Merge develop into chore/modularize-code

Resolves conflicts from develop (passkey #955, hide-expired-topics #1089,
dependency updates, react-router v8) against the feature-package
modularization.

Resolution summary:
- Imports: kept the modularized `@/` (client) and feature-package (server)
  import style; folded in develop's newly-added imports converted to the same
  style.
- New passkey files added by develop landed in the old flat layout and were
  relocated into the modularized structure with `@/` imports:
  - components/PasskeyRegistrationPrompt -> core/components/PasskeyRegistrationPrompt
  - pages/SettingsPage/components/PasskeySettings ->
    core/admin/pages/SettingsPage/components/PasskeySettings
  - utils/passkey.ts (git-relocated) -> core/utils/passkey.ts
- CollapsibleTopicElement: took develop's canonical #1089 behavior
  (`canApply = !!fullTopic && state === OPEN`).
- BaseKeycloakIntegrationTest: kept in mock/ (consistent with BaseIntegrationTest)
  with modularized repository imports; TestContainerImages is same-package.

Verified: client build/tsc/lint/tests green; server compiles + 864/864 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: krusche

.env

@@ -0,0 +1,15 @@
+# Docker Compose environment file.
+#
+# This file is COMMITTED on purpose so the workspace sets up automatically: `docker compose up -d`
+# works out of the box with no manual steps (Docker Compose loads `.env` automatically).
+#
+# RULE: non-secret build/config values ONLY. Never commit credentials, tokens, or other secrets
+# here. Deployment secrets belong in an uncommitted env file (e.g. `.env.prod`, `.env.local`),
+# which stays gitignored. To override a value locally without committing, set it in your shell or
+# pass `--env-file`.
+
+# PostgreSQL image tag. Single source of truth, read by both the docker-compose files and the
+# Gradle build (integration-test Testcontainers parse this file). All consumers fall back to the
+# same tag if this variable is unset, so the workspace still builds even without this file. The
+# e2e GitHub workflow uses its own repository variable — see docs/DATABASE.md.
+POSTGRES_IMAGE_TAG=18.4-alpine

.github/workflows/build_docker.yml

@@ -21,7 +21,7 @@ jobs:
       server_image_tag: "${{ steps.output-tag.outputs.server_image_tag }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.ref }}
           fetch-depth: 1
@@ -95,7 +95,7 @@ jobs:
       client_image_tag: "${{ steps.output-tag.outputs.client_image_tag }}"
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.ref }}
           fetch-depth: 1

.github/workflows/deploy_docker.yml

@@ -42,7 +42,7 @@ jobs:
       url: '${{ vars.CLIENT_HOST }}'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create main.cf and master.cf File
         env:
@@ -110,6 +110,9 @@ jobs:
           KEYCLOAK_CLIENT_ID: ${{ vars.KEYCLOAK_CLIENT_ID }}
           KEYCLOAK_SERVICE_CLIENT_ID: ${{ vars.KEYCLOAK_SERVICE_CLIENT_ID }}
           KEYCLOAK_SERVICE_CLIENT_SECRET: ${{ secrets.KEYCLOAK_SERVICE_CLIENT_SECRET }}
+          PASSKEY_RP_ID: ${{ vars.PASSKEY_RP_ID }}
+          PASSKEY_RP_NAME: ${{ vars.PASSKEY_RP_NAME }}
+          PASSKEY_PROMPT_APPS: ${{ vars.PASSKEY_PROMPT_APPS }}
         with:
           host: ${{ vars.VM_HOST }}
           username: ${{ vars.VM_USERNAME }}
@@ -118,7 +121,7 @@ jobs:
           proxy_username: ${{ vars.DEPLOYMENT_GATEWAY_USER }}
           proxy_key: ${{ secrets.DEPLOYMENT_GATEWAY_SSH_KEY }}
           proxy_port: ${{ vars.DEPLOYMENT_GATEWAY_PORT }}
-          envs: SERVER_TAG,CLIENT_TAG,SPRING_DATASOURCE_DATABASE,SPRING_DATASOURCE_USERNAME,SPRING_DATASOURCE_PASSWORD,APP_HOSTNAME,SERVER_HOST,CLIENT_HOST,APPLICATION_TITLE,CHAIR_NAME,CHAIR_URL,ALLOW_SUGGESTED_TOPICS,THESIS_TYPES,STUDY_PROGRAMS,STUDY_DEGREES,GENDERS,LANGUAGES,CUSTOM_DATA,THESIS_FILES,MAIL_SENDER,KEYCLOAK_HOST,KEYCLOAK_REALM_NAME,KEYCLOAK_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_SECRET
+          envs: SERVER_TAG,CLIENT_TAG,SPRING_DATASOURCE_DATABASE,SPRING_DATASOURCE_USERNAME,SPRING_DATASOURCE_PASSWORD,APP_HOSTNAME,SERVER_HOST,CLIENT_HOST,APPLICATION_TITLE,CHAIR_NAME,CHAIR_URL,ALLOW_SUGGESTED_TOPICS,THESIS_TYPES,STUDY_PROGRAMS,STUDY_DEGREES,GENDERS,LANGUAGES,CUSTOM_DATA,THESIS_FILES,MAIL_SENDER,KEYCLOAK_HOST,KEYCLOAK_REALM_NAME,KEYCLOAK_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_ID,KEYCLOAK_SERVICE_CLIENT_SECRET,PASSKEY_RP_ID,PASSKEY_RP_NAME,PASSKEY_PROMPT_APPS
           script: |
             rm -f .env.prod
             cat > .env.prod << ENVEOF
@@ -145,6 +148,9 @@ jobs:
             KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID}
             KEYCLOAK_SERVICE_CLIENT_ID=${KEYCLOAK_SERVICE_CLIENT_ID}
             KEYCLOAK_SERVICE_CLIENT_SECRET=${KEYCLOAK_SERVICE_CLIENT_SECRET}
+            PASSKEY_RP_ID=${PASSKEY_RP_ID}
+            PASSKEY_RP_NAME=${PASSKEY_RP_NAME}
+            PASSKEY_PROMPT_APPS=${PASSKEY_PROMPT_APPS}
             SERVER_IMAGE_TAG=${SERVER_TAG:-latest}
             CLIENT_IMAGE_TAG=${CLIENT_TAG:-latest}
             ENVEOF

.github/workflows/e2e_tests.yml

@@ -13,7 +13,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:18.4-alpine
+        image: postgres:${{ vars.POSTGRES_IMAGE_TAG || '18.4-alpine' }}
         env:
           POSTGRES_USER: thesis-management-postgres
           POSTGRES_PASSWORD: thesis-management-postgres
@@ -27,7 +27,7 @@ jobs:
           --health-retries 10
 
       mailpit:
-        image: axllent/mailpit:v1.30
+        image: axllent/mailpit:v1.30.2
         ports:
           - 1125:1025
           - 8125:8025
@@ -39,26 +39,29 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.ref }}
           fetch-depth: 1
 
-      # Start Keycloak manually (service containers don't support custom commands)
+      # Build + start Keycloak from the repo Dockerfile used in local compose.
       - name: Start Keycloak
         run: |
+          docker build -t thesis-management-keycloak-ci -f keycloak/Dockerfile .
+
           docker run -d --name keycloak \
             -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
             -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
             -p 8181:8080 \
-            quay.io/keycloak/keycloak:26.5 \
-            start-dev
+            -v "$PWD/keycloak/thesis-management-realm.json:/opt/keycloak/data/import/thesis-management-realm.json:ro" \
+            thesis-management-keycloak-ci \
+            start-dev --import-realm
 
       - name: Wait for Keycloak to be ready
         run: |
           echo "Waiting for Keycloak..."
           for i in $(seq 1 60); do
-            if curl -sf http://localhost:8181/realms/master > /dev/null 2>&1; then
+            if curl -sf http://localhost:8181/realms/thesis-management > /dev/null 2>&1; then
               echo "Keycloak is ready"
               break
             fi
@@ -70,20 +73,38 @@ jobs:
             sleep 2
           done
 
-      - name: Import Keycloak realm
+      - name: Verify Keycloak passkey provider
         run: |
-          # Get admin token
-          TOKEN=$(curl -sf -X POST "http://localhost:8181/realms/master/protocol/openid-connect/token" \
-            -H "Content-Type: application/x-www-form-urlencoded" \
-            -d "username=admin&password=admin&grant_type=password&client_id=admin-cli" | jq -r '.access_token')
-
-          # Import realm
-          curl -sf -X POST "http://localhost:8181/admin/realms" \
-            -H "Authorization: Bearer $TOKEN" \
-            -H "Content-Type: application/json" \
-            -d @keycloak/thesis-management-realm.json
-
-          echo "Realm imported successfully"
+          echo "Waiting for Keycloak passkey provider..."
+          headers_file="$(mktemp)"
+          body_file="$(mktemp)"
+          for i in $(seq 1 60); do
+            status="$(
+              curl -sS \
+                -D "$headers_file" \
+                -o "$body_file" \
+                -w "%{http_code}" \
+                -H "Origin: http://localhost:3100" \
+                http://localhost:8181/realms/thesis-management/passkey/thesis-management-app/health || true
+            )"
+            if [[ "$status" =~ ^2[0-9][0-9]$ ]] \
+              && grep -qi '^access-control-allow-origin: http://localhost:3100' "$headers_file" \
+              && grep -qi '^access-control-allow-credentials: true' "$headers_file"; then
+              echo "Keycloak passkey provider is ready"
+              break
+            fi
+            if [ "$i" -eq 60 ]; then
+              echo "::error::Keycloak passkey provider did not become available with credentialed CORS for http://localhost:3100"
+              echo "Last HTTP status: ${status:-none}"
+              echo "Last response headers:"
+              cat "$headers_file"
+              echo "Last response body:"
+              cat "$body_file"
+              docker logs keycloak
+              exit 1
+            fi
+            sleep 2
+          done
 
       # Set up Java for server
       - name: Set up JDK 25
@@ -118,7 +139,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '24.16.0'
+          node-version: '24.17.0'
           cache: 'pnpm'
           cache-dependency-path: client/pnpm-lock.yaml
 
@@ -153,7 +174,7 @@ jobs:
 
       - name: Serve client static bundle
         working-directory: ./client
-        run: pnpm dlx serve@14 -s build -l 3100 --no-clipboard --no-port-switching &
+        run: pnpm dlx serve@14 -s build -l 3100 -c ../serve.e2e.json --no-clipboard --no-port-switching &
 
       # Wait for both services to be ready
       - name: Wait for server to be ready

.github/workflows/refresh_sbom.yml

@@ -116,7 +116,7 @@ jobs:
           fi
 
       - name: Checkout PR branch (read-only, no token persisted)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # pull_request_target defaults to the base ref; we want the PR head.
           ref: ${{ github.event.pull_request.head.sha }}
@@ -177,7 +177,7 @@ jobs:
         if: steps.scopes.outputs.client == 'true'
         uses: actions/setup-node@v6
         with:
-          node-version: '24.16.0'
+          node-version: '24.17.0'
 
       - name: Regenerate client SBOM
         if: steps.scopes.outputs.client == 'true'

.github/workflows/run_tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.ref }}
           fetch-depth: 1
@@ -57,7 +57,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '24.16.0'
+          node-version: '24.17.0'
           cache: 'pnpm'
           cache-dependency-path: 'client/pnpm-lock.yaml'
 

.gitignore

@@ -1,4 +1,5 @@
 .env*
+!.env
 
 db_backups
 uploads

client.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.16.0-alpine AS build
+FROM node:24.17.0-alpine AS build
 WORKDIR /app
 ENV CI=1
 ENV HUSKY=0

client/e2e/admin/data-export.spec.ts

@@ -131,10 +131,15 @@ test.describe('Data Export - Route Protection (authenticated)', () => {
 test.describe('Data Export - Route Protection (unauthenticated)', () => {
   test.use({ storageState: { cookies: [], origins: [] } })
 
-  test('unauthenticated users are redirected from data export page', async ({ page }) => {
+  test('unauthenticated users see the login modal on data export page', async ({ page }) => {
     await page.goto('/data-export', { waitUntil: 'domcontentloaded', timeout: 30_000 })
 
-    // Should redirect to login — the Data Export heading should not be visible
+    await expect(page).toHaveURL(/\/data-export/)
+    const loginModal = page.getByRole('dialog', { name: 'Login' })
+    await expect(loginModal).toBeVisible({ timeout: 30_000 })
+    await expect(loginModal.getByRole('button', { name: 'Login' })).toBeVisible()
+
+    // Protected page content should not be visible while unauthenticated.
     await expect(page.getByRole('heading', { name: 'Data Export' })).not.toBeVisible({
       timeout: 15_000,
     })