Merge pull request 'Fix Tag Workflow' (#17 ) from dev into main

Reviewed-on: #17
Fix Tag Workflow
2026-07-05 00:08:49 +02:00 · 2026-07-05 00:08:18 +02:00 · 2026-07-05 00:03:46 +02:00 · 2026-07-04 22:50:54 +02:00 · 2026-07-04 22:14:58 +02:00 · 2026-07-04 17:31:21 +02:00
33 changed files with 846 additions and 149 deletions
@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)"
+    ]
+  }
+}
@@ -7,48 +7,51 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-java17

    steps:
      # 1. Checkout the code
      - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

-      # 2. Set up Java and Maven
-      - name: Set up JDK (Eclipse Temurin)
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-          cache: maven
-
-      # 3. Verify Maven installation
-      - name: Install Maven
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y maven
-          mvn -version
-
-      # 4. Build the Spring Boot application
+      # 2. Build the Spring Boot application using the Maven wrapper (Java 17 pre-installed in runner image)
      - name: Build Spring Boot Application
-        run: |
-          mvn clean package -DskipTests
+        run: ./mvnw clean package -DskipTests

-      # 5. Set up Docker
-      - name: Set up Docker
-        run: |
-          docker --version
+      # 4. Set up Docker Buildx (enables layer caching)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

-      # 6. Build the Docker image
-      - name: Build and Package Docker Image
-        run: |
-          docker build -t tea.zendric.de/cedric/xpensely-server:latest .
+      # 5. Login to Docker Hub to avoid pull rate limits
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      # 7. Docker login
+      # 6. Docker login to Gitea registry
      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: tea.zendric.de
+          username: ${{ secrets.TEAUSER }}
+          password: ${{ secrets.TEAPASSWORD }}
+
+      # 7. Build and push Docker image with layer caching
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: tea.zendric.de/cedric/xpensely-server:latest
+          cache-from: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache
+          cache-to: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache,mode=max
+
+      # 8. Trigger Dokploy to redeploy the dev server automatically via API
+      - name: Trigger Dokploy Redeploy
        run: |
-          echo "${{ secrets.TEAPASSWORD }}" | docker login tea.zendric.de -u ${{ secrets.TEAUSER }} --password-stdin
-      # 8. Push Docker image
-      - name: Push the Docker Image to registry
-        run: |
-          docker push tea.zendric.de/cedric/xpensely-server:latest
+          curl -X POST "https://dokploy.zendric.de/api/compose.deploy" \
+            -H "Content-Type: application/json" \
+            -H "x-api-key: ${{ secrets.DOKPLOY_API_TOKEN }}" \
+            -d "{\"composeId\": \"${{ secrets.DOKPLOY_COMPOSE_ID }}\"}" \
+            --fail
@@ -7,78 +7,65 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-java17

    steps:
      # 1. Checkout the code
      - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

-      # 2. Set up Java and Maven
-      - name: Set up JDK (Eclipse Temurin)
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-          cache: maven
-
-      # 3. Verify Maven installation
-      - name: Install Maven
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y maven
-          mvn -version
-
-      # 4. Build the Spring Boot application
+      # 2. Build the Spring Boot application using the Maven wrapper
+      #    (Java 17 is pre-installed in the runner image)
      - name: Build Spring Boot Application
-        run: |
-          mvn clean package -DskipTests
+        run: ./mvnw clean package -DskipTests

-      # 5. Set up Docker
-      - name: Set up Docker
+      # 3. Derive version tags from the pushed git tag
+      #    e.g. 1.1.0 -> tag_version=1.1.0, minor=1.1, major=1
+      - name: Extract version tags
+        id: ver
        run: |
-          docker --version
-
-      # 6. Extract the tag name
-      - name: Extract Tag Version
-        id: extract_version
-        run: |
-          TAG_VERSION=$(echo "${GITHUB_REF}" | sed 's#refs/tags/##')
+          TAG_VERSION="${{ github.ref_name }}"
          if [ -z "$TAG_VERSION" ]; then
            echo "Error: TAG_VERSION is empty."
            exit 1
          fi
-          echo "TAG_VERSION=$TAG_VERSION" >> $GITHUB_ENV
+          MINOR_VERSION=$(echo "$TAG_VERSION" | cut -d. -f1,2)
+          MAJOR_VERSION=$(echo "$TAG_VERSION" | cut -d. -f1)
+          echo "tag_version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
+          echo "minor=$MINOR_VERSION"     >> "$GITHUB_OUTPUT"
+          echo "major=$MAJOR_VERSION"     >> "$GITHUB_OUTPUT"

-          # Extract major and minor versions
-          MAJOR_VERSION=$(echo "${TAG_VERSION}" | cut -d. -f1)
-          MINOR_VERSION=$(echo "${TAG_VERSION}" | cut -d. -f1,2)
-          echo "MAJOR_VERSION=$MAJOR_VERSION" >> $GITHUB_ENV
-          echo "MINOR_VERSION=$MINOR_VERSION" >> $GITHUB_ENV
+      # 4. Set up Docker Buildx (enables layer caching)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

-      # 7. Build the Docker image with the tag
-      - name: Build and Package Docker Image
-        run: |
-          docker build -t tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} .
+      # 5. Login to Docker Hub to avoid base-image pull rate limits
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}

-      # 8. Tag the image with Major Version (e.g., 0)
-      - name: Tag with Major Version
-        run: |
-          docker tag tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} tea.zendric.de/cedric/xpensely-server:${{ env.MAJOR_VERSION }}
-
-      # 9. Tag the image with Minor Version (e.g., 0.1)
-      - name: Tag with Minor Version
-        run: |
-          docker tag tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} tea.zendric.de/cedric/xpensely-server:${{ env.MINOR_VERSION }}
-
-      # 10. Docker login
+      # 6. Login to the Gitea registry
      - name: Login to Docker Registry
-        run: |
-          echo "${{ secrets.TEAPASSWORD }}" | docker login tea.zendric.de -u ${{ secrets.TEAUSER }} --password-stdin
+        uses: docker/login-action@v3
+        with:
+          registry: tea.zendric.de
+          username: ${{ secrets.TEAUSER }}
+          password: ${{ secrets.TEAPASSWORD }}

-      # 11. Push the Docker images with the tags
-      - name: Push the Docker Image to registry
-        run: |
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }}
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.MAJOR_VERSION }}
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.MINOR_VERSION }}
+      # 7. Build and push the versioned Docker images with layer caching.
+      #    Pushes exact, minor, and major tags. The prod compose references
+      #    the major tag (":1"), so pushing here makes the new build available
+      #    to pull in Dockge — deploy is triggered MANUALLY after the DB migration.
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.tag_version }}
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.minor }}
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.major }}
+          cache-from: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache
+          cache-to: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache,mode=max
@@ -6,6 +6,11 @@ target/
 !**/src/test/**/target/
 .env

+# Local debugging (not for CI/prod)
+.env.local
+Dockerfile.local
+compose.local.yml
+
 ### STS ###
 .apt_generated
 .classpath
@@ -0,0 +1,7 @@
+Run it locally:
+
+1. build the current state:
+   mvn clean install or mvn clean install -DskipTests
+
+2. docker it up and run it
+   docker-compose -f dev-docker-compose.yml up --build
@@ -1,6 +1,6 @@
 <mxfile host="65bd71144e">
    <diagram id="TZX9Tq6sZIlTxQ58HocZ" name="Page-1">
-        <mxGraphModel dx="826" dy="472" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
+        <mxGraphModel dx="989" dy="570" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
            <root>
                <mxCell id="0"/>
                <mxCell id="1" parent="0"/>
@@ -193,6 +193,90 @@
                <mxCell id="73" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;24.12.24 ; Expense ; 24,12 €&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#76608a;fontColor=#ffffff;strokeColor=#432D57;" parent="1" vertex="1">
                    <mxGeometry x="1399" y="226" width="120" height="20" as="geometry"/>
                </mxCell>
+                <mxCell id="86" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="74" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="74" value="List" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#60a917;fontColor=#ffffff;strokeColor=#2D7600;" vertex="1" parent="1">
+                    <mxGeometry x="1880" y="160" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="75" value="DB-Structure for Categories" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
+                    <mxGeometry x="1930" y="35" width="100" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="78" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="76" target="77">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="76" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="220" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="79" value="Available Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2160" y="150" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="83" style="edgeStyle=none;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="81" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="81" value="Standard Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2060" y="35" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="84" style="edgeStyle=none;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="82" target="79">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="82" value="Custom Categories" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2270" y="35" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="91" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="87" target="90">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="87" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="280" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="92" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="88" target="89">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="88" value="List Entry" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1920" y="340" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="89" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="370" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="90" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="315" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="94" value="&lt;h1 style=&quot;font-size: 18px;&quot;&gt;- list id&lt;/h1&gt;&lt;div&gt;- List &amp;lt;String&amp;gt;&lt;/div&gt;" style="text;html=1;strokeColor=none;fillColor=none;spacing=5;spacingTop=-20;whiteSpace=wrap;overflow=hidden;rounded=0;fontSize=18;" vertex="1" parent="1">
+                    <mxGeometry x="2410" y="50" width="130" height="70" as="geometry"/>
+                </mxCell>
+                <mxCell id="77" value="Category" style="ellipse;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="2150" y="260" width="120" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="97" value="" style="rounded=0;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1730" y="510" width="200" height="320" as="geometry"/>
+                </mxCell>
+                <mxCell id="98" value="ExpenseList" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1770" y="520" width="120" height="20" as="geometry"/>
+                </mxCell>
+                <mxCell id="100" value="+" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="1880" y="790" width="30" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="101" value="Categorie" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
+                    <mxGeometry x="1770" y="480" width="120" height="30" as="geometry"/>
+                </mxCell>
+                <mxCell id="102" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Amount : 24,12 €&lt;br&gt;Title: Expense&lt;br&gt;Date: 24.12.24&lt;br&gt;From: Jessi&lt;br&gt;Deviation: 0 €&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#76608a;fontColor=#ffffff;strokeColor=#432D57;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1745" y="550" width="170" height="170" as="geometry"/>
+                </mxCell>
+                <mxCell id="105" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Essen&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#1ba1e2;fontColor=#ffffff;strokeColor=#006EAF;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1760" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="106" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Trinken&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#a20025;fontColor=#ffffff;strokeColor=#6F0000;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1800" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="107" value="&lt;span style=&quot;font-size: 8px;&quot;&gt;Auto&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#d80073;fontColor=#ffffff;strokeColor=#A50040;align=left;spacingLeft=12;" vertex="1" parent="1">
+                    <mxGeometry x="1840" y="680" width="40" height="10" as="geometry"/>
+                </mxCell>
+                <mxCell id="111" style="edgeStyle=none;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=18;" edge="1" parent="1" source="108" target="74">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="108" value="Actor" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontSize=18;" vertex="1" parent="1">
+                    <mxGeometry x="1715" y="150" width="30" height="60" as="geometry"/>
+                </mxCell>
            </root>
        </mxGraphModel>
    </diagram>
@@ -1,11 +1,9 @@
 services:
  xpensely-server:
    image: tea.zendric.de/cedric/xpensely-server:latest
+    pull_policy: always
    restart: always
    environment:
-      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
-      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
-
      DB_PORT: 5432
      DB_P_NAME: ${POSTGRES_DB}
      DB_USERNAME: ${POSTGRES_USER}
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17-jdk
+FROM eclipse-temurin:21-jdk

 COPY ./target/*.jar app.jar

@@ -1,6 +1,6 @@
 # Xpensely Server — API Reference

-> Last updated: 2026-05-09 · Branch: `feature/security-hardening`
+> Last updated: 2026-05-14 · Branch: `dev`

 ## Table of Contents
 1. [Overview](#1-overview)
@@ -28,6 +28,7 @@ Xpensely Server is a Spring Boot REST API that manages shared expense lists for
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/` | Health check — returns `"Welcome"` |
+| GET | `/api/version` | Returns build version and timestamp |
 | POST | `/api/users/createUser` | Register a new user |
 | GET | `/api/users/byName` | Look up a user by username |

@@ -98,6 +99,25 @@ Welcome

 ---

+#### `GET /api/version`
+
+Returns the application version and build timestamp. No authentication required.
+
+**Response:** `200 OK`
+```json
+{
+  "version": "0.0.1-SNAPSHOT",
+  "builtAt": "2026-05-09T10:00:00Z"
+}
+```
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `version` | String | Maven project version |
+| `builtAt` | String (ISO-8601) | UTC timestamp of the build |
+
+---
+
 ### 4.2 Users

 Base path: `/api/users`
@@ -121,7 +141,7 @@ Base path: `/api/users`
 | `username` | String | Required. 3–30 chars. Pattern: `^[a-zA-Z0-9_.\-]+$` |
 | `googleId` | String | Required. Non-blank. Must match the JWT `sub` from Google. |

-**Success response:** `200 OK` — returns the created [AppUser](#appuser) object.
+**Success response:** `201 Created` — returns the created [AppUser](#appuser) object.

 **Error responses:**
 | Status | Condition |
@@ -145,6 +165,7 @@ Base path: `/api/users`
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Authenticated user's ID does not match the requested `id` |
 | 404 | No user found for `id` |

 ---
@@ -181,6 +202,7 @@ Base path: `/api/users`
 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Requested Google ID does not match the authenticated user's Google ID |
 | 404 | No user found for that Google ID |

 ---
@@ -194,11 +216,12 @@ Base path: `/api/users`
 |-------|------|----------|-------------|
 | `id` | Long | Yes | Database ID of the user to delete |

-**Success response:** `200 OK` — returns the deleted [AppUser](#appuser).
+**Success response:** `200 OK` — returns a plain string: `"User deleted: <username>"`.

 **Error responses:**
 | Status | Condition |
 |--------|-----------|
+| 403 | Authenticated user's ID does not match the requested `id` |
 | 404 | No user found for `id` |

 ---
@@ -219,7 +242,11 @@ Returns all expense lists where the caller is the owner **or** has been shared t

 **Request body:** None

-**Success response:** `200 OK` — array of [ExpenseList](#expenselist).
+**Success responses:**
+| Status | Condition |
+|--------|-----------|
+| 200 OK | Returns array of [ExpenseList](#expenselist) |
+| 204 No Content | Caller has no expense lists |

 ```json
 [
@@ -337,7 +364,7 @@ Only the **owner** may delete a list. Deleting a list cascades to all its expens
 | `date` | String (ISO-8601) | Required. Format: `YYYY-MM-DD`. |
 | `category` | String | Required. Non-blank category name. |

-**Success response:** `200 OK` — returns the created [Expense](#expense).
+**Success response:** `201 Created` — returns the created [Expense](#expense).

 **Error responses:**
 | Status | Condition |
@@ -411,7 +438,7 @@ Caller must be a member of the list. Expense must belong to the specified list.

 Caller must be a member of the list.

-**Success response:** `200 OK` — returns the deleted [Expense](#expense).
+**Success response:** `204 No Content`

 **Error responses:**
 | Status | Condition |
@@ -465,13 +492,14 @@ Joins the caller to a shared expense list using an invite code.
 |-------|------|-------------|
 | `inviteCode` | String | Required. Exactly 6 characters. |

-**Success response:** `200 OK` — returns the [ExpenseList](#expenselist) the caller joined.
+**Success response:** `200 OK` — returns a plain string: `"User added to the list"`.

 **Error responses:**
 | Status | Condition |
 |--------|-----------|
-| 400 | Validation failure or invite code not found / expired |
-| 403 | Caller is already the owner of this list |
+| 400 | Validation failure or caller is already the owner of the list |
+| 404 | Invite code not found or expired |
+| 226 IM Used | List already has a second member (`sharedWith` is not null) |

 ---

@@ -0,0 +1,148 @@
+# Xpensely API — Manual test file (IntelliJ HTTP Client / VS Code REST Client)
+#
+# HOW TO GET A TOKEN:
+#   1. Run the Flutter dev app and sign in with Google
+#   2. Add a breakpoint or log in auth_interceptor.dart after _storage.read(key: 'id_token')
+#   3. Paste the token value below (valid for ~1 hour)
+#
+# Switch between dev and prod by changing @baseUrl.
+
+@devBaseUrl  = https://dev-xpensely.zendric.de/api
+@prodBaseUrl = https://xpensely.zendric.de/api
+@baseUrl     = {{devBaseUrl}}
+
+# Paste your Google ID token here:
+@token = PASTE_ID_TOKEN_HERE
+
+# Your Google sub (from the JWT payload — decode at jwt.io):
+@googleId = PASTE_GOOGLE_SUB_HERE
+
+
+### ─── Health ────────────────────────────────────────────────────────────────
+
+### Version (no auth required — should always return 200)
+GET {{baseUrl}}/version
+
+### ─── Auth probe ─────────────────────────────────────────────────────────────
+
+### Any protected endpoint without a token — expect 401
+GET {{baseUrl}}/users/byGoogleId?id={{googleId}}
+
+### ─── Users ──────────────────────────────────────────────────────────────────
+
+### Look up your account by Google ID — expect 200 if account exists, 403 if not
+GET {{baseUrl}}/users/byGoogleId?id={{googleId}}
+Authorization: Bearer {{token}}
+
+###
+
+### Get your account by DB id — replace {id} with your numeric user id
+GET {{baseUrl}}/users?id=1
+Authorization: Bearer {{token}}
+
+###
+
+### Get any user by username (no auth required)
+GET {{baseUrl}}/users/byName?username=testuser
+
+###
+
+### Create a new account (requires valid JWT — account must not exist yet)
+POST {{baseUrl}}/users/createUser
+Content-Type: application/json
+Authorization: Bearer {{token}}
+
+{
+  "username": "myusername",
+  "googleId": "{{googleId}}"
+}
+
+###
+
+### Delete your account — replace {id} with your numeric user id
+DELETE {{baseUrl}}/users?id=1
+Authorization: Bearer {{token}}
+
+### ─── Expense Lists ───────────────────────────────────────────────────────────
+
+### Get all your expense lists — expect 200 (with data) or 204 (empty)
+GET {{baseUrl}}/expenselist/mine
+Authorization: Bearer {{token}}
+
+###
+
+### Get a specific expense list by id
+GET {{baseUrl}}/expenselist/byId?id=1
+Authorization: Bearer {{token}}
+
+###
+
+### Create a new expense list
+POST {{baseUrl}}/expenselist/create
+Content-Type: application/json
+Authorization: Bearer {{token}}
+
+{
+  "name": "Groceries"
+}
+
+###
+
+### Add an expense to a list — replace {listId} in the URL
+POST {{baseUrl}}/expenselist/1/add
+Content-Type: application/json
+Authorization: Bearer {{token}}
+
+{
+  "title": "Coffee",
+  "owner": "myusername",
+  "amount": 4.50,
+  "date": "2026-05-15",
+  "category": "Food"
+}
+
+###
+
+### Update an expense in a list
+PUT {{baseUrl}}/expenselist/1/update
+Content-Type: application/json
+Authorization: Bearer {{token}}
+
+{
+  "id": 1,
+  "title": "Coffee (updated)",
+  "ownerName": "myusername",
+  "amount": 5.00,
+  "date": "2026-05-15",
+  "category": "Food",
+  "expenseListId": 1
+}
+
+###
+
+### Delete an expense from a list
+DELETE {{baseUrl}}/expenselist/1/delete?expenseId=1
+Authorization: Bearer {{token}}
+
+###
+
+### Generate an invite code for a list (you must be the owner)
+POST {{baseUrl}}/expenselist/1/invite
+Authorization: Bearer {{token}}
+
+###
+
+### Accept an invite
+POST {{baseUrl}}/expenselist/accept-invite
+Content-Type: application/json
+Authorization: Bearer {{token}}
+
+{
+  "inviteCode": "PASTE_6_CHAR_CODE_HERE"
+}
+
+###
+
+### Delete an expense list (you must be the owner)
+DELETE {{baseUrl}}/expenselist/1
+Authorization: Bearer {{token}}
@@ -6,11 +6,11 @@
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.0.6</version>
-        <relativePath/> <!-- lookup parent from repository -->
+        <relativePath/>
    </parent>
    <groupId>de.zendric.app</groupId>
    <artifactId>XpenselyServer</artifactId>
-    <version>1.0.0</version>
+    <version>1.1.0</version>
    <name>XpenselyServer</name>
    <description>XpenselyServer used to handle the Xpensely App</description>
    <url/>
@@ -52,10 +52,6 @@
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-oauth2-client</artifactId>
-        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
@@ -128,6 +124,13 @@
                        </exclude>
                    </excludes>
                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>build-info</goal>
+                        </goals>
+                    </execution>
+                </executions>
            </plugin>
        </plugins>
    </build>
@@ -9,6 +9,7 @@ import org.springframework.web.server.ResponseStatusException;

 import de.zendric.app.xpensely_server.model.AppUser;
 import de.zendric.app.xpensely_server.model.AppUserCreateRequest;
+import de.zendric.app.xpensely_server.model.UsernameUpdateRequest;
 import de.zendric.app.xpensely_server.security.AuthenticatedUserResolver;
 import de.zendric.app.xpensely_server.services.UserService;

@@ -31,11 +32,6 @@ public class AppUserController {
        return ResponseEntity.ok(userService.getUser(id));
    }

-    @GetMapping("/byName")
-    public AppUser getUserByName(@RequestParam String username) {
-        return userService.getUserByName(username);
-    }
-
    @GetMapping("/byGoogleId")
    public ResponseEntity<AppUser> getUserByGoogleId(@RequestParam String id, Authentication authentication) {
        AppUser self = authenticatedUserResolver.resolveCurrentUser(authentication);
@@ -51,6 +47,14 @@ public class AppUserController {
        return new ResponseEntity<>(nUser, HttpStatus.CREATED);
    }

+    @PutMapping("/username")
+    public ResponseEntity<AppUser> updateUsername(@RequestBody @Valid UsernameUpdateRequest request,
+            Authentication authentication) {
+        AppUser self = authenticatedUserResolver.resolveCurrentUser(authentication);
+        AppUser updated = userService.updateUsername(self.getId(), request.getUsername());
+        return ResponseEntity.ok(updated);
+    }
+
    @DeleteMapping
    public ResponseEntity<String> deleteUser(@RequestParam Long id, Authentication authentication) {
        AppUser self = authenticatedUserResolver.resolveCurrentUser(authentication);
@@ -17,7 +17,6 @@ import de.zendric.app.xpensely_server.model.*;
 import de.zendric.app.xpensely_server.security.AuthenticatedUserResolver;
 import de.zendric.app.xpensely_server.services.CategoryService;
 import de.zendric.app.xpensely_server.services.ExpenseListService;
-import de.zendric.app.xpensely_server.services.UserService;

@RestController
@RequestMapping("/api/expenselist")
@@ -26,14 +25,12 @@ public class ExpenseListController {
    private static final Logger log = LoggerFactory.getLogger(ExpenseListController.class);

    private final ExpenseListService expenseListService;
-    private final UserService userService;
    private final CategoryService categoryService;
    private final AuthenticatedUserResolver authenticatedUserResolver;

-    public ExpenseListController(ExpenseListService expenseListService, UserService userService,
+    public ExpenseListController(ExpenseListService expenseListService,
            CategoryService categoryService, AuthenticatedUserResolver authenticatedUserResolver) {
        this.expenseListService = expenseListService;
-        this.userService = userService;
        this.categoryService = categoryService;
        this.authenticatedUserResolver = authenticatedUserResolver;
    }
@@ -83,6 +80,18 @@ public class ExpenseListController {
        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
    }

+    @PutMapping("/{id}/rename")
+    public ResponseEntity<ExpenseList> rename(@PathVariable("id") Long id,
+            @RequestBody @Valid CreateExpenseListRequest request, Authentication authentication) {
+        AppUser user = authenticatedUserResolver.resolveCurrentUser(authentication);
+        Optional<ExpenseList> listOpt = expenseListService.findById(id);
+        if (listOpt.isEmpty())
+            return new ResponseEntity<>(HttpStatus.NOT_FOUND);
+        assertOwner(user, listOpt.get());
+        ExpenseList renamed = expenseListService.renameList(id, request.getName());
+        return new ResponseEntity<>(renamed, HttpStatus.OK);
+    }
+
    @PostMapping("/{id}/add")
    public ResponseEntity<Expense> addExpenseToList(
            @PathVariable("id") Long expenseListId,
@@ -93,7 +102,7 @@ public class ExpenseListController {
        if (listOpt.isEmpty())
            return new ResponseEntity<>(HttpStatus.NOT_FOUND);
        assertMember(user, listOpt.get());
-        AppUser expenseOwner = userService.getUserByName(expenseInput.getOwner());
+        AppUser expenseOwner = resolveListMember(listOpt.get(), expenseInput.getOwner());
        Expense expense = expenseInput.convertToExpense(expenseOwner.getId());
        Expense addedExpense = expenseListService.addExpenseToList(expenseListId, expense);
        return new ResponseEntity<>(addedExpense, HttpStatus.CREATED);
@@ -109,7 +118,7 @@ public class ExpenseListController {
        if (expenseListOpt.isEmpty())
            return new ResponseEntity<>(HttpStatus.NOT_FOUND);
        assertMember(user, expenseListOpt.get());
-        AppUser expenseOwner = userService.getUserByName(expenseChangeRequest.getOwnerName());
+        AppUser expenseOwner = resolveListMember(expenseListOpt.get(), expenseChangeRequest.getOwnerName());
        Expense expense = expenseChangeRequest.convertToExpense(expenseOwner.getId(), expenseListOpt.get());
        Expense updatedExpense = expenseListService.updateExpense(expenseListId, expense);
        return new ResponseEntity<>(updatedExpense, HttpStatus.OK);
@@ -156,6 +165,11 @@ public class ExpenseListController {
        if (list.getOwner().getId().equals(authenticatedUser.getId())) {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("You cannot join your own list");
        }
+        if (list.getOwner().getUsername().equals(authenticatedUser.getUsername())) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).body(
+                    "You and the list owner both use the username \"" + authenticatedUser.getUsername()
+                            + "\". Please change your username before joining this list.");
+        }
        list.setSharedWith(authenticatedUser);
        expenseListService.save(list);
        return ResponseEntity.ok("User added to the list");
@@ -173,4 +187,20 @@ public class ExpenseListController {
        if (!isOwner && !isShared)
            throw new ResponseStatusException(HttpStatus.FORBIDDEN);
    }
+
+    /**
+     * Resolves an expense owner by username among the list's members. Usernames are
+     * not globally unique, so the owner must be one of this list's (at most two)
+     * members — never a global lookup.
+     */
+    private AppUser resolveListMember(ExpenseList list, String username) {
+        if (list.getOwner() != null && list.getOwner().getUsername().equals(username)) {
+            return list.getOwner();
+        }
+        if (list.getSharedWith() != null && list.getSharedWith().getUsername().equals(username)) {
+            return list.getSharedWith();
+        }
+        throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
+                "Expense owner must be a member of this list");
+    }
 }
@@ -1,5 +1,6 @@
 package de.zendric.app.xpensely_server.controller;

+import de.zendric.app.xpensely_server.model.Exception.GoogleAccountAlreadyRegisteredException;
 import de.zendric.app.xpensely_server.model.Exception.ResourceNotFoundException;
 import de.zendric.app.xpensely_server.model.Exception.UsernameAlreadyExistsException;
 import org.slf4j.Logger;
@@ -47,6 +48,13 @@ public class GlobalExceptionHandler {
                .body(Map.of("error", ex.getMessage()));
    }

+    @ExceptionHandler(GoogleAccountAlreadyRegisteredException.class)
+    public ResponseEntity<Map<String, String>> handleGoogleAccountConflict(
+            GoogleAccountAlreadyRegisteredException ex) {
+        return ResponseEntity.status(HttpStatus.CONFLICT)
+                .body(Map.of("error", ex.getMessage()));
+    }
+
    @ExceptionHandler(ResponseStatusException.class)
    public ResponseEntity<Map<String, String>> handleResponseStatus(ResponseStatusException ex) {
        return ResponseEntity.status(ex.getStatusCode())
@@ -1,13 +1,30 @@
 package de.zendric.app.xpensely_server.controller;

+import org.springframework.boot.info.BuildProperties;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;

+import java.util.Map;
+
@RestController
 class HomeController {

+    private final BuildProperties buildProperties;
+
+    HomeController(BuildProperties buildProperties) {
+        this.buildProperties = buildProperties;
+    }
+
    @GetMapping("/")
    public String getAll() {
        return "Welcome";
    }
+
+    @GetMapping("/api/version")
+    public Map<String, String> version() {
+        return Map.of(
+                "version", buildProperties.getVersion(),
+                "builtAt", buildProperties.getTime().toString()
+        );
+    }
 }
@@ -26,9 +26,10 @@ public class AppUser {
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

-    @Column(name = "username", nullable = false, unique = true)
+    @Column(name = "username", nullable = false)
    private String username;

+    @Column(name = "google_id", unique = true)
    @JsonIgnore
    private String googleId;

@@ -0,0 +1,11 @@
+package de.zendric.app.xpensely_server.model.Exception;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+@ResponseStatus(HttpStatus.CONFLICT)
+public class GoogleAccountAlreadyRegisteredException extends RuntimeException {
+    public GoogleAccountAlreadyRegisteredException(String message) {
+        super(message);
+    }
+}
@@ -27,7 +27,7 @@ public class ExpenseInput {
    private String owner;

    @NotNull(message = "Amount is required")
-    @DecimalMin(value = "0.01", message = "Amount must be greater than zero")
+    @DecimalMin(value = "0.00", message = "Amount must not be negative")
    private Double amount;

    private Double personalUseAmount;
@@ -36,7 +36,7 @@ public class ExpenseInput {
    @NotNull(message = "Date is required")
    private LocalDate date;

-    @NotBlank(message = "Category is required")
+    // Optional: Quick Add creates stub expenses without a category, to be filled in later.
    private String category;

    private ExpenseList expenseList;
@@ -0,0 +1,15 @@
+package de.zendric.app.xpensely_server.model;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+import lombok.Data;
+
+@Data
+public class UsernameUpdateRequest {
+
+    @NotBlank(message = "Username is required")
+    @Size(min = 3, max = 30, message = "Username must be between 3 and 30 characters")
+    @Pattern(regexp = "^[a-zA-Z0-9_.\\-]+$", message = "Username may only contain letters, digits, underscores, dots, and hyphens")
+    private String username;
+}
@@ -14,4 +14,6 @@ public interface UserRepository extends JpaRepository<AppUser, Long> {
    Optional<AppUser> findByGoogleId(String id);

    Boolean existsByUsername(String username);
+
+    Boolean existsByGoogleId(String googleId);
 }
@@ -1,6 +1,7 @@
 package de.zendric.app.xpensely_server.security;

 import de.zendric.app.xpensely_server.model.AppUser;
+import de.zendric.app.xpensely_server.model.Exception.ResourceNotFoundException;
 import de.zendric.app.xpensely_server.services.UserService;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.core.Authentication;
@@ -24,12 +25,8 @@ public class AuthenticatedUserResolver {
        Jwt jwt = (Jwt) authentication.getPrincipal();
        String googleId = jwt.getSubject();
        try {
-            AppUser user = userService.getUserByGoogleId(googleId);
-            if (user == null) {
-                throw new ResponseStatusException(HttpStatus.FORBIDDEN, "User not registered");
-            }
-            return user;
-        } catch (IllegalArgumentException e) {
+            return userService.getUserByGoogleId(googleId);
+        } catch (IllegalArgumentException | ResourceNotFoundException e) {
            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "User not registered");
        }
    }
@@ -28,10 +28,10 @@ public class SecurityConfig {
        public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
                http
                                .authorizeHttpRequests(auth -> auth
+                                                .requestMatchers("/api/version").permitAll()
                                                .anyRequest().authenticated())
                                .oauth2ResourceServer(oauth2 -> oauth2
                                                .jwt(Customizer.withDefaults()))
-                                .oauth2Login(Customizer.withDefaults())
                                .addFilterAfter(new RateLimitFilter(), BearerTokenAuthenticationFilter.class)
                                .csrf(csrf -> csrf.disable());

@@ -39,6 +39,13 @@ public class ExpenseListService {
        repository.deleteById(id);
    }

+    public ExpenseList renameList(Long id, String newName) {
+        ExpenseList list = repository.findById(id)
+                .orElseThrow(() -> new ResourceNotFoundException("ExpenseList not found with id: " + id));
+        list.setName(newName);
+        return repository.save(list);
+    }
+
    public Optional<ExpenseList> findById(Long id) {
        return repository.findById(id);
    }
@@ -5,8 +5,8 @@ import java.util.List;
 import org.springframework.stereotype.Service;

 import de.zendric.app.xpensely_server.model.AppUser;
+import de.zendric.app.xpensely_server.model.Exception.GoogleAccountAlreadyRegisteredException;
 import de.zendric.app.xpensely_server.model.Exception.ResourceNotFoundException;
-import de.zendric.app.xpensely_server.model.Exception.UsernameAlreadyExistsException;
 import de.zendric.app.xpensely_server.repo.UserRepository;

@Service
@@ -22,9 +22,18 @@ public class UserService {
    }

    public AppUser createUser(AppUser user) {
-        if (Boolean.TRUE.equals(userRepository.existsByUsername(user.getUsername()))) {
-            throw new UsernameAlreadyExistsException("Username already exists");
+        if (Boolean.TRUE.equals(userRepository.existsByGoogleId(user.getGoogleId()))) {
+            throw new GoogleAccountAlreadyRegisteredException(
+                    "An account already exists for this Google account");
        }
+        // Usernames are not unique — identity is the Google account (googleId).
+        return userRepository.save(user);
+    }
+
+    public AppUser updateUsername(Long userId, String newUsername) {
+        AppUser user = userRepository.findById(userId)
+                .orElseThrow(() -> new ResourceNotFoundException("User not found with id: " + userId));
+        user.setUsername(newUsername);
        return userRepository.save(user);
    }

@@ -3,8 +3,6 @@ spring.application.name=XpenselyServer

 #Security
 spring.security.enabled=false
-spring.security.oauth2.client.registration.google.client-id=${GOOGLE_CLIENT_ID}
-spring.security.oauth2.client.registration.google.client-secret=${GOOGLE_CLIENT_SECRET}
 spring.security.oauth2.resourceserver.jwt.issuer-uri=https://accounts.google.com

 # PostgreSQL Configuration
@@ -0,0 +1,24 @@
+package de.zendric.app.xpensely_Server.config;
+
+import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Primary;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtException;
+
+/**
+ * Provides a no-op JwtDecoder so the application context starts without
+ * fetching Google's JWKS endpoint. Tests use SecurityMockMvcRequestPostProcessors.jwt()
+ * which populates the SecurityContext directly and never calls this decoder.
+ */
+@TestConfiguration
+public class TestJwtDecoderConfig {
+
+    @Bean
+    @Primary
+    public JwtDecoder jwtDecoder() {
+        return token -> {
+            throw new JwtException("Real JWT validation is disabled in integration tests — use jwt() post-processor");
+        };
+    }
+}
@@ -6,8 +6,6 @@ import de.zendric.app.xpensely_server.security.AuthenticatedUserResolver;
 import de.zendric.app.xpensely_server.services.UserService;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration;
-import org.springframework.boot.security.oauth2.client.autoconfigure.servlet.OAuth2ClientWebSecurityAutoConfiguration;
 import org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
@@ -22,8 +20,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;

@WebMvcTest(value = AppUserController.class, excludeAutoConfiguration = {
-        OAuth2ClientAutoConfiguration.class,
-        OAuth2ClientWebSecurityAutoConfiguration.class,
        OAuth2ResourceServerAutoConfiguration.class
 })
@AutoConfigureMockMvc(addFilters = false)
@@ -99,4 +95,38 @@ class AppUserControllerTest {
        mockMvc.perform(delete("/api/users").param("id", "99"))
                .andExpect(status().isForbidden());
    }
+
+    // --- Rename username ---
+
+    @Test
+    void updateUsername_valid_returns200WithUpdatedUser() throws Exception {
+        AppUser self = new AppUser(); self.setId(1L); self.setUsername("old");
+        AppUser updated = new AppUser(); updated.setId(1L); updated.setUsername("newname");
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(self);
+        when(userService.updateUsername(1L, "newname")).thenReturn(updated);
+
+        mockMvc.perform(put("/api/users/username")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"username\":\"newname\"}"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.username").value("newname"));
+    }
+
+    @Test
+    void updateUsername_invalidPattern_returns400() throws Exception {
+        mockMvc.perform(put("/api/users/username")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"username\":\"bad name!\"}"))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.username").exists());
+    }
+
+    @Test
+    void updateUsername_tooShort_returns400() throws Exception {
+        mockMvc.perform(put("/api/users/username")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"username\":\"ab\"}"))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.username").exists());
+    }
 }
@@ -2,15 +2,13 @@ package de.zendric.app.xpensely_Server.controller;

 import de.zendric.app.xpensely_server.controller.ExpenseListController;
 import de.zendric.app.xpensely_server.model.AppUser;
+import de.zendric.app.xpensely_server.model.Expense;
 import de.zendric.app.xpensely_server.model.ExpenseList;
 import de.zendric.app.xpensely_server.security.AuthenticatedUserResolver;
 import de.zendric.app.xpensely_server.services.CategoryService;
 import de.zendric.app.xpensely_server.services.ExpenseListService;
-import de.zendric.app.xpensely_server.services.UserService;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration;
-import org.springframework.boot.security.oauth2.client.autoconfigure.servlet.OAuth2ClientWebSecurityAutoConfiguration;
 import org.springframework.boot.security.oauth2.server.resource.autoconfigure.servlet.OAuth2ResourceServerAutoConfiguration;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
@@ -19,17 +17,17 @@ import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;

+import java.time.LocalDateTime;
 import java.util.List;
 import java.util.Optional;

 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;

@WebMvcTest(value = ExpenseListController.class, excludeAutoConfiguration = {
-        OAuth2ClientAutoConfiguration.class,
-        OAuth2ClientWebSecurityAutoConfiguration.class,
        OAuth2ResourceServerAutoConfiguration.class
 })
@AutoConfigureMockMvc(addFilters = false)
@@ -38,7 +36,6 @@ class ExpenseListControllerTest {

    @Autowired MockMvc mockMvc;
    @MockitoBean ExpenseListService expenseListService;
-    @MockitoBean UserService userService;
    @MockitoBean CategoryService categoryService;
    @MockitoBean AuthenticatedUserResolver authenticatedUserResolver;

@@ -178,4 +175,110 @@ class ExpenseListControllerTest {
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.name").exists());
    }
+
+    // --- Owner resolution within list members ---
+
+    @Test
+    void addExpense_ownerNotAListMember_returns400() throws Exception {
+        AppUser member = new AppUser(); member.setId(1L); member.setUsername("alice");
+        ExpenseList list = new ExpenseList(); list.setId(1L); list.setOwner(member);
+
+        when(expenseListService.findById(1L)).thenReturn(Optional.of(list));
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(member);
+
+        mockMvc.perform(post("/api/expenselist/1/add")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"title\":\"Lunch\",\"owner\":\"ghost\",\"amount\":10.0,\"date\":\"2026-05-04\",\"category\":\"Food\"}"))
+                .andExpect(status().isBadRequest());
+    }
+
+    @Test
+    void addExpense_ownerIsAListMember_returns201() throws Exception {
+        AppUser member = new AppUser(); member.setId(1L); member.setUsername("alice");
+        ExpenseList list = new ExpenseList(); list.setId(1L); list.setOwner(member);
+
+        when(expenseListService.findById(1L)).thenReturn(Optional.of(list));
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(member);
+        when(expenseListService.addExpenseToList(eq(1L), any())).thenReturn(new Expense());
+
+        mockMvc.perform(post("/api/expenselist/1/add")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"title\":\"Lunch\",\"owner\":\"alice\",\"amount\":10.0,\"date\":\"2026-05-04\",\"category\":\"Food\"}"))
+                .andExpect(status().isCreated());
+    }
+
+    // --- Rename list ---
+
+    @Test
+    void renameList_owner_returns200WithRenamedList() throws Exception {
+        AppUser owner = new AppUser(); owner.setId(1L);
+        ExpenseList list = new ExpenseList(); list.setId(5L); list.setOwner(owner);
+        ExpenseList renamed = new ExpenseList(); renamed.setId(5L); renamed.setName("Groceries");
+
+        when(expenseListService.findById(5L)).thenReturn(Optional.of(list));
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(owner);
+        when(expenseListService.renameList(5L, "Groceries")).thenReturn(renamed);
+
+        mockMvc.perform(put("/api/expenselist/5/rename")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"name\":\"Groceries\"}"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.name").value("Groceries"));
+    }
+
+    @Test
+    void renameList_nonOwner_returns403() throws Exception {
+        AppUser owner = new AppUser(); owner.setId(1L);
+        AppUser nonOwner = new AppUser(); nonOwner.setId(2L);
+        ExpenseList list = new ExpenseList(); list.setId(5L); list.setOwner(owner);
+
+        when(expenseListService.findById(5L)).thenReturn(Optional.of(list));
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(nonOwner);
+
+        mockMvc.perform(put("/api/expenselist/5/rename")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"name\":\"Groceries\"}"))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    void renameList_blankName_returns400() throws Exception {
+        mockMvc.perform(put("/api/expenselist/5/rename")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"name\":\"\"}"))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.name").exists());
+    }
+
+    @Test
+    void renameList_notFound_returns404() throws Exception {
+        AppUser owner = new AppUser(); owner.setId(1L);
+        when(expenseListService.findById(9L)).thenReturn(Optional.empty());
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(owner);
+
+        mockMvc.perform(put("/api/expenselist/9/rename")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"name\":\"Groceries\"}"))
+                .andExpect(status().isNotFound());
+    }
+
+    // --- Duplicate-username invite guard ---
+
+    @Test
+    void acceptInvite_sameUsernameAsOwner_returns409() throws Exception {
+        AppUser owner = new AppUser(); owner.setId(1L); owner.setUsername("cedric");
+        AppUser joiner = new AppUser(); joiner.setId(2L); joiner.setUsername("cedric");
+        ExpenseList list = new ExpenseList();
+        list.setId(1L);
+        list.setOwner(owner);
+        list.setInviteCodeExpiration(LocalDateTime.now().plusHours(1));
+
+        when(expenseListService.findByInviteCode("ABC123")).thenReturn(list);
+        when(authenticatedUserResolver.resolveCurrentUser(any())).thenReturn(joiner);
+
+        mockMvc.perform(post("/api/expenselist/accept-invite")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"inviteCode\":\"ABC123\"}"))
+                .andExpect(status().isConflict());
+    }
 }
@@ -1,6 +1,7 @@
 package de.zendric.app.xpensely_Server.security;

 import de.zendric.app.xpensely_server.model.AppUser;
+import de.zendric.app.xpensely_server.model.Exception.ResourceNotFoundException;
 import de.zendric.app.xpensely_server.security.AuthenticatedUserResolver;
 import de.zendric.app.xpensely_server.services.UserService;
 import org.junit.jupiter.api.BeforeEach;
@@ -48,7 +49,8 @@ class AuthenticatedUserResolverTest {
                .subject("unknown-id")
                .build();
        JwtAuthenticationToken auth = new JwtAuthenticationToken(jwt);
-        when(userService.getUserByGoogleId("unknown-id")).thenReturn(null);
+        when(userService.getUserByGoogleId("unknown-id"))
+                .thenThrow(new ResourceNotFoundException("User not found with Google ID: unknown-id"));

        ResponseStatusException ex = assertThrows(ResponseStatusException.class,
                () -> resolver.resolveCurrentUser(auth));
@@ -0,0 +1,153 @@
+package de.zendric.app.xpensely_Server.security;
+
+import de.zendric.app.xpensely_Server.config.TestJwtDecoderConfig;
+import de.zendric.app.xpensely_server.model.AppUser;
+import de.zendric.app.xpensely_server.repo.ExpenseListRepository;
+import de.zendric.app.xpensely_server.repo.UserRepository;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.context.annotation.Import;
+import org.springframework.http.MediaType;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.MockMvc;
+
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+/**
+ * Full-stack integration tests for the security filter chain.
+ * Runs with the real securityFilterChain (not the test permit-all chain).
+ * Uses an H2 in-memory database (see application-integration.properties).
+ * JWT validation is bypassed via jwt() post-processor — no real Google token needed.
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.MOCK)
+@AutoConfigureMockMvc
+@ActiveProfiles("integration")
+@Import(TestJwtDecoderConfig.class)
+class SecurityFilterChainIntegrationTest {
+
+    @Autowired MockMvc mockMvc;
+    @Autowired UserRepository userRepository;
+    @Autowired ExpenseListRepository expenseListRepository;
+
+    private static final String KNOWN_GOOGLE_ID = "google-integration-test-123";
+    private static final String UNKNOWN_GOOGLE_ID = "google-unknown-999";
+
+    @BeforeEach
+    void setUp() {
+        expenseListRepository.deleteAll();
+        userRepository.deleteAll();
+
+        AppUser user = new AppUser();
+        user.setGoogleId(KNOWN_GOOGLE_ID);
+        user.setUsername("integrationtestuser");
+        userRepository.save(user);
+    }
+
+    @AfterEach
+    void tearDown() {
+        expenseListRepository.deleteAll();
+        userRepository.deleteAll();
+    }
+
+    // --- Public endpoints ---
+
+    @Test
+    void versionEndpoint_noAuth_returns200() throws Exception {
+        mockMvc.perform(get("/api/version"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.version").exists());
+    }
+
+    // --- Unauthenticated access (no JWT) → 401 ---
+
+    @Test
+    void byGoogleId_noJwt_returns401() throws Exception {
+        mockMvc.perform(get("/api/users/byGoogleId").param("id", KNOWN_GOOGLE_ID))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void createUser_noJwt_returns401() throws Exception {
+        mockMvc.perform(post("/api/users/createUser")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"username\":\"newuser\",\"googleId\":\"new-google-id\"}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void expenseListMine_noJwt_returns401() throws Exception {
+        mockMvc.perform(get("/api/expenselist/mine"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    // --- Authenticated, user exists in DB → success ---
+
+    @Test
+    void byGoogleId_withJwt_userInDb_returns200() throws Exception {
+        mockMvc.perform(get("/api/users/byGoogleId")
+                        .param("id", KNOWN_GOOGLE_ID)
+                        .with(jwt().jwt(j -> j.subject(KNOWN_GOOGLE_ID))))
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    void expenseListMine_withJwt_userInDb_emptyList_returns204() throws Exception {
+        mockMvc.perform(get("/api/expenselist/mine")
+                        .with(jwt().jwt(j -> j.subject(KNOWN_GOOGLE_ID))))
+                .andExpect(status().isNoContent());
+    }
+
+    @Test
+    void createUser_withJwt_validBody_returns201() throws Exception {
+        mockMvc.perform(post("/api/users/createUser")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"username\":\"newuser123\",\"googleId\":\"brand-new-google-id\"}")
+                        .with(jwt().jwt(j -> j.subject("brand-new-google-id"))))
+                .andExpect(status().isCreated());
+    }
+
+    // --- Authenticated, user NOT in DB → 403 ---
+
+    @Test
+    void byGoogleId_withJwt_userNotInDb_returns403() throws Exception {
+        mockMvc.perform(get("/api/users/byGoogleId")
+                        .param("id", UNKNOWN_GOOGLE_ID)
+                        .with(jwt().jwt(j -> j.subject(UNKNOWN_GOOGLE_ID))))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    void expenseListMine_withJwt_userNotInDb_returns403() throws Exception {
+        mockMvc.perform(get("/api/expenselist/mine")
+                        .with(jwt().jwt(j -> j.subject(UNKNOWN_GOOGLE_ID))))
+                .andExpect(status().isForbidden());
+    }
+
+    // --- Authenticated, accessing another user's resource → 403 ---
+
+    @Test
+    void byGoogleId_withJwt_differentId_returns403() throws Exception {
+        mockMvc.perform(get("/api/users/byGoogleId")
+                        .param("id", UNKNOWN_GOOGLE_ID)
+                        .with(jwt().jwt(j -> j.subject(KNOWN_GOOGLE_ID))))
+                .andExpect(status().isForbidden());
+    }
+
+    // --- Validation errors still return 400 with JWT ---
+
+    @Test
+    void createUser_withJwt_blankUsername_returns400() throws Exception {
+        mockMvc.perform(post("/api/users/createUser")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content("{\"username\":\"\",\"googleId\":\"some-id\"}")
+                        .with(jwt().jwt(j -> j.subject("some-id"))))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.username").exists());
+    }
+}
@@ -0,0 +1,5 @@
+build.artifact=xpensely-server
+build.group=de.zendric.app
+build.name=XpenselyServer
+build.time=2026-01-01T00\:00\:00.000Z
+build.version=test
@@ -0,0 +1,10 @@
+# H2 in-memory database replaces PostgreSQL for integration tests
+spring.datasource.url=jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;MODE=PostgreSQL
+spring.datasource.driver-class-name=org.h2.Driver
+spring.datasource.username=sa
+spring.datasource.password=
+spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
+spring.jpa.hibernate.ddl-auto=create-drop
+
+# Placeholder URI — TestJwtDecoderConfig overrides the decoder bean so this URI is never fetched
+spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://placeholder.invalid/jwks
Author	SHA1	Message	Date
Cedric	003cf7e2da	Merge pull request 'Fix Tag Workflow' (#17 ) from dev into main Build and Deploy Versioned Spring Boot Server / build (push) Successful in 1m16s Details Reviewed-on: #17	2026-07-05 00:08:49 +02:00
Cedric	6203a83af3	Fix Tag Workflow Build and Deploy Spring Boot Server / build (push) Successful in 1m19s Details	2026-07-05 00:08:18 +02:00
Cedric	c1c530c46b	Merge pull request 'Release 1.1.0' (#16 ) from dev into main Reviewed-on: #16	2026-07-05 00:03:46 +02:00
Cedric	41e32efd7e	Added Rename User and Lists Build and Deploy Spring Boot Server / build (push) Successful in 1m18s Details	2026-07-04 22:50:54 +02:00
Cedric	d73d349a58	Release 1.1.0 Final Security Hardening Build and Deploy Spring Boot Server / build (push) Successful in 1m11s Details	2026-07-04 22:14:58 +02:00
Cedric	f958fb7853	Fixed Auth and Connection issues Build and Deploy Spring Boot Server / build (push) Successful in 3m41s Details	2026-07-04 17:31:21 +02:00
Cedric	7ad72119a8	fix secrets no longer needed Build and Deploy Spring Boot Server / build (push) Successful in 1m13s Details	2026-05-14 23:46:40 +02:00
Cedric	f7f2bf5768	ci: switch to compose.deploy to force fresh image pull Build and Deploy Spring Boot Server / build (push) Successful in 1m12s Details	2026-05-12 23:57:45 +02:00
Cedric	28df2a66ca	fix: always pull latest image on redeploy Build and Deploy Spring Boot Server / build (push) Successful in 1m21s Details	2026-05-12 23:25:07 +02:00
Cedric	29f26a8a18	feat: add /api/version endpoint returning build time and version Build and Deploy Spring Boot Server / build (push) Successful in 1m25s Details	2026-05-12 23:08:37 +02:00
Cedric	a3fa59f347	ci: test full pipeline end-to-end Build and Deploy Spring Boot Server / build (push) Successful in 1m12s Details	2026-05-12 20:34:42 +02:00
Cedric	2880934644	ci: test full pipeline end-to-end Build and Deploy Spring Boot Server / build (push) Successful in 1m10s Details	2026-05-10 23:43:13 +02:00
Cedric	b42980200d	ci: trigger Dokploy redeploy via API after image push Build and Deploy Spring Boot Server / build (push) Failing after 1m48s Details	2026-05-10 23:38:07 +02:00
Cedric	8381cdbffa	ci: test full pipeline Build and Deploy Spring Boot Server / build (push) Successful in 1m20s Details	2026-05-10 22:59:53 +02:00
Cedric	5cab2fed3b	ci: test Dokploy webhook Build and Deploy Spring Boot Server / build (push) Successful in 1m13s Details	2026-05-10 22:36:44 +02:00
Cedric	417eef7042	ci: fix Dokploy webhook, token is in URL not Authorization header Build and Deploy Spring Boot Server / build (push) Failing after 1m11s Details	2026-05-10 22:29:40 +02:00
Cedric	ed5543ce61	ci: fix Java 21 in dockerfile, add Docker Hub login to avoid rate limits Build and Deploy Spring Boot Server / build (push) Failing after 1m23s Details	2026-05-10 22:22:06 +02:00
Cedric	40b8f45de8	ci: test with Java 21 runner image Build and Deploy Spring Boot Server / build (push) Failing after 1m2s Details	2026-05-10 22:15:16 +02:00
Cedric	b221d07b48	ci: use ubuntu-java17 runner image, remove setup-java step Build and Deploy Spring Boot Server / build (push) Failing after 2m22s Details	2026-05-10 22:08:23 +02:00
Cedric	0e63b6e4e6	ci: fix mvnw executable permission Build and Deploy Spring Boot Server / build (push) Has been cancelled Details	2026-05-10 22:07:30 +02:00
Cedric	4a04c85fe8	ci: use Maven wrapper instead of mvn to fix command not found on Gitea runner Build and Deploy Spring Boot Server / build (push) Failing after 4m43s Details	2026-05-10 21:40:25 +02:00
Cedric	b8e2c9114d	chore: merge main into dev, keep clean docker-compose from main Build and Deploy Spring Boot Server / build (push) Failing after 9m2s Details	2026-05-10 21:29:11 +02:00
Cedric	0876eecf50	ci: improve dev pipeline with Dokploy webhook and Docker layer caching	2026-05-10 21:27:28 +02:00
Cedric	5549691d50	ci: test pipeline	2026-05-10 21:24:18 +02:00
Cedric	46c8df45d6	ci: test pipeline	2026-05-10 21:24:10 +02:00
Cedric	50d274f36a	chore: resolve merge conflicts, keep Spring Boot 4.0.6 version Kept our version over remote (security hardening PR #12) for all conflicts: - pom.xml: Spring Boot 4.0.6 vs 3.4.1, new test deps - SecurityConfig: new csrf/package API for SB4 - GlobalExceptionHandler: full handler set with SLF4J logging - AppUserController/ExpenseListController: clean delegation to GlobalExceptionHandler - Test files: SB4 package paths, extra test coverage Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 20:29:49 +02:00
Cedric	ba4f365f06	chore: merge feature/security-hardening into main Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 20:25:12 +02:00
Cedric	19c7e1915f	security hardening (#12 ) Reviewed-on: #12 Co-authored-by: Cedric Hornberger <ceddi.hornberger@gmx.de> Co-committed-by: Cedric Hornberger <ceddi.hornberger@gmx.de>	2026-05-05 17:13:53 +02:00
Cedric	229a6a8a43	docker-compose.yml aktualisiert	2026-03-04 15:16:11 +01:00
Cedric	76e878ff5c	docker-compose.yml aktualisiert	2026-02-04 20:25:38 +01:00
Cedric	726be3f613	bu commit Build and Deploy Spring Boot Server / build (push) Successful in 10m16s Details	2025-07-11 14:16:05 +02:00
Cedric	936140e76f	dockerCompose backup Build and Deploy Spring Boot Server / build (push) Successful in 10m4s Details	2025-05-11 10:15:15 +02:00