<!-- pom.xml — dependencies used throughout this lecture (Spring Boot 4.x) -->
<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.1.1</version>
  </parent>
  <groupId>in.ravindra</groupId>
  <artifactId>taskmanager</artifactId>
  <version>1.0.0</version>
  <properties>
    <java.version>25</java.version>   <!-- or 21; Spring Boot 4 needs 17+ -->
    <jjwt.version>0.12.6</jjwt.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-webmvc</artifactId>   <!-- was starter-web in Boot 3 -->
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-flyway</artifactId>
    </dependency>
    <dependency>
      <groupId>org.flywaydb</groupId>
      <artifactId>flyway-database-postgresql</artifactId>   <!-- DB-specific Flyway module -->
    </dependency>
    <dependency>
      <groupId>org.postgresql</groupId>
      <artifactId>postgresql</artifactId>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <!-- JJWT: api + impl + a JSON module. Gson avoids the Jackson 2 vs Jackson 3 clash in Boot 4 -->
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-api</artifactId>
      <version>${jjwt.version}</version>
    </dependency>
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-impl</artifactId>
      <version>${jjwt.version}</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-gson</artifactId>
      <version>${jjwt.version}</version>
      <scope>runtime</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-test</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>
    </plugins>
  </build>
</project>

// src/main/java/in/ravindra/shop/product/Product.java
package in.ravindra.shop.product;

import jakarta.persistence.*;
import java.math.BigDecimal;
import java.time.Instant;

@Entity
@Table(name = "products")
public class Product {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, length = 120)
    private String name;

    @Column(nullable = false, precision = 10, scale = 2)
    private BigDecimal price;

    @Enumerated(EnumType.STRING)          // stores "ACTIVE", never 0/1
    @Column(nullable = false, length = 20)
    private ProductStatus status = ProductStatus.ACTIVE;

    @Version                              // optimistic locking: UPDATE ... WHERE id=? AND version=?
    private Long version;

    @Column(name = "created_at", nullable = false, updatable = false)
    private Instant createdAt;

    protected Product() { }               // required by JPA

    public Product(String name, BigDecimal price) {
        this.name = name;
        this.price = price;
    }

    @PrePersist
    void onCreate() { this.createdAt = Instant.now(); }

    public Long getId() { return id; }
    public String getName() { return name; }
    public BigDecimal getPrice() { return price; }
    public void setPrice(BigDecimal price) { this.price = price; }
    public ProductStatus getStatus() { return status; }
    public void setStatus(ProductStatus status) { this.status = status; }
}

enum ProductStatus { ACTIVE, DISCONTINUED }

// src/main/java/in/ravindra/shop/product/ProductService.java
package in.ravindra.shop.product;

import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.math.BigDecimal;
import java.math.RoundingMode;

@Service
public class ProductService {
    private final ProductRepository repo;
    public ProductService(ProductRepository repo) { this.repo = repo; }

    @Transactional
    public void applyDiscount(Long id, int percent) {
        Product p = repo.findById(id)
                .orElseThrow(() -> new ProductNotFoundException(id));   // p is MANAGED
        BigDecimal factor = BigDecimal.valueOf(100 - percent).movePointLeft(2);
        p.setPrice(p.getPrice().multiply(factor).setScale(2, RoundingMode.HALF_UP));
        // no repo.save(p) needed: dirty checking issues
        // UPDATE products SET price=?, version=? WHERE id=? AND version=? at commit
    }
}

// application.yml snippet to SEE the SQL while learning (turn off in production)
// spring:
//   jpa:
//     show-sql: true
//     properties:
//       hibernate.format_sql: true

// src/main/java/in/ravindra/shop/order/Customer.java
package in.ravindra.shop.order;

import jakarta.persistence.*;
import java.util.ArrayList;
import java.util.List;

@Entity
@Table(name = "customers")
public class Customer {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(nullable = false, unique = true)
    private String email;

    private String city;                                   // e.g. "Patna", "Hyderabad"

    @OneToMany(mappedBy = "customer", cascade = CascadeType.ALL, orphanRemoval = true)
    private List<Order> orders = new ArrayList<>();        // inverse side, LAZY by default

    protected Customer() { }
    public Customer(String email, String city) { this.email = email; this.city = city; }

    public void addOrder(Order order) {                    // keep both sides in sync
        orders.add(order);
        order.setCustomer(this);
    }
    public Long getId() { return id; }
    public String getEmail() { return email; }
    public List<Order> getOrders() { return orders; }
}

// src/main/java/in/ravindra/shop/order/Order.java
package in.ravindra.shop.order;

import jakarta.persistence.*;
import java.math.BigDecimal;
import java.time.Instant;
import java.util.ArrayList;
import java.util.List;

@Entity
@Table(name = "orders")                                    // "order" is an SQL keyword
public class Order {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @ManyToOne(fetch = FetchType.LAZY, optional = false)   // OWNING side: has the FK column
    @JoinColumn(name = "customer_id", nullable = false)
    private Customer customer;

    @Enumerated(EnumType.STRING) @Column(nullable = false)
    private OrderStatus status = OrderStatus.NEW;

    @Column(name = "total_amount", nullable = false, precision = 12, scale = 2)
    private BigDecimal totalAmount = BigDecimal.ZERO;

    @Column(name = "created_at", nullable = false)
    private Instant createdAt = Instant.now();

    @OneToMany(mappedBy = "order", cascade = CascadeType.ALL, orphanRemoval = true)
    private List<OrderItem> items = new ArrayList<>();

    protected Order() { }
    public Order(Customer customer) { this.customer = customer; }

    public void addItem(String productName, int qty, BigDecimal unitPrice) {
        OrderItem item = new OrderItem(this, productName, qty, unitPrice);
        items.add(item);
        totalAmount = totalAmount.add(unitPrice.multiply(BigDecimal.valueOf(qty)));
    }
    void setCustomer(Customer customer) { this.customer = customer; }
    public Long getId() { return id; }
    public Customer getCustomer() { return customer; }
    public OrderStatus getStatus() { return status; }
    public BigDecimal getTotalAmount() { return totalAmount; }
    public List<OrderItem> getItems() { return items; }
}

enum OrderStatus { NEW, PAID, SHIPPED, CANCELLED }

// src/main/java/in/ravindra/shop/order/OrderItem.java
package in.ravindra.shop.order;

import jakarta.persistence.*;
import java.math.BigDecimal;

@Entity
@Table(name = "order_items")
public class OrderItem {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    @JoinColumn(name = "order_id", nullable = false)
    private Order order;

    @Column(name = "product_name", nullable = false)
    private String productName;
    private int quantity;
    @Column(name = "unit_price", precision = 10, scale = 2)
    private BigDecimal unitPrice;

    protected OrderItem() { }
    OrderItem(Order order, String productName, int quantity, BigDecimal unitPrice) {
        this.order = order; this.productName = productName;
        this.quantity = quantity; this.unitPrice = unitPrice;
    }
    public String getProductName() { return productName; }
    public int getQuantity() { return quantity; }
}

// Usage inside a @Transactional service method:
// Customer c = new Customer("asha@example.in", "Pune");
// Order o = new Order(c);
// o.addItem("Mechanical keyboard", 1, new BigDecimal("3499.00"));
// c.addOrder(o);
// customerRepository.save(c);   // cascades: INSERT customers, INSERT orders, INSERT order_items

// src/main/java/in/ravindra/shop/order/OrderRepository.java
package in.ravindra.shop.order;

import org.springframework.data.jpa.repository.*;
import org.springframework.data.repository.query.Param;
import java.math.BigDecimal;
import java.time.Instant;
import java.util.List;
import java.util.Optional;

public interface OrderRepository extends JpaRepository<Order, Long> {

    // ---- derived queries: Spring generates the JPQL from the method name ----
    List<Order> findByStatus(OrderStatus status);
    List<Order> findByCustomer_EmailIgnoreCase(String email);          // joins customer
    List<Order> findByStatusAndTotalAmountGreaterThan(OrderStatus status, BigDecimal min);
    List<Order> findTop5ByOrderByCreatedAtDesc();                      // latest 5 orders
    long countByStatus(OrderStatus status);
    boolean existsByCustomer_IdAndStatus(Long customerId, OrderStatus status);
    Optional<Order> findFirstByCustomer_IdOrderByCreatedAtDesc(Long customerId);

    // ---- JPQL when the name would get too long ----
    @Query("""
           select o from Order o
           where o.status = :status
             and o.createdAt between :from and :to
           order by o.totalAmount desc
           """)
    List<Order> findHighValueInPeriod(@Param("status") OrderStatus status,
                                      @Param("from") Instant from,
                                      @Param("to") Instant to);

    // ---- projection: only the columns the report needs ----
    @Query("""
           select new in.ravindra.shop.order.CityRevenue(c.city, sum(o.totalAmount))
           from Order o join o.customer c
           where o.status = 'PAID'
           group by c.city
           order by sum(o.totalAmount) desc
           """)
    List<CityRevenue> revenueByCity();

    // ---- bulk update: needs @Modifying and a transaction ----
    @Modifying
    @Query("update Order o set o.status = 'CANCELLED' where o.status = 'NEW' and o.createdAt < :cutoff")
    int cancelStaleOrders(@Param("cutoff") Instant cutoff);

    // ---- native SQL when you need a database-specific feature ----
    @Query(value = "select * from orders where created_at::date = current_date", nativeQuery = true)
    List<Order> todaysOrders();
}

// src/main/java/in/ravindra/shop/order/CityRevenue.java
package in.ravindra.shop.order;
import java.math.BigDecimal;
public record CityRevenue(String city, BigDecimal revenue) { }

// Sample output of revenueByCity() for a seeded database:
// [CityRevenue[city=Bengaluru, revenue=184250.00],
//  CityRevenue[city=Pune, revenue=97300.00],
//  CityRevenue[city=Patna, revenue=41900.00]]

// OrderRepository additions
Page<Order> findByStatus(OrderStatus status, Pageable pageable);
Slice<Order> findByCustomer_Id(Long customerId, Pageable pageable);   // no count query

// keyset pagination for a feed: "give me 20 orders older than the last one I saw"
@Query("select o from Order o where o.createdAt < :before order by o.createdAt desc")
List<Order> findOlderThan(@Param("before") Instant before, Pageable limit);

// src/main/java/in/ravindra/shop/order/PageResponse.java
package in.ravindra.shop.order;
import java.util.List;
import org.springframework.data.domain.Page;

public record PageResponse<T>(List<T> items, int page, int size, long totalElements, int totalPages, boolean hasNext) {
    public static <T> PageResponse<T> from(Page<T> p) {
        return new PageResponse<>(p.getContent(), p.getNumber(), p.getSize(),
                p.getTotalElements(), p.getTotalPages(), p.hasNext());
    }
}

// src/main/java/in/ravindra/shop/order/OrderController.java
package in.ravindra.shop.order;

import org.springframework.data.domain.*;
import org.springframework.data.web.PageableDefault;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/orders")
public class OrderController {
    private final OrderRepository orders;
    public OrderController(OrderRepository orders) { this.orders = orders; }

    // GET /api/orders?status=PAID&page=0&size=20&sort=createdAt,desc
    @GetMapping
    public PageResponse<OrderSummary> list(
            @RequestParam(defaultValue = "PAID") OrderStatus status,
            @PageableDefault(size = 20, sort = "createdAt", direction = Sort.Direction.DESC) Pageable pageable) {
        Page<OrderSummary> page = orders.findByStatus(status, pageable)
                .map(o -> new OrderSummary(o.getId(), o.getTotalAmount(), o.getStatus()));
        return PageResponse.from(page);
    }
}

record OrderSummary(Long id, java.math.BigDecimal total, OrderStatus status) { }

// application.yml
// spring:
//   data:
//     web:
//       pageable:
//         max-page-size: 100      # size=5000 from a client is silently capped to 100
//
// Response for page=0&size=2:
// {"items":[{"id":42,"total":3499.00,"status":"PAID"},{"id":41,"total":899.00,"status":"PAID"}],
//  "page":0,"size":2,"totalElements":57,"totalPages":29,"hasNext":true}

// 1) The bug: 1 query for orders + 1 query per order for the customer
@Transactional(readOnly = true)
public List<String> emailsOfPaidOrdersSlow() {
    return orderRepository.findByStatus(OrderStatus.PAID).stream()   // select ... from orders
            .map(o -> o.getCustomer().getEmail())                      // select ... from customers where id=?  (x N)
            .toList();
}
// Hibernate log for 100 paid orders: 101 statements

// 2) Fix A: JOIN FETCH
@Query("select o from Order o join fetch o.customer where o.status = :status")
List<Order> findWithCustomerByStatus(@Param("status") OrderStatus status);
// 1 statement: select o.*, c.* from orders o inner join customers c on c.id = o.customer_id where o.status=?

// 3) Fix B: @EntityGraph on a derived query (also works for collections)
@EntityGraph(attributePaths = {"customer", "items"})
List<Order> findDistinctByStatus(OrderStatus status);

// 4) Fix C: global batch fetching (no code change) — application.yml
// spring:
//   jpa:
//     open-in-view: false
//     properties:
//       hibernate:
//         default_batch_fetch_size: 50
// Now the slow version runs: 1 (orders) + ceil(100/50) = 3 statements:
// select ... from customers where id in (?,?,?,... 50 ids)

// 5) Assert the statement count in a test so the bug cannot come back
@SpringBootTest
class OrderQueryCountTest {
    @Autowired OrderService service;
    @Autowired EntityManagerFactory emf;

    @Test
    void paidOrderEmails_doesNotRunNPlusOneQueries() {
        var stats = emf.unwrap(org.hibernate.SessionFactory.class).getStatistics();
        stats.setStatisticsEnabled(true);
        stats.clear();

        service.emailsOfPaidOrdersSlow();   // passes only once batch fetching / join fetch is in place

        org.assertj.core.api.Assertions.assertThat(stats.getPrepareStatementCount()).isLessThanOrEqualTo(3);
    }
}

-- src/main/resources/db/migration/V1__create_users_and_tasks.sql
create table app_users (
    id            bigserial primary key,
    email         varchar(160) not null unique,
    password_hash varchar(100) not null,          -- BCrypt hashes are 60 chars
    full_name     varchar(120) not null,
    role          varchar(20)  not null default 'USER',
    enabled       boolean      not null default true,
    created_at    timestamptz  not null default now()
);

create table tasks (
    id          bigserial primary key,
    owner_id    bigint       not null references app_users(id),
    title       varchar(200) not null,
    description text,
    status      varchar(20)  not null default 'TODO',
    due_date    date,
    version     bigint       not null default 0,
    created_at  timestamptz  not null default now()
);

create index idx_tasks_owner_status on tasks(owner_id, status);

-- src/main/resources/db/migration/V2__add_task_priority.sql
alter table tasks add column priority varchar(10) not null default 'MEDIUM';

-- src/main/resources/db/migration/V3__seed_admin.sql
-- Generate the hash once with: new BCryptPasswordEncoder().encode("Admin@123")
-- and paste the 60-character result below (the value here is a PLACEHOLDER, not a real hash).
insert into app_users (email, password_hash, full_name, role)
values ('admin@taskmanager.in',
        '$2a$10$REPLACE_WITH_REAL_BCRYPT_HASH_GENERATED_LOCALLY_000000',
        'System Admin', 'ADMIN');

# src/main/resources/application.yml
spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/taskmanager
    username: taskmanager
    password: ${DB_PASSWORD:secret}
  jpa:
    hibernate:
      ddl-auto: validate          # Flyway owns the schema; Hibernate only checks it
    open-in-view: false
    properties:
      hibernate:
        default_batch_fetch_size: 50
  flyway:
    enabled: true
    locations: classpath:db/migration

# Startup log you should see:
# o.f.c.i.c.DbMigrate : Migrating schema "public" to version "1 - create users and tasks"
# o.f.c.i.c.DbMigrate : Migrating schema "public" to version "2 - add task priority"
# o.f.c.i.c.DbMigrate : Successfully applied 3 migrations to schema "public", now at version v3

// src/main/java/in/ravindra/taskmanager/security/SecurityConfig.java
package in.ravindra.taskmanager.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableMethodSecurity                      // turns on @PreAuthorize / @PostAuthorize
public class SecurityConfig {

    @Bean
    SecurityFilterChain apiSecurity(HttpSecurity http, JwtService jwtService) throws Exception {
        http
            .csrf(csrf -> csrf.disable())                                   // stateless bearer-token API
            .cors(Customizer.withDefaults())                                // uses the CorsConfigurationSource bean
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/actuator/health").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/public/**").permitAll()
                .requestMatchers("/actuator/**").hasRole("ADMIN")
                .anyRequest().authenticated())                              // order matters: last rule
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)))  // 401, no redirect
            .addFilterBefore(new JwtAuthFilter(jwtService), UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();            // cost 10 by default
    }

    @Bean
    AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();      // ProviderManager -> DaoAuthenticationProvider
    }
}

// src/main/java/in/ravindra/taskmanager/security/JpaUserDetailsService.java
package in.ravindra.taskmanager.security;

import in.ravindra.taskmanager.user.AppUserRepository;
import org.springframework.security.core.userdetails.*;
import org.springframework.stereotype.Service;

@Service
public class JpaUserDetailsService implements UserDetailsService {
    private final AppUserRepository users;
    public JpaUserDetailsService(AppUserRepository users) { this.users = users; }

    @Override
    public UserDetails loadUserByUsername(String email) {
        return users.findByEmailIgnoreCase(email)
                .map(u -> User.withUsername(u.getEmail())
                        .password(u.getPasswordHash())         // BCrypt hash from the DB
                        .roles(u.getRole().name())             // "USER" -> authority "ROLE_USER"
                        .disabled(!u.isEnabled())
                        .build())
                .orElseThrow(() -> new UsernameNotFoundException("No user with email " + email));
    }
}

// Request flow for GET /api/tasks with a valid token:
// Tomcat -> DelegatingFilterProxy -> FilterChainProxy -> [CorsFilter, JwtAuthFilter (sets Authentication),
// ..., AuthorizationFilter (anyRequest().authenticated() -> OK)] -> DispatcherServlet -> TaskController

// src/main/java/in/ravindra/taskmanager/user/AppUser.java
package in.ravindra.taskmanager.user;

import jakarta.persistence.*;
import java.time.Instant;

@Entity
@Table(name = "app_users")
public class AppUser {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    @Column(nullable = false, unique = true, length = 160)
    private String email;
    @Column(name = "password_hash", nullable = false, length = 100)
    private String passwordHash;
    @Column(name = "full_name", nullable = false, length = 120)
    private String fullName;
    @Enumerated(EnumType.STRING) @Column(nullable = false, length = 20)
    private Role role = Role.USER;
    private boolean enabled = true;
    @Column(name = "created_at", nullable = false, updatable = false, insertable = false)
    private Instant createdAt;

    protected AppUser() { }
    public AppUser(String email, String passwordHash, String fullName) {
        this.email = email; this.passwordHash = passwordHash; this.fullName = fullName;
    }
    public Long getId() { return id; }
    public String getEmail() { return email; }
    public String getPasswordHash() { return passwordHash; }
    public String getFullName() { return fullName; }
    public Role getRole() { return role; }
    public boolean isEnabled() { return enabled; }
}

// src/main/java/in/ravindra/taskmanager/user/Role.java
package in.ravindra.taskmanager.user;
public enum Role { USER, ADMIN }

// src/main/java/in/ravindra/taskmanager/user/AppUserRepository.java
package in.ravindra.taskmanager.user;
import org.springframework.data.jpa.repository.JpaRepository;
import java.util.Optional;

public interface AppUserRepository extends JpaRepository<AppUser, Long> {
    Optional<AppUser> findByEmailIgnoreCase(String email);
    boolean existsByEmailIgnoreCase(String email);
}

// src/main/java/in/ravindra/taskmanager/auth/RegisterRequest.java
package in.ravindra.taskmanager.auth;
import jakarta.validation.constraints.*;

public record RegisterRequest(
        @Email @NotBlank String email,
        @NotBlank @Size(min = 8, max = 72) String password,   // BCrypt uses at most 72 bytes
        @NotBlank @Size(max = 120) String fullName) { }

// src/main/java/in/ravindra/taskmanager/auth/AuthService.java (registration part)
package in.ravindra.taskmanager.auth;

import in.ravindra.taskmanager.user.*;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
public class AuthService {
    private final AppUserRepository users;
    private final PasswordEncoder encoder;

    public AuthService(AppUserRepository users, PasswordEncoder encoder) {
        this.users = users; this.encoder = encoder;
    }

    @Transactional
    public Long register(RegisterRequest req) {
        if (users.existsByEmailIgnoreCase(req.email())) {
            throw new EmailAlreadyUsedException(req.email());      // -> 409 Conflict via @ControllerAdvice
        }
        String hash = encoder.encode(req.password());              // "$2a$10$..." 60 chars, new salt each time
        AppUser user = users.save(new AppUser(req.email().toLowerCase(), hash, req.fullName()));
        return user.getId();
    }
}

// Quick check in a JUnit 5 test:
// PasswordEncoder enc = new BCryptPasswordEncoder();
// String h1 = enc.encode("Admin@123");  String h2 = enc.encode("Admin@123");
// assertNotEquals(h1, h2);                    // different salts
// assertTrue(enc.matches("Admin@123", h1));   // both still verify
// assertTrue(enc.matches("Admin@123", h2));

// src/main/java/in/ravindra/taskmanager/security/JwtService.java
package in.ravindra.taskmanager.security;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import java.util.List;

@Service
public class JwtService {
    private final SecretKey key;
    private final long expiryMinutes;

    public JwtService(@Value("${app.jwt.secret}") String secret,
                      @Value("${app.jwt.expiry-minutes:15}") long expiryMinutes) {
        this.key = Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8)); // >= 32 bytes for HS256
        this.expiryMinutes = expiryMinutes;
    }

    public String generate(String email, List<String> authorities) {
        Instant now = Instant.now();
        return Jwts.builder()
                .subject(email)
                .claim("roles", authorities)                       // e.g. ["ROLE_USER"]
                .issuedAt(Date.from(now))
                .expiration(Date.from(now.plus(expiryMinutes, ChronoUnit.MINUTES)))
                .signWith(key)                                     // HS256 chosen from the key size
                .compact();
    }

    /** Verifies signature + expiry; throws io.jsonwebtoken.JwtException when invalid. */
    public Claims parse(String token) {
        return Jwts.parser().verifyWith(key).build().parseSignedClaims(token).getPayload();
    }
}

// src/main/java/in/ravindra/taskmanager/security/JwtAuthFilter.java
package in.ravindra.taskmanager.security;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwtException;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.HttpHeaders;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;
import java.util.List;

// NOT annotated with @Component on purpose: it is added to the chain in SecurityConfig.
// A @Component Filter would ALSO be registered by Spring Boot as a plain servlet filter and run twice.
public class JwtAuthFilter extends OncePerRequestFilter {
    private final JwtService jwtService;
    public JwtAuthFilter(JwtService jwtService) { this.jwtService = jwtService; }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        String header = request.getHeader(HttpHeaders.AUTHORIZATION);
        if (header != null && header.startsWith("Bearer ")
                && SecurityContextHolder.getContext().getAuthentication() == null) {
            try {
                Claims claims = jwtService.parse(header.substring(7));
                @SuppressWarnings("unchecked")
                List<String> roles = claims.get("roles", List.class);
                var authorities = roles.stream().map(SimpleGrantedAuthority::new).toList();
                var auth = new UsernamePasswordAuthenticationToken(claims.getSubject(), null, authorities);
                auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(auth);   // request is now authenticated
            } catch (JwtException | IllegalArgumentException e) {
                logger.debug("Rejected JWT: " + e.getMessage());               // stay unauthenticated -> 401 later
            }
        }
        chain.doFilter(request, response);
    }
}

// src/main/java/in/ravindra/taskmanager/auth/AuthController.java
package in.ravindra.taskmanager.auth;

import in.ravindra.taskmanager.security.JwtService;
import jakarta.validation.Valid;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.web.bind.annotation.*;
import java.util.Map;

@RestController
@RequestMapping("/api/auth")
public class AuthController {
    private final AuthenticationManager authManager;
    private final JwtService jwtService;
    private final AuthService authService;

    public AuthController(AuthenticationManager authManager, JwtService jwtService, AuthService authService) {
        this.authManager = authManager; this.jwtService = jwtService; this.authService = authService;
    }

    public record LoginRequest(String email, String password) { }
    public record TokenResponse(String accessToken, String tokenType, long expiresInSeconds) { }

    @PostMapping("/register")
    @ResponseStatus(HttpStatus.CREATED)
    public Map<String, Long> register(@Valid @RequestBody RegisterRequest req) {
        return Map.of("id", authService.register(req));
    }

    @PostMapping("/login")
    public TokenResponse login(@RequestBody LoginRequest req) {
        Authentication auth = authManager.authenticate(
                new UsernamePasswordAuthenticationToken(req.email(), req.password())); // throws on bad password
        var roles = auth.getAuthorities().stream().map(GrantedAuthority::getAuthority).toList();
        String token = jwtService.generate(auth.getName(), roles);
        return new TokenResponse(token, "Bearer", 15 * 60);
    }
}

// curl -s -X POST localhost:8080/api/auth/login -H 'Content-Type: application/json' \
//   -d '{"email":"asha@example.in","password":"Asha@12345"}'
// {"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhc2hhQGV4YW1wbGUuaW4iLCJyb2xlcyI6WyJST0xFX1VTRVIiXSwiaWF0IjoxNzkxNTM...","tokenType":"Bearer","expiresInSeconds":900}

// src/main/java/in/ravindra/taskmanager/task/TaskService.java (method security examples)
package in.ravindra.taskmanager.task;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
public class TaskService {
    private final TaskRepository tasks;
    public TaskService(TaskRepository tasks) { this.tasks = tasks; }

    @PostAuthorize("returnObject.ownerEmail() == authentication.name or hasRole('ADMIN')")
    @Transactional(readOnly = true)
    public TaskDto get(Long id) {
        return tasks.findById(id).map(TaskDto::from).orElseThrow(() -> new TaskNotFoundException(id));
    }

    @PreAuthorize("@taskSecurity.isOwner(#id, authentication.name) or hasRole('ADMIN')")
    @Transactional
    public void delete(Long id) {
        tasks.deleteById(id);
    }

    @PreAuthorize("hasRole('ADMIN')")
    @Transactional(readOnly = true)
    public long countAll() { return tasks.count(); }
}

// src/main/java/in/ravindra/taskmanager/task/TaskSecurity.java — a bean referenced from SpEL
package in.ravindra.taskmanager.task;
import org.springframework.stereotype.Component;

@Component("taskSecurity")
public class TaskSecurity {
    private final TaskRepository tasks;
    public TaskSecurity(TaskRepository tasks) { this.tasks = tasks; }
    public boolean isOwner(Long taskId, String email) {
        return tasks.existsByIdAndOwner_EmailIgnoreCase(taskId, email);
    }
}

// src/main/java/in/ravindra/taskmanager/security/CorsConfig.java
package in.ravindra.taskmanager.security;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.List;

@Configuration
public class CorsConfig {
    @Bean
    CorsConfigurationSource corsConfigurationSource(
            @Value("${app.cors.allowed-origins}") List<String> origins) {   // e.g. https://tasks.ravindra.in
        CorsConfiguration cfg = new CorsConfiguration();
        cfg.setAllowedOrigins(origins);                                      // exact origins, never "*" with credentials
        cfg.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
        cfg.setAllowedHeaders(List.of("Authorization", "Content-Type"));
        cfg.setExposedHeaders(List.of("Location"));
        cfg.setMaxAge(3600L);                                                // cache the preflight for 1 hour
        var source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/api/**", cfg);
        return source;
    }
}

// Expected behaviour:
// DELETE /api/tasks/7 as the owner            -> 204
// DELETE /api/tasks/7 as another USER         -> 403 {"status":403,"error":"Forbidden"}
// DELETE /api/tasks/7 with no/expired token   -> 401
// OPTIONS /api/tasks from http://localhost:3000 -> 200 with Access-Control-Allow-Origin: http://localhost:3000

# Dockerfile — multi-stage build, layered jar, non-root user
# ---- stage 1: build ----
FROM eclipse-temurin:25-jdk AS build
WORKDIR /workspace
COPY mvnw pom.xml ./
COPY .mvn .mvn
RUN ./mvnw -q dependency:go-offline            # cache dependencies as their own layer
COPY src src
RUN ./mvnw -q clean package -DskipTests        # tests already ran in CI
RUN java -Djarmode=tools -jar target/*.jar extract --layers --destination extracted

# ---- stage 2: runtime ----
FROM eclipse-temurin:25-jre
RUN useradd --system --uid 1001 appuser
WORKDIR /app
COPY --from=build /workspace/extracted/dependencies/ ./
COPY --from=build /workspace/extracted/spring-boot-loader/ ./
COPY --from=build /workspace/extracted/snapshot-dependencies/ ./
COPY --from=build /workspace/extracted/application/ ./
USER appuser
EXPOSE 8080
ENV JAVA_TOOL_OPTIONS="-XX:MaxRAMPercentage=75 -XX:+UseZGC"
ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]

# .dockerignore
# target/
# .git/
# *.md

# docker-compose.yml — API + PostgreSQL for local/staging
services:
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: taskmanager
      POSTGRES_USER: taskmanager
      POSTGRES_PASSWORD: secret
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U taskmanager"]
      interval: 5s
      retries: 10
  api:
    build: .
    ports:
      - "8080:8080"
    environment:
      SPRING_PROFILES_ACTIVE: prod
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/taskmanager
      SPRING_DATASOURCE_USERNAME: taskmanager
      DB_PASSWORD: secret
      JWT_SECRET: change-me-to-a-random-48-byte-base64-string-from-openssl
      APP_CORS_ALLOWED_ORIGINS: http://localhost:3000
    depends_on:
      db:
        condition: service_healthy
volumes:
  pgdata:

# Commands
# ./mvnw clean package                         -> target/taskmanager-1.0.0.jar (~45 MB)
# docker build -t taskmanager:1.0.0 .          -> image ~260 MB
# docker compose up --build                    -> API on http://localhost:8080
# curl localhost:8080/actuator/health          -> {"status":"UP"}

# src/main/resources/application-prod.yml — production profile (secrets come from the environment)
server:
  port: 8080
  shutdown: graceful
  forward-headers-strategy: framework        # trust X-Forwarded-* from Nginx/Ingress for HTTPS links

spring:
  lifecycle:
    timeout-per-shutdown-phase: 20s
  threads:
    virtual:
      enabled: true                          # Java 21+: one virtual thread per request
  datasource:
    url: ${SPRING_DATASOURCE_URL}
    username: ${SPRING_DATASOURCE_USERNAME}
    password: ${DB_PASSWORD}
    hikari:
      maximum-pool-size: 16
      connection-timeout: 5000
  jpa:
    show-sql: false
    open-in-view: false
    hibernate:
      ddl-auto: validate
  flyway:
    enabled: true

app:
  jwt:
    secret: ${JWT_SECRET}                   # openssl rand -base64 48
    expiry-minutes: 15
  cors:
    allowed-origins: ${APP_CORS_ALLOWED_ORIGINS}

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus
  endpoint:
    health:
      probes:
        enabled: true                        # /actuator/health/liveness and /readiness

logging:
  structured:
    format:
      console: ecs                           # JSON logs for ELK / Loki / CloudWatch
  level:
    org.hibernate.SQL: warn

# .github/workflows/deploy.yml — minimal CI/CD
name: build-and-deploy
on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with: { distribution: temurin, java-version: '25' }
      - run: ./mvnw -B verify                              # unit + integration tests
      - run: docker build -t ghcr.io/ravindra/taskmanager:${{ github.sha }} .
      - run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - run: docker push ghcr.io/ravindra/taskmanager:${{ github.sha }}
      # deploy step: ssh to the VPS and run "docker compose pull && docker compose up -d",
      # or trigger the PaaS / kubectl rollout with the new tag

// Mistake 2 and 1 together: entity returned from a controller with lazy fields
@GetMapping("/{id}")
public Order get(@PathVariable Long id) {              // BAD: entity, lazy customer/items, recursion risk
    return orders.findById(id).orElseThrow();
}

// Fix: DTO built inside a transactional service
public record OrderDetails(Long id, String customerEmail, BigDecimal total, List<ItemLine> items) {
    public record ItemLine(String product, int qty) { }
}

@Service
public class OrderQueryService {
    private final OrderRepository orders;
    public OrderQueryService(OrderRepository orders) { this.orders = orders; }

    @Transactional(readOnly = true)
    public OrderDetails details(Long id) {
        Order o = orders.findWithCustomerAndItemsById(id)         // @EntityGraph(attributePaths = {"customer","items"})
                .orElseThrow(() -> new OrderNotFoundException(id));
        return new OrderDetails(o.getId(), o.getCustomer().getEmail(), o.getTotalAmount(),
                o.getItems().stream().map(i -> new OrderDetails.ItemLine(i.getProductName(), i.getQuantity())).toList());
    }
}

// Mistake 11: self-invocation bypasses the proxy
@Service
public class ReportService {
    public void nightlyJob() {
        generate();                         // BAD: @Transactional/@PreAuthorize on generate() are NOT applied
    }
    @Transactional
    @PreAuthorize("hasRole('ADMIN')")
    public void generate() { /* ... */ }
}
// Fix: put generate() in ReportGenerator and inject it into ReportService.

// Mistake 7: the ROLE_ prefix
// .requestMatchers("/api/admin/**").hasRole("ROLE_ADMIN")   // BAD -> IllegalArgumentException / never matches
// .requestMatchers("/api/admin/**").hasRole("ADMIN")        // GOOD
// .requestMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN") // also GOOD

// src/main/java/in/ravindra/taskmanager/TaskManagerApplication.java
package in.ravindra.taskmanager;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class TaskManagerApplication {
    public static void main(String[] args) {
        SpringApplication.run(TaskManagerApplication.class, args);
    }
}

// src/main/java/in/ravindra/taskmanager/task/Task.java
package in.ravindra.taskmanager.task;

import in.ravindra.taskmanager.user.AppUser;
import jakarta.persistence.*;
import java.time.Instant;
import java.time.LocalDate;

@Entity
@Table(name = "tasks")
public class Task {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    @JoinColumn(name = "owner_id", nullable = false)
    private AppUser owner;

    @Column(nullable = false, length = 200)
    private String title;

    @Column(columnDefinition = "text")
    private String description;

    @Enumerated(EnumType.STRING) @Column(nullable = false, length = 20)
    private TaskStatus status = TaskStatus.TODO;

    @Enumerated(EnumType.STRING) @Column(nullable = false, length = 10)
    private Priority priority = Priority.MEDIUM;

    @Column(name = "due_date")
    private LocalDate dueDate;

    @Version
    private long version;

    @Column(name = "created_at", nullable = false, insertable = false, updatable = false)
    private Instant createdAt;

    protected Task() { }
    public Task(AppUser owner, String title, String description, Priority priority, LocalDate dueDate) {
        this.owner = owner; this.title = title; this.description = description;
        this.priority = priority == null ? Priority.MEDIUM : priority; this.dueDate = dueDate;
    }
    public Long getId() { return id; }
    public AppUser getOwner() { return owner; }
    public String getTitle() { return title; }
    public String getDescription() { return description; }
    public TaskStatus getStatus() { return status; }
    public void setStatus(TaskStatus status) { this.status = status; }
    public Priority getPriority() { return priority; }
    public LocalDate getDueDate() { return dueDate; }
}

// src/main/java/in/ravindra/taskmanager/task/TaskStatus.java
package in.ravindra.taskmanager.task;
public enum TaskStatus { TODO, IN_PROGRESS, DONE }

// src/main/java/in/ravindra/taskmanager/task/Priority.java
package in.ravindra.taskmanager.task;
public enum Priority { LOW, MEDIUM, HIGH }

// src/main/java/in/ravindra/taskmanager/task/TaskRepository.java
package in.ravindra.taskmanager.task;

import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.data.jpa.repository.EntityGraph;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Query;
import java.util.List;

public interface TaskRepository extends JpaRepository<Task, Long> {
    Page<Task> findByOwner_EmailIgnoreCase(String email, Pageable pageable);
    Page<Task> findByOwner_EmailIgnoreCaseAndStatus(String email, TaskStatus status, Pageable pageable);
    boolean existsByIdAndOwner_EmailIgnoreCase(Long id, String email);

    @EntityGraph(attributePaths = "owner")                    // admin list: tasks + owners in ONE query
    Page<Task> findAllBy(Pageable pageable);

    @Query("select t.status as status, count(t) as count from Task t group by t.status")
    List<StatusCount> countByStatusGrouped();

    interface StatusCount {                                   // interface projection
        TaskStatus getStatus();
        long getCount();
    }
}

// src/main/java/in/ravindra/taskmanager/task/TaskDtos.java
package in.ravindra.taskmanager.task;

import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;
import jakarta.validation.constraints.Size;
import java.time.LocalDate;

public record CreateTaskRequest(@NotBlank @Size(max = 200) String title,
                                @Size(max = 4000) String description,
                                Priority priority,
                                LocalDate dueDate) { }

public record UpdateStatusRequest(@NotNull TaskStatus status) { }

// src/main/java/in/ravindra/taskmanager/task/TaskDto.java
package in.ravindra.taskmanager.task;
import java.time.LocalDate;

public record TaskDto(Long id, String title, String description, TaskStatus status,
                      Priority priority, LocalDate dueDate, String ownerEmail) {
    static TaskDto from(Task t) {
        return new TaskDto(t.getId(), t.getTitle(), t.getDescription(), t.getStatus(),
                t.getPriority(), t.getDueDate(), t.getOwner().getEmail());
    }
}

// src/main/java/in/ravindra/taskmanager/task/TaskService.java  (full version)
package in.ravindra.taskmanager.task;

import in.ravindra.taskmanager.user.AppUserRepository;
import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.util.LinkedHashMap;
import java.util.Map;

@Service
public class TaskService {
    private final TaskRepository tasks;
    private final AppUserRepository users;

    public TaskService(TaskRepository tasks, AppUserRepository users) {
        this.tasks = tasks; this.users = users;
    }

    @Transactional
    public TaskDto create(String ownerEmail, CreateTaskRequest req) {
        var owner = users.findByEmailIgnoreCase(ownerEmail).orElseThrow();
        Task saved = tasks.save(new Task(owner, req.title(), req.description(), req.priority(), req.dueDate()));
        return TaskDto.from(saved);
    }

    @Transactional(readOnly = true)
    public Page<TaskDto> listMine(String ownerEmail, TaskStatus status, Pageable pageable) {
        Page<Task> page = status == null
                ? tasks.findByOwner_EmailIgnoreCase(ownerEmail, pageable)
                : tasks.findByOwner_EmailIgnoreCaseAndStatus(ownerEmail, status, pageable);
        return page.map(TaskDto::from);          // owner is in the persistence context: no extra query
    }

    @PreAuthorize("@taskSecurity.isOwner(#id, authentication.name) or hasRole('ADMIN')")
    @Transactional
    public TaskDto updateStatus(Long id, TaskStatus status) {
        Task task = tasks.findById(id).orElseThrow(() -> new TaskNotFoundException(id));
        task.setStatus(status);                  // dirty checking + @Version -> UPDATE ... WHERE version=?
        return TaskDto.from(task);
    }

    @PreAuthorize("@taskSecurity.isOwner(#id, authentication.name) or hasRole('ADMIN')")
    @Transactional
    public void delete(Long id) {
        if (!tasks.existsById(id)) throw new TaskNotFoundException(id);
        tasks.deleteById(id);
    }

    @PreAuthorize("hasRole('ADMIN')")
    @Transactional(readOnly = true)
    public Map<TaskStatus, Long> stats() {
        Map<TaskStatus, Long> result = new LinkedHashMap<>();
        for (TaskStatus s : TaskStatus.values()) result.put(s, 0L);
        tasks.countByStatusGrouped().forEach(c -> result.put(c.getStatus(), c.getCount()));
        return result;
    }

    @PreAuthorize("hasRole('ADMIN')")
    @Transactional(readOnly = true)
    public Page<TaskDto> listAll(Pageable pageable) {
        return tasks.findAllBy(pageable).map(TaskDto::from);
    }
}

// src/main/java/in/ravindra/taskmanager/task/TaskController.java
package in.ravindra.taskmanager.task;

import jakarta.validation.Valid;
import org.springframework.data.domain.Pageable;
import org.springframework.data.domain.Sort;
import org.springframework.data.web.PageableDefault;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
import java.util.Map;

@RestController
@RequestMapping("/api")
public class TaskController {
    private final TaskService service;
    public TaskController(TaskService service) { this.service = service; }

    @PostMapping("/tasks")
    public ResponseEntity<TaskDto> create(@Valid @RequestBody CreateTaskRequest req, Authentication auth) {
        TaskDto dto = service.create(auth.getName(), req);
        var location = ServletUriComponentsBuilder.fromCurrentRequest().path("/{id}").build(dto.id());
        return ResponseEntity.created(location).body(dto);
    }

    @GetMapping("/tasks")
    public PageResponse<TaskDto> mine(@RequestParam(required = false) TaskStatus status,
                                      @PageableDefault(size = 10, sort = "dueDate", direction = Sort.Direction.ASC) Pageable pageable,
                                      Authentication auth) {
        return PageResponse.from(service.listMine(auth.getName(), status, pageable));
    }

    @PatchMapping("/tasks/{id}/status")
    public TaskDto updateStatus(@PathVariable Long id, @Valid @RequestBody UpdateStatusRequest req) {
        return service.updateStatus(id, req.status());
    }

    @DeleteMapping("/tasks/{id}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void delete(@PathVariable Long id) { service.delete(id); }

    @GetMapping("/admin/stats")
    public Map<TaskStatus, Long> stats() { return service.stats(); }

    @GetMapping("/admin/tasks")
    public PageResponse<TaskDto> all(@PageableDefault(size = 20) Pageable pageable) {
        return PageResponse.from(service.listAll(pageable));
    }
}

// src/main/java/in/ravindra/taskmanager/task/PageResponse.java
package in.ravindra.taskmanager.task;
import org.springframework.data.domain.Page;
import java.util.List;

public record PageResponse<T>(List<T> items, int page, int size, long totalElements, int totalPages, boolean hasNext) {
    public static <T> PageResponse<T> from(Page<T> p) {
        return new PageResponse<>(p.getContent(), p.getNumber(), p.getSize(), p.getTotalElements(), p.getTotalPages(), p.hasNext());
    }
}

// src/main/java/in/ravindra/taskmanager/common/ApiExceptionHandler.java
package in.ravindra.taskmanager.common;

import in.ravindra.taskmanager.auth.EmailAlreadyUsedException;
import in.ravindra.taskmanager.task.TaskNotFoundException;
import org.springframework.http.HttpStatus;
import org.springframework.http.ProblemDetail;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
public class ApiExceptionHandler {

    @ExceptionHandler(TaskNotFoundException.class)
    ProblemDetail notFound(TaskNotFoundException e) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, e.getMessage());
    }

    @ExceptionHandler(EmailAlreadyUsedException.class)
    ProblemDetail conflict(EmailAlreadyUsedException e) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.CONFLICT, "Email already registered");
    }

    @ExceptionHandler(BadCredentialsException.class)
    ProblemDetail badCredentials(BadCredentialsException e) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.UNAUTHORIZED, "Invalid email or password"); // generic on purpose
    }

    @ExceptionHandler(AccessDeniedException.class)
    ProblemDetail forbidden(AccessDeniedException e) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.FORBIDDEN, "You do not have permission for this action");
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    ProblemDetail invalid(MethodArgumentNotValidException e) {
        var pd = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Validation failed");
        pd.setProperty("errors", e.getBindingResult().getFieldErrors().stream()
                .map(f -> f.getField() + ": " + f.getDefaultMessage()).toList());
        return pd;
    }
}

// src/main/java/in/ravindra/taskmanager/task/TaskNotFoundException.java
package in.ravindra.taskmanager.task;
public class TaskNotFoundException extends RuntimeException {
    public TaskNotFoundException(Long id) { super("Task " + id + " not found"); }
}

// src/main/java/in/ravindra/taskmanager/auth/EmailAlreadyUsedException.java
package in.ravindra.taskmanager.auth;
public class EmailAlreadyUsedException extends RuntimeException {
    public EmailAlreadyUsedException(String email) { super("Email already used: " + email); }
}

// ------------------------------------------------------------------
// Try it (after: docker compose up --build)
// ------------------------------------------------------------------
// 1) Register
// curl -s -X POST localhost:8080/api/auth/register -H 'Content-Type: application/json' \
//   -d '{"email":"asha@example.in","password":"Asha@12345","fullName":"Asha Verma"}'
// -> 201 {"id":2}
//
// 2) Login and keep the token
// TOKEN=$(curl -s -X POST localhost:8080/api/auth/login -H 'Content-Type: application/json' \
//   -d '{"email":"asha@example.in","password":"Asha@12345"}' | sed 's/.*"accessToken":"\([^"]*\)".*/\1/')
//
// 3) Create a task
// curl -s -X POST localhost:8080/api/tasks -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
//   -d '{"title":"Prepare Spring Security interview notes","priority":"HIGH","dueDate":"2026-10-15"}'
// -> 201 Location: /api/tasks/1
//    {"id":1,"title":"Prepare Spring Security interview notes","description":null,"status":"TODO",
//     "priority":"HIGH","dueDate":"2026-10-15","ownerEmail":"asha@example.in"}
//
// 4) List my TODO tasks, page 0
// curl -s "localhost:8080/api/tasks?status=TODO&page=0&size=10" -H "Authorization: Bearer $TOKEN"
// -> {"items":[{...}],"page":0,"size":10,"totalElements":1,"totalPages":1,"hasNext":false}
//
// 5) Move it to IN_PROGRESS
// curl -s -X PATCH localhost:8080/api/tasks/1/status -H "Authorization: Bearer $TOKEN" \
//   -H 'Content-Type: application/json' -d '{"status":"IN_PROGRESS"}'
//
// 6) Admin-only stats with Asha's token -> 403; with admin@taskmanager.in / Admin@123 -> 200
// curl -s localhost:8080/api/admin/stats -H "Authorization: Bearer $TOKEN"
// -> 403 {"type":"about:blank","title":"Forbidden","status":403,"detail":"You do not have permission for this action"}
// -> 200 {"TODO":0,"IN_PROGRESS":1,"DONE":0}   (as admin)
//
// 7) No token -> 401 ; tampered token -> 401 ; after 15 minutes -> 401 (ExpiredJwtException)