Merge df0f2584ae into 4ea6876b74

2026-03-22 15:12:08 +01:00 · 2025-10-10 13:58:48 +00:00
31 changed files with 290 additions and 1102 deletions
--- a/.github/workflows/deploy-pr.yaml
+++ b/.github/workflows/deploy-pr.yaml
@@ -20,26 +20,13 @@ jobs:
      pr_number: ${{ github.event.pull_request.number }}
    secrets: inherit

-  get_urls:
-    if: github.event.action != 'closed'
-    name: Generate Preview URLs
-    uses: ./.github/workflows/url_generator.yml
-    with:
-      runner: vhs
-      mode: pr
-      pr_number: ${{ github.event.pull_request.number }}
-      base_domain: ${{ vars.DEV_BASE_DOMAIN }}
-    secrets: inherit
-
  frontend:
    if: github.event.action != 'closed'
    name: Frontend - Build and Deploy to Cloudflare Pages (PR)
-    needs: [get_urls]
    uses: ./.github/workflows/frontend-pages.yml
    with:
      mode: pr
      pr_number: ${{ github.event.pull_request.number }}
-      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
    secrets: inherit

  deploy:
@@ -49,7 +36,7 @@ jobs:
    concurrency:
      group: pr-${{ github.event.pull_request.number }}
      cancel-in-progress: false
-    needs: [build, frontend, get_urls]
+    needs: [build, frontend]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -75,24 +62,25 @@ jobs:
          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
+          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
          DIGEST: ${{ needs.build.outputs.digest }}
-          DOMAIN: "${{ needs.get_urls.outputs.backend_url }}"
-          DOMAIN_SCHEME: "${{ needs.get_urls.outputs.backend_url_scheme }}"
-          FRONTEND_DOMAIN: "${{ needs.get_urls.outputs.frontend_url }}"
-          FRONTEND_DOMAIN_SCHEME: "${{ needs.get_urls.outputs.frontend_url_scheme }}"
        run: |
          PR=${{ github.event.pull_request.number }}
+          if [ -z "$PR" ]; then echo "PR number missing"; exit 1; fi
+          if [ -z "$DEV_BASE_DOMAIN" ]; then echo "Secret DEV_BASE_DOMAIN is required (e.g., dev.example.com)"; exit 1; fi
+          if [ -z "$RABBITMQ_PASSWORD" ]; then echo "Secret DEV_RABBITMQ_PASSWORD is required"; exit 1; fi
+          if [ -z "$DB_PASSWORD" ]; then echo "Secret DEV_DB_PASSWORD is required"; exit 1; fi
          RELEASE=myapp-pr-$PR
          NAMESPACE=pr-$PR
+          DOMAIN=pr-$PR.$DEV_BASE_DOMAIN
+          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install "$RELEASE" ./7project/charts/myapp-chart \
            -n "$NAMESPACE" --create-namespace \
            -f 7project/charts/myapp-chart/values-dev.yaml \
            --set prNumber="$PR" \
            --set deployment="pr-$PR" \
            --set domain="$DOMAIN" \
-            --set domain_scheme="$DOMAIN_SCHEME" \
-            --set frontend_domain="$FRONTEND_DOMAIN" \
-            --set frontend_domain_scheme="$FRONTEND_DOMAIN_SCHEME" \
+            --set image.repository="$IMAGE_REPO" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
            --set-string database.password="$DB_PASSWORD"
@@ -100,16 +88,19 @@ jobs:
      - name: Post preview URLs as PR comment
        uses: actions/github-script@v7
        env:
-          BACKEND_URL: ${{ needs.get_urls.outputs.backend_url_scheme }}
-          FRONTEND_URL: ${{ needs.get_urls.outputs.frontend_url_scheme }}
+          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
+          FRONTEND_URL: ${{ needs.frontend.outputs.deployed_url }}
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) { core.setFailed('No pull_request context'); return; }
            const prNumber = pr.number;
-            const backendUrl = process.env.BACKEND_URL || '(not available)';
+            const domainBase = process.env.DEV_BASE_DOMAIN;
+            if (!domainBase) { core.setFailed('DEV_BASE_DOMAIN is required'); return; }
+            const backendDomain = `pr-${prNumber}.${domainBase}`;
+            const backendUrl = `https://${backendDomain}`;
            const frontendUrl = process.env.FRONTEND_URL || '(not available)';
-            const marker = '<!-- preview-comment-marker -->';
+            const marker = '<!-- preview-link -->';
            const body = `${marker}\nPreview environment is running\n- Frontend: ${frontendUrl}\n- Backend: ${backendUrl}\n`;
            const { owner, repo } = context.repo;
            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number: prNumber, per_page: 100 });
@@ -148,4 +139,4 @@ jobs:
          NAMESPACE=pr-$PR
          helm uninstall "$RELEASE" -n "$NAMESPACE" || true
          # Optionally delete the namespace if empty
-          kubectl delete namespace "$NAMESPACE" --ignore-not-found=true || true
+          kubectl delete namespace "$NAMESPACE" --ignore-not-found=true || true
--- a/.github/workflows/deploy-prod.yaml
+++ b/.github/workflows/deploy-prod.yaml
@@ -30,28 +30,17 @@ jobs:
      context: 7project/backend
    secrets: inherit

-  get_urls:
-    name: Generate Production URLs
-    uses: ./.github/workflows/url_generator.yml
-    with:
-      mode: prod
-      runner: vhs
-      base_domain: ${{ vars.PROD_DOMAIN }}
-    secrets: inherit
-
  frontend:
    name: Frontend - Build and Deploy to Cloudflare Pages (prod)
-    needs: [get_urls]
    uses: ./.github/workflows/frontend-pages.yml
    with:
      mode: prod
-      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
    secrets: inherit

  deploy:
    name: Helm upgrade/install (prod)
    runs-on: vhs
-    needs: [build, frontend, get_urls]
+    needs: [build, frontend]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -74,31 +63,25 @@ jobs:

      - name: Helm upgrade/install prod
        env:
-          DOMAIN: ${{ needs.get_urls.outputs.backend_url }}
-          DOMAIN_SCHEME: ${{ needs.get_urls.outputs.backend_url_scheme }}
-          FRONTEND_DOMAIN: ${{ needs.get_urls.outputs.frontend_url }}
-          FRONTEND_DOMAIN_SCHEME: ${{ needs.get_urls.outputs.frontend_url_scheme }}
+          DOMAIN: ${{ secrets.PROD_DOMAIN }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
+          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
          DIGEST: ${{ needs.build.outputs.digest }}
-          BANKID_CLIENT_ID: ${{ secrets.BANKID_CLIENT_ID }}
-          BANKID_CLIENT_SECRET: ${{ secrets.BANKID_CLIENT_SECRET }}
-          MOJEID_CLIENT_ID: ${{ secrets.MOJEID_CLIENT_ID }}
-          MOJEID_CLIENT_SECRET: ${{ secrets.MOJEID_CLIENT_SECRET }}
-
        run: |
+          if [ -z "$DOMAIN" ]; then
+            echo "Secret PROD_DOMAIN is required (e.g., app.example.com)"; exit 1; fi
+          if [ -z "$RABBITMQ_PASSWORD" ]; then
+            echo "Secret PROD_RABBITMQ_PASSWORD is required"; exit 1; fi
+          if [ -z "$DB_PASSWORD" ]; then
+            echo "Secret PROD_DB_PASSWORD is required"; exit 1; fi
+          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install myapp ./7project/charts/myapp-chart \
            -n prod --create-namespace \
            -f 7project/charts/myapp-chart/values-prod.yaml \
            --set deployment="prod" \
            --set domain="$DOMAIN" \
-            --set domain_scheme="$DOMAIN_SCHEME" \
-            --set frontend_domain="$FRONTEND_DOMAIN" \
-            --set frontend_domain_scheme="$FRONTEND_DOMAIN_SCHEME" \
+            --set image.repository="$IMAGE_REPO" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
-            --set-string database.password="$DB_PASSWORD"
-            --set-string oauth.bankid.clientId="$BANKID_CLIENT_ID" \
-            --set-string oauth.bankid.clientSecret="$BANKID_CLIENT_SECRET" \
-            --set-string oauth.mojeid.clientId="$MOJEID_CLIENT_ID" \
-            --set-string oauth.mojeid.clientSecret="$MOJEID_CLIENT_SECRET"
+            --set-string database.password="$DB_PASSWORD" 
--- a/.github/workflows/frontend-pages.yml
+++ b/.github/workflows/frontend-pages.yml
@@ -15,10 +15,6 @@ on:
        description: 'Cloudflare Pages project name (overrides default)'
        required: false
        type: string
-      backend_url_scheme:
-        description: 'The full scheme URL for the backend (e.g., https://api.example.com)'
-        required: true
-        type: string
    secrets:
      CLOUDFLARE_API_TOKEN:
        required: true
@@ -29,6 +25,14 @@ on:
        description: 'URL of deployed frontend'
        value: ${{ jobs.deploy.outputs.deployed_url }}

+# Required repository secrets:
+#   CLOUDFLARE_API_TOKEN     - API token with Pages:Edit (or Account:Workers Scripts:Edit) permissions
+#   CLOUDFLARE_ACCOUNT_ID    - Your Cloudflare account ID
+# Optional repository variables:
+#   CF_PAGES_PROJECT_NAME      - Default Cloudflare Pages project name
+#   PROD_DOMAIN                - App domain for prod releases (e.g., api.example.com or https://api.example.com)
+#   BACKEND_URL_PR_TEMPLATE    - Template for PR backend URL. Use {PR} placeholder for PR number (e.g., https://api-pr-{PR}.example.com)
+
 jobs:
  build:
    name: Build frontend
@@ -50,9 +54,50 @@ jobs:
      - name: Install dependencies
        run: npm ci

-      - name: Set backend URL from workflow input
+      - name: Compute backend URL for Vite
+        id: be
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+          PR_TEMPLATE: ${{ vars.BACKEND_URL_PR_TEMPLATE }}
+          DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
+          PROD_DOMAIN_VAR: ${{ vars.PROD_DOMAIN }}
+          PROD_DOMAIN_SECRET: ${{ secrets.PROD_DOMAIN }}
+          BACKEND_URL_OVERRIDE: ${{ vars.BACKEND_URL || secrets.BACKEND_URL }}
+          MODE: ${{ inputs.mode }}
        run: |
-          echo "VITE_BACKEND_URL=${{ inputs.backend_url_scheme }}" >> $GITHUB_ENV
+          set -euo pipefail
+          URL=""
+          # 1) Explicit override wins (from repo var or secret)
+          if [ -n "${BACKEND_URL_OVERRIDE:-}" ]; then
+            if echo "$BACKEND_URL_OVERRIDE" | grep -Eiq '^https?://'; then
+              URL="$BACKEND_URL_OVERRIDE"
+            else
+              URL="https://${BACKEND_URL_OVERRIDE}"
+            fi
+          else
+            # 2) PR-specific URL when building for PR
+            if [ "${MODE:-}" = "pr" ] || [ "${EVENT_NAME}" = "pull_request" ]; then
+              if [ -n "${PR_TEMPLATE:-}" ] && [ -n "${PR_NUMBER:-}" ] ; then
+                URL="${PR_TEMPLATE//\{PR\}/${PR_NUMBER}}"
+              elif [ -n "${DEV_BASE_DOMAIN:-}" ] && [ -n "${PR_NUMBER:-}" ]; then
+                URL="https://pr-${PR_NUMBER}.${DEV_BASE_DOMAIN}"
+              fi
+            fi
+            # 3) Fallback to PROD_DOMAIN (prefer repo var, then secret)
+            if [ -z "$URL" ]; then
+              PROD_DOMAIN="${PROD_DOMAIN_VAR:-${PROD_DOMAIN_SECRET:-}}"
+              if [ -n "$PROD_DOMAIN" ]; then
+                if echo "$PROD_DOMAIN" | grep -Eiq '^https?://'; then
+                  URL="$PROD_DOMAIN"
+                else
+                  URL="https://${PROD_DOMAIN}"
+                fi
+              fi
+            fi
+          fi
+          echo "Using backend URL: ${URL:-<empty>}"
+          echo "VITE_BACKEND_URL=${URL}" >> $GITHUB_ENV

      - name: Build
        run: npm run build
@@ -132,4 +177,4 @@ jobs:
          else
            URL="https://${PBRANCH}.${PNAME}.pages.dev"
          fi
-          echo "deployed_url=$URL" >> $GITHUB_OUTPUT
+          echo "deployed_url=$URL" >> $GITHUB_OUTPUT
--- a/.github/workflows/url_generator.yml
+++ b/.github/workflows/url_generator.yml
@@ -1,74 +0,0 @@
-name: Generate Preview or Production URLs
-
-on:
-  workflow_call:
-    inputs:
-      mode:
-        description: "Build mode: 'prod' or 'pr'"
-        required: true
-        type: string
-      pr_number:
-        description: 'PR number (required when mode=pr)'
-        required: false
-        type: string
-      runner:
-        description: 'The runner to use for this job'
-        required: false
-        type: string
-        default: 'ubuntu-latest'
-      base_domain:
-        description: 'The base domain for production URLs (e.g., example.com)'
-        required: true
-        type: string
-
-    outputs:
-      backend_url:
-        description: "The backend URL without scheme (e.g., api.example.com)"
-        value: ${{ jobs.generate-urls.outputs.backend_url }}
-      frontend_url:
-        description: "The frontend URL without scheme (e.g., app.example.com)"
-        value: ${{ jobs.generate-urls.outputs.frontend_url }}
-      backend_url_scheme:
-        description: "The backend URL with scheme (e.g., https://api.example.com)"
-        value: ${{ jobs.generate-urls.outputs.backend_url_scheme }}
-      frontend_url_scheme:
-        description: "The frontend URL with scheme (e.g., https://app.example.com)"
-        value: ${{ jobs.generate-urls.outputs.frontend_url_scheme }}
-
-jobs:
-  generate-urls:
-    permissions:
-      contents: none
-    runs-on: ${{ inputs.runner }}
-
-    outputs:
-      backend_url: ${{ steps.set_urls.outputs.backend_url }}
-      frontend_url: ${{ steps.set_urls.outputs.frontend_url }}
-      backend_url_scheme: ${{ steps.set_urls.outputs.backend_url_scheme }}
-      frontend_url_scheme: ${{ steps.set_urls.outputs.frontend_url_scheme }}
-
-    steps:
-      - name: Generate URLs
-        id: set_urls
-        env:
-          BASE_DOMAIN: ${{ inputs.base_domain }}
-        run: |
-          set -euo pipefail
-          
-          if [ "${{ inputs.mode }}" = "prod" ]; then
-            BACKEND_URL="api.${BASE_DOMAIN}"
-            FRONTEND_URL="finance.${BASE_DOMAIN}"
-          else
-            # This is your current logic
-            FRONTEND_URL="pr-${{ inputs.pr_number }}.group-8-frontend.pages.dev"
-            BACKEND_URL="api-pr-${{ inputs.pr_number }}.${BASE_DOMAIN}"
-          fi
-
-          FRONTEND_URL_SCHEME="https://$FRONTEND_URL"
-          BACKEND_URL_SCHEME="https://$BACKEND_URL"
-          
-          # This part correctly writes to GITHUB_OUTPUT for the step
-          echo "backend_url_scheme=$BACKEND_URL_SCHEME" >> $GITHUB_OUTPUT
-          echo "frontend_url_scheme=$FRONTEND_URL_SCHEME" >> $GITHUB_OUTPUT
-          echo "backend_url=$BACKEND_URL" >> $GITHUB_OUTPUT
-          echo "frontend_url=$FRONTEND_URL" >> $GITHUB_OUTPUT
--- a/7project/backend/alembic/versions/2025_10_11_2107-5ab2e654c96e_change_token_lenght.py
+++ b/7project/backend/alembic/versions/2025_10_11_2107-5ab2e654c96e_change_token_lenght.py
@@ -1,38 +0,0 @@
-"""change token length
-
-Revision ID: 5ab2e654c96e
-Revises: 7af8f296d089
-Create Date: 2025-10-11 21:07:41.930470
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import mysql
-
-# revision identifiers, used by Alembic.
-revision: str = '5ab2e654c96e'
-down_revision: Union[str, Sequence[str], None] = '7af8f296d089'
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Upgrade schema."""
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.alter_column('oauth_account', 'access_token',
-               existing_type=mysql.VARCHAR(length=1024),
-               type_=sa.String(length=4096),
-               existing_nullable=False)
-    # ### end Alembic commands ###
-
-
-def downgrade() -> None:
-    """Downgrade schema."""
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.alter_column('oauth_account', 'access_token',
-               existing_type=sa.String(length=4096),
-               type_=mysql.VARCHAR(length=1024),
-               existing_nullable=False)
-    # ### end Alembic commands ###
--- a/7project/backend/app/api/auth.py
+++ b/7project/backend/app/api/auth.py
@@ -1,31 +0,0 @@
-from fastapi import APIRouter
-
-from app.schemas.user import UserCreate, UserRead, UserUpdate
-from app.services.user_service import auth_backend, fastapi_users
-
-router = APIRouter()
-
-# Keep existing paths as-is under /auth/* and /users/*
-router.include_router(
-    fastapi_users.get_auth_router(auth_backend), prefix="/auth/jwt", tags=["auth"]
-)
-router.include_router(
-    fastapi_users.get_register_router(UserRead, UserCreate),
-    prefix="/auth",
-    tags=["auth"],
-)
-router.include_router(
-    fastapi_users.get_reset_password_router(),
-    prefix="/auth",
-    tags=["auth"],
-)
-router.include_router(
-    fastapi_users.get_verify_router(UserRead),
-    prefix="/auth",
-    tags=["auth"],
-)
-router.include_router(
-    fastapi_users.get_users_router(UserRead, UserUpdate),
-    prefix="/users",
-    tags=["users"],
-)
--- a/7project/backend/app/api/categories.py
+++ b/7project/backend/app/api/categories.py
@@ -1,77 +0,0 @@
-from typing import List
-
-from fastapi import APIRouter, Depends, HTTPException, status
-from sqlalchemy import select, delete
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.models.categories import Category
-from app.schemas.category import CategoryCreate, CategoryRead
-from app.services.db import get_async_session
-from app.services.user_service import current_active_user
-from app.models.user import User
-
-router = APIRouter(prefix="/categories", tags=["categories"])
-
-
-@router.post("/create", response_model=CategoryRead, status_code=status.HTTP_201_CREATED)
-async def create_category(
-    payload: CategoryCreate,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    # Enforce per-user unique name via query to provide 409 feedback
-    res = await session.execute(
-        select(Category).where(Category.user_id == user.id, Category.name == payload.name)
-    )
-    existing = res.scalar_one_or_none()
-    if existing:
-        raise HTTPException(status_code=409, detail="Category with this name already exists")
-
-    category = Category(name=payload.name, description=payload.description, user_id=user.id)
-    session.add(category)
-    await session.commit()
-    await session.refresh(category)
-    return category
-
-
-@router.get("/", response_model=List[CategoryRead])
-async def list_categories(
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(select(Category).where(Category.user_id == user.id))
-    return list(res.scalars())
-
-
-@router.get("/{category_id}", response_model=CategoryRead)
-async def get_category(
-    category_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Category).where(Category.id == category_id, Category.user_id == user.id)
-    )
-    category = res.scalar_one_or_none()
-    if not category:
-        raise HTTPException(status_code=404, detail="Category not found")
-    return category
-
-
-@router.delete("/{category_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_category(
-    category_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Category.id).where(Category.id == category_id, Category.user_id == user.id)
-    )
-    if res.scalar_one_or_none() is None:
-        raise HTTPException(status_code=404, detail="Category not found")
-
-    await session.execute(
-        delete(Category).where(Category.id == category_id, Category.user_id == user.id)
-    )
-    await session.commit()
-    return None
--- a/7project/backend/app/api/transactions.py
+++ b/7project/backend/app/api/transactions.py
@@ -1,219 +0,0 @@
-from typing import List, Optional
-
-from fastapi import APIRouter, Depends, HTTPException, status
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.models.transaction import Transaction
-from app.models.categories import Category
-from app.schemas.transaction import (
-    TransactionCreate,
-    TransactionRead,
-    TransactionUpdate,
-)
-from app.services.db import get_async_session
-from app.services.user_service import current_active_user
-from app.models.user import User
-
-router = APIRouter(prefix="/transactions", tags=["transactions"])
-
-
-def _to_read_model(tx: Transaction) -> TransactionRead:
-    return TransactionRead(
-        id=tx.id,
-        amount=tx.amount,
-        description=tx.description,
-        category_ids=[c.id for c in (tx.categories or [])],
-    )
-
-
-@router.post("/create", response_model=TransactionRead, status_code=status.HTTP_201_CREATED)
-async def create_transaction(
-    payload: TransactionCreate,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    tx = Transaction(amount=payload.amount, description=payload.description, user_id=user.id)
-
-    # Attach categories if provided (and owned by user)
-    if payload.category_ids:
-        res = await session.execute(
-            select(Category).where(
-                Category.user_id == user.id, Category.id.in_(payload.category_ids)
-            )
-        )
-        categories = list(res.scalars())
-        if len(categories) != len(set(payload.category_ids)):
-            raise HTTPException(
-                status_code=400,
-                detail="Duplicate category IDs provided or one or more categories not found"
-            )
-        tx.categories = categories
-
-    session.add(tx)
-    await session.commit()
-    await session.refresh(tx)
-    # Ensure categories are loaded
-    await session.refresh(tx, attribute_names=["categories"])
-    return _to_read_model(tx)
-
-
-@router.get("/", response_model=List[TransactionRead])
-async def list_transactions(
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Transaction).where(Transaction.user_id == user.id).order_by(Transaction.id)
-    )
-    txs = list(res.scalars())
-    # Eagerly load categories for each transaction
-    for tx in txs:
-        await session.refresh(tx, attribute_names=["categories"])
-    return [_to_read_model(tx) for tx in txs]
-
-
-@router.get("/{transaction_id}", response_model=TransactionRead)
-async def get_transaction(
-    transaction_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Transaction).where(
-            Transaction.id == transaction_id, Transaction.user_id == user.id
-        )
-    )
-    tx: Optional[Transaction] = res.scalar_one_or_none()
-    if not tx:
-        raise HTTPException(status_code=404, detail="Transaction not found")
-    await session.refresh(tx, attribute_names=["categories"])
-    return _to_read_model(tx)
-
-
-@router.patch("/{transaction_id}/edit", response_model=TransactionRead)
-async def update_transaction(
-    transaction_id: int,
-    payload: TransactionUpdate,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Transaction).where(
-            Transaction.id == transaction_id, Transaction.user_id == user.id
-        )
-    )
-    tx: Optional[Transaction] = res.scalar_one_or_none()
-    if not tx:
-        raise HTTPException(status_code=404, detail="Transaction not found")
-
-    if payload.amount is not None:
-        tx.amount = payload.amount
-    if payload.description is not None:
-        tx.description = payload.description
-
-    if payload.category_ids is not None:
-        # Preload categories to avoid async lazy-load during assignment
-        await session.refresh(tx, attribute_names=["categories"])
-        if payload.category_ids:
-            # Check for duplicate category IDs in the payload
-            if len(payload.category_ids) != len(set(payload.category_ids)):
-                raise HTTPException(status_code=400, detail="Duplicate category IDs in payload")
-            res = await session.execute(
-                select(Category).where(
-                    Category.user_id == user.id, Category.id.in_(payload.category_ids)
-                )
-            )
-            categories = list(res.scalars())
-            if len(categories) != len(payload.category_ids):
-                raise HTTPException(status_code=400, detail="One or more categories not found")
-            tx.categories = categories
-        else:
-            tx.categories = []
-
-    await session.commit()
-    await session.refresh(tx, attribute_names=["categories"])
-    return _to_read_model(tx)
-
-
-@router.delete("/{transaction_id}/delete", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_transaction(
-    transaction_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res = await session.execute(
-        select(Transaction).where(
-            Transaction.id == transaction_id, Transaction.user_id == user.id
-        )
-    )
-    tx = res.scalar_one_or_none()
-    if not tx:
-        raise HTTPException(status_code=404, detail="Transaction not found")
-
-    await session.delete(tx)
-    await session.commit()
-    return None
-
-
-@router.post("/{transaction_id}/categories/{category_id}", response_model=TransactionRead)
-async def assign_category(
-    transaction_id: int,
-    category_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    # Load transaction and category ensuring ownership
-    res_tx = await session.execute(
-        select(Transaction).where(
-            Transaction.id == transaction_id, Transaction.user_id == user.id
-        )
-    )
-    tx: Optional[Transaction] = res_tx.scalar_one_or_none()
-    if not tx:
-        raise HTTPException(status_code=404, detail="Transaction not found")
-
-    res_cat = await session.execute(
-        select(Category).where(Category.id == category_id, Category.user_id == user.id)
-    )
-    cat: Optional[Category] = res_cat.scalar_one_or_none()
-    if not cat:
-        raise HTTPException(status_code=404, detail="Category not found")
-
-    await session.refresh(tx, attribute_names=["categories"])
-    if cat not in tx.categories:
-        tx.categories.append(cat)
-        await session.commit()
-        await session.refresh(tx, attribute_names=["categories"])
-    return _to_read_model(tx)
-
-
-@router.delete("/{transaction_id}/categories/{category_id}", response_model=TransactionRead)
-async def unassign_category(
-    transaction_id: int,
-    category_id: int,
-    session: AsyncSession = Depends(get_async_session),
-    user: User = Depends(current_active_user),
-):
-    res_tx = await session.execute(
-        select(Transaction).where(
-            Transaction.id == transaction_id, Transaction.user_id == user.id
-        )
-    )
-    tx: Optional[Transaction] = res_tx.scalar_one_or_none()
-    if not tx:
-        raise HTTPException(status_code=404, detail="Transaction not found")
-
-    res_cat = await session.execute(
-        select(Category).where(Category.id == category_id, Category.user_id == user.id)
-    )
-    cat: Optional[Category] = res_cat.scalar_one_or_none()
-    if not cat:
-        raise HTTPException(status_code=404, detail="Category not found")
-
-    await session.refresh(tx, attribute_names=["categories"])
-    if cat in tx.categories:
-        tx.categories.remove(cat)
-        await session.commit()
-        await session.refresh(tx, attribute_names=["categories"])
-    return _to_read_model(tx)
--- a/7project/backend/app/app.py
+++ b/7project/backend/app/app.py
@@ -1,13 +1,11 @@
 from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware

+import app.services.user_service
 from app.models.user import User

-from app.services.user_service import current_active_verified_user
-from app.api.auth import router as auth_router
-from app.api.categories import router as categories_router
-from app.api.transactions import router as transactions_router
-from app.services.user_service import auth_backend, current_active_verified_user, fastapi_users, get_oauth_provider
+from app.schemas.user import UserCreate, UserRead, UserUpdate
+from app.services.user_service import auth_backend, current_active_verified_user, fastapi_users

 fastApi = FastAPI()

@@ -23,29 +21,38 @@ fastApi.add_middleware(
    allow_headers=["*"],
 )

-fastApi.include_router(auth_router)
-fastApi.include_router(categories_router)
-fastApi.include_router(transactions_router)
-
 fastApi.include_router(
-    fastapi_users.get_oauth_router(
-        get_oauth_provider("MojeID"),
-        auth_backend,
-        "SECRET",
-        associate_by_email=True,
-    ),
-    prefix="/auth/mojeid",
+    fastapi_users.get_auth_router(auth_backend), prefix="/auth/jwt", tags=["auth"]
+)
+fastApi.include_router(
+    fastapi_users.get_register_router(UserRead, UserCreate),
+    prefix="/auth",
    tags=["auth"],
 )
+fastApi.include_router(
+    fastapi_users.get_reset_password_router(),
+    prefix="/auth",
+    tags=["auth"],
+)
+fastApi.include_router(
+    fastapi_users.get_verify_router(UserRead),
+    prefix="/auth",
+    tags=["auth"],
+)
+fastApi.include_router(
+    fastapi_users.get_users_router(UserRead, UserUpdate),
+    prefix="/users",
+    tags=["users"],
+)

 fastApi.include_router(
    fastapi_users.get_oauth_router(
-        get_oauth_provider("BankID"),
+        app.services.user_service.mojeid_oauth_service,
        auth_backend,
        "SECRET",
-        associate_by_email=True,
+        associate_by_email=True
    ),
-    prefix="/auth/bankid",
+    prefix="/auth/mojeid",
    tags=["auth"],
 )

--- a/7project/backend/app/models/user.py
+++ b/7project/backend/app/models/user.py
@@ -1,12 +1,13 @@
+from typing import List
+
 from sqlalchemy import Column, String
-from sqlalchemy.orm import relationship, mapped_column, Mapped
+from sqlalchemy.orm import relationship
 from fastapi_users.db import SQLAlchemyBaseUserTableUUID, SQLAlchemyBaseOAuthAccountTableUUID
 from app.core.base import Base


 class OAuthAccount(SQLAlchemyBaseOAuthAccountTableUUID, Base):
-    # BankID token is longer than default
-    access_token: Mapped[str] = mapped_column(String(length=4096), nullable=False)
+    pass


 class User(SQLAlchemyBaseUserTableUUID, Base):
--- a/7project/backend/app/oauth/bank_id.py
+++ b/7project/backend/app/oauth/bank_id.py
@@ -1,50 +0,0 @@
-import secrets
-from typing import Optional, Literal
-
-from httpx_oauth.oauth2 import T
-
-from app.oauth.custom_openid import CustomOpenID
-
-
-class BankID(CustomOpenID):
-    def __init__(self, client_id: str, client_secret: str):
-        super().__init__(
-            client_id,
-            client_secret,
-            "https://oidc.sandbox.bankid.cz/.well-known/openid-configuration",
-            "BankID",
-            base_scopes=["openid", "profile.email", "profile.name"],
-        )
-
-    async def get_user_info(self, token: str) -> dict:
-        info = await self.get_profile(token)
-
-        return {
-            "first_name": info.get("given_name"),
-            "last_name": info.get("family_name"),
-        }
-
-    async def get_authorization_url(
-            self,
-            redirect_uri: str,
-            state: Optional[str] = None,
-            scope: Optional[list[str]] = None,
-            code_challenge: Optional[str] = None,
-            code_challenge_method: Optional[Literal["plain", "S256"]] = None,
-            extras_params: Optional[T] = None,
-    ) -> str:
-        if extras_params is None:
-            extras_params = {}
-
-        # BankID requires random nonce parameter for security
-        # https://developer.bankid.cz/docs/security_sep
-        extras_params["nonce"] = secrets.token_urlsafe()
-
-        return await super().get_authorization_url(
-            redirect_uri,
-            state,
-            scope,
-            code_challenge,
-            code_challenge_method,
-            extras_params,
-        )
--- a/7project/backend/app/oauth/custom_openid.py
+++ b/7project/backend/app/oauth/custom_openid.py
@@ -1,6 +0,0 @@
-from httpx_oauth.clients.openid import OpenID
-
-
-class CustomOpenID(OpenID):
-    async def get_user_info(self, token: str) -> dict:
-        raise NotImplementedError()
--- a/7project/backend/app/oauth/moje_id.py
+++ b/7project/backend/app/oauth/moje_id.py
@@ -1,12 +1,12 @@
 import json
-from typing import Optional, Literal, Any
+from typing import Optional, Literal

-from httpx_oauth.oauth2 import T
-
-from app.oauth.custom_openid import CustomOpenID
+from httpx_oauth.clients.openid import OpenID
+from httpx_oauth.oauth2 import OAuth2Token, GetAccessTokenError, T


-class MojeIDOAuth(CustomOpenID):
+# claims=%7B%22id_token%22%3A%7B%22birthdate%22%3A%7B%22essential%22%3Atrue%7D%2C%22name%22%3A%7B%22essential%22%3Atrue%7D%2C%22given_name%22%3A%7B%22essential%22%3Atrue%7D%2C%22family_name%22%3A%7B%22essential%22%3Atrue%7D%2C%22email%22%3A%7B%22essential%22%3Atrue%7D%2C%22address%22%3A%7B%22essential%22%3Afalse%7D%2C%22mojeid_valid%22%3A%7B%22essential%22%3Atrue%7D%7D%7D
+class MojeIDOAuth(OpenID):
    def __init__(self, client_id: str, client_secret: str):
        super().__init__(
            client_id,
@@ -16,14 +16,6 @@ class MojeIDOAuth(CustomOpenID):
            base_scopes=["openid", "email", "profile"],
        )

-    async def get_user_info(self, token: str) -> Optional[Any]:
-        info = await self.get_profile(token)
-
-        return {
-            "first_name": info.get("given_name"),
-            "last_name": info.get("family_name"),
-        }
-
    async def get_authorization_url(
            self,
            redirect_uri: str,
--- a/7project/backend/app/schemas/category.py
+++ b/7project/backend/app/schemas/category.py
@@ -1,16 +0,0 @@
-from typing import Optional
-from pydantic import BaseModel, ConfigDict
-
-
-class CategoryBase(BaseModel):
-    name: str
-    description: Optional[str] = None
-
-
-class CategoryCreate(CategoryBase):
-    pass
-
-
-class CategoryRead(CategoryBase):
-    id: int
-    model_config = ConfigDict(from_attributes=True)
--- a/7project/backend/app/schemas/transaction.py
+++ b/7project/backend/app/schemas/transaction.py
@@ -1,21 +0,0 @@
-from typing import List, Optional
-from pydantic import BaseModel, Field, ConfigDict
-
-
-class TransactionBase(BaseModel):
-    amount: float = Field(..., gt=-1e18, lt=1e18)
-    description: Optional[str] = None
-
-class TransactionCreate(TransactionBase):
-    category_ids: Optional[List[int]] = None
-
-class TransactionUpdate(BaseModel):
-    amount: Optional[float] = Field(None, gt=-1e18, lt=1e18)
-    description: Optional[str] = None
-    category_ids: Optional[List[int]] = None
-
-class TransactionRead(TransactionBase):
-    id: int
-    category_ids: List[int] = []
-
-    model_config = ConfigDict(from_attributes=True)
--- a/7project/backend/app/schemas/user.py
+++ b/7project/backend/app/schemas/user.py
@@ -4,13 +4,13 @@ from fastapi_users import schemas

 class UserRead(schemas.BaseUser[uuid.UUID]):
    first_name: Optional[str] = None
-    last_name: Optional[str] = None
+    surname: Optional[str] = None

 class UserCreate(schemas.BaseUserCreate):
    first_name: Optional[str] = None
-    last_name: Optional[str] = None
+    surname: Optional[str] = None

 class UserUpdate(schemas.BaseUserUpdate):
    first_name: Optional[str] = None
-    last_name: Optional[str] = None
+    surname: Optional[str] = None

--- a/7project/backend/app/services/user_service.py
+++ b/7project/backend/app/services/user_service.py
@@ -3,66 +3,32 @@ import uuid
 from typing import Optional

 from fastapi import Depends, Request
-from fastapi_users import BaseUserManager, FastAPIUsers, UUIDIDMixin, models
+from fastapi_users import BaseUserManager, FastAPIUsers, UUIDIDMixin
 from fastapi_users.authentication import (
    AuthenticationBackend,
    BearerTransport,
 )
 from fastapi_users.authentication.strategy.jwt import JWTStrategy
 from fastapi_users.db import SQLAlchemyUserDatabase
-from httpx_oauth.oauth2 import BaseOAuth2

 from app.models.user import User
-from app.oauth.bank_id import BankID
-from app.oauth.custom_openid import CustomOpenID
 from app.oauth.moje_id import MojeIDOAuth
 from app.services.db import get_user_db
 from app.core.queue import enqueue_email

 SECRET = os.getenv("SECRET", "CHANGE_ME_SECRET")
-
 FRONTEND_URL = os.getenv("FRONTEND_URL", "http://localhost:5173")
 BACKEND_URL = os.getenv("BACKEND_URL", "http://localhost:8000")

-providers = {
-    "MojeID": MojeIDOAuth(
-        os.getenv("MOJEID_CLIENT_ID", "CHANGE_ME_CLIENT_ID"),
-        os.getenv("MOJEID_CLIENT_SECRET", "CHANGE_ME_CLIENT_SECRET"),
-    ),
-    "BankID": BankID(
-        os.getenv("BANKID_CLIENT_ID", "CHANGE_ME_CLIENT_ID"),
-        os.getenv("BANKID_CLIENT_SECRET", "CHANGE_ME_CLIENT_SECRET"),
-    )
-}
-
-
-def get_oauth_provider(name: str) -> Optional[BaseOAuth2]:
-    if name not in providers:
-        return None
-    return providers[name]
-
+mojeid_oauth_service = MojeIDOAuth(
+    os.getenv("MOJEID_CLIENT_ID", "CHANGE_ME_CLIENT_ID"),
+    os.getenv("MOJEID_CLIENT_SECRET", "CHANGE_ME_CLIENT_SECRET"),
+)

 class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
    reset_password_token_secret = SECRET
    verification_token_secret = SECRET

-    async def oauth_callback(self: "BaseUserManager[models.UOAP, models.ID]", oauth_name: str, access_token: str,
-                             account_id: str, account_email: str, expires_at: Optional[int] = None,
-                             refresh_token: Optional[str] = None, request: Optional[Request] = None, *,
-                             associate_by_email: bool = False, is_verified_by_default: bool = False) -> models.UOAP:
-
-        user = await super().oauth_callback(oauth_name, access_token, account_id, account_email, expires_at,
-                                            refresh_token, request, associate_by_email=associate_by_email,
-                                            is_verified_by_default=is_verified_by_default)
-
-        # set additional user info from the OAuth provider
-        provider = get_oauth_provider(oauth_name)
-        if provider is not None and isinstance(provider, CustomOpenID):
-            update_dict = await provider.get_user_info(access_token)
-            await self.user_db.update(user, update_dict)
-
-        return user
-
    async def on_after_register(self, user: User, request: Optional[Request] = None):
        await self.request_verify(user, request)

@@ -92,18 +58,14 @@ class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
            print("[Email Fallback] Subject:", subject)
            print("[Email Fallback] Body:\n", body)

-
 async def get_user_manager(user_db: SQLAlchemyUserDatabase = Depends(get_user_db)):
    yield UserManager(user_db)

-
 bearer_transport = BearerTransport(tokenUrl="auth/jwt/login")

-
 def get_jwt_strategy() -> JWTStrategy:
    return JWTStrategy(secret=SECRET, lifetime_seconds=3600)

-
 auth_backend = AuthenticationBackend(
    name="jwt",
    transport=bearer_transport,
@@ -114,3 +76,4 @@ fastapi_users = FastAPIUsers[User, uuid.UUID](get_user_manager, [auth_backend])

 current_active_user = fastapi_users.current_user(active=True)
 current_active_verified_user = fastapi_users.current_user(active=True, verified=True)
+
--- a/7project/charts/myapp-chart/templates/NOTES.txt
+++ b/7project/charts/myapp-chart/templates/NOTES.txt
@@ -0,0 +1,54 @@
+Thank you for installing myapp-chart.
+
+This chart packages all Kubernetes manifests from the original deployment directory and parameterizes environment, database name (with optional PR suffix), image, and domain for external access.
+
+Namespaces per developer (important):
+- Install each developer's environment into their own namespace using Helm's -n/--namespace flag.
+- No hardcoded namespace is used in templates; resources are created in .Release.Namespace.
+- Example namespaces: dev-alice, dev-bob, pr-123, etc.
+
+Key values:
+- deployment -> used as Database CR name and DB username (MARIADB_DB and MARIADB_USER)
+- image.repository/tag or image.digest -> container image
+- domain -> public FQDN used by TunnelBinding (required to expose app)
+- app/worker names, replicas, ports
+
+Examples:
+- Dev install (Alice):
+  helm upgrade --install myapp ./7project/charts/myapp-chart \
+    -n dev-alice --create-namespace \
+    -f values-dev.yaml \
+    --set domain=alice.demo.example.com \
+    --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
+    --set-string database.password="$DB_PASSWORD"
+
+- Dev install (Bob):
+  helm upgrade --install myapp ./7project/charts/myapp-chart \
+    -n dev-bob --create-namespace \
+    -f values-dev.yaml \
+    --set domain=bob.demo.example.com
+
+- Prod install (different cleanupPolicy):
+  helm upgrade --install myapp ./7project/charts/myapp-chart \
+    -n prod --create-namespace \
+    -f values-prod.yaml \
+    --set domain=app.example.com
+
+- PR (preview) install with DB name containing PR number (also its own namespace):
+  PR=123
+  helm upgrade --install myapp-pr-$PR ./7project/charts/myapp-chart \
+    -n pr-$PR --create-namespace \
+    -f values-dev.yaml \
+    --set prNumber=$PR \
+    --set deployment=preview-$PR \
+    --set domain=pr-$PR.example.com
+
+- Use a custom deployment identifier to suffix DB name, DB username and Secret name:
+  helm upgrade --install myapp ./7project/charts/myapp-chart \
+    -n dev-alice --create-namespace \
+    -f values-dev.yaml \
+    --set deployment=alice \
+    --set domain=alice.demo.example.com
+
+Render locally (dry run):
+  helm template ./7project/charts/myapp-chart -f values-dev.yaml --set prNumber=456 --set deployment=test --set domain=demo.example.com --namespace dev-test | sed -n '/kind: Database/,$p' | head -n 30
--- a/7project/charts/myapp-chart/templates/app-deployment.yaml
+++ b/7project/charts/myapp-chart/templates/app-deployment.yaml
@@ -52,22 +52,6 @@ spec:
              value: {{ .Values.rabbitmq.vhost | default "/" | quote }}
            - name: MAIL_QUEUE
              value: {{ .Values.worker.mailQueueName | default "mail_queue" | quote }}
-            - name: MOJEID_CLIENT_ID
-              value: {{ .Values.oauth.mojeid.clientId | quote }}
-            - name: MOJEID_CLIENT_SECRET
-              value: {{ .Values.oauth.mojeid.clientSecret | quote }}
-            - name: BANKID_CLIENT_ID
-              value: {{ .Values.oauth.bankid.clientId | quote }}
-            - name: BANKID_CLIENT_SECRET
-              value: {{ .Values.oauth.bankid.clientSecret | quote }}
-            - name: DOMAIN
-              value: {{ required "Set .Values.domain" .Values.domain | quote }}
-            - name: DOMAIN_SCHEME
-              value: {{ required "Set .Values.domain_scheme" .Values.domain_scheme | quote }}
-            - name: FRONTEND_DOMAIN
-              value: {{ required "Set .Values.frontend_domain" .Values.frontend_domain | quote }}
-            - name: FRONTEND_DOMAIN_SCHEME
-              value: {{ required "Set .Values.frontend_domain_scheme" .Values.frontend_domain_scheme | quote }}
          livenessProbe:
            httpGet:
              path: /
--- a/7project/charts/myapp-chart/values.yaml
+++ b/7project/charts/myapp-chart/values.yaml
@@ -11,10 +11,6 @@ deployment: ""
 # Public domain to expose the app under (used by TunnelBinding fqdn)
 # Set at install time: --set domain=example.com
 domain: ""
-domain_scheme: ""
-
-frontend_domain: ""
-frontend_domain_scheme: ""

 image:
  repository: lukastrkan/cc-app-demo
@@ -37,14 +33,6 @@ worker:
 service:
  port: 80

-oauth:
-  bankid:
-    clientId: ""
-    clientSecret: ""
-  mojeid:
-    clientId: ""
-    clientSecret: ""
-
 rabbitmq:
  create: true
  replicas: 1
--- a/7project/meetings/2025-10-16-meeting.md
+++ b/7project/meetings/2025-10-16-meeting.md
@@ -1,53 +0,0 @@
-# Weekly Meeting Notes
-
- Group 8 - Personal finance tracker
- Mentor: Jaychander
-
-Keep all meeting notes in the `meetings.md` file in your project folder.
-Just copy the template below for each weekly meeting and fill in the details.
-
-## Administrative Info
-
- Date: 2025-10-08
- Attendees: Dejan Ribarovski, Lukas Trkan
- Notetaker: Dejan Ribarovski
-
-## Progress Update (Before Meeting)
-
-Summary of what has been accomplished since the last meeting in the following categories.
-
-## Action Items from Last Week (During Meeting)
-
- [x] start coding the app logic
- [x] start writing the report so it matches the actual progress
- [x] redo the system diagram so it includes a response flow
-
-### Coding
-Implemented initial functioning version of the app, added OAuth with BankId and MojeID,
-added database snapshots.
-
-### Documentation
-report.md is up to date
-
-## Questions and Topics for Discussion (Before Meeting)
-
-Prepare 3-5 questions and topics you want to discuss with your mentor.
-
-1. What other functionality should be added to the app
-2. Priority for the next week (Testing maybe?)
-3. Question 3
-
-## Discussion Notes (During Meeting)
-
-## Action Items for Next Week (During Meeting)
-
-Last 3 minutes of the meeting, summarize action items.
-
- [ ] OAuth
- [ ] CI/CD fix
- [ ] Database local (multiple bank accounts)
- [ ] Add tests and set up github pipeline
- [ ] Frontend imporvment - user experience
- [ ] make the report more clear
-
---
--- a/7project/meetings/2025-10-9-meeting.md
+++ b/7project/meetings/2025-10-9-meeting.md
--- a/7project/report.md
+++ b/7project/report.md
@@ -1,4 +1,4 @@
-# Personal finance tracker
+# Project Report

 > **Instructions**:
 > This template provides the structure for your project report.
@@ -7,211 +7,126 @@

 ## Project Overview

-**Project Name**: Personal Finance Tracker
+**Project Name**: [Your project name]

 **Group Members**:

- 289229, Lukáš Trkan, lukastrkan
- 289258, Dejan Ribarovski, derib2613, ribardej
+- Student number, Name, GitHub username
+- Student number, Name, GitHub username
+- Student number, Name, GitHub username

 **Brief Description**:
-Our application is a finance tracker, so a person can easily track his cash flow
-through multiple bank accounts. Person can label transactions with custom categories
-and later filter by them.
+[2-3 sentences describing what your application does and its main purpose]

 ## Architecture Overview
-Our system is a full‑stack web application composed of a React frontend, a FastAPI backend, a PostgreSQL database, and asynchronous background workers powered by Celery with RabbitMQ. Redis is available for caching/kv and may be used by Celery as a result backend. The backend exposes REST endpoints for authentication (email/password and OAuth), users, categories, and transactions. A thin controller layer (FastAPI routers) lives under app/api. Infrastructure for Kubernetes is provided via OpenTofu (Terraform‑compatible) modules and the application is packaged via a Helm chart.

 ### High-Level Architecture

+[Describe the overall system architecture. Consider including a diagram using mermaid or linking to an image]
+
 ```mermaid
-flowchart LR
-    proc_queue[Message Queue] --> proc_queue_worker[Worker Service]
-    proc_queue_worker --> ext_mail[(Email Service)]
-    proc_cron[Task planner] --> proc_queue
-    proc_queue_worker --> ext_bank[(Bank API)]
-    proc_queue_worker --> db
-    client[Client/Frontend] <--> svc[Backend API]
-    svc --> proc_queue
-    svc <--> db[(Database)]
-    svc <--> cache[(Cache)]
+graph TD
+    A[Component A] --> B[Component B]
+    B --> C[Component C]
 ```

 ### Components

- Frontend (frontend/): React + TypeScript app built with Vite. Talks to the backend via REST, handles login/registration, shows latest transactions, filtering, and allows adding transactions.
- Backend API (backend/app): FastAPI app with routers under app/api for auth, categories, and transactions. Uses FastAPI Users for auth (JWT + OAuth), SQLAlchemy ORM, and Pydantic v2 schemas.
- Worker service (backend/app/workers): Celery worker handling asynchronous tasks (e.g., sending verification emails, future background processing).
- Database (PostgreSQL): Persists users, categories, transactions; schema managed by Alembic migrations.
- Message Queue (RabbitMQ): Transports background jobs from the API to the worker.
- Cache/Result Store (Redis): Available for caching or Celery result backend.
- Infrastructure as Code (tofu/): OpenTofu modules provisioning cluster services (RabbitMQ, Redis, Argo CD, cert-manager, Cloudflare tunnel, etc.).
- Deployment Chart (charts/myapp-chart/): Helm chart to deploy the application to Kubernetes.
+- **Component 1**: [Description of what this component does]
+- **Component 2**: [Description of what this component does]
+- **Component 3**: [Description of what this component does]

 ### Technologies Used

- Backend: Python, FastAPI, FastAPI Users, SQLAlchemy, Pydantic, Alembic, Celery
- Frontend: React, TypeScript, Vite
- Database: PostgreSQL
- Messaging: RabbitMQ 
- Cache: Redis
- Containerization/Orchestration: Docker, Docker Compose (dev), Kubernetes, Helm
- IaC/Platform: OpenTofu (Terraform), Argo CD, cert-manager, MetalLB, Cloudflare Tunnel, Prometheus
+- **Backend**: [e.g., Go, Node.js, Python]
+- **Database**: [e.g., PostgreSQL, MongoDB, Redis]
+- **Cloud Services**: [e.g., AWS EC2, Google Cloud Run, Azure Functions]
+- **Container Orchestration**: [e.g., Docker, Kubernetes]
+- **Other**: [List other significant technologies]

 ## Prerequisites

 ### System Requirements

- Operating System: Linux, macOS, or Windows
- Minimum RAM: 4 GB (8 GB recommended for running backend, frontend, and database together)
- Storage: 2 GB free (Docker images may require additional space)
+- Operating System: [e.g., Linux, macOS, Windows]
+- Minimum RAM: [e.g., 8GB]
+- Storage: [e.g., 10GB free space]

 ### Required Software

- Docker Desktop or Docker Engine 24+
- Docker Compose v2+
- Node.js 20+ and npm 10+ (for local frontend dev/build)
- Python 3.12+ (for local backend dev outside Docker)
- PostgreSQL 15+ (optional if running DB outside Docker)
- Helm 3.12+ and kubectl 1.29+ (for Kubernetes deployment)
- OpenTofu 1.7+ (for infrastructure provisioning)
+- [Software 1] (version X.X or higher)
+- [Software 2] (version X.X or higher)
+- [etc.]

-### Environment Variables (common)
+### Dependencies

- Backend: SECRET, FRONTEND_URL, BACKEND_URL, DATABASE_URL, RABBITMQ_URL, REDIS_URL 
- OAuth vars (Backend): MOJEID_CLIENT_ID/SECRET, BANKID_CLIENT_ID/SECRET (optional)
- Frontend: VITE_BACKEND_URL
-
-### Dependencies (key libraries)
-I am not sure what is meant by "key libraries"
-
-Backend: FastAPI, fastapi-users, SQLAlchemy, pydantic v2, Alembic, Celery  
-Frontend: React, TypeScript, Vite  
-Services: PostgreSQL, RabbitMQ, Redis
+```bash
+# List key dependencies that need to be installed
+# For example:
+# Docker Engine 20.10+
+# Node.js 18+
+# Go 1.25+
+```

 ## Build Instructions

-You can run the project with Docker Compose (recommended for local development) or run services manually.
-
-### 1) Clone the Repository
+### 1. Clone the Repository

 ```bash
-git clone https://github.com/dat515-2025/Group-8.git
-cd 7project
+git clone [your-repository-url]
+cd [repository-name]
 ```

-### 2) Install dependencies
-Backend
+### 2. Install Dependencies
+
 ```bash
-# In 7project/backend
-python3.12 -m venv .venv
-source .venv/bin/activate  # Windows: .venv\Scripts\activate
-pip install -r requirements.txt
+# Provide step-by-step commands
+# For example:
+# npm install
+# go mod download
 ```
-Frontend
+
+### 3. Build the Application
+
 ```bash
-# In 7project/frontend
-npm install
+# Provide exact build commands
+# For example:
+# make build
+# docker build -t myapp .
 ```

-### 3) Manual Local Run
+### 4. Configuration

-Backend
 ```bash
-# From the 7project/ directory
-docker compose up --build
-# This starts: PostgreSQL, RabbitMQ/Redis (if defined)
-
-# Set environment variables (or create .env file)
-export SECRET=CHANGE_ME_SECRET
-export BACKEND_URL=http://127.0.0.1:8000
-export FRONTEND_URL=http://localhost:5173
-export DATABASE_URL=postgresql+asyncpg://user:password@127.0.0.1:5432/app
-export RABBITMQ_URL=amqp://guest:guest@127.0.0.1:5672/
-export REDIS_URL=redis://127.0.0.1:6379/0
-
-# Apply DB migrations (Alembic)
-# From 7project/backend
-alembic upgrade head
-
-# Run API
-uvicorn app.app:fastApi --reload --host 0.0.0.0 --port 8000
-
-# Run Celery worker (optional, for emails/background tasks)
-celery -A app.celery_app.celery_app worker -l info
+# Any configuration steps needed
+# Environment variables to set
+# Configuration files to create
 ```

-Frontend
-```bash
-# Configure backend URL for dev
-echo 'VITE_BACKEND_URL=http://127.0.0.1:8000' > .env
-npm run dev
-# Open http://localhost:5173
-```
-
- Backend default: http://127.0.0.1:8000 (OpenAPI at /docs)
- Frontend default: http://localhost:5173
-
-If needed, adjust compose services/ports in compose.yml.
-
-
 ## Deployment Instructions

-### Local (Docker Compose)
+### Local Deployment

-Described in the previous section (Manual Local Run)
-
-### Kubernetes (via OpenTofu + Helm)
-
-1) Provision platform services (RabbitMQ/Redis/ingress/tunnel/etc.) with OpenTofu
 ```bash
-cd tofu
-# copy and edit variables
-cp terraform.tfvars.example terraform.tfvars
-# authenticate to your cluster/cloud as needed, then:
-tofu init
-tofu plan
-tofu apply
+# Step-by-step commands for local deployment
+# For example:
+# docker-compose up -d
+# kubectl apply -f manifests/
 ```

-2) Deploy the app using Helm
-```bash
-# Set the namespace
-kubectl create namespace myapp || true
+### Cloud Deployment

-# Install/upgrade the chart with required values
-helm upgrade --install myapp charts/myapp-chart \
-  -n myapp \
-  -f charts/myapp-chart/values.yaml \
-  --set image.backend.repository=myorg/myapp-backend \
-  --set image.backend.tag=latest \
-  --set env.BACKEND_URL="https://myapp.example.com" \
-  --set env.FRONTEND_URL="https://myapp.example.com" \
-  --set env.SECRET="CHANGE_ME_SECRET"
-```
-Adjust values to your registry and domain. The chart’s NOTES.txt includes additional examples.
-
-3) Expose and access
- If using Cloudflare Tunnel or an ingress, configure DNS accordingly (see tofu/modules/cloudflare and deployment/tunnel.yaml).
- For quick testing without ingress:
 ```bash
-kubectl -n myapp port-forward deploy/myapp-backend 8000:8000
-kubectl -n myapp port-forward deploy/myapp-frontend 5173:80
+# Commands for cloud deployment
+# Include any cloud-specific setup
 ```

 ### Verification

 ```bash
-# Check pods
-kubectl -n myapp get pods
-
-# Backend health
-curl -i http://127.0.0.1:8000/
-# OpenAPI
-open http://127.0.0.1:8000/docs
-
-# Frontend (if port-forwarded)
-open http://localhost:5173
+# Commands to verify deployment worked
+# How to check if services are running
+# Example health check endpoints
 ```

 ## Testing Instructions
@@ -241,38 +156,19 @@ open http://localhost:5173

 ## Usage Examples

-All endpoints are documented at OpenAPI: http://127.0.0.1:8000/docs
-
-### Auth: Register and Login (JWT)
+### Basic Usage

 ```bash
-# Register
-curl -X POST http://127.0.0.1:8000/auth/register \
-  -H 'Content-Type: application/json' \
-  -d '{
-    "email": "user@example.com",
-    "password": "StrongPassw0rd",
-    "first_name": "Jane",
-    "last_name": "Doe"
-  }'
-
-# Login (JWT)
-TOKEN=$(curl -s -X POST http://127.0.0.1:8000/auth/jwt/login \
-  -H 'Content-Type: application/x-www-form-urlencoded' \
-  -d 'username=user@example.com&password=StrongPassw0rd' | jq -r .access_token)
-
-echo $TOKEN
-
-# Call a protected route
-curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/authenticated-route
+# Examples of how to use the application
+# Common commands or API calls
+# Sample data or test scenarios
 ```

-### Frontend
+### Advanced Features

- Start with: npm run dev in 7project/frontend
- Ensure VITE_BACKEND_URL is set to the backend URL (e.g., http://127.0.0.1:8000)
- Open http://localhost:5173
- Login, view latest transactions, filter, and add new transactions from the UI.
+```bash
+# Examples showcasing advanced functionality
+```

 ---

@@ -319,18 +215,18 @@ curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/authenticated-route
 > This information is used for individual grading.
 > Link to the specific commit on GitHub for each contribution.

-| Task/Component                                                        | Assigned To | Status        | Time Spent     | Difficulty | Notes       |
-|-----------------------------------------------------------------------|-------------| ------------- |----------------|------------| ----------- |
-| [Project Setup & Repository](https://github.com/dat515-2025/Group-8#) | Lukas       | ✅ Complete    | [X hours]      | Medium     | [Any notes] |
-| [Design Document](https://github.com/dat515-2025/Group-8/blob/main/6design/design.md)          | Both        | ✅ Complete    | 2 Hours        | Easy       | [Any notes] |
-| [Backend API Development](https://github.com/dat515-2025/Group-8/tree/main/7project/backend/app/api)  | Dejan       | ✅ Complete    | 10 hours       | Medium     | [Any notes] |
-| [Database Setup & Models](https://github.com/dat515-2025/Group-8/tree/main/7project/backend/app/models)  | Lukas       | ✅ Complete    | [X hours]      | Medium     | [Any notes] |
-| [Frontend Development](https://github.com/dat515-2025/Group-8/tree/main/7project/frontend)     | Dejan       | 🔄 In Progress | 7 hours so far | Medium     | [Any notes] |
-| [Docker Configuration](https://github.com/dat515-2025/Group-8/blob/main/7project/compose.yml)     | Lukas       | ✅ Complete    | [X hours]      | Easy       | [Any notes] |
-| [Cloud Deployment](https://github.com/dat515-2025/Group-8/blob/main/7project/deployment/app-demo-deployment.yaml)         | Lukas       | ✅ Complete    | [X hours]      | Hard       | [Any notes] |
-| [Testing Implementation](https://github.com/dat515-2025/group-name)   | Dejan       | ❌ Not Started     | [X hours]      | Medium     | [Any notes] |
-| [Documentation](https://github.com/dat515-2025/group-name)            | Both        | ❌ Not Started   | [X hours]      | Easy       | [Any notes] |
-| [Presentation Video](https://github.com/dat515-2025/group-name)       | Both        | ❌ Not Started     | [X hours]      | Medium     | [Any notes] |
+| Task/Component                                                      | Assigned To | Status        | Time Spent | Difficulty | Notes       |
+| ------------------------------------------------------------------- | ----------- | ------------- | ---------- | ---------- | ----------- |
+| Project Setup & Repository                                          | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |
+| [Design Document](https://github.com/dat515-2025/group-name)         | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
+| [Backend API Development](https://github.com/dat515-2025/group-name) | [Name]      | ✅ Complete    | [X hours]  | Hard       | [Any notes] |
+| [Database Setup & Models](https://github.com/dat515-2025/group-name) | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |
+| [Frontend Development](https://github.com/dat515-2025/group-name)    | [Name]      | 🔄 In Progress | [X hours]  | Medium     | [Any notes] |
+| [Docker Configuration](https://github.com/dat515-2025/group-name)    | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
+| [Cloud Deployment](https://github.com/dat515-2025/group-name)        | [Name]      | ✅ Complete    | [X hours]  | Hard       | [Any notes] |
+| [Testing Implementation](https://github.com/dat515-2025/group-name)  | [Name]      | ⏳ Pending     | [X hours]  | Medium     | [Any notes] |
+| [Documentation](https://github.com/dat515-2025/group-name)           | [Name]      | ✅ Complete    | [X hours]  | Easy       | [Any notes] |
+| [Presentation Video](https://github.com/dat515-2025/group-name)      | [Name]      | ✅ Complete    | [X hours]  | Medium     | [Any notes] |

 **Legend**: ✅ Complete | 🔄 In Progress | ⏳ Pending | ❌ Not Started

@@ -348,16 +244,25 @@ curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/authenticated-route
 | [Date]    | Documentation       | [X.X]      | Updated README and design doc       |
 | **Total** |                     | **[XX.X]** |                                     |

-### Dejan
+### [Team Member 2 Name]

-| Date        | Activity             | Hours  | Description                    |
-|-------------|----------------------|--------|--------------------------------|
-| 25.9.       | Design               | 1.5    | 6design                        |
-| 9-11.10.    | Backend APIs         | 10     | Implemented Backend APIs       |
-| 13-15.10.   | Frontend Development | 6.5    | Created user interface mockups |
-| Continually | Documantation        | 3      | Documenting the dev process    |
-| **Total**   |                      | **21** |                                |
+| Date      | Activity             | Hours      | Description                               |
+| --------- | -------------------- | ---------- | ----------------------------------------- |
+| [Date]    | Frontend Development | [X.X]      | Created user interface mockups            |
+| [Date]    | Integration          | [X.X]      | Connected frontend to backend API         |
+| [Date]    | Deployment           | [X.X]      | Docker configuration and cloud deployment |
+| [Date]    | Testing              | [X.X]      | End-to-end testing                        |
+| **Total** |                      | **[XX.X]** |                                           |

+### [Team Member 3 Name] (if applicable)
+
+| Date      | Activity                 | Hours      | Description                      |
+| --------- | ------------------------ | ---------- | -------------------------------- |
+| [Date]    | Database Design          | [X.X]      | Schema design and implementation |
+| [Date]    | Cloud Configuration      | [X.X]      | AWS/GCP setup and configuration  |
+| [Date]    | Performance Optimization | [X.X]      | Caching and query optimization   |
+| [Date]    | Monitoring               | [X.X]      | Logging and monitoring setup     |
+| **Total** |                          | **[XX.X]** |                                  |

 ### Group Total: [XXX.X] hours

@@ -387,8 +292,11 @@ curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/authenticated-route

 [Personal reflection on growth, challenges, and learning]

+#### [Team Member 3 Name] (if applicable)
+
+[Personal reflection on growth, challenges, and learning]

 ---

 **Report Completion Date**: [Date]
-**Last Updated**: 15.10.2025
+**Last Updated**: [Date]
--- a/7project/tofu/main.tf
+++ b/7project/tofu/main.tf
@@ -96,13 +96,6 @@ module "database" {

  phpmyadmin_enabled = var.phpmyadmin_enabled
  cloudflare_domain  = var.cloudflare_domain
-
-  s3_enabled = var.s3_enabled
-  s3_bucket = var.s3_bucket
-  s3_region = var.s3_region
-  s3_endpoint = var.s3_endpoint
-  s3_key_id = var.s3_key_id
-  s3_key_secret = var.s3_key_secret
 }

 #module "argocd" {
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/Chart.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/Chart.yaml
@@ -1,4 +1,4 @@
 apiVersion: v2
 name: maxscale-helm
-version: 1.0.14
+version: 1.0.8
 description: Helm chart for MaxScale related Kubernetes manifests
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/backup.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/backup.yaml
@@ -1,42 +0,0 @@
-{{- if .Values.s3.enabled }}
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: Backup
-metadata:
-  name: backup
-  namespace: mariadb-operator
-spec:
-  mariaDbRef:
-    name: mariadb-repl
-    namespace: mariadb-operator
-  schedule:
-    cron: "0 */3 * * *"
-    suspend: false
-  timeZone: "Europe/Prague"
-  maxRetention: 720h # 30 days
-  compression: bzip2
-  storage:
-    s3:
-      bucket: {{ .Values.s3.bucket | quote }}
-      endpoint: {{ .Values.s3.endpoint | quote }}
-      accessKeyIdSecretKeyRef:
-        name: s3-credentials
-        key: key_id
-      secretAccessKeySecretKeyRef:
-        name: s3-credentials
-        key: secret_key
-      region: {{ .Values.s3.region | quote }}
-      tls:
-        enabled: true
-  # Define a PVC to use as staging area for keeping the backups while they are being processed.
-  stagingStorage:
-    persistentVolumeClaim:
-      resources:
-        requests:
-          storage: 10Gi
-      accessModes:
-        - ReadWriteOnce
-  args:
-    - --single-transaction
-    - --all-databases
-  logLevel: info
-{{- end }}
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/garage.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/templates/garage.yaml
@@ -1,11 +0,0 @@
-{{- if .Values.s3.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-credentials
-  namespace: mariadb-operator
-type: Opaque
-stringData:
-  key_id: "{{ .Values.s3.key_id }}"
-  secret_key: "{{ .Values.s3.key_secret }}"
-{{- end }}
--- a/7project/tofu/modules/maxscale/charts/maxscale-helm/values.yaml
+++ b/7project/tofu/modules/maxscale/charts/maxscale-helm/values.yaml
@@ -14,12 +14,4 @@ metallb:
 phpmyadmin:
  enabled: true

-s3:
-  enabled: false
-  endpoint: ""
-  region: ""
-  bucket: ""
-  key_id: ""
-  key_secret: ""
-
 base_domain: example.com
--- a/7project/tofu/modules/maxscale/main.tf
+++ b/7project/tofu/modules/maxscale/main.tf
@@ -59,7 +59,7 @@ resource "helm_release" "mariadb-operator" {
 resource "helm_release" "maxscale_helm" {
  name       = "maxscale-helm"
  chart      = "${path.module}/charts/maxscale-helm"
-  version    = "1.0.14"
+  version    = "1.0.8"
  depends_on = [helm_release.mariadb-operator-crds, kubectl_manifest.secrets]
  timeout    = 3600

@@ -71,12 +71,6 @@ resource "helm_release" "maxscale_helm" {
    { name = "metallb.primary_ip", value = var.primary_ip },
    { name = "metallb.secondary_ip", value = var.secondary_ip },
    { name = "phpmyadmin.enabled", value = tostring(var.phpmyadmin_enabled) },
-    { name = "base_domain", value = var.cloudflare_domain },
-    { name = "s3.key_id", value = var.s3_key_id },
-    { name = "s3.key_secret", value = var.s3_key_secret },
-    { name = "s3.enabled", value = var.s3_enabled },
-    { name = "s3.endpoint", value = var.s3_endpoint },
-    { name = "s3.region", value = var.s3_region },
-    { name = "s3.bucket", value = var.s3_bucket },
+    { name = "base_domain", value = var.cloudflare_domain }
  ]
 }
--- a/7project/tofu/modules/maxscale/variables.tf
+++ b/7project/tofu/modules/maxscale/variables.tf
@@ -52,39 +52,7 @@ variable "mariadb_user_password" {
 }

 variable "cloudflare_domain" {
-  type     = string
-  default  = "Base cloudflare domain, e.g. example.com"
+  type = string
+  default = "Base cloudflare domain, e.g. example.com"
  nullable = false
-}
-
-variable "s3_key_id" {
-  description = "S3 Key ID for backups"
-  type        = string
-  sensitive   = true
-}
-
-variable "s3_key_secret" {
-  description = "S3 Key Secret for backups"
-  type        = string
-  sensitive   = true
-}
-
-variable "s3_enabled" {
-  description = "Enable S3 backups"
-  type        = bool
-}
-
-variable "s3_endpoint" {
-  description = "S3 endpoint for backups"
-  type        = string
-}
-
-variable "s3_region" {
-  description = "S3 region for backups"
-  type        = string
-}
-
-variable "s3_bucket" {
-  description = "S3 bucket name for backups"
-  type        = string
-}
+}
--- a/7project/tofu/variables.tf
+++ b/7project/tofu/variables.tf
@@ -108,40 +108,3 @@ variable "rabbitmq-password" {
  sensitive   = true
  description = "Admin password for RabbitMQ user"
 }
-
-variable "s3_key_id" {
-  description = "S3 Key ID for backups"
-  type        = string
-  sensitive   = true
-  nullable    = false
-}
-
-variable "s3_key_secret" {
-  description = "S3 Key Secret for backups"
-  type        = string
-  sensitive   = true
-  nullable    = false
-}
-
-variable "s3_enabled" {
-  description = "Enable S3 backups"
-  type        = bool
-}
-
-variable "s3_endpoint" {
-  description = "S3 endpoint for backups"
-  type        = string
-}
-
-variable "s3_region" {
-  description = "S3 region for backups"
-  type        = string
-}
-
-variable "s3_bucket" {
-  description = "S3 bucket name for backups"
-  type        = string
-}
-
-
-