_invite_token_group_id_index.sql

@@ -1,3 +0,0 @@
--- The composite PK (invite_token_id, group_id) does not support efficient lookups by group_id alone.
--- Add a dedicated index to support existsActiveWithGroupId queries.
-CREATE INDEX idx_itg_group_id ON invite_token_group_ids (group_id);

backend/src/main/resources/db/migration/V67__recreate_spring_session_tables.sql

@@ -1,27 +0,0 @@
--- Re-introduces the Spring Session JDBC tables that were dropped by V2 as unused.
--- DDL copied verbatim from Spring Session 3.x schema-postgresql.sql.
--- See ADR-020 and issue #523.
-
-CREATE TABLE spring_session (
-    PRIMARY_ID            CHAR(36) NOT NULL,
-    SESSION_ID            CHAR(36) NOT NULL,
-    CREATION_TIME         BIGINT   NOT NULL,
-    LAST_ACCESS_TIME      BIGINT   NOT NULL,
-    MAX_INACTIVE_INTERVAL INT      NOT NULL,
-    EXPIRY_TIME           BIGINT   NOT NULL,
-    PRINCIPAL_NAME        VARCHAR(100),
-    CONSTRAINT spring_session_pk PRIMARY KEY (PRIMARY_ID)
-);
-
-CREATE UNIQUE INDEX spring_session_ix1 ON spring_session (SESSION_ID);
-CREATE INDEX        spring_session_ix2 ON spring_session (EXPIRY_TIME);
-CREATE INDEX        spring_session_ix3 ON spring_session (PRINCIPAL_NAME);
-
-CREATE TABLE spring_session_attributes (
-    SESSION_PRIMARY_ID CHAR(36)     NOT NULL,
-    ATTRIBUTE_NAME     VARCHAR(200) NOT NULL,
-    ATTRIBUTE_BYTES    BYTEA        NOT NULL,
-    CONSTRAINT spring_session_attributes_pk PRIMARY KEY (SESSION_PRIMARY_ID, ATTRIBUTE_NAME),
-    CONSTRAINT spring_session_attributes_fk FOREIGN KEY (SESSION_PRIMARY_ID)
-        REFERENCES spring_session (PRIMARY_ID) ON DELETE CASCADE
-);

backend/src/test/java/org/raddatz/familienarchiv/ActuatorPrometheusIT.java

@@ -1,63 +0,0 @@
-package org.raddatz.familienarchiv;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalManagementPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.ResponseEntity;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class ActuatorPrometheusIT {
-
-    @LocalManagementPort
-    private int managementPort;
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Test
-    void prometheus_endpoint_returns_200_without_credentials() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void prometheus_endpoint_returns_jvm_metrics() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
-
-        assertThat(response.getBody()).contains("jvm_memory_used_bytes");
-    }
-
-    @Test
-    void actuator_metrics_requires_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/metrics", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(401);
-    }
-
-    private RestTemplate noThrowTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(org.springframework.http.client.ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/ActuatorSecurityTest.java

@@ -1,55 +0,0 @@
-package org.raddatz.familienarchiv;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalManagementPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.ResponseEntity;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class ActuatorSecurityTest {
-
-    @LocalManagementPort
-    private int managementPort;
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Test
-    void actuator_health_is_accessible_without_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/health", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void actuator_env_requires_authentication() {
-        ResponseEntity<String> response = noThrowTemplate().getForEntity(
-                "http://localhost:" + managementPort + "/actuator/env", String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(401);
-    }
-
-    private RestTemplate noThrowTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(org.springframework.http.client.ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/ApplicationContextTest.java

@@ -1,18 +1,14 @@
 package org.raddatz.familienarchiv;
 
 import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
-import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Import;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.testcontainers.containers.PostgreSQLContainer;
 import software.amazon.awssdk.services.s3.S3Client;
 
-import static org.assertj.core.api.Assertions.assertThat;
-
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
@@ -21,18 +17,9 @@ class ApplicationContextTest {
     @MockitoBean
     S3Client s3Client;
 
-    @Autowired
-    ApplicationContext ctx;
-
     @Test
     void contextLoads() {
         // verifies that the Spring context starts successfully with all beans wired,
         // Flyway migrations applied, and no configuration errors
     }
-
-    @Test
-    void sentry_is_disabled_when_no_dsn_is_configured() {
-        // application-test.yaml has no sentry.dsn — SDK must stay inactive so tests are clean
-        assertThat(io.sentry.Sentry.isEnabled()).isFalse();
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/MigrationIntegrationTest.java

@@ -399,86 +399,6 @@ class MigrationIntegrationTest {
               AND dc.annotation_id IS NOT NULL
             """;
 
-    // ─── V62: indexes on FK columns ──────────────────────────────────────────
-
-    @Test
-    void v62_idx_documents_sender_id_exists() {
-        Integer count = jdbc.queryForObject(
-                "SELECT COUNT(*) FROM pg_catalog.pg_indexes WHERE tablename = 'documents' AND indexname = 'idx_documents_sender_id'",
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    void v62_idx_comments_author_id_exists() {
-        Integer count = jdbc.queryForObject(
-                "SELECT COUNT(*) FROM pg_catalog.pg_indexes WHERE tablename = 'document_comments' AND indexname = 'idx_comments_author_id'",
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    // ─── V63+V64: group_permissions dedup + primary key ──────────────────────
-
-    @Test
-    void v64_pk_group_permissions_exists() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM pg_catalog.pg_constraint c
-                JOIN pg_catalog.pg_class t ON c.conrelid = t.oid
-                WHERE t.relname = 'group_permissions'
-                  AND c.conname = 'pk_group_permissions'
-                  AND c.contype = 'p'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    void v64_permission_column_isNotNullable() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM information_schema.columns
-                WHERE table_schema = 'public'
-                  AND table_name = 'group_permissions'
-                  AND column_name = 'permission'
-                  AND is_nullable = 'NO'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
-    @Test
-    @Transactional(propagation = Propagation.NOT_SUPPORTED)
-    void v64_rejectsDuplicateGroupPermission() {
-        UUID groupId = createUserGroup("DuplicateTestGroup-" + UUID.randomUUID());
-        try {
-            jdbc.update("INSERT INTO group_permissions (group_id, permission) VALUES (?, 'READ_ALL')", groupId);
-
-            assertThatThrownBy(() ->
-                    jdbc.update("INSERT INTO group_permissions (group_id, permission) VALUES (?, 'READ_ALL')", groupId)
-            ).isInstanceOf(DataIntegrityViolationException.class);
-        } finally {
-            jdbc.update("DELETE FROM group_permissions WHERE group_id = ?", groupId);
-            jdbc.update("DELETE FROM user_groups WHERE id = ?", groupId);
-        }
-    }
-
-    // ─── V65: tbmp UNIQUE promoted to PRIMARY KEY ─────────────────────────────
-
-    @Test
-    void v65_pk_tbmp_exists() {
-        Integer count = jdbc.queryForObject(
-                """
-                SELECT COUNT(*) FROM pg_catalog.pg_constraint c
-                JOIN pg_catalog.pg_class t ON c.conrelid = t.oid
-                WHERE t.relname = 'transcription_block_mentioned_persons'
-                  AND c.conname = 'pk_tbmp'
-                  AND c.contype = 'p'
-                """,
-                Integer.class);
-        assertThat(count).isEqualTo(1);
-    }
-
     // ─── helpers ─────────────────────────────────────────────────────────────
 
     private UUID createPerson(String firstName, String lastName) {
@@ -562,10 +482,4 @@ class MigrationIntegrationTest {
                 """, id, recipientId, docId, commentId);
         return id;
     }
-
-    private UUID createUserGroup(String name) {
-        UUID id = UUID.randomUUID();
-        jdbc.update("INSERT INTO user_groups (id, name) VALUES (?, ?)", id, name);
-        return id;
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/audit/AuditServiceIntegrationTest.java

@@ -1,11 +1,11 @@
 package org.raddatz.familienarchiv.audit;
 
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.raddatz.familienarchiv.PostgresContainerConfig;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.transaction.support.TransactionTemplate;
@@ -18,6 +18,7 @@ import static org.awaitility.Awaitility.await;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class AuditServiceIntegrationTest {
 
     @MockitoBean S3Client s3Client;
@@ -25,11 +26,6 @@ class AuditServiceIntegrationTest {
     @Autowired AuditLogRepository auditLogRepository;
     @Autowired TransactionTemplate transactionTemplate;
 
-    @BeforeEach
-    void resetAuditLog() {
-        auditLogRepository.deleteAll();
-    }
-
     @Test
     void logAfterCommit_writes_ANNOTATION_CREATED_row_after_transaction_commits() {
         transactionTemplate.execute(status -> {

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthServiceTest.java

@@ -1,191 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.raddatz.familienarchiv.audit.AuditKind;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.UserService;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.*;
-import static org.mockito.Mockito.*;
-
-@ExtendWith(MockitoExtension.class)
-class AuthServiceTest {
-
-    @Mock AuthenticationManager authenticationManager;
-    @Mock UserService userService;
-    @Mock AuditService auditService;
-    @Mock LoginRateLimiter loginRateLimiter;
-    @Mock SessionRevocationPort sessionRevocationPort;
-    @InjectMocks AuthService authService;
-
-    private static final String IP = "127.0.0.1";
-    private static final String UA = "Mozilla/5.0 (Test)";
-
-    @Test
-    void login_returns_user_on_valid_credentials() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        AuthService.LoginResult result = authService.login("user@test.de", "pass123", IP, UA);
-
-        assertThat(result.user()).isEqualTo(user);
-        assertThat(result.authentication()).isEqualTo(auth);
-    }
-
-    @Test
-    void login_fires_LOGIN_SUCCESS_audit_on_valid_credentials() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.login("user@test.de", "pass123", IP, UA);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGIN_SUCCESS),
-            eq(userId),
-            isNull(),
-            argThat(payload -> userId.toString().equals(payload.get("userId").toString())
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password"))
-        );
-    }
-
-    @Test
-    void login_throws_INVALID_CREDENTIALS_on_bad_password() {
-        when(authenticationManager.authenticate(any())).thenThrow(new BadCredentialsException("bad"));
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "wrong", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.INVALID_CREDENTIALS));
-    }
-
-    @Test
-    void login_fires_LOGIN_FAILED_audit_on_bad_credentials_without_password_in_payload() {
-        when(authenticationManager.authenticate(any())).thenThrow(new BadCredentialsException("bad"));
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "wrong", IP, UA))
-            .isInstanceOf(DomainException.class);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGIN_FAILED),
-            isNull(),
-            isNull(),
-            argThat(payload -> "user@test.de".equals(payload.get("email"))
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password")
-                && !payload.containsKey("pwd")
-                && !payload.containsKey("passwordAttempt"))
-        );
-    }
-
-    @Test
-    void login_treats_unknown_user_identically_to_bad_password() {
-        when(authenticationManager.authenticate(any()))
-            .thenThrow(new BadCredentialsException("unknown user hidden as bad creds"));
-
-        assertThatThrownBy(() -> authService.login("unknown@test.de", "any", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.INVALID_CREDENTIALS));
-
-        verify(auditService).log(eq(AuditKind.LOGIN_FAILED), isNull(), isNull(), anyMap());
-    }
-
-    @Test
-    void logout_fires_LOGOUT_audit() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.logout("user@test.de", IP, UA);
-
-        verify(auditService).log(
-            eq(AuditKind.LOGOUT),
-            eq(userId),
-            isNull(),
-            argThat(payload -> userId.toString().equals(payload.get("userId").toString())
-                && IP.equals(payload.get("ip"))
-                && !payload.containsKey("password"))
-        );
-    }
-
-    @Test
-    void login_checks_rate_limit_before_authenticating() {
-        doThrow(DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS, "rate limited"))
-            .when(loginRateLimiter).checkAndConsume(IP, "user@test.de");
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "pass", IP, UA))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-
-        verify(authenticationManager, never()).authenticate(any());
-    }
-
-    @Test
-    void login_fires_LOGIN_RATE_LIMITED_audit_when_rate_limited() {
-        doThrow(DomainException.tooManyRequests(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS, "rate limited"))
-            .when(loginRateLimiter).checkAndConsume(IP, "user@test.de");
-
-        assertThatThrownBy(() -> authService.login("user@test.de", "pass", IP, UA))
-            .isInstanceOf(DomainException.class);
-
-        verify(auditService).log(eq(AuditKind.LOGIN_RATE_LIMITED), isNull(), isNull(),
-            argThat(payload -> IP.equals(payload.get("ip")) && "user@test.de".equals(payload.get("email"))));
-    }
-
-    @Test
-    void login_invalidates_rate_limit_on_success() {
-        UUID userId = UUID.randomUUID();
-        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = new UsernamePasswordAuthenticationToken("user@test.de", null, Set.of());
-        when(authenticationManager.authenticate(any())).thenReturn(auth);
-        when(userService.findByEmail("user@test.de")).thenReturn(user);
-
-        authService.login("user@test.de", "pass123", IP, UA);
-
-        verify(loginRateLimiter).invalidateOnSuccess(IP, "user@test.de");
-    }
-
-    @Test
-    void revokeOtherSessions_delegates_to_port() {
-        when(sessionRevocationPort.revokeOtherSessions("session-keep", "user@test.de")).thenReturn(2);
-
-        int count = authService.revokeOtherSessions("session-keep", "user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRevocationPort).revokeOtherSessions("session-keep", "user@test.de");
-    }
-
-    @Test
-    void revokeAllSessions_delegates_to_port() {
-        when(sessionRevocationPort.revokeAllSessions("user@test.de")).thenReturn(3);
-
-        int count = authService.revokeAllSessions("user@test.de");
-
-        assertThat(count).isEqualTo(3);
-        verify(sessionRevocationPort).revokeAllSessions("user@test.de");
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthSessionControllerTest.java

@@ -1,191 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.auth.AuthService.LoginResult;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-import org.raddatz.familienarchiv.security.SecurityConfig;
-import org.raddatz.familienarchiv.security.PermissionAspect;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.CustomUserDetailsService;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.aop.AopAutoConfiguration;
-import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.MediaType;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.test.web.servlet.MockMvc;
-
-import java.util.UUID;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-
-@WebMvcTest(AuthSessionController.class)
-@Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
-class AuthSessionControllerTest {
-
-    @Autowired MockMvc mockMvc;
-
-    @MockitoBean AuthService authService;
-    @MockitoBean CustomUserDetailsService customUserDetailsService;
-    @MockitoBean SessionAuthenticationStrategy sessionAuthenticationStrategy;
-
-    // ─── POST /api/auth/login ──────────────────────────────────────────────────
-
-    @Test
-    void login_returns_200_with_user_on_valid_credentials() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("user@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"pass123\"}"))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.email").value("user@test.de"))
-            .andExpect(jsonPath("$.id").value(userId.toString()));
-    }
-
-    @Test
-    void login_returns_401_with_INVALID_CREDENTIALS_on_bad_credentials() throws Exception {
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenThrow(DomainException.invalidCredentials());
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
-            .andExpect(status().isUnauthorized())
-            .andExpect(jsonPath("$.code").value(ErrorCode.INVALID_CREDENTIALS.name()));
-    }
-
-    @Test
-    void login_is_public_no_session_required() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("pub@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        // No WithMockUser — must be reachable without an active session
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"pub@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk());
-    }
-
-    @Test
-    void login_delegates_to_SessionAuthenticationStrategy_for_fixation_protection() throws Exception {
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder().id(userId).email("fix@test.de").build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"fix@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk());
-
-        // Session-fixation defense (CWE-384): the controller must hand the new
-        // Authentication to Spring Security's strategy, which rotates the session ID.
-        verify(sessionAuthenticationStrategy).onAuthentication(eq(auth), any(), any());
-    }
-
-    @Test
-    void login_response_body_does_not_contain_password_field() throws Exception {
-        // Regression guard: AppUser.password is @JsonProperty(WRITE_ONLY). If anyone
-        // ever drops that annotation, this assertion catches the credential leak on
-        // the very next CI run.
-        UUID userId = UUID.randomUUID();
-        AppUser appUser = AppUser.builder()
-            .id(userId)
-            .email("leak@test.de")
-            .password("$2a$10$shouldnotappearinresponse")
-            .build();
-        Authentication auth = mock(Authentication.class);
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenReturn(new LoginResult(appUser, auth));
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"leak@test.de\",\"password\":\"pass\"}"))
-            .andExpect(status().isOk())
-            .andExpect(jsonPath("$.password").doesNotExist())
-            .andExpect(jsonPath("$.pwd").doesNotExist())
-            .andExpect(content().string(org.hamcrest.Matchers.not(
-                org.hamcrest.Matchers.containsString("$2a$10$shouldnotappearinresponse"))));
-    }
-
-    @Test
-    void login_does_not_set_cookie_on_failure() throws Exception {
-        when(authService.login(anyString(), anyString(), anyString(), anyString()))
-            .thenThrow(DomainException.invalidCredentials());
-
-        mockMvc.perform(post("/api/auth/login")
-                .with(csrf())
-                .contentType(MediaType.APPLICATION_JSON)
-                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
-            .andExpect(status().isUnauthorized())
-            .andExpect(header().doesNotExist("Set-Cookie"));
-    }
-
-    // ─── CSRF protection ──────────────────────────────────────────────────────
-
-    @Test
-    void authenticated_post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        // Red test: CSRF disabled → returns 204; after re-enabling returns 403.
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("user@test.de")))   // authenticated but no CSRF token
-            .andExpect(status().isForbidden())
-            .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
-
-    // ─── POST /api/auth/logout ─────────────────────────────────────────────────
-
-    @Test
-    void logout_returns_204_when_authenticated() throws Exception {
-        doNothing().when(authService).logout(anyString(), anyString(), anyString());
-
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("user@test.de"))
-                .with(csrf()))
-            .andExpect(status().isNoContent());
-    }
-
-    @Test
-    void logout_without_session_returns_403() throws Exception {
-        // CsrfFilter runs before AnonymousAuthenticationFilter. When authentication is null,
-        // ExceptionTranslationFilter routes CSRF AccessDeniedException to accessDeniedHandler → 403.
-        mockMvc.perform(post("/api/auth/logout"))
-            .andExpect(status().isForbidden())
-            .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
-
-    @Test
-    void logout_returns_204_even_when_audit_throws() throws Exception {
-        // CWE-613 defense: the session MUST be invalidated even if the audit lookup
-        // explodes (e.g. user deleted between login and logout). Audit is best-effort.
-        doThrow(new RuntimeException("audit DB down"))
-            .when(authService).logout(anyString(), anyString(), anyString());
-
-        mockMvc.perform(post("/api/auth/logout")
-                .with(user("ghost@test.de"))
-                .with(csrf()))
-            .andExpect(status().isNoContent());
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthSessionIntegrationTest.java

@@ -1,192 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.user.AppUser;
-import org.raddatz.familienarchiv.user.AppUserRepository;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.web.server.LocalServerPort;
-import org.springframework.context.annotation.Import;
-import org.springframework.http.HttpEntity;
-import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpMethod;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.http.client.ClientHttpResponse;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.web.client.DefaultResponseErrorHandler;
-import org.springframework.web.client.RestTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.io.IOException;
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class AuthSessionIntegrationTest {
-
-    @LocalServerPort int port;
-    @MockitoBean S3Client s3Client;
-    @Autowired AppUserRepository userRepository;
-    @Autowired PasswordEncoder passwordEncoder;
-    @Autowired JdbcTemplate jdbcTemplate;
-
-    private RestTemplate http;
-    private String baseUrl;
-
-    private static final String TEST_EMAIL = "session-it@test.de";
-    private static final String TEST_PASSWORD = "pass4Session!";
-
-    @BeforeEach
-    void setUp() {
-        http = noThrowRestTemplate();
-        baseUrl = "http://localhost:" + port;
-        // spring_session_attributes cascades on delete — removing the parent row is enough
-        jdbcTemplate.update("DELETE FROM spring_session");
-        jdbcTemplate.update("DELETE FROM app_users WHERE email = ?", TEST_EMAIL);
-        userRepository.save(AppUser.builder()
-                .email(TEST_EMAIL)
-                .password(passwordEncoder.encode(TEST_PASSWORD))
-                .build());
-    }
-
-    // ─── Task 13: full session lifecycle ──────────────────────────────────────
-
-    @Test
-    void login_sets_opaque_fa_session_cookie() {
-        String xsrf = fetchXsrfToken();
-        ResponseEntity<String> response = doLogin(xsrf);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(200);
-        String cookie = extractFaSessionCookie(response);
-        assertThat(cookie).isNotBlank();
-        // Opaque token — must not look like Basic-auth credentials (email:password)
-        assertThat(cookie).doesNotContain(":");
-    }
-
-    @Test
-    void session_cookie_authenticates_subsequent_request() {
-        String xsrf = fetchXsrfToken();
-        String cookie = extractFaSessionCookie(doLogin(xsrf));
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(cookie)), String.class);
-
-        assertThat(me.getStatusCode().value()).isEqualTo(200);
-    }
-
-    @Test
-    void logout_invalidates_session_and_cookie_returns_401_on_reuse() {
-        String xsrf = fetchXsrfToken();
-        String sessionCookie = extractFaSessionCookie(doLogin(xsrf));
-
-        ResponseEntity<Void> logout = http.postForEntity(
-                baseUrl + "/api/auth/logout",
-                new HttpEntity<>(csrfAndSessionHeaders(sessionCookie, xsrf)), Void.class);
-        assertThat(logout.getStatusCode().value()).isEqualTo(204);
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(sessionCookie)), String.class);
-        assertThat(me.getStatusCode().value()).isEqualTo(401);
-    }
-
-    // ─── Task 14: idle-timeout ────────────────────────────────────────────────
-
-    @Test
-    void session_expired_by_idle_timeout_returns_401() {
-        String xsrf = fetchXsrfToken();
-        String cookie = extractFaSessionCookie(doLogin(xsrf));
-
-        // Backdate LAST_ACCESS_TIME by 9 hours so lastAccess + maxInactiveInterval(8h) < now
-        long nineHoursAgoMs = System.currentTimeMillis() - 9L * 3600 * 1000;
-        jdbcTemplate.update(
-                "UPDATE spring_session SET LAST_ACCESS_TIME = ?, EXPIRY_TIME = ?",
-                nineHoursAgoMs, nineHoursAgoMs);
-
-        ResponseEntity<String> me = http.exchange(
-                baseUrl + "/api/users/me", HttpMethod.GET,
-                new HttpEntity<>(cookieHeaders(cookie)), String.class);
-        assertThat(me.getStatusCode().value()).isEqualTo(401);
-    }
-
-    // ─── Task: CSRF rejection at integration layer ────────────────────────────
-
-    @Test
-    void post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() {
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_JSON);
-        // Deliberately omit XSRF-TOKEN cookie and X-XSRF-TOKEN header
-        ResponseEntity<String> response = http.postForEntity(
-                baseUrl + "/api/auth/logout",
-                new HttpEntity<>("{}", headers), String.class);
-
-        assertThat(response.getStatusCode().value()).isEqualTo(403);
-        assertThat(response.getBody()).contains("CSRF_TOKEN_MISSING");
-    }
-
-    // ─── helpers ─────────────────────────────────────────────────────────────
-
-    /**
-     * Generates an XSRF token for use in integration tests.
-     * CookieCsrfTokenRepository validates that Cookie: XSRF-TOKEN=X matches X-XSRF-TOKEN: X.
-     * By supplying both with the same value we simulate exactly what a browser does.
-     */
-    private String fetchXsrfToken() {
-        return java.util.UUID.randomUUID().toString();
-    }
-
-    private ResponseEntity<String> doLogin(String xsrfToken) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.setContentType(MediaType.APPLICATION_JSON);
-        headers.set("Cookie", "XSRF-TOKEN=" + xsrfToken);
-        headers.set("X-XSRF-TOKEN", xsrfToken);
-        String body = "{\"email\":\"" + TEST_EMAIL + "\",\"password\":\"" + TEST_PASSWORD + "\"}";
-        return http.postForEntity(baseUrl + "/api/auth/login",
-                new HttpEntity<>(body, headers), String.class);
-    }
-
-    private HttpHeaders cookieHeaders(String sessionId) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.set("Cookie", "fa_session=" + sessionId);
-        return headers;
-    }
-
-    private HttpHeaders csrfAndSessionHeaders(String sessionId, String xsrfToken) {
-        HttpHeaders headers = new HttpHeaders();
-        headers.set("Cookie", "fa_session=" + sessionId + "; XSRF-TOKEN=" + xsrfToken);
-        headers.set("X-XSRF-TOKEN", xsrfToken);
-        return headers;
-    }
-
-    private String extractFaSessionCookie(ResponseEntity<?> response) {
-        List<String> setCookieHeader = response.getHeaders().get("Set-Cookie");
-        if (setCookieHeader == null) return "";
-        return setCookieHeader.stream()
-                .filter(c -> c.startsWith("fa_session="))
-                .map(c -> c.split(";")[0].substring("fa_session=".length()))
-                .findFirst()
-                .orElse("");
-    }
-
-
-    private RestTemplate noThrowRestTemplate() {
-        RestTemplate template = new RestTemplate();
-        template.setErrorHandler(new DefaultResponseErrorHandler() {
-            @Override
-            public boolean hasError(ClientHttpResponse response) throws IOException {
-                return false;
-            }
-        });
-        return template;
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapterIntegrationTest.java

@@ -1,136 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.support.TransactionTemplate;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.time.Instant;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Integration test for {@link JdbcSessionRevocationAdapter} that verifies
- * session rows are actually written to / removed from the {@code spring_session}
- * table backed by a real PostgreSQL container.
- *
- * <p>Sessions are inserted via raw JDBC to avoid the module-access restriction on
- * {@code JdbcIndexedSessionRepository.JdbcSession}. The {@link SessionRevocationPort}
- * bean injected here is the real {@link JdbcSessionRevocationAdapter} wired by Spring.
- */
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class JdbcSessionRevocationAdapterIntegrationTest {
-
-    @MockitoBean S3Client s3Client;
-
-    @Autowired SessionRevocationPort adapter;
-    @Autowired JdbcTemplate jdbcTemplate;
-    @Autowired TransactionTemplate transactionTemplate;
-
-    private static final String PRINCIPAL = "revocation-it@test.de";
-
-    @BeforeEach
-    void clearSessions() {
-        // spring_session_attributes cascades on delete
-        transactionTemplate.execute(status -> {
-            jdbcTemplate.update("DELETE FROM spring_session");
-            return null;
-        });
-    }
-
-    // ── helper ─────────────────────────────────────────────────────────────────
-
-    /**
-     * Inserts a minimal {@code spring_session} row attributed to {@value #PRINCIPAL}
-     * and returns its opaque primary-key ID (the value the repository uses as the
-     * session identifier, not the {@code SESSION_ID} column which holds the public token).
-     *
-     * <p>Column layout mirrors the Flyway-managed schema shipped with the app:
-     * PRIMARY_ID, SESSION_ID, CREATION_TIME, LAST_ACCESS_TIME, MAX_INACTIVE_INTERVAL,
-     * EXPIRY_TIME, PRINCIPAL_NAME.
-     */
-    /**
-     * Inserts a persisted session row for {@value #PRINCIPAL} and returns the
-     * {@code SESSION_ID} column value — this is the opaque identifier that
-     * {@link JdbcIndexedSessionRepository} uses as the session's public key
-     * (returned by {@code JdbcSession.getId()} and expected by
-     * {@link JdbcIndexedSessionRepository#deleteById}).
-     *
-     * <p>The inserts run inside a {@link TransactionTemplate} so the rows are
-     * committed before {@code findByPrincipalName} opens its own transaction and
-     * can see the data via Read Committed isolation.
-     */
-    private String insertSession() {
-        String primaryId = UUID.randomUUID().toString();
-        // SESSION_ID is the value used by JdbcSession.getId() and findByPrincipalName map keys.
-        String sessionId  = UUID.randomUUID().toString();
-        long   now        = Instant.now().toEpochMilli();
-        long   expiry     = now + 8L * 3600 * 1000; // 8-hour TTL
-        transactionTemplate.execute(status -> {
-            jdbcTemplate.update("""
-                    INSERT INTO spring_session
-                        (PRIMARY_ID, SESSION_ID, CREATION_TIME, LAST_ACCESS_TIME,
-                         MAX_INACTIVE_INTERVAL, EXPIRY_TIME, PRINCIPAL_NAME)
-                    VALUES (?, ?, ?, ?, ?, ?, ?)
-                    """,
-                    primaryId, sessionId, now, now, 28800, expiry, PRINCIPAL);
-            // Spring Session's listSessionsByPrincipalName query joins spring_session_attributes;
-            // insert a minimal attribute row so the session appears in the result set.
-            jdbcTemplate.update("""
-                    INSERT INTO spring_session_attributes
-                        (SESSION_PRIMARY_ID, ATTRIBUTE_NAME, ATTRIBUTE_BYTES)
-                    VALUES (?, ?, ?)
-                    """,
-                    primaryId, "test_attr", new byte[]{0});
-            return null;
-        });
-        return sessionId;  // the public key used by JdbcSession.getId() and deleteById()
-    }
-
-    // ── tests ──────────────────────────────────────────────────────────────────
-
-    @Test
-    void revokeAllSessions_removes_every_row_from_spring_session_table() {
-        insertSession();
-        insertSession();
-
-        int count = adapter.revokeAllSessions(PRINCIPAL);
-
-        assertThat(count).isEqualTo(2);
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE PRINCIPAL_NAME = ?",
-                Long.class, PRINCIPAL))
-            .isZero();
-    }
-
-    @Test
-    void revokeOtherSessions_deletes_non_current_rows_and_keeps_current_session() {
-        String keepId = insertSession();
-        insertSession();
-        insertSession();
-
-        int count = adapter.revokeOtherSessions(keepId, PRINCIPAL);
-
-        assertThat(count).isEqualTo(2);
-        // The current session row must still be present (keyed by SESSION_ID)
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE SESSION_ID = ?",
-                Long.class, keepId))
-            .isEqualTo(1L);
-        // The total for this principal is now exactly 1
-        assertThat(jdbcTemplate.queryForObject(
-                "SELECT COUNT(*) FROM spring_session WHERE PRINCIPAL_NAME = ?",
-                Long.class, PRINCIPAL))
-            .isEqualTo(1L);
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/JdbcSessionRevocationAdapterTest.java

@@ -1,52 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
-
-import java.util.HashMap;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.Mockito.*;
-
-@ExtendWith(MockitoExtension.class)
-class JdbcSessionRevocationAdapterTest {
-
-    @Mock JdbcIndexedSessionRepository sessionRepository;
-    @InjectMocks JdbcSessionRevocationAdapter adapter;
-
-    @SuppressWarnings("unchecked")
-    @Test
-    void revokeOtherSessions_preserves_current_and_deletes_N_minus_1() {
-        var sessions = new HashMap<String, Object>();
-        sessions.put("session-keep", null);
-        sessions.put("session-del-1", null);
-        sessions.put("session-del-2", null);
-        doReturn(sessions).when(sessionRepository).findByPrincipalName("user@test.de");
-
-        int count = adapter.revokeOtherSessions("session-keep", "user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRepository, never()).deleteById("session-keep");
-        verify(sessionRepository).deleteById("session-del-1");
-        verify(sessionRepository).deleteById("session-del-2");
-    }
-
-    @SuppressWarnings("unchecked")
-    @Test
-    void revokeAllSessions_deletes_all_sessions_for_principal() {
-        var sessions = new HashMap<String, Object>();
-        sessions.put("session-1", null);
-        sessions.put("session-2", null);
-        doReturn(sessions).when(sessionRepository).findByPrincipalName("user@test.de");
-
-        int count = adapter.revokeAllSessions("user@test.de");
-
-        assertThat(count).isEqualTo(2);
-        verify(sessionRepository).deleteById("session-1");
-        verify(sessionRepository).deleteById("session-2");
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/auth/LoginRateLimiterTest.java

@@ -1,148 +0,0 @@
-package org.raddatz.familienarchiv.auth;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.exception.DomainException;
-import org.raddatz.familienarchiv.exception.ErrorCode;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatNoException;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-class LoginRateLimiterTest {
-
-    private LoginRateLimiter rateLimiter;
-
-    @BeforeEach
-    void setUp() {
-        RateLimitProperties props = new RateLimitProperties();
-        props.setMaxAttemptsPerIpEmail(10);
-        props.setMaxAttemptsPerIp(20);
-        props.setWindowMinutes(15);
-        rateLimiter = new LoginRateLimiter(props);
-    }
-
-    @Test
-    void tenth_attempt_from_same_ip_email_succeeds() {
-        for (int i = 0; i < 10; i++) {
-            assertThatNoException().isThrownBy(
-                () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-        }
-    }
-
-    @Test
-    void eleventh_attempt_from_same_ip_email_throws_TOO_MANY_LOGIN_ATTEMPTS() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void blocked_attempt_carries_retry_after_seconds_equal_to_window_duration() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getRetryAfterSeconds())
-                .isEqualTo(15 * 60L));  // windowMinutes=15 → 900 seconds
-    }
-
-    @Test
-    void success_after_10_failures_resets_ip_email_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        rateLimiter.invalidateOnSuccess("1.2.3.4", "user@example.com");
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-    }
-
-    @Test
-    void twentyfirst_attempt_from_same_ip_across_different_emails_throws() {
-        for (int i = 0; i < 20; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user" + i + "@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "attacker@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void different_email_from_same_ip_not_blocked_by_sibling_email_exhaustion() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class);
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "other@example.com"));
-    }
-
-    @Test
-    void email_lookup_is_case_insensitive_so_mixed_case_shares_the_same_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "User@Example.COM");
-        }
-
-        assertThatThrownBy(() -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"))
-            .isInstanceOf(DomainException.class)
-            .satisfies(ex -> assertThat(((DomainException) ex).getCode())
-                .isEqualTo(ErrorCode.TOO_MANY_LOGIN_ATTEMPTS));
-    }
-
-    @Test
-    void invalidateOnSuccess_is_case_insensitive_so_mixed_case_clears_the_bucket() {
-        for (int i = 0; i < 10; i++) {
-            rateLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        rateLimiter.invalidateOnSuccess("1.2.3.4", "User@Example.COM");
-
-        assertThatNoException().isThrownBy(
-            () -> rateLimiter.checkAndConsume("1.2.3.4", "user@example.com"));
-    }
-
-    @Test
-    void ip_exhaustion_does_not_consume_ipEmail_tokens_for_blocked_attempts() {
-        // Use a tighter limiter so the phantom-consumption effect is observable.
-        // ipEmail=3, IP=3: exhausting IP via one email burns the other email's quota with the old code.
-        RateLimitProperties props = new RateLimitProperties();
-        props.setMaxAttemptsPerIpEmail(3);
-        props.setMaxAttemptsPerIp(3);
-        props.setWindowMinutes(15);
-        LoginRateLimiter tightLimiter = new LoginRateLimiter(props);
-
-        // Exhaust the per-IP bucket using "user@"
-        for (int i = 0; i < 3; i++) {
-            tightLimiter.checkAndConsume("1.2.3.4", "user@example.com");
-        }
-
-        // Three blocked attempts for "target@" while IP is exhausted
-        for (int i = 0; i < 3; i++) {
-            assertThatThrownBy(() -> tightLimiter.checkAndConsume("1.2.3.4", "target@example.com"))
-                .isInstanceOf(DomainException.class);
-        }
-
-        // A successful login for "user@" resets the IP bucket but NOT target@'s ipEmail bucket
-        tightLimiter.invalidateOnSuccess("1.2.3.4", "user@example.com");
-
-        // After IP reset: "target@" must NOT be blocked by an exhausted ipEmail bucket.
-        // With the old code, 3 blocked attempts burned all 3 ipEmail tokens → blocked here.
-        // With the fix, tokens are refunded on each blocked attempt → still has capacity.
-        assertThatNoException().isThrownBy(
-            () -> tightLimiter.checkAndConsume("1.2.3.4", "target@example.com"));
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/config/ForwardHeadersConfigurationTest.java

@@ -1,48 +0,0 @@
-package org.raddatz.familienarchiv.config;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.config.YamlPropertiesFactoryBean;
-import org.springframework.boot.web.server.autoconfigure.ServerProperties.ForwardHeadersStrategy;
-import org.springframework.boot.context.properties.bind.Binder;
-import org.springframework.boot.context.properties.source.ConfigurationPropertySources;
-import org.springframework.core.env.PropertiesPropertySource;
-import org.springframework.core.io.ClassPathResource;
-
-import java.util.Properties;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Binds {@code server.forward-headers-strategy} from {@code application.yaml} into
- * Spring Boot's typed {@link ForwardHeadersStrategy} enum. The binder rejects any
- * value that is not a valid enum constant ({@code BindException}), so a typo
- * ({@code "nativ"}, {@code "Native"}, {@code "framework "}) or a future Spring
- * rename of the property fails the test, not silently degrades to {@code NONE}.
- *
- * <p>No Spring context, no embedded server, no Testcontainers — this is the
- * cheapest test that pins the contract "Caddy's X-Forwarded-Proto is trusted".
- */
-class ForwardHeadersConfigurationTest {
-
-    @Test
-    void forward_headers_strategy_binds_to_NATIVE() {
-        YamlPropertiesFactoryBean yaml = new YamlPropertiesFactoryBean();
-        yaml.setResources(new ClassPathResource("application.yaml"));
-        Properties props = yaml.getObject();
-        assertThat(props).as("application.yaml must be on the classpath").isNotNull();
-
-        Binder binder = new Binder(ConfigurationPropertySources.from(
-            new PropertiesPropertySource("application", props)));
-
-        ForwardHeadersStrategy strategy = binder
-            .bind("server.forward-headers-strategy", ForwardHeadersStrategy.class)
-            .orElseThrow(() -> new AssertionError(
-                "server.forward-headers-strategy is missing from application.yaml"));
-
-        assertThat(strategy)
-            .as("Spring must trust X-Forwarded-Proto from Caddy so that "
-                + "request.getScheme(), redirect URLs, and the Spring Session "
-                + "'Secure' cookie reflect the original https client request.")
-            .isEqualTo(ForwardHeadersStrategy.NATIVE);
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/config/RateLimitInterceptorTest.java

@@ -45,15 +45,6 @@ class RateLimitInterceptorTest {
         verify(response).setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
     }
 
-    @Test
-    void blocked_response_includes_retry_after_header() throws Exception {
-        for (int i = 0; i < 10; i++) {
-            interceptor.preHandle(request, response, null);
-        }
-        interceptor.preHandle(request, response, null);
-        verify(response).setHeader("Retry-After", "60");
-    }
-
     @Test
     void different_ips_have_independent_limits() throws Exception {
         HttpServletRequest other = mock(HttpServletRequest.class);

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentControllerTest.java

@@ -44,12 +44,10 @@ import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.multipart;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.patch;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(DocumentController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -216,14 +214,14 @@ class DocumentControllerTest {
 
     @Test
     void createDocument_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void createDocument_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isForbidden());
     }
 
@@ -237,7 +235,7 @@ class DocumentControllerTest {
                 .build();
         when(documentService.createDocument(any(), any())).thenReturn(doc);
 
-        mockMvc.perform(multipart("/api/documents").with(csrf()))
+        mockMvc.perform(multipart("/api/documents"))
                 .andExpect(status().isOk());
     }
 
@@ -246,7 +244,7 @@ class DocumentControllerTest {
     @Test
     void updateDocument_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID())
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -254,7 +252,7 @@ class DocumentControllerTest {
     @WithMockUser
     void updateDocument_returns403_whenMissingWritePermission() throws Exception {
         mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID())
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isForbidden());
     }
 
@@ -271,7 +269,7 @@ class DocumentControllerTest {
         when(documentService.updateDocument(any(), any(), any(), any())).thenReturn(doc);
 
         mockMvc.perform(multipart("/api/documents/" + id)
-                        .with(req -> { req.setMethod("PUT"); return req; }).with(csrf()))
+                        .with(req -> { req.setMethod("PUT"); return req; }))
                 .andExpect(status().isOk());
     }
 
@@ -280,7 +278,7 @@ class DocumentControllerTest {
     @Test
     void deleteDocument_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + UUID.randomUUID()).with(csrf()))
+                        .delete("/api/documents/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -288,7 +286,7 @@ class DocumentControllerTest {
     @WithMockUser
     void deleteDocument_returns403_whenMissingWritePermission() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + UUID.randomUUID()).with(csrf()))
+                        .delete("/api/documents/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
@@ -297,7 +295,7 @@ class DocumentControllerTest {
     void deleteDocument_returns204_whenHasWritePermission() throws Exception {
         UUID id = UUID.randomUUID();
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders
-                        .delete("/api/documents/" + id).with(csrf()))
+                        .delete("/api/documents/" + id))
                 .andExpect(status().isNoContent());
     }
 
@@ -305,14 +303,14 @@ class DocumentControllerTest {
 
     @Test
     void quickUpload_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void quickUpload_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isForbidden());
     }
 
@@ -328,7 +326,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("files", "scan001.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created[0].title").value("scan001"))
                 .andExpect(jsonPath("$.updated").isEmpty())
@@ -347,7 +345,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("files", "scan001.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated[0].title").value("Alter Brief"))
@@ -362,7 +360,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("files", "report.docx",
                         "application/vnd.openxmlformats-officedocument.wordprocessingml.document", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.errors[0].filename").value("report.docx"))
@@ -492,7 +490,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void quickUpload_returnsEmptyResult_whenNoFilesPartProvided() throws Exception {
-        mockMvc.perform(multipart("/api/documents/quick-upload").with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated").isEmpty())
@@ -642,7 +640,7 @@ class DocumentControllerTest {
 
     @Test
     void patchTrainingLabels_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isUnauthorized());
@@ -651,7 +649,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser
     void patchTrainingLabels_returns403_whenMissingWritePermission() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isForbidden());
@@ -661,7 +659,7 @@ class DocumentControllerTest {
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns204_whenAddingLabel() throws Exception {
         UUID id = UUID.randomUUID();
-        mockMvc.perform(patch("/api/documents/" + id + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + id + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_RECOGNITION\",\"enrolled\":true}"))
                 .andExpect(status().isNoContent());
@@ -673,7 +671,7 @@ class DocumentControllerTest {
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns204_whenRemovingLabel() throws Exception {
         UUID id = UUID.randomUUID();
-        mockMvc.perform(patch("/api/documents/" + id + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + id + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"KURRENT_SEGMENTATION\",\"enrolled\":false}"))
                 .andExpect(status().isNoContent());
@@ -684,7 +682,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchTrainingLabels_returns400_whenUnknownLabel() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels").with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/training-labels")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"label\":\"UNKNOWN_GARBAGE\",\"enrolled\":true}"))
                 .andExpect(status().isBadRequest());
@@ -698,7 +696,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(file))
                 .andExpect(status().isForbidden());
     }
 
@@ -715,7 +713,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.id").value(id.toString()))
                 .andExpect(jsonPath("$.status").value("UPLOADED"));
@@ -728,7 +726,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile(
                         "file", "evil.html", "text/html", "<script>alert(1)</script>".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(htmlFile).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(htmlFile))
                 .andExpect(status().isBadRequest());
     }
 
@@ -745,7 +743,7 @@ class DocumentControllerTest {
         org.springframework.mock.web.MockMultipartFile file =
                 new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
 
-        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file))
                 .andExpect(status().isNotFound());
     }
 
@@ -802,7 +800,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         ("{\"senderId\":\"" + senderId + "\"}").getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created.length()").value(3))
                 .andExpect(jsonPath("$.created[0].sender.id").value(senderId.toString()))
@@ -829,7 +827,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         ("{\"senderId\":\"" + senderId + "\"}").getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created").isEmpty())
                 .andExpect(jsonPath("$.updated[0].sender.id").value(senderId.toString()))
@@ -861,7 +859,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"titles\":[\"Alpha\",\"Beta\",\"Gamma\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(f3).file(metadata))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.created[0].title").value("Alpha"))
                 .andExpect(jsonPath("$.created[1].title").value("Beta"))
@@ -885,7 +883,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"titles\":[\"A\",\"B\",\"C\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(f1).file(f2).file(metadata))
                 .andExpect(status().isBadRequest());
     }
 
@@ -906,7 +904,7 @@ class DocumentControllerTest {
                 new org.springframework.mock.web.MockMultipartFile("metadata", "metadata", "application/json",
                         "{\"tagNames\":[\"Briefwechsel\",\"Krieg\"]}".getBytes());
 
-        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata).with(csrf()))
+        mockMvc.perform(multipart("/api/documents/quick-upload").file(file).file(metadata))
                 .andExpect(status().isOk());
 
         org.assertj.core.api.Assertions.assertThat(captor.getValue().getTagNames())
@@ -928,7 +926,7 @@ class DocumentControllerTest {
                     "files", "f" + i + ".pdf", "application/pdf", new byte[]{1}));
         }
 
-        mockMvc.perform(builder.with(csrf()))
+        mockMvc.perform(builder)
                 .andExpect(status().isBadRequest())
                 .andExpect(jsonPath("$.code").value("BATCH_TOO_LARGE"));
     }
@@ -947,7 +945,7 @@ class DocumentControllerTest {
 
     @Test
     void patchBulk_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(UUID.randomUUID().toString())))
                 .andExpect(status().isUnauthorized());
@@ -956,7 +954,7 @@ class DocumentControllerTest {
     @Test
     @WithMockUser
     void patchBulk_returns403_forReadAllUser() throws Exception {
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(UUID.randomUUID().toString())))
                 .andExpect(status().isForbidden());
@@ -967,7 +965,7 @@ class DocumentControllerTest {
     void patchBulk_returns400_whenDocumentIdsIsEmpty() throws Exception {
         when(userService.findByEmail(any())).thenReturn(AppUser.builder().id(UUID.randomUUID()).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"documentIds\":[]}"))
                 .andExpect(status().isBadRequest());
@@ -978,7 +976,7 @@ class DocumentControllerTest {
     void patchBulk_returns400_whenDocumentIdsIsMissing() throws Exception {
         when(userService.findByEmail(any())).thenReturn(AppUser.builder().id(UUID.randomUUID()).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isBadRequest());
@@ -992,7 +990,7 @@ class DocumentControllerTest {
         String[] ids = new String[501];
         for (int i = 0; i < 501; i++) ids[i] = UUID.randomUUID().toString();
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(ids)))
                 .andExpect(status().isBadRequest())
@@ -1011,7 +1009,7 @@ class DocumentControllerTest {
         String tooLong = "x".repeat(256);
 
         String body = "{\"documentIds\":[\"" + id + "\"],\"archiveBox\":\"" + tooLong + "\"}";
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest());
@@ -1027,7 +1025,7 @@ class DocumentControllerTest {
         String[] ids = new String[500];
         for (int i = 0; i < 500; i++) ids[i] = UUID.randomUUID().toString();
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(ids)))
                 .andExpect(status().isOk())
@@ -1044,7 +1042,7 @@ class DocumentControllerTest {
 
         // Same id sent three times — controller should dedupe and call the
         // service exactly once, returning updated=1, not 3.
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(id.toString(), id.toString(), id.toString())))
                 .andExpect(status().isOk())
@@ -1063,7 +1061,7 @@ class DocumentControllerTest {
         when(documentService.applyBulkEditToDocument(any(), any(), any()))
                 .thenAnswer(inv -> Document.builder().id(inv.getArgument(0)).build());
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(id1.toString(), id2.toString())))
                 .andExpect(status().isOk())
@@ -1139,7 +1137,7 @@ class DocumentControllerTest {
     void batchMetadata_returns401_whenUnauthenticated() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}"))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -1148,7 +1146,7 @@ class DocumentControllerTest {
     void batchMetadata_returns403_forUserWithoutReadAll() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + UUID.randomUUID() + "\"]}"))
                 .andExpect(status().isForbidden());
     }
 
@@ -1157,7 +1155,7 @@ class DocumentControllerTest {
     void batchMetadata_returns400_whenIdsEmpty() throws Exception {
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[]}").with(csrf()))
+                        .content("{\"ids\":[]}"))
                 .andExpect(status().isBadRequest());
     }
 
@@ -1174,7 +1172,7 @@ class DocumentControllerTest {
 
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(sb.toString()).with(csrf()))
+                        .content(sb.toString()))
                 .andExpect(status().isBadRequest())
                 .andExpect(jsonPath("$.code").value("BULK_EDIT_TOO_MANY_IDS"));
     }
@@ -1189,7 +1187,7 @@ class DocumentControllerTest {
 
         mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/api/documents/batch-metadata")
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"ids\":[\"" + id + "\"]}").with(csrf()))
+                        .content("{\"ids\":[\"" + id + "\"]}"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$[0].id").value(id.toString()))
                 .andExpect(jsonPath("$[0].title").value("Brief"))
@@ -1210,7 +1208,7 @@ class DocumentControllerTest {
                         org.raddatz.familienarchiv.exception.ErrorCode.DOCUMENT_NOT_FOUND,
                         "evil\r\nFAKE LOG ENTRY: admin logged in"));
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(badId.toString())))
                 .andExpect(status().isOk())
@@ -1234,7 +1232,7 @@ class DocumentControllerTest {
                 .thenThrow(org.raddatz.familienarchiv.exception.DomainException.notFound(
                         org.raddatz.familienarchiv.exception.ErrorCode.DOCUMENT_NOT_FOUND, "Document not found: " + badId));
 
-        mockMvc.perform(patch("/api/documents/bulk").with(csrf())
+        mockMvc.perform(patch("/api/documents/bulk")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(bulkBody(okId.toString(), badId.toString())))
                 .andExpect(status().isOk())
@@ -1339,16 +1337,4 @@ class DocumentControllerTest {
                 DocumentStatus.REVIEWED,
                 org.raddatz.familienarchiv.tag.TagOperator.AND)));
     }
-
-    // ─── CSRF protection ──────────────────────────────────────────────────────
-
-    @Test
-    @WithMockUser
-    void post_without_csrf_token_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        mockMvc.perform(post("/api/documents")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{}"))
-                .andExpect(status().isForbidden())
-                .andExpect(jsonPath("$.code").value(ErrorCode.CSRF_TOKEN_MISSING.name()));
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentFtsPagedIntegrationTest.java

@@ -1,109 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import jakarta.persistence.EntityManager;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.config.FlywayConfig;
-import org.raddatz.familienarchiv.document.DocumentRepository;
-import org.raddatz.familienarchiv.document.Document;
-import org.raddatz.familienarchiv.document.DocumentStatus;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
-import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
-import org.springframework.context.annotation.Import;
-import org.springframework.test.annotation.DirtiesContext;
-
-import java.util.List;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatNoException;
-
-/**
- * Repository-level integration tests for {@code findFtsPageRaw}: verifies that the
- * paginated FTS query returns exactly page-size rows and that the window-function
- * total reflects the full match count, not just the page count.
- *
- * <p>Uses real Postgres via Testcontainers so the GIN index, tsvector trigger, and
- * {@code websearch_to_tsquery} semantics are identical to production.
- *
- * <p>{@code AFTER_CLASS} dirty-context keeps the Spring context alive for all tests
- * in this class and rebuilds it once at the end, rather than after every test.
- */
-@DataJpaTest
-@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
-@Import({PostgresContainerConfig.class, FlywayConfig.class})
-@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_CLASS)
-class DocumentFtsPagedIntegrationTest {
-
-    @Autowired DocumentRepository documentRepository;
-    @Autowired EntityManager em;
-
-    // 60 docs match "Walter"; 10 docs with "Hans" do not.
-    private static final int WALTER_COUNT = 60;
-    private static final int PAGE_SIZE = 50;
-
-    @BeforeEach
-    void seed() {
-        documentRepository.deleteAll();
-        em.flush();
-        for (int i = 0; i < WALTER_COUNT; i++) {
-            documentRepository.saveAndFlush(doc("Brief von Walter Nr. " + i));
-        }
-        for (int i = 0; i < 10; i++) {
-            documentRepository.saveAndFlush(doc("Brief von Hans Nr. " + i));
-        }
-        em.clear();
-    }
-
-    @Test
-    void findFtsPageRaw_firstPage_returnsPageSizeRows() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", 0, PAGE_SIZE);
-
-        assertThat(rows).hasSize(PAGE_SIZE);
-    }
-
-    @Test
-    void findFtsPageRaw_windowTotal_equalsFullMatchCount_notPageSize() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", 0, PAGE_SIZE);
-
-        long total = ((Number) rows.get(0)[2]).longValue();
-        assertThat(total).isEqualTo(WALTER_COUNT);
-    }
-
-    @Test
-    void findFtsPageRaw_lastPage_returnsRemainder() {
-        int remainder = WALTER_COUNT % PAGE_SIZE; // 60 % 50 = 10
-        List<Object[]> rows = documentRepository.findFtsPageRaw("Walter", PAGE_SIZE, PAGE_SIZE);
-
-        assertThat(rows).hasSize(remainder);
-        long total = ((Number) rows.get(0)[2]).longValue();
-        assertThat(total).isEqualTo(WALTER_COUNT);
-    }
-
-    @Test
-    void findFtsPageRaw_noMatches_returnsEmptyList() {
-        List<Object[]> rows = documentRepository.findFtsPageRaw("XYZ_KEIN_TREFFER", 0, PAGE_SIZE);
-
-        assertThat(rows).isEmpty();
-    }
-
-    @Test
-    void findFtsPageRaw_stopwordOnlyQuery_returnsEmptyList_noException() {
-        assertThatNoException().isThrownBy(() -> {
-            List<Object[]> rows = documentRepository.findFtsPageRaw("der die das und", 0, PAGE_SIZE);
-            assertThat(rows).isEmpty();
-        });
-    }
-
-    // ─── Helper ───────────────────────────────────────────────────────────────
-
-    private Document doc(String title) {
-        return Document.builder()
-                .title(title)
-                .originalFilename(title.replace(" ", "_") + ".pdf")
-                .status(DocumentStatus.UPLOADED)
-                .build();
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentFtsTest.java

@@ -69,7 +69,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Alter Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Brief");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Brief");
 
         assertThat(ids).hasSize(1);
     }
@@ -79,7 +79,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Alter Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Briefe");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Briefe");
 
         assertThat(ids).hasSize(1);
     }
@@ -89,7 +89,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Ein furchtbarer Brief"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("furchtb");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("furchtb");
 
         assertThat(ids).hasSize(1);
     }
@@ -99,7 +99,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Familienfoto"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Brief");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Brief");
 
         assertThat(ids).isEmpty();
     }
@@ -115,7 +115,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("schreiben");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("schreiben");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -125,14 +125,14 @@ class DocumentFtsTest {
         Document doc = documentRepository.saveAndFlush(document("Leeres Dokument"));
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).isEmpty();
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).isEmpty();
 
         UUID annotationId = annotation(doc.getId());
         blockRepository.saveAndFlush(block(doc.getId(), annotationId, "Grundbuch Eintrag 1923", 0));
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).contains(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).contains(doc.getId());
     }
 
     @Test
@@ -144,13 +144,13 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).contains(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).contains(doc.getId());
 
         blockRepository.deleteById(block.getId());
         em.flush();
         em.clear();
 
-        assertThat(documentRepository.findAllMatchingIdsByFts("Grundbuch")).doesNotContain(doc.getId());
+        assertThat(documentRepository.findRankedIdsByFts("Grundbuch")).doesNotContain(doc.getId());
     }
 
     // ─── Ranking ───────────────────────────────────────────────────────────────
@@ -166,7 +166,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Grundbuch");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Grundbuch");
 
         assertThat(ids).hasSize(2);
         assertThat(ids.get(0)).isEqualTo(docA.getId());
@@ -179,7 +179,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Ein Brief von der Oma"));
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("der die das und");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("der die das und");
 
         assertThat(ids).isEmpty();
     }
@@ -195,7 +195,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Wille");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Wille");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -205,7 +205,7 @@ class DocumentFtsTest {
         documentRepository.saveAndFlush(document("Brief"));
         em.clear();
 
-        assertThatNoException().isThrownBy(() -> documentRepository.findAllMatchingIdsByFts("((("));
+        assertThatNoException().isThrownBy(() -> documentRepository.findRankedIdsByFts("((("));
     }
 
     // ─── Weight C: sender/receiver names ───────────────────────────────────────
@@ -223,7 +223,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Schmidt");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Schmidt");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -241,7 +241,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Raddatz");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Raddatz");
 
         assertThat(ids).contains(doc.getId());
     }
@@ -260,7 +260,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> ids = documentRepository.findAllMatchingIdsByFts("Familiengeschichte");
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Familiengeschichte");
 
         assertThat(ids).hasSize(1);
     }
@@ -278,7 +278,7 @@ class DocumentFtsTest {
         em.flush();
         em.clear();
 
-        List<UUID> rankedIds = documentRepository.findAllMatchingIdsByFts("Grundbuch");
+        List<UUID> rankedIds = documentRepository.findRankedIdsByFts("Grundbuch");
         Specification<Document> spec = Specification.where(hasIds(rankedIds))
                 .and(hasStatus(DocumentStatus.UPLOADED));
 

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentLazyLoadingTest.java

@@ -1,178 +0,0 @@
-package org.raddatz.familienarchiv.document;
-
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.audit.AuditLogQueryService;
-import org.raddatz.familienarchiv.dashboard.DashboardService;
-import org.raddatz.familienarchiv.person.Person;
-import org.raddatz.familienarchiv.person.PersonRepository;
-import org.raddatz.familienarchiv.tag.Tag;
-import org.raddatz.familienarchiv.tag.TagRepository;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.data.domain.PageRequest;
-import org.springframework.test.context.ActiveProfiles;
-import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import software.amazon.awssdk.services.s3.S3Client;
-
-import java.util.HashSet;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.when;
-
-/**
- * Verifies that lazy-loaded associations on {@link Document} are accessible after a service
- * method returns — i.e. no {@link org.hibernate.LazyInitializationException} is thrown outside
- * the Hibernate session that loaded the entity.
- *
- * <p><b>Known limitation:</b> calling {@code getDocumentById} (or any other service method) from
- * within an already-open transaction is not covered here. When an outer transaction is active,
- * the service's own {@code @Transactional} merges into it and Hibernate keeps the same session
- * open, so the lazy-init guard behaves differently than in a non-transactional caller. This is a
- * known constraint of the test setup, not a bug in the production code.
- */
-@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
-@ActiveProfiles("test")
-@Import(PostgresContainerConfig.class)
-class DocumentLazyLoadingTest {
-
-    @MockitoBean
-    S3Client s3Client;
-
-    @Autowired
-    DocumentRepository documentRepository;
-
-    @Autowired
-    PersonRepository personRepository;
-
-    @Autowired
-    TagRepository tagRepository;
-
-    @Autowired
-    DocumentService documentService;
-
-    @Autowired
-    DashboardService dashboardService;
-
-    @MockitoBean
-    AuditLogQueryService auditLogQueryService;
-
-    @AfterEach
-    void cleanup() {
-        documentRepository.deleteAll();
-        tagRepository.deleteAll();
-        personRepository.deleteAll();
-    }
-
-    @Test
-    void getDocumentById_tagsAndReceiversAccessible_afterReturnFromService() {
-        Person sender = savedPerson("Max", "LzSender");
-        Person receiver = savedPerson("Anna", "LzReceiver");
-        Tag tag = savedTag("LzTag");
-        Document doc = savedDocument("LazyTest", "lazy_test.pdf", sender, Set.of(receiver), Set.of(tag));
-
-        Document result = documentService.getDocumentById(doc.getId());
-
-        // Only the collection access itself is in assertThatCode — guards against LazyInitializationException.
-        // Value assertions live outside so failures surface as AssertionError, not as unexpected exception.
-        assertThatCode(() -> {
-            result.getTags().size();
-            result.getReceivers().size();
-        }).doesNotThrowAnyException();
-        assertThat(result.getTags()).isNotEmpty();
-        result.getTags().forEach(t -> assertThat(t.getName()).isNotNull());
-        assertThat(result.getReceivers()).isNotEmpty();
-        result.getReceivers().forEach(r -> assertThat(r.getLastName()).isNotNull());
-    }
-
-    @Test
-    void getRecentActivity_collectionsAccessibleAfterReturn() {
-        Person sender = savedPerson("Hans", "RaSender");
-        Tag tag = savedTag("RaTag");
-        for (int i = 0; i < 3; i++) {
-            savedDocument("RaDoc " + i, "ra_doc" + i + ".pdf", sender, Set.of(), Set.of(tag));
-        }
-
-        List<Document> results = documentService.getRecentActivity(3);
-
-        // Access lazy fields inside assertThatCode — guards against LazyInitializationException.
-        // Value assertions live outside so failures surface as AssertionError, not as unexpected exception.
-        assertThatCode(() -> {
-            results.forEach(d -> d.getSender().getLastName());
-            results.forEach(d -> d.getTags().size());
-        }).doesNotThrowAnyException();
-        results.forEach(d -> assertThat(d.getSender()).isNotNull());
-        results.forEach(d -> assertThat(d.getSender().getLastName()).isNotNull());
-        results.forEach(d -> assertThat(d.getTags()).isNotEmpty());
-    }
-
-    @Test
-    void searchDocuments_receiverSort_doesNotThrowLazyInitializationException() {
-        Person sender = savedPerson("Hans", "SrSender");
-        Person receiver = savedPerson("Anna", "SrReceiver");
-        Tag tag = savedTag("SrTag");
-        savedDocument("SrDoc", "sr_doc.pdf", sender, Set.of(receiver), Set.of(tag));
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                null, null, null, null, null, null, null, null,
-                DocumentSort.RECEIVER, "asc", null,
-                PageRequest.of(0, 20));
-        assertThat(result.totalElements()).isGreaterThan(0);
-        assertThatCode(() ->
-                result.items().forEach(i -> i.document().getSender().getLastName()))
-                .doesNotThrowAnyException();
-    }
-
-    @Test
-    void searchDocuments_senderSort_doesNotThrowLazyInitializationException() {
-        Person sender = savedPerson("Hans", "SsSender");
-        Tag tag = savedTag("SsTag");
-        savedDocument("SsDoc", "ss_doc.pdf", sender, Set.of(), Set.of(tag));
-
-        assertThatCode(() -> documentService.searchDocuments(
-                null, null, null, null, null, null, null, null,
-                DocumentSort.SENDER, "asc", null,
-                PageRequest.of(0, 20)))
-                .doesNotThrowAnyException();
-    }
-
-    @Test
-    void dashboardService_getResume_accessesReceiversViaGetDocumentById_withoutException() {
-        Person sender = savedPerson("Max", "DsSender");
-        Person receiver = savedPerson("Anna", "DsReceiver");
-        Document doc = savedDocument("DashboardTest", "dashboard_test.pdf", sender, Set.of(receiver), Set.of());
-        UUID fakeUserId = UUID.randomUUID();
-        when(auditLogQueryService.findMostRecentDocumentForUser(any())).thenReturn(Optional.of(doc.getId()));
-        when(auditLogQueryService.findRecentContributorsPerDocument(any())).thenReturn(java.util.Map.of());
-
-        assertThatCode(() -> dashboardService.getResume(fakeUserId))
-                .doesNotThrowAnyException();
-    }
-
-    private Person savedPerson(String firstName, String lastName) {
-        return personRepository.save(Person.builder().firstName(firstName).lastName(lastName).build());
-    }
-
-    private Tag savedTag(String name) {
-        return tagRepository.save(Tag.builder().name(name).build());
-    }
-
-    private Document savedDocument(String title, String filename, Person sender,
-                                   Set<Person> receivers, Set<Tag> tags) {
-        return documentRepository.save(Document.builder()
-                .title(title).originalFilename(filename)
-                .status(DocumentStatus.UPLOADED)
-                .sender(sender)
-                .receivers(new HashSet<>(receivers))
-                .tags(new HashSet<>(tags))
-                .build());
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentRepositoryTest.java

@@ -1,9 +1,5 @@
 package org.raddatz.familienarchiv.document;
 
-import jakarta.persistence.EntityManager;
-import jakarta.persistence.EntityManagerFactory;
-import org.hibernate.SessionFactory;
-import org.hibernate.stat.Statistics;
 import org.junit.jupiter.api.Test;
 import org.raddatz.familienarchiv.PostgresContainerConfig;
 import org.raddatz.familienarchiv.config.FlywayConfig;
@@ -25,7 +21,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
 import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
 import org.springframework.context.annotation.Import;
-import org.springframework.data.jpa.domain.Specification;
 
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
@@ -60,12 +55,6 @@ class DocumentRepositoryTest {
     @Autowired
     private TranscriptionBlockRepository transcriptionBlockRepository;
 
-    @Autowired
-    private EntityManagerFactory entityManagerFactory;
-
-    @Autowired
-    private EntityManager entityManager;
-
     // ─── save and findById ────────────────────────────────────────────────────
 
     @Test
@@ -501,117 +490,6 @@ class DocumentRepositoryTest {
         assertThat(ids).containsExactlyInAnyOrder(grandparent.getId(), parent2.getId(), child2.getId());
     }
 
-    // ─── query-count — entity-graph assertions ────────────────────────────────
-
-    @Test
-    void findAll_withSpecAndPageable_loadsDocumentsInAtMostFiveStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Hans").lastName("QcSender").build());
-        Person receiver = personRepository.save(Person.builder().firstName("Anna").lastName("QcReceiver").build());
-        Tag tag = tagRepository.save(Tag.builder().name("QcTag").build());
-        for (int i = 0; i < 10; i++) {
-            documentRepository.save(Document.builder()
-                    .title("QcDoc " + i).originalFilename("qcdoc" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .receivers(new HashSet<>(Set.of(receiver)))
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        Specification<Document> allDocs = (root, query, cb) -> null;
-        documentRepository.findAll(allDocs, PageRequest.of(0, 10));
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) must load 10 docs in ≤5 statements, not N+1")
-                .isLessThanOrEqualTo(5);
-    }
-
-    @Test
-    void findById_loadsSenderReceiversAndTagsInAtMostTwoStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Max").lastName("FbSender").build());
-        Set<Person> receivers = new HashSet<>();
-        for (int i = 0; i < 3; i++) {
-            receivers.add(personRepository.save(
-                    Person.builder().firstName("R" + i).lastName("FbReceiver").build()));
-        }
-        Set<Tag> tags = new HashSet<>();
-        for (int i = 0; i < 5; i++) {
-            tags.add(tagRepository.save(Tag.builder().name("FbTag" + i).build()));
-        }
-        Document doc = documentRepository.save(Document.builder()
-                .title("FindByIdQc").originalFilename("findbyid_qc.pdf")
-                .status(DocumentStatus.UPLOADED)
-                .sender(sender).receivers(receivers).tags(tags)
-                .build());
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        documentRepository.findById(doc.getId());
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.full) must load sender+receivers+tags in ≤2 statements, not 4")
-                .isLessThanOrEqualTo(2);
-    }
-
-    @Test
-    void findAll_withPageable_loadsSenderWithoutNPlusOne() {
-        Person sender = personRepository.save(Person.builder().firstName("Maria").lastName("RaSender").build());
-        Tag tag = tagRepository.save(Tag.builder().name("RaTag2").build());
-        for (int i = 0; i < 5; i++) {
-            documentRepository.save(Document.builder()
-                    .title("RaDoc2 " + i).originalFilename("radoc2_" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        documentRepository.findAll(PageRequest.of(0, 5, Sort.by(Sort.Direction.DESC, "updatedAt")));
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) via findAll(Pageable) must not N+1 sender for 5 docs")
-                .isLessThanOrEqualTo(5);
-    }
-
-    @Test
-    void findAll_withSpecOnly_appliesEntityGraphInAtMostFiveStatements() {
-        Person sender = personRepository.save(Person.builder().firstName("Otto").lastName("SoSender").build());
-        Tag tag = tagRepository.save(Tag.builder().name("SoTag").build());
-        for (int i = 0; i < 5; i++) {
-            documentRepository.save(Document.builder()
-                    .title("SoDoc " + i).originalFilename("sodoc_" + i + ".pdf")
-                    .status(DocumentStatus.UPLOADED)
-                    .sender(sender)
-                    .tags(new HashSet<>(Set.of(tag)))
-                    .build());
-        }
-        entityManager.flush();
-        entityManager.clear();
-        Statistics stats = entityManagerFactory.unwrap(SessionFactory.class).getStatistics();
-        stats.setStatisticsEnabled(true);
-        stats.clear();
-
-        Specification<Document> allDocs = (root, query, cb) -> null;
-        documentRepository.findAll(allDocs);
-
-        assertThat(stats.getPrepareStatementCount())
-                .as("@EntityGraph(Document.list) via findAll(Spec) must not N+1 sender for 5 docs")
-                .isLessThanOrEqualTo(5);
-    }
-
     // ─── seeding helpers ─────────────────────────────────────────────────────
 
     private Document uploaded(String title) {

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentSearchPagedIntegrationTest.java

@@ -12,9 +12,9 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
 import org.springframework.data.domain.PageRequest;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.annotation.Transactional;
 import software.amazon.awssdk.services.s3.S3Client;
 
 import java.time.LocalDate;
@@ -33,7 +33,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
-@Transactional
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class DocumentSearchPagedIntegrationTest {
 
     private static final int FIXTURE_SIZE = 120;

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentServiceSortTest.java

@@ -21,22 +21,17 @@ import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.domain.Specification;
 
 import java.time.LocalDate;
-import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyInt;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class DocumentServiceSortTest {
 
-    private static final Pageable PAGE = org.springframework.data.domain.PageRequest.of(0, 10_000);
+    private static final Pageable UNPAGED = org.springframework.data.domain.PageRequest.of(0, 10_000);
 
     @Mock DocumentRepository documentRepository;
     @Mock PersonService personService;
@@ -48,12 +43,12 @@ class DocumentServiceSortTest {
     @Mock TranscriptionBlockQueryService transcriptionBlockQueryService;
     @InjectMocks DocumentService documentService;
 
-    // ─── DATE sort ────────────────────────────────────────────────────────────
+    // ─── searchDocuments — DATE sort ──────────────────────────────────────────
 
     @Test
     void searchDocuments_with_DATE_sort_and_text_sorts_chronologically_not_by_relevance() {
-        UUID id1 = UUID.randomUUID();  // higher relevance, older doc
-        UUID id2 = UUID.randomUUID();  // lower relevance, newer doc
+        UUID id1 = UUID.randomUUID();  // rank position 0 (higher relevance, older doc)
+        UUID id2 = UUID.randomUUID();  // rank position 1 (lower relevance, newer doc)
 
         Document older = Document.builder().id(id1)
                 .title("Brief").status(DocumentStatus.UPLOADED)
@@ -62,48 +57,38 @@ class DocumentServiceSortTest {
                 .title("Brief").status(DocumentStatus.UPLOADED)
                 .documentDate(LocalDate.of(1960, 1, 1)).build();
 
-        when(documentRepository.findAllMatchingIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        // FTS returns id1 first (higher rank), id2 second
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        // findAll(spec, pageable) — the correct date path — returns date-DESC order
         when(documentRepository.findAll(any(Specification.class), any(Pageable.class)))
                 .thenReturn(new PageImpl<>(List.of(newer, older)));
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.DATE, "DESC", null, PAGE);
+                "Brief", null, null, null, null, null, null, null, DocumentSort.DATE, "DESC", null, UNPAGED);
 
+        // Expect: date order (newer 1960 first), NOT rank order (older 1940 first)
         assertThat(result.items()).hasSize(2);
-        assertThat(result.items().get(0).document().getId()).isEqualTo(id2);  // newer first
+        assertThat(result.items().get(0).document().getId()).isEqualTo(id2);  // newer doc first
     }
 
-    // ─── RELEVANCE sort — pure text (no filters) ──────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_pureText_calls_findFtsPageRaw_not_findAllMatchingIds() {
-        UUID id1 = UUID.randomUUID();
-        List<Object[]> ftsRows = ftsRows(id1, 0.5d, 1L);
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any()))
-                .thenReturn(List.of(doc(id1)));
-
-        documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
-
-        verify(documentRepository).findFtsPageRaw(anyString(), anyInt(), anyInt());
-        verify(documentRepository, never()).findAllMatchingIdsByFts(anyString());
-    }
+    // ─── searchDocuments — RELEVANCE sort ─────────────────────────────────────
 
     @Test
     void searchDocuments_with_RELEVANCE_sort_and_text_preserves_fts_rank_order() {
-        UUID id1 = UUID.randomUUID();  // higher rank — must appear first
-        UUID id2 = UUID.randomUUID();  // lower rank
+        UUID id1 = UUID.randomUUID();  // rank position 0
+        UUID id2 = UUID.randomUUID();  // rank position 1
 
-        List<Object[]> ftsRows = new ArrayList<>();
-        ftsRows.add(new Object[]{id1, 0.8d, 2L});
-        ftsRows.add(new Object[]{id2, 0.3d, 2L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(id2), doc(id1))); // unordered from JPA
+        Document doc1 = Document.builder().id(id1).title("Brief").status(DocumentStatus.UPLOADED).build();
+        Document doc2 = Document.builder().id(id2).title("Brief").status(DocumentStatus.UPLOADED).build();
+
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        when(documentRepository.findAll(any(Specification.class)))
+                .thenReturn(List.of(doc2, doc1));  // unordered from DB
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
+                "Brief", null, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, UNPAGED);
 
+        // Expect: rank order restored (id1 first)
         assertThat(result.items().get(0).document().getId()).isEqualTo(id1);
     }
 
@@ -112,82 +97,16 @@ class DocumentServiceSortTest {
         UUID id1 = UUID.randomUUID();
         UUID id2 = UUID.randomUUID();
 
-        List<Object[]> ftsRows = new ArrayList<>();
-        ftsRows.add(new Object[]{id1, 0.8d, 2L});
-        ftsRows.add(new Object[]{id2, 0.3d, 2L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(id2), doc(id1)));
+        Document doc1 = Document.builder().id(id1).title("Brief").status(DocumentStatus.UPLOADED).build();
+        Document doc2 = Document.builder().id(id2).title("Brief").status(DocumentStatus.UPLOADED).build();
+
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(id1, id2));
+        when(documentRepository.findAll(any(Specification.class)))
+                .thenReturn(List.of(doc2, doc1));
 
         DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null, null, null, null, PAGE);
+                "Brief", null, null, null, null, null, null, null, null, null, null, UNPAGED);
 
         assertThat(result.items().get(0).document().getId()).isEqualTo(id1);
     }
-
-    // ─── RELEVANCE sort — overflow guard ─────────────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_returns_empty_when_offset_exceeds_maxInt() {
-        // offset = pageNumber * pageSize; choose values so offset > Integer.MAX_VALUE
-        Pageable hugePage = org.springframework.data.domain.PageRequest.of(Integer.MAX_VALUE / 10 + 1, 10);
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null,
-                DocumentSort.RELEVANCE, null, null, hugePage);
-
-        assertThat(result.items()).isEmpty();
-        verify(documentRepository, never()).findFtsPageRaw(anyString(), anyInt(), anyInt());
-    }
-
-    // ─── toFtsPage — UUID-as-String JDBC driver variance ────────────────────
-
-    @Test
-    void searchDocuments_relevance_handles_string_uuid_from_jdbc_driver() {
-        String stringId = "11111111-1111-1111-1111-111111111111";
-        UUID uuidId = UUID.fromString(stringId);
-        // Simulate a JDBC driver that returns the id column as String instead of UUID
-        List<Object[]> ftsRows = new ArrayList<>();
-        ftsRows.add(new Object[]{stringId, 0.5d, 1L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc(uuidId)));
-
-        DocumentSearchResult result = documentService.searchDocuments(
-                "Brief", null, null, null, null, null, null, null,
-                DocumentSort.RELEVANCE, null, null, PAGE);
-
-        assertThat(result.items()).hasSize(1);
-        assertThat(result.items().get(0).document().getId()).isEqualTo(uuidId);
-    }
-
-    // ─── RELEVANCE sort — text + active filter ────────────────────────────────
-
-    @Test
-    void searchDocuments_relevance_with_active_filter_uses_inMemory_path() {
-        UUID id1 = UUID.randomUUID();
-        UUID id2 = UUID.randomUUID();
-
-        when(documentRepository.findAllMatchingIdsByFts("Brief")).thenReturn(List.of(id1, id2));
-        when(documentRepository.findAll(any(Specification.class)))
-                .thenReturn(List.of(doc(id2), doc(id1)));
-
-        // sender filter is active → triggers in-memory path, not findFtsPageRaw
-        LocalDate from = LocalDate.of(1900, 1, 1);
-        documentService.searchDocuments(
-                "Brief", from, null, null, null, null, null, null, DocumentSort.RELEVANCE, null, null, PAGE);
-
-        verify(documentRepository, never()).findFtsPageRaw(anyString(), anyInt(), anyInt());
-        verify(documentRepository).findAllMatchingIdsByFts("Brief");
-    }
-
-    // ─── Helpers ──────────────────────────────────────────────────────────────
-
-    private static Document doc(UUID id) {
-        return Document.builder().id(id).title("Brief").status(DocumentStatus.UPLOADED).build();
-    }
-
-    private static List<Object[]> ftsRows(UUID id, double rank, long total) {
-        List<Object[]> rows = new ArrayList<>();
-        rows.add(new Object[]{id, rank, total});
-        return rows;
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/DocumentServiceTest.java

@@ -1620,10 +1620,9 @@ class DocumentServiceTest {
         // chr(1)=\u0001 marks start, chr(2)=\u0002 marks end of highlighted term
         List<Object[]> rows = Collections.singletonList(new Object[]{docId, "\u0001Brief\u0002 an Anna", null, false, null, null, null});
 
-        List<Object[]> ftsRows = new java.util.ArrayList<>();
-        ftsRows.add(new Object[]{docId, 0.5d, 1L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(ftsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc));
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(docId));
+        when(documentRepository.findAll(any(org.springframework.data.jpa.domain.Specification.class)))
+                .thenReturn(List.of(doc));
         when(documentRepository.findEnrichmentData(any(), eq("Brief"))).thenReturn(rows);
 
         DocumentSearchResult result = documentService.searchDocuments(
@@ -1655,10 +1654,9 @@ class DocumentServiceTest {
         String snippetHeadline = "Hier ist der \u0001Brief\u0002 aus Berlin";
         List<Object[]> rows = Collections.singletonList(new Object[]{docId, "Dok", snippetHeadline, false, null, null, null});
 
-        List<Object[]> snippetFtsRows = new java.util.ArrayList<>();
-        snippetFtsRows.add(new Object[]{docId, 0.5d, 1L});
-        when(documentRepository.findFtsPageRaw(anyString(), anyInt(), anyInt())).thenReturn(snippetFtsRows);
-        when(documentRepository.findAllById(any())).thenReturn(List.of(doc));
+        when(documentRepository.findRankedIdsByFts("Brief")).thenReturn(List.of(docId));
+        when(documentRepository.findAll(any(org.springframework.data.jpa.domain.Specification.class)))
+                .thenReturn(List.of(doc));
         when(documentRepository.findEnrichmentData(any(), eq("Brief"))).thenReturn(rows);
 
         DocumentSearchResult result = documentService.searchDocuments(
@@ -2204,7 +2202,7 @@ class DocumentServiceTest {
 
     @Test
     void findIdsForFilter_returnsEmpty_whenFtsHasNoMatches() {
-        when(documentRepository.findAllMatchingIdsByFts("xyz")).thenReturn(List.of());
+        when(documentRepository.findRankedIdsByFts("xyz")).thenReturn(List.of());
 
         List<UUID> result = documentService.findIdsForFilter(
                 "xyz", null, null, null, null, null, null, null, null);
@@ -2388,7 +2386,7 @@ class DocumentServiceTest {
 
     @Test
     void getDensity_shortCircuits_whenFtsReturnsNoMatches() {
-        when(documentRepository.findAllMatchingIdsByFts("xyz")).thenReturn(List.of());
+        when(documentRepository.findRankedIdsByFts("xyz")).thenReturn(List.of());
 
         DocumentDensityResult result = documentService.getDensity(
                 new DensityFilters("xyz", null, null, null, null, null, null));

backend/src/test/java/org/raddatz/familienarchiv/document/ThumbnailServiceIntegrationTest.java

@@ -10,7 +10,6 @@ import org.raddatz.familienarchiv.document.DocumentStatus;
 import org.raddatz.familienarchiv.document.DocumentRepository;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.test.context.ActiveProfiles;
 import org.springframework.context.annotation.Import;
 import org.springframework.test.context.DynamicPropertyRegistry;
 import org.springframework.test.context.DynamicPropertySource;
@@ -42,7 +41,6 @@ import static org.assertj.core.api.Assertions.assertThat;
  * test pyramid mocks at the FileService boundary.
  */
 @SpringBootTest
-@ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
 class ThumbnailServiceIntegrationTest {
 

backend/src/test/java/org/raddatz/familienarchiv/document/annotation/AnnotationControllerTest.java

@@ -31,7 +31,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(AnnotationController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -68,7 +67,7 @@ class AnnotationControllerTest {
 
     @Test
     void createAnnotation_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isUnauthorized());
@@ -77,7 +76,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser
     void createAnnotation_returns403_whenMissingAnnotatePermission() throws Exception {
-        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isForbidden());
@@ -93,7 +92,7 @@ class AnnotationControllerTest {
         when(documentService.getDocumentById(any())).thenReturn(Document.builder().build());
         when(annotationService.createAnnotation(any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + docId + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + docId + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isCreated());
@@ -102,7 +101,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void deleteAnnotation_returns204_whenHasWriteAllPermission() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
                 .andExpect(status().isNoContent());
     }
 
@@ -116,7 +115,7 @@ class AnnotationControllerTest {
         when(documentService.getDocumentById(any())).thenReturn(Document.builder().build());
         when(annotationService.createAnnotation(any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + docId + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + docId + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isCreated())
@@ -134,7 +133,7 @@ class AnnotationControllerTest {
         when(documentService.getDocumentById(any())).thenReturn(Document.builder().build());
         when(annotationService.createAnnotation(any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + docId + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + docId + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isCreated());
@@ -144,28 +143,28 @@ class AnnotationControllerTest {
 
     @Test
     void deleteAnnotation_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void deleteAnnotation_returns403_whenMissingAnnotatePermission() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void deleteAnnotation_returns403_whenUserHasOnlyReadAllPermission() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "ANNOTATE_ALL")
     void deleteAnnotation_returns204_whenHasAnnotatePermission() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()))
                 .andExpect(status().isNoContent());
     }
 
@@ -175,7 +174,7 @@ class AnnotationControllerTest {
 
     @Test
     void patchAnnotation_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(PATCH_JSON))
                 .andExpect(status().isUnauthorized());
@@ -184,7 +183,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser
     void patchAnnotation_returns403_withoutPermission() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(PATCH_JSON))
                 .andExpect(status().isForbidden());
@@ -200,7 +199,7 @@ class AnnotationControllerTest {
                 .x(0.2).y(0.3).width(0.2).height(0.2).color("#ff0000").build();
         when(annotationService.updateAnnotation(any(), any(), any())).thenReturn(updated);
 
-        mockMvc.perform(patch("/api/documents/" + docId + "/annotations/" + annotId).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + docId + "/annotations/" + annotId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(PATCH_JSON))
                 .andExpect(status().isOk())
@@ -218,7 +217,7 @@ class AnnotationControllerTest {
                 .x(0.2).y(0.3).width(0.2).height(0.2).color("#ff0000").build();
         when(annotationService.updateAnnotation(any(), any(), any())).thenReturn(updated);
 
-        mockMvc.perform(patch("/api/documents/" + docId + "/annotations/" + annotId).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + docId + "/annotations/" + annotId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(PATCH_JSON))
                 .andExpect(status().isOk());
@@ -230,7 +229,7 @@ class AnnotationControllerTest {
         when(annotationService.updateAnnotation(any(), any(), any()))
                 .thenThrow(DomainException.notFound(ErrorCode.ANNOTATION_NOT_FOUND, "not found"));
 
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(PATCH_JSON))
                 .andExpect(status().isNotFound());
@@ -239,7 +238,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchAnnotation_returns400_withOutOfBoundsCoordinates() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"x\":-0.1,\"y\":0.3}"))
                 .andExpect(status().isBadRequest());
@@ -248,7 +247,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchAnnotation_returns400_withWidthBelowMinimum() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"width\":0.005}"))
                 .andExpect(status().isBadRequest());
@@ -257,7 +256,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchAnnotation_returns400_withHeightBelowMinimum() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"height\":0.005}"))
                 .andExpect(status().isBadRequest());
@@ -266,7 +265,7 @@ class AnnotationControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void patchAnnotation_returns400_withXAboveMaximum() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + UUID.randomUUID() + "/annotations/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"x\":1.1}"))
                 .andExpect(status().isBadRequest());
@@ -277,7 +276,7 @@ class AnnotationControllerTest {
     @Test
     void createAnnotation_returns401_whenUnauthenticated_resolveUserIdReturnsNull() throws Exception {
         // authentication == null → resolveUserId returns null
-        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + UUID.randomUUID() + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isUnauthorized());
@@ -295,7 +294,7 @@ class AnnotationControllerTest {
         when(documentService.getDocumentById(any())).thenReturn(Document.builder().build());
         when(annotationService.createAnnotation(any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + docId + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + docId + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isCreated());
@@ -313,7 +312,7 @@ class AnnotationControllerTest {
         when(documentService.getDocumentById(any())).thenReturn(Document.builder().build());
         when(annotationService.createAnnotation(any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + docId + "/annotations").with(csrf())
+        mockMvc.perform(post("/api/documents/" + docId + "/annotations")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(ANNOTATION_JSON))
                 .andExpect(status().isCreated());

backend/src/test/java/org/raddatz/familienarchiv/document/comment/CommentControllerTest.java

@@ -27,7 +27,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(CommentController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -45,14 +44,6 @@ class CommentControllerTest {
 
     // ─── Block comment endpoints ─────────────────────────────────────────────
 
-    @Test
-    @WithMockUser
-    void getBlockComments_returns400_when_documentId_is_not_a_UUID() throws Exception {
-        UUID blockId = UUID.randomUUID();
-        mockMvc.perform(get("/api/documents/NOT-A-UUID/transcription-blocks/" + blockId + "/comments"))
-                .andExpect(status().isBadRequest());
-    }
-
     @Test
     @WithMockUser
     void getBlockComments_returns200() throws Exception {
@@ -71,7 +62,7 @@ class CommentControllerTest {
                 .id(UUID.randomUUID()).documentId(DOC_ID).blockId(blockId).content("Nice").build();
         when(commentService.postBlockComment(any(), any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments").with(csrf())
+        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isCreated())
                 .andExpect(jsonPath("$.blockId").value(blockId.toString()));
@@ -80,7 +71,7 @@ class CommentControllerTest {
     @Test
     void postBlockComment_returns401_whenUnauthenticated() throws Exception {
         UUID blockId = UUID.randomUUID();
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments").with(csrf())
+        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isUnauthorized());
     }
@@ -89,7 +80,7 @@ class CommentControllerTest {
     @WithMockUser
     void postBlockComment_returns403_whenMissingPermission() throws Exception {
         UUID blockId = UUID.randomUUID();
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments").with(csrf())
+        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isForbidden());
     }
@@ -102,7 +93,7 @@ class CommentControllerTest {
                 .id(UUID.randomUUID()).documentId(DOC_ID).blockId(blockId).content("Nice").build();
         when(commentService.postBlockComment(any(), any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments").with(csrf())
+        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isCreated());
     }
@@ -117,27 +108,18 @@ class CommentControllerTest {
                 .id(UUID.randomUUID()).documentId(DOC_ID).blockId(blockId).content("Test comment").build();
         when(commentService.postBlockComment(any(), any(), any(), any(), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments").with(csrf())
+        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId + "/comments")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isCreated());
     }
 
     // ─── Block reply endpoints ───────────────────────────────────────────────
 
-    @Test
-    @WithMockUser(authorities = "ANNOTATE_ALL")
-    void replyToBlockComment_returns400_when_blockId_is_not_a_UUID() throws Exception {
-        mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/NOT-A-UUID"
-                                + "/comments/" + COMMENT_ID + "/replies").with(csrf())
-                        .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
-                .andExpect(status().isBadRequest());
-    }
-
     @Test
     void replyToBlockComment_returns401_whenUnauthenticated() throws Exception {
         UUID blockId = UUID.randomUUID();
         mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId
-                                + "/comments/" + COMMENT_ID + "/replies").with(csrf())
+                                + "/comments/" + COMMENT_ID + "/replies")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isUnauthorized());
     }
@@ -152,7 +134,7 @@ class CommentControllerTest {
         when(commentService.replyToComment(any(), any(), any(), any(), any())).thenReturn(saved);
 
         mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId
-                                + "/comments/" + COMMENT_ID + "/replies").with(csrf())
+                                + "/comments/" + COMMENT_ID + "/replies")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isCreated());
     }
@@ -167,7 +149,7 @@ class CommentControllerTest {
         when(commentService.replyToComment(any(), any(), any(), any(), any())).thenReturn(saved);
 
         mockMvc.perform(post("/api/documents/" + DOC_ID + "/transcription-blocks/" + blockId
-                                + "/comments/" + COMMENT_ID + "/replies").with(csrf())
+                                + "/comments/" + COMMENT_ID + "/replies")
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isCreated());
     }
@@ -176,7 +158,7 @@ class CommentControllerTest {
 
     @Test
     void editComment_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID)
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isUnauthorized());
     }
@@ -188,7 +170,7 @@ class CommentControllerTest {
                 .id(COMMENT_ID).documentId(DOC_ID).authorName("Hans").content("Test comment").build();
         when(commentService.editComment(any(), any(), any(), any())).thenReturn(updated);
 
-        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID)
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isOk());
     }
@@ -200,7 +182,7 @@ class CommentControllerTest {
                 .id(COMMENT_ID).documentId(DOC_ID).authorName("Hans").content("Test comment").build();
         when(commentService.editComment(any(), any(), any(), any())).thenReturn(updated);
 
-        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID).with(csrf())
+        mockMvc.perform(patch("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID)
                         .contentType(MediaType.APPLICATION_JSON).content(COMMENT_JSON))
                 .andExpect(status().isOk());
     }
@@ -209,14 +191,14 @@ class CommentControllerTest {
 
     @Test
     void deleteComment_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void deleteComment_returns204_whenAuthenticated() throws Exception {
-        mockMvc.perform(delete("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID).with(csrf()))
+        mockMvc.perform(delete("/api/documents/" + DOC_ID + "/comments/" + COMMENT_ID))
                 .andExpect(status().isNoContent());
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/document/transcription/TranscriptionBlockControllerTest.java

@@ -28,7 +28,6 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(TranscriptionBlockController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -144,7 +143,7 @@ class TranscriptionBlockControllerTest {
 
     @Test
     void createBlock_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(CREATE_JSON))
                 .andExpect(status().isUnauthorized());
@@ -153,7 +152,7 @@ class TranscriptionBlockControllerTest {
     @Test
     @WithMockUser
     void createBlock_returns403_whenMissingWriteAllPermission() throws Exception {
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(CREATE_JSON))
                 .andExpect(status().isForbidden());
@@ -165,7 +164,7 @@ class TranscriptionBlockControllerTest {
         when(userService.findByEmail(any())).thenReturn(mockUser());
         when(transcriptionService.createBlock(eq(DOC_ID), any(), any())).thenReturn(sampleBlock());
 
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(CREATE_JSON))
                 .andExpect(status().isCreated())
@@ -178,7 +177,7 @@ class TranscriptionBlockControllerTest {
     void createBlock_returns401_whenUserNotFoundInDatabase() throws Exception {
         when(userService.findByEmail(any())).thenReturn(null);
 
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(CREATE_JSON))
                 .andExpect(status().isUnauthorized());
@@ -193,7 +192,7 @@ class TranscriptionBlockControllerTest {
                 + "\"mentionedPersons\":[{\"personId\":\"" + UUID.randomUUID()
                 + "\",\"displayName\":\"" + longName + "\"}]}";
 
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest())
@@ -207,7 +206,7 @@ class TranscriptionBlockControllerTest {
         String body = "{\"pageNumber\":1,\"x\":0.1,\"y\":0.2,\"width\":0.3,\"height\":0.4,\"text\":\"x\","
                 + "\"mentionedPersons\":[{\"personId\":null,\"displayName\":\"Auguste Raddatz\"}]}";
 
-        mockMvc.perform(post(URL_BASE).with(csrf())
+        mockMvc.perform(post(URL_BASE)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest())
@@ -218,7 +217,7 @@ class TranscriptionBlockControllerTest {
 
     @Test
     void updateBlock_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(UPDATE_JSON))
                 .andExpect(status().isUnauthorized());
@@ -227,7 +226,7 @@ class TranscriptionBlockControllerTest {
     @Test
     @WithMockUser
     void updateBlock_returns403_whenMissingWriteAllPermission() throws Exception {
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(UPDATE_JSON))
                 .andExpect(status().isForbidden());
@@ -244,7 +243,7 @@ class TranscriptionBlockControllerTest {
         when(transcriptionService.updateBlock(eq(DOC_ID), eq(BLOCK_ID), any(), any()))
                 .thenReturn(updated);
 
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(UPDATE_JSON))
                 .andExpect(status().isOk())
@@ -260,7 +259,7 @@ class TranscriptionBlockControllerTest {
         String body = "{\"text\":\"x\",\"mentionedPersons\":[{\"personId\":\""
                 + UUID.randomUUID() + "\",\"displayName\":\"" + longName + "\"}]}";
 
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest())
@@ -273,7 +272,7 @@ class TranscriptionBlockControllerTest {
         when(userService.findByEmail(any())).thenReturn(mockUser());
         String body = "{\"text\":\"x\",\"mentionedPersons\":[{\"personId\":null,\"displayName\":\"Auguste Raddatz\"}]}";
 
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(body))
                 .andExpect(status().isBadRequest())
@@ -287,7 +286,7 @@ class TranscriptionBlockControllerTest {
         when(transcriptionService.updateBlock(any(), any(), any(), any()))
                 .thenThrow(DomainException.notFound(ErrorCode.TRANSCRIPTION_BLOCK_NOT_FOUND, "not found"));
 
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(UPDATE_JSON))
                 .andExpect(status().isNotFound());
@@ -298,7 +297,7 @@ class TranscriptionBlockControllerTest {
     void updateBlock_returns401_whenUserNotFoundInDatabase() throws Exception {
         when(userService.findByEmail(any())).thenReturn(null);
 
-        mockMvc.perform(put(URL_BLOCK).with(csrf())
+        mockMvc.perform(put(URL_BLOCK)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(UPDATE_JSON))
                 .andExpect(status().isUnauthorized());
@@ -308,28 +307,28 @@ class TranscriptionBlockControllerTest {
 
     @Test
     void deleteBlock_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete(URL_BLOCK).with(csrf()))
+        mockMvc.perform(delete(URL_BLOCK))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void deleteBlock_returns403_whenMissingWriteAllPermission() throws Exception {
-        mockMvc.perform(delete(URL_BLOCK).with(csrf()))
+        mockMvc.perform(delete(URL_BLOCK))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void deleteBlock_returns403_whenUserHasOnlyReadAllPermission() throws Exception {
-        mockMvc.perform(delete(URL_BLOCK).with(csrf()))
+        mockMvc.perform(delete(URL_BLOCK))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void deleteBlock_returns204_whenAuthorised() throws Exception {
-        mockMvc.perform(delete(URL_BLOCK).with(csrf()))
+        mockMvc.perform(delete(URL_BLOCK))
                 .andExpect(status().isNoContent());
     }
 
@@ -340,7 +339,7 @@ class TranscriptionBlockControllerTest {
                 DomainException.notFound(ErrorCode.TRANSCRIPTION_BLOCK_NOT_FOUND, "not found"))
                 .when(transcriptionService).deleteBlock(any(), any());
 
-        mockMvc.perform(delete(URL_BLOCK).with(csrf()))
+        mockMvc.perform(delete(URL_BLOCK))
                 .andExpect(status().isNotFound());
     }
 
@@ -348,7 +347,7 @@ class TranscriptionBlockControllerTest {
 
     @Test
     void reorderBlocks_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put(URL_REORDER).with(csrf())
+        mockMvc.perform(put(URL_REORDER)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(REORDER_JSON))
                 .andExpect(status().isUnauthorized());
@@ -357,7 +356,7 @@ class TranscriptionBlockControllerTest {
     @Test
     @WithMockUser
     void reorderBlocks_returns403_whenMissingWriteAllPermission() throws Exception {
-        mockMvc.perform(put(URL_REORDER).with(csrf())
+        mockMvc.perform(put(URL_REORDER)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(REORDER_JSON))
                 .andExpect(status().isForbidden());
@@ -368,7 +367,7 @@ class TranscriptionBlockControllerTest {
     void reorderBlocks_returns200_withReorderedBlocks_whenAuthorised() throws Exception {
         when(transcriptionService.listBlocks(DOC_ID)).thenReturn(List.of(sampleBlock()));
 
-        mockMvc.perform(put(URL_REORDER).with(csrf())
+        mockMvc.perform(put(URL_REORDER)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(REORDER_JSON))
                 .andExpect(status().isOk())
@@ -435,7 +434,7 @@ class TranscriptionBlockControllerTest {
         when(transcriptionService.reviewBlock(eq(DOC_ID), eq(BLOCK_ID), any())).thenReturn(reviewed);
 
         mockMvc.perform(put("/api/documents/{documentId}/transcription-blocks/{blockId}/review",
-                        DOC_ID, BLOCK_ID).with(csrf()))
+                        DOC_ID, BLOCK_ID))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.reviewed").value(true));
     }
@@ -446,14 +445,14 @@ class TranscriptionBlockControllerTest {
 
     @Test
     void markAllBlocksReviewed_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put(URL_REVIEW_ALL).with(csrf()))
+        mockMvc.perform(put(URL_REVIEW_ALL))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void markAllBlocksReviewed_returns403_whenMissingWriteAllPermission() throws Exception {
-        mockMvc.perform(put(URL_REVIEW_ALL).with(csrf()))
+        mockMvc.perform(put(URL_REVIEW_ALL))
                 .andExpect(status().isForbidden());
     }
 
@@ -470,7 +469,7 @@ class TranscriptionBlockControllerTest {
         when(transcriptionService.markAllBlocksReviewed(eq(DOC_ID), any()))
                 .thenReturn(List.of(b1, b2));
 
-        mockMvc.perform(put(URL_REVIEW_ALL).with(csrf()))
+        mockMvc.perform(put(URL_REVIEW_ALL))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$").isArray())
                 .andExpect(jsonPath("$[0].reviewed").value(true))
@@ -484,7 +483,7 @@ class TranscriptionBlockControllerTest {
         when(transcriptionService.markAllBlocksReviewed(eq(DOC_ID), any()))
                 .thenReturn(List.of());
 
-        mockMvc.perform(put(URL_REVIEW_ALL).with(csrf()))
+        mockMvc.perform(put(URL_REVIEW_ALL))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$").isArray())
                 .andExpect(jsonPath("$").isEmpty());
@@ -495,7 +494,7 @@ class TranscriptionBlockControllerTest {
     void markAllBlocksReviewed_returns401_whenUserNotFoundInDatabase() throws Exception {
         when(userService.findByEmail(any())).thenReturn(null);
 
-        mockMvc.perform(put(URL_REVIEW_ALL).with(csrf()))
+        mockMvc.perform(put(URL_REVIEW_ALL))
                 .andExpect(status().isUnauthorized());
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/exception/GlobalExceptionHandlerTest.java

@@ -1,33 +0,0 @@
-package org.raddatz.familienarchiv.exception;
-
-import io.sentry.Sentry;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
-import org.mockito.MockedStatic;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.http.ResponseEntity;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.Mockito.mockStatic;
-
-@ExtendWith(MockitoExtension.class)
-class GlobalExceptionHandlerTest {
-
-    @InjectMocks
-    private GlobalExceptionHandler handler;
-
-    @Test
-    void handleGeneric_captures_exception_in_sentry_and_returns_500() {
-        RuntimeException ex = new RuntimeException("unexpected failure");
-
-        try (MockedStatic<Sentry> sentryMock = mockStatic(Sentry.class)) {
-            ResponseEntity<GlobalExceptionHandler.ErrorResponse> response = handler.handleGeneric(ex);
-
-            sentryMock.verify(() -> Sentry.captureException(ex));
-            assertThat(response.getStatusCode().value()).isEqualTo(500);
-            assertThat(response.getBody()).isNotNull();
-            assertThat(response.getBody().code()).isEqualTo(ErrorCode.INTERNAL_ERROR);
-        }
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/geschichte/GeschichteControllerTest.java

@@ -36,7 +36,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(GeschichteController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -131,7 +130,7 @@ class GeschichteControllerTest {
 
     @Test
     void create_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/geschichten").with(csrf())
+        mockMvc.perform(post("/api/geschichten")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"title\":\"x\"}"))
                 .andExpect(status().isUnauthorized());
@@ -140,7 +139,7 @@ class GeschichteControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void create_returns403_whenLackingBlogWrite() throws Exception {
-        mockMvc.perform(post("/api/geschichten").with(csrf())
+        mockMvc.perform(post("/api/geschichten")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"title\":\"x\"}"))
                 .andExpect(status().isForbidden());
@@ -156,7 +155,7 @@ class GeschichteControllerTest {
         GeschichteUpdateDTO dto = new GeschichteUpdateDTO();
         dto.setTitle("New");
 
-        mockMvc.perform(post("/api/geschichten").with(csrf())
+        mockMvc.perform(post("/api/geschichten")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(dto)))
                 .andExpect(status().isCreated())
@@ -168,7 +167,7 @@ class GeschichteControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void update_returns403_whenLackingBlogWrite() throws Exception {
-        mockMvc.perform(patch("/api/geschichten/{id}", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(patch("/api/geschichten/{id}", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isForbidden());
@@ -181,7 +180,7 @@ class GeschichteControllerTest {
         when(geschichteService.update(eq(id), any(GeschichteUpdateDTO.class)))
                 .thenReturn(published(id, "Updated"));
 
-        mockMvc.perform(patch("/api/geschichten/{id}", id).with(csrf())
+        mockMvc.perform(patch("/api/geschichten/{id}", id)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"status\":\"PUBLISHED\"}"))
                 .andExpect(status().isOk())
@@ -193,7 +192,7 @@ class GeschichteControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void delete_returns403_whenLackingBlogWrite() throws Exception {
-        mockMvc.perform(delete("/api/geschichten/{id}", UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/geschichten/{id}", UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
@@ -202,7 +201,7 @@ class GeschichteControllerTest {
     void delete_returns204_withBlogWrite() throws Exception {
         UUID id = UUID.randomUUID();
 
-        mockMvc.perform(delete("/api/geschichten/{id}", id).with(csrf()))
+        mockMvc.perform(delete("/api/geschichten/{id}", id))
                 .andExpect(status().isNoContent());
 
         verify(geschichteService).delete(id);

backend/src/test/java/org/raddatz/familienarchiv/geschichte/GeschichteServiceIntegrationTest.java

@@ -19,9 +19,9 @@ import org.springframework.context.annotation.Import;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.annotation.Transactional;
 import software.amazon.awssdk.services.s3.S3Client;
 
 import java.util.List;
@@ -32,7 +32,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
-@Transactional
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class GeschichteServiceIntegrationTest {
 
     @MockitoBean

backend/src/test/java/org/raddatz/familienarchiv/importing/MassImportServiceTest.java

@@ -20,13 +20,7 @@ import software.amazon.awssdk.core.sync.RequestBody;
 import software.amazon.awssdk.services.s3.S3Client;
 import software.amazon.awssdk.services.s3.model.PutObjectRequest;
 
-import org.apache.poi.xssf.usermodel.XSSFWorkbook;
-import org.xml.sax.SAXParseException;
-
 import java.io.File;
-import java.io.OutputStream;
-import java.io.ByteArrayOutputStream;
-import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.LocalDate;
@@ -35,8 +29,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipOutputStream;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -58,7 +50,6 @@ class MassImportServiceTest {
     void setUp() {
         service = new MassImportService(documentService, personService, tagService, s3Client, thumbnailAsyncRunner);
         ReflectionTestUtils.setField(service, "bucketName", "test-bucket");
-        ReflectionTestUtils.setField(service, "importDir", "/import");
         ReflectionTestUtils.setField(service, "colIndex", 0);
         ReflectionTestUtils.setField(service, "colBox", 1);
         ReflectionTestUtils.setField(service, "colFolder", 2);
@@ -78,64 +69,20 @@ class MassImportServiceTest {
         assertThat(service.getStatus().state()).isEqualTo(MassImportService.State.IDLE);
     }
 
-    @Test
-    void getStatus_hasStatusCode_IMPORT_IDLE_byDefault() {
-        assertThat(service.getStatus().statusCode()).isEqualTo("IMPORT_IDLE");
-    }
-
     // ─── runImportAsync ───────────────────────────────────────────────────────
 
     @Test
     void runImportAsync_setsFailedStatus_whenImportDirectoryDoesNotExist() {
-        // /import directory doesn't exist in test environment → IOException → IMPORT_FAILED_INTERNAL
+        // /import directory doesn't exist in test environment → findSpreadsheetFile throws
         service.runImportAsync();
 
         assertThat(service.getStatus().state()).isEqualTo(MassImportService.State.FAILED);
-        assertThat(service.getStatus().statusCode()).isEqualTo("IMPORT_FAILED_INTERNAL");
-    }
-
-    @Test
-    void runImportAsync_readsFromConfiguredImportDir(@TempDir Path tempDir) {
-        // Empty temp dir → findSpreadsheetFile throws "no spreadsheet" with the
-        // configured path in the message. Proves the field, not a constant,
-        // drives the lookup.
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().state()).isEqualTo(MassImportService.State.FAILED);
-        assertThat(service.getStatus().message()).contains(tempDir.toString());
-    }
-
-    @Test
-    void runImportAsync_setsStatusCode_IMPORT_FAILED_NO_SPREADSHEET_whenDirIsEmpty(@TempDir Path tempDir) {
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().statusCode()).isEqualTo("IMPORT_FAILED_NO_SPREADSHEET");
-    }
-
-    @Test
-    void runImportAsync_setsStatusCode_IMPORT_DONE_whenSpreadsheetHasNoDataRows(@TempDir Path tempDir) throws Exception {
-        Path xlsx = tempDir.resolve("import.xlsx");
-        try (XSSFWorkbook wb = new XSSFWorkbook()) {
-            wb.createSheet("Sheet1");
-            try (OutputStream out = Files.newOutputStream(xlsx)) {
-                wb.write(out);
-            }
-        }
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().statusCode()).isEqualTo("IMPORT_DONE");
     }
 
     @Test
     void runImportAsync_throwsConflict_whenAlreadyRunning() {
         MassImportService.ImportStatus running = new MassImportService.ImportStatus(
-                MassImportService.State.RUNNING, "IMPORT_RUNNING", "Running...", 0, List.of(), LocalDateTime.now());
+                MassImportService.State.RUNNING, "Running...", 0, LocalDateTime.now());
         ReflectionTestUtils.setField(service, "currentStatus", running);
 
         assertThatThrownBy(() -> service.runImportAsync())
@@ -154,76 +101,9 @@ class MassImportServiceTest {
                 .build();
         when(documentService.findByOriginalFilename("doc001.pdf")).thenReturn(Optional.of(existing));
 
-        Optional<String> result = service.importSingleDocument(minimalCells("doc001.pdf"), Optional.empty(), "doc001.pdf", "doc001");
+        service.importSingleDocument(minimalCells("doc001.pdf"), Optional.empty(), "doc001.pdf", "doc001");
 
         verify(documentService, never()).save(any());
-        assertThat(result).isPresent().contains("ALREADY_EXISTS");
-    }
-
-    // ─── importSingleDocument — already-exists guard fires before file I/O ─────
-
-    @Test
-    void importSingleDocument_skipsWithAlreadyExists_whenDocumentUploadedAndFileIsPresent(@TempDir Path tempDir) throws Exception {
-        // Document already exists with status UPLOADED (not PLACEHOLDER).
-        // A physical PDF file is also present on disk (valid magic bytes).
-        // Expected: ALREADY_EXISTS is returned and no S3 upload is attempted —
-        // the guard fires before any file I/O, so no partial processing occurs.
-        Document existing = Document.builder()
-                .id(UUID.randomUUID())
-                .originalFilename("present.pdf")
-                .status(DocumentStatus.UPLOADED)
-                .build();
-        when(documentService.findByOriginalFilename("present.pdf")).thenReturn(Optional.of(existing));
-
-        Path physicalFile = tempDir.resolve("present.pdf");
-        byte[] pdfHeader = {0x25, 0x50, 0x44, 0x46, 0x2D}; // %PDF-
-        Files.write(physicalFile, pdfHeader);
-
-        Optional<String> result = service.importSingleDocument(
-                minimalCells("present.pdf"), Optional.of(physicalFile.toFile()), "present.pdf", "present");
-
-        assertThat(result).isPresent().contains("ALREADY_EXISTS");
-        verify(s3Client, never()).putObject(any(PutObjectRequest.class), any(RequestBody.class));
-        verify(documentService, never()).save(any());
-    }
-
-    // ─── importSingleDocument — S3 failure surfaced in skippedFiles ──────────
-
-    @Test
-    void runImportAsync_addsS3UploadFailed_toSkippedFiles_whenS3Throws(@TempDir Path tempDir) throws Exception {
-        byte[] pdfHeader = {0x25, 0x50, 0x44, 0x46, 0x2D}; // %PDF-
-        Files.write(tempDir.resolve("upload_fail.pdf"), pdfHeader);
-        buildMinimalImportXlsx(tempDir, "upload_fail.pdf");
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-        when(documentService.findByOriginalFilename("upload_fail.pdf")).thenReturn(Optional.empty());
-        doThrow(new RuntimeException("S3 unavailable"))
-                .when(s3Client).putObject(any(PutObjectRequest.class), any(RequestBody.class));
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().skipped()).isEqualTo(1);
-        assertThat(service.getStatus().skippedFiles())
-                .extracting(MassImportService.SkippedFile::filename, MassImportService.SkippedFile::reason)
-                .containsExactly(org.assertj.core.groups.Tuple.tuple("upload_fail.pdf", "S3_UPLOAD_FAILED"));
-    }
-
-    @Test
-    void runImportAsync_addsAlreadyExists_toSkippedFiles_whenDocumentAlreadyUploaded(@TempDir Path tempDir) throws Exception {
-        buildMinimalImportXlsx(tempDir, "existing.pdf");
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-        Document existing = Document.builder()
-                .id(UUID.randomUUID())
-                .originalFilename("existing.pdf")
-                .status(DocumentStatus.UPLOADED)
-                .build();
-        when(documentService.findByOriginalFilename("existing.pdf")).thenReturn(Optional.of(existing));
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().skipped()).isEqualTo(1);
-        assertThat(service.getStatus().skippedFiles())
-                .extracting(MassImportService.SkippedFile::reason)
-                .containsExactly("ALREADY_EXISTS");
     }
 
     // ─── importSingleDocument — create new document (metadata only) ───────────
@@ -275,7 +155,7 @@ class MassImportServiceTest {
     }
 
     @Test
-    void importSingleDocument_returnsS3UploadFailed_whenS3UploadFails(@TempDir Path tempDir) throws Exception {
+    void importSingleDocument_returnsEarly_whenS3UploadFails(@TempDir Path tempDir) throws Exception {
         Path tempFile = tempDir.resolve("fail.pdf");
         Files.write(tempFile, "data".getBytes());
 
@@ -283,11 +163,10 @@ class MassImportServiceTest {
         doThrow(new RuntimeException("S3 error"))
                 .when(s3Client).putObject(any(PutObjectRequest.class), any(RequestBody.class));
 
-        Optional<String> result = service.importSingleDocument(
+        service.importSingleDocument(
                 minimalCells("fail.pdf"), Optional.of(tempFile.toFile()), "fail.pdf", "fail");
 
         verify(documentService, never()).save(any());
-        assertThat(result).isPresent().contains("S3_UPLOAD_FAILED");
     }
 
     // ─── importSingleDocument — sender handling ───────────────────────────────
@@ -393,8 +272,8 @@ class MassImportServiceTest {
     @Test
     void processRows_returnsZero_whenOnlyHeaderRow() {
         List<List<String>> rows = List.of(List.of("header", "col1"));
-        MassImportService.ProcessResult result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
-        assertThat(result.processed()).isEqualTo(0);
+        Integer result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
+        assertThat(result).isEqualTo(0);
     }
 
     @Test
@@ -403,8 +282,8 @@ class MassImportServiceTest {
                 List.of("header"),
                 minimalCells("")  // blank index
         );
-        MassImportService.ProcessResult result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
-        assertThat(result.processed()).isEqualTo(0);
+        Integer result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
+        assertThat(result).isEqualTo(0);
         verify(documentService, never()).findByOriginalFilename(any());
     }
 
@@ -417,9 +296,9 @@ class MassImportServiceTest {
                 List.of("header"),
                 minimalCells("doc001")  // no dot → appends ".pdf"
         );
-        MassImportService.ProcessResult result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
+        Integer result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
 
-        assertThat(result.processed()).isEqualTo(1);
+        assertThat(result).isEqualTo(1);
         verify(documentService).findByOriginalFilename("doc001.pdf");
     }
 
@@ -432,9 +311,9 @@ class MassImportServiceTest {
                 List.of("header"),
                 minimalCells("doc002.pdf")  // has dot → used as-is
         );
-        MassImportService.ProcessResult result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
+        Integer result = ReflectionTestUtils.invokeMethod(service, "processRows", rows);
 
-        assertThat(result.processed()).isEqualTo(1);
+        assertThat(result).isEqualTo(1);
         verify(documentService).findByOriginalFilename("doc002.pdf");
     }
 
@@ -593,86 +472,6 @@ class MassImportServiceTest {
         assertThat(result).isEqualTo("hello");
     }
 
-    // ─── PDF magic byte validation regression ─────────────────────────────────
-
-    @Test
-    void runImportAsync_uploadsValidPdf_andSkipsFakeOne(@TempDir Path tempDir) throws Exception {
-        setupOneValidOneFakeImport(tempDir);
-
-        service.runImportAsync();
-
-        verify(s3Client, times(1)).putObject(any(PutObjectRequest.class), any(RequestBody.class));
-    }
-
-    @Test
-    void runImportAsync_setsSkippedCount_toOne_whenOneFakeFile(@TempDir Path tempDir) throws Exception {
-        setupOneValidOneFakeImport(tempDir);
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().skipped()).isEqualTo(1);
-    }
-
-    @Test
-    void runImportAsync_includesRejectedFilename_inSkippedFiles(@TempDir Path tempDir) throws Exception {
-        setupOneValidOneFakeImport(tempDir);
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().skippedFiles())
-                .extracting(MassImportService.SkippedFile::filename)
-                .contains("fake.pdf");
-    }
-
-    @Test
-    void runImportAsync_skipsFile_whenShorterThanFourBytes(@TempDir Path tempDir) throws Exception {
-        Files.write(tempDir.resolve("tiny.pdf"), new byte[]{0x25, 0x50, 0x44}); // only 3 bytes
-        buildMinimalImportXlsx(tempDir, "tiny.pdf");
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-        lenient().when(documentService.findByOriginalFilename(any())).thenReturn(Optional.empty());
-
-        service.runImportAsync();
-
-        assertThat(service.getStatus().skipped()).isEqualTo(1);
-    }
-
-    @Test
-    void runImportAsync_skipsFile_whenMagicBytesCheckThrowsIOException(@TempDir Path tempDir) throws Exception {
-        Files.writeString(tempDir.resolve("unreadable.pdf"), "some content");
-        buildMinimalImportXlsx(tempDir, "unreadable.pdf");
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-        lenient().when(documentService.findByOriginalFilename(any())).thenReturn(Optional.empty());
-
-        MassImportService spyService = spy(service);
-        doThrow(new java.io.IOException("simulated read error")).when(spyService).openFileStream(any(File.class));
-
-        spyService.runImportAsync();
-
-        assertThat(spyService.getStatus().skipped()).isEqualTo(1);
-        assertThat(spyService.getStatus().skippedFiles())
-                .extracting(MassImportService.SkippedFile::reason)
-                .containsExactly("FILE_READ_ERROR");
-    }
-
-    // ─── readOds — XXE security regression ───────────────────────────────────
-
-    // Security regression — do not remove.
-    @Test
-    void readOds_rejects_xxe_doctype_payload(@TempDir Path tempDir) throws Exception {
-        File malicious = buildXxeOds(tempDir, "file:///etc/hostname");
-        assertThatThrownBy(() -> service.readOds(malicious))
-                .isInstanceOf(SAXParseException.class)
-                .hasMessageContaining("DOCTYPE is disallowed");
-    }
-
-    @Test
-    void readOds_parses_valid_ods_correctly(@TempDir Path tempDir) throws Exception {
-        File valid = buildValidOds(tempDir, "Mustermann");
-        List<List<String>> rows = service.readOds(valid);
-        assertThat(rows).isNotEmpty();
-        assertThat(rows.get(0)).contains("Mustermann");
-    }
-
     // ─── helpers ──────────────────────────────────────────────────────────────
 
     /**
@@ -706,72 +505,4 @@ class MassImportServiceTest {
                 ""         // 13: transcription
         );
     }
-
-    /** Creates a minimal ODS ZIP containing a content.xml with an XXE payload. */
-    private File buildXxeOds(Path dir, String entityTarget) throws Exception {
-        String xml = "<?xml version=\"1.0\"?>"
-                + "<!DOCTYPE foo [<!ENTITY xxe SYSTEM \"" + entityTarget + "\">]>"
-                + "<office:document-content"
-                + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
-                + " xmlns:table=\"urn:oasis:names:tc:opendocument:xmlns:table:1.0\""
-                + " xmlns:text=\"urn:oasis:names:tc:opendocument:xmlns:text:1.0\">"
-                + "<office:body><office:spreadsheet>"
-                + "<table:table><table:table-row><table:table-cell>"
-                + "<text:p>&xxe;</text:p>"
-                + "</table:table-cell></table:table-row></table:table>"
-                + "</office:spreadsheet></office:body>"
-                + "</office:document-content>";
-        return writeOdsZip(dir.resolve("malicious.ods"), xml);
-    }
-
-    /** Creates a minimal valid ODS ZIP containing a content.xml with the given cell value.
-     *  cellValue must not contain XML metacharacters ({@code < > &}). */
-    private File buildValidOds(Path dir, String cellValue) throws Exception {
-        String xml = "<?xml version=\"1.0\"?>"
-                + "<office:document-content"
-                + " xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\""
-                + " xmlns:table=\"urn:oasis:names:tc:opendocument:xmlns:table:1.0\""
-                + " xmlns:text=\"urn:oasis:names:tc:opendocument:xmlns:text:1.0\">"
-                + "<office:body><office:spreadsheet>"
-                + "<table:table><table:table-row><table:table-cell>"
-                + "<text:p>" + cellValue + "</text:p>"
-                + "</table:table-cell></table:table-row></table:table>"
-                + "</office:spreadsheet></office:body>"
-                + "</office:document-content>";
-        return writeOdsZip(dir.resolve("valid.ods"), xml);
-    }
-
-    private File writeOdsZip(Path destination, String contentXml) throws Exception {
-        try (OutputStream fos = Files.newOutputStream(destination);
-             ZipOutputStream zip = new ZipOutputStream(fos)) {
-            zip.putNextEntry(new ZipEntry("content.xml"));
-            zip.write(contentXml.getBytes(StandardCharsets.UTF_8));
-            zip.closeEntry();
-        }
-        return destination.toFile();
-    }
-
-    private void setupOneValidOneFakeImport(Path tempDir) throws Exception {
-        byte[] pdfHeader = {0x25, 0x50, 0x44, 0x46, 0x2D}; // %PDF-
-        Files.write(tempDir.resolve("real.pdf"), pdfHeader);
-        Files.writeString(tempDir.resolve("fake.pdf"), "not a pdf");
-        buildMinimalImportXlsx(tempDir, "real.pdf", "fake.pdf");
-        ReflectionTestUtils.setField(service, "importDir", tempDir.toString());
-        when(documentService.findByOriginalFilename(any())).thenReturn(Optional.empty());
-        when(documentService.save(any())).thenAnswer(inv -> inv.getArgument(0));
-    }
-
-    private void buildMinimalImportXlsx(Path dir, String... filenames) throws Exception {
-        Path xlsx = dir.resolve("import.xlsx");
-        try (XSSFWorkbook wb = new XSSFWorkbook()) {
-            org.apache.poi.ss.usermodel.Sheet sheet = wb.createSheet("Sheet1");
-            sheet.createRow(0).createCell(0).setCellValue("Index");
-            for (int i = 0; i < filenames.length; i++) {
-                sheet.createRow(i + 1).createCell(0).setCellValue(filenames[i]);
-            }
-            try (OutputStream out = Files.newOutputStream(xlsx)) {
-                wb.write(out);
-            }
-        }
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/notification/NotificationControllerTest.java

@@ -35,7 +35,6 @@ import static org.mockito.Mockito.when;
 import static org.springframework.http.MediaType.TEXT_EVENT_STREAM_VALUE;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(NotificationController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -142,7 +141,7 @@ class NotificationControllerTest {
 
     @Test
     void markAllRead_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/notifications/read-all").with(csrf()))
+        mockMvc.perform(post("/api/notifications/read-all"))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -152,7 +151,7 @@ class NotificationControllerTest {
         AppUser user = AppUser.builder().id(USER_ID).email("testuser@example.com").build();
         when(userService.findByEmail("testuser")).thenReturn(user);
 
-        mockMvc.perform(post("/api/notifications/read-all").with(csrf()))
+        mockMvc.perform(post("/api/notifications/read-all"))
                 .andExpect(status().isNoContent());
 
         verify(notificationService).markAllRead(USER_ID);
@@ -162,7 +161,7 @@ class NotificationControllerTest {
 
     @Test
     void markOneRead_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(patch("/api/notifications/" + UUID.randomUUID() + "/read").with(csrf()))
+        mockMvc.perform(patch("/api/notifications/" + UUID.randomUUID() + "/read"))
                 .andExpect(status().isUnauthorized());
     }
 
@@ -177,7 +176,7 @@ class NotificationControllerTest {
                 org.raddatz.familienarchiv.exception.DomainException.forbidden("not yours"))
                 .when(notificationService).markRead(notifId, USER_ID);
 
-        mockMvc.perform(patch("/api/notifications/" + notifId + "/read").with(csrf()))
+        mockMvc.perform(patch("/api/notifications/" + notifId + "/read"))
                 .andExpect(status().isForbidden());
     }
 
@@ -257,7 +256,7 @@ class NotificationControllerTest {
                 .notifyOnReply(true).notifyOnMention(true).build();
         when(notificationService.updatePreferences(USER_ID, true, true)).thenReturn(updated);
 
-        mockMvc.perform(put("/api/users/me/notification-preferences").with(csrf())
+        mockMvc.perform(put("/api/users/me/notification-preferences")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"notifyOnReply\":true,\"notifyOnMention\":true}"))
                 .andExpect(status().isOk())
@@ -276,7 +275,7 @@ class NotificationControllerTest {
                 .notifyOnReply(true).notifyOnMention(false).build();
         when(notificationService.updatePreferences(USER_ID, true, false)).thenReturn(updated);
 
-        mockMvc.perform(put("/api/users/me/notification-preferences").with(csrf())
+        mockMvc.perform(put("/api/users/me/notification-preferences")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"notifyOnReply\":true,\"notifyOnMention\":false}"))
                 .andExpect(status().isOk())
@@ -338,7 +337,7 @@ class NotificationControllerTest {
         doThrow(DomainException.notFound(ErrorCode.NOTIFICATION_NOT_FOUND, "Notification not found: " + notifId))
                 .when(notificationService).markRead(notifId, USER_ID);
 
-        mockMvc.perform(patch("/api/notifications/" + notifId + "/read").with(csrf()))
+        mockMvc.perform(patch("/api/notifications/" + notifId + "/read"))
                 .andExpect(status().isNotFound());
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/ocr/OcrControllerTest.java

@@ -39,7 +39,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(OcrController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -67,7 +66,7 @@ class OcrControllerTest {
 
         when(ocrService.startOcr(eq(docId), eq(ScriptType.TYPEWRITER), any(), anyBoolean())).thenReturn(jobId);
 
-        mockMvc.perform(post("/api/documents/{id}/ocr", docId).with(csrf())
+        mockMvc.perform(post("/api/documents/{id}/ocr", docId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(dto)))
                 .andExpect(status().isAccepted())
@@ -81,7 +80,7 @@ class OcrControllerTest {
         when(ocrService.startOcr(eq(docId), any(), any(), anyBoolean()))
                 .thenThrow(DomainException.badRequest(ErrorCode.OCR_DOCUMENT_NOT_UPLOADED, "Not uploaded"));
 
-        mockMvc.perform(post("/api/documents/{id}/ocr", docId).with(csrf())
+        mockMvc.perform(post("/api/documents/{id}/ocr", docId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isBadRequest());
@@ -128,7 +127,7 @@ class OcrControllerTest {
 
         when(ocrBatchService.startBatch(eq(docIds), any())).thenReturn(jobId);
 
-        mockMvc.perform(post("/api/ocr/batch").with(csrf())
+        mockMvc.perform(post("/api/ocr/batch")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(dto)))
                 .andExpect(status().isAccepted())
@@ -180,14 +179,14 @@ class OcrControllerTest {
 
     @Test
     void triggerTraining_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/ocr/train").with(csrf()))
+        mockMvc.perform(post("/api/ocr/train"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void triggerTraining_returns403_whenNotAdmin() throws Exception {
-        mockMvc.perform(post("/api/ocr/train").with(csrf()))
+        mockMvc.perform(post("/api/ocr/train"))
                 .andExpect(status().isForbidden());
     }
 
@@ -197,7 +196,7 @@ class OcrControllerTest {
         when(ocrTrainingService.triggerTraining(any()))
                 .thenThrow(DomainException.conflict(ErrorCode.TRAINING_ALREADY_RUNNING, "Already running"));
 
-        mockMvc.perform(post("/api/ocr/train").with(csrf()))
+        mockMvc.perform(post("/api/ocr/train"))
                 .andExpect(status().isConflict());
     }
 
@@ -210,7 +209,7 @@ class OcrControllerTest {
                 .blockCount(10).documentCount(3).modelName("german_kurrent").build();
         when(ocrTrainingService.triggerTraining(any())).thenReturn(run);
 
-        mockMvc.perform(post("/api/ocr/train").with(csrf()))
+        mockMvc.perform(post("/api/ocr/train"))
                 .andExpect(status().isCreated())
                 .andExpect(jsonPath("$.status").value("DONE"))
                 .andExpect(jsonPath("$.blockCount").value(10));
@@ -366,7 +365,7 @@ class OcrControllerTest {
     @Test
     @WithMockUser(authorities = "ADMIN")
     void triggerSenderTraining_returns400_whenPersonIdIsNull() throws Exception {
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":null}"))
                 .andExpect(status().isBadRequest());
@@ -374,7 +373,7 @@ class OcrControllerTest {
 
     @Test
     void triggerSenderTraining_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isUnauthorized());
@@ -383,7 +382,7 @@ class OcrControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void triggerSenderTraining_returns403_whenNotAdmin() throws Exception {
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isForbidden());
@@ -396,7 +395,7 @@ class OcrControllerTest {
         when(senderModelService.triggerManualSenderTraining(unknownId))
                 .thenThrow(DomainException.notFound(ErrorCode.PERSON_NOT_FOUND, "Person not found"));
 
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + unknownId + "\"}"))
                 .andExpect(status().isNotFound());
@@ -411,7 +410,7 @@ class OcrControllerTest {
                 .personId(personId).blockCount(5).documentCount(0).modelName("sender_" + personId).build();
         when(senderModelService.triggerManualSenderTraining(personId)).thenReturn(run);
 
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + personId + "\"}"))
                 .andExpect(status().isAccepted())
@@ -427,7 +426,7 @@ class OcrControllerTest {
                 .personId(personId).blockCount(5).documentCount(0).modelName("sender_" + personId).build();
         when(senderModelService.triggerManualSenderTraining(personId)).thenReturn(run);
 
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + personId + "\"}"))
                 .andExpect(status().isAccepted())
@@ -443,7 +442,7 @@ class OcrControllerTest {
                 .personId(personId).blockCount(5).documentCount(0).modelName("sender_" + personId).build();
         when(senderModelService.triggerManualSenderTraining(personId)).thenReturn(run);
 
-        mockMvc.perform(post("/api/ocr/train-sender").with(csrf())
+        mockMvc.perform(post("/api/ocr/train-sender")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"personId\":\"" + personId + "\"}"))
                 .andExpect(status().isAccepted());

backend/src/test/java/org/raddatz/familienarchiv/person/PersonControllerTest.java

@@ -36,7 +36,6 @@ import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(PersonController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -218,7 +217,7 @@ class PersonControllerTest {
 
     @Test
     void createPerson_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\"}"))
                 .andExpect(status().isUnauthorized());
@@ -227,7 +226,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void createPerson_returns400_whenPersonTypeIsPerson_andFirstNameIsMissing() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -236,7 +235,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void createPerson_returns400_whenPersonTypeIsPerson_andFirstNameIsBlank() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"  \",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -245,7 +244,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void createPerson_returns400_whenLastNameIsMissing() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -254,7 +253,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void createPerson_returns400_whenLastNameIsBlank() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"  \",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -266,7 +265,7 @@ class PersonControllerTest {
         Person saved = Person.builder().id(UUID.randomUUID()).firstName("Hans").lastName("Müller").build();
         when(personService.createPerson(any(org.raddatz.familienarchiv.person.PersonUpdateDTO.class))).thenReturn(saved);
 
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isOk())
@@ -279,7 +278,7 @@ class PersonControllerTest {
         Person saved = Person.builder().id(UUID.randomUUID()).lastName("Verlag GmbH").build();
         when(personService.createPerson(any(org.raddatz.familienarchiv.person.PersonUpdateDTO.class))).thenReturn(saved);
 
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"Verlag GmbH\",\"personType\":\"INSTITUTION\"}"))
                 .andExpect(status().isOk())
@@ -294,7 +293,7 @@ class PersonControllerTest {
         Person saved = Person.builder().id(UUID.randomUUID()).firstName("Hans").lastName("Müller").build();
         when(personService.createPerson(captor.capture())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"title\":\"  Prof.  \",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isOk());
@@ -308,7 +307,7 @@ class PersonControllerTest {
         when(personService.createPerson(any())).thenThrow(
                 DomainException.badRequest(ErrorCode.INVALID_PERSON_TYPE, "SKIP is not a valid person type"));
 
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"Müller\",\"personType\":\"SKIP\"}"))
                 .andExpect(status().isBadRequest())
@@ -319,7 +318,7 @@ class PersonControllerTest {
 
     @Test
     void updatePerson_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\"}"))
                 .andExpect(status().isUnauthorized());
@@ -328,7 +327,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void updatePerson_returns400_whenPersonTypeIsPerson_andFirstNameIsBlank() throws Exception {
-        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -337,7 +336,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void updatePerson_returns400_whenLastNameIsNull() throws Exception {
-        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -350,7 +349,7 @@ class PersonControllerTest {
         Person updated = Person.builder().id(id).firstName("Hans").lastName("Müller").build();
         when(personService.updatePerson(eq(id), any())).thenReturn(updated);
 
-        mockMvc.perform(put("/api/persons/{id}", id).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", id)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isOk())
@@ -361,7 +360,7 @@ class PersonControllerTest {
 
     @Test
     void mergePerson_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetPersonId\":\"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isUnauthorized());
@@ -370,7 +369,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void mergePerson_returns400_whenTargetPersonIdIsMissing() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isBadRequest());
@@ -379,7 +378,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void mergePerson_returns400_whenTargetPersonIdIsBlank() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetPersonId\":\"  \"}"))
                 .andExpect(status().isBadRequest());
@@ -391,7 +390,7 @@ class PersonControllerTest {
         UUID sourceId = UUID.randomUUID();
         UUID targetId = UUID.randomUUID();
 
-        mockMvc.perform(post("/api/persons/{id}/merge", sourceId).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/merge", sourceId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetPersonId\":\"" + targetId + "\"}"))
                 .andExpect(status().isNoContent());
@@ -403,7 +402,7 @@ class PersonControllerTest {
     @WithMockUser(authorities = "WRITE_ALL")
     void updatePerson_returns400_whenLastNameIsBlank() throws Exception {
         UUID id = UUID.randomUUID();
-        mockMvc.perform(put("/api/persons/{id}", id).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", id)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"   \",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -419,7 +418,7 @@ class PersonControllerTest {
                 .alias("Oma Maria").birthYear(1901).deathYear(1975).notes("Some notes").build();
         when(personService.createPerson(any(org.raddatz.familienarchiv.person.PersonUpdateDTO.class))).thenReturn(saved);
 
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Maria\",\"lastName\":\"Raddatz\"," +
                                 "\"alias\":\"Oma Maria\",\"birthYear\":1901,\"deathYear\":1975," +
@@ -437,7 +436,7 @@ class PersonControllerTest {
     void updatePerson_returns400_whenNotesExceed5000Chars() throws Exception {
         String oversizedNotes = "x".repeat(5001);
         UUID id = UUID.randomUUID();
-        mockMvc.perform(put("/api/persons/{id}", id).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", id)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"notes\":\"" + oversizedNotes + "\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -448,7 +447,7 @@ class PersonControllerTest {
     void updatePerson_returns400_whenFirstNameExceeds100Chars() throws Exception {
         String oversizedFirstName = "x".repeat(101);
         UUID id = UUID.randomUUID();
-        mockMvc.perform(put("/api/persons/{id}", id).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", id)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"" + oversizedFirstName + "\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isBadRequest());
@@ -459,7 +458,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void createPerson_returns403_whenUserHasOnlyReadPermission() throws Exception {
-        mockMvc.perform(post("/api/persons").with(csrf())
+        mockMvc.perform(post("/api/persons")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isForbidden());
@@ -468,7 +467,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void updatePerson_returns403_whenUserHasOnlyReadPermission() throws Exception {
-        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/persons/{id}", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"firstName\":\"Hans\",\"lastName\":\"Müller\",\"personType\":\"PERSON\"}"))
                 .andExpect(status().isForbidden());
@@ -477,7 +476,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void mergePerson_returns403_whenUserHasOnlyReadPermission() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/merge", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetPersonId\":\"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isForbidden());
@@ -508,7 +507,7 @@ class PersonControllerTest {
                 .id(UUID.randomUUID()).lastName("de Gruyter").type(PersonNameAliasType.BIRTH).sortOrder(0).build();
         when(personService.addAlias(eq(personId), any())).thenReturn(saved);
 
-        mockMvc.perform(post("/api/persons/{id}/aliases", personId).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/aliases", personId)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"de Gruyter\",\"type\":\"BIRTH\"}"))
                 .andExpect(status().isOk())
@@ -518,7 +517,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void addAlias_returns403_withoutWritePermission() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"de Gruyter\",\"type\":\"BIRTH\"}"))
                 .andExpect(status().isForbidden());
@@ -532,7 +531,7 @@ class PersonControllerTest {
         UUID personId = UUID.randomUUID();
         UUID aliasId = UUID.randomUUID();
 
-        mockMvc.perform(delete("/api/persons/{id}/aliases/{aliasId}", personId, aliasId).with(csrf()))
+        mockMvc.perform(delete("/api/persons/{id}/aliases/{aliasId}", personId, aliasId))
                 .andExpect(status().isNoContent());
 
         verify(personService).removeAlias(personId, aliasId);
@@ -541,14 +540,14 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "READ_ALL")
     void removeAlias_returns403_withoutWritePermission() throws Exception {
-        mockMvc.perform(delete("/api/persons/{id}/aliases/{aliasId}", UUID.randomUUID(), UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/persons/{id}/aliases/{aliasId}", UUID.randomUUID(), UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void addAlias_returns400_whenLastNameIsBlank() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"\",\"type\":\"BIRTH\"}"))
                 .andExpect(status().isBadRequest());
@@ -557,7 +556,7 @@ class PersonControllerTest {
     @Test
     @WithMockUser(authorities = "WRITE_ALL")
     void addAlias_returns400_whenTypeIsNull() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID()).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/aliases", UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"lastName\":\"de Gruyter\"}"))
                 .andExpect(status().isBadRequest());

backend/src/test/java/org/raddatz/familienarchiv/person/PersonServiceIntegrationTest.java

@@ -8,9 +8,9 @@ import org.raddatz.familienarchiv.person.PersonRepository;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
+import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
-import org.springframework.transaction.annotation.Transactional;
 import software.amazon.awssdk.services.s3.S3Client;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -18,7 +18,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
-@Transactional
+@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class PersonServiceIntegrationTest {
 
     @MockitoBean S3Client s3Client;

backend/src/test/java/org/raddatz/familienarchiv/person/relationship/RelationshipControllerTest.java

@@ -28,7 +28,6 @@ import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(RelationshipController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -68,7 +67,7 @@ class RelationshipControllerTest {
     @Test
     @WithMockUser(username = "testuser", authorities = {"READ_ALL"})
     void addRelationship_returns403_for_user_with_READ_ALL_only() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"relatedPersonId\":\"" + OTHER_ID + "\",\"relationType\":\"PARENT_OF\"}"))
                 .andExpect(status().isForbidden());
@@ -77,14 +76,14 @@ class RelationshipControllerTest {
     @Test
     @WithMockUser(username = "testuser", authorities = {"READ_ALL"})
     void deleteRelationship_returns403_for_READ_ALL_only_user() throws Exception {
-        mockMvc.perform(delete("/api/persons/{id}/relationships/{relId}", PERSON_ID, UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/persons/{id}/relationships/{relId}", PERSON_ID, UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(username = "testuser", authorities = {"READ_ALL"})
     void patchFamilyMember_returns403_for_READ_ALL_only_user() throws Exception {
-        mockMvc.perform(patch("/api/persons/{id}/family-member", PERSON_ID).with(csrf())
+        mockMvc.perform(patch("/api/persons/{id}/family-member", PERSON_ID)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"familyMember\":true}"))
                 .andExpect(status().isForbidden());
@@ -126,7 +125,7 @@ class RelationshipControllerTest {
     @Test
     @WithMockUser(username = "testuser", authorities = {"WRITE_ALL"})
     void addRelationship_returns400_when_relationType_is_unknown_value() throws Exception {
-        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"relatedPersonId\":\"" + OTHER_ID + "\",\"relationType\":\"NOT_A_REAL_TYPE\"}"))
                 .andExpect(status().isBadRequest());
@@ -142,7 +141,7 @@ class RelationshipControllerTest {
                 RelationType.PARENT_OF, null, null, null);
         when(relationshipService.addRelationship(any(), any())).thenReturn(created);
 
-        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID).with(csrf())
+        mockMvc.perform(post("/api/persons/{id}/relationships", PERSON_ID)
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"relatedPersonId\":\"" + OTHER_ID + "\",\"relationType\":\"PARENT_OF\"}"))
                 .andExpect(status().isCreated())
@@ -155,7 +154,7 @@ class RelationshipControllerTest {
         UUID relId = UUID.randomUUID();
         doNothing().when(relationshipService).deleteRelationship(any(), any());
 
-        mockMvc.perform(delete("/api/persons/{id}/relationships/{relId}", PERSON_ID, relId).with(csrf()))
+        mockMvc.perform(delete("/api/persons/{id}/relationships/{relId}", PERSON_ID, relId))
                 .andExpect(status().isNoContent());
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/tag/TagControllerTest.java

@@ -29,7 +29,6 @@ import static org.mockito.Mockito.doThrow;
 import static org.mockito.ArgumentMatchers.any;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(TagController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -62,7 +61,7 @@ class TagControllerTest {
 
     @Test
     void updateTag_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put("/api/tags/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/tags/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"name\": \"New\"}"))
                 .andExpect(status().isUnauthorized());
@@ -71,7 +70,7 @@ class TagControllerTest {
     @Test
     @WithMockUser
     void updateTag_returns403_whenMissingAdminTagPermission() throws Exception {
-        mockMvc.perform(put("/api/tags/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/tags/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"name\": \"New\"}"))
                 .andExpect(status().isForbidden());
@@ -83,7 +82,7 @@ class TagControllerTest {
         Tag tag = Tag.builder().id(UUID.randomUUID()).name("New").build();
         when(tagService.update(any(), any())).thenReturn(tag);
 
-        mockMvc.perform(put("/api/tags/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/tags/" + UUID.randomUUID())
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"name\": \"New\"}"))
                 .andExpect(status().isOk());
@@ -117,7 +116,7 @@ class TagControllerTest {
 
     @Test
     void mergeTag_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge").with(csrf())
+        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetId\": \"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isUnauthorized());
@@ -126,7 +125,7 @@ class TagControllerTest {
     @Test
     @WithMockUser
     void mergeTag_returns403_whenMissingAdminTagPermission() throws Exception {
-        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge").with(csrf())
+        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetId\": \"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isForbidden());
@@ -135,7 +134,7 @@ class TagControllerTest {
     @Test
     @WithMockUser(authorities = "ADMIN_TAG")
     void mergeTag_returns400_whenTargetIdIsNull() throws Exception {
-        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge").with(csrf())
+        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isBadRequest());
@@ -147,7 +146,7 @@ class TagControllerTest {
         when(tagService.mergeTags(any(), any()))
                 .thenThrow(DomainException.notFound(ErrorCode.TAG_NOT_FOUND, "Tag not found"));
 
-        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge").with(csrf())
+        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetId\": \"" + UUID.randomUUID() + "\"}"))
                 .andExpect(status().isNotFound());
@@ -160,7 +159,7 @@ class TagControllerTest {
         Tag target = Tag.builder().id(targetId).name("Target").build();
         when(tagService.mergeTags(any(), any())).thenReturn(target);
 
-        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge").with(csrf())
+        mockMvc.perform(post("/api/tags/" + UUID.randomUUID() + "/merge")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{\"targetId\": \"" + targetId + "\"}"))
                 .andExpect(status().isOk())
@@ -172,21 +171,21 @@ class TagControllerTest {
 
     @Test
     void deleteSubtree_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree").with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void deleteSubtree_returns403_whenMissingAdminTagPermission() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree").with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree"))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "ADMIN_TAG")
     void deleteSubtree_returns204_whenHasAdminTagPermission() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree").with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID() + "/subtree"))
                 .andExpect(status().isNoContent());
     }
 
@@ -194,21 +193,21 @@ class TagControllerTest {
 
     @Test
     void deleteTag_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser
     void deleteTag_returns403_whenMissingAdminTagPermission() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
     @Test
     @WithMockUser(authorities = "ADMIN_TAG")
     void deleteTag_returns200_whenHasAdminTagPermission() throws Exception {
-        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/tags/" + UUID.randomUUID()))
                 .andExpect(status().isOk());
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/user/AdminControllerTest.java

@@ -27,7 +27,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(AdminController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -41,57 +40,16 @@ class AdminControllerTest {
     @MockitoBean ThumbnailBackfillService thumbnailBackfillService;
     @MockitoBean CustomUserDetailsService customUserDetailsService;
 
-    // ─── GET /api/admin/import-status ─────────────────────────────────────────
-
-    @Test
-    @WithMockUser(authorities = "ADMIN")
-    void importStatus_returns200_withStatusCode_whenAdmin() throws Exception {
-        MassImportService.ImportStatus status = new MassImportService.ImportStatus(
-                MassImportService.State.IDLE, "IMPORT_IDLE", "Kein Import gestartet.", 0, List.of(), null);
-        when(massImportService.getStatus()).thenReturn(status);
-
-        mockMvc.perform(get("/api/admin/import-status"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.state").value("IDLE"))
-                .andExpect(jsonPath("$.statusCode").value("IMPORT_IDLE"))
-                .andExpect(jsonPath("$.processed").value(0));
-    }
-
-    @Test
-    @WithMockUser(authorities = "ADMIN")
-    void importStatus_messageField_notPresentInApiResponse() throws Exception {
-        MassImportService.ImportStatus status = new MassImportService.ImportStatus(
-                MassImportService.State.IDLE, "IMPORT_IDLE", "Kein Import gestartet.", 0, List.of(), null);
-        when(massImportService.getStatus()).thenReturn(status);
-
-        mockMvc.perform(get("/api/admin/import-status"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.message").doesNotExist());
-    }
-
-    @Test
-    void importStatus_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(get("/api/admin/import-status"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    @WithMockUser(authorities = "READ_ALL")
-    void importStatus_returns403_whenUserLacksAdminPermission() throws Exception {
-        mockMvc.perform(get("/api/admin/import-status"))
-                .andExpect(status().isForbidden());
-    }
-
     @Test
     void backfillVersions_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/admin/backfill-versions").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-versions"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(roles = "USER")
     void backfillVersions_returns403_whenNotAdmin() throws Exception {
-        mockMvc.perform(post("/api/admin/backfill-versions").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-versions"))
                 .andExpect(status().isForbidden());
     }
 
@@ -101,7 +59,7 @@ class AdminControllerTest {
         when(documentService.getDocumentsWithoutVersions()).thenReturn(List.of(Document.builder().build()));
         when(documentVersionService.backfillMissingVersions(anyList())).thenReturn(1);
 
-        mockMvc.perform(post("/api/admin/backfill-versions").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-versions"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.count").value(1));
     }
@@ -110,14 +68,14 @@ class AdminControllerTest {
 
     @Test
     void backfillFileHashes_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/admin/backfill-file-hashes").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-file-hashes"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(roles = "USER")
     void backfillFileHashes_returns403_whenNotAdmin() throws Exception {
-        mockMvc.perform(post("/api/admin/backfill-file-hashes").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-file-hashes"))
                 .andExpect(status().isForbidden());
     }
 
@@ -126,7 +84,7 @@ class AdminControllerTest {
     void backfillFileHashes_returns200_withCount_whenAdmin() throws Exception {
         when(documentService.backfillFileHashes()).thenReturn(3);
 
-        mockMvc.perform(post("/api/admin/backfill-file-hashes").with(csrf()))
+        mockMvc.perform(post("/api/admin/backfill-file-hashes"))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.count").value(3));
     }
@@ -135,14 +93,14 @@ class AdminControllerTest {
 
     @Test
     void generateThumbnails_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/admin/generate-thumbnails").with(csrf()))
+        mockMvc.perform(post("/api/admin/generate-thumbnails"))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(roles = "USER")
     void generateThumbnails_returns403_whenNotAdmin() throws Exception {
-        mockMvc.perform(post("/api/admin/generate-thumbnails").with(csrf()))
+        mockMvc.perform(post("/api/admin/generate-thumbnails"))
                 .andExpect(status().isForbidden());
     }
 
@@ -153,7 +111,7 @@ class AdminControllerTest {
                 ThumbnailBackfillService.State.RUNNING, "running…", 10, 0, 0, 0, LocalDateTime.now());
         when(thumbnailBackfillService.getStatus()).thenReturn(status);
 
-        mockMvc.perform(post("/api/admin/generate-thumbnails").with(csrf()))
+        mockMvc.perform(post("/api/admin/generate-thumbnails"))
                 .andExpect(status().isAccepted())
                 .andExpect(jsonPath("$.state").value("RUNNING"))
                 .andExpect(jsonPath("$.total").value(10));

backend/src/test/java/org/raddatz/familienarchiv/user/AdminSeedFailClosedTest.java

@@ -1,174 +0,0 @@
-package org.raddatz.familienarchiv.user;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.boot.CommandLineRunner;
-import org.springframework.core.env.Environment;
-import org.springframework.security.crypto.password.PasswordEncoder;
-import org.springframework.test.util.ReflectionTestUtils;
-
-import java.util.Optional;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-/**
- * UserDataInitializer must refuse to seed the admin user with the hardcoded
- * dev defaults when running outside the {@code dev} profile.
- *
- * <p>Why this matters: per DEPLOYMENT.md §3.5 and ADR-011, the admin password
- * is permanently locked on first deploy (UserDataInitializer only seeds when
- * the row is missing). If an operator forgets to set {@code APP_ADMIN_USERNAME}
- * / {@code APP_ADMIN_PASSWORD}, prod silently boots with the well-known dev
- * defaults — a credential-disclosure foot-gun, not a config typo. See #513.
- */
-@ExtendWith(MockitoExtension.class)
-class AdminSeedFailClosedTest {
-
-    @Mock AppUserRepository userRepository;
-    @Mock UserGroupRepository groupRepository;
-    @Mock Environment environment;
-    @Mock PasswordEncoder passwordEncoder;
-
-    UserDataInitializer initializer;
-
-    @BeforeEach
-    void setUp() {
-        initializer = new UserDataInitializer(userRepository, groupRepository, environment);
-    }
-
-    @Test
-    void refuses_to_seed_when_email_is_default_and_profile_is_not_dev() throws Exception {
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false);
-        ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL);
-        ReflectionTestUtils.setField(initializer, "adminPassword", "operator-set-this-one");
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-
-        assertThatThrownBy(() -> runner.run())
-            .isInstanceOf(IllegalStateException.class)
-            .hasMessageContaining("default credentials")
-            .hasMessageContaining("permanent");
-
-        verify(userRepository, never()).save(org.mockito.ArgumentMatchers.any());
-    }
-
-    @Test
-    void refuses_to_seed_when_password_is_default_and_profile_is_not_dev() throws Exception {
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false);
-        ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud");
-        ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD);
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-
-        assertThatThrownBy(() -> runner.run())
-            .isInstanceOf(IllegalStateException.class)
-            .hasMessageContaining("default credentials");
-    }
-
-    @Test
-    void allows_seed_when_both_values_are_set_and_profile_is_not_dev() throws Exception {
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(groupRepository.findByName("Administrators")).thenReturn(Optional.empty());
-        when(groupRepository.save(any(UserGroup.class))).thenAnswer(inv -> inv.getArgument(0));
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false);
-        when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub");
-        ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud");
-        ReflectionTestUtils.setField(initializer, "adminPassword", "a-real-strong-password");
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-        runner.run();
-
-        verify(userRepository).save(any(AppUser.class));
-    }
-
-    @Test
-    void allows_seed_with_defaults_when_profile_is_dev() throws Exception {
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(groupRepository.findByName("Administrators")).thenReturn(Optional.empty());
-        when(groupRepository.save(any(UserGroup.class))).thenAnswer(inv -> inv.getArgument(0));
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(true);
-        when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub");
-        ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL);
-        ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD);
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-        runner.run();
-
-        verify(userRepository).save(any(AppUser.class));
-    }
-
-    @Test
-    void does_not_check_defaults_when_admin_already_exists() throws Exception {
-        AppUser existing = AppUser.builder()
-            .email("someone@example.com")
-            .password("$2a$10$stub")
-            .build();
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.of(existing));
-        ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL);
-        ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD);
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-        runner.run();
-
-        verify(userRepository, never()).save(org.mockito.ArgumentMatchers.any());
-        // Importantly, no IllegalStateException — re-deploys must not panic over
-        // historical default-seeded data they cannot retroactively fix.
-    }
-
-    @Test
-    void reuses_existing_Administrators_group_when_seeding_a_new_admin() throws Exception {
-        // Setup: admin user does not exist, but the Administrators group does
-        // (e.g. previous boot seeded the group then failed; operator deleted
-        // the bad user row to retry with a corrected APP_ADMIN_USERNAME). The
-        // re-seed must reuse the group, not blind-INSERT a duplicate. See #518.
-        UserGroup existingGroup = UserGroup.builder()
-            .name("Administrators")
-            .build();
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(groupRepository.findByName("Administrators")).thenReturn(Optional.of(existingGroup));
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false);
-        when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub");
-        ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud");
-        ReflectionTestUtils.setField(initializer, "adminPassword", "a-real-strong-password");
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-        runner.run();
-
-        // Group must not be re-inserted — that would violate user_groups_name_key.
-        verify(groupRepository, never()).save(any(UserGroup.class));
-        // But the admin user IS created, with the existing group attached.
-        org.mockito.ArgumentCaptor<AppUser> captor = org.mockito.ArgumentCaptor.forClass(AppUser.class);
-        verify(userRepository).save(captor.capture());
-        assertThat(captor.getValue().getGroups()).containsExactly(existingGroup);
-    }
-
-    @Test
-    void creates_Administrators_group_when_seeding_admin_on_a_fresh_database() throws Exception {
-        when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty());
-        when(groupRepository.findByName("Administrators")).thenReturn(Optional.empty());
-        when(groupRepository.save(any(UserGroup.class))).thenAnswer(inv -> inv.getArgument(0));
-        when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false);
-        when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub");
-        ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud");
-        ReflectionTestUtils.setField(initializer, "adminPassword", "a-real-strong-password");
-
-        CommandLineRunner runner = initializer.initAdminUser(passwordEncoder);
-        runner.run();
-
-        // Group should be inserted exactly once.
-        verify(groupRepository).save(any(UserGroup.class));
-        verify(userRepository).save(any(AppUser.class));
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/user/AdminSeedPropertyKeyTest.java

@@ -1,95 +0,0 @@
-package org.raddatz.familienarchiv.user;
-
-import org.junit.jupiter.api.Test;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.beans.factory.config.YamlPropertiesFactoryBean;
-import org.springframework.boot.context.properties.bind.Binder;
-import org.springframework.boot.context.properties.source.ConfigurationPropertySources;
-import org.springframework.core.env.PropertiesPropertySource;
-import org.springframework.core.io.ClassPathResource;
-
-import java.lang.reflect.Field;
-import java.util.Properties;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Pins the admin-seed property key contract. {@code UserDataInitializer} reads
- * {@code @Value("${app.admin.email:...}")} and {@code @Value("${app.admin.password:...}")}.
- * The yaml MUST expose those exact keys, not e.g. {@code app.admin.username}, or
- * the env vars {@code APP_ADMIN_USERNAME} / {@code APP_ADMIN_PASSWORD} are
- * silently ignored and the admin user gets seeded with the hardcoded defaults.
- *
- * <p>Discovered as a HIGH bug during the production-deploy bootstrap (#513): on
- * first deploy the prod admin password is permanently locked to whatever ends
- * up in the database, so a key-name mismatch would lock prod to the dev defaults
- * {@code admin@familyarchive.local} / {@code admin123}.
- *
- * <p>No Spring context — Binder reads application.yaml directly.
- */
-class AdminSeedPropertyKeyTest {
-
-    @Test
-    void admin_email_key_binds_from_yaml() {
-        Binder binder = binderFromApplicationYaml();
-
-        String email = binder.bind("app.admin.email", String.class)
-            .orElseThrow(() -> new AssertionError(
-                "app.admin.email is missing from application.yaml. "
-                + "UserDataInitializer reads this exact key; if the yaml uses "
-                + "a different name (e.g. 'username'), the env var "
-                + "APP_ADMIN_USERNAME is silently ignored."));
-
-        assertThat(email)
-            .as("app.admin.email must resolve from APP_ADMIN_USERNAME or its default")
-            .isNotBlank();
-    }
-
-    @Test
-    void admin_password_key_binds_from_yaml() {
-        Binder binder = binderFromApplicationYaml();
-
-        String password = binder.bind("app.admin.password", String.class)
-            .orElseThrow(() -> new AssertionError(
-                "app.admin.password is missing from application.yaml. "
-                + "UserDataInitializer reads this exact key."));
-
-        assertThat(password)
-            .as("app.admin.password must resolve from APP_ADMIN_PASSWORD or its default")
-            .isNotBlank();
-    }
-
-    @Test
-    void userDataInitializer_reads_app_admin_email_not_username() throws NoSuchFieldException {
-        // Pin the Java side too: a future rename of the @Value placeholder
-        // (e.g. back to `${app.admin.username:...}`) would silently break the
-        // binding while the yaml-side assertions above still pass. See #513.
-        Field field = UserDataInitializer.class.getDeclaredField("adminEmail");
-        Value annotation = field.getAnnotation(Value.class);
-        assertThat(annotation)
-            .as("UserDataInitializer.adminEmail must be @Value-annotated")
-            .isNotNull();
-        assertThat(annotation.value())
-            .as("UserDataInitializer must read app.admin.email — not username or any other key")
-            .startsWith("${app.admin.email:");
-    }
-
-    @Test
-    void userDataInitializer_reads_app_admin_password() throws NoSuchFieldException {
-        Field field = UserDataInitializer.class.getDeclaredField("adminPassword");
-        Value annotation = field.getAnnotation(Value.class);
-        assertThat(annotation).isNotNull();
-        assertThat(annotation.value())
-            .as("UserDataInitializer must read app.admin.password")
-            .startsWith("${app.admin.password:");
-    }
-
-    private Binder binderFromApplicationYaml() {
-        YamlPropertiesFactoryBean yaml = new YamlPropertiesFactoryBean();
-        yaml.setResources(new ClassPathResource("application.yaml"));
-        Properties props = yaml.getObject();
-        assertThat(props).as("application.yaml must be on the classpath").isNotNull();
-        return new Binder(ConfigurationPropertySources.from(
-            new PropertiesPropertySource("application", props)));
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/user/AppUserTest.java

@@ -35,15 +35,4 @@ class AppUserTest {
             .count();
         assertThat(distinct).isGreaterThan(1);
     }
-
-    @Test
-    void computeColor_returnsValidPaletteColorForIntegerMinValueHash() {
-        // UUID "80000000-0000-0000-0000-000000000000" has hashCode() == Integer.MIN_VALUE.
-        // Math.abs(Integer.MIN_VALUE) overflows back to Integer.MIN_VALUE (negative), making
-        // Math.abs(hashCode()) % n unsafe for palette sizes that don't evenly divide MIN_VALUE.
-        // Math.floorMod eliminates this edge case entirely.
-        UUID minHashId = UUID.fromString("80000000-0000-0000-0000-000000000000");
-        assertThat(minHashId.hashCode()).isEqualTo(Integer.MIN_VALUE);
-        assertThat(EXPECTED_PALETTE).contains(AppUser.computeColor(minHashId));
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/user/AuthControllerTest.java

@@ -30,7 +30,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(AuthController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -118,7 +117,7 @@ class AuthControllerTest {
         req.setFirstName("Max");
         req.setLastName("Muster");
 
-        mockMvc.perform(post("/api/auth/register").with(csrf())
+        mockMvc.perform(post("/api/auth/register")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isCreated())
@@ -135,7 +134,7 @@ class AuthControllerTest {
         req.setEmail("dupe@test.com");
         req.setPassword("password123");
 
-        mockMvc.perform(post("/api/auth/register").with(csrf())
+        mockMvc.perform(post("/api/auth/register")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isConflict());
@@ -151,7 +150,7 @@ class AuthControllerTest {
         req.setEmail("new@test.com");
         req.setPassword("abc");
 
-        mockMvc.perform(post("/api/auth/register").with(csrf())
+        mockMvc.perform(post("/api/auth/register")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isBadRequest());
@@ -167,7 +166,7 @@ class AuthControllerTest {
         req.setEmail("new@test.com");
         req.setPassword("password123");
 
-        mockMvc.perform(post("/api/auth/register").with(csrf())
+        mockMvc.perform(post("/api/auth/register")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isNotFound());
@@ -184,7 +183,7 @@ class AuthControllerTest {
         req.setPassword("password123");
 
         // No WithMockUser — must still succeed (no auth challenge)
-        mockMvc.perform(post("/api/auth/register").with(csrf())
+        mockMvc.perform(post("/api/auth/register")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isCreated());

backend/src/test/java/org/raddatz/familienarchiv/user/InviteControllerTest.java

@@ -20,20 +20,16 @@ import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
 
-import org.mockito.ArgumentCaptor;
-
 import java.time.LocalDateTime;
 import java.util.List;
 import java.util.UUID;
 
-import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(InviteController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -104,7 +100,7 @@ class InviteControllerTest {
 
     @Test
     void createInvite_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/invites").with(csrf())
+        mockMvc.perform(post("/api/invites")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isUnauthorized());
@@ -113,7 +109,7 @@ class InviteControllerTest {
     @Test
     @WithMockUser(username = "user@test.com")
     void createInvite_returns403_whenUserLacksAdminUserPermission() throws Exception {
-        mockMvc.perform(post("/api/invites").with(csrf())
+        mockMvc.perform(post("/api/invites")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isForbidden());
@@ -143,7 +139,7 @@ class InviteControllerTest {
         req.setLabel("Für Familie");
         req.setMaxUses(1);
 
-        mockMvc.perform(post("/api/invites").with(csrf())
+        mockMvc.perform(post("/api/invites")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(req)))
                 .andExpect(status().isCreated())
@@ -151,42 +147,18 @@ class InviteControllerTest {
                 .andExpect(jsonPath("$.label").value("Für Familie"));
     }
 
-    @Test
-    @WithMockUser(username = "admin@test.com", authorities = {"ADMIN_USER"})
-    void createInvite_forwardsGroupIdsToService() throws Exception {
-        UUID groupId = UUID.randomUUID();
-        AppUser admin = AppUser.builder().id(UUID.randomUUID()).email("admin@test.com").build();
-        when(userService.findByEmail("admin@test.com")).thenReturn(admin);
-
-        InviteToken savedToken = InviteToken.builder()
-                .id(UUID.randomUUID()).code("ABCDE12345").useCount(0).build();
-        when(inviteService.createInvite(any(), eq(admin))).thenReturn(savedToken);
-        when(inviteService.toListItemDTO(any(), anyString()))
-                .thenReturn(makeInviteDTO(savedToken.getId(), "ABCDE12345"));
-
-        String body = "{\"groupIds\":[\"" + groupId + "\"]}";
-        mockMvc.perform(post("/api/invites").with(csrf())
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content(body))
-                .andExpect(status().isCreated());
-
-        ArgumentCaptor<CreateInviteRequest> captor = ArgumentCaptor.forClass(CreateInviteRequest.class);
-        verify(inviteService).createInvite(captor.capture(), eq(admin));
-        assertThat(captor.getValue().getGroupIds()).containsExactly(groupId);
-    }
-
     // ─── DELETE /api/invites/{id} ─────────────────────────────────────────────
 
     @Test
     void revokeInvite_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/invites/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/invites/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
 
     @Test
     @WithMockUser(username = "user@test.com")
     void revokeInvite_returns403_whenUserLacksAdminUserPermission() throws Exception {
-        mockMvc.perform(delete("/api/invites/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/invites/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
@@ -195,7 +167,7 @@ class InviteControllerTest {
     void revokeInvite_returns204_whenSuccessful() throws Exception {
         UUID id = UUID.randomUUID();
 
-        mockMvc.perform(delete("/api/invites/" + id).with(csrf()))
+        mockMvc.perform(delete("/api/invites/" + id))
                 .andExpect(status().isNoContent());
 
         verify(inviteService).revokeInvite(id);

backend/src/test/java/org/raddatz/familienarchiv/user/InviteServiceTest.java

@@ -156,35 +156,6 @@ class InviteServiceTest {
         assertThat(result.getGroupIds()).contains(g.getId());
     }
 
-    @Test
-    void createInvite_throwsGroupNotFound_whenSubmittedGroupIdDoesNotExist() {
-        UUID unknownGroupId = UUID.randomUUID();
-        when(userService.findGroupsByIds(anyList())).thenReturn(List.of());
-
-        CreateInviteRequest req = new CreateInviteRequest();
-        req.setGroupIds(List.of(unknownGroupId));
-
-        assertThatThrownBy(() -> inviteService.createInvite(req, admin))
-                .isInstanceOf(DomainException.class)
-                .extracting(e -> ((DomainException) e).getCode())
-                .isEqualTo(ErrorCode.GROUP_NOT_FOUND);
-    }
-
-    @Test
-    void createInvite_doesNotThrowGroupNotFound_whenDuplicateGroupIdsSubmitted() {
-        UUID groupId = UUID.randomUUID();
-        UserGroup group = UserGroup.builder().id(groupId).name("Familie").build();
-        when(inviteTokenRepository.findByCode(anyString())).thenReturn(Optional.empty());
-        when(userService.findGroupsByIds(anyList())).thenReturn(List.of(group));
-        when(inviteTokenRepository.save(any())).thenAnswer(inv -> inv.getArgument(0));
-
-        CreateInviteRequest req = new CreateInviteRequest();
-        req.setGroupIds(List.of(groupId, groupId)); // same UUID submitted twice
-
-        // before deduplication: size(groups)==1 != size(submitted)==2 → false GROUP_NOT_FOUND
-        assertThatCode(() -> inviteService.createInvite(req, admin)).doesNotThrowAnyException();
-    }
-
     // ─── redeemInvite ─────────────────────────────────────────────────────────
 
     @Test

backend/src/test/java/org/raddatz/familienarchiv/user/InviteTokenRepositoryIntegrationTest.java

@@ -1,78 +0,0 @@
-package org.raddatz.familienarchiv.user;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.PostgresContainerConfig;
-import org.raddatz.familienarchiv.config.FlywayConfig;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
-import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
-import org.springframework.context.annotation.Import;
-
-import java.time.LocalDateTime;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@DataJpaTest
-@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
-@Import({PostgresContainerConfig.class, FlywayConfig.class})
-class InviteTokenRepositoryIntegrationTest {
-
-    @Autowired InviteTokenRepository inviteTokenRepository;
-    @Autowired UserGroupRepository userGroupRepository;
-    @Autowired AppUserRepository appUserRepository;
-
-    private UserGroup group;
-    private AppUser admin;
-
-    @BeforeEach
-    void setUp() {
-        inviteTokenRepository.deleteAll();
-        userGroupRepository.deleteAll();
-        appUserRepository.deleteAll();
-        admin = appUserRepository.save(AppUser.builder().email("admin@test.com").password("pw").build());
-        group = userGroupRepository.save(UserGroup.builder().name("Familie").build());
-    }
-
-    // ─── existsActiveWithGroupId ──────────────────────────────────────────────
-
-    @Test
-    void existsActiveWithGroupId_returnsTrueForActiveInviteLinkedToGroup() {
-        inviteTokenRepository.save(token(t -> t));
-
-        assertThat(inviteTokenRepository.existsActiveWithGroupId(group.getId())).isTrue();
-    }
-
-    @Test
-    void existsActiveWithGroupId_returnsFalseWhenInviteIsRevoked() {
-        inviteTokenRepository.save(token(t -> t.revoked(true)));
-
-        assertThat(inviteTokenRepository.existsActiveWithGroupId(group.getId())).isFalse();
-    }
-
-    @Test
-    void existsActiveWithGroupId_returnsFalseWhenInviteIsExpired() {
-        inviteTokenRepository.save(token(t -> t.expiresAt(LocalDateTime.now().minusDays(1))));
-
-        assertThat(inviteTokenRepository.existsActiveWithGroupId(group.getId())).isFalse();
-    }
-
-    @Test
-    void existsActiveWithGroupId_returnsFalseWhenInviteIsExhausted() {
-        inviteTokenRepository.save(token(t -> t.maxUses(1).useCount(1)));
-
-        assertThat(inviteTokenRepository.existsActiveWithGroupId(group.getId())).isFalse();
-    }
-
-    // ─── helpers ─────────────────────────────────────────────────────────────
-
-    private InviteToken token(java.util.function.UnaryOperator<InviteToken.InviteTokenBuilder> customizer) {
-        InviteToken.InviteTokenBuilder builder = InviteToken.builder()
-                .code(UUID.randomUUID().toString().replace("-", "").substring(0, 10))
-                .groupIds(new java.util.HashSet<>(Set.of(group.getId())))
-                .createdBy(admin);
-        return customizer.apply(builder).build();
-    }
-}

backend/src/test/java/org/raddatz/familienarchiv/user/PasswordResetServiceTest.java

@@ -27,7 +27,6 @@ import org.springframework.mail.MailSendException;
 import org.springframework.mail.SimpleMailMessage;
 import org.springframework.mail.javamail.JavaMailSender;
 import org.springframework.security.crypto.password.PasswordEncoder;
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.springframework.test.util.ReflectionTestUtils;
 
 @ExtendWith(MockitoExtension.class)
@@ -37,10 +36,8 @@ class PasswordResetServiceTest {
     @Mock PasswordResetTokenRepository tokenRepository;
     @Mock PasswordEncoder passwordEncoder;
     @Mock JavaMailSender mailSender;
-    @Mock AuthService authService;
     @InjectMocks PasswordResetService service;
 
-
     private AppUser makeUser(String email) {
         return AppUser.builder()
                 .id(UUID.randomUUID())
@@ -179,27 +176,6 @@ class PasswordResetServiceTest {
         verify(mailSender).send(any(SimpleMailMessage.class));
     }
 
-    @Test
-    void resetPassword_revokes_all_sessions_after_password_reset() {
-        AppUser user = makeUser("user@example.com");
-        PasswordResetToken token = PasswordResetToken.builder()
-                .id(UUID.randomUUID())
-                .token("validtoken123")
-                .user(user)
-                .expiresAt(LocalDateTime.now().plusHours(1))
-                .used(false)
-                .build();
-        when(tokenRepository.findByToken("validtoken123")).thenReturn(Optional.of(token));
-        when(passwordEncoder.encode(any())).thenReturn("hashed");
-
-        ResetPasswordRequest req = new ResetPasswordRequest();
-        req.setToken("validtoken123");
-        req.setNewPassword("newpass");
-        service.resetPassword(req);
-
-        verify(authService).revokeAllSessions("user@example.com");
-    }
-
     // ─── cleanupExpiredTokens ─────────────────────────────────────────────────
 
     @Test

backend/src/test/java/org/raddatz/familienarchiv/user/UserControllerTest.java

@@ -1,8 +1,6 @@
 package org.raddatz.familienarchiv.user;
 
 import org.junit.jupiter.api.Test;
-import org.raddatz.familienarchiv.audit.AuditService;
-import org.raddatz.familienarchiv.auth.AuthService;
 import org.raddatz.familienarchiv.security.SecurityConfig;
 import org.raddatz.familienarchiv.user.AppUser;
 import org.raddatz.familienarchiv.security.PermissionAspect;
@@ -12,7 +10,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.aop.AopAutoConfiguration;
 import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.context.annotation.Import;
-import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
@@ -20,8 +17,6 @@ import org.springframework.test.web.servlet.MockMvc;
 import java.util.UUID;
 
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
@@ -29,7 +24,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
 
 @WebMvcTest(UserController.class)
 @Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
@@ -38,8 +32,6 @@ class UserControllerTest {
     @Autowired MockMvc mockMvc;
 
     @MockitoBean UserService userService;
-    @MockitoBean AuthService authService;
-    @MockitoBean AuditService auditService;
     @MockitoBean CustomUserDetailsService customUserDetailsService;
 
     // ─── GET /api/users/me ────────────────────────────────────────────────────────
@@ -91,7 +83,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "admin@example.com", authorities = {"ADMIN_USER"})
     void createUser_returns400_whenEmailIsNotValidEmailFormat() throws Exception {
-        mockMvc.perform(post("/api/users").with(csrf())
+        mockMvc.perform(post("/api/users")
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{\"email\":\"notanemail\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isBadRequest());
@@ -100,7 +92,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "admin@example.com", authorities = {"ADMIN_USER"})
     void createUser_returns400_whenEmailContainsColon() throws Exception {
-        mockMvc.perform(post("/api/users").with(csrf())
+        mockMvc.perform(post("/api/users")
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{\"email\":\"user:name@example.com\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isBadRequest());
@@ -109,7 +101,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "admin@example.com", authorities = {"ADMIN_USER"})
     void createUser_returns400_whenEmailIsBlank() throws Exception {
-        mockMvc.perform(post("/api/users").with(csrf())
+        mockMvc.perform(post("/api/users")
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{\"email\":\"\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isBadRequest());
@@ -120,7 +112,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "reader@example.com")
     void createUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
-        mockMvc.perform(post("/api/users").with(csrf())
+        mockMvc.perform(post("/api/users")
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{\"email\":\"x@x.com\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isForbidden());
@@ -129,7 +121,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "reader@example.com")
     void adminUpdateUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
-        mockMvc.perform(put("/api/users/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/users/" + UUID.randomUUID())
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isForbidden());
@@ -138,7 +130,7 @@ class UserControllerTest {
     @Test
     @WithMockUser(username = "reader@example.com")
     void deleteUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
-        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
                 .andExpect(status().isForbidden());
     }
 
@@ -146,7 +138,7 @@ class UserControllerTest {
 
     @Test
     void createUser_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/users").with(csrf())
+        mockMvc.perform(post("/api/users")
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{\"email\":\"x@x.com\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isUnauthorized());
@@ -154,7 +146,7 @@ class UserControllerTest {
 
     @Test
     void adminUpdateUser_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(put("/api/users/" + UUID.randomUUID()).with(csrf())
+        mockMvc.perform(put("/api/users/" + UUID.randomUUID())
                         .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
                         .content("{}"))
                 .andExpect(status().isUnauthorized());
@@ -162,92 +154,7 @@ class UserControllerTest {
 
     @Test
     void deleteUser_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()).with(csrf()))
+        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
                 .andExpect(status().isUnauthorized());
     }
-
-    // ─── POST /api/users/me/password (changePassword + session revocation) ────
-
-    @Test
-    @WithMockUser(username = "user@example.com")
-    void changePassword_returns204_and_calls_revokeOtherSessions() throws Exception {
-        AppUser user = AppUser.builder().id(UUID.randomUUID()).email("user@example.com").build();
-        when(userService.findByEmail("user@example.com")).thenReturn(user);
-        when(authService.revokeOtherSessions(any(), any())).thenReturn(1);
-
-        mockMvc.perform(post("/api/users/me/password").with(csrf())
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"currentPassword\":\"old\",\"newPassword\":\"new123!\"}"))
-                .andExpect(status().isNoContent());
-
-        verify(authService).revokeOtherSessions(any(), eq("user@example.com"));
-    }
-
-    @Test
-    void changePassword_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/users/me/password").with(csrf())
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"currentPassword\":\"old\",\"newPassword\":\"new123!\"}"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    @WithMockUser(username = "user@example.com")
-    void changePassword_without_csrf_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        mockMvc.perform(post("/api/users/me/password")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"currentPassword\":\"old\",\"newPassword\":\"new123!\"}"))
-                .andExpect(status().isForbidden())
-                .andExpect(jsonPath("$.code").value("CSRF_TOKEN_MISSING"));
-    }
-
-    // ─── POST /api/users/{id}/force-logout ────────────────────────────────────
-
-    @Test
-    @WithMockUser(username = "admin@example.com", authorities = "ADMIN_USER")
-    void forceLogout_returns200_and_revokes_target_sessions() throws Exception {
-        UUID targetId = UUID.randomUUID();
-        AppUser actor = AppUser.builder().id(UUID.randomUUID()).email("admin@example.com").build();
-        AppUser target = AppUser.builder().id(targetId).email("target@example.com").build();
-        when(userService.findByEmail("admin@example.com")).thenReturn(actor);
-        when(userService.getById(targetId)).thenReturn(target);
-        when(authService.revokeAllSessions("target@example.com")).thenReturn(2);
-
-        mockMvc.perform(post("/api/users/" + targetId + "/force-logout").with(csrf()))
-                .andExpect(status().isOk())
-                .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath("$.revokedCount").value(2));
-    }
-
-    @Test
-    void forceLogout_returns401_whenUnauthenticated() throws Exception {
-        mockMvc.perform(post("/api/users/" + UUID.randomUUID() + "/force-logout").with(csrf()))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    @WithMockUser
-    void forceLogout_returns403_whenMissingPermission() throws Exception {
-        mockMvc.perform(post("/api/users/" + UUID.randomUUID() + "/force-logout").with(csrf()))
-                .andExpect(status().isForbidden());
-    }
-
-    @Test
-    @WithMockUser(authorities = "ADMIN_USER")
-    void forceLogout_returns404_whenUserNotFound() throws Exception {
-        UUID targetId = UUID.randomUUID();
-        when(userService.getById(targetId)).thenThrow(
-                org.raddatz.familienarchiv.exception.DomainException.notFound(
-                        org.raddatz.familienarchiv.exception.ErrorCode.USER_NOT_FOUND, "not found"));
-
-        mockMvc.perform(post("/api/users/" + targetId + "/force-logout").with(csrf()))
-                .andExpect(status().isNotFound());
-    }
-
-    @Test
-    @WithMockUser(username = "admin@example.com", authorities = "ADMIN_USER")
-    void forceLogout_without_csrf_returns_403_CSRF_TOKEN_MISSING() throws Exception {
-        mockMvc.perform(post("/api/users/" + UUID.randomUUID() + "/force-logout"))
-                .andExpect(status().isForbidden())
-                .andExpect(jsonPath("$.code").value("CSRF_TOKEN_MISSING"));
-    }
 }

backend/src/test/java/org/raddatz/familienarchiv/user/UserServiceTest.java

@@ -36,7 +36,6 @@ class UserServiceTest {
 
     @Mock AppUserRepository userRepository;
     @Mock UserGroupRepository groupRepository;
-    @Mock InviteTokenRepository inviteTokenRepository;
     @Mock PasswordEncoder passwordEncoder;
     @Mock AuditService auditService;
     @InjectMocks UserService userService;
@@ -903,41 +902,4 @@ class UserServiceTest {
         assertThat(result.getName()).isEqualTo("Familie");
         assertThat(result.getPermissions()).containsExactlyInAnyOrder("READ_ALL", "WRITE_ALL");
     }
-
-    // ─── deleteGroup ──────────────────────────────────────────────────────────
-
-    @Test
-    void deleteGroup_throwsConflict_whenActiveInviteReferencesGroup() {
-        UUID groupId = UUID.randomUUID();
-        when(inviteTokenRepository.existsActiveWithGroupId(groupId)).thenReturn(true);
-
-        assertThatThrownBy(() -> userService.deleteGroup(groupId))
-                .isInstanceOf(DomainException.class)
-                .extracting(e -> ((DomainException) e).getCode())
-                .isEqualTo(ErrorCode.GROUP_HAS_ACTIVE_INVITES);
-    }
-
-    @Test
-    void deleteGroup_deletesGroup_whenNoActiveInviteReferencesGroup() {
-        UUID groupId = UUID.randomUUID();
-        when(inviteTokenRepository.existsActiveWithGroupId(groupId)).thenReturn(false);
-
-        userService.deleteGroup(groupId);
-
-        verify(groupRepository).deleteById(groupId);
-    }
-
-    @Test
-    void createGroup_withNullPermissions_savesGroupWithEmptyPermissionSet() {
-        org.raddatz.familienarchiv.user.GroupDTO dto = new org.raddatz.familienarchiv.user.GroupDTO();
-        dto.setName("Leser");
-        dto.setPermissions(null);
-
-        UserGroup saved = UserGroup.builder().id(UUID.randomUUID()).name("Leser").build();
-        when(groupRepository.save(any())).thenReturn(saved);
-
-        userService.createGroup(dto);
-
-        verify(groupRepository).save(argThat(g -> g.getPermissions() != null && g.getPermissions().isEmpty()));
-    }
 }