Feature/synchronize UI design

.gitignore

@@ -3,6 +3,7 @@ target/
 .mvn/wrapper/maven-wrapper.jar
 !**/src/main/**/target/
 !**/src/test/**/target/
+.env
 
 ### STS ###
 .apt_generated

pom.xml

@@ -172,6 +172,11 @@
                             <artifactId>lombok</artifactId>
                             <version>${lombok.version}</version>
                         </path>
+                        <path>
+                            <groupId>org.hibernate.orm</groupId>
+                            <artifactId>hibernate-processor</artifactId>
+                            <version>${hibernate.version}</version>
+                        </path>
                     </annotationProcessorPaths>
                 </configuration>
             </plugin>

src/main/java/org/example/visacasemanagementsystem/ApplicationViewController.java

@@ -1,31 +1,59 @@
 package org.example.visacasemanagementsystem;
 
+import jakarta.servlet.http.HttpServletResponse;
 import org.example.visacasemanagementsystem.user.security.UserPrincipal;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
 import java.util.Objects;
 
+/**
+ * Entry-point controller: maps the site root to the role-based router and
+ * hosts that router at /home.
+ */
 @Controller
 public class ApplicationViewController {
 
     @GetMapping("/")
     public String index() {
-        return "redirect:/dashboard";
+        return "redirect:/home";
     }
 
-    @GetMapping("/dashboard")
-    public String dashboard(@AuthenticationPrincipal UserPrincipal principal) {
+    /**
+     * Role-based landing-page router. Each role has a distinct primary page:
+     *   SYSADMIN -> /log/visa
+     *   ADMIN    -> /visa/cases
+     *   USER     -> /visa/my-applications.
+     */
+    @GetMapping("/home")
+    public String home(@AuthenticationPrincipal UserPrincipal principal) {
         if (principal == null) {
             return "redirect:/user/login";
         }
-        boolean isSysAdmin = principal.getAuthorities().stream()
-                .anyMatch(a -> Objects.equals(a.getAuthority(), "ROLE_SYSADMIN"));
-        boolean isAdmin = principal.getAuthorities().stream()
-                .anyMatch(a -> Objects.equals(a.getAuthority(), "ROLE_ADMIN"));
 
-        if (isSysAdmin) return "redirect:/dashboard/sysadmin";
-        if (isAdmin)    return "redirect:/dashboard/admin";
-        return "redirect:/dashboard/applicant";
+        boolean isSysAdmin = false;
+        boolean isAdmin = false;
+        for (var authority : principal.getAuthorities()) {
+            String role = authority.getAuthority();
+            if (Objects.equals(role, "ROLE_SYSADMIN")) isSysAdmin = true;
+            else if (Objects.equals(role, "ROLE_ADMIN")) isAdmin = true;
+        }
+
+        if (isSysAdmin) return "redirect:/log/visa";
+        if (isAdmin)    return "redirect:/visa/cases";
+        return "redirect:/visa/my-applications";
+    }
+
+    /**
+     * Target of {@code SecurityConfig.exceptionHandling().accessDeniedPage(...)}.
+     */
+    @GetMapping("/access-denied")
+    public String accessDenied(Model model, HttpServletResponse response) {
+        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+        model.addAttribute("errorTitle", "⚠️Access Denied.");
+        model.addAttribute("errorMessage",
+                "You do not have permission to perform this action.");
+        return "error/error";
     }
 }

src/main/java/org/example/visacasemanagementsystem/audit/controller/LogViewController.java

@@ -0,0 +1,119 @@
+package org.example.visacasemanagementsystem.audit.controller;
+
+import org.example.visacasemanagementsystem.audit.UserEventType;
+import org.example.visacasemanagementsystem.audit.VisaEventType;
+import org.example.visacasemanagementsystem.audit.service.UserLogService;
+import org.example.visacasemanagementsystem.audit.service.VisaLogService;
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.domain.Sort;
+import org.springframework.format.annotation.DateTimeFormat;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.time.LocalTime;
+
+/**
+ * SYSADMIN-only audit-log pages.
+ */
+@PreAuthorize("hasRole('SYSADMIN')")
+@Controller
+@RequestMapping("/log")
+public class LogViewController {
+
+    // Hard cap on page size for pagination.
+    private static final int MAX_PAGE_SIZE = 100;
+    private static final String DEFAULT_PAGE_SIZE_STR = "20";
+
+    private final VisaLogService visaLogService;
+    private final UserLogService userLogService;
+
+    public LogViewController(VisaLogService visaLogService, UserLogService userLogService) {
+        this.visaLogService = visaLogService;
+        this.userLogService = userLogService;
+    }
+
+    @GetMapping("/visa")
+    public String visaLog(
+            @RequestParam(value = "eventType", required = false) VisaEventType eventType,
+            @RequestParam(value = "from", required = false)
+                @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate from,
+            @RequestParam(value = "to", required = false)
+                @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate to,
+            @RequestParam(value = "page", defaultValue = "0") int page,
+            @RequestParam(value = "size", defaultValue = DEFAULT_PAGE_SIZE_STR) int size,
+            Model model) {
+        return renderLogPage(eventType, from, to, page, size,
+                visaLogService::findFiltered,
+                VisaEventType.values(), "Visa Log", "log/visa", model);
+    }
+
+    @GetMapping("/user")
+    public String userLog(
+            @RequestParam(value = "eventType", required = false) UserEventType eventType,
+            @RequestParam(value = "from", required = false)
+                @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate from,
+            @RequestParam(value = "to", required = false)
+                @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate to,
+            @RequestParam(value = "page", defaultValue = "0") int page,
+            @RequestParam(value = "size", defaultValue = DEFAULT_PAGE_SIZE_STR) int size,
+            Model model) {
+        return renderLogPage(eventType, from, to, page, size,
+                userLogService::findFiltered,
+                UserEventType.values(), "User Log", "log/user", model);
+    }
+
+    // ─── Helpers ──────────────────────────────────────────────────────────
+
+    /** Four-arity fetch function: (eventType, from, to, pageable) → Page. */
+    @FunctionalInterface
+    private interface LogFetcher<E extends Enum<E>, D> {
+        Page<D> fetch(E eventType, LocalDateTime from, LocalDateTime to, Pageable pageable);
+    }
+
+    /**
+     * Populates the model and returns the view name for any log page.
+     * Date-to-LocalDateTime conversion and pagination clamping are applied here
+     * so each handler only needs to supply its service reference and enum type.
+     */
+    private <E extends Enum<E>, D> String renderLogPage(
+            E eventType, LocalDate from, LocalDate to, int page, int size,
+            LogFetcher<E, D> fetchFn,
+            E[] allEventTypes, String pageTitle, String view, Model model) {
+
+        Page<D> logs = fetchFn.fetch(
+                eventType,
+                startOfDayOrNull(from),
+                endOfDayOrNull(to),
+                buildPageable(page, size));
+
+        model.addAttribute("logs", logs);
+        model.addAttribute("eventTypes", allEventTypes);
+        model.addAttribute("selectedEventType", eventType);
+        model.addAttribute("from", from);
+        model.addAttribute("to", to);
+        model.addAttribute("pageTitle", pageTitle);
+        return view;
+    }
+
+    private static LocalDateTime startOfDayOrNull(LocalDate d) {
+        return d == null ? null : d.atStartOfDay();
+    }
+
+    private static LocalDateTime endOfDayOrNull(LocalDate d) {
+        return d == null ? null : d.atTime(LocalTime.MAX);
+    }
+
+    private static PageRequest buildPageable(int page, int size) {
+        int safePage = Math.max(page, 0);
+        int safeSize = Math.clamp(size, 1, MAX_PAGE_SIZE);
+        return PageRequest.of(safePage, safeSize, Sort.by(Sort.Direction.DESC, "timeStamp"));
+    }
+}

src/main/java/org/example/visacasemanagementsystem/audit/repository/UserLogRepository.java

@@ -2,8 +2,9 @@
 
 import org.example.visacasemanagementsystem.audit.entity.UserLog;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 import org.springframework.stereotype.Repository;
 
 @Repository
-public interface UserLogRepository extends JpaRepository<UserLog, Long> {
+public interface UserLogRepository extends JpaRepository<UserLog, Long>, JpaSpecificationExecutor<UserLog> {
 }

src/main/java/org/example/visacasemanagementsystem/audit/repository/VisaLogRepository.java

@@ -2,8 +2,9 @@
 
 import org.example.visacasemanagementsystem.audit.entity.VisaLog;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.JpaSpecificationExecutor;
 import org.springframework.stereotype.Repository;
 
 @Repository
-public interface VisaLogRepository extends JpaRepository<VisaLog, Long> {
+public interface VisaLogRepository extends JpaRepository<VisaLog, Long>, JpaSpecificationExecutor<VisaLog> {
 }

src/main/java/org/example/visacasemanagementsystem/audit/service/UserLogService.java

@@ -3,11 +3,16 @@
 import org.example.visacasemanagementsystem.audit.UserEventType;
 import org.example.visacasemanagementsystem.audit.dto.UserLogDTO;
 import org.example.visacasemanagementsystem.audit.entity.UserLog;
+import org.example.visacasemanagementsystem.audit.entity.UserLog_;
 import org.example.visacasemanagementsystem.audit.mapper.UserLogMapper;
 import org.example.visacasemanagementsystem.audit.repository.UserLogRepository;
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.domain.Specification;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Service;
 
+import java.time.LocalDateTime;
 import java.util.List;
 
 @Service
@@ -33,4 +38,29 @@ public List<UserLogDTO> findAll() {
                 .map(userLogMapper::toDTO)
                 .toList();
     }
+
+    /**
+     * Used by the /log/user page. Mirror of VisaLogService#findFiltered.
+     * Only non-null filters are added to the query, avoiding Hibernate 6/7's
+     * inability to bind null enum-typed parameters in JPQL.
+     */
+    @PreAuthorize("isAuthenticated()")
+    public Page<UserLogDTO> findFiltered(UserEventType eventType,
+                                         LocalDateTime from,
+                                         LocalDateTime to,
+                                         Pageable pageable) {
+        // Start from the "no filter" Specification. Spring Data JPA 4 deprecated
+        // the where(null) idiom in favour of this explicit factory method.
+        Specification<UserLog> spec = Specification.unrestricted();
+        if (eventType != null) {
+            spec = spec.and((root, query, cb) -> cb.equal(root.get(UserLog_.userEventType), eventType));
+        }
+        if (from != null) {
+            spec = spec.and((root, query, cb) -> cb.greaterThanOrEqualTo(root.get(UserLog_.timeStamp), from));
+        }
+        if (to != null) {
+            spec = spec.and((root, query, cb) -> cb.lessThanOrEqualTo(root.get(UserLog_.timeStamp), to));
+        }
+        return userLogRepository.findAll(spec, pageable).map(userLogMapper::toDTO);
+    }
 }

src/main/java/org/example/visacasemanagementsystem/audit/service/VisaLogService.java

@@ -3,11 +3,16 @@
 import org.example.visacasemanagementsystem.audit.VisaEventType;
 import org.example.visacasemanagementsystem.audit.dto.VisaLogDTO;
 import org.example.visacasemanagementsystem.audit.entity.VisaLog;
+import org.example.visacasemanagementsystem.audit.entity.VisaLog_;
 import org.example.visacasemanagementsystem.audit.mapper.VisaLogMapper;
 import org.example.visacasemanagementsystem.audit.repository.VisaLogRepository;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.domain.Specification;
 import org.springframework.stereotype.Service;
 
+import java.time.LocalDateTime;
 import java.util.List;
 
 @Service
@@ -33,4 +38,28 @@ public List<VisaLogDTO> findAll() {
                 .map(visaLogMapper::toDTO)
                 .toList();
     }
+
+    /**
+     * Used by the /log/visa page. Any of the three filter values can be null —
+     * only non-null filters are added to the query, so Hibernate never has to
+     * bind a null enum parameter (which fails in Hibernate 6/7).
+     */
+    public Page<VisaLogDTO> findFiltered(VisaEventType eventType,
+                                         LocalDateTime from,
+                                         LocalDateTime to,
+                                         Pageable pageable) {
+        // Start from the "no filter" Specification. Spring Data JPA 4 deprecated
+        // the where(null) idiom in favour of this explicit factory method.
+        Specification<VisaLog> spec = Specification.unrestricted();
+        if (eventType != null) {
+            spec = spec.and((root, query, cb) -> cb.equal(root.get(VisaLog_.visaEventType), eventType));
+        }
+        if (from != null) {
+            spec = spec.and((root, query, cb) -> cb.greaterThanOrEqualTo(root.get(VisaLog_.timeStamp), from));
+        }
+        if (to != null) {
+            spec = spec.and((root, query, cb) -> cb.lessThanOrEqualTo(root.get(VisaLog_.timeStamp), to));
+        }
+        return visaLogRepository.findAll(spec, pageable).map(visaLogMapper::toDTO);
+    }
 }

src/main/java/org/example/visacasemanagementsystem/config/SecurityConfig.java

@@ -7,6 +7,7 @@
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
@@ -15,7 +16,6 @@
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
 import org.springframework.security.web.context.SecurityContextRepository;
 
-import static org.springframework.security.config.Customizer.withDefaults;
 
 @Configuration
 @EnableWebSecurity
@@ -32,29 +32,46 @@ public SecurityConfig(UserDetailsService userDetailsService) {
     public SecurityFilterChain securityFilterChain(HttpSecurity http, OauthSuccessHandler oauthSuccessHandler) throws Exception {
         http
                 .authorizeHttpRequests(auth -> auth
+                        // Public landing + static assets + anonymous auth forms
                         .requestMatchers("/").permitAll()
+                        .requestMatchers("/css/**").permitAll()
                         .requestMatchers("/static/google-icon.svg").permitAll()
                         .requestMatchers("/user/signup").permitAll()
                         .requestMatchers("/user/login").permitAll()
-                        .requestMatchers("/logout").permitAll()
-                        .requestMatchers("/dashboard").authenticated()
+
+                        // Any authenticated user can hit these; role-specific protection
+                        // lives on the individual @PreAuthorize annotations.
+                        .requestMatchers(org.springframework.http.HttpMethod.POST, "/user/logout").authenticated()
+                        .requestMatchers("/home").authenticated()
                         .requestMatchers("/profile/**").authenticated()
-                        .requestMatchers("/visas/**").authenticated()
+                        .requestMatchers("/visa/cases").hasAnyRole("SYSADMIN", "ADMIN")
+                        .requestMatchers("/visa/my-applications").hasRole("USER")
+                        .requestMatchers("/visa/apply").hasRole("USER")
+                        .requestMatchers("/visa/**").authenticated()
                         .requestMatchers("/api/comments/**").authenticated()
-                        .requestMatchers("/**/admin").hasRole("ADMIN")
-                        .requestMatchers("/**/applicant").hasRole("USER")
+
+                        // Audit logs and user list are sysadmin-only.
                         .requestMatchers("/profile/edit/{userId}/authorization").hasRole("SYSADMIN")
+                        .requestMatchers("/log/**").hasRole("SYSADMIN")
+                        .requestMatchers("/favicon.ico").permitAll()
+                        .requestMatchers("/login/oauth2/**").permitAll()
+                        .requestMatchers("/error").permitAll()
+                        .requestMatchers("/access-denied").permitAll()
                         .anyRequest().hasRole("SYSADMIN")
                 )
+                .exceptionHandling(ex -> ex.accessDeniedPage("/access-denied"))
                 .headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin))
                 .formLogin(l -> l
-                        .defaultSuccessUrl("/dashboard", true)
+                        // /home is the single post-login router and redirects as follows:
+                        // USER -> /visa/my-applications
+                        // ADMIN -> /visa/cases,
+                        // SYSADMIN -> /log/visa
+                        .defaultSuccessUrl("/home", true)
                         .loginPage("/user/login"))
                 .oauth2Login(l -> l
                         .loginPage("/user/login")
                         .successHandler(oauthSuccessHandler))
-                .logout(withDefaults()) //TODO: Custom logout page required
-                .httpBasic(withDefaults());
+                .logout(AbstractHttpConfigurer::disable);
 
         return http.build();
     }