Dev

README.md

@@ -17,15 +17,24 @@
 [![Spring Boot 4.0.6](https://img.shields.io/badge/Spring%20Boot-4.0.6-brightgreen.svg?logo=springboot&logoColor=white)](https://spring.io/projects/spring-boot)
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-16-336791.svg?logo=postgresql&logoColor=white)](https://www.postgresql.org/)
 [![Redis](https://img.shields.io/badge/Redis-7-DC382D.svg?logo=redis&logoColor=white)](https://redis.io/)
+[![Apache Kafka](https://img.shields.io/badge/Apache_Kafka-7.6-231F20.svg?logo=apachekafka&logoColor=white)](https://kafka.apache.org/)
 [![Liquibase](https://img.shields.io/badge/Liquibase-Migrations-006699.svg?logo=liquibase&logoColor=white)](https://www.liquibase.com/)
+[![WebSockets](https://img.shields.io/badge/WebSockets-STOMP-010101.svg?logo=socketdotio&logoColor=white)](https://docs.spring.io/spring-framework/reference/web/websocket.html)
 [![React 19](https://img.shields.io/badge/React-19-61dafb.svg?logo=react&logoColor=black)](https://react.dev/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-blue.svg?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![Tailwind CSS v4](https://img.shields.io/badge/Tailwind_CSS-v4-38b2ac.svg?logo=tailwindcss&logoColor=white)](https://tailwindcss.com/)
+[![TanStack Query](https://img.shields.io/badge/TanStack_Query-v5-FF4154.svg?logo=reactquery&logoColor=white)](https://tanstack.com/query)
+[![Zod](https://img.shields.io/badge/Zod-v4-3E67B1.svg?logo=zod&logoColor=white)](https://zod.dev/)
+[![AI Multi-Router](https://img.shields.io/badge/AI-Multi--Router-8E75B2.svg?logo=googlegemini&logoColor=white)](docs/backend/decisions/README.md#adr-002-multi-provider-ai-fallback-router-architecture)
+[![Stripe API](https://img.shields.io/badge/Stripe-API-635BFF.svg?logo=stripe&logoColor=white)](https://stripe.com/)
+[![Playwright](https://img.shields.io/badge/Playwright-E2E_Tests-2EAD33.svg?logo=playwright&logoColor=white)](https://playwright.dev/)
+[![Grafana k6](https://img.shields.io/badge/Grafana_k6-Load_Testing-7D64FF.svg?logo=k6&logoColor=white)](https://k6.io/)
 
 [![Docker](https://img.shields.io/badge/Docker-Multi--Stage-2496ED.svg?logo=docker&logoColor=white)](https://www.docker.com/)
 [![Nginx](https://img.shields.io/badge/Nginx-Reverse_Proxy-009639.svg?logo=nginx&logoColor=white)](https://nginx.org/)
 [![Testcontainers](https://img.shields.io/badge/Testcontainers-Integration_Tests-0B1C28.svg)](https://testcontainers.com/)
 [![Telegram Bot API](https://img.shields.io/badge/Telegram-Bot_API-26A5E4.svg?logo=telegram&logoColor=white)](https://core.telegram.org/bots/api)
+[![Cloudflare Turnstile](https://img.shields.io/badge/Cloudflare-Turnstile-F38020.svg?logo=cloudflare&logoColor=white)](https://www.cloudflare.com/products/turnstile/)
 
 ---
 
@@ -39,8 +48,6 @@ It serves as a full-scale technical showcase of building resilient, high-concurr
   <img src="docs/images/preview.gif" alt="Launchly Platform Overview" width="100%" />
 </p>
 
----
-
 ## Tech Stack
 
 ### Backend — `backend/`
@@ -53,6 +60,7 @@ It serves as a full-scale technical showcase of building resilient, high-concurr
 - **Transactional Outbox & DLQ**: Resilient asynchronous event delivery with retry backoff and Dead Letter Queue
 - **Distributed Idempotency Layer**: Redis-backed replay protection on all critical mutation endpoints
 - **Dynamic Tier-Based Rate Limiter**: Token-bucket algorithm with RFC headers and role-based quotas
+- **Cloudflare Turnstile Verify API**: Server-side bot verification and credential stuffing protection on auth endpoints
 - **Enterprise Security Headers**: Strict HSTS, Content-Type Options, Frame Options, Referrer and Permissions policies
 - **GDPR & SOC2 PII Masking**: Automatic redacting of emails, phone numbers, and secrets in runtime logs
 - **JPA Deep Entity Graphs & JDBC Batching**: High-throughput statement batching (size=50) and N+1 query elimination
@@ -71,6 +79,7 @@ It serves as a full-scale technical showcase of building resilient, high-concurr
 - **TanStack Query v5**: Server state caching, background synchronization, and optimistic mutations
 - **Zustand v5**: Client-only synchronous state (auth session, canvas selection, network health)
 - **React Hook Form + Zod v4**: Strict type-safe form validation and DTO transformations
+- **Cloudflare Turnstile Widget**: Non-blocking bot protection with dynamic theme and flexible sizing
 - **React Router v7**: Nested dashboard layouts and role-based route guards
 - **STOMP & SockJS Client**: Real-time live chat subscriptions
 - **TanStack Virtual & Custom Virtualizer**: Scalable windowing for high-volume conversation and contact lists
@@ -90,6 +99,7 @@ It serves as a full-scale technical showcase of building resilient, high-concurr
 
 - **Visual Bot Constructor**: Drag-and-drop conversational graph builder supporting Message, Menu, Action, Condition, and AI nodes.
 - **Omnichannel CRM & Live Inbox**: Two-way Telegram chat with live agent intervention, conversation search, and lead status pipelines.
+- **Cloudflare Turnstile Bot & Spam Protection**: Smart non-interactive challenge verification securing authentication flows (registration and login) with zero friction.
 - **Transactional Outbox & Integrations**: Guaranteed at-least-once delivery for webhooks (Hotmart, e-commerce, CRM leads) with automatic retry backoff and DLQ tracking.
 - **Distributed Idempotency Protection**: Safe concurrent execution prevention for AI generation, campaign dispatches, team invites, and support appeals.
 - **Dynamic Tier Rate Limiting**: Multi-tenant token-bucket rate limiting per plan tier (`ROLE_OWNER`, `ROLE_PRO`, `ROLE_ENTERPRISE`, `ROLE_ADMIN`).

backend/pom.xml

@@ -30,7 +30,7 @@
         <java.version>21</java.version>
         <mapstruct.version>1.6.3</mapstruct.version>
         <jjwt.version>0.12.6</jjwt.version>
-        <testcontainers.version>1.20.4</testcontainers.version>
+        <testcontainers.version>1.20.6</testcontainers.version>
         <sonar.projectKey>polchduikt_launchly</sonar.projectKey>
         <sonar.organization>polchduikt</sonar.organization>
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
@@ -101,6 +101,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-jackson</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.datatype</groupId>
+            <artifactId>jackson-datatype-jsr310</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-websocket</artifactId>
@@ -273,6 +277,10 @@
             <version>${testcontainers.version}</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
@@ -297,6 +305,7 @@
                         <path>
                             <groupId>org.projectlombok</groupId>
                             <artifactId>lombok</artifactId>
+                            <version>1.18.36</version>
                         </path>
                         <path>
                             <groupId>org.mapstruct</groupId>

backend/src/main/java/com/launchly/admin/controller/AdminAutomationController.java

@@ -12,6 +12,7 @@
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.http.ResponseEntity;
@@ -82,7 +83,7 @@ public ResponseEntity<Void> toggleAutomation(@Parameter(description = "Automatio
     @PreAuthorize("hasRole('ADMIN')")
     public ResponseEntity<Void> blockAutomation(
             @Parameter(description = "Automation ID") @PathVariable Long automationId,
-            @RequestBody(required = false) AdminBlockRequest request) {
+            @Valid @RequestBody(required = false) AdminBlockRequest request) {
         adminAutomationService.blockAutomation(automationId, request);
         return ResponseEntity.ok().build();
     }

backend/src/main/java/com/launchly/admin/controller/AdminBroadcastController.java

@@ -12,6 +12,7 @@
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.http.ResponseEntity;
@@ -82,7 +83,7 @@ public ResponseEntity<Void> cancelBroadcast(@Parameter(description = "Broadcast
     @PreAuthorize("hasAnyRole('ADMIN', 'MANAGER')")
     public ResponseEntity<Void> blockBroadcast(
             @Parameter(description = "Broadcast ID") @PathVariable Long broadcastId,
-            @RequestBody(required = false) AdminBlockRequest request) {
+            @Valid @RequestBody(required = false) AdminBlockRequest request) {
         adminBroadcastService.blockBroadcast(broadcastId, request);
         return ResponseEntity.ok().build();
     }

backend/src/main/java/com/launchly/admin/controller/AdminOutboxController.java

@@ -16,7 +16,6 @@
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
-
 import java.util.Map;
 
 @Tag(name = "Admin: Outbox & DLQ", description = "Dead letter queue inspection and event replay management")

backend/src/main/java/com/launchly/admin/controller/AdminSupportChatController.java

@@ -1,8 +1,9 @@
 package com.launchly.admin.controller;
 
-import com.launchly.admin.dto.CreateMessageRequest;
-import com.launchly.admin.dto.SupportMessageDto;
-import com.launchly.admin.dto.SupportTicketDto;
+import com.launchly.support.dto.CreateMessageRequest;
+import com.launchly.support.dto.SupportMessageDto;
+import com.launchly.support.dto.SupportTicketDto;
+import com.launchly.support.enums.TicketStatus;
 import com.launchly.admin.service.AdminSupportChatService;
 import com.launchly.common.exception.ErrorResponse;
 import io.swagger.v3.oas.annotations.Operation;
@@ -12,6 +13,7 @@
 import io.swagger.v3.oas.annotations.responses.ApiResponse;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.http.ResponseEntity;
@@ -66,7 +68,7 @@ public ResponseEntity<SupportTicketDto> getTicketDetail(@Parameter(description =
     @PostMapping("/{id}/messages")
     public ResponseEntity<SupportMessageDto> addMessage(
             @Parameter(description = "Ticket ID") @PathVariable Long id,
-            @RequestBody CreateMessageRequest request,
+            @Valid @RequestBody CreateMessageRequest request,
             @AuthenticationPrincipal UserDetails userDetails) {
         return ResponseEntity.ok(adminSupportChatService.addMessage(id, request.getText(), userDetails.getUsername()));
     }
@@ -91,7 +93,7 @@ public ResponseEntity<SupportTicketDto> toggleFavorite(@Parameter(description =
     @PatchMapping("/{id}/status")
     public ResponseEntity<SupportTicketDto> updateStatus(
             @Parameter(description = "Ticket ID") @PathVariable Long id,
-            @Parameter(description = "New status: OPEN, PENDING, CLOSED") @RequestParam(required = false) String status) {
+            @Parameter(description = "New status: OPEN, PENDING, CLOSED") @RequestParam(required = false) TicketStatus status) {
         return ResponseEntity.ok(adminSupportChatService.updateStatus(id, status));
     }
 

backend/src/main/java/com/launchly/admin/entity/UserAuditLog.java

@@ -11,14 +11,18 @@
     @Index(name = "idx_user_audit_logs_user_date", columnList = "user_id, created_at"),
     @Index(name = "idx_audit_logs_user_created", columnList = "user_id, created_at DESC")
 })
-@Data
+@Getter
+@Setter
+@ToString(exclude = {"user"})
+@EqualsAndHashCode(onlyExplicitlyIncluded = true)
 @Builder
 @NoArgsConstructor
 @AllArgsConstructor
 public class UserAuditLog {
 
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @EqualsAndHashCode.Include
     private Long id;
 
     @ManyToOne(fetch = FetchType.LAZY)

backend/src/main/java/com/launchly/admin/mapper/AdminMapper.java

@@ -1,12 +1,25 @@
 package com.launchly.admin.mapper;
 
+import com.launchly.admin.dto.AdminAutomationDto;
+import com.launchly.admin.dto.AdminBroadcastDetailDto;
 import com.launchly.admin.dto.AdminBroadcastDto;
+import com.launchly.admin.dto.AdminUserDetailDto;
 import com.launchly.admin.dto.AdminUserDto;
+import com.launchly.admin.dto.UserActivityDto;
+import com.launchly.admin.dto.UserAutomationSummaryDto;
+import com.launchly.admin.dto.UserBroadcastSummaryDto;
+import com.launchly.admin.entity.UserAuditLog;
 import com.launchly.auth.entity.User;
+import com.launchly.bot.entity.Bot;
+import com.launchly.bot.entity.FlowSchema;
 import com.launchly.broadcast.entity.BroadcastCampaign;
 import org.mapstruct.Mapper;
 import org.mapstruct.Mapping;
 import org.mapstruct.ReportingPolicy;
+import org.springframework.data.domain.Page;
+
+import java.time.LocalDateTime;
+import java.util.List;
 
 @Mapper(componentModel = "spring", unmappedTargetPolicy = ReportingPolicy.IGNORE)
 public interface AdminMapper {
@@ -44,7 +57,7 @@ public interface AdminMapper {
     @Mapping(target = "blockedAt", source = "campaign.blockedAt")
     @Mapping(target = "createdByEmail", expression = "java(creator != null && creator.getEmail() != null ? creator.getEmail() : defaultAuthor)")
     @Mapping(target = "authorName", expression = "java(creator != null && creator.getName() != null ? creator.getName() : defaultAuthor)")
-    @Mapping(target = "createdAt", expression = "java(campaign.getCreatedAt() != null ? campaign.getCreatedAt() : java.time.LocalDateTime.now())")
+    @Mapping(target = "createdAt", expression = "java(campaign.getCreatedAt() != null ? campaign.getCreatedAt() : LocalDateTime.now())")
     AdminBroadcastDto toBroadcastDto(BroadcastCampaign campaign, User creator, String defaultAuthor);
 
     @Mapping(target = "id", source = "campaign.id")
@@ -55,17 +68,16 @@ public interface AdminMapper {
     @Mapping(target = "sentCount", expression = "java(campaign.getSentCount() != null ? campaign.getSentCount() : 0)")
     @Mapping(target = "failedCount", expression = "java(campaign.getFailedCount() != null ? campaign.getFailedCount() : 0)")
     @Mapping(target = "totalCount", expression = "java(campaign.getTotalCount() != null ? campaign.getTotalCount() : 0)")
-    @Mapping(target = "status", expression = "java(campaign.isBlocked() ? \"BLOCKED\" : (campaign.getStatus() != null ? campaign.getStatus().name() : \"DRAFT\"))")
-    @Mapping(target = "blocked", source = "campaign.blocked")
+    @Mapping(target = "status", expression = "java(campaign.getStatus() != null ? campaign.getStatus().name() : \"DRAFT\")")
     @Mapping(target = "blockReason", source = "campaign.blockReason")
     @Mapping(target = "blockedAt", source = "campaign.blockedAt")
     @Mapping(target = "createdByEmail", expression = "java(creator != null && creator.getEmail() != null ? creator.getEmail() : defaultAuthor)")
     @Mapping(target = "authorName", expression = "java(creator != null && creator.getName() != null ? creator.getName() : defaultAuthor)")
     @Mapping(target = "authorId", expression = "java(creator != null ? creator.getId() : null)")
-    @Mapping(target = "createdAt", expression = "java(campaign.getCreatedAt() != null ? campaign.getCreatedAt() : java.time.LocalDateTime.now())")
+    @Mapping(target = "createdAt", expression = "java(campaign.getCreatedAt() != null ? campaign.getCreatedAt() : LocalDateTime.now())")
     @Mapping(target = "scheduledAt", source = "campaign.scheduledAt")
     @Mapping(target = "activities", source = "activities")
-    com.launchly.admin.dto.AdminBroadcastDetailDto toBroadcastDetailDto(BroadcastCampaign campaign, User creator, String defaultAuthor, org.springframework.data.domain.Page<com.launchly.admin.dto.UserActivityDto> activities);
+    AdminBroadcastDetailDto toBroadcastDetailDto(BroadcastCampaign campaign, User creator, String defaultAuthor, Page<UserActivityDto> activities);
 
     @Mapping(target = "id", source = "flow.id")
     @Mapping(target = "name", expression = "java(bot != null && bot.getName() != null ? bot.getName() : \"Flow #\" + flow.getId())")
@@ -79,8 +91,8 @@ public interface AdminMapper {
     @Mapping(target = "blockedAt", expression = "java(bot != null ? bot.getBlockedAt() : null)")
     @Mapping(target = "triggerCount", source = "runsCount")
     @Mapping(target = "errorCount", constant = "0L")
-    @Mapping(target = "lastExecutedAt", expression = "java(flow.getUpdatedAt() != null ? flow.getUpdatedAt() : java.time.LocalDateTime.now())")
-    com.launchly.admin.dto.AdminAutomationDto toAutomationDto(com.launchly.bot.entity.FlowSchema flow, com.launchly.bot.entity.Bot bot, User owner, String resolvedBotName, boolean isConnected, int runsCount);
+    @Mapping(target = "lastExecutedAt", expression = "java(flow.getUpdatedAt() != null ? flow.getUpdatedAt() : LocalDateTime.now())")
+    AdminAutomationDto toAutomationDto(FlowSchema flow, Bot bot, User owner, String resolvedBotName, boolean isConnected, int runsCount);
 
     @Mapping(target = "id", source = "log.id")
     @Mapping(target = "targetId", source = "log.targetId")
@@ -90,23 +102,23 @@ public interface AdminMapper {
     @Mapping(target = "category", source = "log.category")
     @Mapping(target = "badge", source = "log.badge")
     @Mapping(target = "timestamp", source = "log.createdAt")
-    com.launchly.admin.dto.UserActivityDto toActivityDto(com.launchly.admin.entity.UserAuditLog log);
+    UserActivityDto toActivityDto(UserAuditLog log);
 
     @Mapping(target = "id", source = "flow.id")
     @Mapping(target = "name", expression = "java(flow.getBot() != null ? flow.getBot().getName() : \"Flow #\" + flow.getId())")
     @Mapping(target = "botName", source = "resolvedBotName")
     @Mapping(target = "active", expression = "java(flow.getBot() != null && flow.getBot().isActive() && isConnected)")
     @Mapping(target = "triggerCount", source = "runs")
     @Mapping(target = "triggerType", constant = "KEYWORD")
-    com.launchly.admin.dto.UserAutomationSummaryDto toAutomationSummaryDto(com.launchly.bot.entity.FlowSchema flow, String resolvedBotName, boolean isConnected, int runs);
+    UserAutomationSummaryDto toAutomationSummaryDto(FlowSchema flow, String resolvedBotName, boolean isConnected, int runs);
 
     @Mapping(target = "id", source = "campaign.id")
     @Mapping(target = "name", source = "campaign.name")
     @Mapping(target = "botName", expression = "java(campaign.getBot() != null ? campaign.getBot().getName() : \"—\")")
     @Mapping(target = "status", expression = "java(campaign.getStatus() != null ? campaign.getStatus().name() : \"DRAFT\")")
     @Mapping(target = "sentCount", expression = "java(campaign.getSentCount() != null ? campaign.getSentCount() : 0)")
     @Mapping(target = "createdAt", expression = "java(campaign.getCreatedAt() != null ? campaign.getCreatedAt().toString() : \"\")")
-    com.launchly.admin.dto.UserBroadcastSummaryDto toBroadcastSummaryDto(BroadcastCampaign campaign);
+    UserBroadcastSummaryDto toBroadcastSummaryDto(BroadcastCampaign campaign);
 
     @Mapping(target = "id", source = "user.id")
     @Mapping(target = "email", source = "user.email")
@@ -130,7 +142,5 @@ public interface AdminMapper {
     @Mapping(target = "activities", source = "activities")
     @Mapping(target = "automations", source = "automations")
     @Mapping(target = "broadcasts", source = "broadcasts")
-    com.launchly.admin.dto.AdminUserDetailDto toUserDetailDto(User user, long botsCount, long automationsCount, long broadcastsCount, long contactsCount, String planName, java.time.LocalDateTime lastActivity, org.springframework.data.domain.Page<com.launchly.admin.dto.UserActivityDto> activities, java.util.List<com.launchly.admin.dto.UserAutomationSummaryDto> automations, java.util.List<com.launchly.admin.dto.UserBroadcastSummaryDto> broadcasts);
+    AdminUserDetailDto toUserDetailDto(User user, long botsCount, long automationsCount, long broadcastsCount, long contactsCount, String planName, LocalDateTime lastActivity, Page<UserActivityDto> activities, List<UserAutomationSummaryDto> automations, List<UserBroadcastSummaryDto> broadcasts);
 }
-
-