Behind Jambotron's Caddy the app saw http while the browser used https,
so same-domain requests looked cross-origin and @CrossOrigin answered
403 on /api/auth/signin. server.forward-headers-strategy=framework makes
the app use X-Forwarded-Proto/Host; app.origin can be set via APP_ORIGIN.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Frontend
- Upgrade Angular 19 -> 22 (TypeScript 6, new control flow), drop unused
packages (bootstrap, jquery, popper, ng-bootstrap, webpack)
- Move the UI to Angular Material: toolbar with user menu, tutorials list,
add/edit forms, admin users table with role editing dialog, profile,
home page with published tutorials, registration form, login dialog
- Guard routes: login required for add/edit/profile, admin role for /admin
- Remove the /login, Moderator and User pages, event bus, auth interceptor
and other dead code
Backend
- Add PUT /api/users/{id}/roles (admin only) that keeps at least one admin
and does not let an admin drop their own admin role
- Tighten security: read tutorials publicly, change them only when logged
in, users/roles API for admins only; hide password hashes in JSON
- Remove unused Settings and Test endpoints, DTO mappers, commented code
- Flyway V2 aligns the schema with the entities (bigint ids, tutorials PK,
identity ids); Hibernate now runs with ddl-auto: validate
Docker
- Three-stage Dockerfile (Node build, Gradle build, JRE runtime) with
layer caching, non-root user and healthcheck; add .dockerignore
- docker-compose waits for a healthy Postgres, always rebuilds the image,
no longer mounts the Docker socket
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app is compiled with toolchain 26 (class file 70), but the runtime
image was eclipse-temurin:21 (max class file 65), which caused
UnsupportedClassVersionError at startup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>