Refactor BFF Package Structure #64

Merged
stne3960 merged 12 commits from refactor/bff-structure into main 2026-01-12 17:38:55 +01:00
Owner

This PR

  • Reorganizes BFF codebase into a cleaner layered architecture with separate packages for config, controller, dto/response, and service
  • Upgrades Spring Boot from 3.4.4 to 4.0.1 (includes Spring Security 7 and Jackson 3)
  • Enables CSRF protection for the SPA frontend
  • Adds Accept-Language header support in frontend

Package restructuring:

  • Move configuration classes (BackendApiConfiguration, FrontendConfiguration) to bff.config
  • Move controllers (ProfileController, TestController) to bff.controller
  • Move DTOs to bff.dto.response and rename Profile to ProfileResponse
  • Extract ProfileService into new bff.service package
  • Extract security configuration from main class into dedicated SecurityConfiguration

Security improvements:

  • Enable CSRF protection with csrf.spa() for Single Page Application support
  • Add PUT and DELETE to allowed CORS methods
  • Add X-XSRF-TOKEN to allowed headers

Frontend middleware:

  • Add includeCsrfToken middleware to automatically include CSRF tokens in POST/PUT/DELETE requests
  • Add includeAcceptLanguage middleware to send browser language preferences (uses navigator language before profile is fetched)

Other:

  • Minor code formatting improvements (checkstyle will be separate PR)
This PR - Reorganizes BFF codebase into a cleaner layered architecture with separate packages for config, controller, dto/response, and service - Upgrades Spring Boot from 3.4.4 to 4.0.1 (includes Spring Security 7 and Jackson 3) - Enables CSRF protection for the SPA frontend - Adds Accept-Language header support in frontend Package restructuring: - Move configuration classes (BackendApiConfiguration, FrontendConfiguration) to bff.config - Move controllers (ProfileController, TestController) to bff.controller - Move DTOs to bff.dto.response and rename Profile to ProfileResponse - Extract ProfileService into new bff.service package - Extract security configuration from main class into dedicated SecurityConfiguration Security improvements: - Enable CSRF protection with csrf.spa() for Single Page Application support - Add PUT and DELETE to allowed CORS methods - Add X-XSRF-TOKEN to allowed headers Frontend middleware: - Add includeCsrfToken middleware to automatically include CSRF tokens in POST/PUT/DELETE requests - Add includeAcceptLanguage middleware to send browser language preferences (uses navigator language before profile is fetched) Other: - Minor code formatting improvements (checkstyle will be separate PR)
stne3960 added 12 commits 2026-01-11 14:33:16 +01:00
First-time contributor
Deployed to https://studentportalen-refactor-bff-structure.branch.dsv.su.se
ansv7779 approved these changes 2026-01-12 11:40:55 +01:00
stne3960 merged commit e6439c244f into main 2026-01-12 17:38:55 +01:00
Sign in to join this conversation.
No Reviewers
No Milestone
No project
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DMC/studentportalen#64
No description provided.