fix secrets no longer needed

.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)"
+    ]
+  }
+}

.gitea/workflows/build.yml

@@ -7,48 +7,51 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-java17
 
     steps:
       # 1. Checkout the code
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      # 2. Set up Java and Maven
-      - name: Set up JDK (Eclipse Temurin)
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-          cache: maven
-
-      # 3. Verify Maven installation
-      - name: Install Maven
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y maven
-          mvn -version
-
-      # 4. Build the Spring Boot application
+      # 2. Build the Spring Boot application using the Maven wrapper (Java 17 pre-installed in runner image)
       - name: Build Spring Boot Application
-        run: |
-          mvn clean package -DskipTests
+        run: ./mvnw clean package -DskipTests
 
-      # 5. Set up Docker
-      - name: Set up Docker
-        run: |
-          docker --version
+      # 4. Set up Docker Buildx (enables layer caching)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      # 6. Build the Docker image
-      - name: Build and Package Docker Image
-        run: |
-          docker build -t tea.zendric.de/cedric/xpensely-server:latest .
+      # 5. Login to Docker Hub to avoid pull rate limits
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # 7. Docker login
+      # 6. Docker login to Gitea registry
       - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: tea.zendric.de
+          username: ${{ secrets.TEAUSER }}
+          password: ${{ secrets.TEAPASSWORD }}
+
+      # 7. Build and push Docker image with layer caching
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: tea.zendric.de/cedric/xpensely-server:latest
+          cache-from: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache
+          cache-to: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache,mode=max
+
+      # 8. Trigger Dokploy to redeploy the dev server automatically via API
+      - name: Trigger Dokploy Redeploy
         run: |
-          echo "${{ secrets.TEAPASSWORD }}" | docker login tea.zendric.de -u ${{ secrets.TEAUSER }} --password-stdin
-      # 8. Push Docker image
-      - name: Push the Docker Image to registry
-        run: |
-          docker push tea.zendric.de/cedric/xpensely-server:latest
+          curl -X POST "https://dokploy.zendric.de/api/compose.deploy" \
+            -H "Content-Type: application/json" \
+            -H "x-api-key: ${{ secrets.DOKPLOY_API_TOKEN }}" \
+            -d "{\"composeId\": \"${{ secrets.DOKPLOY_COMPOSE_ID }}\"}" \
+            --fail

README.md

@@ -0,0 +1,7 @@
+Run it locally:
+
+1. build the current state:
+   mvn clean install or mvn clean install -DskipTests
+
+2. docker it up and run it
+   docker-compose -f dev-docker-compose.yml up --build

apiDesign.drawio

@@ -1,6 +1,6 @@
 <mxfile host="65bd71144e">
     <diagram id="TZX9Tq6sZIlTxQ58HocZ" name="Page-1">
-        <mxGraphModel dx="826" dy="472" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
+        <mxGraphModel dx="989" dy="570" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
             <root>
                 <mxCell id="0"/>
                 <mxCell id="1" parent="0"/>
@@ -193,6 +193,90 @@
                 <mxCell id="73" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;24.12.24 ; Expense ; 24,12 €&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#76608a;fontColor=#ffffff;strokeColor=#432D57;" parent="1" vertex="1">
                     <mxGeometry x="1399" y="226" width="120" height="20" as="geometry"/>
                 </mxCell>
+                <mxCell id="86" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="74" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="74" value="List" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#60a917;fontColor=#ffffff;strokeColor=#2D7600;" vertex="1" parent="1">
+                    <mxGeometry x="1880" y="160" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="75" value="DB-Structure for Categories" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
+                    <mxGeometry x="1930" y="35" width="100" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="78" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="76" target="77">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="76" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="220" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="79" value="Available Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2160" y="150" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="83" style="edgeStyle=none;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="81" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="81" value="Standard Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2060" y="35" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="84" style="edgeStyle=none;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="82" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="82" value="Custom Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2270" y="35" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="91" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="87" target="90">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="87" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="280" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="92" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="88" target="89">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="88" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="340" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="89" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="370" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="90" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="315" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="94" value="&lt;h1 style=&quot;font-size: 18px;&quot;&gt;- list id&lt;/h1&gt;&lt;div&gt;- List &amp;lt;String&amp;gt;&lt;/div&gt;" style="text;html=1;strokeColor=none;fillColor=none;spacing=5;spacingTop=-20;whiteSpace=wrap;overflow=hidden;rounded=0;fontSize=18;" vertex="1" parent="1">
+                    <mxGeometry x="2410" y="50" width="130" height="70" as="geometry"/>
+                </mxCell>
+                <mxCell id="77" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="260" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="97" value="" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1730" y="510" width="200" height="320" as="geometry"/>
+                </mxCell>
+                <mxCell id="98" value="ExpenseList" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1770" y="520" width="120" height="20" as="geometry"/>
+                </mxCell>
+                <mxCell id="100" value="+" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1880" y="790" width="30" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="101" value="Categorie" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
+                    <mxGeometry x="1770" y="480" width="120" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="102" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Amount : 24,12 €&lt;br&gt;Title: Expense&lt;br&gt;Date: 24.12.24&lt;br&gt;From: Jessi&lt;br&gt;Deviation: 0 €&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#76608a;fontColor=#ffffff;strokeColor=#432D57;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1745" y="550" width="170" height="170" as="geometry"/>
+                </mxCell>
+                <mxCell id="105" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Essen&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1ba1e2;fontColor=#ffffff;strokeColor=#006EAF;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1760" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="106" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Trinken&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#a20025;fontColor=#ffffff;strokeColor=#6F0000;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1800" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="107" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Auto&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#d80073;fontColor=#ffffff;strokeColor=#A50040;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1840" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="111" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=18;" edge="1" parent="1" source="108" target="74">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="108" value="Actor" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontSize=18;" vertex="1" parent="1">
+                    <mxGeometry x="1715" y="150" width="30" height="60" as="geometry"/>
+                </mxCell>
             </root>
         </mxGraphModel>
     </diagram>

docker-compose.yml

@@ -1,11 +1,9 @@
 services:
   xpensely-server:
     image: tea.zendric.de/cedric/xpensely-server:latest
+    pull_policy: always
     restart: always
     environment:
-      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
-      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
-
       DB_PORT: 5432
       DB_P_NAME: ${POSTGRES_DB}
       DB_USERNAME: ${POSTGRES_USER}

dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17-jdk
+FROM eclipse-temurin:21-jdk
 
 COPY ./target/*.jar app.jar
 

docs/API.md

@@ -1,6 +1,6 @@
 # Xpensely Server — API Reference
 
-> Last updated: 2026-05-09 · Branch: `feature/security-hardening`
+> Last updated: 2026-05-14 · Branch: `dev`
 
 ## Table of Contents
 1. [Overview](#1-overview)
@@ -28,6 +28,7 @@ Xpensely Server is a Spring Boot REST API that manages shared expense lists for
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/` | Health check — returns `"Welcome"` |
+| GET | `/api/version` | Returns build version and timestamp |
 | POST | `/api/users/createUser` | Register a new user |
 | GET | `/api/users/byName` | Look up a user by username |
 
@@ -98,6 +99,25 @@ Welcome
 
 ---
 
+#### `GET /api/version`
+
+Returns the application version and build timestamp. No authentication required.
+
+**Response:** `200 OK`
+```json
+{
+  "version": "0.0.1-SNAPSHOT",
+  "builtAt": "2026-05-09T10:00:00Z"
+}
+```
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `version` | String | Maven project version |
+| `builtAt` | String (ISO-8601) | UTC timestamp of the build |
+
+---
+
 ### 4.2 Users
 
 Base path: `/api/users`
@@ -121,7 +141,7 @@ Base path: `/api/users`
 | `username` | String | Required. 3–30 chars. Pattern: `^[a-zA-Z0-9_.\-]+$` |
 | `googleId` | String | Required. Non-blank. Must match the JWT `sub` from Google. |
 
-**Success response:** `200 OK` — returns the created [AppUser](#appuser) object.
+**Success response:** `201 Created` — returns the created [AppUser](#appuser) object.
 
 **Error responses:**
 | Status | Condition |
@@ -145,6 +165,7 @@ Base path: `/api/users`
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Authenticated user's ID does not match the requested `id` |
 | 404 | No user found for `id` |
 
 ---
@@ -181,6 +202,7 @@ Base path: `/api/users`
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Requested Google ID does not match the authenticated user's Google ID |
 | 404 | No user found for that Google ID |
 
 ---
@@ -194,11 +216,12 @@ Base path: `/api/users`
 |-------|------|----------|-------------|
 | `id` | Long | Yes | Database ID of the user to delete |
 
-**Success response:** `200 OK` — returns the deleted [AppUser](#appuser).
+**Success response:** `200 OK` — returns a plain string: `"User deleted: <username>"`.
 
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Authenticated user's ID does not match the requested `id` |
 | 404 | No user found for `id` |
 
 ---
@@ -219,7 +242,11 @@ Returns all expense lists where the caller is the owner **or** has been shared t
 
 **Request body:** None
 
-**Success response:** `200 OK` — array of [ExpenseList](#expenselist).
+**Success responses:**
+| Status | Condition |
+|--------|-----------|
+| 200 OK | Returns array of [ExpenseList](#expenselist) |
+| 204 No Content | Caller has no expense lists |
 
 ```json
 [
@@ -337,7 +364,7 @@ Only the **owner** may delete a list. Deleting a list cascades to all its expens
 | `date` | String (ISO-8601) | Required. Format: `YYYY-MM-DD`. |
 | `category` | String | Required. Non-blank category name. |
 
-**Success response:** `200 OK` — returns the created [Expense](#expense).
+**Success response:** `201 Created` — returns the created [Expense](#expense).
 
 **Error responses:**
 | Status | Condition |
@@ -411,7 +438,7 @@ Caller must be a member of the list. Expense must belong to the specified list.
 
 Caller must be a member of the list.
 
-**Success response:** `200 OK` — returns the deleted [Expense](#expense).
+**Success response:** `204 No Content`
 
 **Error responses:**
 | Status | Condition |
@@ -465,13 +492,14 @@ Joins the caller to a shared expense list using an invite code.
 |-------|------|-------------|
 | `inviteCode` | String | Required. Exactly 6 characters. |
 
-**Success response:** `200 OK` — returns the [ExpenseList](#expenselist) the caller joined.
+**Success response:** `200 OK` — returns a plain string: `"User added to the list"`.
 
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
-| 400 | Validation failure or invite code not found / expired |
-| 403 | Caller is already the owner of this list |
+| 400 | Validation failure or caller is already the owner of the list |
+| 404 | Invite code not found or expired |
+| 226 IM Used | List already has a second member (`sharedWith` is not null) |
 
 ---
 

pom.xml

@@ -128,6 +128,13 @@
                         </exclude>
                     </excludes>
                 </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>build-info</goal>
+                        </goals>
+                    </execution>
+                </executions>
             </plugin>
         </plugins>
     </build>

src/main/java/de/zendric/app/xpensely_server/controller/HomeController.java

@@ -1,13 +1,30 @@
 package de.zendric.app.xpensely_server.controller;
 
+import org.springframework.boot.info.BuildProperties;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.Map;
+
 @RestController
 class HomeController {
 
+    private final BuildProperties buildProperties;
+
+    HomeController(BuildProperties buildProperties) {
+        this.buildProperties = buildProperties;
+    }
+
     @GetMapping("/")
     public String getAll() {
         return "Welcome";
     }
+
+    @GetMapping("/api/version")
+    public Map<String, String> version() {
+        return Map.of(
+                "version", buildProperties.getVersion(),
+                "builtAt", buildProperties.getTime().toString()
+        );
+    }
 }

src/main/java/de/zendric/app/xpensely_server/security/SecurityConfig.java

@@ -28,10 +28,10 @@ public class SecurityConfig {
         public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
                 http
                                 .authorizeHttpRequests(auth -> auth
+                                                .requestMatchers("/api/version").permitAll()
                                                 .anyRequest().authenticated())
                                 .oauth2ResourceServer(oauth2 -> oauth2
                                                 .jwt(Customizer.withDefaults()))
-                                .oauth2Login(Customizer.withDefaults())
                                 .addFilterAfter(new RateLimitFilter(), BearerTokenAuthenticationFilter.class)
                                 .csrf(csrf -> csrf.disable());
 

src/main/resources/application.properties

@@ -3,8 +3,6 @@ spring.application.name=XpenselyServer
 
 #Security
 spring.security.enabled=false
-spring.security.oauth2.client.registration.google.client-id=${GOOGLE_CLIENT_ID}
-spring.security.oauth2.client.registration.google.client-secret=${GOOGLE_CLIENT_SECRET}
 spring.security.oauth2.resourceserver.jwt.issuer-uri=https://accounts.google.com
 
 # PostgreSQL Configuration