feat: production hardening with security, caching, CI/CD and UX improvements

[manziosee]

…vements

🚀 CI/CD & GitHub Actions

• Added .github/workflows/ci.yml for automated testing
• Runs on push/PR to main/dev branches
• Backend: Java 17 + PostgreSQL integration tests
• Frontend: Node 20 + Vite type-check and build
• Ensures code quality before deployment

🛡️ Security Enhancements

• Rate limiting filter (RateLimitFilter.java) for auth endpoints • 10 requests per IP per 60 seconds on /login, /register, /forgot-password • Returns 429 Too Many Requests with JSON error message
• JWT secret validation: @PostConstruct checks secret length ≥32 bytes • Prevents weak/default secrets at startup • App fails fast with clear error message
• Input validation with @Valid on all RequestController endpoints • Request entity now has @notblank + @SiZe constraints • Returns 400 Bad Request with validation details
• @Profile('dev') on all test/debug controllers to prevent exposure in production • TestController, TestRequestController, TestAssignmentController • TestEmailController, TestPasswordResetController, AuthTestController • EnvironmentTestController, ManualInitController, AdminInitController • SendGridTestController

⚡ Performance Optimization

• Added @EnableCaching to main application class
• Implemented @Cacheable on expensive operations: • AnalyticsService.getAnalyticsDashboard() - 5 min TTL • LeaderboardService.getTopVolunteers() - 10 min TTL • SkillService.getAllSkills() - 30 min TTL
• Added @CacheEvict on skill mutations (create/update/delete)
• Reduces database load for frequently accessed data

🧩 Frontend UX Improvements

• Added ErrorBoundary component to catch React component crashes • Prevents blank white screen on errors • Shows user-friendly error with 'Try Again' and 'Go Home' buttons
• Added 404 Not Found page for invalid routes
• Replaced LoadingSpinner with skeleton loaders: • AdminUsersPage: TableSkeleton + StatCardSkeleton • AdminRequestsPage: TableSkeleton • AdminAnalyticsPage: StatCardSkeleton grid • Provides visual feedback while data loads

📝 Logging & Code Quality

• Replaced all System.out.println with SLF4J logging • AssignmentService, AuthService, EmailService • NotificationService, SendGridEmailService • DataInitializer, DatabaseConfig • AssignmentController, AnalyticsController, CategoryController
• Added proper log levels (info, warn, error, debug)
• Structured logging for better monitoring

🔧 Security & Access Control

• Added @EnableMethodSecurity with prePostEnabled=true
• Added @PreAuthorize('hasRole(''ADMIN'')') to SystemSettingsController
• Ensures only administrators can modify system settings
• Consistent role-based access control across all admin endpoints

📚 Documentation Updates

• Complete README.md rewrite with: • Architecture diagram and explanation • Technology stack badges (Java 17, Spring Boot, React, PostgreSQL) • Database schema visualization • Environment variables reference table • API documentation with 8 feature groups • i18n multi-language support section • Security features overview • Deployment instructions for Fly.io + Vercel • Local development setup guide

🧹 Cleanup & Hardening

• Removed hardcoded userSatisfactionRating from AnalyticsService
• Now computed dynamically from actual ratings data
• Updated all admin email references to darkosee23@gmail.com
• CORS hardening across all controllers
• Consistent error responses with proper HTTP status codes

This commit transforms the application into a production-ready system with: ✅ Automated CI/CD pipeline
✅ Rate limiting protection against brute force
✅ Input validation on all critical endpoints
✅ Caching for improved performance
✅ Better UX with error boundaries and skeletons
✅ Comprehensive logging for monitoring
✅ Role-based access control
✅ Up-to-date documentation
✅ No hardcoded test data in production services

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
community-support-system	Ready	Preview, Comment	Mar 7, 2026 10:04pm