Potential fix for code scanning alert no. 9: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Update .github/workflows/deploy-pr.yaml
2026-03-22 15:12:08 +01:00 · 2025-10-16 18:04:04 +02:00 · 2025-10-16 18:02:09 +02:00 · 2025-10-16 18:00:07 +02:00 · 2025-10-16 17:50:39 +02:00 · 2025-10-16 17:43:55 +02:00
34 changed files with 875 additions and 283 deletions
--- a/.github/workflows/deploy-pr.yaml
+++ b/.github/workflows/deploy-pr.yaml
@@ -20,13 +20,26 @@ jobs:
      pr_number: ${{ github.event.pull_request.number }}
    secrets: inherit

+  get_urls:
+    if: github.event.action != 'closed'
+    name: Generate Preview URLs
+    uses: ./.github/workflows/url_generator.yml
+    with:
+      runner: vhs
+      mode: pr
+      pr_number: ${{ github.event.pull_request.number }}
+      base_domain: ${{ vars.DEV_BASE_DOMAIN }}
+    secrets: inherit
+
  frontend:
    if: github.event.action != 'closed'
    name: Frontend - Build and Deploy to Cloudflare Pages (PR)
+    needs: [get_urls]
    uses: ./.github/workflows/frontend-pages.yml
    with:
      mode: pr
      pr_number: ${{ github.event.pull_request.number }}
+      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
    secrets: inherit

  deploy:
@@ -36,7 +49,7 @@ jobs:
    concurrency:
      group: pr-${{ github.event.pull_request.number }}
      cancel-in-progress: false
-    needs: [build, frontend]
+    needs: [build, frontend, get_urls]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -62,25 +75,24 @@ jobs:
          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
-          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
          DIGEST: ${{ needs.build.outputs.digest }}
+          DOMAIN: "${{ needs.get_urls.outputs.backend_url }}"
+          DOMAIN_SCHEME: "${{ needs.get_urls.outputs.backend_url_scheme }}"
+          FRONTEND_DOMAIN: "${{ needs.get_urls.outputs.frontend_url }}"
+          FRONTEND_DOMAIN_SCHEME: "${{ needs.get_urls.outputs.frontend_url_scheme }}"
        run: |
          PR=${{ github.event.pull_request.number }}
-          if [ -z "$PR" ]; then echo "PR number missing"; exit 1; fi
-          if [ -z "$DEV_BASE_DOMAIN" ]; then echo "Secret DEV_BASE_DOMAIN is required (e.g., dev.example.com)"; exit 1; fi
-          if [ -z "$RABBITMQ_PASSWORD" ]; then echo "Secret DEV_RABBITMQ_PASSWORD is required"; exit 1; fi
-          if [ -z "$DB_PASSWORD" ]; then echo "Secret DEV_DB_PASSWORD is required"; exit 1; fi
          RELEASE=myapp-pr-$PR
          NAMESPACE=pr-$PR
-          DOMAIN=pr-$PR.$DEV_BASE_DOMAIN
-          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install "$RELEASE" ./7project/charts/myapp-chart \
            -n "$NAMESPACE" --create-namespace \
            -f 7project/charts/myapp-chart/values-dev.yaml \
            --set prNumber="$PR" \
            --set deployment="pr-$PR" \
            --set domain="$DOMAIN" \
-            --set image.repository="$IMAGE_REPO" \
+            --set domain_scheme="$DOMAIN_SCHEME" \
+            --set frontend_domain="$FRONTEND_DOMAIN" \
+            --set frontend_domain_scheme="$FRONTEND_DOMAIN_SCHEME" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
            --set-string database.password="$DB_PASSWORD"
@@ -88,19 +100,16 @@ jobs:
      - name: Post preview URLs as PR comment
        uses: actions/github-script@v7
        env:
-          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
-          FRONTEND_URL: ${{ needs.frontend.outputs.deployed_url }}
+          BACKEND_URL: ${{ needs.get_urls.outputs.backend_url_scheme }}
+          FRONTEND_URL: ${{ needs.get_urls.outputs.frontend_url_scheme }}
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) { core.setFailed('No pull_request context'); return; }
            const prNumber = pr.number;
-            const domainBase = process.env.DEV_BASE_DOMAIN;
-            if (!domainBase) { core.setFailed('DEV_BASE_DOMAIN is required'); return; }
-            const backendDomain = `pr-${prNumber}.${domainBase}`;
-            const backendUrl = `https://${backendDomain}`;
+            const backendUrl = process.env.BACKEND_URL || '(not available)';
            const frontendUrl = process.env.FRONTEND_URL || '(not available)';
-            const marker = '<!-- preview-link -->';
+            const marker = '<!-- preview-comment-marker -->';
            const body = `${marker}\nPreview environment is running\n- Frontend: ${frontendUrl}\n- Backend: ${backendUrl}\n`;
            const { owner, repo } = context.repo;
            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number: prNumber, per_page: 100 });
@@ -139,4 +148,4 @@ jobs:
          NAMESPACE=pr-$PR
          helm uninstall "$RELEASE" -n "$NAMESPACE" || true
          # Optionally delete the namespace if empty
-          kubectl delete namespace "$NAMESPACE" --ignore-not-found=true || true
+          kubectl delete namespace "$NAMESPACE" --ignore-not-found=true || true
--- a/.github/workflows/deploy-prod.yaml
+++ b/.github/workflows/deploy-prod.yaml
@@ -30,17 +30,28 @@ jobs:
      context: 7project/backend
    secrets: inherit

+  get_urls:
+    name: Generate Production URLs
+    uses: ./.github/workflows/url_generator.yml
+    with:
+      mode: prod
+      runner: vhs
+      base_domain: ${{ vars.PROD_DOMAIN }}
+    secrets: inherit
+
  frontend:
    name: Frontend - Build and Deploy to Cloudflare Pages (prod)
+    needs: [get_urls]
    uses: ./.github/workflows/frontend-pages.yml
    with:
      mode: prod
+      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
    secrets: inherit

  deploy:
    name: Helm upgrade/install (prod)
    runs-on: vhs
-    needs: [build, frontend]
+    needs: [build, frontend, get_urls]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -63,25 +74,31 @@ jobs:

      - name: Helm upgrade/install prod
        env:
-          DOMAIN: ${{ secrets.PROD_DOMAIN }}
+          DOMAIN: ${{ needs.get_urls.outputs.backend_url }}
+          DOMAIN_SCHEME: ${{ needs.get_urls.outputs.backend_url_scheme }}
+          FRONTEND_DOMAIN: ${{ needs.get_urls.outputs.frontend_url }}
+          FRONTEND_DOMAIN_SCHEME: ${{ needs.get_urls.outputs.frontend_url_scheme }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
-          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
          DIGEST: ${{ needs.build.outputs.digest }}
+          BANKID_CLIENT_ID: ${{ secrets.BANKID_CLIENT_ID }}
+          BANKID_CLIENT_SECRET: ${{ secrets.BANKID_CLIENT_SECRET }}
+          MOJEID_CLIENT_ID: ${{ secrets.MOJEID_CLIENT_ID }}
+          MOJEID_CLIENT_SECRET: ${{ secrets.MOJEID_CLIENT_SECRET }}
+
        run: |
-          if [ -z "$DOMAIN" ]; then
-            echo "Secret PROD_DOMAIN is required (e.g., app.example.com)"; exit 1; fi
-          if [ -z "$RABBITMQ_PASSWORD" ]; then
-            echo "Secret PROD_RABBITMQ_PASSWORD is required"; exit 1; fi
-          if [ -z "$DB_PASSWORD" ]; then
-            echo "Secret PROD_DB_PASSWORD is required"; exit 1; fi
-          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install myapp ./7project/charts/myapp-chart \
            -n prod --create-namespace \
            -f 7project/charts/myapp-chart/values-prod.yaml \
            --set deployment="prod" \
            --set domain="$DOMAIN" \
-            --set image.repository="$IMAGE_REPO" \
+            --set domain_scheme="$DOMAIN_SCHEME" \
+            --set frontend_domain="$FRONTEND_DOMAIN" \
+            --set frontend_domain_scheme="$FRONTEND_DOMAIN_SCHEME" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
-            --set-string database.password="$DB_PASSWORD" 
+            --set-string database.password="$DB_PASSWORD"
+            --set-string oauth.bankid.clientId="$BANKID_CLIENT_ID" \
+            --set-string oauth.bankid.clientSecret="$BANKID_CLIENT_SECRET" \
+            --set-string oauth.mojeid.clientId="$MOJEID_CLIENT_ID" \
+            --set-string oauth.mojeid.clientSecret="$MOJEID_CLIENT_SECRET"
--- a/.github/workflows/frontend-pages.yml
+++ b/.github/workflows/frontend-pages.yml
@@ -15,6 +15,10 @@ on:
        description: 'Cloudflare Pages project name (overrides default)'
        required: false
        type: string
+      backend_url_scheme:
+        description: 'The full scheme URL for the backend (e.g., https://api.example.com)'
+        required: true
+        type: string
    secrets:
      CLOUDFLARE_API_TOKEN:
        required: true
@@ -25,14 +29,6 @@ on:
        description: 'URL of deployed frontend'
        value: ${{ jobs.deploy.outputs.deployed_url }}

-# Required repository secrets:
-#   CLOUDFLARE_API_TOKEN     - API token with Pages:Edit (or Account:Workers Scripts:Edit) permissions
-#   CLOUDFLARE_ACCOUNT_ID    - Your Cloudflare account ID
-# Optional repository variables:
-#   CF_PAGES_PROJECT_NAME      - Default Cloudflare Pages project name
-#   PROD_DOMAIN                - App domain for prod releases (e.g., api.example.com or https://api.example.com)
-#   BACKEND_URL_PR_TEMPLATE    - Template for PR backend URL. Use {PR} placeholder for PR number (e.g., https://api-pr-{PR}.example.com)
-
 jobs:
  build:
    name: Build frontend
@@ -54,50 +50,9 @@ jobs:
      - name: Install dependencies
        run: npm ci

-      - name: Compute backend URL for Vite
-        id: be
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
-          PR_TEMPLATE: ${{ vars.BACKEND_URL_PR_TEMPLATE }}
-          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
-          PROD_DOMAIN_VAR: ${{ vars.PROD_DOMAIN }}
-          PROD_DOMAIN_SECRET: ${{ secrets.PROD_DOMAIN }}
-          BACKEND_URL_OVERRIDE: ${{ vars.BACKEND_URL || secrets.BACKEND_URL }}
-          MODE: ${{ inputs.mode }}
+      - name: Set backend URL from workflow input
        run: |
-          set -euo pipefail
-          URL=""
-          # 1) Explicit override wins (from repo var or secret)
-          if [ -n "${BACKEND_URL_OVERRIDE:-}" ]; then
-            if echo "$BACKEND_URL_OVERRIDE" | grep -Eiq '^https?://'; then
-              URL="$BACKEND_URL_OVERRIDE"
-            else
-              URL="https://${BACKEND_URL_OVERRIDE}"
-            fi
-          else
-            # 2) PR-specific URL when building for PR
-            if [ "${MODE:-}" = "pr" ] || [ "${EVENT_NAME}" = "pull_request" ]; then
-              if [ -n "${PR_TEMPLATE:-}" ] && [ -n "${PR_NUMBER:-}" ] ; then
-                URL="${PR_TEMPLATE//\{PR\}/${PR_NUMBER}}"
-              elif [ -n "${DEV_BASE_DOMAIN:-}" ] && [ -n "${PR_NUMBER:-}" ]; then
-                URL="https://pr-${PR_NUMBER}.${DEV_BASE_DOMAIN}"
-              fi
-            fi
-            # 3) Fallback to PROD_DOMAIN (prefer repo var, then secret)
-            if [ -z "$URL" ]; then
-              PROD_DOMAIN="${PROD_DOMAIN_VAR:-${PROD_DOMAIN_SECRET:-}}"
-              if [ -n "$PROD_DOMAIN" ]; then
-                if echo "$PROD_DOMAIN" | grep -Eiq '^https?://'; then
-                  URL="$PROD_DOMAIN"
-                else
-                  URL="https://${PROD_DOMAIN}"
-                fi
-              fi
-            fi
-          fi
-          echo "Using backend URL: ${URL:-<empty>}"
-          echo "VITE_BACKEND_URL=${URL}" >> $GITHUB_ENV
+          echo "VITE_BACKEND_URL=${{ inputs.backend_url_scheme }}" >> $GITHUB_ENV

      - name: Build
        run: npm run build
@@ -177,4 +132,4 @@ jobs:
          else
            URL="https://${PBRANCH}.${PNAME}.pages.dev"
          fi
-          echo "deployed_url=$URL" >> $GITHUB_OUTPUT
+          echo "deployed_url=$URL" >> $GITHUB_OUTPUT
--- a/.github/workflows/url_generator.yml
+++ b/.github/workflows/url_generator.yml
@@ -0,0 +1,74 @@
+name: Generate Preview or Production URLs
+
+on:
+  workflow_call:
+    inputs:
+      mode:
+        description: "Build mode: 'prod' or 'pr'"
+        required: true
+        type: string
+      pr_number:
+        description: 'PR number (required when mode=pr)'
+        required: false
+        type: string
+      runner:
+        description: 'The runner to use for this job'
+        required: false
+        type: string
+        default: 'ubuntu-latest'
+      base_domain:
+        description: 'The base domain for production URLs (e.g., example.com)'
+        required: true
+        type: string
+
+    outputs:
+      backend_url:
+        description: "The backend URL without scheme (e.g., api.example.com)"
+        value: ${{ jobs.generate-urls.outputs.backend_url }}
+      frontend_url:
+        description: "The frontend URL without scheme (e.g., app.example.com)"
+        value: ${{ jobs.generate-urls.outputs.frontend_url }}
+      backend_url_scheme:
+        description: "The backend URL with scheme (e.g., https://api.example.com)"
+        value: ${{ jobs.generate-urls.outputs.backend_url_scheme }}
+      frontend_url_scheme:
+        description: "The frontend URL with scheme (e.g., https://app.example.com)"
+        value: ${{ jobs.generate-urls.outputs.frontend_url_scheme }}
+
+jobs:
+  generate-urls:
+    permissions:
+      contents: none
+    runs-on: ${{ inputs.runner }}
+
+    outputs:
+      backend_url: ${{ steps.set_urls.outputs.backend_url }}
+      frontend_url: ${{ steps.set_urls.outputs.frontend_url }}
+      backend_url_scheme: ${{ steps.set_urls.outputs.backend_url_scheme }}
+      frontend_url_scheme: ${{ steps.set_urls.outputs.frontend_url_scheme }}
+
+    steps:
+      - name: Generate URLs
+        id: set_urls
+        env:
+          BASE_DOMAIN: ${{ inputs.base_domain }}
+        run: |
+          set -euo pipefail
+          
+          if [ "${{ inputs.mode }}" = "prod" ]; then
+            BACKEND_URL="api.${BASE_DOMAIN}"
+            FRONTEND_URL="finance.${BASE_DOMAIN}"
+          else
+            # This is your current logic
+            FRONTEND_URL="pr-${{ inputs.pr_number }}.group-8-frontend.pages.dev"
+            BACKEND_URL="api-pr-${{ inputs.pr_number }}.${BASE_DOMAIN}"
+          fi
+
+          FRONTEND_URL_SCHEME="https://$FRONTEND_URL"
+          BACKEND_URL_SCHEME="https://$BACKEND_URL"
+          
+          # This part correctly writes to GITHUB_OUTPUT for the step
+          echo "backend_url_scheme=$BACKEND_URL_SCHEME" >> $GITHUB_OUTPUT
+          echo "frontend_url_scheme=$FRONTEND_URL_SCHEME" >> $GITHUB_OUTPUT
+          echo "backend_url=$BACKEND_URL" >> $GITHUB_OUTPUT
+          echo "frontend_url=$FRONTEND_URL" >> $GITHUB_OUTPUT
--- a/7project/backend/Dockerfile
+++ b/7project/backend/Dockerfile
@@ -5,4 +5,4 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY . .
 EXPOSE 8000
-CMD alembic upgrade head && uvicorn app.app:app --host 0.0.0.0 --port 8000
+CMD alembic upgrade head && uvicorn app.app:fastApi --host 0.0.0.0 --port 8000
--- a/7project/backend/alembic/versions/2025_10_10_1405-7af8f296d089_add_user_oauth.py
+++ b/7project/backend/alembic/versions/2025_10_10_1405-7af8f296d089_add_user_oauth.py
@@ -0,0 +1,48 @@
+"""add user oauth
+
+Revision ID: 7af8f296d089
+Revises: 390041bd839e
+Create Date: 2025-10-10 14:05:00.153376
+
+"""
+from typing import Sequence, Union
+
+import fastapi_users_db_sqlalchemy
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '7af8f296d089'
+down_revision: Union[str, Sequence[str], None] = '390041bd839e'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('oauth_account',
+    sa.Column('id', fastapi_users_db_sqlalchemy.generics.GUID(), nullable=False),
+    sa.Column('user_id', fastapi_users_db_sqlalchemy.generics.GUID(), nullable=False),
+    sa.Column('oauth_name', sa.String(length=100), nullable=False),
+    sa.Column('access_token', sa.String(length=1024), nullable=False),
+    sa.Column('expires_at', sa.Integer(), nullable=True),
+    sa.Column('refresh_token', sa.String(length=1024), nullable=True),
+    sa.Column('account_id', sa.String(length=320), nullable=False),
+    sa.Column('account_email', sa.String(length=320), nullable=False),
+    sa.ForeignKeyConstraint(['user_id'], ['user.id'], ondelete='cascade'),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index(op.f('ix_oauth_account_account_id'), 'oauth_account', ['account_id'], unique=False)
+    op.create_index(op.f('ix_oauth_account_oauth_name'), 'oauth_account', ['oauth_name'], unique=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_index(op.f('ix_oauth_account_oauth_name'), table_name='oauth_account')
+    op.drop_index(op.f('ix_oauth_account_account_id'), table_name='oauth_account')
+    op.drop_table('oauth_account')
+    # ### end Alembic commands ###
--- a/7project/backend/alembic/versions/2025_10_11_2107-5ab2e654c96e_change_token_lenght.py
+++ b/7project/backend/alembic/versions/2025_10_11_2107-5ab2e654c96e_change_token_lenght.py
@@ -0,0 +1,38 @@
+"""change token length
+
+Revision ID: 5ab2e654c96e
+Revises: 7af8f296d089
+Create Date: 2025-10-11 21:07:41.930470
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import mysql
+
+# revision identifiers, used by Alembic.
+revision: str = '5ab2e654c96e'
+down_revision: Union[str, Sequence[str], None] = '7af8f296d089'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('oauth_account', 'access_token',
+               existing_type=mysql.VARCHAR(length=1024),
+               type_=sa.String(length=4096),
+               existing_nullable=False)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('oauth_account', 'access_token',
+               existing_type=sa.String(length=4096),
+               type_=mysql.VARCHAR(length=1024),
+               existing_nullable=False)
+    # ### end Alembic commands ###
--- a/7project/backend/app/api/categories.py
+++ b/7project/backend/app/api/categories.py
@@ -13,7 +13,7 @@ from app.models.user import User
 router = APIRouter(prefix="/categories", tags=["categories"])


-@router.post("/", response_model=CategoryRead, status_code=status.HTTP_201_CREATED)
+@router.post("/create", response_model=CategoryRead, status_code=status.HTTP_201_CREATED)
 async def create_category(
    payload: CategoryCreate,
    session: AsyncSession = Depends(get_async_session),
--- a/7project/backend/app/api/transactions.py
+++ b/7project/backend/app/api/transactions.py
@@ -27,7 +27,7 @@ def _to_read_model(tx: Transaction) -> TransactionRead:
    )


-@router.post("/", response_model=TransactionRead, status_code=status.HTTP_201_CREATED)
+@router.post("/create", response_model=TransactionRead, status_code=status.HTTP_201_CREATED)
 async def create_transaction(
    payload: TransactionCreate,
    session: AsyncSession = Depends(get_async_session),
@@ -44,7 +44,10 @@ async def create_transaction(
        )
        categories = list(res.scalars())
        if len(categories) != len(set(payload.category_ids)):
-            raise HTTPException(status_code=400, detail="One or more categories not found")
+            raise HTTPException(
+                status_code=400,
+                detail="Duplicate category IDs provided or one or more categories not found"
+            )
        tx.categories = categories

    session.add(tx)
@@ -88,7 +91,7 @@ async def get_transaction(
    return _to_read_model(tx)


-@router.patch("/{transaction_id}", response_model=TransactionRead)
+@router.patch("/{transaction_id}/edit", response_model=TransactionRead)
 async def update_transaction(
    transaction_id: int,
    payload: TransactionUpdate,
@@ -113,13 +116,16 @@ async def update_transaction(
        # Preload categories to avoid async lazy-load during assignment
        await session.refresh(tx, attribute_names=["categories"])
        if payload.category_ids:
+            # Check for duplicate category IDs in the payload
+            if len(payload.category_ids) != len(set(payload.category_ids)):
+                raise HTTPException(status_code=400, detail="Duplicate category IDs in payload")
            res = await session.execute(
                select(Category).where(
                    Category.user_id == user.id, Category.id.in_(payload.category_ids)
                )
            )
            categories = list(res.scalars())
-            if len(categories) != len(set(payload.category_ids)):
+            if len(categories) != len(payload.category_ids):
                raise HTTPException(status_code=400, detail="One or more categories not found")
            tx.categories = categories
        else:
@@ -130,7 +136,7 @@ async def update_transaction(
    return _to_read_model(tx)


-@router.delete("/{transaction_id}", status_code=status.HTTP_204_NO_CONTENT)
+@router.delete("/{transaction_id}/delete", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_transaction(
    transaction_id: int,
    session: AsyncSession = Depends(get_async_session),
--- a/7project/backend/app/app.py
+++ b/7project/backend/app/app.py
@@ -7,11 +7,12 @@ from app.services.user_service import current_active_verified_user
 from app.api.auth import router as auth_router
 from app.api.categories import router as categories_router
 from app.api.transactions import router as transactions_router
+from app.services.user_service import auth_backend, current_active_verified_user, fastapi_users, get_oauth_provider

-app = FastAPI()
+fastApi = FastAPI()

 # CORS for frontend dev server
-app.add_middleware(
+fastApi.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "http://localhost:5173",
@@ -22,17 +23,39 @@ app.add_middleware(
    allow_headers=["*"],
 )

-app.include_router(auth_router)
-app.include_router(categories_router)
-app.include_router(transactions_router)
+fastApi.include_router(auth_router)
+fastApi.include_router(categories_router)
+fastApi.include_router(transactions_router)
+
+fastApi.include_router(
+    fastapi_users.get_oauth_router(
+        get_oauth_provider("MojeID"),
+        auth_backend,
+        "SECRET",
+        associate_by_email=True,
+    ),
+    prefix="/auth/mojeid",
+    tags=["auth"],
+)
+
+fastApi.include_router(
+    fastapi_users.get_oauth_router(
+        get_oauth_provider("BankID"),
+        auth_backend,
+        "SECRET",
+        associate_by_email=True,
+    ),
+    prefix="/auth/bankid",
+    tags=["auth"],
+)


 # Liveness/root endpoint
-@app.get("/", include_in_schema=False)
+@fastApi.get("/", include_in_schema=False)
 async def root():
    return {"status": "ok"}


-@app.get("/authenticated-route")
+@fastApi.get("/authenticated-route")
 async def authenticated_route(user: User = Depends(current_active_verified_user)):
    return {"message": f"Hello {user.email}!"}
--- a/7project/backend/app/models/user.py
+++ b/7project/backend/app/models/user.py
@@ -1,13 +1,19 @@
 from sqlalchemy import Column, String
-from sqlalchemy.orm import relationship
-from fastapi_users.db import SQLAlchemyBaseUserTableUUID
+from sqlalchemy.orm import relationship, mapped_column, Mapped
+from fastapi_users.db import SQLAlchemyBaseUserTableUUID, SQLAlchemyBaseOAuthAccountTableUUID
 from app.core.base import Base


+class OAuthAccount(SQLAlchemyBaseOAuthAccountTableUUID, Base):
+    # BankID token is longer than default
+    access_token: Mapped[str] = mapped_column(String(length=4096), nullable=False)
+
+
 class User(SQLAlchemyBaseUserTableUUID, Base):
    first_name = Column(String(length=100), nullable=True)
    last_name = Column(String(length=100), nullable=True)
+    oauth_accounts = relationship("OAuthAccount", lazy="joined")

    # Relationship
    transactions = relationship("Transaction", back_populates="user")
-    categories = relationship("Category", back_populates="user")
+    categories = relationship("Category", back_populates="user")
--- a/7project/backend/app/oauth/init.py
+++ b/7project/backend/app/oauth/init.py
--- a/7project/backend/app/oauth/bank_id.py
+++ b/7project/backend/app/oauth/bank_id.py
@@ -0,0 +1,50 @@
+import secrets
+from typing import Optional, Literal
+
+from httpx_oauth.oauth2 import T
+
+from app.oauth.custom_openid import CustomOpenID
+
+
+class BankID(CustomOpenID):
+    def __init__(self, client_id: str, client_secret: str):
+        super().__init__(
+            client_id,
+            client_secret,
+            "https://oidc.sandbox.bankid.cz/.well-known/openid-configuration",
+            "BankID",
+            base_scopes=["openid", "profile.email", "profile.name"],
+        )
+
+    async def get_user_info(self, token: str) -> dict:
+        info = await self.get_profile(token)
+
+        return {
+            "first_name": info.get("given_name"),
+            "last_name": info.get("family_name"),
+        }
+
+    async def get_authorization_url(
+            self,
+            redirect_uri: str,
+            state: Optional[str] = None,
+            scope: Optional[list[str]] = None,
+            code_challenge: Optional[str] = None,
+            code_challenge_method: Optional[Literal["plain", "S256"]] = None,
+            extras_params: Optional[T] = None,
+    ) -> str:
+        if extras_params is None:
+            extras_params = {}
+
+        # BankID requires random nonce parameter for security
+        # https://developer.bankid.cz/docs/security_sep
+        extras_params["nonce"] = secrets.token_urlsafe()
+
+        return await super().get_authorization_url(
+            redirect_uri,
+            state,
+            scope,
+            code_challenge,
+            code_challenge_method,
+            extras_params,
+        )
--- a/7project/backend/app/oauth/custom_openid.py
+++ b/7project/backend/app/oauth/custom_openid.py
@@ -0,0 +1,6 @@
+from httpx_oauth.clients.openid import OpenID
+
+
+class CustomOpenID(OpenID):
+    async def get_user_info(self, token: str) -> dict:
+        raise NotImplementedError()
--- a/7project/backend/app/oauth/moje_id.py
+++ b/7project/backend/app/oauth/moje_id.py
@@ -0,0 +1,56 @@
+import json
+from typing import Optional, Literal, Any
+
+from httpx_oauth.oauth2 import T
+
+from app.oauth.custom_openid import CustomOpenID
+
+
+class MojeIDOAuth(CustomOpenID):
+    def __init__(self, client_id: str, client_secret: str):
+        super().__init__(
+            client_id,
+            client_secret,
+            "https://mojeid.regtest.nic.cz/.well-known/openid-configuration/",
+            "MojeID",
+            base_scopes=["openid", "email", "profile"],
+        )
+
+    async def get_user_info(self, token: str) -> Optional[Any]:
+        info = await self.get_profile(token)
+
+        return {
+            "first_name": info.get("given_name"),
+            "last_name": info.get("family_name"),
+        }
+
+    async def get_authorization_url(
+            self,
+            redirect_uri: str,
+            state: Optional[str] = None,
+            scope: Optional[list[str]] = None,
+            code_challenge: Optional[str] = None,
+            code_challenge_method: Optional[Literal["plain", "S256"]] = None,
+            extras_params: Optional[T] = None,
+    ) -> str:
+        required_fields = {
+            'id_token': {
+                'name': {'essential': True},
+                'given_name': {'essential': True},
+                'family_name': {'essential': True},
+                'email': {'essential': True},
+                'mojeid_valid': {'essential': True},
+            }}
+
+        if extras_params is None:
+            extras_params = {}
+        extras_params["claims"] = json.dumps(required_fields)
+
+        return await super().get_authorization_url(
+            redirect_uri,
+            state,
+            scope,
+            code_challenge,
+            code_challenge_method,
+            extras_params,
+        )
--- a/7project/backend/app/schemas/category.py
+++ b/7project/backend/app/schemas/category.py
@@ -1,23 +1,16 @@
 from typing import Optional
-from pydantic import BaseModel
-try:
-    # Pydantic v2
-    from pydantic import ConfigDict  # type: ignore
-    _HAS_V2 = True
-except Exception:  # pragma: no cover
-    _HAS_V2 = False
+from pydantic import BaseModel, ConfigDict
+

 class CategoryBase(BaseModel):
    name: str
    description: Optional[str] = None

+
 class CategoryCreate(CategoryBase):
    pass

+
 class CategoryRead(CategoryBase):
    id: int
-    if _HAS_V2:
-        model_config = ConfigDict(from_attributes=True)  # type: ignore
-    else:  # Pydantic v1 fallback
-        class Config:  # type: ignore
-            orm_mode = True
+    model_config = ConfigDict(from_attributes=True)
--- a/7project/backend/app/schemas/transaction.py
+++ b/7project/backend/app/schemas/transaction.py
@@ -1,5 +1,6 @@
 from typing import List, Optional
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, ConfigDict
+

 class TransactionBase(BaseModel):
    amount: float = Field(..., gt=-1e18, lt=1e18)
@@ -17,5 +18,4 @@ class TransactionRead(TransactionBase):
    id: int
    category_ids: List[int] = []

-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
--- a/7project/backend/app/services/db.py
+++ b/7project/backend/app/services/db.py
@@ -4,11 +4,13 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from fastapi_users.db import SQLAlchemyUserDatabase

 from ..core.db import async_session_maker
-from ..models.user import User
+from ..models.user import User, OAuthAccount
+

 async def get_async_session() -> AsyncGenerator[AsyncSession, None]:
    async with async_session_maker() as session:
        yield session

+
 async def get_user_db(session: AsyncSession = Depends(get_async_session)):
-    yield SQLAlchemyUserDatabase(session, User)
+    yield SQLAlchemyUserDatabase(session, User, OAuthAccount)
--- a/7project/backend/app/services/user_service.py
+++ b/7project/backend/app/services/user_service.py
@@ -3,26 +3,66 @@ import uuid
 from typing import Optional

 from fastapi import Depends, Request
-from fastapi_users import BaseUserManager, FastAPIUsers, UUIDIDMixin
+from fastapi_users import BaseUserManager, FastAPIUsers, UUIDIDMixin, models
 from fastapi_users.authentication import (
    AuthenticationBackend,
    BearerTransport,
 )
 from fastapi_users.authentication.strategy.jwt import JWTStrategy
 from fastapi_users.db import SQLAlchemyUserDatabase
+from httpx_oauth.oauth2 import BaseOAuth2

 from app.models.user import User
+from app.oauth.bank_id import BankID
+from app.oauth.custom_openid import CustomOpenID
+from app.oauth.moje_id import MojeIDOAuth
 from app.services.db import get_user_db
 from app.core.queue import enqueue_email

 SECRET = os.getenv("SECRET", "CHANGE_ME_SECRET")
+
 FRONTEND_URL = os.getenv("FRONTEND_URL", "http://localhost:5173")
 BACKEND_URL = os.getenv("BACKEND_URL", "http://localhost:8000")

+providers = {
+    "MojeID": MojeIDOAuth(
+        os.getenv("MOJEID_CLIENT_ID", "CHANGE_ME_CLIENT_ID"),
+        os.getenv("MOJEID_CLIENT_SECRET", "CHANGE_ME_CLIENT_SECRET"),
+    ),
+    "BankID": BankID(
+        os.getenv("BANKID_CLIENT_ID", "CHANGE_ME_CLIENT_ID"),
+        os.getenv("BANKID_CLIENT_SECRET", "CHANGE_ME_CLIENT_SECRET"),
+    )
+}
+
+
+def get_oauth_provider(name: str) -> Optional[BaseOAuth2]:
+    if name not in providers:
+        return None
+    return providers[name]
+
+
 class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
    reset_password_token_secret = SECRET
    verification_token_secret = SECRET

+    async def oauth_callback(self: "BaseUserManager[models.UOAP, models.ID]", oauth_name: str, access_token: str,
+                             account_id: str, account_email: str, expires_at: Optional[int] = None,
+                             refresh_token: Optional[str] = None, request: Optional[Request] = None, *,
+                             associate_by_email: bool = False, is_verified_by_default: bool = False) -> models.UOAP:
+
+        user = await super().oauth_callback(oauth_name, access_token, account_id, account_email, expires_at,
+                                            refresh_token, request, associate_by_email=associate_by_email,
+                                            is_verified_by_default=is_verified_by_default)
+
+        # set additional user info from the OAuth provider
+        provider = get_oauth_provider(oauth_name)
+        if provider is not None and isinstance(provider, CustomOpenID):
+            update_dict = await provider.get_user_info(access_token)
+            await self.user_db.update(user, update_dict)
+
+        return user
+
    async def on_after_register(self, user: User, request: Optional[Request] = None):
        await self.request_verify(user, request)

@@ -52,14 +92,18 @@ class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
            print("[Email Fallback] Subject:", subject)
            print("[Email Fallback] Body:\n", body)

+
 async def get_user_manager(user_db: SQLAlchemyUserDatabase = Depends(get_user_db)):
    yield UserManager(user_db)

+
 bearer_transport = BearerTransport(tokenUrl="auth/jwt/login")

+
 def get_jwt_strategy() -> JWTStrategy:
    return JWTStrategy(secret=SECRET, lifetime_seconds=3600)

+
 auth_backend = AuthenticationBackend(
    name="jwt",
    transport=bearer_transport,
@@ -70,4 +114,3 @@ fastapi_users = FastAPIUsers[User, uuid.UUID](get_user_manager, [auth_backend])

 current_active_user = fastapi_users.current_user(active=True)
 current_active_verified_user = fastapi_users.current_user(active=True, verified=True)
-
--- a/7project/backend/requirements.txt
+++ b/7project/backend/requirements.txt
@@ -11,6 +11,7 @@ asyncmy==0.2.9
 bcrypt==4.3.0
 billiard==4.2.2
 celery==5.5.3
+certifi==2025.10.5
 cffi==2.0.0
 click==8.1.8
 click-didyoumean==0.3.1
@@ -25,7 +26,10 @@ fastapi-users==14.0.1
 fastapi-users-db-sqlalchemy==7.0.0
 greenlet==3.2.4
 h11==0.16.0
+httpcore==1.0.9
 httptools==0.6.4
+httpx==0.28.1
+httpx-oauth==0.16.1
 idna==3.10
 kombu==5.5.4
 makefun==1.16.0
--- a/7project/charts/myapp-chart/templates/NOTES.txt
+++ b/7project/charts/myapp-chart/templates/NOTES.txt
@@ -1,54 +0,0 @@
-Thank you for installing myapp-chart.
-
-This chart packages all Kubernetes manifests from the original deployment directory and parameterizes environment, database name (with optional PR suffix), image, and domain for external access.
-
-Namespaces per developer (important):
- Install each developer's environment into their own namespace using Helm's -n/--namespace flag.
- No hardcoded namespace is used in templates; resources are created in .Release.Namespace.
- Example namespaces: dev-alice, dev-bob, pr-123, etc.
-
-Key values:
- deployment -> used as Database CR name and DB username (MARIADB_DB and MARIADB_USER)
- image.repository/tag or image.digest -> container image
- domain -> public FQDN used by TunnelBinding (required to expose app)
- app/worker names, replicas, ports
-
-Examples:
- Dev install (Alice):
-  helm upgrade --install myapp ./7project/charts/myapp-chart \
-    -n dev-alice --create-namespace \
-    -f values-dev.yaml \
-    --set domain=alice.demo.example.com \
-    --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
-    --set-string database.password="$DB_PASSWORD"
-
- Dev install (Bob):
-  helm upgrade --install myapp ./7project/charts/myapp-chart \
-    -n dev-bob --create-namespace \
-    -f values-dev.yaml \
-    --set domain=bob.demo.example.com
-
- Prod install (different cleanupPolicy):
-  helm upgrade --install myapp ./7project/charts/myapp-chart \
-    -n prod --create-namespace \
-    -f values-prod.yaml \
-    --set domain=app.example.com
-
- PR (preview) install with DB name containing PR number (also its own namespace):
-  PR=123
-  helm upgrade --install myapp-pr-$PR ./7project/charts/myapp-chart \
-    -n pr-$PR --create-namespace \
-    -f values-dev.yaml \
-    --set prNumber=$PR \
-    --set deployment=preview-$PR \
-    --set domain=pr-$PR.example.com
-
- Use a custom deployment identifier to suffix DB name, DB username and Secret name:
-  helm upgrade --install myapp ./7project/charts/myapp-chart \
-    -n dev-alice --create-namespace \
-    -f values-dev.yaml \
-    --set deployment=alice \
-    --set domain=alice.demo.example.com
-
-Render locally (dry run):
-  helm template ./7project/charts/myapp-chart -f values-dev.yaml --set prNumber=456 --set deployment=test --set domain=demo.example.com --namespace dev-test | sed -n '/kind: Database/,$p' | head -n 30
--- a/7project/charts/myapp-chart/templates/app-deployment.yaml
+++ b/7project/charts/myapp-chart/templates/app-deployment.yaml
@@ -52,6 +52,22 @@ spec:
              value: {{ .Values.rabbitmq.vhost | default "/" | quote }}
            - name: MAIL_QUEUE
              value: {{ .Values.worker.mailQueueName | default "mail_queue" | quote }}
+            - name: MOJEID_CLIENT_ID
+              value: {{ .Values.oauth.mojeid.clientId | quote }}
+            - name: MOJEID_CLIENT_SECRET
+              value: {{ .Values.oauth.mojeid.clientSecret | quote }}
+            - name: BANKID_CLIENT_ID
+              value: {{ .Values.oauth.bankid.clientId | quote }}
+            - name: BANKID_CLIENT_SECRET
+              value: {{ .Values.oauth.bankid.clientSecret | quote }}
+            - name: DOMAIN
+              value: {{ required "Set .Values.domain" .Values.domain | quote }}
+            - name: DOMAIN_SCHEME
+              value: {{ required "Set .Values.domain_scheme" .Values.domain_scheme | quote }}
+            - name: FRONTEND_DOMAIN
+              value: {{ required "Set .Values.frontend_domain" .Values.frontend_domain | quote }}
+            - name: FRONTEND_DOMAIN_SCHEME
+              value: {{ required "Set .Values.frontend_domain_scheme" .Values.frontend_domain_scheme | quote }}
          livenessProbe:
            httpGet:
              path: /
--- a/7project/charts/myapp-chart/values.yaml
+++ b/7project/charts/myapp-chart/values.yaml
@@ -11,6 +11,10 @@ deployment: ""
 # Public domain to expose the app under (used by TunnelBinding fqdn)
 # Set at install time: --set domain=example.com
 domain: ""
+domain_scheme: ""
+
+frontend_domain: ""
+frontend_domain_scheme: ""

 image:
  repository: lukastrkan/cc-app-demo
@@ -33,6 +37,14 @@ worker:
 service:
  port: 80

+oauth:
+  bankid:
+    clientId: ""
+    clientSecret: ""
+  mojeid:
+    clientId: ""
+    clientSecret: ""
+
 rabbitmq:
  create: true
  replicas: 1
--- a/7project/meetings/2025-10-16-meeting.md
+++ b/7project/meetings/2025-10-16-meeting.md
@@ -0,0 +1,53 @@
+# Weekly Meeting Notes
+
+- Group 8 - Personal finance tracker
+- Mentor: Jaychander
+
+Keep all meeting notes in the `meetings.md` file in your project folder.
+Just copy the template below for each weekly meeting and fill in the details.
+
+## Administrative Info
+
+- Date: 2025-10-08
+- Attendees: Dejan Ribarovski, Lukas Trkan
+- Notetaker: Dejan Ribarovski
+
+## Progress Update (Before Meeting)
+
+Summary of what has been accomplished since the last meeting in the following categories.
+
+## Action Items from Last Week (During Meeting)
+
+- [x] start coding the app logic
+- [x] start writing the report so it matches the actual progress
+- [x] redo the system diagram so it includes a response flow
+
+### Coding
+Implemented initial functioning version of the app, added OAuth with BankId and MojeID,
+added database snapshots.
+
+### Documentation
+report.md is up to date
+
+## Questions and Topics for Discussion (Before Meeting)
+
+Prepare 3-5 questions and topics you want to discuss with your mentor.
+
+1. What other functionality should be added to the app
+2. Priority for the next week (Testing maybe?)
+3. Question 3
+
+## Discussion Notes (During Meeting)
+
+## Action Items for Next Week (During Meeting)
+
+Last 3 minutes of the meeting, summarize action items.
+
+- [ ] OAuth
+- [ ] CI/CD fix
+- [ ] Database local (multiple bank accounts)
+- [ ] Add tests and set up github pipeline
+- [ ] Frontend imporvment - user experience
+- [ ] make the report more clear
+
+---
--- a/7project/meetings/2025-10-9-meeting.md
+++ b/7project/meetings/2025-10-9-meeting.md
--- a/7project/report.md
+++ b/7project/report.md
@@ -1,4 +1,4 @@
-# Project Report
+# Personal finance tracker

 > **Instructions**:
 > This template provides the structure for your project report.
@@ -7,126 +7,211 @@

 ## Project Overview

-**Project Name**: [Your project name]
+**Project Name**: Personal Finance Tracker

 **Group Members**:

- Student number, Name, GitHub username
- Student number, Name, GitHub username
- Student number, Name, GitHub username
+- 289229, Lukáš Trkan, lukastrkan
+- 289258, Dejan Ribarovski, derib2613, ribardej

 **Brief Description**:
-[2-3 sentences describing what your application does and its main purpose]
+Our application is a finance tracker, so a person can easily track his cash flow
+through multiple bank accounts. Person can label transactions with custom categories
+and later filter by them.

 ## Architecture Overview
+Our system is a full‑stack web application composed of a React frontend, a FastAPI backend, a PostgreSQL database, and asynchronous background workers powered by Celery with RabbitMQ. Redis is available for caching/kv and may be used by Celery as a result backend. The backend exposes REST endpoints for authentication (email/password and OAuth), users, categories, and transactions. A thin controller layer (FastAPI routers) lives under app/api. Infrastructure for Kubernetes is provided via OpenTofu (Terraform‑compatible) modules and the application is packaged via a Helm chart.

 ### High-Level Architecture

-[Describe the overall system architecture. Consider including a diagram using mermaid or linking to an image]
-
 ```mermaid
-graph TD
-    A[Component A] --> B[Component B]
-    B --> C[Component C]
+flowchart LR
+    proc_queue[Message Queue] --> proc_queue_worker[Worker Service]
+    proc_queue_worker --> ext_mail[(Email Service)]
+    proc_cron[Task planner] --> proc_queue
+    proc_queue_worker --> ext_bank[(Bank API)]
+    proc_queue_worker --> db
+    client[Client/Frontend] <--> svc[Backend API]
+    svc --> proc_queue
+    svc <--> db[(Database)]
+    svc <--> cache[(Cache)]
 ```

 ### Components

- **Component 1**: [Description of what this component does]
- **Component 2**: [Description of what this component does]
- **Component 3**: [Description of what this component does]
+- Frontend (frontend/): React + TypeScript app built with Vite. Talks to the backend via REST, handles login/registration, shows latest transactions, filtering, and allows adding transactions.
+- Backend API (backend/app): FastAPI app with routers under app/api for auth, categories, and transactions. Uses FastAPI Users for auth (JWT + OAuth), SQLAlchemy ORM, and Pydantic v2 schemas.
+- Worker service (backend/app/workers): Celery worker handling asynchronous tasks (e.g., sending verification emails, future background processing).
+- Database (PostgreSQL): Persists users, categories, transactions; schema managed by Alembic migrations.
+- Message Queue (RabbitMQ): Transports background jobs from the API to the worker.
+- Cache/Result Store (Redis): Available for caching or Celery result backend.
+- Infrastructure as Code (tofu/): OpenTofu modules provisioning cluster services (RabbitMQ, Redis, Argo CD, cert-manager, Cloudflare tunnel, etc.).
+- Deployment Chart (charts/myapp-chart/): Helm chart to deploy the application to Kubernetes.

 ### Technologies Used

- **Backend**: [e.g., Go, Node.js, Python]
- **Database**: [e.g., PostgreSQL, MongoDB, Redis]
- **Cloud Services**: [e.g., AWS EC2, Google Cloud Run, Azure Functions]
- **Container Orchestration**: [e.g., Docker, Kubernetes]
- **Other**: [List other significant technologies]
+- Backend: Python, FastAPI, FastAPI Users, SQLAlchemy, Pydantic, Alembic, Celery
+- Frontend: React, TypeScript, Vite
+- Database: PostgreSQL
+- Messaging: RabbitMQ 
+- Cache: Redis
+- Containerization/Orchestration: Docker, Docker Compose (dev), Kubernetes, Helm
+- IaC/Platform: OpenTofu (Terraform), Argo CD, cert-manager, MetalLB, Cloudflare Tunnel, Prometheus

 ## Prerequisites

 ### System Requirements

- Operating System: [e.g., Linux, macOS, Windows]
- Minimum RAM: [e.g., 8GB]
- Storage: [e.g., 10GB free space]
+- Operating System: Linux, macOS, or Windows
+- Minimum RAM: 4 GB (8 GB recommended for running backend, frontend, and database together)
+- Storage: 2 GB free (Docker images may require additional space)

 ### Required Software

- [Software 1] (version X.X or higher)
- [Software 2] (version X.X or higher)
- [etc.]
+- Docker Desktop or Docker Engine 24+
+- Docker Compose v2+
+- Node.js 20+ and npm 10+ (for local frontend dev/build)
+- Python 3.12+ (for local backend dev outside Docker)
+- PostgreSQL 15+ (optional if running DB outside Docker)
+- Helm 3.12+ and kubectl 1.29+ (for Kubernetes deployment)
+- OpenTofu 1.7+ (for infrastructure provisioning)

-### Dependencies
+### Environment Variables (common)

-```bash
-# List key dependencies that need to be installed
-# For example:
-# Docker Engine 20.10+
-# Node.js 18+
-# Go 1.25+
-```
+- Backend: SECRET, FRONTEND_URL, BACKEND_URL, DATABASE_URL, RABBITMQ_URL, REDIS_URL 
+- OAuth vars (Backend): MOJEID_CLIENT_ID/SECRET, BANKID_CLIENT_ID/SECRET (optional)
+- Frontend: VITE_BACKEND_URL
+
+### Dependencies (key libraries)
+I am not sure what is meant by "key libraries"
+
+Backend: FastAPI, fastapi-users, SQLAlchemy, pydantic v2, Alembic, Celery  
+Frontend: React, TypeScript, Vite  
+Services: PostgreSQL, RabbitMQ, Redis

 ## Build Instructions

-### 1. Clone the Repository
+You can run the project with Docker Compose (recommended for local development) or run services manually.
+
+### 1) Clone the Repository

 ```bash
-git clone [your-repository-url]
-cd [repository-name]
+git clone https://github.com/dat515-2025/Group-8.git
+cd 7project
 ```

-### 2. Install Dependencies
-
+### 2) Install dependencies
+Backend
 ```bash
-# Provide step-by-step commands
-# For example:
-# npm install
-# go mod download
+# In 7project/backend
+python3.12 -m venv .venv
+source .venv/bin/activate  # Windows: .venv\Scripts\activate
+pip install -r requirements.txt
 ```
-
-### 3. Build the Application
-
+Frontend
 ```bash
-# Provide exact build commands
-# For example:
-# make build
-# docker build -t myapp .
+# In 7project/frontend
+npm install
 ```

-### 4. Configuration
+### 3) Manual Local Run

+Backend
 ```bash
-# Any configuration steps needed
-# Environment variables to set
-# Configuration files to create
+# From the 7project/ directory
+docker compose up --build
+# This starts: PostgreSQL, RabbitMQ/Redis (if defined)
+
+# Set environment variables (or create .env file)
+export SECRET=CHANGE_ME_SECRET
+export BACKEND_URL=http://127.0.0.1:8000
+export FRONTEND_URL=http://localhost:5173
+export DATABASE_URL=postgresql+asyncpg://user:password@127.0.0.1:5432/app
+export RABBITMQ_URL=amqp://guest:guest@127.0.0.1:5672/
+export REDIS_URL=redis://127.0.0.1:6379/0
+
+# Apply DB migrations (Alembic)
+# From 7project/backend
+alembic upgrade head
+
+# Run API
+uvicorn app.app:fastApi --reload --host 0.0.0.0 --port 8000
+
+# Run Celery worker (optional, for emails/background tasks)
+celery -A app.celery_app.celery_app worker -l info
 ```

+Frontend
+```bash
+# Configure backend URL for dev
+echo 'VITE_BACKEND_URL=http://127.0.0.1:8000' > .env
+npm run dev
+# Open http://localhost:5173
+```
+
+- Backend default: http://127.0.0.1:8000 (OpenAPI at /docs)
+- Frontend default: http://localhost:5173
+
+If needed, adjust compose services/ports in compose.yml.
+
+
 ## Deployment Instructions

-### Local Deployment
+### Local (Docker Compose)

+Described in the previous section (Manual Local Run)
+
+### Kubernetes (via OpenTofu + Helm)
+
+1) Provision platform services (RabbitMQ/Redis/ingress/tunnel/etc.) with OpenTofu
 ```bash
-# Step-by-step commands for local deployment
-# For example:
-# docker-compose up -d
-# kubectl apply -f manifests/
+cd tofu
+# copy and edit variables
+cp terraform.tfvars.example terraform.tfvars
+# authenticate to your cluster/cloud as needed, then:
+tofu init
+tofu plan
+tofu apply
 ```

-### Cloud Deployment
-
+2) Deploy the app using Helm
 ```bash
-# Commands for cloud deployment
-# Include any cloud-specific setup
+# Set the namespace
+kubectl create namespace myapp || true
+
+# Install/upgrade the chart with required values
+helm upgrade --install myapp charts/myapp-chart \
+  -n myapp \
+  -f charts/myapp-chart/values.yaml \
+  --set image.backend.repository=myorg/myapp-backend \
+  --set image.backend.tag=latest \
+  --set env.BACKEND_URL="https://myapp.example.com" \
+  --set env.FRONTEND_URL="https://myapp.example.com" \
+  --set env.SECRET="CHANGE_ME_SECRET"
+```
+Adjust values to your registry and domain. The chart’s NOTES.txt includes additional examples.
+
+3) Expose and access
+- If using Cloudflare Tunnel or an ingress, configure DNS accordingly (see tofu/modules/cloudflare and deployment/tunnel.yaml).
+- For quick testing without ingress:
+```bash
+kubectl -n myapp port-forward deploy/myapp-backend 8000:8000
+kubectl -n myapp port-forward deploy/myapp-frontend 5173:80
 ```

 ### Verification

 ```bash
-# Commands to verify deployment worked
-# How to check if services are running
-# Example health check endpoints
+# Check pods
+kubectl -n myapp get pods
+
+# Backend health
+curl -i http://127.0.0.1:8000/
+# OpenAPI
+open http://127.0.0.1:8000/docs
+
+# Frontend (if port-forwarded)
+open http://localhost:5173
 ```

 ## Testing Instructions
@@ -156,19 +241,38 @@ cd [repository-name]

 ## Usage Examples

-### Basic Usage
+All endpoints are documented at OpenAPI: http://127.0.0.1:8000/docs
+
+### Auth: Register and Login (JWT)

 ```bash
-# Examples of how to use the application
-# Common commands or API calls
-# Sample data or test scenarios
+# Register
+curl -X POST http://127.0.0.1:8000/auth/register \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "email": "user@example.com",
+    "password": "StrongPassw0rd",
+    "first_name": "Jane",
+    "last_name": "Doe"
+  }'
+
+# Login (JWT)
+TOKEN=$(curl -s -X POST http://127.0.0.1:8000/auth/jwt/login \
+  -H 'Content-Type: application/x-www-form-urlencoded' \
+  -d 'username=user@example.com&password=StrongPassw0rd' | jq -r .access_token)
+
+echo $TOKEN
+
+# Call a protected route
+curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/authenticated-route
 ```

-### Advanced Features
+### Frontend

-```bash
-# Examples showcasing advanced functionality
-```
+- Start with: npm run dev in 7project/frontend
+- Ensure VITE_BACKEND_URL is set to the backend URL (e.g., http://127.0.0.1:8000)
+- Open http://localhost:5173
+- Login, view latest transactions, filter, and add new transactions from the UI.

 ---

@@ -215,18 +319,18 @@ cd [repository-name]
 > This information is used for individual grading.
 > Link to the specific commit on GitHub for each contribution.

-| Task/Component                                                      | Assigned To | Status        | Time Spent | Difficulty | Notes       |
-| ------------------------------------------------------------------- | ----------- | ------------- | ---------- | ---------- | ----------- |
-| Project Setup & Repository                                          | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |
-| [Design Document](https://github.com/dat515-2025/group-name)         | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
-| [Backend API Development](https://github.com/dat515-2025/group-name) | [Name]      | ✅ Complete    | [X hours]  | Hard       | [Any notes] |
-| [Database Setup & Models](https://github.com/dat515-2025/group-name) | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |
-| [Frontend Development](https://github.com/dat515-2025/group-name)    | [Name]      | 🔄 In Progress | [X hours]  | Medium     | [Any notes] |
-| [Docker Configuration](https://github.com/dat515-2025/group-name)    | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
-| [Cloud Deployment](https://github.com/dat515-2025/group-name)        | [Name]      | ✅ Complete    | [X hours]  | Hard       | [Any notes] |
-| [Testing Implementation](https://github.com/dat515-2025/group-name)  | [Name]      | ⏳ Pending     | [X hours]  | Medium     | [Any notes] |
-| [Documentation](https://github.com/dat515-2025/group-name)           | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
-| [Presentation Video](https://github.com/dat515-2025/group-name)      | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |
+| Task/Component                                                        | Assigned To | Status        | Time Spent     | Difficulty | Notes       |
+|-----------------------------------------------------------------------|-------------| ------------- |----------------|------------| ----------- |
+| [Project Setup & Repository](https://github.com/dat515-2025/Group-8#) | Lukas       | ✅ Complete    | [X hours]      | Medium     | [Any notes] |
+| [Design Document](https://github.com/dat515-2025/Group-8/blob/main/6design/design.md)          | Both        | ✅ Complete    | 2 Hours        | Easy       | [Any notes] |
+| [Backend API Development](https://github.com/dat515-2025/Group-8/tree/main/7project/backend/app/api)  | Dejan       | ✅ Complete    | 10 hours       | Medium     | [Any notes] |
+| [Database Setup & Models](https://github.com/dat515-2025/Group-8/tree/main/7project/backend/app/models)  | Lukas       | ✅ Complete    | [X hours]      | Medium     | [Any notes] |
+| [Frontend Development](https://github.com/dat515-2025/Group-8/tree/main/7project/frontend)     | Dejan       | 🔄 In Progress | 7 hours so far | Medium     | [Any notes] |
+| [Docker Configuration](https://github.com/dat515-2025/Group-8/blob/main/7project/compose.yml)     | Lukas       | ✅ Complete    | [X hours]      | Easy       | [Any notes] |
+| [Cloud Deployment](https://github.com/dat515-2025/Group-8/blob/main/7project/deployment/app-demo-deployment.yaml)         | Lukas       | ✅ Complete    | [X hours]      | Hard       | [Any notes] |
+| [Testing Implementation](https://github.com/dat515-2025/group-name)   | Dejan       | ❌ Not Started     | [X hours]      | Medium     | [Any notes] |
+| [Documentation](https://github.com/dat515-2025/group-name)            | Both        | ❌ Not Started   | [X hours]      | Easy       | [Any notes] |
+| [Presentation Video](https://github.com/dat515-2025/group-name)       | Both        | ❌ Not Started     | [X hours]      | Medium     | [Any notes] |

 **Legend**: ✅ Complete | 🔄 In Progress | ⏳ Pending | ❌ Not Started

@@ -244,25 +348,16 @@ cd [repository-name]
 | [Date]    | Documentation       | [X.X]      | Updated README and design doc       |
 | **Total** |                     | **[XX.X]** |                                     |

-### [Team Member 2 Name]
+### Dejan

-| Date      | Activity             | Hours      | Description                               |
-| --------- | -------------------- | ---------- | ----------------------------------------- |
-| [Date]    | Frontend Development | [X.X]      | Created user interface mockups            |
-| [Date]    | Integration          | [X.X]      | Connected frontend to backend API         |
-| [Date]    | Deployment           | [X.X]      | Docker configuration and cloud deployment |
-| [Date]    | Testing              | [X.X]      | End-to-end testing                        |
-| **Total** |                      | **[XX.X]** |                                           |
+| Date        | Activity             | Hours  | Description                    |
+|-------------|----------------------|--------|--------------------------------|
+| 25.9.       | Design               | 1.5    | 6design                        |
+| 9-11.10.    | Backend APIs         | 10     | Implemented Backend APIs       |
+| 13-15.10.   | Frontend Development | 6.5    | Created user interface mockups |
+| Continually | Documantation        | 3      | Documenting the dev process    |
+| **Total**   |                      | **21** |                                |

-### [Team Member 3 Name] (if applicable)
-
-| Date      | Activity                 | Hours      | Description                      |
-| --------- | ------------------------ | ---------- | -------------------------------- |
-| [Date]    | Database Design          | [X.X]      | Schema design and implementation |
-| [Date]    | Cloud Configuration      | [X.X]      | AWS/GCP setup and configuration  |
-| [Date]    | Performance Optimization | [X.X]      | Caching and query optimization   |
-| [Date]    | Monitoring               | [X.X]      | Logging and monitoring setup     |
-| **Total** |                          | **[XX.X]** |                                  |

 ### Group Total: [XXX.X] hours

@@ -292,11 +387,8 @@ cd [repository-name]

 [Personal reflection on growth, challenges, and learning]

-#### [Team Member 3 Name] (if applicable)
-
-[Personal reflection on growth, challenges, and learning]

 ---

 **Report Completion Date**: [Date]
-**Last Updated**: [Date]
+**Last Updated**: 15.10.2025
--- a/7project/tofu/main.tf
+++ b/7project/tofu/main.tf
@@ -96,6 +96,13 @@ module "database" {

  phpmyadmin_enabled = var.phpmyadmin_enabled
  cloudflare_domain  = var.cloudflare_domain
+
+  s3_enabled = var.s3_enabled
+  s3_bucket = var.s3_bucket
+  s3_region = var.s3_region
+  s3_endpoint = var.s3_endpoint
+  s3_key_id = var.s3_key_id
+  s3_key_secret = var.s3_key_secret
 }

 #module "argocd" {
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/Chart.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/Chart.yaml
@@ -1,4 +1,4 @@
 apiVersion: v2
 name: maxscale-helm
-version: 1.0.8
+version: 1.0.14
 description: Helm chart for MaxScale related Kubernetes manifests
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/backup.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/backup.yaml
@@ -0,0 +1,42 @@
+{{- if .Values.s3.enabled }}
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Backup
+metadata:
+  name: backup
+  namespace: mariadb-operator
+spec:
+  mariaDbRef:
+    name: mariadb-repl
+    namespace: mariadb-operator
+  schedule:
+    cron: "0 */3 * * *"
+    suspend: false
+  timeZone: "Europe/Prague"
+  maxRetention: 720h # 30 days
+  compression: bzip2
+  storage:
+    s3:
+      bucket: {{ .Values.s3.bucket | quote }}
+      endpoint: {{ .Values.s3.endpoint | quote }}
+      accessKeyIdSecretKeyRef:
+        name: s3-credentials
+        key: key_id
+      secretAccessKeySecretKeyRef:
+        name: s3-credentials
+        key: secret_key
+      region: {{ .Values.s3.region | quote }}
+      tls:
+        enabled: true
+  # Define a PVC to use as staging area for keeping the backups while they are being processed.
+  stagingStorage:
+    persistentVolumeClaim:
+      resources:
+        requests:
+          storage: 10Gi
+      accessModes:
+        - ReadWriteOnce
+  args:
+    - --single-transaction
+    - --all-databases
+  logLevel: info
+{{- end }}
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/garage.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/garage.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.s3.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+  namespace: mariadb-operator
+type: Opaque
+stringData:
+  key_id: "{{ .Values.s3.key_id }}"
+  secret_key: "{{ .Values.s3.key_secret }}"
+{{- end }}
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/values.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/values.yaml
@@ -14,4 +14,12 @@ metallb:
 phpmyadmin:
  enabled: true

+s3:
+  enabled: false
+  endpoint: ""
+  region: ""
+  bucket: ""
+  key_id: ""
+  key_secret: ""
+
 base_domain: example.com
--- a/7project/tofu/modules/maxscale/main.tf
+++ b/7project/tofu/modules/maxscale/main.tf
@@ -59,7 +59,7 @@ resource "helm_release" "mariadb-operator" {
 resource "helm_release" "maxscale_helm" {
  name       = "maxscale-helm"
  chart      = "${path.module}/charts/maxscale-helm"
-  version    = "1.0.8"
+  version    = "1.0.14"
  depends_on = [helm_release.mariadb-operator-crds, kubectl_manifest.secrets]
  timeout    = 3600

@@ -71,6 +71,12 @@ resource "helm_release" "maxscale_helm" {
    { name = "metallb.primary_ip", value = var.primary_ip },
    { name = "metallb.secondary_ip", value = var.secondary_ip },
    { name = "phpmyadmin.enabled", value = tostring(var.phpmyadmin_enabled) },
-    { name = "base_domain", value = var.cloudflare_domain }
+    { name = "base_domain", value = var.cloudflare_domain },
+    { name = "s3.key_id", value = var.s3_key_id },
+    { name = "s3.key_secret", value = var.s3_key_secret },
+    { name = "s3.enabled", value = var.s3_enabled },
+    { name = "s3.endpoint", value = var.s3_endpoint },
+    { name = "s3.region", value = var.s3_region },
+    { name = "s3.bucket", value = var.s3_bucket },
  ]
 }
--- a/7project/tofu/modules/maxscale/variables.tf
+++ b/7project/tofu/modules/maxscale/variables.tf
@@ -52,7 +52,39 @@ variable "mariadb_user_password" {
 }

 variable "cloudflare_domain" {
-  type = string
-  default = "Base cloudflare domain, e.g. example.com"
+  type     = string
+  default  = "Base cloudflare domain, e.g. example.com"
  nullable = false
-}
+}
+
+variable "s3_key_id" {
+  description = "S3 Key ID for backups"
+  type        = string
+  sensitive   = true
+}
+
+variable "s3_key_secret" {
+  description = "S3 Key Secret for backups"
+  type        = string
+  sensitive   = true
+}
+
+variable "s3_enabled" {
+  description = "Enable S3 backups"
+  type        = bool
+}
+
+variable "s3_endpoint" {
+  description = "S3 endpoint for backups"
+  type        = string
+}
+
+variable "s3_region" {
+  description = "S3 region for backups"
+  type        = string
+}
+
+variable "s3_bucket" {
+  description = "S3 bucket name for backups"
+  type        = string
+}
--- a/7project/tofu/variables.tf
+++ b/7project/tofu/variables.tf
@@ -108,3 +108,40 @@ variable "rabbitmq-password" {
  sensitive   = true
  description = "Admin password for RabbitMQ user"
 }
+
+variable "s3_key_id" {
+  description = "S3 Key ID for backups"
+  type        = string
+  sensitive   = true
+  nullable    = false
+}
+
+variable "s3_key_secret" {
+  description = "S3 Key Secret for backups"
+  type        = string
+  sensitive   = true
+  nullable    = false
+}
+
+variable "s3_enabled" {
+  description = "Enable S3 backups"
+  type        = bool
+}
+
+variable "s3_endpoint" {
+  description = "S3 endpoint for backups"
+  type        = string
+}
+
+variable "s3_region" {
+  description = "S3 region for backups"
+  type        = string
+}
+
+variable "s3_bucket" {
+  description = "S3 bucket name for backups"
+  type        = string
+}
+
+
+
Author	SHA1	Message	Date
Lukáš Trkan	8929920072	Potential fix for code scanning alert no. 9: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2025-10-16 18:04:04 +02:00
Lukáš Trkan	cdb6cf5e20	Update .github/workflows/deploy-pr.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-16 18:02:09 +02:00
Lukáš Trkan	5190e9c48e	fix(infrastructure): use correct runner	2025-10-16 18:00:07 +02:00
Lukáš Trkan	815bf7f065	fix(infrastructure): use correct runner	2025-10-16 17:50:39 +02:00
Lukáš Trkan	85a390565a	fix(infrastructure): use correct runner	2025-10-16 17:43:55 +02:00
Lukáš Trkan	20d26b7edc	fix(infrastructure): use correct runner	2025-10-16 17:42:16 +02:00
Lukáš Trkan	579dda50b9	fix(infrastructure): use correct runner	2025-10-16 17:42:02 +02:00
Lukáš Trkan	4f7d30daf6	fix(infrastructure): use correct runner	2025-10-16 17:32:00 +02:00
Lukáš Trkan	49c96187c9	fix(infrastructure): use correct runner	2025-10-16 17:17:41 +02:00
Lukáš Trkan	d1feafd4ef	fix(infrastructure): use correct runner	2025-10-16 17:12:01 +02:00
Lukáš Trkan	efb454ba99	fix(infrastructure): use correct runner	2025-10-16 17:06:06 +02:00
Lukáš Trkan	810f1ccb32	fix(infrastructure): use correct runner	2025-10-16 17:01:38 +02:00
Lukáš Trkan	c4afdf5ad2	fix(infrastructure): use correct runner	2025-10-16 15:10:33 +02:00
Lukáš Trkan	c290a109b6	fix(infrastructure): use variables, not secrets	2025-10-16 15:01:53 +02:00
Lukáš Trkan	7c161f6f37	fix(infrastructure): add env variables to deployment	2025-10-16 14:49:26 +02:00
Lukáš Trkan	c4991ea3c4	fix(infrastructure): add env variables to deployment	2025-10-16 14:47:16 +02:00
Lukáš Trkan	3b6b64d472	update report.md	2025-10-16 13:51:52 +02:00
ribardej	9bc543a5fa	feat(docs): weekly meeting	2025-10-16 13:27:53 +02:00
ribardej	14516a808b	feat(docs): this week meeting.md	2025-10-16 11:15:54 +02:00
ribardej	922ebf46ae	feat(docs): Catch up on report.md	2025-10-15 16:25:28 +02:00
Lukáš Trkan	e200c73b47	fix(backend): use correct variable to register routers Some checks failed Deploy Prod / Build and push image (reusable) (push) Has been cancelled Details Deploy Prod / Frontend - Build and Deploy to Cloudflare Pages (prod) (push) Has been cancelled Details Deploy Prod / Helm upgrade/install (prod) (push) Has been cancelled Details	2025-10-13 17:11:31 +02:00
Dejan Ribarovski	ac10ab381e	Merge pull request #26 from dat515-2025/20-create-a-controller-layer-on-backend-side 20 create a controller layer on backend side	2025-10-13 14:05:05 +02:00
Dejan Ribarovski	879109144c	Merge branch 'main' into 20-create-a-controller-layer-on-backend-side	2025-10-13 14:03:24 +02:00
ribardej	7061e57442	Merge remote-tracking branch 'origin/20-create-a-controller-layer-on-backend-side' into 20-create-a-controller-layer-on-backend-side	2025-10-13 13:57:04 +02:00
ribardej	30068079c6	feat(backend): renamed endpoints for consistency	2025-10-13 13:56:44 +02:00
Dejan Ribarovski	9580bea630	Update 7project/backend/app/api/transactions.py Better error message Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-13 13:52:36 +02:00
Dejan Ribarovski	975f5e5bec	Update 7project/backend/app/api/transactions.py Better error message Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-13 13:52:24 +02:00
ribardej	f1065bc274	feat(backend): update consistent Pydantic v2 use everywhere	2025-10-13 13:50:59 +02:00
Dejan Ribarovski	12152238c6	Merge pull request #23 from dat515-2025/merge/oauth Some checks are pending Deploy Prod / Build and push image (reusable) (push) Waiting to run Details Deploy Prod / Frontend - Build and Deploy to Cloudflare Pages (prod) (push) Waiting to run Details Deploy Prod / Helm upgrade/install (prod) (push) Blocked by required conditions Details feat(auth): add support for OAuth and MojeID	2025-10-13 12:46:17 +02:00
Dejan Ribarovski	21ef5a3961	Merge pull request #25 from dat515-2025/merge/database_backups feat(infrastructure): add backups	2025-10-13 12:41:27 +02:00
Lukáš Trkan	bf213234b1	feat(infrastructure): add backups	2025-10-12 20:14:48 +02:00
Lukáš Trkan	95c8bf1e92	Update 7project/backend/app/app.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-11 22:25:04 +02:00
Lukáš Trkan	b213f22a15	feat(auth): refactor	2025-10-11 22:22:36 +02:00
Lukáš Trkan	0cf06b7bd9	feat(auth): add CustomOpenID class to force get_user_info implementation	2025-10-11 21:37:49 +02:00
Lukáš Trkan	7a67b12533	Update 7project/backend/alembic/versions/2025_10_11_2107-5ab2e654c96e_change_token_lenght.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-10-11 21:32:03 +02:00
Lukáš Trkan	a91aea805f	feat(auth): add BankID OAuth provider	2025-10-11 21:16:53 +02:00
Lukáš Trkan	32764ab1b0	feat(auth): allow updating custom fields from oauth, update MojeID	2025-10-11 20:34:36 +02:00
Lukáš Trkan	df0f2584ae	feat(auth): add support for OAuth and MojeID	2025-10-10 15:58:40 +02:00
Lukáš Trkan	b7570e334f	feat(auth): add support for OAuth and MojeID	2025-10-10 15:51:18 +02:00