ls1intum · MaximilianAnzinger · Apr 21, 2026 · Jan 27, 2026 · Jan 27, 2026 · Feb 3, 2026
diff --git a/auth-flow.mmd b/auth-flow.mmd
@@ -0,0 +1,32 @@
+sequenceDiagram
+    participant B as Browser
+    participant KC as Keycloak
+    participant Mail as Email (Mailpit dev)
+    participant API as Spring Boot
+    participant DB as PostgreSQL
+
+    B->>KC: login() redirect + PKCE
+    KC-->>B: login / register form
+
+    alt First-time registration
+        B->>KC: submit university email + password
+        KC->>Mail: send verification email
+        B->>KC: click verification link
+    else Returning user
+        B->>KC: submit credentials
+    end
+
+    KC-->>B: JWT access token
+
+    B->>API: GET /api/auth/me + Bearer JWT
+    API->>KC: validate via JWK Set
+    API->>API: check email domain in allowlist
+
+    alt Domain not allowed
+        API-->>B: 403 Forbidden
+        B->>B: domainError = true (Access denied)
+    else Domain allowed
+        API->>DB: findOrCreate user by sub
+        API-->>B: {id, role}
+        B->>B: isAuthenticated = true
+    end
diff --git a/auth-flow.svg b/auth-flow.svg
diff --git a/postcss.config.mjs b/postcss.config.mjs
diff --git a/public/silent-check-sso.html b/public/silent-check-sso.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<html>
+  <body>
+    <script>
+      parent.postMessage(location.href, location.origin);
+    </script>
+  </body>
+</html>
@@ -66,6 +66,7 @@ dependencies {
     implementation 'org.flywaydb:flyway-database-postgresql'
 
     // Security
+    implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
     implementation 'com.nimbusds:nimbus-jose-jwt:10.6'
 
     // API Documentation

diff --git a/server/docker-compose.yml b/server/docker-compose.yml
@@ -38,6 +38,15 @@ services:
     networks:
       - memo-network
 
+  mailpit:
+    image: axllent/mailpit:latest
+    container_name: memo-mailpit
+    ports:
+      - '1025:1025'
+      - '8025:8025'
+    networks:
+      - memo-network
+
   keycloak:
     image: quay.io/keycloak/keycloak:26.4
     container_name: memo-keycloak
@@ -83,7 +92,7 @@ services:
       DB_NAME: memo
       DB_USER: postgres
       DB_PASSWORD: memo
-      KEYCLOAK_ISSUER_URI: http://keycloak:8080/realms/memo
+      KEYCLOAK_ISSUER_URI: http://localhost:8081/realms/memo
       KEYCLOAK_JWK_SET_URI: http://keycloak:8080/realms/memo/protocol/openid-connect/certs
       SPRING_PROFILES_ACTIVE: local
     ports:

diff --git a/server/docker/keycloak/memo-realm.json b/server/docker/keycloak/memo-realm.json
@@ -23,7 +23,23 @@
       "attributes": {
         "access.token.lifespan": "3600",
         "post.logout.redirect.uris": "+"
-      }
+      },
+      "protocolMappers": [
+        {
+          "name": "email",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "userinfo.token.claim": "true",
+            "user.attribute": "email",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "claim.name": "email",
+            "jsonType.label": "String"
+          }
+        }
+      ]
     }
   ],
   "roles": {
@@ -38,36 +54,16 @@
       }
     ]
   },
-  "users": [
-    {
-      "username": "demo",
-      "email": "demo@memo.local",
-      "enabled": true,
-      "firstName": "Demo",
-      "lastName": "User",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "demo",
-          "temporary": false
-        }
-      ],
-      "realmRoles": ["USER"]
-    },
-    {
-      "username": "admin",
-      "email": "admin@memo.local",
-      "enabled": true,
-      "firstName": "Admin",
-      "lastName": "User",
-      "credentials": [
-        {
-          "type": "password",
-          "value": "admin",
-          "temporary": false
-        }
-      ],
-      "realmRoles": ["ADMIN", "USER"]
-    }
-  ]
+  "identityProviders": [],
+  "identityProviderMappers": [],
+  "verifyEmail": true,
+  "smtpServer": {
+    "host": "mailpit",
+    "port": "1025",
+    "from": "noreply@memo.local",
+    "fromDisplayName": "Memo",
+    "ssl": "false",
+    "starttls": "false",
+    "auth": "false"
+  }
 }
diff --git a/server/src/main/java/de/tum/cit/memo/MemoApiApplication.java b/server/src/main/java/de/tum/cit/memo/MemoApiApplication.java
@@ -2,8 +2,10 @@
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.context.properties.ConfigurationPropertiesScan;
 
 @SpringBootApplication
+@ConfigurationPropertiesScan
 public class MemoApiApplication {
 
     public static void main(String[] args) {

diff --git a/server/src/main/java/de/tum/cit/memo/config/MemoProperties.java b/server/src/main/java/de/tum/cit/memo/config/MemoProperties.java
@@ -0,0 +1,18 @@
+package de.tum.cit.memo.config;
+
+import java.util.List;
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@ConfigurationProperties(prefix = "memo")
+@Getter
+@Setter
+public class MemoProperties {
+
+    /**
+     * Allowed email domains for user access. If empty, all domains are permitted.
+     * Example: mytum.de, in.tum.de, tum.de
+     */
+    private List<String> allowedEmailDomains = List.of();
+}
@@ -0,0 +1,104 @@
+package de.tum.cit.memo.controller;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import de.tum.cit.memo.dto.CompetencyImportRow;
+import de.tum.cit.memo.dto.ImportResult;
+import de.tum.cit.memo.service.CompetencyService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.security.SecurityRequirement;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+@RestController
+@RequestMapping("/api/admin")
+@RequiredArgsConstructor
+@Tag(name = "Admin", description = "Admin-only operations")
+@SecurityRequirement(name = "bearer-jwt")
+@SuppressWarnings("null")
+public class AdminController {
+
+    private final CompetencyService competencyService;
+    private final ObjectMapper objectMapper;
+
+    @PostMapping("/competencies/import")
+    @Operation(summary = "Bulk import competencies from JSON array")
+    public ResponseEntity<ImportResult> importJson(
+        @Valid @RequestBody List<CompetencyImportRow> rows
+    ) {
+        return ResponseEntity.ok(competencyService.bulkImportCompetencies(rows));
+    }
+
+    @PostMapping(value = "/competencies/import/file", consumes = "multipart/form-data")
+    @Operation(summary = "Bulk import competencies from uploaded CSV or JSON file")
+    public ResponseEntity<ImportResult> importFile(
+        @RequestParam("file") MultipartFile file
+    ) throws IOException {
+        String originalFilename = file.getOriginalFilename();
+        List<CompetencyImportRow> rows;
+        if (originalFilename != null && originalFilename.endsWith(".csv")) {
+            rows = parseCsv(file);
+        } else {
+            rows = parseJson(file);
+        }
+        return ResponseEntity.ok(competencyService.bulkImportCompetencies(rows));
+    }
+
+    private List<CompetencyImportRow> parseCsv(MultipartFile file) throws IOException {
+        List<CompetencyImportRow> rows = new ArrayList<>();
+        try (BufferedReader reader = new BufferedReader(
+            new InputStreamReader(file.getInputStream(), StandardCharsets.UTF_8))) {
+            String header = reader.readLine();
+            if (header == null) {
+                return rows;
+            }
+            String line;
+            while ((line = reader.readLine()) != null) {
+                String[] parts = splitCsvLine(line);
+                String title = parts.length > 0 ? parts[0].trim() : "";
+                String description = parts.length > 1 ? parts[1].trim() : null;
+                rows.add(new CompetencyImportRow(title, description));
+            }
+        }
+        return rows;
+    }
+
+    private String[] splitCsvLine(String line) {
+        List<String> fields = new ArrayList<>();
+        StringBuilder current = new StringBuilder();
+        boolean inQuotes = false;
+        for (int i = 0; i < line.length(); i++) {
+            char c = line.charAt(i);
+            if (c == '"') {
+                inQuotes = !inQuotes;
+            } else if (c == ',' && !inQuotes) {
+                fields.add(current.toString());
+                current = new StringBuilder();
+            } else {
+                current.append(c);
+            }
+        }
+        fields.add(current.toString());
+        return fields.toArray(new String[0]);
+    }
+
+    private List<CompetencyImportRow> parseJson(MultipartFile file) throws IOException {
+        return objectMapper.readValue(
+            file.getInputStream(),
+            objectMapper.getTypeFactory().constructCollectionType(List.class, CompetencyImportRow.class)
+        );
+    }
+}
diff --git a/server/src/main/java/de/tum/cit/memo/controller/AuthController.java b/server/src/main/java/de/tum/cit/memo/controller/AuthController.java
@@ -0,0 +1,58 @@
+package de.tum.cit.memo.controller;
+
+import de.tum.cit.memo.config.MemoProperties;
+import de.tum.cit.memo.entity.User;
+import de.tum.cit.memo.service.UserService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.security.SecurityRequirement;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import java.util.List;
+import java.util.Map;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/auth")
+@RequiredArgsConstructor
+@Tag(name = "Auth", description = "Authentication and user sync")
+@SecurityRequirement(name = "bearer-jwt")
+public class AuthController {
+
+    private final UserService userService;
+
+    private final MemoProperties memoProperties;
+
+    @GetMapping("/me")
+    @Operation(summary = "Get or create current authenticated user")
+    public ResponseEntity<Map<String, String>> me(@AuthenticationPrincipal Jwt jwt) {
+        List<String> allowedDomains = memoProperties.getAllowedEmailDomains();
+        if (!allowedDomains.isEmpty()) {
+            String email = jwt.getClaimAsString("email");
+            if (email == null || !isAllowedDomain(email, allowedDomains)) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                    .body(Map.of("error", "Email domain not permitted. Please use a university email address."));
+            }
+        }
+        String sub = jwt.getSubject();
+        User user = userService.findOrCreateBySubject(sub);
+        return ResponseEntity.ok(Map.of(
+            "id", user.getId(),
+            "role", user.getRole().name()
+        ));
+    }
+
+    private static boolean isAllowedDomain(String email, List<String> allowedDomains) {
+        int atIndex = email.indexOf('@');
+        if (atIndex < 0) {
+            return false;
+        }
+        String domain = email.substring(atIndex + 1).toLowerCase(java.util.Locale.ROOT);
+        return allowedDomains.contains(domain);
+    }
+}
@@ -0,0 +1,17 @@
+package de.tum.cit.memo.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class CompetencyImportRow {
+
+    @NotBlank(message = "Title is required")
+    private String title;
+
+    private String description;
+}
@@ -0,0 +1,5 @@
+package de.tum.cit.memo.dto;
+
+import java.util.List;
+
+public record ImportResult(int imported, int skipped, List<String> errors) {}