chore: bump api version to 23 [skip ci]

* feat: update to new domain

* feat: add yml files to track changes in server

.gemini/agents/client-updater-bot.md

@@ -0,0 +1,23 @@
+---
+name: client-updater
+description: A bot that updates the client software to the latest version.
+tools: [run_shell_command, read_file, write_file, replace, list_directory, glob, grep_search, ask_user]
+---
+# Instructions
+1. Navigate to the `client` directory.
+2. Execute the following command to check for updates:
+   `npx npm-check-updates --target minor`
+3. Display the resulting list of available minor updates to the user.
+4. If there are packages to update:
+   - Run `npx npm-check-updates --target minor -u` to update `package.json`.
+   - Run `npm install` to update the `package-lock.json` and install the new versions.
+5. Run the validation script to ensure stability:
+   `../tools/check-frontend.sh`
+6. If the validation passes:
+   - Create a new branch (e.g., `update-deps-[date]`).
+   - Commit the changes to `package.json` and `package-lock.json`.
+   - Push and create a Pull Request (using `gh pr create` if available).
+7. If validation fails (lint, build, or test issues):
+   - Diagnose the failure using `grep_search` and `read_file`.
+   - Fix the issues, then retry the validation and PR steps.
+8. Report the final status and the PR link to the user.

.gemini/commands/issue.toml

@@ -0,0 +1,12 @@
+description = "Create a formatted GitHub issue"
+prompt = """
+Act as a project manager. Based on the following input: {{args}}
+Create a GitHub issue using the `gh` CLI tool with this exact structure:
+- Title: [Feat/Bug] <short summary>
+- Body: A detailed description, technical requirements, and acceptance criteria.
+- Label: Automatically determine if it's 'bug', 'enhencement', or 'task'.
+
+Once the user confirms the plan, execute the command:
+`gh issue create --title "[Type] Title" --body "..." --label "..."
+"""
+

.github/workflows/cd-main.yml

@@ -109,6 +109,8 @@ jobs:
             -var="db_name=${{ secrets.DB_NAME }}" \
             -var="security_key=${{ secrets.JWT_SECURITY_KEY }}" \
             -var="mailgun_apikey=${{ secrets.MAILGUN_API_KEY }}" \
+            -var="r2_access_key=${{ secrets.R2_ACCESS_KEY_ID }}" \
+            -var="r2_secret_key=${{ secrets.R2_SECRET_ACCESS_KEY }}" \
             -var="backend_image=${{ steps.deploy-vars.outputs.backend_image }}" \
             -var="frontend_image=${{ steps.deploy-vars.outputs.frontend_image }}"
           terraform show -json tfplan > tfplan.json

.github/workflows/cd-pr.yml

@@ -23,8 +23,6 @@ jobs:
 
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "1.10.0"
 
       - name: Show Terraform provider versions
         working-directory: terraform-stg
@@ -68,61 +66,13 @@ jobs:
         working-directory: terraform-stg
         run: terraform validate
 
-      - name: Test TLS from subprocess
-        run: |
-          cat > /tmp/tlstest.sh << 'EOF'
-          #!/bin/bash
-          echo "Testing from subprocess PID: $$"
-          echo "GODEBUG=$GODEBUG"
-          openssl s_client -connect 191.252.159.227:6443 </dev/null 2>&1 | grep -E "CONNECTED|error|timeout|TLS"
-          EOF
-          chmod +x /tmp/tlstest.sh
-          # Run in a subprocess the same way Terraform spawns providers
-          bash /tmp/tlstest.sh &
-          wait $!
-
-      - name: Check system resources
-        run: |
-          echo "--- Memory ---"
-          free -h
-          echo "--- Ulimits ---"
-          ulimit -a
-          echo "--- OOM kills ---"
-          sudo dmesg | grep -i "killed process\|oom" | tail -20
-
-      - name: Test provider binary directly
-        working-directory: terraform-stg
-        run: |
-          PROVIDER=".terraform/providers/registry.terraform.io/hashicorp/kubernetes/2.38.0/linux_amd64/terraform-provider-kubernetes_v2.38.0_x5"
-          echo "--- Provider binary info ---"
-          ls -lh $PROVIDER
-          file $PROVIDER
-          echo "--- Run provider directly ---"
-          timeout 5 $PROVIDER --help 2>&1 || true
-
-      - name: Test TLS with CA verification like Terraform does
-        run: |
-          kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > /tmp/ca.crt
-          kubectl config view --raw -o jsonpath='{.users[0].user.client-certificate-data}' | base64 -d > /tmp/client.crt
-          kubectl config view --raw -o jsonpath='{.users[0].user.client-key-data}' | base64 -d > /tmp/client.key
-      
-          echo "--- Test with CA verification (exactly like Terraform) ---"
-          curl -v \
-            --cacert /tmp/ca.crt \
-            --cert /tmp/client.crt \
-            --key /tmp/client.key \
-            https://191.252.159.227:6443/api/v1/namespaces/tasknote-stg 2>&1 | grep -E "TLS|SSL|Connected|error|timeout|HTTP|issuer|subject"
-
       - name: Terraform Plan
         id: check-changes
         working-directory: terraform-stg
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          TF_LOG: DEBUG
-          GODEBUG: http2client=1
         run: |
-          echo "Start: $(date)"
           timeout 3m terraform plan -input=false -out=tfplan \
             -var="db_user=${{ secrets.DB_USER }}" \
             -var="db_password=${{ secrets.DB_PASSWORD }}" \
@@ -132,7 +82,6 @@ jobs:
             -var="backend_image=${{ steps.deploy-vars.outputs.backend_image }}" \
             -var="frontend_image=${{ steps.deploy-vars.outputs.frontend_image }}" \
             -var="deploy_version=${{ github.run_id }}"
-          echo "End: $(date)"
           terraform show -json tfplan > tfplan.json
           if jq -e '.resource_changes | length == 0' tfplan.json >/dev/null; then
             echo "no_changes=true" >> "$GITHUB_OUTPUT"
@@ -173,7 +122,7 @@ jobs:
 
       - name: Setup Kubeconfig
         run: |
-          mkdir -p ${{ runner.temp }}/.kube
+          mkdir -p ~/.kube
           echo "${{ secrets.KUBECONFIG_DATA }}" | base64 -d > ~/.kube/config
           chmod 600 ~/.kube/config
 

.github/workflows/ci-pr-backend.yml

@@ -10,6 +10,7 @@ on:
       - 'server/**/*.java'
       - 'server/**/*.xml'
       - 'server/pom.xml'
+      - 'server/**/*.yml'
       - '.github/workflows/server-ci.yml'
 
 jobs:

.gitignore

@@ -7,6 +7,8 @@ client.pnp.js
 
 # testing
 client/coverage
+client/cypress/videos
+client/cypress/screenshots
 
 # production
 client/build
@@ -34,3 +36,18 @@ yarn-error.log*
 
 # Schema Spy
 schemaspy/output/
+
+# Terraform
+.terraform/
+*.tfstate
+*.tfstate.backup
+*.tfplan
+*.tfvars
+*.tfvars.json
+override.tf
+override.tf.json
+_override.tf
+_override.tf.json
+.terraformrc
+terraform.rc
+

client/Caddyfile

@@ -34,7 +34,7 @@
       media-src 'self';
       object-src 'none';
       script-src 'unsafe-inline' 'report-sample' 'self' https://*.cloudfront.net;
-      style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com;
+      style-src 'report-sample' 'self' https://cdn.jsdelivr.net/ https://fonts.googleapis.com 'sha256-+OsIn6RhyCZCUkkvtHxFtP0kU3CGdGeLjDd9Fzqdl3o=';
       worker-src 'none';
     "
     Referrer-Policy "same-origin"

client/cypress.config.ts

@@ -0,0 +1,16 @@
+import { defineConfig } from 'cypress';
+
+export default defineConfig({
+  e2e: {
+    baseUrl: 'http://localhost:5000',
+    specPattern: 'cypress/e2e/**/*.cy.{ts,tsx}',
+    supportFile: 'cypress/support/e2e.ts',
+    videosFolder: 'cypress/videos',
+    screenshotsFolder: 'cypress/screenshots',
+    viewportWidth: 1280,
+    viewportHeight: 720,
+    setupNodeEvents(on, config) {
+      return config;
+    }
+  }
+});

client/cypress/e2e/auth.cy.ts

@@ -0,0 +1,141 @@
+/**
+ * E2E tests for authentication flows: User Signup and Login.
+ *
+ * These tests cover the primary user journeys for account creation
+ * and logging in to the TaskNote application.
+ */
+describe('Authentication', () => {
+  /**
+   * User Signup (Registration) flow
+   */
+  describe('Signup', () => {
+    beforeEach(() => {
+      cy.visit('/register');
+    });
+
+    it('displays the registration form', () => {
+      cy.contains('h2', 'Create account').should('be.visible');
+      cy.get('input[name="email"]').should('be.visible');
+      cy.get('input[name="password"]').should('be.visible');
+      cy.get('input[name="passwordAgain"]').should('be.visible');
+      cy.get('button[type="submit"]').should('be.visible').and('contain', 'Create account');
+    });
+
+    it('shows a validation error when the form is submitted empty', () => {
+      cy.get('button[type="submit"]').click();
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('shows a validation error when passwords do not match', () => {
+      cy.get('input[name="email"]').type('testuser@example.com');
+      cy.get('input[name="password"]').type('Password1!');
+      cy.get('input[name="passwordAgain"]').type('DifferentPass1!');
+      cy.get('button[type="submit"]').click();
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('navigates to the login page via the login link', () => {
+      cy.contains('a', 'Login').first().click();
+      cy.url().should('include', '/login');
+    });
+
+    it('navigates back to the landing page via the back-to-home link', () => {
+      cy.contains('a', 'Back to home').click();
+      cy.url().should('eq', `${Cypress.config('baseUrl')}/`);
+    });
+
+    it('submits the signup form and shows a confirmation message on success', () => {
+      cy.intercept({ method: 'PUT', url: /\/auth\/sign-up/ }, {
+        statusCode: 201,
+        body: { message: 'User created' }
+      }).as('signUp');
+
+      cy.get('input[name="email"]').type(`newuser${Date.now()}@example.com`);
+      cy.get('input[name="password"]').type('Password1!');
+      cy.get('input[name="passwordAgain"]').type('Password1!');
+      cy.get('button[type="submit"]').click();
+
+      cy.wait('@signUp');
+      cy.get('.alert-success').should('be.visible');
+    });
+
+    it('displays an error alert when the API returns an error on signup', () => {
+      cy.intercept({ method: 'PUT', url: /\/auth\/sign-up/ }, {
+        statusCode: 409,
+        body: { message: 'Email already in use' }
+      }).as('signUpFail');
+
+      cy.get('input[name="email"]').type(`existing${Date.now()}@example.com`);
+      cy.get('input[name="password"]').type('Password1!');
+      cy.get('input[name="passwordAgain"]').type('Password1!');
+      cy.get('button[type="submit"]').click();
+
+      cy.wait('@signUpFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+  });
+
+  /**
+   * User Login flow
+   */
+  describe('Login', () => {
+    beforeEach(() => {
+      cy.visit('/login');
+    });
+
+    it('displays the login form', () => {
+      cy.contains('h2', 'Login').should('be.visible');
+      cy.get('input[name="email"]').should('be.visible');
+      cy.get('input[name="password"]').should('be.visible');
+      cy.get('button[type="submit"]').should('be.visible').and('contain', 'Login');
+    });
+
+    it('shows a validation error when the form is submitted empty', () => {
+      cy.get('button[type="submit"]').click();
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('navigates to the register page via the create account link', () => {
+      cy.contains('a', 'Create account').click();
+      cy.url().should('include', '/register');
+    });
+
+    it('navigates back to the landing page via the back-to-home link', () => {
+      cy.contains('a', 'Back to home').click();
+      cy.url().should('eq', `${Cypress.config('baseUrl')}/`);
+    });
+
+    it('navigates to the reset password page via the forgot password link', () => {
+      cy.contains('a', 'Forgot your password?').click();
+      cy.url().should('include', '/reset-password');
+    });
+
+    it('redirects to home after a successful login', () => {
+      cy.intercept({ method: 'POST', url: /\/auth\/sign-in/ }, {
+        statusCode: 200,
+        body: { token: 'fake-jwt-token', email: 'user@example.com' }
+      }).as('signIn');
+
+      cy.get('input[name="email"]').type('user@example.com');
+      cy.get('input[name="password"]').type('Password1!');
+      cy.get('button[type="submit"]').click();
+
+      cy.wait('@signIn');
+      cy.url().should('include', '/home');
+    });
+
+    it('displays an error alert when the API returns an error on login', () => {
+      cy.intercept({ method: 'POST', url: /\/auth\/sign-in/ }, {
+        statusCode: 401,
+        body: { message: 'Invalid credentials' }
+      }).as('signInFail');
+
+      cy.get('input[name="email"]').type('user@example.com');
+      cy.get('input[name="password"]').type('wrongpassword');
+      cy.get('button[type="submit"]').click();
+
+      cy.wait('@signInFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+  });
+});

client/cypress/e2e/home.cy.ts

@@ -0,0 +1,199 @@
+/**
+ * E2E tests for Home page management: searching and filtering tasks and notes.
+ */
+
+const mockUser = {
+  userId: 1,
+  name: 'Test User',
+  email: 'test@example.com',
+  admin: false,
+  createdAt: '2026-01-01T00:00:00.000Z',
+  gravatarImageUrl: '',
+  lang: 'en'
+};
+
+const mockTasks = [
+  {
+    id: 1,
+    description: 'Buy groceries',
+    done: false,
+    highPriority: true,
+    dueDate: '2026-06-01',
+    dueDateFmt: 'Jun 1, 2026',
+    lastUpdate: '2026-05-01',
+    tag: 'personal',
+    urls: []
+  },
+  {
+    id: 2,
+    description: 'Write report',
+    done: false,
+    highPriority: false,
+    dueDate: '',
+    dueDateFmt: '',
+    lastUpdate: '2026-05-02',
+    tag: 'work',
+    urls: []
+  }
+];
+
+const mockNotes = [
+  {
+    id: 1,
+    title: 'Meeting notes',
+    description: 'Discuss quarterly goals',
+    url: null,
+    tag: 'work',
+    lastUpdate: '2026-05-01',
+    shared: false,
+    shareToken: null
+  },
+  {
+    id: 2,
+    title: 'Recipe',
+    description: 'Pasta carbonara recipe',
+    url: null,
+    tag: 'personal',
+    lastUpdate: '2026-05-02',
+    shared: false,
+    shareToken: null
+  }
+];
+
+const mockTags = ['personal', 'work'];
+
+describe('Home Management', () => {
+  beforeEach(() => {
+    cy.intercept('GET', /\/rest\/user-sessions\/refresh/, {
+      statusCode: 200,
+      body: { token: 'fake-jwt-token', ...mockUser }
+    }).as('refreshToken');
+
+    cy.intercept('GET', /\/rest\/home\/tasks\/tags/, {
+      statusCode: 200,
+      body: mockTags
+    }).as('getTags');
+
+    cy.intercept('GET', /\/rest\/tasks$/, {
+      statusCode: 200,
+      body: mockTasks
+    }).as('getTasks');
+
+    cy.intercept('GET', /\/rest\/notes$/, {
+      statusCode: 200,
+      body: mockNotes
+    }).as('getNotes');
+
+    cy.visit('/home', {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('TASKNOTE-TOKEN', 'fake-jwt-token');
+        win.localStorage.setItem('TASKNOTE-USER', JSON.stringify(mockUser));
+      }
+    });
+  });
+
+  /**
+   * Home page display
+   */
+  describe('Display', () => {
+    it('shows tasks and notes after loading', () => {
+      cy.wait('@getTasks');
+      cy.wait('@getNotes');
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Write report').should('be.visible');
+      cy.contains('Meeting notes').should('be.visible');
+      cy.contains('Recipe').should('be.visible');
+    });
+  });
+
+  /**
+   * Search / text filtering
+   */
+  describe('Search', () => {
+    beforeEach(() => {
+      cy.wait('@getTasks');
+      cy.wait('@getNotes');
+    });
+
+    it('filters items by search text matching a task description', () => {
+      cy.get('input[placeholder="Filter tasks & notes"]').type('groceries');
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Write report').should('not.exist');
+      cy.contains('Meeting notes').should('not.exist');
+      cy.contains('Recipe').should('not.exist');
+    });
+
+    it('filters items by search text matching a note title', () => {
+      cy.get('input[placeholder="Filter tasks & notes"]').type('Meeting');
+
+      cy.contains('Meeting notes').should('be.visible');
+      cy.contains('Buy groceries').should('not.exist');
+      cy.contains('Recipe').should('not.exist');
+    });
+
+    it('restores all items after clearing the search', () => {
+      cy.get('input[placeholder="Filter tasks & notes"]').type('groceries');
+      cy.contains('Write report').should('not.exist');
+
+      cy.get('input[placeholder="Filter tasks & notes"]').clear();
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Meeting notes').should('be.visible');
+    });
+  });
+
+  /**
+   * Dropdown filter
+   */
+  describe('Dropdown Filter', () => {
+    beforeEach(() => {
+      cy.wait('@getTasks');
+      cy.wait('@getNotes');
+    });
+
+    it('shows only tasks when Tasks filter is selected', () => {
+      cy.get('[data-testid="dropdown-tag-filter"]').click();
+      cy.contains('Tasks').click();
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Write report').should('be.visible');
+      cy.contains('Meeting notes').should('not.exist');
+      cy.contains('Recipe').should('not.exist');
+    });
+
+    it('shows only notes when Notes filter is selected', () => {
+      cy.get('[data-testid="dropdown-tag-filter"]').click();
+      cy.contains('Notes').click();
+
+      cy.contains('Meeting notes').should('be.visible');
+      cy.contains('Recipe').should('be.visible');
+      cy.contains('Buy groceries').should('not.exist');
+      cy.contains('Write report').should('not.exist');
+    });
+
+    it('shows everything when Everything filter is selected', () => {
+      cy.get('[data-testid="dropdown-tag-filter"]').click();
+      cy.contains('Tasks').click();
+
+      cy.get('[data-testid="dropdown-tag-filter"]').click();
+      cy.contains('Everything').click();
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Meeting notes').should('be.visible');
+    });
+
+    it('filters by tag when a tag is selected', () => {
+      cy.wait('@getTags');
+
+      cy.get('[data-testid="dropdown-tag-filter"]').click();
+      cy.contains('#personal').click();
+
+      cy.contains('Buy groceries').should('be.visible');
+      cy.contains('Recipe').should('be.visible');
+      cy.contains('Write report').should('not.exist');
+      cy.contains('Meeting notes').should('not.exist');
+    });
+  });
+});

client/cypress/e2e/notes.cy.ts

@@ -0,0 +1,268 @@
+/**
+ * E2E tests for Notes Management: Create, Update, Delete, and Share notes.
+ */
+
+const mockUser = {
+  userId: 1,
+  name: 'Test User',
+  email: 'test@example.com',
+  admin: false,
+  createdAt: '2026-01-01T00:00:00.000Z',
+  gravatarImageUrl: '',
+  lang: 'en'
+};
+
+const mockNote = {
+  id: 1,
+  title: 'Meeting notes',
+  description: 'Discuss quarterly goals',
+  url: null,
+  tag: 'work',
+  lastUpdate: '2026-05-01',
+  shared: false,
+  shareToken: null
+};
+
+describe('Notes Management', () => {
+  /**
+   * Sets up authentication intercepts and visits the given path.
+   *
+   * @param {string} path - The path to visit.
+   */
+  const visitWithAuth = (path: string): void => {
+    cy.intercept('GET', /\/rest\/user-sessions\/refresh/, {
+      statusCode: 200,
+      body: { token: 'fake-jwt-token', ...mockUser }
+    }).as('refreshToken');
+
+    cy.intercept('GET', /\/rest\/home\/tasks\/tags/, {
+      statusCode: 200,
+      body: ['work', 'personal']
+    }).as('getTags');
+
+    cy.visit(path, {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('TASKNOTE-TOKEN', 'fake-jwt-token');
+        win.localStorage.setItem('TASKNOTE-USER', JSON.stringify(mockUser));
+      }
+    });
+  };
+
+  /**
+   * Create note
+   */
+  describe('Create', () => {
+    beforeEach(() => {
+      visitWithAuth('/notes/new');
+    });
+
+    it('displays the add note form', () => {
+      cy.contains('Add Note').should('be.visible');
+      cy.get('input[name="note_title"]').should('be.visible');
+      cy.get('textarea[name="note_description"]').should('be.visible');
+      cy.contains('button', 'Save note').should('be.visible');
+    });
+
+    it('shows a validation error when submitted without a title', () => {
+      cy.contains('button', 'Save note').click();
+
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('shows a validation error when submitted without content', () => {
+      cy.get('input[name="note_title"]').type('A note title');
+      cy.contains('button', 'Save note').click();
+
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('creates a note and navigates to home on success', () => {
+      cy.intercept('POST', /\/rest\/notes/, {
+        statusCode: 201,
+        body: {
+          id: 10,
+          title: 'New note',
+          description: 'Some content',
+          url: null,
+          tag: '',
+          lastUpdate: '',
+          shared: false,
+          shareToken: null
+        }
+      }).as('createNote');
+
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.get('input[name="note_title"]').type('New note');
+      cy.get('textarea[name="note_description"]').type('Some content');
+      cy.contains('button', 'Save note').click();
+
+      cy.wait('@createNote');
+      cy.url().should('include', '/home');
+    });
+
+    it('shows an error alert when the API returns an error on create', () => {
+      cy.intercept('POST', /\/rest\/notes/, {
+        statusCode: 500,
+        body: { message: 'Internal Server Error' }
+      }).as('createNoteFail');
+
+      cy.get('input[name="note_title"]').type('Failing note');
+      cy.get('textarea[name="note_description"]').type('Some content');
+      cy.contains('button', 'Save note').click();
+
+      cy.wait('@createNoteFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('navigates back to home when Cancel is clicked', () => {
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.contains('button', 'Cancel').click();
+
+      cy.url().should('include', '/home');
+    });
+  });
+
+  /**
+   * Update note
+   */
+  describe('Update', () => {
+    beforeEach(() => {
+      cy.intercept('GET', /\/rest\/notes\/\d+/, {
+        statusCode: 200,
+        body: mockNote
+      }).as('getNote');
+
+      visitWithAuth('/notes/edit/1');
+      cy.wait('@getNote');
+    });
+
+    it('pre-fills the form with the existing note data', () => {
+      cy.get('input[name="note_title"]').should('have.value', 'Meeting notes');
+      cy.get('textarea[name="note_description"]').should('have.value', 'Discuss quarterly goals');
+    });
+
+    it('updates the note and navigates to home on success', () => {
+      cy.intercept('PATCH', /\/rest\/notes\/\d+/, {
+        statusCode: 200,
+        body: { ...mockNote, title: 'Updated meeting notes' }
+      }).as('updateNote');
+
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.get('input[name="note_title"]').clear().type('Updated meeting notes');
+      cy.contains('button', 'Save note').click();
+
+      cy.wait('@updateNote');
+      cy.url().should('include', '/home');
+    });
+
+    it('shows an error alert when the update API call fails', () => {
+      cy.intercept('PATCH', /\/rest\/notes\/\d+/, {
+        statusCode: 500,
+        body: { message: 'Internal Server Error' }
+      }).as('updateNoteFail');
+
+      cy.get('input[name="note_title"]').clear().type('Updated note');
+      cy.contains('button', 'Save note').click();
+
+      cy.wait('@updateNoteFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+  });
+
+  /**
+   * Delete note
+   */
+  describe('Delete', () => {
+    beforeEach(() => {
+      cy.intercept('GET', /\/rest\/tasks$/, {
+        statusCode: 200,
+        body: []
+      }).as('getTasks');
+
+      cy.intercept('GET', /\/rest\/notes$/, {
+        statusCode: 200,
+        body: [mockNote]
+      }).as('getNotes');
+
+      visitWithAuth('/home');
+      cy.wait('@getNotes');
+    });
+
+    it('deletes a note via the note dropdown menu', () => {
+      cy.intercept('DELETE', /\/rest\/notes\/\d+/, {
+        statusCode: 204
+      }).as('deleteNote');
+
+      cy.get('[data-testid="note-dropdown-menu-1"]').click();
+      cy.get('[data-testid="note-dropdown-delete-item-1"]').click();
+
+      cy.wait('@deleteNote');
+    });
+  });
+
+  /**
+   * Share note
+   */
+  describe('Share', () => {
+    beforeEach(() => {
+      cy.intercept('GET', /\/rest\/tasks$/, {
+        statusCode: 200,
+        body: []
+      }).as('getTasks');
+
+      cy.intercept('GET', /\/rest\/notes$/, {
+        statusCode: 200,
+        body: [mockNote]
+      }).as('getNotes');
+
+      visitWithAuth('/home');
+      cy.wait('@getNotes');
+    });
+
+    it('shares a note via the note dropdown menu', () => {
+      cy.intercept('PUT', /\/rest\/notes\/\d+\/share/, {
+        statusCode: 200,
+        body: { ...mockNote, shared: true, shareToken: 'abc123' }
+      }).as('shareNote');
+
+      cy.get('[data-testid="note-dropdown-menu-1"]').click();
+      cy.get('[data-testid="note-dropdown-share-item-1"]').click();
+
+      cy.wait('@shareNote');
+    });
+
+    it('unshares a shared note via the note dropdown menu', () => {
+      const sharedNote = { ...mockNote, shared: true, shareToken: 'abc123' };
+
+      cy.intercept('GET', /\/rest\/notes$/, {
+        statusCode: 200,
+        body: [sharedNote]
+      }).as('getSharedNotes');
+
+      cy.intercept('PUT', /\/rest\/notes\/\d+\/unshare/, {
+        statusCode: 200,
+        body: { ...sharedNote, shared: false, shareToken: null }
+      }).as('unshareNote');
+
+      cy.visit('/home', {
+        onBeforeLoad(win) {
+          win.localStorage.setItem('TASKNOTE-TOKEN', 'fake-jwt-token');
+          win.localStorage.setItem('TASKNOTE-USER', JSON.stringify(mockUser));
+        }
+      });
+
+      cy.wait('@getSharedNotes');
+
+      cy.get('[data-testid="note-dropdown-menu-1"]').click();
+      cy.get('[data-testid="note-dropdown-share-item-1"]').click();
+
+      cy.wait('@unshareNote');
+    });
+  });
+});

client/cypress/e2e/tasks.cy.ts

@@ -0,0 +1,226 @@
+/**
+ * E2E tests for Task Management: Create, Update, and Delete tasks.
+ */
+
+const mockUser = {
+  userId: 1,
+  name: 'Test User',
+  email: 'test@example.com',
+  admin: false,
+  createdAt: '2026-01-01T00:00:00.000Z',
+  gravatarImageUrl: '',
+  lang: 'en'
+};
+
+const mockTask = {
+  id: 1,
+  description: 'Buy groceries',
+  done: false,
+  highPriority: false,
+  dueDate: '',
+  dueDateFmt: '',
+  lastUpdate: '2026-05-01',
+  tag: 'personal',
+  urls: []
+};
+
+describe('Task Management', () => {
+  /**
+   * Sets up authentication intercepts and visits the given path.
+   *
+   * @param {string} path - The path to visit.
+   */
+  const visitWithAuth = (path: string): void => {
+    cy.intercept('GET', /\/rest\/user-sessions\/refresh/, {
+      statusCode: 200,
+      body: { token: 'fake-jwt-token', ...mockUser }
+    }).as('refreshToken');
+
+    cy.intercept('GET', /\/rest\/home\/tasks\/tags/, {
+      statusCode: 200,
+      body: ['personal', 'work']
+    }).as('getTags');
+
+    cy.visit(path, {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('TASKNOTE-TOKEN', 'fake-jwt-token');
+        win.localStorage.setItem('TASKNOTE-USER', JSON.stringify(mockUser));
+      }
+    });
+  };
+
+  /**
+   * Create task
+   */
+  describe('Create', () => {
+    beforeEach(() => {
+      visitWithAuth('/tasks/new');
+    });
+
+    it('displays the add task form', () => {
+      cy.contains('Add Task').should('be.visible');
+      cy.get('input[name="description"]').should('be.visible');
+      cy.get('input[name="url"]').should('be.visible');
+      cy.get('input[name="tag"]').should('be.visible');
+      cy.contains('button', 'Save task').should('be.visible');
+    });
+
+    it('shows a validation error when submitted without a description', () => {
+      cy.contains('button', 'Save task').click();
+
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('creates a task and navigates to home on success', () => {
+      cy.intercept('POST', /\/rest\/tasks/, {
+        statusCode: 201,
+        body: {
+          id: 10,
+          description: 'New task',
+          done: false,
+          highPriority: false,
+          dueDate: '',
+          dueDateFmt: '',
+          lastUpdate: '',
+          tag: '',
+          urls: []
+        }
+      }).as('createTask');
+
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.get('input[name="description"]').type('New task');
+      cy.contains('button', 'Save task').click();
+
+      cy.wait('@createTask');
+      cy.url().should('include', '/home');
+    });
+
+    it('shows an error alert when the API returns an error on create', () => {
+      cy.intercept('POST', /\/rest\/tasks/, {
+        statusCode: 500,
+        body: { message: 'Internal Server Error' }
+      }).as('createTaskFail');
+
+      cy.get('input[name="description"]').type('Failing task');
+      cy.contains('button', 'Save task').click();
+
+      cy.wait('@createTaskFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+
+    it('navigates back to home when Cancel is clicked', () => {
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.contains('button', 'Cancel').click();
+
+      cy.url().should('include', '/home');
+    });
+  });
+
+  /**
+   * Update task
+   */
+  describe('Update', () => {
+    beforeEach(() => {
+      cy.intercept('GET', /\/rest\/tasks\/\d+/, {
+        statusCode: 200,
+        body: mockTask
+      }).as('getTask');
+
+      visitWithAuth('/tasks/edit/1');
+      cy.wait('@getTask');
+    });
+
+    it('pre-fills the form with the existing task data', () => {
+      cy.get('input[name="description"]').should('have.value', 'Buy groceries');
+    });
+
+    it('updates the task and navigates to home on success', () => {
+      cy.intercept('PATCH', /\/rest\/tasks\/\d+/, {
+        statusCode: 200,
+        body: { ...mockTask, description: 'Buy more groceries' }
+      }).as('updateTask');
+
+      cy.intercept('GET', /\/rest\/tasks$/, { statusCode: 200, body: [] }).as('getTasks');
+      cy.intercept('GET', /\/rest\/notes$/, { statusCode: 200, body: [] }).as('getNotes');
+
+      cy.get('input[name="description"]').clear().type('Buy more groceries');
+      cy.contains('button', 'Save task').click();
+
+      cy.wait('@updateTask');
+      cy.url().should('include', '/home');
+    });
+
+    it('shows an error alert when the update API call fails', () => {
+      cy.intercept('PATCH', /\/rest\/tasks\/\d+/, {
+        statusCode: 500,
+        body: { message: 'Internal Server Error' }
+      }).as('updateTaskFail');
+
+      cy.get('input[name="description"]').clear().type('Updated task');
+      cy.contains('button', 'Save task').click();
+
+      cy.wait('@updateTaskFail');
+      cy.get('.alert-danger').should('be.visible');
+    });
+  });
+
+  /**
+   * Mark as done / undone
+   */
+  describe('Mark as Done', () => {
+    beforeEach(() => {
+      cy.intercept('GET', /\/rest\/tasks$/, {
+        statusCode: 200,
+        body: [mockTask]
+      }).as('getTasks');
+
+      cy.intercept('GET', /\/rest\/notes$/, {
+        statusCode: 200,
+        body: []
+      }).as('getNotes');
+
+      visitWithAuth('/home');
+      cy.wait('@getTasks');
+    });
+
+    it('marks a task as done via the task dropdown menu', () => {
+      cy.intercept('DELETE', /\/rest\/tasks\/\d+/, {
+        statusCode: 204
+      }).as('markDone');
+
+      cy.get('[data-testid="task-dropdown-menu-1"]').click();
+      cy.get('[data-testid="task-dropdown-done-item-1"]').click();
+
+      cy.wait('@markDone');
+    });
+
+    it('marks a done task as undone via the task dropdown menu', () => {
+      cy.intercept('GET', /\/rest\/tasks$/, {
+        statusCode: 200,
+        body: [{ ...mockTask, done: true }]
+      }).as('getDoneTasks');
+
+      cy.intercept('DELETE', /\/rest\/tasks\/\d+/, {
+        statusCode: 204
+      }).as('markUndone');
+
+      cy.visit('/home', {
+        onBeforeLoad(win) {
+          win.localStorage.setItem('TASKNOTE-TOKEN', 'fake-jwt-token');
+          win.localStorage.setItem('TASKNOTE-USER', JSON.stringify(mockUser));
+        }
+      });
+
+      cy.wait('@getDoneTasks');
+
+      cy.get('[data-testid="task-dropdown-menu-1"]').click();
+      cy.get('[data-testid="task-dropdown-done-item-1"]').click();
+
+      cy.wait('@markUndone');
+    });
+  });
+});

client/cypress/support/commands.ts

@@ -0,0 +1,26 @@
+// Custom Cypress commands.
+// Add any project-wide custom commands here.
+
+// Prevent TypeScript errors for cy.login usage
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Cypress {
+    interface Chainable {
+      /**
+       * Custom command to log in via the UI.
+       * @param email - User email address
+       * @param password - User password
+       */
+      login(email: string, password: string): Chainable<void>;
+    }
+  }
+}
+
+Cypress.Commands.add('login', (email: string, password: string) => {
+  cy.visit('/login');
+  cy.get('input[name="email"]').clear().type(email);
+  cy.get('input[name="password"]').clear().type(password);
+  cy.get('button[type="submit"]').click();
+});
+
+export {};

client/cypress/support/e2e.ts

@@ -0,0 +1,4 @@
+// Support file for Cypress E2E tests.
+// This file is loaded before each spec file.
+
+import './commands';

client/cypress/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext", "dom"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "types": ["cypress", "node"],
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "strict": false,
+    "skipLibCheck": true
+  },
+  "include": [
+    "./**/*.ts",
+    "./**/*.tsx"
+  ]
+}

client/eslint.config.mjs

@@ -21,6 +21,7 @@ export default [
   {
     ignores: [
       '**/__test__/*',
+      'cypress/**',
       '**/assets/*',
       '**/*.scss',
       '**/*.css',

client/package.json

@@ -13,25 +13,25 @@
   "private": true,
   "dependencies": {
     "@popperjs/core": "^2.11.8",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.7.0",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^5.2.0",
+    "@vitejs/plugin-react": "^6.0.1",
     "bootstrap": "^5.3.8",
-    "dompurify": "^3.4.1",
-    "i18next": "^25.10.10",
-    "react": "^19.2.5",
+    "dompurify": "^3.4.2",
+    "i18next": "^26.1.0",
+    "react": "^19.2.6",
     "react-bootstrap": "^2.10.10",
     "react-bootstrap-icons": "^1.11.6",
     "react-charts": "^3.0.0-beta.57",
     "react-datepicker": "^9.1.0",
-    "react-dom": "^19.2.5",
-    "react-i18next": "^16.6.6",
+    "react-dom": "^19.2.6",
+    "react-i18next": "^17.0.7",
     "react-markdown": "^10.1.0",
-    "react-router": "^7.14.2",
+    "react-router": "^7.15.0",
     "react-router-bootstrap": "^0.26.3",
     "remark-gfm": "^4.0.1",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.2"
+    "typescript": "^6.0.3",
+    "vite": "^8.0.12"
   },
   "scripts": {
     "start": "vite --host",
@@ -41,7 +41,10 @@
     "test:no-watch": "vitest --watch=false",
     "test:coverage": "vitest run --coverage --watch=false",
     "lint": "./node_modules/.bin/eslint",
-    "lint:fix": "./node_modules/.bin/eslint --fix"
+    "lint:fix": "./node_modules/.bin/eslint --fix",
+    "cypress:open": "cypress open",
+    "cypress:run": "cypress run",
+    "cypress:run:headless": "cypress run --headless"
   },
   "eslintConfig": {
     "extends": [
@@ -62,7 +65,7 @@
     ]
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.5",
+    "@eslint/compat": "^2.1.0",
     "@eslint/eslintrc": "^3.3.5",
     "@eslint/js": "^9.39.4",
     "@stylistic/eslint-plugin": "^5.10.0",
@@ -72,20 +75,21 @@
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.14",
     "@types/react-router-bootstrap": "^0.26.8",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.6",
+    "cypress": "^15.14.2",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-import-x": "^4.16.2",
     "eslint-plugin-jsdoc": "^62.9.0",
-    "eslint-plugin-n": "^17.24.0",
+    "eslint-plugin-n": "^18.0.1",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-react": "^7.37.5",
-    "globals": "^17.5.0",
-    "jsdom": "^29.1.0",
+    "globals": "^17.6.0",
+    "jsdom": "^29.1.1",
     "prettier": "^3.8.3",
     "sass": "^1.99.0",
     "source-map-support": "^0.5.21",
-    "typescript-eslint": "^8.59.1",
-    "vitest": "^4.1.5"
+    "typescript-eslint": "^8.59.3",
+    "vitest": "^4.1.6"
   }
 }

client/src/App.tsx

@@ -27,7 +27,7 @@ import './styles/custom.scss';
  * @returns {React.ReactNode} The rendered component.
  */
 function App(): React.ReactNode {
-  const { signed, checkCurrentAuthUser } = useContext(AuthContext);
+  const { signed, loading } = useContext(AuthContext);
   const [theme, setTheme] = useState(() => {
     return localStorage.getItem('theme') ?? 'light';
   });
@@ -114,10 +114,6 @@ function App(): React.ReactNode {
 
   const browserRouter = getBrowserRouter();
 
-  useEffect(() => {
-    checkCurrentAuthUser(window.location.pathname);
-  }, []);
-
   useEffect(() => {
     document.body.setAttribute('data-bs-theme', theme);
     localStorage.setItem('theme', theme);
@@ -138,7 +134,7 @@ function App(): React.ReactNode {
       </button>
 
       {/* Your routes or content here */}
-      <RouterProvider router={browserRouter} />
+      {!loading && <RouterProvider router={browserRouter} />}
     </>
   );
 };

client/src/__test__/App.test.tsx

@@ -1,16 +1,24 @@
-import React from 'react';
+import React, { act } from 'react';
 import { test, vi } from 'vitest';
 import App from '../App';
-import { act, render } from '@testing-library/react';
+import { render } from '@testing-library/react';
 import AuthContext from '../context/AuthContext';
 import authContextMock from './__mocks__/authContextMock';
 import SidebarContext from '../context/SidebarContext';
+import FilterContext from '../context/FilterContext';
 
 const sidebarContextMock = {
   currentPage: '/home',
   setNewPage: vi.fn()
 };
 
+const filterContextMock = {
+  filterText: '',
+  selectedOption: 'everything',
+  setFilterText: vi.fn(),
+  setSelectedOption: vi.fn()
+};
+
 vi.mock('react-charts', () => ({
   Chart: ({ options }) => <div data-testid="mocked-chart">Mocked Chart</div>
 }));
@@ -20,7 +28,9 @@ test('Renders the app', async () => {
     render(
       <AuthContext.Provider value={authContextMock}>
         <SidebarContext.Provider value={sidebarContextMock}>
-          <App />
+          <FilterContext.Provider value={filterContextMock}>
+            <App />
+          </FilterContext.Provider>
         </SidebarContext.Provider>
       </AuthContext.Provider>
     );

client/src/__test__/__mocks__/authContextMock.ts

@@ -2,6 +2,7 @@ import { vi } from "vitest";
 
 const authContextMock = {
   signed: true,
+  loading: false,
   user: undefined,
   checkCurrentAuthUser: vi.fn(),
   signIn: vi.fn(),

client/src/__test__/components/LoginForm.test.tsx

@@ -1,5 +1,5 @@
-import React from 'react';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import React, { act } from 'react';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { BrowserRouter } from 'react-router';
 import { fireEvent, render, screen } from '@testing-library/react';
 import LoginForm from '../../components/LoginForm';
@@ -119,6 +119,7 @@ describe('LoginForm Component test', () => {
   });
 
   it('should disable resend button and show countdown for "register" prefix', async () => {
+    vi.useFakeTimers();
     renderFn("register");
 
     const emailInput = screen.getByTestId('register_email_input');
@@ -129,9 +130,14 @@ describe('LoginForm Component test', () => {
     fireEvent.change(emailInput, { target: { value: 'test@example.com' } });
     fireEvent.change(passwordInput, { target: { value: 'password123' } });
     fireEvent.change(repeatPasswordInput, { target: { value: 'password123' } });
-    fireEvent.click(submitButton);
+    
+    await act(async () => {
+      fireEvent.click(submitButton);
+    });
 
     const resendButton = screen.queryByRole('button', { name: /resend confirmation email/i }) as HTMLButtonElement;
     expect(resendButton).toBeNull();
+    
+    vi.useRealTimers();
   });
 });

client/src/__test__/context/AuthProvider.test.tsx

@@ -1,7 +1,7 @@
 // AuthProvider.test.tsx
-import React, { useContext } from 'react';
+import React, { useContext, act } from 'react';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, act, waitFor, cleanup } from '@testing-library/react';
+import { render, waitFor, cleanup } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import AuthProvider from '../../context/AuthProvider';
 import AuthContext, { AuthContextData } from '../../context/AuthContext';
@@ -15,6 +15,7 @@ vi.mock('../../api-service/api');
 const ConsumerComponent: React.FC = () => {
   const {
     signed,
+    loading,
     user,
     signIn,
     register,
@@ -26,6 +27,7 @@ const ConsumerComponent: React.FC = () => {
   return (
     <div>
       <div data-testid="signed">{signed ? 'true' : 'false'}</div>
+      <div data-testid="loading">{loading ? 'true' : 'false'}</div>
       <div data-testid="user">{user ? user.name : 'none'}</div>
       <button
         data-testid="signIn"
@@ -89,15 +91,57 @@ describe('AuthProvider', () => {
     cleanup();
   });
 
-  it('should render the default context values', () => {
+  it('should render the default context values', async () => {
     const { getByTestId } = render(
       <AuthProvider>
         <ConsumerComponent />
       </AuthProvider>
     );
 
+    await waitFor(() => {
+      expect(getByTestId('signed').textContent).toBe('false');
+      expect(getByTestId('user').textContent).toBe('none');
+    });
+  });
+
+  it('should set loading to false after initial auth check with no token', async () => {
+    // No token in localStorage, so fetchCurrentSession returns immediately.
+    const { getByTestId } = render(
+      <AuthProvider>
+        <ConsumerComponent />
+      </AuthProvider>
+    );
+
+    await waitFor(() =>
+      expect(getByTestId('loading').textContent).toBe('false')
+    );
     expect(getByTestId('signed').textContent).toBe('false');
-    expect(getByTestId('user').textContent).toBe('none');
+  });
+
+  it('should set loading to false and signed to true after successful initial auth check', async () => {
+    const fakeResponse = {
+      token: 'refresh-token',
+      userId: '789',
+      name: 'Refreshed User',
+      email: 'refreshed@example.com',
+      admin: false,
+      createdAt: new Date().toISOString(),
+      gravatarImageUrl: 'http://dummyimage.com'
+    };
+
+    vi.spyOn(api, 'getJSON').mockResolvedValue(fakeResponse);
+    localStorage.setItem(API_TOKEN, 'dummy');
+
+    const { getByTestId } = render(
+      <AuthProvider>
+        <ConsumerComponent />
+      </AuthProvider>
+    );
+
+    await waitFor(() =>
+      expect(getByTestId('loading').textContent).toBe('false')
+    );
+    expect(getByTestId('signed').textContent).toBe('true');
   });
 
   it('should sign in a user successfully', async () => {
@@ -120,9 +164,7 @@ describe('AuthProvider', () => {
       </AuthProvider>
     );
 
-    await act(async () => {
-      userEvent.click(getByTestId('signIn'));
-    });
+    await userEvent.click(getByTestId('signIn'));
 
     await waitFor(() =>
       expect(getByTestId('signed').textContent).toBe('true')
@@ -169,18 +211,14 @@ describe('AuthProvider', () => {
     );
 
     // Make sure that the context initially renders with the signed user by triggering a signIn.
-    await act(async () => {
-      userEvent.click(getByTestId('signIn'));
-    });
+    await userEvent.click(getByTestId('signIn'));
 
     await waitFor(() =>
       expect(getByTestId('signed').textContent).toBe('true')
     );
 
     // Now sign out
-    await act(async () => {
-      userEvent.click(getByTestId('sign-out-btn'));
-    });
+    await userEvent.click(getByTestId('sign-out-btn'));
 
     await waitFor(() =>
       expect(getByTestId('signed').textContent).toBe('false')
@@ -198,14 +236,10 @@ describe('AuthProvider', () => {
       </AuthProvider>
     );
 
-    await act(async () => {
-      userEvent.click(getByTestId('updateUser'));
-    });
+    await userEvent.click(getByTestId('updateUser'));
 
     await waitFor(() => {
-      act(() => {
-        expect(getByTestId('user').textContent).toBe('Updated User')
-      })
+      expect(getByTestId('user').textContent).toBe('Updated User')
       const savedUser = localStorage.getItem(USER_DATA);
       expect(savedUser).not.toBeNull();
       

client/src/__test__/setup.ts

@@ -1,6 +1,8 @@
-import { afterEach, beforeEach } from 'vitest';
+// @ts-ignore
+globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+
+import { afterEach, beforeEach, vi } from 'vitest';
 import { cleanup } from '@testing-library/react';
-import { vi } from 'vitest';
 
 // runs a cleanup after each test case (e.g. clearing jsdom)
 afterEach(() => {

client/src/__test__/views/NoteAdd.test.tsx

@@ -1,4 +1,4 @@
-import React from 'react';
+import React, { act } from 'react';
 import { render, fireEvent, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { MemoryRouter } from 'react-router';
@@ -105,8 +105,12 @@ describe('NoteAdd Component', () => {
     vi.resetAllMocks();
   });
 
-  it('should render the NoteAdd component', () => {
-    const { getByText } = renderNoteAdd();
+  it('should render the NoteAdd component', async () => {
+    let result: any;
+    await act(async () => {
+      result = renderNoteAdd();
+    });
+    const { getByText } = result;
     expect(getByText('note_form_title_label')).toBeDefined();
     expect(getByText('task_form_url_label')).toBeDefined();
     expect(getByText('note_form_content_label')).toBeDefined();
@@ -114,7 +118,11 @@ describe('NoteAdd Component', () => {
   });
 
   it('should show error message when form is invalid', async () => {
-    const { getByText, getByRole } = renderNoteAdd();
+    let result: any;
+    await act(async () => {
+      result = renderNoteAdd();
+    });
+    const { getByText, getByRole } = result;
     const submitButton = getByRole('button', { name: 'note_form_submit' });
     fireEvent.click(submitButton);
     await waitFor(() => {
@@ -127,7 +135,11 @@ describe('NoteAdd Component', () => {
       new URLSearchParams("backTo=home"),
     ]);
 
-    const { getByLabelText, getByTestId, getByRole } = renderNoteAdd();
+    let result: any;
+    await act(async () => {
+      result = renderNoteAdd();
+    });
+    const { getByLabelText, getByTestId, getByRole } = result;
     const descriptionInput = getByLabelText('note_form_title_label') as HTMLInputElement;
     const noteContentInput = getByTestId('note-content-input-area') as HTMLAreaElement;
     const submitButton = getByRole('button', { name: 'note_form_submit' });
@@ -151,8 +163,12 @@ describe('NoteAdd Component', () => {
     });
   });
 
-  it('should render text based on new contentHeader component', () => {
-    const { getByText } = renderNoteAdd();
+  it('should render text based on new contentHeader component', async () => {
+    let result: any;
+    await act(async () => {
+      result = renderNoteAdd();
+    });
+    const { getByText } = result;
 
     expect(getByText('Add')).toBeDefined();
     expect(getByText('Note')).toBeDefined();

client/src/__test__/views/TaskAdd.test.tsx

@@ -1,4 +1,4 @@
-import React from 'react';
+import React, { act } from 'react';
 import { render, fireEvent, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { MemoryRouter } from 'react-router';
@@ -23,7 +23,7 @@ vi.mock('react-i18next', () => ({
   }),
   initReactI18next: {
     type: '3rdParty',
-    init: vi.fn(),
+    init:  vi.fn(),
   },
   I18nextProvider: ({ children }: any) => children,
 }));
@@ -82,8 +82,12 @@ describe('TaskAdd Component', () => {
     (useSearchParams as unknown as ReturnType<typeof vi.fn>).mockReset();
   });
 
-  it('should render the TaskAdd component', () => {
-    const { getByText } = renderTaskAdd();
+  it('should render the TaskAdd component', async () => {
+    let result: any;
+    await act(async () => {
+      result = renderTaskAdd();
+    });
+    const { getByText } = result;
     expect(getByText('task_form_title')).toBeDefined();
     expect(getByText('task_form_desc_label')).toBeDefined();
     expect(getByText('task_form_url_label')).toBeDefined();
@@ -92,7 +96,11 @@ describe('TaskAdd Component', () => {
   });
 
   it('should show error message when form is invalid', async () => {
-    const { getByText, getByRole } = renderTaskAdd();
+    let result: any;
+    await act(async () => {
+      result = renderTaskAdd();
+    });
+    const { getByText, getByRole } = result;
     const submitButton = getByRole('button', { name: 'task_form_submit' });
     fireEvent.click(submitButton);
     await waitFor(() => {
@@ -105,7 +113,11 @@ describe('TaskAdd Component', () => {
       new URLSearchParams("backTo=home"),
     ]);
 
-    const { getByLabelText, getByRole } = renderTaskAdd();
+    let result: any;
+    await act(async () => {
+      result = renderTaskAdd();
+    });
+    const { getByLabelText, getByRole } = result;
     const descriptionInput = getByLabelText('task_form_desc_label') as HTMLInputElement;
     const submitButton = getByRole('button', { name: 'task_form_submit' });
 
@@ -125,12 +137,16 @@ describe('TaskAdd Component', () => {
     });
   });
 
-  it('should render text based on new contentHeader component', () => {
+  it('should render text based on new contentHeader component', async () => {
     (useSearchParams as unknown as ReturnType<typeof vi.fn>).mockReturnValue([
       new URLSearchParams("backTo=home"),
     ]);
 
-    const { getByText } = renderTaskAdd();
+    let result: any;
+    await act(async () => {
+      result = renderTaskAdd();
+    });
+    const { getByText } = result;
 
     expect(getByText('Add')).toBeDefined();
     expect(getByText('Task')).toBeDefined();

client/src/context/AuthContext.ts

@@ -4,6 +4,7 @@ import { UserRegistration } from '../types/UserRegistration';
 
 export interface AuthContextData {
   signed: boolean;
+  loading: boolean;
   user: UserResponse | undefined;
   checkCurrentAuthUser: (pathname: string) => Promise<void>;
   signIn: (email: string, password: string) => Promise<string>;

client/src/context/AuthProvider.tsx

@@ -1,4 +1,4 @@
-import React, { useMemo, useState } from 'react';
+import React, { useEffect, useMemo, useState } from 'react';
 import AuthContext, { AuthContextData } from './AuthContext';
 import { API_TOKEN, REDIRECT_PATH, USER_DATA } from '../app-constants/app-constants';
 import { SigninResponse } from '../types/SigninResponse';
@@ -13,9 +13,9 @@ interface Props {
 
 const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children }: Props) => {
   const [signed, setSigned] = useState<boolean>(false);
+  const [loading, setLoading] = useState<boolean>(true);
   const [user, setUser] = useState<UserResponse | undefined>();
   const [isAdmin, setIsAdmin] = useState<boolean>(false);
-  const [intervalInstance, setIntervalInstance] = useState<NodeJS.Timeout | null>(null);
 
   const fetchCurrentSession = async (pathname: string): Promise<SigninResponse | undefined> => {
     const token = localStorage.getItem(API_TOKEN);
@@ -114,39 +114,16 @@ const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children }: Pro
     setSigned(false);
     setUser(undefined);
     setIsAdmin(false);
-    if (intervalInstance) {
-      clearInterval(intervalInstance);
-      setIntervalInstance(null);
-    }
     localStorage.removeItem(API_TOKEN);
     localStorage.removeItem(REDIRECT_PATH);
     localStorage.removeItem(USER_DATA);
   };
 
-  const refreshTokenPvt = async (): Promise<void> => {
-    const bearerToken: SigninResponse | undefined = await fetchCurrentSession('/');
-    if (bearerToken) {
-      updateUserSession(null, bearerToken.token);
-    }
-    return Promise.resolve();
-  };
-
-  // 2 minutes
-  const second = 1000;
-  const minute = second * 60;
-  const REFRESH_TIMER = minute * 2;
-
-  if (intervalInstance == null && signed) {
-    const instance = setInterval(() => {
-      refreshTokenPvt()
-        .then(() => {
-          console.debug('User session successfully refreshed!');
-        })
-        .catch(e => console.error(e));
-    }, REFRESH_TIMER);
-
-    setIntervalInstance(instance);
-  }
+  useEffect(() => {
+    checkCurrentAuthUser(window.location.pathname)
+      .catch(e => console.error(e))
+      .finally(() => setLoading(false));
+  }, []);
 
   const updateUser = (userUpdated: UserResponse): void => {
     setUser(userUpdated);
@@ -155,6 +132,7 @@ const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children }: Pro
 
   const contextValue: AuthContextData = useMemo(() => ({
     signed,
+    loading,
     user,
     checkCurrentAuthUser,
     signIn,
@@ -162,7 +140,7 @@ const AuthProvider: React.FC<{ children: React.ReactNode }> = ({ children }: Pro
     register,
     isAdmin,
     updateUser
-  }), [signed, user, checkCurrentAuthUser, signIn, signOut, register, isAdmin, updateUser]);
+  }), [signed, loading, user, checkCurrentAuthUser, signIn, signOut, register, isAdmin, updateUser]);
 
   return (
     <AuthContext.Provider value={contextValue}>

client/src/views/Home/index.tsx

@@ -487,7 +487,7 @@ function Home(): React.ReactNode {
                   </Col>
                   <Col xs={2} className="text-end">
                     <Dropdown>
-                      <Dropdown.Toggle variant="success">
+                      <Dropdown.Toggle variant="success" data-testid={`task-dropdown-menu-${task.id}`}>
                         <ThreeDotsVertical />
                       </Dropdown.Toggle>
                       <Dropdown.Menu>
@@ -498,7 +498,11 @@ function Home(): React.ReactNode {
                             </Dropdown.Item>
                           </NavLink>
                         )}
-                        <Dropdown.Item as="button" onClick={() => markAsDone(task)}>
+                        <Dropdown.Item
+                          as="button"
+                          onClick={() => markAsDone(task)}
+                          data-testid={`task-dropdown-done-item-${task.id}`}
+                        >
                           {task.done ? t('task_table_action_undone') : t('task_table_action_done')}
                         </Dropdown.Item>
                       </Dropdown.Menu>

client/tsconfig.json

@@ -17,7 +17,10 @@
     "allowSyntheticDefaultImports": true,
     "forceConsistentCasingInFileNames": true,
     "noFallthroughCasesInSwitch": true,
-    "moduleResolution": "node",
+    "types": [
+      "node"
+    ],
+    "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
     "noEmit": true,

mailgun-templates/email_changed.html

@@ -157,14 +157,14 @@
 				<p>If you made this change, no further action is needed.</p>
 				<p>
 				  If you did not make this change, secure your account immediately and contact
-				  <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				  <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 				</p>
 			  </td>
 			</tr>
 			<tr>
 			  <td class="footer">
 				This is an automatic message from Tasknote, please do not reply.<br />
-				Need help? Contact <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				Need help? Contact <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 			  </td>
 			</tr>
 		  </table>

mailgun-templates/password_change_confirmation.html

@@ -125,7 +125,7 @@
 				<p class="notice">
 				  If this was you, no action is required. If this was not you, secure your account
 				  right away and contact
-				  <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				  <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 				</p>
 
 				<p>Thank you for helping keep your account safe.</p>
@@ -134,7 +134,7 @@
 			<tr>
 			  <td class="footer">
 				This is an automatic message from Tasknote, please do not reply.<br />
-				Need help? Contact <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				Need help? Contact <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 			  </td>
 			</tr>
 		  </table>

mailgun-templates/password_reset.html

@@ -167,7 +167,7 @@
 			<tr>
 			  <td class="footer">
 				This is an automatic message from Tasknote, please do not reply.<br />
-				Need help? Contact <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				Need help? Contact <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 			  </td>
 			</tr>
 		  </table>

mailgun-templates/sign_up_confirmation.html

@@ -157,7 +157,7 @@
 			<tr>
 			  <td class="footer">
 				This is an automatic message from Tasknote, please do not reply.<br />
-				Need help? Contact <a class="link" href="mailto:ricardompcampos@gmail.com">ricardompcampos@gmail.com</a>.
+				Need help? Contact <a class="link" href="mailto:support@tasknote.cc">support@tasknote.cc</a>.
 			  </td>
 			</tr>
 		  </table>

server/pom.xml

@@ -5,13 +5,13 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>4.0.5</version>
+    <version>4.0.6</version>
     <relativePath/> <!-- lookup parent from repository -->
   </parent>
   
   <groupId>br.com.tasknoteapp</groupId>
   <artifactId>server</artifactId>
-  <version>20</version>
+  <version>23</version>
   <name>tasknote-api</name>
   <description>Java backend REST API to serve TaskNote frontend client</description>
   
@@ -53,7 +53,7 @@
     <surefire.version>3.5.5</surefire.version>
     <jacoco.version>0.8.14</jacoco.version>
     <checkstyle.version>3.6.0</checkstyle.version>
-    <springboot.version>4.0.5</springboot.version>
+    <springboot.version>4.0.6</springboot.version>
     <jjwt.version>0.12.6</jjwt.version>
   </properties>
 
@@ -165,7 +165,7 @@
   </dependencies>
 
   <build>
-    <plugins>
+    <plugins> 
       <plugin>
         <groupId>org.hibernate.orm</groupId>
         <artifactId>hibernate-maven-plugin</artifactId>
@@ -187,7 +187,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-failsafe-plugin</artifactId>
-	<version>${failsafe.version}</version>
+        <version>${failsafe.version}</version>
         <executions>
           <execution>
             <id>integration-tests</id>
@@ -209,7 +209,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-	<version>${surefire.version}</version>
+	      <version>${surefire.version}</version>
         <configuration>
           <argLine>@{argLine} -Xmx1024m</argLine>
           <skipTests>${skip.unit.tests}</skipTests>
@@ -221,7 +221,7 @@
       <plugin>
         <groupId>org.jacoco</groupId>
         <artifactId>jacoco-maven-plugin</artifactId>
-	<version>${jacoco.version}</version>
+        <version>${jacoco.version}</version>
         <configuration>
           <skip>${jacoco.skip}</skip>
           <excludes>
@@ -330,7 +330,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-checkstyle-plugin</artifactId>
-	<version>${checkstyle.version}</version>
+        <version>${checkstyle.version}</version>
         <dependencies>
           <dependency>
             <groupId>com.puppycrawl.tools</groupId>

server/src/main/resources/application.yml

@@ -13,8 +13,8 @@ logging:
 
 mailgun:
   api-key: ${MAILGUN_APIKEY:abc123456}
-  domain: tasknote.darkroasted.vps-kinghost.net
-  sender-email: no-reply@tasknote.darkroasted.vps-kinghost.net
+  domain: tasknote.cc
+  sender-email: no-reply@tasknote.cc
 
 server:
   port: 8585

terraform-gcp/.terraform.lock.hcl

@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/google" {
+  version     = "5.45.2"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:k8taQAdfHrv2F/AiGV5BZBZfI+1uaq8g6O8dWzjx42c=",
+    "zh:0d09c8f20b556305192cdbe0efa6d333ceebba963a8ba91f9f1714b5a20c4b7a",
+    "zh:117143fc91be407874568df416b938a6896f94cb873f26bba279cedab646a804",
+    "zh:16ccf77d18dd2c5ef9c0625f9cf546ebdf3213c0a452f432204c69feed55081e",
+    "zh:3e555cf22a570a4bd247964671f421ed7517970cd9765ceb46f335edc2c6f392",
+    "zh:688bd5b05a75124da7ae6e885b2b92bd29f4261808b2b78bd5f51f525c1052ca",
+    "zh:6db3ef37a05010d82900bfffb3261c59a0c247e0692049cb3eb8c2ef16c9d7bf",
+    "zh:70316fde75f6a15d72749f66d994ccbdde5f5ed4311b6d06b99850f698c9bbf9",
+    "zh:84b8e583771a4f2bd514e519d98ed7fd28dce5efe0634e973170e1cfb5556fb4",
+    "zh:9d4b8ef0a9b6677935c604d94495042e68ff5489932cfd1ec41052e094a279d3",
+    "zh:a2089dd9bd825c107b148dd12d6b286f71aa37dfd4ca9c35157f2dcba7bc19d8",
+    "zh:f03d795c0fd9721e59839255ee7ba7414173017dc530b4ce566daf3802a0d6dd",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}

terraform-gcp/cloudrun.tf

@@ -0,0 +1,117 @@
+resource "google_cloud_run_v2_service" "backend" {
+  name     = "tasknote-api"
+  location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+
+  depends_on = [google_project_service.run]
+
+  template {
+    service_account = google_service_account.cloudrun_sa.email
+    vpc_access {
+      connector = google_vpc_access_connector.connector.id
+      egress    = "ALL_TRAFFIC"
+    }
+
+    containers {
+      image = var.backend_image
+      ports {
+        container_port = 8585
+      }
+      env {
+        name  = "POSTGRES_DB"
+        value = var.db_name
+      }
+      env {
+        name  = "POSTGRES_HOST"
+        value = google_sql_database_instance.instance.private_ip_address
+      }
+      env {
+        name  = "POSTGRES_USER"
+        value = var.db_user
+      }
+      env {
+        name  = "POSTGRES_PASSWORD"
+        value = var.db_password
+      }
+      env {
+        name  = "POSTGRES_PORT"
+        value = "5432"
+      }
+      env {
+        name  = "CORS_ALLOWED_ORIGINS"
+        value = var.cors_allowed_origins
+      }
+      env {
+        name = "SERVER_SERVLET_CONTEXT_PATH"
+        value = "/"
+      }
+      env {
+        name  = "TARGET_ENV"
+        value = "production"
+      }
+      env {
+        name = "SECURITY_KEY"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.security_key.secret_id
+            version = "latest"
+          }
+        }
+      }
+      env {
+        name = "MAILGUN_APIKEY"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.mailgun_apikey.secret_id
+            version = "latest"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "google_cloud_run_v2_service" "frontend" {
+  name     = "tasknote-app"
+  location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+
+  depends_on = [google_project_service.run]
+
+  template {
+    service_account = google_service_account.cloudrun_sa.email
+
+    containers {
+      image = var.frontend_image
+      ports {
+        container_port = 5000
+      }
+      env {
+        name  = "VITE_BACKEND_SERVER"
+        value = google_cloud_run_v2_service.backend.uri
+      }
+    }
+  }
+}
+
+# Allow unauthenticated access to both services
+resource "google_cloud_run_service_iam_member" "backend_public" {
+  location = google_cloud_run_v2_service.backend.location
+  service  = google_cloud_run_v2_service.backend.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+resource "google_cloud_run_service_iam_member" "frontend_public" {
+  location = google_cloud_run_v2_service.frontend.location
+  service  = google_cloud_run_v2_service.frontend.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+# Grant Cloud SQL Client role to the service account
+resource "google_project_iam_member" "cloudsql_client" {
+  project = var.project_id
+  role    = "roles/cloudsql.client"
+  member  = "serviceAccount:${google_service_account.cloudrun_sa.email}"
+}

terraform-gcp/database.tf

@@ -0,0 +1,32 @@
+resource "google_sql_database_instance" "instance" {
+  name             = "tasknote-db-instance"
+  region           = var.region
+  database_version = "POSTGRES_15"
+
+  depends_on = [
+    google_service_networking_connection.private_vpc_connection,
+    google_project_service.sqladmin,
+    google_project_service.servicenetworking
+  ]
+
+  settings {
+    tier = "db-f1-micro" # Smallest tier for dev/small app
+    ip_configuration {
+      ipv4_enabled    = false
+      private_network = google_compute_network.vpc_network.id
+    }
+  }
+
+  deletion_protection = false # Set to true for production
+}
+
+resource "google_sql_database" "database" {
+  name     = var.db_name
+  instance = google_sql_database_instance.instance.name
+}
+
+resource "google_sql_user" "users" {
+  name     = var.db_user
+  instance = google_sql_database_instance.instance.name
+  password = var.db_password
+}

terraform-gcp/network.tf

@@ -0,0 +1,35 @@
+resource "google_compute_network" "vpc_network" {
+  name                    = "tasknote-vpc"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  name          = "tasknote-subnet"
+  ip_cidr_range = "10.0.0.0/24"
+  region        = var.region
+  network       = google_compute_network.vpc_network.id
+}
+
+# Private IP for Cloud SQL
+resource "google_compute_global_address" "private_ip_address" {
+  name          = "tasknote-private-ip"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = 16
+  network       = google_compute_network.vpc_network.id
+}
+
+resource "google_service_networking_connection" "private_vpc_connection" {
+  network                 = google_compute_network.vpc_network.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
+}
+
+# Serverless VPC Access Connector
+resource "google_vpc_access_connector" "connector" {
+  name          = "tasknote-vpc-connector"
+  region        = var.region
+  ip_cidr_range = "10.8.0.0/28"
+  network       = google_compute_network.vpc_network.name
+  depends_on    = [google_project_service.vpcaccess, google_project_service.compute]
+}

terraform-gcp/outputs.tf

@@ -0,0 +1,15 @@
+output "backend_url" {
+  value = google_cloud_run_v2_service.backend.uri
+}
+
+output "frontend_url" {
+  value = google_cloud_run_v2_service.frontend.uri
+}
+
+output "cloud_sql_instance_ip" {
+  value = google_sql_database_instance.instance.private_ip_address
+}
+
+output "artifact_registry_repo" {
+  value = google_artifact_registry_repository.repo.name
+}

terraform-gcp/providers.tf

@@ -0,0 +1,25 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.0"
+    }
+  }
+
+  backend "s3" {
+    bucket                      = "tasknote"
+    key                         = "gcp/terraform.tfstate"
+    region                      = "auto"
+    endpoints                   = { s3 = "https://d17eb09b6bce2f90e16e800bb2a6baf9.r2.cloudflarestorage.com" }
+    skip_credentials_validation = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    skip_metadata_api_check     = true
+    skip_s3_checksum            = true
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}

terraform-gcp/registry.tf

@@ -0,0 +1,7 @@
+resource "google_artifact_registry_repository" "repo" {
+  location      = var.region
+  repository_id = "tasknote-repo"
+  description   = "Docker repository for TaskNote images"
+  format        = "DOCKER"
+  depends_on    = [google_project_service.artifactregistry]
+}

terraform-gcp/secrets.tf

@@ -0,0 +1,49 @@
+resource "google_service_account" "cloudrun_sa" {
+  account_id   = "tasknote-cloudrun-sa"
+  display_name = "TaskNote Cloud Run Service Account"
+}
+
+resource "google_secret_manager_secret" "security_key" {
+  secret_id = "security-key"
+  replication {
+    user_managed {
+      replicas {
+        location = var.region
+      }
+    }
+  }
+}
+
+resource "google_secret_manager_secret_version" "security_key_version" {
+  secret      = google_secret_manager_secret.security_key.id
+  secret_data = var.security_key
+}
+
+resource "google_secret_manager_secret" "mailgun_apikey" {
+  secret_id = "mailgun-apikey"
+  replication {
+    user_managed {
+      replicas {
+        location = var.region
+      }
+    }
+  }
+  depends_on = [google_project_service.secretmanager]
+}
+
+resource "google_secret_manager_secret_version" "mailgun_apikey_version" {
+  secret      = google_secret_manager_secret.mailgun_apikey.id
+  secret_data = var.mailgun_apikey
+}
+
+resource "google_secret_manager_secret_iam_member" "security_key_access" {
+  secret_id = google_secret_manager_secret.security_key.id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.cloudrun_sa.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "mailgun_apikey_access" {
+  secret_id = google_secret_manager_secret.mailgun_apikey.id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.cloudrun_sa.email}"
+}

terraform-gcp/services.tf

@@ -0,0 +1,34 @@
+resource "google_project_service" "compute" {
+  service            = "compute.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "sqladmin" {
+  service            = "sqladmin.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "run" {
+  service            = "run.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "secretmanager" {
+  service            = "secretmanager.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "vpcaccess" {
+  service            = "vpcaccess.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "artifactregistry" {
+  service            = "artifactregistry.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "servicenetworking" {
+  service            = "servicenetworking.googleapis.com"
+  disable_on_destroy = false
+}

terraform-gcp/terraform.tfvars.example

@@ -0,0 +1,10 @@
+project_id           = "your-gcp-project-id"
+region               = "us-central1"
+db_user              = "tasknoteuser"
+db_password          = "your-db-password"
+db_name              = "tasknote"
+security_key         = "your-security-key"
+mailgun_apikey       = "your-mailgun-apikey"
+backend_image        = "ghcr.io/rmcampos/tasknote/api:latest"
+frontend_image       = "ghcr.io/rmcampos/tasknote/app:latest"
+cors_allowed_origins = "*"

terraform-gcp/variables.tf

@@ -0,0 +1,50 @@
+variable "project_id" {
+  type        = string
+  description = "The GCP Project ID"
+}
+
+variable "region" {
+  type        = string
+  default     = "us-central1"
+  description = "The GCP region to deploy resources"
+}
+
+variable "db_user" {
+  type      = string
+  sensitive = true
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "db_name" {
+  type      = string
+  default   = "tasknote"
+}
+
+variable "security_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "mailgun_apikey" {
+  type      = string
+  sensitive = true
+}
+
+variable "backend_image" {
+  type    = string
+  default = "ghcr.io/rmcampos/tasknote/api:latest"
+}
+
+variable "frontend_image" {
+  type    = string
+  default = "ghcr.io/rmcampos/tasknote/app:latest"
+}
+
+variable "cors_allowed_origins" {
+  type    = string
+  default = "*"
+}

terraform/.terraform.lock.hcl

@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/kubernetes" {
+  version     = "3.1.0"
+  constraints = ">= 2.0.0"
+  hashes = [
+    "h1:oodIAuFMikXNmEtil5MQgP4dfSctUBYQiGJfjbsF3NY=",
+    "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
+    "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
+    "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
+    "zh:1678c982853ad461e65ccb5e79d585e13ed109dd47dab2a66d3a7a304faeef65",
+    "zh:1c050a5c15e330457a9c18caacf61a923c59d663e13f2962e4b32f04fef523a0",
+    "zh:2c55bcec83be58ec132c7cb0a1ac644758b800d794fdc636d53a0eada0358a3a",
+    "zh:a062bb0aa316c08d8460c66a5d68da71da40de5d3bc3b31abcf3a1a9a19650f1",
+    "zh:a26fdea0afaa9b247c73c0b42843ca51ba7db0ac2571f9d3d50dcabd20ca1b98",
+    "zh:c872c9385a78d502bf5823d61cd3bb0f9a0585030e025eb12585c83451beeaa1",
+    "zh:f180879af931182beee4c8c0d9dab62b81d86f17ddcbe3786ef4c7cec9163a4e",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:f70f5789264069e0eef06f9b5d5fde955ef7206f7d446d1ce51a4c37a3f3e02f",
+  ]
+}

terraform/main.tf

@@ -48,6 +48,26 @@ variable "mailgun_apikey" {
   sensitive = true
 }
 
+variable "r2_access_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "r2_secret_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "r2_bucket_name" {
+  type    = string
+  default = "tasknote-backups"
+}
+
+variable "r2_endpoint" {
+  type    = string
+  default = "https://d17eb09b6bce2f90e16e800bb2a6baf9.r2.cloudflarestorage.com"
+}
+
 variable "cors_allowed_origins" {
   type    = string
   default = "https://tasknote.darkroasted.vps-kinghost.net"
@@ -368,3 +388,120 @@ resource "kubernetes_ingress_v1" "tasknote_ingress" {
     }
   }
 }
+
+resource "kubernetes_secret_v1" "r2_backup_secrets" {
+  metadata {
+    name      = "r2-backup-secrets"
+    namespace = kubernetes_namespace_v1.tasknote.metadata[0].name
+  }
+
+  data = {
+    access_key = var.r2_access_key
+    secret_key = var.r2_secret_key
+  }
+}
+
+resource "kubernetes_cron_job_v1" "tasknote_db_backup" {
+  metadata {
+    name      = "tasknote-db-backup"
+    namespace = kubernetes_namespace_v1.tasknote.metadata[0].name
+  }
+  spec {
+    schedule = "0 0,12 * * *"
+    job_template {
+      metadata {
+        labels = {
+          app = "taknote-db-backup"
+        }
+      }
+      spec {
+        template {
+          metadata {
+            labels = {
+              app = "tasknote-db-backup"
+            }
+          }
+          spec {
+            container {
+              name    = "backup"
+              image   = "postgres:15.8-alpine"
+              command = ["/bin/sh", "-c"]
+              args = [
+                <<-EOT
+                apk add --no-cache aws-cli
+                export PGPASSWORD=$POSTGRES_PASSWORD
+                FILENAME="backup-$(date +%Y%m%d%H%M%S).sql.gz"
+                echo "Starting backup of $POSTGRES_DB to $FILENAME..."
+                pg_dump -h $DB_HOST -U $POSTGRES_USER $POSTGRES_DB | gzip > /tmp/$FILENAME
+                echo "Uploading to R2..."
+                AWS_ACCESS_KEY_ID=$R2_ACCESS_KEY AWS_SECRET_ACCESS_KEY=$R2_SECRET_KEY \
+                aws s3 cp /tmp/$FILENAME s3://$R2_BUCKET/ --endpoint-url $R2_ENDPOINT
+                echo "Backup completed successfully."
+                EOT
+              ]
+              env {
+                name  = "DB_HOST"
+                value = "tasknote-db-svc"
+              }
+              env {
+                name = "POSTGRES_USER"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_user"
+                  }
+                }
+              }
+              env {
+                name = "POSTGRES_PASSWORD"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_password"
+                  }
+                }
+              }
+              env {
+                name = "POSTGRES_DB"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_db"
+                  }
+                }
+              }
+              env {
+                name = "R2_ACCESS_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.r2_backup_secrets.metadata[0].name
+                    key  = "access_key"
+                  }
+                }
+              }
+              env {
+                name = "R2_SECRET_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.r2_backup_secrets.metadata[0].name
+                    key  = "secret_key"
+                  }
+                }
+              }
+              env {
+                name  = "R2_BUCKET"
+                value = var.r2_bucket_name
+              }
+              env {
+                name  = "R2_ENDPOINT"
+                value = var.r2_endpoint
+              }
+            }
+            restart_policy = "OnFailure"
+          }
+        }
+      }
+    }
+  }
+}
+

tools/tools.md

@@ -180,4 +180,10 @@ mvn test -P test -Dtest=YourTestClassName
 
 # For a single class method
 mvn test -P test -Dtest=YourTestClassName#method
-```
+```
+
+## Running SQL query from the CLI using docker
+
+```bash
+docker exec -it tasknote-db psql -U tasknoteuser -d tasknote -c "SET search_path TO tasknote; SELECT * FROM users;
+```