ChatApp

ChatApp is a real-time chat backend built with Spring Boot 3, PostgreSQL, MongoDB, STOMP/WebSocket, Cloudinary, and optional Gemini AI. It demonstrates session security, authorization at the domain boundary, polyglot persistence, asynchronous integrations, and container deployment.

Implemented capabilities

• BCrypt registration/login with secure session cookies, session-fixation protection, CORS allow-listing, and CSRF protection.
• REST APIs for authentication, chat creation/listing/deletion, bounded history pagination, message search, and file uploads.
• Authenticated STOMP flows for sending, editing, soft-deleting, reacting, read receipts, typing indicators, and presence.
• PostgreSQL for users/chat membership and MongoDB for append-heavy message documents.
• Server-side sender identity and membership checks for both REST and WebSocket traffic.
• Cloudinary attachments with MIME allow-listing and request-size limits.
• Optional Gemini replies with bounded async execution and HTTP timeouts.
• No server-rendered frontend dependency; the UI remains a separate project using REST and STOMP.
• Centralized API errors, edge-case tests, Docker hardening, and GitHub Actions CI.

Run locally

1. Copy .env.example to .env and provide PostgreSQL and MongoDB values. .env is local-only and must never be committed.
2. For local HTTP development set COOKIE_SECURE=false and COOKIE_SAME_SITE=Lax; Flyway creates the schema and seeds the geminiai system account.
3. Start with ./mvnw spring-boot:run or mvnw.cmd spring-boot:run on Windows.
4. Check GET /api/health for liveness or GET /actuator/health for the Render health check.
5. Run tests with ./mvnw test.

If a real .env was ever committed in an earlier Git revision, rotate the database, MongoDB, Cloudinary, and Gemini credentials. Removing the file from the current revision does not erase old Git history.

Spring Boot automatically imports the local .env file through spring.config.import; IntelliJ does not need a separate Env File plugin or run-configuration entry. Keep the file at the project root, keep it ignored, and restart the application after changing it. If IntelliJ displays .env in grey or with an ignored-file indicator, that is expected and means Git will not commit it.

See BACKEND_API.md, FRONTEND_INTEGRATION.md, FRONTEND_MIGRATION.md, CONFIGURATION.md, ARCHITECTURE.md, and DOCKER.md.

Render deployment

The included Dockerfile and render.yaml deploy the API as a Docker web service. Configure the secret sync: false variables in Render. Cloudinary is required for uploads; Gemini is optional. Use managed PostgreSQL and MongoDB Atlas, set FRONTEND_URL to the deployed frontend origin, COOKIE_SECURE=true, COOKIE_SAME_SITE=None, and JPA_DDL_AUTO=validate in production. Flyway applies versioned schema migrations at startup.