feat: fix backend issues with state and memory leak

RMCampos · RMCampos · commit 9c404fc3f74f · 2026-03-02T12:53:45.000-03:00
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
@@ -39,7 +39,7 @@ services:
     ports:
       - "8585:8585"
       - "5005:5005"
-    image: maven:3.9.9-eclipse-temurin-25
+    image: maven:3.9.12-eclipse-temurin-25
     entrypoint: './mvnw -ntp spring-boot:run -Dspring-boot.run.jvmArguments="-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=*:5005" -Dmaven.plugin.validation=VERBOSE'
     working_dir: /app
     volumes:
diff --git a/server/pom.xml b/server/pom.xml
@@ -173,7 +173,7 @@
             <configuration>
               <enableLazyInitialization>true</enableLazyInitialization>
               <enableDirtyTracking>true</enableDirtyTracking>
-              <enableAssociationManagement>true</enableAssociationManagement>
+              <enableAssociationManagement>false</enableAssociationManagement>
             </configuration>
           </execution>
         </executions>
diff --git a/server/src/main/java/br/com/tasknoteapp/server/config/SecurityConfig.java b/server/src/main/java/br/com/tasknoteapp/server/config/SecurityConfig.java
@@ -14,6 +14,7 @@
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
@@ -59,6 +60,8 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                     .permitAll())
         .httpBasic(AbstractHttpConfigurer::disable)
         .formLogin(AbstractHttpConfigurer::disable)
+        .sessionManagement(
+            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
         .exceptionHandling(
             exceptionHandling ->
                 exceptionHandling.authenticationEntryPoint(
diff --git a/server/src/main/java/br/com/tasknoteapp/server/controller/NoteController.java b/server/src/main/java/br/com/tasknoteapp/server/controller/NoteController.java
@@ -1,6 +1,5 @@
 package br.com.tasknoteapp.server.controller;
 
-import br.com.tasknoteapp.server.entity.NoteEntity;
 import br.com.tasknoteapp.server.exception.NoteNotFoundException;
 import br.com.tasknoteapp.server.request.NotePatchRequest;
 import br.com.tasknoteapp.server.request.NoteRequest;
@@ -77,8 +76,8 @@ public ResponseEntity<NoteResponse> patchNote(
    */
   @PostMapping
   public ResponseEntity<NoteResponse> postNotes(@RequestBody @Valid NoteRequest noteRequest) {
-    NoteEntity createdNote = noteService.createNote(noteRequest);
-    return ResponseEntity.status(HttpStatus.CREATED).body(NoteResponse.fromEntity(createdNote));
+    NoteResponse createdNote = noteService.createNote(noteRequest);
+    return ResponseEntity.status(HttpStatus.CREATED).body(createdNote);
   }
 
   /**
diff --git a/server/src/main/java/br/com/tasknoteapp/server/entity/NoteEntity.java b/server/src/main/java/br/com/tasknoteapp/server/entity/NoteEntity.java
@@ -8,7 +8,6 @@
 import jakarta.persistence.Id;
 import jakarta.persistence.JoinColumn;
 import jakarta.persistence.ManyToOne;
-import jakarta.persistence.OneToOne;
 import jakarta.persistence.Table;
 import java.time.LocalDateTime;
 
@@ -30,9 +29,6 @@ public class NoteEntity {
   @ManyToOne(fetch = FetchType.LAZY)
   private UserEntity user;
 
-  @OneToOne(mappedBy = "note", fetch = FetchType.LAZY)
-  private NoteUrlEntity noteUrl;
-
   @Column(name = "tag", nullable = true, length = 30)
   private String tag;
 
@@ -77,14 +73,6 @@ public void setUser(UserEntity user) {
     this.user = user;
   }
 
-  public NoteUrlEntity getNoteUrl() {
-    return noteUrl;
-  }
-
-  public void setNoteUrl(NoteUrlEntity noteUrl) {
-    this.noteUrl = noteUrl;
-  }
-
   public String getTag() {
     return tag;
   }
diff --git a/server/src/main/java/br/com/tasknoteapp/server/entity/UserEntity.java b/server/src/main/java/br/com/tasknoteapp/server/entity/UserEntity.java
@@ -5,7 +5,6 @@
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
-import jakarta.persistence.OneToMany;
 import jakarta.persistence.Table;
 import java.time.LocalDateTime;
 import java.util.Collection;
@@ -41,9 +40,6 @@ public class UserEntity implements UserDetails {
   @Column(name = "name", length = 20)
   private String name;
 
-  @OneToMany(mappedBy = "user")
-  private List<TaskEntity> tasks;
-
   @Column(name = "email_confirmed_at", nullable = true)
   private LocalDateTime emailConfirmedAt;
 
@@ -147,14 +143,6 @@ public void setName(String name) {
     this.name = name;
   }
 
-  public List<TaskEntity> getTasks() {
-    return tasks;
-  }
-
-  public void setTasks(List<TaskEntity> tasks) {
-    this.tasks = tasks;
-  }
-
   public LocalDateTime getEmailConfirmedAt() {
     return emailConfirmedAt;
   }
diff --git a/server/src/main/java/br/com/tasknoteapp/server/repository/NoteUrlRepository.java b/server/src/main/java/br/com/tasknoteapp/server/repository/NoteUrlRepository.java
@@ -1,10 +1,13 @@
 package br.com.tasknoteapp.server.repository;
 
 import br.com.tasknoteapp.server.entity.NoteUrlEntity;
+import java.util.Optional;
 import org.springframework.data.jpa.repository.JpaRepository;
 
 /** This interface represents a note url repository, for database access. */
 public interface NoteUrlRepository extends JpaRepository<NoteUrlEntity, Long> {
 
+  Optional<NoteUrlEntity> findByNote_id(Long noteId);
+
   void deleteByNote_id(Long noteId);
 }
diff --git a/server/src/main/java/br/com/tasknoteapp/server/repository/UserPwdLimitRepository.java b/server/src/main/java/br/com/tasknoteapp/server/repository/UserPwdLimitRepository.java
@@ -12,6 +12,8 @@ public interface UserPwdLimitRepository extends JpaRepository<UserPwdLimitEntity
 
   List<UserPwdLimitEntity> findAllByUser_id(Long userId, Sort sort);
 
+  List<UserPwdLimitEntity> findTop3ByUser_idOrderByWhenHappenedDesc(Long userId);
+
   @Modifying
   @Query("delete UserPwdLimitEntity u where u.user.id = ?1")
   void deleteAllForUser(Long userId);
diff --git a/server/src/main/java/br/com/tasknoteapp/server/response/NoteResponse.java b/server/src/main/java/br/com/tasknoteapp/server/response/NoteResponse.java
@@ -1,9 +1,7 @@
 package br.com.tasknoteapp.server.response;
 
 import br.com.tasknoteapp.server.entity.NoteEntity;
-import br.com.tasknoteapp.server.entity.NoteUrlEntity;
 import br.com.tasknoteapp.server.util.TimeAgoUtil;
-import java.util.Objects;
 
 /** This record represents a task and its urls object to be returned. */
 public record NoteResponse(
@@ -16,9 +14,7 @@ public record NoteResponse(
    * @param entity The NoteEntity source data.
    * @return NoteResponse instance with all note data and urls, if any.
    */
-  public static NoteResponse fromEntity(NoteEntity entity) {
-    NoteUrlEntity noteUrl = entity.getNoteUrl();
-    String url = Objects.isNull(noteUrl) ? null : noteUrl.getUrl();
+  public static NoteResponse fromEntity(NoteEntity entity, String url) {
     String timeAgoFmt = TimeAgoUtil.format(entity.getLastUpdate());
 
     return new NoteResponse(
diff --git a/server/src/main/java/br/com/tasknoteapp/server/service/AuthService.java b/server/src/main/java/br/com/tasknoteapp/server/service/AuthService.java
@@ -36,8 +36,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.core.env.Environment;
-import org.springframework.data.domain.Sort;
-import org.springframework.data.domain.Sort.Direction;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -513,8 +511,10 @@ private Optional<String> getGravatarImageUrl(String email) {
   }
 
   private void checkLoginAttemptLimit(Long userId) {
-    Sort sort = Sort.by(Direction.DESC, "whenHappened");
-    List<UserPwdLimitEntity> userPwdList = userPwdLimitRepository.findAllByUser_id(userId, sort);
+    // Fetch only the 3 most recent failed attempts to avoid loading unbounded rows for
+    // targeted/brute-forced accounts.
+    List<UserPwdLimitEntity> userPwdList =
+        userPwdLimitRepository.findTop3ByUser_idOrderByWhenHappenedDesc(userId);
 
     logger.warn("login count attempt for user {}: {}", userId, userPwdList.size());
 
diff --git a/server/src/main/java/br/com/tasknoteapp/server/service/MailgunEmailService.java b/server/src/main/java/br/com/tasknoteapp/server/service/MailgunEmailService.java
@@ -8,6 +8,7 @@
 import br.com.tasknoteapp.server.templates.MailgunTemplateResetPwdConfirm;
 import br.com.tasknoteapp.server.templates.MailgunTemplateSignUp;
 import java.nio.charset.StandardCharsets;
+import java.time.Duration;
 import java.util.Base64;
 import java.util.Objects;
 import org.slf4j.Logger;
@@ -53,7 +54,11 @@ public MailgunEmailService(
     this.senderEmail = sender;
     this.targetEnv = targetEnv;
     this.restTemplate =
-        templateBuilder.defaultHeader(HttpHeaders.AUTHORIZATION, basicAuth("api", apiKey)).build();
+        templateBuilder
+            .connectTimeout(Duration.ofSeconds(5))
+            .readTimeout(Duration.ofSeconds(10))
+            .defaultHeader(HttpHeaders.AUTHORIZATION, basicAuth("api", apiKey))
+            .build();
   }
 
   /**
diff --git a/server/src/main/java/br/com/tasknoteapp/server/service/NoteService.java b/server/src/main/java/br/com/tasknoteapp/server/service/NoteService.java
@@ -67,7 +67,9 @@ public List<NoteResponse> getAllNotes() {
     List<NoteEntity> notes = noteRepository.findAllByUser_id(user.getId());
     logger.info(notes.size() + " notes found!");
 
-    return notes.stream().map(NoteResponse::fromEntity).toList();
+    return notes.stream()
+        .map(n -> NoteResponse.fromEntity(n, getNoteUrl(n.getId())))
+        .toList();
   }
 
   /**
@@ -86,16 +88,16 @@ public NoteResponse getNoteById(Long noteId) {
     }
 
     logger.info("Note found! Id " + noteId);
-    return NoteResponse.fromEntity(task.get());
+    return NoteResponse.fromEntity(task.get(), getNoteUrl(noteId));
   }
 
   /**
    * Create a note for the user.
    *
    * @param noteRequest The note content.
-   * @return {@link NoteEntity} created in the database
+   * @return {@link NoteResponse} with created note data.
    */
-  public NoteEntity createNote(NoteRequest noteRequest) {
+  public NoteResponse createNote(NoteRequest noteRequest) {
     UserEntity user = getCurrentUser();
 
     logger.info("Creating note to user " + user.getId());
@@ -110,13 +112,14 @@ public NoteEntity createNote(NoteRequest noteRequest) {
 
     logger.info("Note created! Id " + created.getId());
 
+    String savedUrl = null;
     if (!Objects.isNull(noteRequest.url()) && !noteRequest.url().isEmpty()) {
       NoteUrlEntity urlEntity = saveUrl(note, noteRequest.url());
-      note.setNoteUrl(urlEntity);
+      savedUrl = urlEntity.getUrl();
     }
 
     logger.info("Finished note creation!");
-    return created;
+    return NoteResponse.fromEntity(created, savedUrl);
   }
 
   /**
@@ -154,8 +157,7 @@ public NoteResponse patchNote(Long noteId, NotePatchRequest patch) {
     logger.info("URL deleted from task " + noteId);
 
     if (!Objects.isNull(patch.url()) && !patch.url().isBlank()) {
-      NoteUrlEntity urlEntity = saveUrl(noteEntity, patch.url());
-      noteEntity.setNoteUrl(urlEntity);
+      saveUrl(noteEntity, patch.url());
     } else {
       logger.info("No urls to patch for task " + noteId);
     }
@@ -165,7 +167,7 @@ public NoteResponse patchNote(Long noteId, NotePatchRequest patch) {
 
     logger.info("Note patched! Id " + patchedNote.getId());
 
-    return NoteResponse.fromEntity(patchedNote);
+    return NoteResponse.fromEntity(patchedNote, getNoteUrl(patchedNote.getId()));
   }
 
   /**
@@ -186,13 +188,8 @@ public void deleteNote(Long noteId) {
 
     NoteEntity noteEntity = note.get();
 
-    NoteUrlEntity noteUrl = noteEntity.getNoteUrl();
-    if (!Objects.isNull(noteUrl)) {
-      noteUrlRepository.delete(noteUrl);
-      logger.info("URL Deleted from task " + noteId);
-    } else {
-      logger.info("No urls to delete for task " + noteId);
-    }
+    noteUrlRepository.deleteByNote_id(noteId);
+    logger.info("URL deleted from task " + noteId);
 
     noteRepository.delete(noteEntity);
 
@@ -213,7 +210,9 @@ public List<NoteResponse> searchNotes(String searchTerm) {
     List<NoteEntity> notes =
         noteRepository.findAllBySearchTerm(searchTerm.toUpperCase(), user.getId());
     logger.info(notes.size() + " tasks found!");
-    return notes.stream().map(NoteResponse::fromEntity).toList();
+    return notes.stream()
+        .map(n -> NoteResponse.fromEntity(n, getNoteUrl(n.getId())))
+        .toList();
   }
 
   /**
@@ -239,7 +238,7 @@ public NoteResponse shareNote(Long noteId) {
       logger.info("Note " + noteId + " shared with token " + noteEntity.getShareToken());
     }
 
-    return NoteResponse.fromEntity(noteEntity);
+    return NoteResponse.fromEntity(noteEntity, getNoteUrl(noteEntity.getId()));
   }
 
   /**
@@ -263,7 +262,7 @@ public NoteResponse unshareNote(Long noteId) {
     noteRepository.save(noteEntity);
     logger.info("Note " + noteId + " unshared.");
 
-    return NoteResponse.fromEntity(noteEntity);
+    return NoteResponse.fromEntity(noteEntity, getNoteUrl(noteEntity.getId()));
   }
 
   /**
@@ -280,7 +279,7 @@ public NoteResponse getSharedNote(String shareToken) {
       throw new NoteNotFoundException();
     }
 
-    return NoteResponse.fromEntity(noteOpt.get());
+    return NoteResponse.fromEntity(noteOpt.get(), getNoteUrl(noteOpt.get().getId()));
   }
 
   private UserEntity getCurrentUser() {
@@ -289,6 +288,10 @@ private UserEntity getCurrentUser() {
     return authService.findByEmail(email).orElseThrow();
   }
 
+  private String getNoteUrl(Long noteId) {
+    return noteUrlRepository.findByNote_id(noteId).map(NoteUrlEntity::getUrl).orElse(null);
+  }
+
   private NoteUrlEntity saveUrl(NoteEntity noteEntity, String url) {
     NoteUrlEntity noteUrl = new NoteUrlEntity();
     noteUrl.setUrl(url);
diff --git a/server/src/main/java/br/com/tasknoteapp/server/service/impl/UserServiceImpl.java b/server/src/main/java/br/com/tasknoteapp/server/service/impl/UserServiceImpl.java
@@ -4,7 +4,6 @@
 import br.com.tasknoteapp.server.repository.UserRepository;
 import br.com.tasknoteapp.server.service.UserService;
 import java.util.Optional;
-import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.stereotype.Service;
 
@@ -14,22 +13,24 @@ class UserServiceImpl implements UserService {
 
   private final UserRepository userRepository;
 
+  private UserDetailsService cachedUserDetailsService;
+
   public UserServiceImpl(UserRepository userRepository) {
     this.userRepository = userRepository;
   }
 
   @Override
   public UserDetailsService userDetailsService() {
-    return new UserDetailsService() {
-      @Override
-      public UserDetails loadUserByUsername(String email) {
-        Optional<UserEntity> user = userRepository.findByEmail(email);
-        if (user.isEmpty()) {
-          throw new RuntimeException("User not found: " + email);
-        }
-
-        return user.get();
-      }
-    };
+    if (this.cachedUserDetailsService == null) {
+      this.cachedUserDetailsService =
+          email -> {
+            Optional<UserEntity> user = userRepository.findByEmail(email);
+            if (user.isEmpty()) {
+              throw new RuntimeException("User not found: " + email);
+            }
+            return user.get();
+          };
+    }
+    return this.cachedUserDetailsService;
   }
 }
diff --git a/server/src/main/resources/application-native.yml b/server/src/main/resources/application-native.yml
@@ -36,7 +36,8 @@ spring:
     locations: classpath:db/migration
   jpa:
     database-platform: org.hibernate.dialect.PostgreSQLDialect
+    open-in-view: false
     properties:
       hibernate:
         default_schema: tasknote
-    show-sql: true
+    show-sql: false
diff --git a/server/src/main/resources/application.yml b/server/src/main/resources/application.yml
diff --git a/server/src/test/java/br/com/tasknoteapp/server/controller/NoteControllerTest.java b/server/src/test/java/br/com/tasknoteapp/server/controller/NoteControllerTest.java
diff --git a/server/src/test/java/br/com/tasknoteapp/server/service/AuthServiceTest.java b/server/src/test/java/br/com/tasknoteapp/server/service/AuthServiceTest.java
diff --git a/server/src/test/java/br/com/tasknoteapp/server/service/MailgunEmailServiceTest.java b/server/src/test/java/br/com/tasknoteapp/server/service/MailgunEmailServiceTest.java
diff --git a/server/src/test/java/br/com/tasknoteapp/server/service/NoteServiceTest.java b/server/src/test/java/br/com/tasknoteapp/server/service/NoteServiceTest.java
