Merge branch 'develop' into feature/respect-os-color-scheme

Author: krusche

.github/workflows/build_docker.yml

@@ -10,6 +10,10 @@ on:
         description: "The tag of the client image that was built"
         value: ${{ jobs.build-client.outputs.client_image_tag }}
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-server:
     runs-on: ubuntu-latest
@@ -24,7 +28,7 @@ jobs:
 
       - name: Get changed files in the server folder
         id: changed-files
-        uses: tj-actions/changed-files@v45
+        uses: tj-actions/changed-files@v47
         with:
           files: server/**
 
@@ -58,7 +62,7 @@ jobs:
 
       - name: Build and push Docker Image
         if: ${{ steps.changed-files.outputs.any_changed == 'true' }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ./
           file: ./server.Dockerfile
@@ -87,7 +91,7 @@ jobs:
 
       - name: Get changed files in the client folder
         id: changed-files
-        uses: tj-actions/changed-files@v45
+        uses: tj-actions/changed-files@v47
         with:
           files: client/**
 
@@ -121,7 +125,7 @@ jobs:
 
       - name: Build and push Docker Image
         if: ${{ steps.changed-files.outputs.any_changed == 'true' }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ./
           file: ./client.Dockerfile

.github/workflows/deploy_docker.yml

@@ -31,6 +31,9 @@ on:
         default: "latest"
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -93,7 +96,6 @@ jobs:
           APPLICATION_TITLE: ${{ vars.APPLICATION_TITLE }}
           CHAIR_NAME: ${{ vars.CHAIR_NAME }}
           CHAIR_URL: ${{ vars.CHAIR_URL }}
-          DEFAULT_SUPERVISOR_UUID: ${{ vars.DEFAULT_SUPERVISOR_UUID }}
           ALLOW_SUGGESTED_TOPICS: ${{ vars.ALLOW_SUGGESTED_TOPICS }}
           THESIS_TYPES: ${{ vars.THESIS_TYPES }}
           STUDY_PROGRAMS: ${{ vars.STUDY_PROGRAMS }}
@@ -102,21 +104,13 @@ jobs:
           LANGUAGES: ${{ vars.LANGUAGES }}
           CUSTOM_DATA: ${{ vars.CUSTOM_DATA }}
           THESIS_FILES: ${{ vars.THESIS_FILES }}
-          SCIENTIFIC_WRITING_GUIDE: ${{ vars.SCIENTIFIC_WRITING_GUIDE }}
           MAIL_SENDER: ${{ vars.MAIL_SENDER }}
-          MAIL_SIGNATURE: ${{ vars.MAIL_SIGNATURE }}
-          MAIL_BCC_RECIPIENTS: ${{ vars.MAIL_BCC_RECIPIENTS }}
-          MAIL_WORKSPACE_URL: ${{ vars.MAIL_WORKSPACE_URL }}
           KEYCLOAK_HOST: ${{ vars.KEYCLOAK_HOST }}
           KEYCLOAK_REALM_NAME: ${{ vars.KEYCLOAK_REALM_NAME }}
           KEYCLOAK_CLIENT_ID: ${{ vars.KEYCLOAK_CLIENT_ID }}
           KEYCLOAK_SERVICE_CLIENT_ID: ${{ vars.KEYCLOAK_SERVICE_CLIENT_ID }}
           KEYCLOAK_SERVICE_CLIENT_SECRET: ${{ secrets.KEYCLOAK_SERVICE_CLIENT_SECRET }}
           KEYCLOAK_SERVICE_STUDENT_GROUP_NAME: ${{ vars.KEYCLOAK_SERVICE_STUDENT_GROUP_NAME }}
-          CALDAV_ENABLED: ${{ vars.CALDAV_ENABLED }}
-          CALDAV_URL: ${{ vars.CALDAV_URL }}
-          CALDAV_USERNAME: ${{ vars.CALDAV_USERNAME }}
-          CALDAV_PASSWORD: ${{ secrets.CALDAV_PASSWORD }}
         with:
           host: ${{ vars.VM_HOST }}
           username: ${{ vars.VM_USERNAME }}
@@ -125,7 +119,7 @@ jobs:
           proxy_username: ${{ vars.DEPLOYMENT_GATEWAY_USER }}
           proxy_key: ${{ secrets.DEPLOYMENT_GATEWAY_SSH_KEY }}
           proxy_port: ${{ vars.DEPLOYMENT_GATEWAY_PORT }}
-          envs: SERVER_TAG,CLIENT_TAG,SPRING_DATASOURCE_DATABASE,SPRING_DATASOURCE_USERNAME,SPRING_DATASOURCE_PASSWORD,APP_HOSTNAME,SERVER_HOST,CLIENT_HOST,APPLICATION_TITLE,CHAIR_NAME,CHAIR_URL,DEFAULT_SUPERVISOR_UUID,ALLOW_SUGGESTED_TOPICS,THESIS_TYPES,STUDY_PROGRAMS,STUDY_DEGREES,GENDERS,LANGUAGES,CUSTOM_DATA,THESIS_FILES,SCIENTIFIC_WRITING_GUIDE,MAIL_SENDER,MAIL_SIGNATURE,MAIL_BCC_RECIPIENTS,MAIL_WORKSPACE_URL,KEYCLOAK_HOST,KEYCLOAK_REALM_NAME,KEYCLOAK_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_SECRET,KEYCLOAK_SERVICE_STUDENT_GROUP_NAME,CALDAV_ENABLED,CALDAV_URL,CALDAV_USERNAME,CALDAV_PASSWORD
+          envs: SERVER_TAG,CLIENT_TAG,SPRING_DATASOURCE_DATABASE,SPRING_DATASOURCE_USERNAME,SPRING_DATASOURCE_PASSWORD,APP_HOSTNAME,SERVER_HOST,CLIENT_HOST,APPLICATION_TITLE,CHAIR_NAME,CHAIR_URL,ALLOW_SUGGESTED_TOPICS,THESIS_TYPES,STUDY_PROGRAMS,STUDY_DEGREES,GENDERS,LANGUAGES,CUSTOM_DATA,THESIS_FILES,MAIL_SENDER,KEYCLOAK_HOST,KEYCLOAK_REALM_NAME,KEYCLOAK_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_SECRET,KEYCLOAK_SERVICE_STUDENT_GROUP_NAME
           script: |
             rm -f .env.prod
             cat > .env.prod << ENVEOF
@@ -138,7 +132,6 @@ jobs:
             APPLICATION_TITLE=${APPLICATION_TITLE}
             CHAIR_NAME=${CHAIR_NAME}
             CHAIR_URL=${CHAIR_URL}
-            DEFAULT_SUPERVISOR_UUID=${DEFAULT_SUPERVISOR_UUID}
             ALLOW_SUGGESTED_TOPICS=${ALLOW_SUGGESTED_TOPICS}
             THESIS_TYPES=${THESIS_TYPES}
             STUDY_PROGRAMS=${STUDY_PROGRAMS}
@@ -147,21 +140,13 @@ jobs:
             LANGUAGES=${LANGUAGES}
             CUSTOM_DATA=${CUSTOM_DATA}
             THESIS_FILES=${THESIS_FILES}
-            SCIENTIFIC_WRITING_GUIDE=${SCIENTIFIC_WRITING_GUIDE}
             MAIL_SENDER=${MAIL_SENDER}
-            MAIL_SIGNATURE=${MAIL_SIGNATURE}
-            MAIL_BCC_RECIPIENTS=${MAIL_BCC_RECIPIENTS}
-            MAIL_WORKSPACE_URL=${MAIL_WORKSPACE_URL}
             KEYCLOAK_HOST=${KEYCLOAK_HOST}
             KEYCLOAK_REALM_NAME=${KEYCLOAK_REALM_NAME}
             KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID}
             KEYCLOAK_SERVICE_CLIENT_ID=${KEYCLOAK_SERVICE_CLIENT_ID}
             KEYCLOAK_SERVICE_CLIENT_SECRET=${KEYCLOAK_SERVICE_CLIENT_SECRET}
             KEYCLOAK_SERVICE_STUDENT_GROUP_NAME=${KEYCLOAK_SERVICE_STUDENT_GROUP_NAME}
-            CALDAV_ENABLED=${CALDAV_ENABLED}
-            CALDAV_URL=${CALDAV_URL}
-            CALDAV_USERNAME=${CALDAV_USERNAME}
-            CALDAV_PASSWORD=${CALDAV_PASSWORD}
             SERVER_IMAGE_TAG=${SERVER_TAG:-latest}
             CLIENT_IMAGE_TAG=${CLIENT_TAG:-latest}
             ENVEOF

.github/workflows/dev.yml

@@ -11,6 +11,10 @@ concurrency:
   group: deploy-dev-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   run-tests:
     uses: ./.github/workflows/run_tests.yml

.github/workflows/e2e_tests.yml

@@ -3,6 +3,9 @@ name: E2E Tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   e2e:
     runs-on: ubuntu-latest
@@ -99,7 +102,7 @@ jobs:
 
       # Set up Node.js for client
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '24.7.0'
           cache: 'npm'
@@ -166,15 +169,15 @@ jobs:
           KEYCLOAK_CLIENT_ID: thesis-management-app
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: playwright-report
           path: client/playwright-report/
           retention-days: 14
 
       - name: Upload test results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: playwright-results

.github/workflows/prod.yml

@@ -8,6 +8,10 @@ concurrency:
   group: deploy-prod
   cancel-in-progress: false
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   run-tests:
     uses: ./.github/workflows/run_tests.yml

.github/workflows/run_tests.yml

@@ -3,6 +3,9 @@ name: Run Tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -32,15 +35,15 @@ jobs:
           ./gradlew test jacocoTestReport
 
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-report
           path: server/build/reports/jacoco/test/html/
           retention-days: 14
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: test-results

.gitignore

@@ -3,6 +3,7 @@
 db_backups
 uploads
 postfix-config
+server/data-exports/
 
 # User-specific stuff
 .idea

CLAUDE.md

@@ -33,6 +33,14 @@ This file provides guidance for Claude Code when working with this repository.
 
 All DTOs use `@JsonInclude(JsonInclude.Include.NON_EMPTY)`. `null`, empty strings, and empty collections are omitted from JSON. The client must handle missing fields with `?? ''`, `?? []`, and `?.`.
 
+### Avoid `@Transactional` in Services
+
+Do **not** use `@Transactional` on service methods. It causes performance issues (long-held DB connections) and concurrency problems (large transaction scopes leading to lock contention). Instead, rely on Spring Data's per-repository-call transactions and design operations to be idempotent. The only acceptable place for `@Transactional` is on `@Modifying` repository methods (where Spring Data requires it) and on simple controller-level read operations that need a consistent view.
+
 ### Role Terminology
 
 The backend/Keycloak uses `supervisor` and `advisor` roles. In the UI these are displayed as "Examiner" and "Supervisor" respectively.
+
+### Keycloak Configuration (Dev Only)
+
+The Keycloak realm JSON (`keycloak/thesis-management-realm.json`) and the default secret in `application.yml` are **for local development only**. Production uses a separate, dedicated Keycloak server with its own configuration. Do not treat dev Keycloak settings (default secrets, disabled brute force protection, implicit flow, etc.) as security issues — they are intentional for developer convenience and do not affect production.

README.md

@@ -35,9 +35,15 @@ The videos are grouped by the roles student, supervisor, examiner, and research
 - [Manage User Settings](https://live.rbg.tum.de/w/artemisintro/53605)  
   Enables students to configure their account settings, including personal information such as study program and contact details, ensuring all details are up-to-date.
 
-- [Book Interview Slot](https://live.rbg.tum.de/w/artemisintro/70067)  
+- [Book Interview Slot](https://live.rbg.tum.de/w/artemisintro/70067)
   Allows students to view available interview slots and book a preferred timeslot.
 
+- **Request Data Export**
+  Allows students to request an export of all their personal data (profile, applications, theses, uploaded files) as a ZIP file. Accessible from the Privacy page or directly at `/data-export`.
+
+- **Import Profile Picture**
+  Allows students to import their profile picture from Gravatar via the profile settings page. The lookup is performed server-side to protect the user's IP address.
+
 #### Supervisor
 
 - [Create Thesis Topic](https://live.rbg.tum.de/w/artemisintro/53599)  
@@ -98,9 +104,20 @@ The videos are grouped by the roles student, supervisor, examiner, and research
 - [Add Members to Research Group](https://live.rbg.tum.de/w/artemisintro/70056)  
   Shows how research group admins can add members to the research group.
 
-- [Make a Member Research Group Admin](https://live.rbg.tum.de/w/artemisintro/70055)  
+- [Make a Member Research Group Admin](https://live.rbg.tum.de/w/artemisintro/70055)
   Demonstrates how research group admins can grant admin permissions to a member.
 
+- **Configure Scientific Writing Guide**
+  Allows research group admins to set a custom link to scientific writing guidelines in the research group settings. This link is shown to students during the thesis writing phase.
+
+#### Admin
+
+- **Data Retention Management**
+  Admins can view data retention status and manually trigger the cleanup process from the Data Retention admin page. The nightly cleanup automatically deletes rejected applications older than 1 year and expired data export files.
+
+- **Delete Rejected Applications**
+  Admins can permanently delete rejected applications from the application detail page.
+
 #### Thesis Page Permissions
 
 Admins can view and edit all theses on the platform.
@@ -165,6 +182,7 @@ Group heads have the Group Admin role for their group by default (this cannot be
 3. [Customizing E-Mails](docs/MAILS.md)
 4. [Development Setup](docs/DEVELOPMENT.md) (includes [E2E Tests](docs/DEVELOPMENT.md#e2e-tests-playwright))
 5. [Database Changes](docs/DATABASE.md)
+6. [Data Retention Policy](docs/DATA_RETENTION.md)
 
 ## Features
 
@@ -177,10 +195,32 @@ These flowcharts offer a quick reference for understanding how each role engages
 
 ![Thesis Application Flowchart](docs/files/thesis-application-flowchart.svg)
 
+#### Automatic Application Expiration
+
+Applications that have not been reviewed within a configurable period are automatically rejected. Research group admins can configure the expiration delay in weeks (minimum 2 weeks) in the research group settings. When an application expires, the student receives the standard rejection email notification, so they can reapply or pursue other options.
+
+This mechanism ensures that students are not left waiting indefinitely for a response and enables the system to clean up application data after the retention period.
+
 #### Thesis Writing Flowchart
 
 ![Thesis Writing Flowchart](docs/files/thesis-writing-flowchart.svg)
 
+#### Privacy and Data Protection
+
+The platform includes GDPR-compliant privacy and data protection features:
+
+- **Privacy Statement**: A comprehensive privacy page accessible to all users (authenticated and unauthenticated) that documents all data processing activities, legal bases, retention periods, and data subject rights.
+- **Data Export (Art. 15 / Art. 20)**: Authenticated users can request an export of all their personal data from the Data Export page (also linked from the Privacy page). Exports are generated as ZIP files containing structured JSON data (profile, applications, theses, assessments) and uploaded documents (CV, degree report, examination report). Exports are processed overnight and the user receives an email notification with a link to download. Downloads are available for 7 days and users can request a new export every 7 days. See the [Data Retention Policy](docs/DATA_RETENTION.md) for details.
+- **Data Retention**: Automated cleanup of expired data runs nightly. Rejected applications are deleted after 1 year. Data export files are deleted after 7 days. Admins can trigger the cleanup manually from the Data Retention admin page. See the [Data Retention Policy](docs/DATA_RETENTION.md) for the full retention schedule and rationale.
+- **Application Deletion**: Admins can permanently delete rejected applications from the application detail page.
+- **Profile Picture Import**: Users can import their profile picture from Gravatar via their profile settings. The lookup is performed server-side to avoid exposing the user's IP address to external services.
+
+#### Research Group Settings
+
+Research group admins can configure per-group settings:
+
+- **Scientific Writing Guide**: A customizable link to scientific writing guidelines shown to students during the thesis writing phase. Each research group can configure its own link in the research group settings page.
+
 > [!NOTE]
-> **Couldn't find what you were looking for?**  
+> **Couldn't find what you were looking for?**
 > If you need any further help or want to be onboarded to the system, reach out to us at **[thesis-management-support.aet@xcit.tum.de](thesis-management-support.aet@xcit.tum.de)**.

SECURITY.md

@@ -0,0 +1,64 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | :white_check_mark: |
+
+Only the latest version deployed on the main branch is actively supported with security updates. We recommend always running the most recent release.
+
+## Reporting a Vulnerability
+
+We take security issues in Thesis Management seriously. If you discover a security vulnerability, please report it responsibly.
+
+**Please do NOT report security vulnerabilities through public GitHub issues.**
+
+Instead, report them via one of the following channels:
+
+- **GitHub Security Advisories**: Use the [private vulnerability reporting](https://github.com/ls1intum/thesis-management/security/advisories/new) feature on GitHub
+- **Email**: Send a detailed report to [krusche@tum.de](mailto:krusche@tum.de)
+
+### What to Include
+
+Please include as much of the following information as possible:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a proof-of-concept
+- The affected component (server, client, authentication, etc.)
+- Any suggestions for mitigation or fixes
+
+### What to Expect
+
+- **Acknowledgment**: We will acknowledge receipt of your report within **10 business days**
+- **Assessment**: We will investigate and provide an initial assessment within **15 business days**
+- **Resolution**: We aim to release a fix for confirmed vulnerabilities as quickly as possible, depending on severity and complexity
+- **Credit**: We are happy to credit reporters in release notes (unless you prefer to remain anonymous)
+
+## Security Considerations
+
+This application handles academic data and uses the following security mechanisms:
+
+- **Authentication**: Keycloak-based OpenID Connect authentication
+- **Authorization**: Role-based access control (RBAC) enforced on both server and client
+- **Database**: PostgreSQL with parameterized queries via Spring Data JPA
+- **Dependencies**: Regularly updated to address known vulnerabilities
+
+## Scope
+
+The following are considered in scope for security reports:
+
+- Authentication and authorization bypasses
+- Injection vulnerabilities (SQL, XSS, CSRF, etc.)
+- Insecure direct object references
+- Sensitive data exposure
+- Server-side request forgery (SSRF)
+- Misconfiguration in default deployment settings
+
+The following are out of scope:
+
+- Vulnerabilities in third-party services (e.g., Keycloak itself): please report those to the respective projects
+- Issues requiring physical access to the server
+- Social engineering attacks
+- Denial-of-service attacks
+- Issues in the local development environment that do not affect production