Make authentication work

Author: renepanzar

.gitignore

@@ -158,3 +158,5 @@ jmeter.log
 /venv*/
 /.env
 /ui/.angular
+/build/
+/.gradle/

CONTRIBUTING.md

@@ -30,63 +30,103 @@ the feature you would like to see, why you need it, and how it should work.
 
 ## How to set up your environment and run tests
 
-The project can be developed with Eclipse, needs a PostgreSQL database and a
-Redis key/value store. For authorisation, the following options are available:
-Google, GitHub, Facebook, Twitter, and Keycloak.
+The backend is a **Quarkus** application (Java 21, Gradle). The frontend is an
+**Angular 11** single-page app served by the
+[Quinoa](https://quarkiverse.github.io/quarkiverse-docs/quarkus-quinoa/dev/)
+extension. Authentication is handled by **Keycloak**.
 
 ### Prerequisites
 
-For development, you need the following dependencies.
+| Tool | Version | Notes |
+|------|---------|-------|
+| Java JDK | 21 | Temurin / Corretto both work |
+| Docker + Docker Compose | any recent | runs PostgreSQL + Keycloak |
+| Node.js | 20 LTS | only needed for UI hot-reload; not required for the default dev flow |
 
-1. Java 8 JDK (i.e. OpenJDK 8)
-1. Docker
-1. Docker Compose
-1. Node.js
+### Running it (standard — no Node required)
 
-### Using IntelliJ IDEA
+The default workflow serves the pre-built Angular artefacts from `public/ui`
+directly via Quinoa. No Angular dev server or local Node installation is needed.
 
-1. Run the compile SBT task
+1. **Start the backing services** (PostgreSQL + Keycloak):
 
-   ```
-   bin/activator compile
+   ```bash
+   docker-compose up -d
    ```
 
-1. Import project in IntelliJ IDEA as a _Scala_ project
-1. Run the run configuration named _Start Database_
-1. Run the run configuration named _Start Server_
-1. Go to [localhost:4210/ui](http://localhost:4210/ui) to see it running
+2. **Copy your credentials into `.env`** (create it if it doesn't exist yet):
 
-### Running it Manually
+   ```
+   AUTH_PROVIDERS=keycloak
+   KEYCLOAK_CLIENT_ID=translatr-localhost
+   KEYCLOAK_CLIENT_SECRET=<your-secret>
+   ```
 
-1. Run the compile SBT task
+3. **Start Quarkus in dev mode** — the `copyUiToBuild` task runs automatically
+   first, staging the pre-built UI into `build/quinoa/`:
 
+   ```bash
+   export JAVA_HOME=/Library/Java/JavaVirtualMachines/temurin-21.jdk/Contents/Home
+   ./gradlew quarkusDev
    ```
-   bin/activator compile
-   ```
 
-1. Run database container by using _docker compose_
+4. Open [http://localhost:9000](http://localhost:9000).
+
+### Running it (UI hot-reload — requires Node 20 LTS)
 
+Use this when you are actively working on the Angular frontend and want instant
+browser refresh on file save.
+
+1. Complete steps 1–2 from the standard flow above.
+
+2. Install UI dependencies (first time only):
+
+   ```bash
+   cd ui && npm install
    ```
-   export POSTGRES_PASSWORD=translatr
-   docker-compose up
+
+3. **Terminal A** — start the Angular dev server:
+
+   ```bash
+   cd ui && npm start          # listens on port 4210
    ```
 
-1. Run development server
+4. **Terminal B** — uncomment the two `dev-server` lines in
+   `src/main/resources/application-dev.properties`:
 
+   ```properties
+   %dev.quarkus.quinoa.dev-server.port=4210
+   %dev.quarkus.quinoa.dev-server.managed=false
    ```
-   export AUTH_PROVIDERS=keycloak
-   export KEYCLOAK_CLIENT_ID=translatr-localhost
-   export KEYCLOAK_CLIENT_SECRET=$YOUR_KEYCLOAK_CLIENT_SECRET
-   export REDIRECT_BASE=http://localhost:4210
-   bin/activator ~run -Dconfig.file=dev.conf
+
+   Then start Quarkus:
+
+   ```bash
+   ./gradlew quarkusDev
    ```
 
-1. Go to [localhost:4210/ui](http://localhost:4210/ui) to see it running
+5. Open [http://localhost:9000](http://localhost:9000).
+
+> **Note on Node versions**
+> Angular 11 uses webpack 4. Node 22+ dropped `--openssl-legacy-provider`,
+> so **Node 20 LTS** is required for `npm start` / `npm run build`.
+> The `.node-version` file in `ui/` records the required version.
 
 ### Authorisation
 
-To be able to use Translatr and create a user you need to authorise yourself.
-This can be done in many ways, but you need at least one auth provider.
+At least one auth provider must be configured. The recommended choice for local
+development is Keycloak (started automatically by `docker-compose up`).
+
+#### Keycloak (recommended)
+
+The `docker-compose.yml` starts a Keycloak instance on port **8088** and
+imports the `docker/Translatr-realm.json` realm automatically.
+
+```
+export AUTH_PROVIDERS=keycloak
+export KEYCLOAK_CLIENT_ID=translatr-localhost
+export KEYCLOAK_CLIENT_SECRET=<client-secret-from-realm>
+```
 
 #### Google
 
@@ -108,58 +148,27 @@ export GITHUB_CLIENT_ID=...
 export GITHUB_CLIENT_SECRET=...
 ```
 
-#### Facebook
-
-Credentials can be retrieved from the [Facebook for developers page](https://developers.facebook.com/apps).
-
-```
-export AUTH_PROVIDERS=facebook
-export FACEBOOK_CLIENT_ID=...
-export FACEBOOK_CLIENT_SECRET=...
-```
-
-#### Twitter
-
-Credentials can be retrieved from the [Twitter Developer Documentation on OAuth](https://dev.twitter.com/docs/auth/oauth).
-
-```
-export AUTH_PROVIDERS=twitter
-export TWITTER_CONSUMER_KEY=...
-export TWITTER_CONSUMER_SECRET=...
-```
-
-#### Keycloak
-
-The realm needs to be named Translatr. This is a sample [Keycloak app for Heroku](https://github.com/resamsel/keycloak-swarm-heroku).
-
-```
-export KEYCLOAK_HOST=http://localhost:8080
-export KEYCLOAK_CLIENT_ID=...
-export KEYCLOAK_CLIENT_SECRET=...
-```
-
 ### Testing
 
-Unit and integration tests live in the **test/** directory. In Eclipse, this
-directory should be a source directory.
-
-Unit tests can be run by issuing the following command:
+Unit and integration tests use **JUnit 5** and **RestAssured** and run against
+the live PostgreSQL instance started by `docker-compose`.
 
-```
-bin/activator clean jacoco:cover -Dconfig.file=test.conf -J-Xmx1g
+```bash
+./gradlew test
 ```
 
-Jacoco generates a coverage report in **target/scala-2.11/jacoco/html/index.html**
+The test report is written to `build/reports/tests/test/index.html`.
 
 ### Debugging
 
-For debugging with your favorite IDE, just add the parameters `-jvm-debug 9999`
-to the bin/activator command. Then connect your IDE to localhost with port 9999.
+Add the Quarkus debug flags to attach a remote debugger on port 5005:
 
-```
-bin/activator ~run -Dconfig.file=dev.conf -jvm-debug 9999
+```bash
+./gradlew quarkusDev -Dsuspend=false -Ddebug=5005
 ```
 
+Then connect your IDE to `localhost:5005`.
+
 ## How to add support for a new file format
 
 Adding support for new file formats is quite easy. The few steps necessary are defined in the following sections.
@@ -323,4 +332,3 @@ GitHub](https://egghead.io/series/how-to-contribute-to-an-open-source-project-on
 ### Style Guide
 
 Use the [Google style guide for Java](https://raw.githubusercontent.com/google/styleguide/gh-pages/eclipse-java-google-style.xml).
-

build.gradle.kts

@@ -21,7 +21,7 @@ dependencies {
     implementation("io.quarkus:quarkus-hibernate-orm-panache")
     implementation("io.quarkus:quarkus-jdbc-postgresql")
     implementation("io.quarkus:quarkus-oidc")
-    implementation("io.quarkus:quarkus-flyway-postgresql")
+    implementation("io.quarkus:quarkus-flyway")
     implementation("io.quarkus:quarkus-cache")
     implementation("io.quarkus:quarkus-micrometer-registry-prometheus")
     implementation("io.quarkus:quarkus-vertx")
@@ -43,6 +43,7 @@ dependencies {
     testImplementation("io.quarkus:quarkus-junit5")
     testImplementation("io.quarkus:quarkus-junit5-mockito")
     testImplementation("io.quarkus:quarkus-test-security")
+    testImplementation("io.quarkus:quarkus-test-security-jwt")
     testImplementation("io.rest-assured:rest-assured")
     testImplementation("org.assertj:assertj-core:3.15.0")
     testImplementation("org.mockito:mockito-core:2.8.47")
@@ -72,3 +73,29 @@ tasks.withType<Test> {
     systemProperty("java.util.logging.manager", "org.jboss.logmanager.LogManager")
 }
 
+// ---------------------------------------------------------------------------
+// UI staging
+// ---------------------------------------------------------------------------
+// Copies the already-built Angular artefacts from public/ui into the directory
+// that Quinoa uses as its static-file root (build/quinoa/).
+// This lets `./gradlew quarkusDev` serve the UI without needing a running
+// Angular dev server or a Node build step.
+//
+// Usage:
+//   ./gradlew quarkusDev          ← uses pre-built files from public/ui
+//
+// To develop the UI with hot-reload instead:
+//   1. cd ui && npm start          (Angular dev server on port 4210)
+//   2. In application-dev.properties uncomment the dev-server lines
+// ---------------------------------------------------------------------------
+val copyUiToBuild by tasks.registering(Copy::class) {
+    description = "Stages pre-built Angular UI (public/ui) into Quinoa's serving directory"
+    group = "build"
+    from("public/ui")
+    into("build/quinoa")
+}
+
+tasks.named("quarkusDev") {
+    dependsOn(copyUiToBuild)
+}
+

docker-compose.yml

@@ -33,7 +33,7 @@ services:
       KEYCLOAK_ADMIN: admin
       KEYCLOAK_ADMIN_PASSWORD: translatr123
       KC_DB: postgres
-      KC_DB_URL: jdbc:postgresql://database:5432/translatr
+      KC_DB_URL: jdbc:postgresql://database:5432/keycloak
       KC_DB_USERNAME: ${POSTGRES_USER:-postgres}
       KC_DB_PASSWORD: ${POSTGRES_PASSWORD:-translatr}
     volumes:

docker/Translatr-realm.json

@@ -2103,7 +2103,7 @@
     "clientOfflineSessionMaxLifespan": "0",
     "clientSessionIdleTimeout": "0",
     "clientSessionMaxLifespan": "0",
-    "frontendUrl": "http://localhost:8080/auth",
+    "frontendUrl": "http://localhost:8080",
     "clientOfflineSessionIdleTimeout": "0"
   },
   "keycloakVersion": "11.0.2",

docker/entrypoint-initdb.d/init-translatr.sh

@@ -3,12 +3,14 @@ set -e
 
 psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
     CREATE USER translatr WITH PASSWORD 'translatr';
-    CREATE DATABASE translatr;
     GRANT ALL PRIVILEGES ON DATABASE translatr TO translatr;
     CREATE DATABASE "translatr-test";
     GRANT ALL PRIVILEGES ON DATABASE "translatr-test" TO translatr;
     CREATE DATABASE "translatr-load-test";
     GRANT ALL PRIVILEGES ON DATABASE "translatr-load-test" TO translatr;
+    CREATE USER keycloak WITH PASSWORD 'keycloak';
+    CREATE DATABASE "keycloak";
+    GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
 EOSQL
 
 for i in translatr translatr-test translatr-load-test; do

plan-quarkusMigration.prompt.md

@@ -704,7 +704,7 @@ quarkus.quinoa.ui-dir=ui
 quarkus.quinoa.build-dir=dist/apps/translatr
 
 # Angular dev server port for live-reload proxying in dev mode
-quarkus.quinoa.dev-server.port=4200
+quarkus.quinoa.dev-server.port=4210
 
 # Enable SPA routing — serves index.html for unmatched paths
 quarkus.quinoa.enable-spa-routing=true

src/main/java/com/translatr/auth/AccessTokenAuthMechanism.java

@@ -4,30 +4,26 @@
 import io.quarkus.security.identity.IdentityProviderManager;
 import io.quarkus.security.identity.SecurityIdentity;
 import io.quarkus.security.identity.request.TokenAuthenticationRequest;
-import io.quarkus.security.identity.request.UsernamePasswordAuthenticationRequest;
 import io.quarkus.vertx.http.runtime.security.ChallengeData;
 import io.quarkus.vertx.http.runtime.security.HttpAuthenticationMechanism;
 import io.smallrye.mutiny.Uni;
 import io.vertx.ext.web.RoutingContext;
-import jakarta.annotation.Priority;
 import jakarta.enterprise.context.ApplicationScoped;
-import jakarta.enterprise.inject.Alternative;
 import jakarta.inject.Inject;
 
-import java.util.Optional;
 import java.util.Set;
 
 /**
  * Handles API access token authentication via:
  *   - Header:       Authorization: Bearer <token>  OR  X-Access-Token: <token>
  *   - Query param:  ?access_token=<token>
  *
- * Falls through (returns null) when no access token is present, letting
- * Quarkus OIDC handle browser/OAuth flows.
+ * Runs alongside the Quarkus OIDC mechanism (do NOT use @Alternative here –
+ * that would replace OIDC entirely).  Returns null from both authenticate() and
+ * getChallenge() when no access token is present, so the OIDC mechanism can
+ * handle browser/OAuth flows and issue the Keycloak redirect.
  */
 @ApplicationScoped
-@Alternative
-@Priority(1)
 public class AccessTokenAuthMechanism implements HttpAuthenticationMechanism {
 
     static final String HEADER_NAME = "X-Access-Token";
@@ -49,6 +45,11 @@ public Uni<SecurityIdentity> authenticate(RoutingContext context,
 
     @Override
     public Uni<ChallengeData> getChallenge(RoutingContext context) {
+        if (extractToken(context) == null) {
+            // No access token in this request – defer the challenge to the OIDC mechanism
+            // so it can issue the browser redirect to Keycloak instead of a bare 401.
+            return Uni.createFrom().nullItem();
+        }
         return Uni.createFrom().item(
                 new ChallengeData(401, "WWW-Authenticate", "Bearer realm=\"Translatr\""));
     }

src/main/java/com/translatr/controller/ActivityResource.java

@@ -1,6 +1,7 @@
 package com.translatr.controller;
 
 import com.translatr.dto.ActivityDto;
+import com.translatr.dto.AggregateDto;
 import com.translatr.dto.PagedList;
 import com.translatr.service.ActivityService;
 import com.translatr.service.UserService;
@@ -34,4 +35,17 @@ public PagedList<ActivityDto> byUser(@PathParam("userId") UUID userId,
                                          @QueryParam("limit")  @DefaultValue("20") int limit) {
         return activityService.findByUser(userId, offset, limit);
     }
+
+    /**
+     * Public aggregated activity (daily counts), used by the dashboard chart.
+     * Optional filters: projectId, userId.
+     */
+    @GET @Path("/activities/aggregated") @PermitAll
+    public PagedList<AggregateDto> aggregated(
+            @QueryParam("projectId") UUID projectId,
+            @QueryParam("userId")    UUID userId,
+            @QueryParam("offset")    @DefaultValue("0")    int offset,
+            @QueryParam("limit")     @DefaultValue("1000") int limit) {
+        return activityService.getAggregates(projectId, userId, offset, limit);
+    }
 }