Merge branch 'develop'

- Stamp version, channel and vendor into META-INF/build-info.properties
- Read build metadata at runtime from BuildProperties instead of expanded YAML
- Remove app.common placeholders from application.yaml
- Derive the OpenAPI info version from the packaged build version
- Point the OCI image source label at the GitHub repository
- Drop redundant repository blocks from settings.gradle.kts

.gitea/workflows/server-build-and-deploy.yml

@@ -0,0 +1,89 @@
+name: Build and Deploy
+
+on:
+  release:
+    types: [published]
+
+env:
+  APP_NAME: ahsarah-guide-server
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: server
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21 (Corretto)
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: corretto
+          cache: gradle
+
+      - name: Build with Gradle
+        run: >
+          ./gradlew bootJar -x test
+          -PartefactVersion="${{ gitea.event.release.tag_name }}"
+          -PbuildChannel=stable
+          -Pvendor=${{ vars.VENDOR }}
+
+      - name: Resolve JAR file path
+        id: jar
+        run: |
+          JAR_PATH=$(find build/libs -name '*.jar' | head -1)
+          echo "file=$JAR_PATH" >> "$GITHUB_OUTPUT"
+
+      - name: Upload JAR to Gitea Release
+        run: |
+          TAG="${{ gitea.event.release.tag_name }}"
+          FILE="${{ steps.jar.outputs.file }}"
+          ASSET_NAME="${APP_NAME}-${TAG}.jar"
+          curl -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Content-Type: multipart/form-data" \
+            -F "attachment=@${FILE};filename=${ASSET_NAME}" \
+            "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${{ gitea.event.release.id }}/assets?name=${ASSET_NAME}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Generate image tags
+        id: meta
+        run: |
+          DOCKERHUB_USER="${{ vars.DOCKER_HUB_USERNAME }}"
+          echo "tag_version=${DOCKERHUB_USER}/${APP_NAME}:${{ gitea.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          echo "tag_latest=${DOCKERHUB_USER}/${APP_NAME}:latest" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: server
+          file: server/Dockerfile.ci
+          build-args: |
+            JAR_FILE=${{ steps.jar.outputs.file }}
+            IMAGE_VERSION=${{ gitea.event.release.tag_name }}
+            IMAGE_VENDOR=${{ vars.VENDOR }}
+            BUILD_DATE=${{ gitea.event.release.published_at }}
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.tag_version }}
+            ${{ steps.meta.outputs.tag_latest }}
+
+      - name: Push README to Docker Hub
+        uses: christian-korneck/update-container-description-action@v1
+        env:
+          DOCKER_USER: ${{ vars.DOCKER_HUB_USERNAME }}
+          DOCKER_PASS: ${{ secrets.DOCKER_HUB_TOKEN }}
+        with:
+          destination_container_repo: ${{ vars.DOCKER_HUB_USERNAME }}/${{ env.APP_NAME }}
+          provider: dockerhub
+          readme_file: server/README.md

.gitea/workflows/web-build-and-deploy.yml

@@ -0,0 +1,115 @@
+name: Build and Deploy
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build release archive
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build release archive
+        run: pnpm build:tar
+
+      - name: Clean up previous build artifacts on server
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          command: rm -rf /tmp/dist.tar.gz /tmp/dist.tar.gz/
+
+      - name: Upload artifact to server
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: "dist.tar.gz"
+          target: "/tmp/"
+
+  upload-release-asset:
+    name: Upload to Gitea Release
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download artifact from server
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -e
+          SSH_DIR="${RUNNER_TEMP}/ssh"
+          mkdir -p "$SSH_DIR"
+          chmod 700 "$SSH_DIR"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$SSH_DIR/key"
+          chmod 600 "$SSH_DIR/key"
+          scp -i "$SSH_DIR/key" \
+              -P "$DEPLOY_PORT" \
+              -o StrictHostKeyChecking=accept-new \
+              -o UserKnownHostsFile="$SSH_DIR/known_hosts" \
+              "${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/dist.tar.gz" \
+              ./dist.tar.gz
+          rm -rf "$SSH_DIR"
+
+      - name: Upload release asset via Gitea API
+        run: |
+          set -e
+          RELEASE_ID=$(jq -r '.release.id' "$GITEA_EVENT_PATH")
+          URL="${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/${RELEASE_ID}/assets?name=dist.tar.gz"
+          curl -fsSL \
+            -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/gzip" \
+            --data-binary "@dist.tar.gz" \
+            "${URL}"
+
+  deploy-to-server:
+    name: Deploy to onixbyte.cn
+    needs: [build, upload-release-asset]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Extract archive and deploy
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script_stop: true
+          script: |
+            set -e
+            DEPLOY_PATH="${{ vars.DEPLOY_PATH }}"
+            mkdir -p "$DEPLOY_PATH"
+            rm -rf "$DEPLOY_PATH"/*
+            tar -xzf /tmp/dist.tar.gz -C "$DEPLOY_PATH" --strip-components=1
+            chown -R caddy:caddy "$DEPLOY_PATH"
+            rm -f /tmp/dist.tar.gz

.github/workflows/server-build-and-deploy.yml

@@ -0,0 +1,95 @@
+name: Server Build and Deploy
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+env:
+  APP_NAME: ahsarah-guide-server
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: server
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21 (Corretto)
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: corretto
+          cache: gradle
+
+      - name: Build with Gradle
+        run: >
+          ./gradlew bootJar -x test
+          -PartefactVersion="${{ github.event.release.tag_name }}"
+          -PbuildChannel=stable
+          -Pvendor=${{ vars.VENDOR }}
+
+      - name: Resolve JAR file path
+        id: jar
+        run: |
+          JAR_PATH=$(find build/libs -name '*.jar' | head -1)
+          echo "file=$JAR_PATH" >> "$GITHUB_OUTPUT"
+
+      - name: Prepare release asset
+        id: asset
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          FILE="${{ steps.jar.outputs.file }}"
+          ASSET_NAME="${APP_NAME}-${TAG}.jar"
+          cp "${FILE}" "../${ASSET_NAME}"
+          echo "path=${ASSET_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload JAR to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: ${{ steps.asset.outputs.path }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Generate image tags
+        id: meta
+        run: |
+          DOCKERHUB_USER="${{ vars.DOCKER_HUB_USERNAME }}"
+          echo "tag_version=${DOCKERHUB_USER}/${APP_NAME}:${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          echo "tag_latest=${DOCKERHUB_USER}/${APP_NAME}:latest" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: server
+          file: server/Dockerfile.ci
+          build-args: |
+            JAR_FILE=${{ steps.jar.outputs.file }}
+            IMAGE_VERSION=${{ github.event.release.tag_name }}
+            IMAGE_VENDOR=${{ vars.VENDOR }}
+            BUILD_DATE=${{ github.event.release.published_at }}
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.tag_version }}
+            ${{ steps.meta.outputs.tag_latest }}
+
+      - name: Push README to Docker Hub
+        uses: christian-korneck/update-container-description-action@v1
+        env:
+          DOCKER_USER: ${{ vars.DOCKER_HUB_USERNAME }}
+          DOCKER_PASS: ${{ secrets.DOCKER_HUB_TOKEN }}
+        with:
+          destination_container_repo: ${{ vars.DOCKER_HUB_USERNAME }}/${{ env.APP_NAME }}
+          provider: dockerhub
+          readme_file: server/README.md

.github/workflows/web-build-and-deploy.yml

@@ -0,0 +1,109 @@
+name: Web Build and Deploy
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build release archive
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build release archive
+        run: pnpm build:tar
+
+      - name: Clean up previous build artefacts on server
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          command: rm -rf /tmp/dist.tar.gz /tmp/dist.tar.gz/
+
+      - name: Upload artefact to server
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: "dist.tar.gz"
+          target: "/tmp/"
+
+  upload-release-asset:
+    name: Upload to GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download artefact from server
+        env:
+          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -e
+          SSH_DIR="${RUNNER_TEMP}/ssh"
+          mkdir -p "$SSH_DIR"
+          chmod 700 "$SSH_DIR"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$SSH_DIR/key"
+          chmod 600 "$SSH_DIR/key"
+          scp -i "$SSH_DIR/key" \
+              -P "$DEPLOY_PORT" \
+              -o StrictHostKeyChecking=accept-new \
+              -o UserKnownHostsFile="$SSH_DIR/known_hosts" \
+              "${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/dist.tar.gz" \
+              ./dist.tar.gz
+          rm -rf "$SSH_DIR"
+
+      - name: Upload release asset to GitHub
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist.tar.gz
+
+  deploy-to-server:
+    name: Deploy to onixbyte.cn
+    needs: [build, upload-release-asset]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Extract archive and deploy
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ vars.DEPLOY_HOST }}
+          username: ${{ vars.DEPLOY_USER }}
+          port: ${{ vars.DEPLOY_PORT }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script_stop: true
+          script: |
+            set -e
+            DEPLOY_PATH="${{ vars.DEPLOY_PATH }}"
+            mkdir -p "$DEPLOY_PATH"
+            rm -rf "$DEPLOY_PATH"/*
+            tar -xzf /tmp/dist.tar.gz -C "$DEPLOY_PATH" --strip-components=1
+            chown -R caddy:caddy "$DEPLOY_PATH"
+            rm -f /tmp/dist.tar.gz

.gitignore

@@ -97,7 +97,7 @@ fabric.properties
 # Editor-based HTTP Client
 http-client.private.env.json
 
-### Server
+### Java
 # Compiled class file
 *.class
 
@@ -111,26 +111,18 @@ http-client.private.env.json
 .mtj.tmp/
 
 # Package Files #
+*.jar
 *.war
 *.nar
 *.ear
 *.zip
 *.tar.gz
 *.rar
-*.jar
 
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
 replay_pid*
 
-# Config
-config/*.yml
-config/*.yaml
-config/*.properties
-
-# Tests
-test/
-
 ### Gradle
 .gradle
 **/build/
@@ -148,3 +140,103 @@ gradle-app.setting
 .project
 # JDT-specific (Eclipse Java Development Tools)
 .classpath
+
+gradle.properties
+
+### Node.js
+# Logs
+logs
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variable files
+.env
+.env.*
+!.env.example
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# Next.js build output
+.next
+out
+
+# Nuxt.js build / generate output
+.nuxt
+dist
+
+# Vite logs files
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test
+
+# yarn v3
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+### Server-specific
+# Config
+server/config/*.yml
+server/config/*.yaml
+server/config/*.properties
+
+# Tests
+server/test/
+
+# frp config
+frpc.toml
+
+### Claude Code
+.claude/settings.local.json
+.claude/memory/
+.claude/plans/
+.claude/worktrees/
+.claude/scheduled_tasks.json

CLAUDE.md

@@ -0,0 +1,153 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Monorepo Structure
+
+- `server/` — Java 21 + Spring Boot 3.5 + Gradle (Kotlin DSL) REST API backend
+- `web/` — React 19 + Vite 8 + TypeScript + Ant Design 6 + Tailwind CSS 4 frontend
+
+## Server
+
+### Coding Standards
+
+- **Style**: Follow the Google Java Coding Style as the foundation.
+- **Indentation**: Use 4 spaces — no tabs.
+- **Line length**: Maximum 100 characters per line.
+- **Comments**: All code comments must use British English spelling (e.g. "colour" not "color", "behaviour" not "behavior", "serialise" not "serialize", "analyse" not "analyze", "traveller" not "traveler").
+
+### Build & Test Commands
+
+```bash
+cd server
+
+# Build the project (skip tests)
+./gradlew build -x test
+
+# Run all tests
+./gradlew test
+
+# Run a single test class
+./gradlew test --tests "com.onixbyte.ahsarahguide.service.PasswordEncoderTest"
+
+# Build the full JAR
+./gradlew bootJar
+```
+
+The project uses Gradle with Java 21 (Amazon Corretto). Tests use JUnit 5 with the Spring Boot test framework, H2 in-memory database for test runtime, and Spring Security test support. Tests require an active `dev` profile.
+
+### Code Architecture
+
+**Ahsarah Guide Server** — A REST API backend for managing firearm builds/modifications.
+
+### Package structure
+
+```
+com.onixbyte.ahsarahguide
+├── client/           # External service clients (TokenClient for JWT)
+├── config/           # Spring beans: Security, CORS, Cache/Redis, Jackson, MyBatis, Spring Data
+├── controller/       # REST controllers (Firearm, Modification, Tag, Auth)
+├── domain/
+│   ├── converter/    # JPA attribute converters (FirearmTypeConverter)
+│   ├── dto/          # Request/response records (FirearmRequest, ModificationResponse, etc.)
+│   └── entity/       # JPA entities (Firearm, Modification, User, Accessory, Tuning)
+├── enumeration/      # Enums (FirearmType)
+├── exeption/         # BizException (custom runtime exception with HTTP status)
+├── filter/           # TokenAuthenticationFilter (JWT auth via OncePerRequestFilter)
+├── manager/          # Thin @Transactional wrappers around repositories
+├── mapper/           # MyBatis mappers (configured but currently unused)
+├── properties/       # @ConfigurationProperties records (Cors, Token, Cookie)
+├── repository/       # Spring Data JPA repositories
+├── security/
+│   ├── authentication/  # Custom UsernamePasswordAuthentication impl
+│   └── provider/        # UsernamePasswordAuthenticationProvider
+├── service/          # Business logic layer (FirearmService, ModificationService, AuthService, etc.)
+├── shared/           # Constants and utility classes (CookieName, CredentialProvider, JacksonModules)
+└── utils/            # Helpers (DateTimeUtil)
+```
+
+### Key design decisions
+
+- **JPA + native queries**: Most CRUD uses Spring Data JPA. Native queries (in `ModificationRepository`) handle JSONB tag filtering with Postgres `@>` operator.
+- **Custom auth flow**: JWT tokens in httpOnly cookies (`AccessToken`). Spring Security with a custom `UsernamePasswordAuthenticationProvider` and `TokenAuthenticationFilter`. Tokens are auto-renewed within 5 min of expiry.
+- **JSONB storage**: `Modification.tags` and `Modification.accessories` (including nested `Tuning` objects) are stored as JSONB columns using Hypersistence Utils `JsonType`.
+- **Strict layering**: The call chain must follow `Controller → Service → Manager → Repository/Mapper`. Skipping layers (e.g. Controller calling Manager directly, Service calling Repository directly) is not permitted.
+- **DTOs as Java records**: All request/response objects are immutable records with static `from()` factory methods for entity→DTO conversion.
+- **Flyway migrations**: SQL migrations in `src/main/resources/db/migration/`.
+
+### API endpoints
+
+| Path                          | Methods          | Auth                                 |
+|-------------------------------|------------------|--------------------------------------|
+| `/firearms`                   | GET, POST        | GET public, POST requires auth       |
+| `/firearms/{id}`              | GET, PUT, DELETE | GET public, PUT/DELETE requires auth |
+| `/modifications`              | GET, POST        | GET public, POST requires auth       |
+| `/modifications/{id}`         | GET, PUT, DELETE | GET public, PUT/DELETE requires auth |
+| `/modifications/batch`        | POST             | Requires auth                        |
+| `/modifications/batch-delete` | DELETE           | Requires auth                        |
+| `/tags`                       | GET              | Public                               |
+| `/auth/login`                 | POST             | Public                               |
+| `/auth/logout`                | POST             | Authenticated                        |
+
+### Commit convention
+
+Conventional commits: `feat:`, `chore:`, `fix:`. Messages are in English, present tense imperative style.
+
+---
+
+## Web
+
+### Commands
+
+```bash
+cd web
+
+pnpm install          # Install dependencies (pnpm required)
+pnpm dev              # Start Vite dev server
+pnpm build            # TypeScript check + Vite production build
+pnpm build:tar        # Build + tar.gz archive (used by CI)
+pnpm preview          # Preview production build locally
+pnpm lint             # ESLint
+```
+
+No test suite exists in this project.
+
+### Architecture
+
+Chinese-language SPA for browsing and managing Ahsarah Guide (阿萨拉向导). The frontend talks to the Spring Boot backend via REST APIs.
+
+**App shell** (`src/main.tsx`): React 19 + React Router 7 + Redux Toolkit + Ant Design 6 + Tailwind CSS 4. Wraps the router in Redux `Provider` → `PersistGate` (Redux Persist) → Ant Design `StyleProvider`/`ConfigProvider` (locale `zh_CN`).
+
+**Routing** (`src/router/index.tsx`): Two layout groups:
+- `HeroLayout` (nav header + footer) for `/`, `/firearms`, `/mod-codes`
+- `EmptyLayout` (minimal) for `/login`
+All page components are lazy-loaded via `createBrowserRouter` + `lazy()`.
+
+**State** (`src/store/`): Redux Toolkit with two slices — `auth` (current user) and `firearms` (paginated firearm list). State is persisted to `localStorage` or `sessionStorage` based on the `VITE_REDUX_STORAGE` env var. Use typed hooks from `src/hooks/store.ts` (`useAppDispatch`, `useAppSelector`).
+
+**API layer** (`src/api/`): Axios instance (`src/shared/web-client/`) with base URL from `VITE_API_BASE_URL`, 10s timeout, and credentials. API modules: `FirearmApi`, `ModificationApi`, `TagApi`, `AuthApi`.
+
+**Pages**:
+- `FirearmsPage` — paginated card grid with type filter, create/edit modals (admin-only), delete with popconfirm
+- `ModCodesPage` — paginated list with tag multi-select and firearmId query param filter, create/edit modals with nested accessory/tuning form lists
+- `LoginPage` — simple username/password form, dispatches `setCurrentUser` on success
+
+**Shared form components**: `FirearmForm` and `ModificationForm` are reused by both create and edit modals. `ModificationForm` fetches all firearms for its weapon selector and supports a `lockFirearmId` prop that disables the selector (used when navigating from a specific firearm).
+
+**Type system** (`src/types/`): `Firearm` with weapon stats, `Modification` with nested `Accessory[]` → `Tuning[]`, `Page<T>` for paginated API responses, `User` for auth.
+
+**Vite config**: Alias `@` → `./src`. Plugins: React, Tailwind CSS 4, port checker. Build uses rolldown with manual chunk splitting for React, Redux, Ant Design, React Router, and rc-* packages.
+
+**Styling**: Tailwind CSS 4 with CSS layers (`theme, base, antd, components, utilities`). Responsive grid for mod code cards (1→2→3→4 columns). Prettier: 100 print width, no semicolons, double quotes, trailing commas ES5.
+
+### Environment variables
+
+```
+VITE_API_BASE_URL=/api        # Backend API base URL
+VITE_REDUX_STORAGE=local      # "local" or "session" for Redux persistence
+```
+
+### Contributing conventions
+
+- User-facing copy, documentation, and code comments in British English
+- Commit messages use `chore:` prefix for dependency updates (per Dependabot config)

LICENCE

@@ -0,0 +1,21 @@
+MIT Licence
+
+Copyright (c) 2026 OnixByte
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,38 @@
+# Ahsarah Guide (阿萨拉向导)
+
+Ahsarah Guide is a full-stack web application for browsing and managing firearm modification guides.
+
+## Monorepo Structure
+
+| Directory | Stack | Description |
+|-----------|-------|-------------|
+| `server/` | Java 21 + Spring Boot 3.5 + Gradle | REST API backend |
+| `web/` | React 19 + Vite 8 + TypeScript + Ant Design 6 | Web frontend |
+
+## Quick Start
+
+### Server
+
+Prerequisites: JDK 21 (Amazon Corretto), PostgreSQL, Redis
+
+```bash
+cd server
+cp config/application-prod.yaml.example config/application-dev.yaml
+# Edit config/application-dev.yaml with your database and Redis credentials
+./gradlew bootJar
+java -jar build/libs/ahsarah-guide-server-*.jar
+```
+
+### Web
+
+Prerequisites: Node.js 20+, pnpm
+
+```bash
+cd web
+pnpm install
+pnpm dev
+```
+
+## Licence
+
+MIT. See [LICENCE](LICENCE) for details.

build.gradle.kts

@@ -1,63 +0,0 @@
-plugins {
-    java
-    alias(libs.plugins.spring.boot)
-    alias(libs.plugins.spring.dependency.management)
-}
-
-val artefactVersion: String by project
-
-group = "com.onixbyte.helix"
-version = artefactVersion
-
-tasks.withType<JavaCompile> {
-    options.encoding = "UTF-8"
-}
-
-java {
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
-    toolchain {
-        languageVersion = JavaLanguageVersion.of(21)
-    }
-}
-
-dependencies {
-    implementation(libs.jspecify.core)
-    implementation(platform(libs.aws.sdk.bom))
-    implementation(libs.aws.sdk.s3)
-    implementation(libs.commons.io)
-    implementation(libs.commons.lang)
-    implementation(libs.commons.collections)
-    implementation(libs.hypersistence.core)
-    implementation(platform(libs.onixbyte.versionCatalogue))
-    implementation(libs.onixbyte.tuple)
-    implementation(libs.onixbyte.commonToolbox)
-    implementation(libs.onixbyte.mathToolbox)
-    implementation(libs.onixbyte.identityGenerator)
-    implementation(libs.onixbyte.captcha)
-    implementation(libs.onixbyte.regions)
-    implementation(libs.jwt.core)
-    implementation(libs.spring.boot.configurationProcessor)
-    implementation(libs.spring.boot.actuator)
-    implementation(libs.spring.boot.starter.web)
-    implementation(libs.spring.boot.starter.webFlux)
-    implementation(libs.spring.boot.starter.validation)
-    implementation(libs.spring.boot.starter.redis)
-    implementation(libs.spring.boot.starter.cache)
-    implementation(libs.spring.boot.starter.jpa)
-    implementation(libs.mybatis.starter.core)
-    implementation(libs.flyway.core)
-    implementation(libs.flyway.postgresql)
-    implementation(libs.jackson.jsr310)
-    implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.16")
-    testImplementation(libs.spring.boot.starter.test)
-    testImplementation(libs.reactor.test)
-    testImplementation(libs.mybatis.starter.test)
-    runtimeOnly(libs.postgres.driver)
-    testRuntimeOnly(libs.h2.database)
-    testRuntimeOnly(libs.junit.launcher)
-}
-
-tasks.test {
-    useJUnitPlatform()
-}

gradle.properties

@@ -1 +0,0 @@
-artefactVersion = 1.1.0

server/.dockerignore

@@ -1,4 +1,6 @@
 delta-force-guide-server.iml
 build/
+!.gitlab-ci.yml
+!build/libs/*.jar
 .idea/
 .gradle

server/Dockerfile

@@ -6,5 +6,5 @@ RUN chmod +x ./gradlew && \
 
 FROM amazoncorretto:21-alpine AS runner
 WORKDIR /app
-COPY --from=builder /app/build/libs/delta-force-guide-server-1.0.0.jar app.jar
+COPY --from=builder /app/build/libs/ahsarah-guide-server-*.jar app.jar
 ENTRYPOINT ["java", "-jar", "app.jar"]

server/Dockerfile.ci

@@ -0,0 +1,19 @@
+FROM amazoncorretto:21-alpine
+WORKDIR /app
+
+ARG JAR_FILE
+ARG IMAGE_VERSION=dev
+ARG IMAGE_VENDOR=OnixByte
+ARG BUILD_DATE
+
+COPY ${JAR_FILE} app.jar
+
+LABEL org.opencontainers.image.title="ahsarah-guide-server" \
+      org.opencontainers.image.description="REST API backend for Ahsarah Guide" \
+      org.opencontainers.image.version="${IMAGE_VERSION}" \
+      org.opencontainers.image.vendor="${IMAGE_VENDOR}" \
+      org.opencontainers.image.source="https://github.com/onixbyte/ahsarah-guide" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.created="${BUILD_DATE}"
+
+ENTRYPOINT ["java", "-jar", "app.jar"]

server/build.gradle.kts

@@ -0,0 +1,69 @@
+plugins {
+    java
+    alias(libs.plugins.spring.boot)
+    alias(libs.plugins.spring.dependency.management)
+}
+
+val artefactVersion: String by project
+val buildChannel: String by project
+val vendor: String by project
+
+group = "com.onixbyte.ahsarahguide"
+version = artefactVersion
+
+tasks.withType<JavaCompile> {
+    options.encoding = "UTF-8"
+}
+
+java {
+    sourceCompatibility = JavaVersion.VERSION_21
+    targetCompatibility = JavaVersion.VERSION_21
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(21)
+    }
+}
+
+// Generate META-INF/build-info.properties at build time. The build version comes
+// from the project version (driven by the git tag in CI); channel and vendor are
+// stamped alongside it so the runtime no longer needs template placeholders.
+springBoot {
+    buildInfo {
+        properties {
+            additional.set(
+                mapOf(
+                    "channel" to buildChannel,
+                    "vendor" to vendor
+                )
+            )
+        }
+    }
+}
+
+dependencies {
+    // BOMs are imported as platforms, so they cannot be bundled.
+    implementation(platform(libs.aws.sdk.bom))
+    implementation(platform(libs.onixbyte.versionCatalogue))
+
+    implementation(libs.bundles.utilities)
+    implementation(libs.bundles.onixbyte)
+    implementation(libs.bundles.web)
+    implementation(libs.bundles.persistence)
+    implementation(libs.bundles.security)
+    implementation(libs.bundles.cache)
+    implementation(libs.bundles.observability)
+    implementation(libs.bundles.mail)
+    implementation(libs.bundles.aws)
+    implementation(libs.bundles.docs)
+
+    // Annotation processor for @ConfigurationProperties; kept out of bundles.
+    implementation(libs.spring.boot.configurationProcessor)
+
+    runtimeOnly(libs.postgres.driver)
+
+    testImplementation(libs.bundles.testing)
+    testRuntimeOnly(libs.bundles.testRuntime)
+}
+
+tasks.test {
+    useJUnitPlatform()
+}

server/config/application-prod.yaml.example

@@ -0,0 +1,131 @@
+spring:
+  datasource:
+    # PostgreSQL connection URL.
+    url: jdbc:postgresql://localhost:5432/dfguide_dev
+
+    # PostgreSQL username.
+    username: postgres
+
+    # PostgreSQL password.
+    password: 123456
+
+    # PostgreSQL JDBC driver class name.
+    driver-class-name: org.postgresql.Driver
+  data:
+    redis:
+      # Redis server host.
+      host: localhost
+
+      # Redis server port.
+      port: 6379
+
+      # Redis database index.
+      #
+      # Default to 0.
+      database: 0
+
+      # Redis server password.
+      #
+      # Uncomment if the server requires a password.
+      #
+      # password: qwerty
+
+logging:
+  pattern:
+    # Date format used in log output. Uncomment to use a custom format.
+    #
+    # Default to the date format provided by Spring Boot.
+    # dateformat: dd MMM yyyy HH:mm:ss.SSS
+
+app:
+  cookie:
+    # Whether the cookie is accessible from JavaScript. Keep `true` to mitigate XSS attacks.
+    http-only: true
+
+    # Whether the cookie is only sent over HTTPS. Set to `true` in production is recommended.
+    secure: true
+
+    # SameSite policy of the cookie.
+    #
+    # NOTE that `none` requires `secure` to be `true`.
+    same-site: none
+
+    # Cookie path.
+    path: '/'
+
+    # Cookie max age.
+    max-age: P1D
+  cors:
+    # Cross-origin allowed origins. Add your custom origins here.
+    allowed-origins: []
+
+    # Whether to allow credentials (cookies, authorisation headers) in cross-origin requests.
+    #
+    # Must be `true` since the application uses cookies for authentication. Change it only when
+    # the authentication mechanism no longer relies on cookies.
+    allow-credentials: true
+
+    # Whether to allow requests originating from private network addresses.
+    allow-private-network: false
+
+    # Headers allowed in cross-origin requests.
+    allowed-headers:
+      - "Content-Type"
+      - "Authorization"
+
+    # HTTP methods allowed in cross-origin requests.
+    #
+    # Methods are matched against Spring's HttpMethod, so they must be written in UPPER CASE.
+    # e.g., GET, POST, PUT, PATCH, DELETE, OPTIONS
+    allowed-methods:
+      - GET
+      - POST
+      - PUT
+      - PATCH
+      - DELETE
+
+    # Response headers exposed to the browser in cross-origin responses.
+    exposed-headers:
+      - "Content-Type"
+      - "Authorization"
+
+    # How long the CORS pre-flight response may be cached by the browser.
+    #
+    # Default to PT2H (2 hours).
+    max-age: PT2H
+  jwt:
+    # Issuer identifier, domain name is recommended.
+    issuer: ahsarah-guide.local
+
+    # Token signing secret, a 32-byte long or longer string is recommended.
+    secret: qwertyuiopasdfghjklzxcvbnm123456
+
+    # Token valid duration.
+    #
+    # Default to PT2H (2 hours).
+    valid-time: PT2H
+
+    # Token renew threshold.
+    #
+    # If valid time of this token is less than this value, then a new token will be delivered to
+    # the user.
+    #
+    # Default to PT5M (5 min).
+    renew-threshold: PT5M
+  webhook:
+    github:
+      # GitHub webhook secret. Used to verify the signature of incoming webhook requests.
+      secret: 123456
+
+      # GitHub usernames allowed to trigger webhook events.
+      allowed-users: [ octocat, onixbyte ]
+
+springdoc:
+  api-docs:
+    # Whether to expose the OpenAPI documentation. Set to `false` if you do not need it
+    # (recommended in production mode).
+    enabled: true
+  swagger-ui:
+    # Whether to expose the Swagger UI. Set to `false` if you do not need it
+    # (recommended in production mode).
+    enabled: true

server/gradle/libs.versions.toml

@@ -4,10 +4,9 @@ javaJwtVersion = "4.5.1"
 postgresDriverVersion = "42.7.9"
 h2Version = "2.2.224"
 springBootVersion = "3.5.13"
-springSecurityVersion = "6.5.2"
 reactorVersion = "3.7.8"
 junitPlatformVersion = "1.12.2"
-onixbyteVersion = "3.3.0"
+onixbyteVersion = "3.4.0"
 onixbyteCaptcha = "1.1.0"
 onixbyteRegions = "2025.12.0"
 awsSdkVersion = "2.25.48"
@@ -18,6 +17,7 @@ mybatisVersion = "3.0.5"
 jacksonVersion = "2.19.2"
 hypersistenceVersion = "3.14.0"
 springDependencyManagementVersion = "1.1.7"
+springDocVersion = "2.8.16"
 
 [libraries]
 # General Utilities
@@ -31,6 +31,7 @@ jackson-jsr310 = { group = "com.fasterxml.jackson.datatype", name = "jackson-dat
 onixbyte-versionCatalogue = { group = "com.onixbyte", name = "version-catalogue", version.ref = "onixbyteVersion" }
 onixbyte-tuple = { group = "com.onixbyte", name = "tuple" }
 onixbyte-commonToolbox = { group = "com.onixbyte", name = "common-toolbox" }
+onixbyte-cryptoToolbox = { group = "com.onixbyte", name = "crypto-toolbox", version.ref = "onixbyteVersion" }
 onixbyte-mathToolbox = { group = "com.onixbyte", name = "math-toolbox" }
 onixbyte-identityGenerator = { group = "com.onixbyte", name = "identity-generator" }
 onixbyte-captcha = { group = "com.onixbyte", name = "captcha", version.ref = "onixbyteCaptcha" }
@@ -41,12 +42,10 @@ mybatis-starter-core = { group = "org.mybatis.spring.boot", name = "mybatis-spri
 spring-boot-starter-jpa = { group = "org.springframework.boot", name = "spring-boot-starter-data-jpa" }
 hypersistence-core = { group = "io.hypersistence", name = "hypersistence-utils-hibernate-63", version.ref = "hypersistenceVersion" }
 postgres-driver = { group = "org.postgresql", name = "postgresql", version.ref = "postgresDriverVersion" }
-mysql-driver = { group = "com.mysql", name = "mysql-connector-j" }
 h2-database = { group = "com.h2database", name = "h2", version.ref = "h2Version" }
 spring-boot-starter-redis = { group = "org.springframework.boot", name = "spring-boot-starter-data-redis", version.ref = "springBootVersion" }
 flyway-core = { group = "org.flywaydb", name = "flyway-core" }
 flyway-postgresql = { group = "org.flywaydb", name = "flyway-database-postgresql" }
-flyway-mysql = { group = "org.flywaydb", name = "flyway-mysql" }
 
 # Spring Boot Core & Web
 spring-boot-starter-web = { group = "org.springframework.boot", name = "spring-boot-starter-web" }
@@ -57,20 +56,111 @@ spring-boot-configurationProcessor = { group = "org.springframework.boot", name
 spring-boot-actuator = { group = "org.springframework.boot", name = "spring-boot-starter-actuator" }
 
 # Security & Auth
-spring-boot-starter-security = { group = "org.springframework.boot", name = "spring-boot-starter-security", version.ref = "springBootVersion" }
+spring-boot-starter-security = { group = "org.springframework.boot", name = "spring-boot-starter-security" }
 jwt-core = { group = "com.auth0", name = "java-jwt", version.ref = "javaJwtVersion" }
 
+# Java Mail & Templating
+spring-boot-starter-mail = { module = "org.springframework.boot:spring-boot-starter-mail" }
+spring-boot-starter-thymeleaf = { group = "org.springframework.boot", name = "spring-boot-starter-thymeleaf" }
+thymeleaf-extras-springsecurity6 = { group = "org.thymeleaf.extras", name = "thymeleaf-extras-springsecurity6" }
+
+# Spring Doc
+spring-boot-starter-doc = { group = "org.springdoc", name = "springdoc-openapi-starter-webmvc-ui", version.ref = "springDocVersion" }
+
 # Cloud Services
 aws-sdk-bom = { group = "software.amazon.awssdk", name = "bom", version.ref = "awsSdkVersion" }
 aws-sdk-s3 = { group = "software.amazon.awssdk", name = "s3" }
 
 # Testing
 spring-boot-starter-test = { group = "org.springframework.boot", name = "spring-boot-starter-test", version.ref = "springBootVersion" }
-spring-security-test = { group = "org.springframework.security", name = "spring-security-test", version.ref = "springSecurityVersion" }
+spring-security-test = { group = "org.springframework.security", name = "spring-security-test" }
 reactor-test = { group = "io.projectreactor", name = "reactor-test", version.ref = "reactorVersion" }
 junit-launcher = { group = "org.junit.platform", name = "junit-platform-launcher", version.ref = "junitPlatformVersion" }
 mybatis-starter-test = { group = "org.mybatis.spring.boot", name = "mybatis-spring-boot-starter-test", version.ref = "mybatisVersion" }
 
+[bundles]
+# General utilities
+utilities = [
+    "jspecify-core",
+    "commons-io",
+    "commons-lang",
+    "commons-collections",
+    "jackson-jsr310",
+]
+
+# Onixbyte ecosystem (the version-catalogue BOM stays out of bundles, it is imported as a platform)
+onixbyte = [
+    "onixbyte-tuple",
+    "onixbyte-commonToolbox",
+    "onixbyte-cryptoToolbox",
+    "onixbyte-mathToolbox",
+    "onixbyte-identityGenerator",
+    "onixbyte-captcha",
+    "onixbyte-regions",
+]
+
+# Web layer
+web = [
+    "spring-boot-starter-web",
+    "spring-boot-starter-webFlux",
+    "spring-boot-starter-validation",
+]
+
+# Persistence and database
+persistence = [
+    "spring-boot-starter-jpa",
+    "mybatis-starter-core",
+    "hypersistence-core",
+    "flyway-core",
+    "flyway-postgresql",
+]
+
+# Security and authentication
+security = [
+    "spring-boot-starter-security",
+    "jwt-core",
+]
+
+# Caching (Redis)
+cache = [
+    "spring-boot-starter-redis",
+    "spring-boot-starter-cache",
+]
+
+# Observability
+observability = [
+    "spring-boot-actuator",
+]
+
+# Mail and templating
+mail = [
+    "spring-boot-starter-mail",
+    "spring-boot-starter-thymeleaf",
+    "thymeleaf-extras-springsecurity6",
+]
+
+# AWS cloud services
+aws = [
+    "aws-sdk-s3",
+]
+
+# API documentation
+docs = [
+    "spring-boot-starter-doc",
+]
+
+# Testing
+testing = [
+    "spring-boot-starter-test",
+    "spring-security-test",
+    "reactor-test",
+    "mybatis-starter-test",
+]
+testRuntime = [
+    "h2-database",
+    "junit-launcher",
+]
+
 [plugins]
 spring-boot = { id = "org.springframework.boot", version.ref = "springBootVersion" }
 spring-dependency-management = { id = "io.spring.dependency-management", version.ref = "springDependencyManagementVersion" }

server/settings.gradle.kts

@@ -0,0 +1 @@
+rootProject.name = "ahsarah-guide-server"

server/src/main/java/com/onixbyte/ahsarahguide/AhsarahGuideApplication.java

@@ -0,0 +1,20 @@
+package com.onixbyte.ahsarahguide;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.scheduling.annotation.EnableAsync;
+
+/**
+ * Entry point for the Ahsarah Guide Server application.
+ *
+ * @author zihluwang
+ */
+@EnableAsync
+@SpringBootApplication
+public class AhsarahGuideApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(AhsarahGuideApplication.class, args);
+    }
+
+}

server/src/main/java/com/onixbyte/ahsarahguide/client/EmailClient.java

@@ -0,0 +1,109 @@
+package com.onixbyte.ahsarahguide.client;
+
+import jakarta.mail.MessagingException;
+import jakarta.mail.internet.InternetAddress;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.mail.javamail.JavaMailSender;
+import org.springframework.mail.javamail.MimeMessageHelper;
+import org.springframework.scheduling.annotation.Async;
+import org.springframework.stereotype.Component;
+import org.thymeleaf.TemplateEngine;
+import org.thymeleaf.context.Context;
+
+import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+
+@Component
+public class EmailClient {
+
+    private static final Logger log = LoggerFactory.getLogger(EmailClient.class);
+
+    private final JavaMailSender mailSender;
+
+    private final TemplateEngine emailTemplateEngine;
+
+    @Autowired
+    public EmailClient(
+            JavaMailSender mailSender,
+            TemplateEngine emailTemplateEngine
+    ) {
+        this.mailSender = mailSender;
+        this.emailTemplateEngine = emailTemplateEngine;
+    }
+
+    private String fromAddress;
+
+    @Autowired
+    public void setFromAddress(@Value("${spring.mail.username}") String fromAddress) {
+        this.fromAddress = fromAddress;
+    }
+
+    /**
+     * Send a template-based HTML email asynchronously.
+     *
+     * @param toRecipient  recipient email address
+     * @param subject      subject line
+     * @param templateName template name (without .html extension, under mail-templates/)
+     * @param variables    context variables required by the template
+     */
+    @Async
+    public void sendTemplateMail(String toRecipient, String subject, String templateName, Map<String, Object> variables) {
+        try {
+            // Render HTML content using the dedicated email template engine
+            var context = new Context();
+            if (variables != null && !variables.isEmpty()) {
+                context.setVariables(variables);
+            }
+            var htmlBody = emailTemplateEngine.process(templateName, context);
+
+            log.debug("htmlBody={}", htmlBody);
+
+            // Build the MIME message
+            var message = mailSender.createMimeMessage();
+            var helper = new MimeMessageHelper(
+                    message,
+                    MimeMessageHelper.MULTIPART_MODE_MIXED_RELATED,
+                    StandardCharsets.UTF_8.name()
+            );
+
+            helper.setFrom(new InternetAddress(fromAddress, "阿萨拉向导", StandardCharsets.UTF_8.name()));
+            helper.setTo(toRecipient);
+            helper.setSubject(subject);
+            helper.setText(htmlBody, true);
+
+            // Dispatch the message
+            mailSender.send(message);
+            log.info("Successfully dispatched email to: [{}] with subject: [{}]", toRecipient, subject);
+
+        } catch (MessagingException | UnsupportedEncodingException ex) {
+            log.error("Failed to construct or send email to: [{}], subject: [{}]", toRecipient, subject, ex);
+            // Handle or rethrow custom business exception if required
+        } catch (Exception ex) {
+            log.error("Unexpected error occurred while processing email for: [{}]", toRecipient, ex);
+        }
+    }
+
+    /**
+     * Convenience method specifically for sending registration/login verification codes.
+     *
+     * @param toRecipient   target recipient email
+     * @param username      display username
+     * @param code          verification code string
+     * @param expireMinutes expiration time in minutes
+     */
+    @Async
+    public void sendVerificationCode(String toRecipient, String username, String code, int expireMinutes) {
+        var subject = "【阿萨拉向导】账号注册验证码";
+        var variables = Map.<String, Object>of(
+                "username", username,
+                "code", code,
+                "expireMinutes", expireMinutes
+        );
+
+        sendTemplateMail(toRecipient, subject, "verification-code", variables);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/client/TokenClient.java

@@ -0,0 +1,75 @@
+package com.onixbyte.ahsarahguide.client;
+
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.JWTVerifier;
+import com.auth0.jwt.algorithms.Algorithm;
+import com.auth0.jwt.interfaces.DecodedJWT;
+import com.onixbyte.ahsarahguide.domain.entity.User;
+import com.onixbyte.ahsarahguide.properties.TokenProperties;
+import com.onixbyte.ahsarahguide.utils.DateTimeUtil;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.time.LocalDateTime;
+
+/**
+ * Client for generating and verifying JSON Web Tokens using the Auth0 java-jwt library.
+ *
+ * @author zihluwang
+ */
+@Component
+public class TokenClient {
+
+    private final Algorithm algorithm;
+    private final TokenProperties tokenProperties;
+    private final JWTVerifier verifier;
+
+    /**
+     * Constructs a new TokenClient with the necessary algorithm and token properties.
+     *
+     * @param algorithm       the signing algorithm used to secure the JWT
+     * @param tokenProperties the configuration properties for the token, such as issuer and
+     *                        validity period
+     */
+    @Autowired
+    public TokenClient(
+            Algorithm algorithm,
+            TokenProperties tokenProperties,
+            JWTVerifier verifier
+    ) {
+        this.algorithm = algorithm;
+        this.tokenProperties = tokenProperties;
+        this.verifier = verifier;
+    }
+
+    /**
+     * Generate a JSON Web Token to the current user.
+     *
+     * @param user the current user for whom the token is being generated
+     * @return a JWT string
+     */
+    public String generateToken(User user) {
+        var issuedAt = LocalDateTime.now();
+        var expiresAt = issuedAt.plus(tokenProperties.validTime());
+
+        return JWT.create()
+                .withSubject(user.getUsername())
+                .withIssuer(tokenProperties.issuer())
+                .withIssuedAt(DateTimeUtil.asInstant(issuedAt))
+                .withExpiresAt(DateTimeUtil.asInstant(expiresAt))
+                .sign(algorithm);
+    }
+
+    /**
+     * Verify and decode token.
+     *
+     * @param token a JWT token
+     * @return information included in the given token
+     * @throws com.auth0.jwt.exceptions.JWTVerificationException if the token is invalid, such as
+     *                                                           expired, or not signed by
+     *                                                           specific server
+     */
+    public DecodedJWT verifyToken(String token) {
+        return verifier.verify(token);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/AppConfig.java

@@ -0,0 +1,45 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.onixbyte.ahsarahguide.interceptor.GitHubWebhookInterceptor;
+import com.onixbyte.ahsarahguide.interceptor.TrafficInterceptor;
+import com.onixbyte.ahsarahguide.security.resolver.CurrentUserArgumentResolver;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+import java.util.List;
+
+@Configuration
+public class AppConfig implements WebMvcConfigurer {
+
+    private final TrafficInterceptor trafficInterceptor;
+
+    private final GitHubWebhookInterceptor gitHubWebhookInterceptor;
+
+    private final CurrentUserArgumentResolver currentUserArgumentResolver;
+
+    @Autowired
+    public AppConfig(
+            TrafficInterceptor trafficInterceptor,
+            GitHubWebhookInterceptor gitHubWebhookInterceptor,
+            CurrentUserArgumentResolver currentUserArgumentResolver
+    ) {
+        this.trafficInterceptor = trafficInterceptor;
+        this.gitHubWebhookInterceptor = gitHubWebhookInterceptor;
+        this.currentUserArgumentResolver = currentUserArgumentResolver;
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(trafficInterceptor);
+        registry.addInterceptor(gitHubWebhookInterceptor)
+                .addPathPatterns("/webhooks/github");
+    }
+
+    @Override
+    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
+        resolvers.add(currentUserArgumentResolver);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/CacheConfig.java

@@ -1,6 +1,6 @@
-package com.onixbyte.deltaforceguide.config;
+package com.onixbyte.ahsarahguide.config;
 
-import com.onixbyte.deltaforceguide.shared.JacksonRedisSerialiser;
+import com.onixbyte.ahsarahguide.shared.JacksonRedisSerialiser;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;

server/src/main/java/com/onixbyte/ahsarahguide/config/CorsConfig.java

@@ -0,0 +1,49 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.onixbyte.ahsarahguide.properties.CorsProperties;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.List;
+import java.util.stream.Stream;
+
+/**
+ * Configuration for CORS (Cross-Origin Resource Sharing) policies.
+ *
+ * @author zihluwang
+ */
+@Configuration
+@EnableConfigurationProperties({CorsProperties.class})
+public class CorsConfig {
+
+    /**
+     * Creates the CORS configuration source with properties from configuration.
+     *
+     * @param properties the CORS configuration properties
+     * @return the CORS configuration source
+     */
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource(
+            CorsProperties properties
+    ) {
+        var corsConfiguration = new CorsConfiguration();
+        corsConfiguration.setAllowCredentials(properties.allowCredentials());
+        corsConfiguration.setAllowedOrigins(List.of(properties.allowedOrigins()));
+        corsConfiguration.setAllowedHeaders(List.of(properties.allowedHeaders()));
+        corsConfiguration.setAllowedMethods(Stream.of(properties.allowedMethods())
+                .map(HttpMethod::name)
+                .toList());
+        corsConfiguration.setMaxAge(properties.maxAge());
+        corsConfiguration.setAllowPrivateNetwork(properties.allowPrivateNetwork());
+        corsConfiguration.setExposedHeaders(List.of(properties.exposedHeaders()));
+
+        var corsConfigurationSource = new UrlBasedCorsConfigurationSource();
+        corsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);
+        return corsConfigurationSource;
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/EmailTemplateConfig.java

@@ -0,0 +1,37 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.onixbyte.captcha.text.TextProducer;
+import com.onixbyte.captcha.text.impl.DefaultTextProducer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.thymeleaf.TemplateEngine;
+import org.thymeleaf.spring6.SpringTemplateEngine;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateresolver.ClassLoaderTemplateResolver;
+import org.thymeleaf.templateresolver.ITemplateResolver;
+
+import java.nio.charset.StandardCharsets;
+
+@Configuration
+public class EmailTemplateConfig {
+
+    @Bean
+    public TemplateEngine emailTemplateEngine() {
+        var resolver = new ClassLoaderTemplateResolver();
+        // Template files are located under src/main/resources/mail-templates/
+        resolver.setPrefix("mail-templates/");
+        resolver.setSuffix(".html");
+        resolver.setTemplateMode(TemplateMode.HTML);
+        resolver.setCharacterEncoding(StandardCharsets.UTF_8.name());
+        resolver.setCacheable(true); // Enable caching for the production environment
+
+        var templateEngine = new SpringTemplateEngine();
+        templateEngine.addTemplateResolver(resolver);
+        return templateEngine;
+    }
+
+    @Bean
+    public TextProducer textProducer() {
+        return DefaultTextProducer.builder().build();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/FilterConfig.java

@@ -0,0 +1,21 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.onixbyte.ahsarahguide.filter.WebhookFilter;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class FilterConfig {
+
+    @Bean
+    public FilterRegistrationBean<WebhookFilter> webhookFilterBean(WebhookFilter webhookFilter) {
+        var registrationBean = new FilterRegistrationBean<WebhookFilter>();
+
+        registrationBean.setFilter(webhookFilter);
+        registrationBean.addUrlPatterns("/webhooks/*");
+        registrationBean.setOrder(1);
+
+        return registrationBean;
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/JacksonConfig.java

@@ -1,11 +1,16 @@
-package com.onixbyte.deltaforceguide.config;
+package com.onixbyte.ahsarahguide.config;
 
 import com.fasterxml.jackson.databind.SerializationFeature;
-import com.onixbyte.deltaforceguide.shared.JacksonModules;
+import com.onixbyte.ahsarahguide.shared.JacksonModules;
 import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
+/**
+ * Configuration for Jackson JSON serialisation and deserialisation settings.
+ *
+ * @author zihluwang
+ */
 @Configuration
 public class JacksonConfig {
 

server/src/main/java/com/onixbyte/ahsarahguide/config/MyBatisConfig.java

@@ -0,0 +1,15 @@
+package com.onixbyte.ahsarahguide.config;
+
+import org.mybatis.spring.annotation.MapperScan;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * Configuration for MyBatis SQL mapping framework integration.
+ *
+ * @author zihluwang
+ */
+@Configuration
+@MapperScan(basePackages = {"com.onixbyte.ahsarahguide.mapper"})
+public class MyBatisConfig {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/config/OpenApiConfiguration.java

@@ -0,0 +1,45 @@
+package com.onixbyte.ahsarahguide.config;
+
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.info.Contact;
+import io.swagger.v3.oas.annotations.info.Info;
+import io.swagger.v3.oas.annotations.info.License;
+import io.swagger.v3.oas.models.OpenAPI;
+import org.springdoc.core.customizers.OpenApiCustomizer;
+import org.springframework.boot.info.BuildProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@OpenAPIDefinition(
+        info = @Info(
+                title = "Ahsarah Guide Server",
+                description = "API for Ahsarah Guide",
+                contact = @Contact(
+                        name = "Zihlu Wang",
+                        email = "zihlu.wang@onixbyte.com"
+                ),
+                license = @License(
+                        name = "MIT",
+                        url = "https://onixbyte.dev/onixbyte/ahsarah-guide/raw/branch/main/LICENCE"
+                )
+        )
+)
+@Configuration
+public class OpenApiConfiguration {
+
+    /**
+     * Overrides the OpenAPI info version with the packaged build version so the
+     * docs always match the released artefact instead of a hard-coded value.
+     *
+     * @param buildProperties the build-info properties generated at build time
+     * @return customiser that stamps the build version onto the API info
+     */
+    @Bean
+    public OpenApiCustomizer versionCustomizer(BuildProperties buildProperties) {
+        return openApi -> {
+            if (openApi.getInfo() != null) {
+                openApi.getInfo().setVersion(buildProperties.getVersion());
+            }
+        };
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/SecurityConfig.java

@@ -0,0 +1,113 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.JWTVerifier;
+import com.auth0.jwt.algorithms.Algorithm;
+import com.onixbyte.ahsarahguide.exeption.ForbiddenException;
+import com.onixbyte.ahsarahguide.exeption.UnauthorisedException;
+import com.onixbyte.ahsarahguide.filter.TokenAuthenticationFilter;
+import com.onixbyte.ahsarahguide.properties.CookieProperties;
+import com.onixbyte.ahsarahguide.properties.TokenProperties;
+import com.onixbyte.ahsarahguide.security.provider.UsernamePasswordAuthenticationProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.access.ExceptionTranslationFilter;
+import org.springframework.web.cors.CorsConfigurationSource;
+
+/**
+ * Spring Security configuration defining authentication, authorisation, and filter chains.
+ *
+ * @author zihluwang
+ */
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+@EnableConfigurationProperties({TokenProperties.class, CookieProperties.class})
+public class SecurityConfig {
+
+    private static final Logger log = LoggerFactory.getLogger(SecurityConfig.class);
+
+    /**
+     * Configures the HTTP security filter chain including endpoint authorisation and JWT filter.
+     *
+     * @param httpSecurity the HTTP security builder
+     * @return the configured security filter chain
+     */
+    @Bean
+    public SecurityFilterChain securityFilterChain(
+            HttpSecurity httpSecurity,
+            CorsConfigurationSource corsConfigurationSource,
+            TokenAuthenticationFilter tokenAuthenticationFilter
+    ) throws Exception {
+        return httpSecurity
+                .cors((cors) -> cors
+                        .configurationSource(corsConfigurationSource))
+                .csrf(AbstractHttpConfigurer::disable)
+                .sessionManagement((customiser) -> customiser
+                        .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+                .authorizeHttpRequests((customiser) -> customiser
+                        .anyRequest().permitAll()
+                )
+                .exceptionHandling(customiser -> customiser
+                        .authenticationEntryPoint((request, response, authException) -> {
+                            log.error("Unauthenticated request: {}", request, authException);
+                            throw new UnauthorisedException("请先登录");
+                        })
+                        .accessDeniedHandler((request, response, accessDeniedException) -> {
+                            log.error("Denied request: {}", request, accessDeniedException);
+                            throw new ForbiddenException("权限不足");
+                        })
+                )
+                .addFilterAfter(tokenAuthenticationFilter, ExceptionTranslationFilter.class)
+                .build();
+    }
+
+    /**
+     * Provides the BCrypt password encoder for credential hashing.
+     *
+     * @return the BCrypt password encoder
+     */
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    /**
+     * Provides the authentication manager for the security configuration.
+     *
+     * @return the authentication manager
+     */
+    @Bean
+    public AuthenticationManager authenticationManager(
+            UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProvider
+    ) {
+        return new ProviderManager(
+                usernamePasswordAuthenticationProvider
+        );
+    }
+
+    @Bean
+    public Algorithm algorithm(TokenProperties properties) {
+        return Algorithm.HMAC256(properties.secret());
+    }
+
+    @Bean
+    public JWTVerifier verifier(Algorithm algorithm, TokenProperties tokenProperties) {
+        return JWT.require(algorithm)
+                .withIssuer(tokenProperties.issuer())
+                .build();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/config/SpringDataConfig.java

@@ -0,0 +1,15 @@
+package com.onixbyte.ahsarahguide.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+
+/**
+ * Configuration for Spring Data JPA auditing and repository settings.
+ *
+ * @author zihluwang
+ */
+@Configuration
+@EnableJpaRepositories(basePackages = {"com.onixbyte.ahsarahguide.repository"})
+public class SpringDataConfig {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/config/WebhookConfig.java

@@ -0,0 +1,10 @@
+package com.onixbyte.ahsarahguide.config;
+
+import com.onixbyte.ahsarahguide.properties.GitHubWebhookProperties;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+@EnableConfigurationProperties({GitHubWebhookProperties.class})
+public class WebhookConfig {
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/AdminController.java

@@ -0,0 +1,59 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.ManageRoleRequest;
+import com.onixbyte.ahsarahguide.security.annotation.RequiresAuth;
+import com.onixbyte.ahsarahguide.service.UserService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.Positive;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * REST controller for administrative user and role management.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "管理员", description = "管理员用户与角色管理")
+@RestController
+@RequestMapping("/admin")
+@Validated
+@RequiresAuth
+public class AdminController {
+
+    private final UserService userService;
+
+    public AdminController(UserService userService) {
+        this.userService = userService;
+    }
+
+    @Operation(description = "为用户分配角色（仅超级管理员可操作）")
+    @PreAuthorize("hasRole('SUPER_USER')")
+    @PutMapping("/users/{id}/roles")
+    public ResponseEntity<Void> assignRole(
+            @PathVariable @Positive(message = "用户ID必须为正数") Long id,
+            @Valid @RequestBody ManageRoleRequest request
+    ) {
+        userService.assignRole(id, request.role());
+        return ResponseEntity.noContent().build();
+    }
+
+    @Operation(description = "移除用户角色（仅超级管理员可操作）")
+    @PreAuthorize("hasRole('SUPER_USER')")
+    @DeleteMapping("/users/{id}/roles/{role}")
+    public ResponseEntity<Void> removeRole(
+            @PathVariable @Positive(message = "用户ID必须为正数") Long id,
+            @PathVariable String role
+    ) {
+        userService.removeRole(id, role);
+        return ResponseEntity.noContent().build();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/AuthController.java

@@ -0,0 +1,62 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.*;
+import com.onixbyte.ahsarahguide.security.annotation.RequiresAuth;
+import com.onixbyte.ahsarahguide.service.AuthService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * REST controller for user authentication endpoints (login, logout).
+ *
+ * @author zihluwang
+ */
+@Tag(name = "用户鉴权", description = "处理用户登录与退出功能")
+@RestController
+@RequestMapping("/auth")
+public class AuthController {
+
+    private final AuthService authService;
+
+    public AuthController(AuthService authService) {
+        this.authService = authService;
+    }
+
+    @Operation(description = "用户登录")
+    @PostMapping("/login")
+    public ResponseEntity<UserResponse> login(@Validated @RequestBody LoginRequest request) {
+        var user = authService.login(request);
+        return authService.getUserResponseResponseEntity(user);
+    }
+
+    @RequiresAuth
+    @Operation(description = "退出登录")
+    @PostMapping("/logout")
+    public ResponseEntity<Void> logout() {
+        var expiredCookie = authService.logout();
+        return ResponseEntity.noContent()
+                .header(HttpHeaders.SET_COOKIE, expiredCookie.toString())
+                .build();
+    }
+
+    @Operation(description = "发送邮件验证码")
+    @PostMapping("/verification-code")
+    public SendVerificationCodeResponse sendVerificationCode(@Validated @RequestBody SendVerificationCodeRequest request) {
+        var verificationCodeId = authService.sendVerificationCode(request);
+        return new SendVerificationCodeResponse(verificationCodeId);
+    }
+
+    @Operation(description = "用户注册")
+    @PostMapping("/register")
+    public ResponseEntity<UserResponse> register(@Validated @RequestBody RegisterRequest request) {
+        var user = authService.register(request);
+        return authService.getUserResponseResponseEntity(user);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/DailyPasswordController.java

@@ -0,0 +1,32 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.DailyPasswordResponse;
+import com.onixbyte.ahsarahguide.service.DailyPasswordService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * REST controller for retrieving daily-generated passwords.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "每日密码", description = "获取每日密码信息")
+@RestController
+@RequestMapping("/daily-passwords")
+public class DailyPasswordController {
+
+    private final DailyPasswordService dailyPasswordService;
+
+    public DailyPasswordController(DailyPasswordService dailyPasswordService) {
+        this.dailyPasswordService = dailyPasswordService;
+    }
+
+    @Operation(description = "获取当日的每日密码数据，该数据将被缓存一天")
+    @GetMapping
+    public DailyPasswordResponse getDailyPassword() {
+        return dailyPasswordService.getDailyPassword();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/FirearmController.java

@@ -0,0 +1,72 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.FirearmRequest;
+import com.onixbyte.ahsarahguide.domain.dto.FirearmResponse;
+import com.onixbyte.ahsarahguide.domain.dto.PageResponse;
+import com.onixbyte.ahsarahguide.enumeration.FirearmType;
+import com.onixbyte.ahsarahguide.security.annotation.RequiresAuth;
+import com.onixbyte.ahsarahguide.service.FirearmService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Sort;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.*;
+
+/**
+ * REST controller for firearm CRUD operations.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "武器管理", description = "与武器有关的操作")
+@RestController
+@RequestMapping("/firearms")
+public class FirearmController {
+
+    private final FirearmService firearmService;
+
+    public FirearmController(FirearmService firearmService) {
+        this.firearmService = firearmService;
+    }
+
+    @Operation(description = "获取分页武器数据")
+    @Validated
+    @GetMapping
+    public PageResponse<FirearmResponse> pageQuery(
+            @RequestParam(defaultValue = "0") @Min(0) int page,
+            @RequestParam(defaultValue = "20") @Min(1) @Max(100) int size,
+            @RequestParam(defaultValue = "id") String sortBy,
+            @RequestParam(defaultValue = "DESC") Sort.Direction direction,
+            @RequestParam(required = false) FirearmType type
+    ) {
+        return firearmService.pageQuery(type, PageRequest.of(page, size, Sort.by(direction, sortBy)));
+    }
+
+    @Operation(description = "获取指定武器的数据")
+    @GetMapping("/{id}")
+    public FirearmResponse queryById(@PathVariable Long id) {
+        return firearmService.queryById(id);
+    }
+
+    @RequiresAuth
+    @PostMapping
+    public FirearmResponse addFirearm(@Validated @RequestBody FirearmRequest request) {
+        return firearmService.addFirearm(request);
+    }
+
+    @RequiresAuth
+    @Operation(description = "更新指定武器的数据")
+    @PutMapping("/{id}")
+    public FirearmResponse updateFirearm(@PathVariable Long id, @Validated @RequestBody FirearmRequest request) {
+        return firearmService.updateFirearm(id, request);
+    }
+
+    @RequiresAuth
+    @Operation(description = "删除指定武器的数据")
+    @DeleteMapping("/{id}")
+    public void deleteFirearm(@PathVariable Long id) {
+        firearmService.deleteFirearm(id);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/GlobalExceptionHandler.java

@@ -0,0 +1,44 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.ErrorResponse;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.server.ResponseStatusException;
+
+/**
+ * Global exception handler that translates exceptions into standard error responses.
+ *
+ * @author zihluwang
+ */
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+    @ExceptionHandler(ResponseStatusException.class)
+    public ResponseEntity<ErrorResponse> handleResponseStatusException(ResponseStatusException exception) {
+        var status = exception.getStatusCode();
+        return ResponseEntity.status(status)
+                .body(new ErrorResponse(exception.getReason()));
+    }
+
+    @ExceptionHandler(AuthenticationException.class)
+    public ResponseEntity<ErrorResponse> handleAuthenticationException(AuthenticationException exception) {
+        return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                .body(new ErrorResponse("请先登录"));
+    }
+
+    @ExceptionHandler(AccessDeniedException.class)
+    public ResponseEntity<ErrorResponse> handleAccessDeniedException(AccessDeniedException exception) {
+        var authentication = SecurityContextHolder.getContext().getAuthentication();
+        var httpStatus = authentication == null || !authentication.isAuthenticated()
+                ? HttpStatus.UNAUTHORIZED
+                : HttpStatus.FORBIDDEN;
+        var message = httpStatus == HttpStatus.UNAUTHORIZED ? "请先登录" : "权限不足";
+        return ResponseEntity.status(httpStatus)
+                .body(new ErrorResponse(message));
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/controller/ModificationController.java

@@ -0,0 +1,109 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.ModificationBatchCreateRequest;
+import com.onixbyte.ahsarahguide.domain.dto.ModificationRequest;
+import com.onixbyte.ahsarahguide.domain.dto.ModificationResponse;
+import com.onixbyte.ahsarahguide.domain.dto.PageResponse;
+import com.onixbyte.ahsarahguide.domain.entity.User;
+import com.onixbyte.ahsarahguide.security.annotation.RequiresAuth;
+import com.onixbyte.ahsarahguide.security.resolver.CurrentUser;
+import com.onixbyte.ahsarahguide.service.ModificationService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+import jakarta.validation.constraints.Positive;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Sort;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+
+/**
+ * REST controller for modification CRUD operations, including batch creation and deletion.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "改装管理", description = "对枪械改装的管理")
+@RestController
+@RequestMapping("/modifications")
+public class ModificationController {
+
+    private final ModificationService modificationService;
+
+    public ModificationController(ModificationService modificationService) {
+        this.modificationService = modificationService;
+    }
+
+    @Operation(description = "分页查询改装信息")
+    @Validated
+    @GetMapping
+    public PageResponse<ModificationResponse> pageQuery(
+            @RequestParam(defaultValue = "0") @Min(0) int page,
+            @RequestParam(defaultValue = "20") @Min(1) @Max(100) int size,
+            @RequestParam(required = false) @Positive Long firearmId,
+            @RequestParam(defaultValue = "id") String sortBy,
+            @RequestParam(defaultValue = "DESC") Sort.Direction direction,
+            @RequestParam(required = false) List<String> tags
+    ) {
+        return modificationService.pageQuery(firearmId, tags, PageRequest.of(page, size, Sort.by(direction, sortBy)));
+    }
+
+    @Operation(description = "查询指定改装的信息")
+    @GetMapping("/{id}")
+    public ModificationResponse queryById(@PathVariable Long id) {
+        return modificationService.queryById(id);
+    }
+
+    @RequiresAuth
+    @Operation(description = "创建改装")
+    @PostMapping
+    public ModificationResponse create(
+            @CurrentUser User user,
+            @Valid @RequestBody ModificationRequest request
+    ) {
+        return modificationService.create(request, user);
+    }
+
+    @RequiresAuth
+    @Operation(description = "批量创建改装")
+    @PostMapping("/batch")
+    public List<ModificationResponse> batchCreate(
+            @CurrentUser User user,
+            @Valid @RequestBody ModificationBatchCreateRequest request
+    ) {
+        return modificationService.batchCreate(request.modifications(), user);
+    }
+
+    @RequiresAuth
+    @Operation(description = "修改指定改装")
+    @PutMapping("/{id}")
+    public ModificationResponse update(@PathVariable Long id, @Valid @RequestBody ModificationRequest request) {
+        return modificationService.update(id, request);
+    }
+
+    @RequiresAuth
+    @Operation(description = "删除指定改装")
+    @DeleteMapping("/{id}")
+    public void delete(@PathVariable Long id) {
+        modificationService.delete(id);
+    }
+
+    @RequiresAuth
+    @Operation(description = "批量删除改装")
+    @DeleteMapping("/batch-delete")
+    @Validated
+    public void batchDelete(@RequestParam List<@Positive Long> ids) {
+        modificationService.batchDelete(ids);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/TagController.java

@@ -1,13 +1,21 @@
-package com.onixbyte.deltaforceguide.controller;
+package com.onixbyte.ahsarahguide.controller;
 
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
-import com.onixbyte.deltaforceguide.service.ModificationService;
+import com.onixbyte.ahsarahguide.service.ModificationService;
 
 import java.util.List;
 
+/**
+ * REST controller for retrieving available modification tags.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "标签管理", description = "管理标签信息")
 @RestController
 @RequestMapping("/tags")
 public class TagController {
@@ -18,6 +26,7 @@ public class TagController {
         this.modificationService = modificationService;
     }
 
+    @Operation(description = "查询指定武器或所有武器的标签")
     @GetMapping
     public List<String> getTags(@RequestParam(required = false) Long firearmId) {
         return modificationService.findAllTags(firearmId);

server/src/main/java/com/onixbyte/ahsarahguide/controller/UserController.java

@@ -0,0 +1,79 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.BuildSummaryResponse;
+import com.onixbyte.ahsarahguide.domain.dto.ChangePasswordRequest;
+import com.onixbyte.ahsarahguide.domain.dto.PageResponse;
+import com.onixbyte.ahsarahguide.domain.dto.UpdateProfileRequest;
+import com.onixbyte.ahsarahguide.domain.dto.UserProfileResponse;
+import com.onixbyte.ahsarahguide.domain.entity.User;
+import com.onixbyte.ahsarahguide.security.annotation.RequiresAuth;
+import com.onixbyte.ahsarahguide.security.resolver.CurrentUser;
+import com.onixbyte.ahsarahguide.service.UserService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.http.ResponseEntity;
+import org.springframework.validation.annotation.Validated;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PutMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * REST controller for the current user's profile management endpoints.
+ *
+ * @author zihluwang
+ */
+@Tag(name = "用户个人中心", description = "当前用户的资料管理与密码修改")
+@RestController
+@RequestMapping("/user")
+@Validated
+@RequiresAuth
+public class UserController {
+
+    private final UserService userService;
+
+    public UserController(UserService userService) {
+        this.userService = userService;
+    }
+
+    @Operation(description = "获取当前登录用户的个人资料")
+    @GetMapping("/me")
+    public UserProfileResponse profile(@CurrentUser User user) {
+        return userService.getProfile(user);
+    }
+
+    @Operation(description = "修改当前用户的个人资料（昵称与邮箱）")
+    @PutMapping("/me")
+    public UserProfileResponse updateProfile(
+            @CurrentUser User user,
+            @Valid @RequestBody UpdateProfileRequest request
+    ) {
+        return userService.updateProfile(user, request);
+    }
+
+    @Operation(description = "修改当前用户的登录密码")
+    @PutMapping("/me/password")
+    public ResponseEntity<Void> changePassword(
+            @CurrentUser User user,
+            @Valid @RequestBody ChangePasswordRequest request
+    ) {
+        userService.changePassword(user, request);
+        return ResponseEntity.noContent().build();
+    }
+
+    @Operation(description = "分页查询当前用户的改枪码列表")
+    @GetMapping("/me/builds")
+    public PageResponse<BuildSummaryResponse> builds(
+            @CurrentUser User user,
+            @RequestParam(defaultValue = "0") @Min(0) int page,
+            @RequestParam(defaultValue = "20") @Min(1) @Max(100) int size
+    ) {
+        return userService.getBuilds(user, PageRequest.of(page, size));
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/VersionController.java

@@ -0,0 +1,26 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.service.AppService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Tag(name = "版本信息")
+@RestController
+@RequestMapping("/versions")
+public class VersionController {
+
+    private final AppService appService;
+
+    public VersionController(AppService appService) {
+        this.appService = appService;
+    }
+
+    @Operation(description = "获取当前应用版本号")
+    @GetMapping
+    public String getVersion() {
+        return appService.getVersion();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/controller/WebhookController.java

@@ -0,0 +1,47 @@
+package com.onixbyte.ahsarahguide.controller;
+
+import com.onixbyte.ahsarahguide.domain.dto.GitHubIssueRequest;
+import com.onixbyte.ahsarahguide.service.WebhookService;
+import com.onixbyte.ahsarahguide.shared.GitHubWebhookHeader;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Tag(name = "WebHook")
+@RestController
+@RequestMapping("/webhooks")
+public class WebhookController {
+
+    private static final Logger log = LoggerFactory.getLogger(WebhookController.class);
+
+    private final WebhookService webhookService;
+
+    public WebhookController(WebhookService webhookService) {
+        this.webhookService = webhookService;
+    }
+
+    @Operation(description = "GitHub WebHook 接口")
+    @PostMapping("/github")
+    public ResponseEntity<Void> handleWebhook(
+            @RequestHeader(GitHubWebhookHeader.EVENT) String event,
+            @RequestBody GitHubIssueRequest request
+    ) {
+        if (!"issues".equals(event)) {
+            log.debug("Ignoring non-issue event: {}", event);
+            return ResponseEntity.ok().build();
+        }
+        if (!"opened".equals(request.action())) {
+            log.debug("Ignoring issue action: {}", request.action());
+            return ResponseEntity.ok().build();
+        }
+        webhookService.processIssueEvent(request);
+        return ResponseEntity.ok().build();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/converter/FirearmTypeConverter.java

@@ -1,9 +1,14 @@
-package com.onixbyte.deltaforceguide.domain.converter;
+package com.onixbyte.ahsarahguide.domain.converter;
 
-import com.onixbyte.deltaforceguide.enumeration.FirearmType;
+import com.onixbyte.ahsarahguide.enumeration.FirearmType;
 import jakarta.persistence.AttributeConverter;
 import jakarta.persistence.Converter;
 
+/**
+ * JPA attribute converter that maps {@link FirearmType} enum to/from its integer database representation.
+ *
+ * @author zihluwang
+ */
 @Converter
 public class FirearmTypeConverter implements AttributeConverter<FirearmType, Integer> {
 

server/src/main/java/com/onixbyte/ahsarahguide/domain/converter/ModificationStatusConverter.java

@@ -0,0 +1,28 @@
+package com.onixbyte.ahsarahguide.domain.converter;
+
+import com.onixbyte.ahsarahguide.enumeration.ModificationStatus;
+import jakarta.persistence.AttributeConverter;
+import jakarta.persistence.Converter;
+
+import java.util.Optional;
+
+/**
+ * JPA attribute converter that maps {@link ModificationStatus} enum to/from its integer database representation.
+ *
+ * @author zihluwang
+ */
+@Converter
+public class ModificationStatusConverter implements AttributeConverter<ModificationStatus, Integer> {
+
+    @Override
+    public Integer convertToDatabaseColumn(ModificationStatus attribute) {
+        return Optional.ofNullable(attribute)
+                .map(ModificationStatus::getCode)
+                .orElse(null);
+    }
+
+    @Override
+    public ModificationStatus convertToEntityAttribute(Integer dbData) {
+        return ModificationStatus.fromCode(dbData);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/AccessoryRequest.java

@@ -0,0 +1,25 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotBlank;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Request DTO for creating or updating an accessory attached to a modification.
+ *
+ * @author zihluwang
+ */
+public record AccessoryRequest(
+        @NotBlank(message = "插槽名称不能为空")
+        String slotName,
+        @NotBlank(message = "配件名称不能为空")
+        String accessoryName,
+        List<@Valid TuningRequest> tunings
+) {
+    public List<TuningRequest> tunings() {
+        return tunings == null ? new ArrayList<>() : tunings;
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/AccessoryResponse.java

@@ -0,0 +1,27 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.onixbyte.ahsarahguide.domain.entity.Accessory;
+
+import java.util.List;
+
+/**
+ * Response DTO for an accessory attached to a modification.
+ *
+ * @author zihluwang
+ */
+public record AccessoryResponse(
+        String slotName,
+        String accessoryName,
+        List<TuningResponse> tunings
+) {
+    public static AccessoryResponse from(Accessory accessory) {
+        return new AccessoryResponse(
+                accessory.getSlotName(),
+                accessory.getAccessoryName(),
+                accessory.getTunings() == null
+                        ? List.of()
+                        : accessory.getTunings().stream().map(TuningResponse::from).toList()
+        );
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/BuildSummaryResponse.java

@@ -0,0 +1,20 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import java.util.List;
+
+/**
+ * Response record summarising a user's custom modification build.
+ * This is a skeleton record whose {@code from()} factory will be fully implemented
+ * when the CustomModification entity is introduced in a future issue.
+ *
+ * @author zihluwang
+ */
+public record BuildSummaryResponse(
+        Long id,
+        String name,
+        String code,
+        String firearmName,
+        List<String> tags
+) {
+    // from() factory to be implemented when CustomModification entity lands
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ChangePasswordRequest.java

@@ -0,0 +1,23 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+
+/**
+ * Request record for changing the current user's password.
+ *
+ * @author zihluwang
+ */
+public record ChangePasswordRequest(
+        @NotBlank(message = "旧密码不能为空")
+        String oldPassword,
+
+        @NotBlank(message = "新密码不能为空")
+        @Size(min = 8, max = 128, message = "密码长度必须在8-128个字符之间")
+        @Pattern(
+                regexp = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d).+$",
+                message = "密码必须包含至少一个大写字母、一个小写字母和一个数字"
+        )
+        String newPassword
+) {}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/DailyPassword.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+/**
+ * DTO representing a single daily-generated password for a map.
+ *
+ * @author zihluwang
+ */
+public record DailyPassword(
+        String mapName,
+        String password
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/DailyPasswordData.java

@@ -0,0 +1,19 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+/**
+ * DTO containing daily password data including update information and password list.
+ *
+ * @author zihluwang
+ */
+public record DailyPasswordData(
+        String updateDate,
+        Integer totalCount,
+        List<DailyPassword> passwords,
+        String source,
+        LocalDateTime lastUpdated,
+        Long timestamp
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/DailyPasswordMetadata.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+/**
+ * DTO holding metadata about the daily password source and update tracking.
+ *
+ * @author zihluwang
+ */
+public record DailyPasswordMetadata(
+        String version,
+        String author
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/DailyPasswordResponse.java

@@ -0,0 +1,14 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+/**
+ * Response DTO wrapping daily password data with metadata.
+ *
+ * @author zihluwang
+ */
+public record DailyPasswordResponse(
+        String status,
+        String message,
+        DailyPasswordData data,
+        DailyPasswordMetadata metadata
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/EmailVerificationCode.java

@@ -0,0 +1,8 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+public record EmailVerificationCode(
+        String username,
+        String email,
+        String code
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ErrorResponse.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+/**
+ * Standard error response body returned on API failures.
+ *
+ * @author zihluwang
+ */
+public record ErrorResponse(
+        String message
+) {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/FirearmRequest.java

@@ -0,0 +1,20 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.onixbyte.ahsarahguide.enumeration.FirearmType;
+
+/**
+ * Request DTO for creating or updating a firearm.
+ *
+ * @author zihluwang
+ */
+public record FirearmRequest(
+        String name,
+        FirearmType type,
+        String level,
+        String calibre,
+        Integer fireRate,
+        Integer armourDamage,
+        Integer bodyDamage,
+        String review
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/FirearmResponse.java

@@ -1,8 +1,13 @@
-package com.onixbyte.deltaforceguide.domain.dto;
+package com.onixbyte.ahsarahguide.domain.dto;
 
-import com.onixbyte.deltaforceguide.domain.entity.Firearm;
-import com.onixbyte.deltaforceguide.enumeration.FirearmType;
+import com.onixbyte.ahsarahguide.domain.entity.Firearm;
+import com.onixbyte.ahsarahguide.enumeration.FirearmType;
 
+/**
+ * Response DTO for a firearm record, including associated modifications.
+ *
+ * @author zihluwang
+ */
 public record FirearmResponse(
         Long id,
         String name,

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/GitHubIssueRequest.java

@@ -0,0 +1,15 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy.class)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record GitHubIssueRequest(
+        String action,
+        GitHubWebhookIssue issue,
+        GitHubWebhookRepository repository,
+        GitHubWebhookSender sender
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/GitHubWebhookIssue.java

@@ -0,0 +1,20 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+import java.util.List;
+
+@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy.class)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record GitHubWebhookIssue(
+        String url,
+        Long id,
+        Long number,
+        String title,
+        String body,
+        List<GitHubWebhookLabel> labels
+) {
+
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/GitHubWebhookLabel.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy.class)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record GitHubWebhookLabel(
+        String name
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/GitHubWebhookRepository.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy.class)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record GitHubWebhookRepository(
+        String fullName
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/GitHubWebhookSender.java

@@ -0,0 +1,12 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.databind.annotation.JsonNaming;
+
+@JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy.class)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record GitHubWebhookSender(
+        String login
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/LoginRequest.java

@@ -0,0 +1,20 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+
+/**
+ * Login request containing principle (username/email) and credential (password).
+ *
+ * @author zihluwang
+ */
+@Schema(description = "登录请求")
+public record LoginRequest(
+        @NotBlank(message = "登录名称不能为空")
+        @Schema(description = "用户名或电子邮箱", requiredMode = Schema.RequiredMode.REQUIRED)
+        String principle,
+        @NotBlank(message = "登录口令不能为空")
+        @Schema(description = "密码", requiredMode = Schema.RequiredMode.REQUIRED)
+        String credential
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ManageRoleRequest.java

@@ -0,0 +1,13 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.NotBlank;
+
+/**
+ * Request record for managing a user's role assignment.
+ *
+ * @author zihluwang
+ */
+public record ManageRoleRequest(
+        @NotBlank(message = "角色不能为空")
+        String role
+) {}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ModificationBatchCreateRequest.java

@@ -0,0 +1,18 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotEmpty;
+
+import java.util.List;
+
+/**
+ * Request DTO for batch creation of modifications.
+ *
+ * @author zihluwang
+ */
+public record ModificationBatchCreateRequest(
+        @NotEmpty(message = "批量创建列表不能为空")
+        List<@Valid ModificationRequest> modifications
+) {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ModificationBatchDeleteRequest.java

@@ -0,0 +1,18 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.NotEmpty;
+import jakarta.validation.constraints.Positive;
+
+import java.util.List;
+
+/**
+ * Request DTO for batch deletion of modifications by ID.
+ *
+ * @author zihluwang
+ */
+public record ModificationBatchDeleteRequest(
+        @NotEmpty(message = "批量删除ID列表不能为空")
+        List<@Positive(message = "ID必须为正数") Long> ids
+) {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ModificationRequest.java

@@ -0,0 +1,38 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Positive;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Request DTO for creating or updating a modification.
+ *
+ * @author zihluwang
+ */
+public record ModificationRequest(
+        @NotNull(message = "武器ID不能为空")
+        @Positive(message = "武器ID必须为正数")
+        Long firearmId,
+        @NotBlank(message = "改装名称不能为空")
+        String name,
+        @NotBlank(message = "改装代码不能为空")
+        String code,
+        List<@NotBlank(message = "标签不能为空") String> tags,
+        List<@Valid AccessoryRequest> accessories,
+        String note,
+        String author,
+        String videoUrl
+) {
+    public List<String> tags() {
+        return tags == null ? new ArrayList<>() : tags;
+    }
+
+    public List<AccessoryRequest> accessories() {
+        return accessories == null ? new ArrayList<>() : accessories;
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/ModificationResponse.java

@@ -1,15 +1,21 @@
-package com.onixbyte.deltaforceguide.domain.dto;
+package com.onixbyte.ahsarahguide.domain.dto;
 
-import com.onixbyte.deltaforceguide.domain.entity.Modification;
+import com.onixbyte.ahsarahguide.domain.entity.Modification;
 
 import java.util.List;
 
+/**
+ * Response DTO for a modification record including accessories and tags.
+ *
+ * @author zihluwang
+ */
 public record ModificationResponse(
         Long id,
         Long firearmId,
         String name,
         String code,
         List<String> tags,
+        List<AccessoryResponse> accessories,
         String note,
         String author,
         String videoUrl
@@ -21,6 +27,9 @@ public record ModificationResponse(
                 modification.getName(),
                 modification.getCode(),
                 modification.getTags(),
+                modification.getAccessories() == null
+                        ? List.of()
+                        : modification.getAccessories().stream().map(AccessoryResponse::from).toList(),
                 modification.getNote(),
                 modification.getAuthor(),
                 modification.getVideoUrl()

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/PageResponse.java

@@ -1,9 +1,14 @@
-package com.onixbyte.deltaforceguide.domain.dto;
+package com.onixbyte.ahsarahguide.domain.dto;
 
 import org.springframework.data.domain.Page;
 
 import java.util.List;
 
+/**
+ * Generic paginated response wrapper for list endpoints.
+ *
+ * @author zihluwang
+ */
 public record PageResponse<T>(
         List<T> items,
         int page,

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/RegisterRequest.java

@@ -0,0 +1,31 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+
+/**
+ * Registration request containing the new user account information.
+ *
+ * @author zihluwang
+ */
+@Schema(description = "注册请求")
+public record RegisterRequest(
+        @NotBlank(message = "用户名不能为空")
+        @Schema(description = "用户名", requiredMode = Schema.RequiredMode.REQUIRED)
+        String username,
+        @NotBlank(message = "邮箱不能为空")
+        @Email(message = "邮箱格式不正确")
+        @Schema(description = "邮箱", requiredMode = Schema.RequiredMode.REQUIRED)
+        String email,
+        @Schema(description = "昵称")
+        String nickname,
+        @Schema(description = "头像链接")
+        String avatarUrl,
+        @NotBlank(message = "密码不能为空")
+        @Schema(description = "密码", requiredMode = Schema.RequiredMode.REQUIRED)
+        String password,
+        @NotBlank(message = "验证码 ID 不能为空") String verificationCodeId,
+        @NotBlank(message = "验证码不能为空") String verificationCode
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/SendVerificationCodeRequest.java

@@ -0,0 +1,9 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.NotBlank;
+
+public record SendVerificationCodeRequest(
+        @NotBlank(message = "用户名不能为空") String username,
+        @NotBlank(message = "电子邮箱地址不能为空") String email
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/SendVerificationCodeResponse.java

@@ -0,0 +1,6 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+public record SendVerificationCodeResponse(
+        String verificationCodeId
+) {
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/TuningRequest.java

@@ -0,0 +1,18 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotNull;
+
+/**
+ * Request DTO for a tuning adjustment on an accessory.
+ *
+ * @author zihluwang
+ */
+public record TuningRequest(
+        @NotBlank(message = "调校项名称不能为空")
+        String tuningName,
+        @NotNull(message = "调校值不能为空")
+        Double tuningValue
+) {
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/TuningResponse.java

@@ -0,0 +1,21 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.onixbyte.ahsarahguide.domain.entity.Tuning;
+
+/**
+ * Response DTO for a tuning adjustment on an accessory.
+ *
+ * @author zihluwang
+ */
+public record TuningResponse(
+        String tuningName,
+        Double tuningValue
+) {
+    public static TuningResponse from(Tuning tuning) {
+        return new TuningResponse(
+                tuning.getTuningName(),
+                tuning.getTuningValue()
+        );
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/UpdateProfileRequest.java

@@ -0,0 +1,14 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.Size;
+
+/**
+ * Request record for updating the current user's profile information.
+ *
+ * @author zihluwang
+ */
+public record UpdateProfileRequest(
+        @Size(min = 1, max = 64, message = "昵称长度必须在1-64个字符之间")
+        String nickname
+) {}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/UserProfileResponse.java

@@ -0,0 +1,44 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.onixbyte.ahsarahguide.domain.entity.User;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+/**
+ * Response record for the current user's full profile information.
+ *
+ * @author zihluwang
+ */
+public record UserProfileResponse(
+        Long id,
+        String username,
+        String nickname,
+        String email,
+        String avatarUrl,
+        Boolean enabled,
+        LocalDateTime createdAt,
+        List<String> roles
+) {
+
+    /**
+     * Creates a {@code UserProfileResponse} from a {@link User} entity and its assigned roles.
+     *
+     * @param user  the user entity
+     * @param roles the list of role names assigned to the user
+     * @return the constructed response
+     */
+    public static UserProfileResponse from(User user, List<String> roles) {
+        return new UserProfileResponse(
+                user.getId(),
+                user.getUsername(),
+                user.getNickname() == null || user.getNickname().isBlank()
+                        ? user.getUsername() : user.getNickname(),
+                user.getEmail(),
+                user.getAvatarUrl(),
+                user.getEnabled(),
+                user.getCreatedAt(),
+                roles
+        );
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/dto/UserResponse.java

@@ -0,0 +1,26 @@
+package com.onixbyte.ahsarahguide.domain.dto;
+
+import com.onixbyte.ahsarahguide.domain.entity.User;
+
+import java.time.LocalDateTime;
+
+/**
+ * Response DTO for a user account, including associated credentials.
+ *
+ * @author zihluwang
+ */
+public record UserResponse(
+        Long id,
+        String username,
+        String email,
+        LocalDateTime expiration
+) {
+    public static UserResponse from(User user, LocalDateTime expiration) {
+        return new UserResponse(
+                user.getId(),
+                user.getUsername(),
+                user.getEmail(),
+                expiration
+        );
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/Accessory.java

@@ -0,0 +1,72 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
+/**
+ * Entity representing an accessory attached to a modification, stored as JSONB.
+ *
+ * @author zihluwang
+ */
+public class Accessory {
+
+    private String slotName;
+
+    private String accessoryName;
+
+    private List<Tuning> tunings = new ArrayList<>();
+
+    public Accessory() {
+    }
+
+    public String getSlotName() {
+        return slotName;
+    }
+
+    public void setSlotName(String slotName) {
+        this.slotName = slotName;
+    }
+
+    public String getAccessoryName() {
+        return accessoryName;
+    }
+
+    public void setAccessoryName(String accessoryName) {
+        this.accessoryName = accessoryName;
+    }
+
+    public List<Tuning> getTunings() {
+        return tunings;
+    }
+
+    public void setTunings(List<Tuning> tunings) {
+        this.tunings = tunings;
+    }
+
+    public void addTuning(Tuning tuning) {
+        this.tunings.add(tuning);
+    }
+
+    public void removeTuning(Tuning tuning) {
+        this.tunings.remove(tuning);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof Accessory accessory)) {
+            return false;
+        }
+        return Objects.equals(slotName, accessory.slotName)
+                && Objects.equals(accessoryName, accessory.accessoryName)
+                && Objects.equals(tunings, accessory.tunings);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(slotName, accessoryName, tunings);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/Firearm.java

@@ -1,7 +1,7 @@
-package com.onixbyte.deltaforceguide.domain.entity;
+package com.onixbyte.ahsarahguide.domain.entity;
 
-import com.onixbyte.deltaforceguide.domain.converter.FirearmTypeConverter;
-import com.onixbyte.deltaforceguide.enumeration.FirearmType;
+import com.onixbyte.ahsarahguide.domain.converter.FirearmTypeConverter;
+import com.onixbyte.ahsarahguide.enumeration.FirearmType;
 import jakarta.persistence.CascadeType;
 import jakarta.persistence.Column;
 import jakarta.persistence.Convert;
@@ -15,6 +15,11 @@ import jakarta.persistence.Table;
 import java.util.ArrayList;
 import java.util.List;
 
+/**
+ * Entity representing a firearm in the Delta Force game.
+ *
+ * @author zihluwang
+ */
 @Entity
 @Table(name = "firearm")
 public class Firearm {
@@ -140,5 +145,88 @@ public class Firearm {
         this.modifications.remove(modification);
         modification.setFirearm(null);
     }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static class Builder {
+
+        private Long id;
+        private String name;
+        private FirearmType type;
+        private String level;
+        private String review;
+        private String calibre;
+        private Integer fireRate;
+        private Integer armourDamage;
+        private Integer bodyDamage;
+        private List<Modification> modifications;
+
+        public Builder id(Long id) {
+            this.id = id;
+            return this;
+        }
+
+        public Builder name(String name) {
+            this.name = name;
+            return this;
+        }
+
+        public Builder type(FirearmType type) {
+            this.type = type;
+            return this;
+        }
+
+        public Builder level(String level) {
+            this.level = level;
+            return this;
+        }
+
+        public Builder review(String review) {
+            this.review = review;
+            return this;
+        }
+
+        public Builder calibre(String calibre) {
+            this.calibre = calibre;
+            return this;
+        }
+
+        public Builder fireRate(Integer fireRate) {
+            this.fireRate = fireRate;
+            return this;
+        }
+
+        public Builder armourDamage(Integer armourDamage) {
+            this.armourDamage = armourDamage;
+            return this;
+        }
+
+        public Builder bodyDamage(Integer bodyDamage) {
+            this.bodyDamage = bodyDamage;
+            return this;
+        }
+
+        public Builder modifications(List<Modification> modifications) {
+            this.modifications = modifications;
+            return this;
+        }
+
+        public Firearm build() {
+            Firearm firearm = new Firearm();
+            firearm.id = this.id;
+            firearm.name = this.name;
+            firearm.type = this.type;
+            firearm.level = this.level;
+            firearm.review = this.review;
+            firearm.calibre = this.calibre;
+            firearm.fireRate = this.fireRate;
+            firearm.armourDamage = this.armourDamage;
+            firearm.bodyDamage = this.bodyDamage;
+            firearm.modifications = this.modifications == null ? new ArrayList<>() : this.modifications;
+            return firearm;
+        }
+    }
 }
 

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/Modification.java

@@ -0,0 +1,289 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import com.onixbyte.ahsarahguide.domain.converter.ModificationStatusConverter;
+import com.onixbyte.ahsarahguide.enumeration.ModificationStatus;
+import io.hypersistence.utils.hibernate.type.json.JsonType;
+import jakarta.persistence.*;
+import org.hibernate.annotations.Type;
+
+import java.time.OffsetDateTime;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Entity representing a firearm modification or build configuration.
+ *
+ * @author zihluwang
+ */
+@Entity
+@Table(
+        name = "modification",
+        indexes = {
+                @Index(name = "idx_modification_firearm_id", columnList = "firearm_id")
+        }
+)
+public class Modification {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne
+    @JoinColumn(name = "user_id")
+    private User user;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "firearm_id", nullable = false, foreignKey = @ForeignKey(name = "fk_modification_firearm"))
+    private Firearm firearm;
+
+    @Column(name = "name", nullable = false, length = 64)
+    private String name;
+
+    @Column(name = "code", nullable = false, length = 64)
+    private String code;
+
+    @Type(JsonType.class)
+    @Column(name = "tags", columnDefinition = "jsonb", nullable = false)
+    private List<String> tags = new ArrayList<>();
+
+    @Type(JsonType.class)
+    @Column(name = "accessories", columnDefinition = "jsonb", nullable = false)
+    private List<Accessory> accessories = new ArrayList<>();
+
+    @Column(name = "note", columnDefinition = "TEXT")
+    private String note;
+
+    @Column(name = "author", length = 64)
+    private String author;
+
+    @Column(name = "video_url", length = 512)
+    private String videoUrl;
+
+    @Column(name = "status", nullable = false)
+    @Convert(converter = ModificationStatusConverter.class)
+    private ModificationStatus status = ModificationStatus.DRAFT;
+
+    @Column(name = "create_by")
+    private Long createBy;
+
+    @Column(name = "create_time", nullable = false)
+    private OffsetDateTime createTime;
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public Firearm getFirearm() {
+        return firearm;
+    }
+
+    public void setFirearm(Firearm firearm) {
+        this.firearm = firearm;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getCode() {
+        return code;
+    }
+
+    public void setCode(String code) {
+        this.code = code;
+    }
+
+    public List<String> getTags() {
+        return tags;
+    }
+
+    public void setTags(List<String> tags) {
+        this.tags = tags;
+    }
+
+    public List<Accessory> getAccessories() {
+        return accessories;
+    }
+
+    public void setAccessories(List<Accessory> accessories) {
+        this.accessories = accessories;
+    }
+
+    public void addAccessory(Accessory modificationAccessory) {
+        this.accessories.add(modificationAccessory);
+    }
+
+    public void removeAccessory(Accessory modificationAccessory) {
+        this.accessories.remove(modificationAccessory);
+    }
+
+    public String getNote() {
+        return note;
+    }
+
+    public void setNote(String note) {
+        this.note = note;
+    }
+
+    public String getAuthor() {
+        return author;
+    }
+
+    public void setAuthor(String author) {
+        this.author = author;
+    }
+
+    public String getVideoUrl() {
+        return videoUrl;
+    }
+
+    public void setVideoUrl(String videoUrl) {
+        this.videoUrl = videoUrl;
+    }
+
+    public User getUser() {
+        return user;
+    }
+
+    public void setUser(User user) {
+        this.user = user;
+    }
+
+    public Long getCreateBy() {
+        return createBy;
+    }
+
+    public void setCreateBy(Long createBy) {
+        this.createBy = createBy;
+    }
+
+    public OffsetDateTime getCreateTime() {
+        return createTime;
+    }
+
+    public void setCreateTime(OffsetDateTime createTime) {
+        this.createTime = createTime;
+    }
+
+    public ModificationStatus getStatus() {
+        return status;
+    }
+
+    public void setStatus(ModificationStatus status) {
+        this.status = status;
+    }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static class Builder {
+
+        private Long id;
+        private User user;
+        private Firearm firearm;
+        private String name;
+        private String code;
+        private List<String> tags;
+        private List<Accessory> accessories;
+        private String note;
+        private String author;
+        private String videoUrl;
+        private Long createBy;
+        private OffsetDateTime createTime;
+        private ModificationStatus status;
+
+        public Builder id(Long id) {
+            this.id = id;
+            return this;
+        }
+
+        public Builder user(User user) {
+            this.user = user;
+            return this;
+        }
+
+        public Builder firearm(Firearm firearm) {
+            this.firearm = firearm;
+            return this;
+        }
+
+        public Builder name(String name) {
+            this.name = name;
+            return this;
+        }
+
+        public Builder code(String code) {
+            this.code = code;
+            return this;
+        }
+
+        public Builder tags(List<String> tags) {
+            this.tags = tags;
+            return this;
+        }
+
+        public Builder accessories(List<Accessory> accessories) {
+            this.accessories = accessories;
+            return this;
+        }
+
+        public Builder note(String note) {
+            this.note = note;
+            return this;
+        }
+
+        public Builder author(String author) {
+            this.author = author;
+            return this;
+        }
+
+        public Builder videoUrl(String videoUrl) {
+            this.videoUrl = videoUrl;
+            return this;
+        }
+
+        public Builder createBy(Long createBy) {
+            this.createBy = createBy;
+            return this;
+        }
+
+        public Builder createTime(OffsetDateTime createTime) {
+            this.createTime = createTime;
+            return this;
+        }
+
+        public Builder status(ModificationStatus status) {
+            this.status = status;
+            return this;
+        }
+
+        public Modification build() {
+            Modification modification = new Modification();
+            modification.id = this.id;
+            modification.user = this.user;
+            modification.firearm = this.firearm;
+            modification.name = this.name;
+            modification.code = this.code;
+            modification.tags = Optional.ofNullable(this.tags).orElseGet(ArrayList::new);
+            modification.accessories = Optional.ofNullable(this.accessories).orElseGet(ArrayList::new);
+            modification.note = this.note;
+            modification.author = this.author;
+            modification.videoUrl = this.videoUrl;
+            modification.createBy = this.createBy;
+            modification.createTime = Optional.ofNullable(this.createTime).orElseGet(OffsetDateTime::now);
+            modification.status = Optional.ofNullable(this.status).orElse(ModificationStatus.DRAFT);
+            return modification;
+        }
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/Tuning.java

@@ -0,0 +1,50 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import java.util.Objects;
+
+/**
+ * Entity representing a tuning adjustment for an accessory, stored as JSONB within Accessory.
+ *
+ * @author zihluwang
+ */
+public class Tuning {
+
+    private String tuningName;
+    private Double tuningValue;
+
+    public Tuning() {
+    }
+
+    public String getTuningName() {
+        return tuningName;
+    }
+
+    public void setTuningName(String tuningName) {
+        this.tuningName = tuningName;
+    }
+
+    public Double getTuningValue() {
+        return tuningValue;
+    }
+
+    public void setTuningValue(Double tuningValue) {
+        this.tuningValue = tuningValue;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof Tuning tuning)) {
+            return false;
+        }
+        return Objects.equals(tuningName, tuning.tuningName)
+                && Objects.equals(tuningValue, tuning.tuningValue);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(tuningName, tuningValue);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/User.java

@@ -0,0 +1,217 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import jakarta.persistence.CascadeType;
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.OneToMany;
+import jakarta.persistence.PreUpdate;
+import jakarta.persistence.Table;
+
+import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Entity representing an application user with authentication credentials.
+ *
+ * @author zihluwang
+ */
+@Entity
+@Table(name = "app_user")
+public class User {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "username", nullable = false)
+    private String username;
+
+    @Column(name = "email", nullable = false)
+    private String email;
+
+    @Column(name = "nickname")
+    private String nickname;
+
+    @Column(name = "avatar_url")
+    private String avatarUrl;
+
+    @Column(name = "enabled", nullable = false)
+    private Boolean enabled = true;
+
+    @Column(name = "created_at", nullable = false)
+    private LocalDateTime createdAt;
+
+    @Column(name = "updated_at", nullable = false)
+    private LocalDateTime updatedAt;
+
+    @OneToMany(mappedBy = "user", cascade = CascadeType.ALL, orphanRemoval = true)
+    private List<UserCredential> credentials = new ArrayList<>();
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getNickname() {
+        return nickname;
+    }
+
+    public void setNickname(String nickname) {
+        this.nickname = nickname;
+    }
+
+    public String getAvatarUrl() {
+        return avatarUrl;
+    }
+
+    public void setAvatarUrl(String avatarUrl) {
+        this.avatarUrl = avatarUrl;
+    }
+
+    public Boolean getEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(Boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public LocalDateTime getCreatedAt() {
+        return createdAt;
+    }
+
+    public void setCreatedAt(LocalDateTime createdAt) {
+        this.createdAt = createdAt;
+    }
+
+    public LocalDateTime getUpdatedAt() {
+        return updatedAt;
+    }
+
+    public void setUpdatedAt(LocalDateTime updatedAt) {
+        this.updatedAt = updatedAt;
+    }
+
+    @PreUpdate
+    private void onUpdate() {
+        this.updatedAt = LocalDateTime.now();
+    }
+
+    public List<UserCredential> getCredentials() {
+        return credentials;
+    }
+
+    public void setCredentials(List<UserCredential> credentials) {
+        this.credentials = credentials;
+    }
+
+    public void addCredential(UserCredential credential) {
+        this.credentials.add(credential);
+        credential.setUser(this);
+    }
+
+    public void removeCredential(UserCredential credential) {
+        this.credentials.remove(credential);
+        credential.setUser(null);
+    }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static class Builder {
+
+        private Long id;
+        private String username;
+        private String email;
+        private String nickname;
+        private String avatarUrl;
+        private Boolean enabled;
+        private LocalDateTime createdAt;
+        private LocalDateTime updatedAt;
+        private List<UserCredential> credentials;
+
+        public Builder id(Long id) {
+            this.id = id;
+            return this;
+        }
+
+        public Builder username(String username) {
+            this.username = username;
+            return this;
+        }
+
+        public Builder email(String email) {
+            this.email = email;
+            return this;
+        }
+
+        public Builder nickname(String nickname) {
+            this.nickname = nickname;
+            return this;
+        }
+
+        public Builder avatarUrl(String avatarUrl) {
+            this.avatarUrl = avatarUrl;
+            return this;
+        }
+
+        public Builder enabled(Boolean enabled) {
+            this.enabled = enabled;
+            return this;
+        }
+
+        public Builder createdAt(LocalDateTime createdAt) {
+            this.createdAt = createdAt;
+            return this;
+        }
+
+        public Builder updatedAt(LocalDateTime updatedAt) {
+            this.updatedAt = updatedAt;
+            return this;
+        }
+
+        public Builder credentials(List<UserCredential> credentials) {
+            this.credentials = credentials;
+            return this;
+        }
+
+        public User build() {
+            User user = new User();
+            user.id = this.id;
+            user.username = this.username;
+            user.email = this.email;
+            user.nickname = this.nickname == null || this.nickname.isBlank()
+                    ? this.username : this.nickname;
+            user.avatarUrl = this.avatarUrl;
+            user.enabled = this.enabled == null || this.enabled;
+            user.createdAt = this.createdAt;
+            user.updatedAt = this.updatedAt;
+            user.credentials = this.credentials == null ? new ArrayList<>() : this.credentials;
+            return user;
+        }
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/UserCredential.java

@@ -0,0 +1,143 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.AttributeOverride;
+import jakarta.persistence.AttributeOverrides;
+import jakarta.persistence.EmbeddedId;
+import jakarta.persistence.Entity;
+import jakarta.persistence.FetchType;
+import jakarta.persistence.ForeignKey;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.MapsId;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.Table;
+
+/**
+ * Entity representing a user credential linked to an authentication provider.
+ *
+ * @author zihluwang
+ */
+@Entity
+@Table(name = "app_user_credential")
+public class UserCredential {
+
+	@EmbeddedId
+	@AttributeOverrides({
+		@AttributeOverride(name = "userId", column = @Column(name = "user_id")),
+		@AttributeOverride(name = "provider", column = @Column(name = "provider"))
+	})
+	private UserCredentialId id = new UserCredentialId();
+
+	@MapsId("userId")
+	@ManyToOne(fetch = FetchType.LAZY, optional = false)
+	@JoinColumn(name = "user_id", nullable = false, foreignKey = @ForeignKey(name = "fk_user_credential_user"))
+	private User user;
+
+	@Column(name = "credential", nullable = false)
+	private String credential;
+
+	public UserCredentialId getId() {
+		return id;
+	}
+
+	public void setId(UserCredentialId id) {
+		this.id = id;
+	}
+
+	public User getUser() {
+		return user;
+	}
+
+	public void setUser(User user) {
+		this.user = user;
+		if (this.id == null) {
+			this.id = new UserCredentialId();
+		}
+		this.id.setUserId(user == null ? null : user.getId());
+	}
+
+	public Long getUserId() {
+		return id == null ? null : id.getUserId();
+	}
+
+	public void setUserId(Long userId) {
+		if (this.id == null) {
+			this.id = new UserCredentialId();
+		}
+		this.id.setUserId(userId);
+	}
+
+	public String getProvider() {
+		return id == null ? null : id.getProvider();
+	}
+
+	public void setProvider(String provider) {
+		if (this.id == null) {
+			this.id = new UserCredentialId();
+		}
+		this.id.setProvider(provider);
+	}
+
+	public String getCredential() {
+		return credential;
+	}
+
+	public void setCredential(String credential) {
+		this.credential = credential;
+	}
+
+	public static Builder builder() {
+		return new Builder();
+	}
+
+	public static class Builder {
+
+		private UserCredentialId id;
+		private User user;
+		private Long userId;
+		private String provider;
+		private String credential;
+
+		public Builder id(UserCredentialId id) {
+			this.id = id;
+			return this;
+		}
+
+		public Builder user(User user) {
+			this.user = user;
+			return this;
+		}
+
+		public Builder userId(Long userId) {
+			this.userId = userId;
+			return this;
+		}
+
+		public Builder provider(String provider) {
+			this.provider = provider;
+			return this;
+		}
+
+		public Builder credential(String credential) {
+			this.credential = credential;
+			return this;
+		}
+
+		public UserCredential build() {
+			UserCredential userCredential = new UserCredential();
+			userCredential.id = this.id == null ? new UserCredentialId() : this.id;
+			userCredential.user = this.user;
+			if (this.user != null) {
+				userCredential.id.setUserId(this.user.getId());
+			}
+			if (this.userId != null) {
+				userCredential.id.setUserId(this.userId);
+			}
+			if (this.provider != null) {
+				userCredential.id.setProvider(this.provider);
+			}
+			userCredential.credential = this.credential;
+			return userCredential;
+		}
+	}
+}

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/UserCredentialId.java

@@ -0,0 +1,81 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import jakarta.persistence.Embeddable;
+
+import java.io.Serializable;
+import java.util.Objects;
+
+/**
+ * Composite key for the UserCredential entity, combining user ID and provider.
+ *
+ * @author zihluwang
+ */
+@Embeddable
+public class UserCredentialId implements Serializable {
+
+    private Long userId;
+
+    private String provider;
+
+    public Long getUserId() {
+        return userId;
+    }
+
+    public void setUserId(Long userId) {
+        this.userId = userId;
+    }
+
+    public String getProvider() {
+        return provider;
+    }
+
+    public void setProvider(String provider) {
+        this.provider = provider;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o == null || getClass() != o.getClass()) {
+            return false;
+        }
+        UserCredentialId that = (UserCredentialId) o;
+        return Objects.equals(userId, that.userId) && Objects.equals(provider, that.provider);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(userId, provider);
+    }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static class Builder {
+
+        private Long userId;
+        private String provider;
+
+        public Builder userId(Long userId) {
+            this.userId = userId;
+            return this;
+        }
+
+        public Builder provider(String provider) {
+            this.provider = provider;
+            return this;
+        }
+
+        public UserCredentialId build() {
+            UserCredentialId id = new UserCredentialId();
+            id.userId = this.userId;
+            id.provider = this.provider;
+            return id;
+        }
+    }
+}
+
+

server/src/main/java/com/onixbyte/ahsarahguide/domain/entity/UserRole.java

@@ -0,0 +1,101 @@
+package com.onixbyte.ahsarahguide.domain.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.FetchType;
+import jakarta.persistence.ForeignKey;
+import jakarta.persistence.Id;
+import jakarta.persistence.JoinColumn;
+import jakarta.persistence.ManyToOne;
+import jakarta.persistence.MapsId;
+import jakarta.persistence.Table;
+
+/**
+ * Entity representing a role assignment linking a user to a security role.
+ * <p>
+ * A user owns at most one role assignment, so the user ID is the primary key.
+ *
+ * @author zihluwang
+ */
+@Entity
+@Table(name = "user_role")
+public class UserRole {
+
+    @Id
+    @Column(name = "user_id")
+    private Long userId;
+
+    @MapsId("userId")
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "user_id", nullable = false, foreignKey = @ForeignKey(name = "fk_user_role_user"))
+    private User user;
+
+    @Column(name = "role", nullable = false, length = 32)
+    private String role;
+
+    public Long getUserId() {
+        return userId;
+    }
+
+    public void setUserId(Long userId) {
+        this.userId = userId;
+    }
+
+    public User getUser() {
+        return user;
+    }
+
+    public void setUser(User user) {
+        this.user = user;
+        if (user != null) {
+            this.userId = user.getId();
+        }
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    public void setRole(String role) {
+        this.role = role;
+    }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static class Builder {
+
+        private User user;
+        private Long userId;
+        private String role;
+
+        public Builder user(User user) {
+            this.user = user;
+            return this;
+        }
+
+        public Builder userId(Long userId) {
+            this.userId = userId;
+            return this;
+        }
+
+        public Builder role(String role) {
+            this.role = role;
+            return this;
+        }
+
+        public UserRole build() {
+            UserRole userRole = new UserRole();
+            userRole.user = this.user;
+            userRole.role = this.role;
+            if (this.user != null) {
+                userRole.userId = this.user.getId();
+            }
+            if (this.userId != null) {
+                userRole.userId = this.userId;
+            }
+            return userRole;
+        }
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/enumeration/FirearmType.java

@@ -1,5 +1,11 @@
-package com.onixbyte.deltaforceguide.enumeration;
+package com.onixbyte.ahsarahguide.enumeration;
 
+/**
+ * Enumeration of firearm types in the Delta Force game.
+ * Each type is associated with an integer code used for database persistence.
+ *
+ * @author zihluwang
+ */
 public enum FirearmType {
 
     RIFLE(0),
@@ -21,6 +27,13 @@ public enum FirearmType {
         return code;
     }
 
+    /**
+     * Resolve a FirearmType from its integer code.
+     *
+      * @param code the integer code, may be null
+     * @return the corresponding FirearmType, or null if the code is null
+     * @throws IllegalArgumentException if the code does not match any known type
+     */
     public static FirearmType fromCode(Integer code) {
         if (code == null) {
             return null;

server/src/main/java/com/onixbyte/ahsarahguide/enumeration/ModificationStatus.java

@@ -0,0 +1,44 @@
+package com.onixbyte.ahsarahguide.enumeration;
+
+import java.util.Arrays;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/**
+ * Enumeration of modification statuses.
+ * <p>
+ * Each status is associated with an integer code used for database persistence.
+ *
+ * @author zihluwang
+ */
+public enum ModificationStatus {
+
+    DRAFT(0),
+    PENDING_APPROVAL(1),
+    PUBLISHED(2);
+
+    private final int code;
+
+    ModificationStatus(int code) {
+        this.code = code;
+    }
+
+    public int getCode() {
+        return code;
+    }
+
+    public static final Map<Integer, ModificationStatus> CODE_MAP = Arrays.stream(values())
+            .collect(Collectors.toMap(ModificationStatus::getCode, Function.identity()));
+
+    /**
+     * Resolve a ModificationStatus from its integer code.
+     *
+     * @param code the integer code, may be null
+     * @return the corresponding ModificationStatus, or null if the code is null
+     * @throws IllegalArgumentException if the code does not match any known status
+     */
+    public static ModificationStatus fromCode(Integer code) {
+        return CODE_MAP.get(code);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/BadRequestException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class BadRequestException extends ResponseStatusException {
+
+    public BadRequestException(String reason) {
+        super(HttpStatus.BAD_REQUEST, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/ConflictException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class ConflictException extends ResponseStatusException {
+
+    public ConflictException(String reason) {
+        super(HttpStatus.CONFLICT, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/ForbiddenException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class ForbiddenException extends ResponseStatusException {
+
+    public ForbiddenException(String reason) {
+        super(HttpStatus.FORBIDDEN, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/InternalServerErrorException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class InternalServerErrorException extends ResponseStatusException {
+
+    public InternalServerErrorException(String reason) {
+        super(HttpStatus.INTERNAL_SERVER_ERROR, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/NotFoundException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class NotFoundException extends ResponseStatusException {
+
+    public NotFoundException(String reason) {
+        super(HttpStatus.NOT_FOUND, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/exeption/UnauthorisedException.java

@@ -0,0 +1,11 @@
+package com.onixbyte.ahsarahguide.exeption;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+public class UnauthorisedException extends ResponseStatusException {
+
+    public UnauthorisedException(String reason) {
+        super(HttpStatus.UNAUTHORIZED, reason);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/filter/TokenAuthenticationFilter.java

@@ -0,0 +1,123 @@
+package com.onixbyte.ahsarahguide.filter;
+
+import com.auth0.jwt.exceptions.JWTVerificationException;
+import com.onixbyte.ahsarahguide.client.TokenClient;
+import com.onixbyte.ahsarahguide.exeption.UnauthorisedException;
+import com.onixbyte.ahsarahguide.manager.CookieManager;
+import com.onixbyte.ahsarahguide.manager.UserManager;
+import com.onixbyte.ahsarahguide.manager.UserRoleManager;
+import com.onixbyte.ahsarahguide.security.authentication.UsernamePasswordAuthentication;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.NonNull;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpHeaders;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.web.servlet.HandlerExceptionResolver;
+import org.springframework.web.util.WebUtils;
+
+import java.io.IOException;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+/**
+ * Servlet filter that extracts and validates JWT tokens from httpOnly cookies for each request.
+ *
+ * @author zihluwang
+ */
+@Component
+public class TokenAuthenticationFilter extends OncePerRequestFilter {
+
+    private final static Logger log = LoggerFactory.getLogger(TokenAuthenticationFilter.class);
+    private static final Duration ACCESS_TOKEN_RENEW_THRESHOLD = Duration.ofMinutes(5);
+
+    private final UserManager userManager;
+    private final UserRoleManager userRoleManager;
+    private final TokenClient tokenClient;
+    private final CookieManager cookieManager;
+    private final HandlerExceptionResolver handlerExceptionResolver;
+
+    public TokenAuthenticationFilter(
+            UserManager userManager,
+            UserRoleManager userRoleManager,
+            TokenClient tokenClient,
+            CookieManager cookieManager,
+            HandlerExceptionResolver handlerExceptionResolver
+    ) {
+        this.userManager = userManager;
+        this.userRoleManager = userRoleManager;
+        this.tokenClient = tokenClient;
+        this.cookieManager = cookieManager;
+        this.handlerExceptionResolver = handlerExceptionResolver;
+    }
+
+    /**
+     * Extracts JWT from httpOnly cookie, validates it, and sets the security context.
+     *
+     * @param request the HTTP request
+     * @param response the HTTP response
+     * @param filterChain the filter chain
+     */
+    @Override
+    protected void doFilterInternal(
+            @NonNull HttpServletRequest request,
+            @NonNull HttpServletResponse response,
+            @NonNull FilterChain filterChain
+    ) throws ServletException, IOException {
+        var token = Optional.ofNullable(WebUtils.getCookie(request, "AccessToken"))
+                .map(Cookie::getValue)
+                .orElse(null);
+        if (Objects.isNull(token) || token.isBlank()) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
+        try {
+            var decodedToken = tokenClient.verifyToken(token);
+            var username = decodedToken.getSubject();
+
+            var userWrapper = userManager.findByUsername(username);
+            if (userWrapper.isEmpty()) {
+                throw new UnauthorisedException("登录已过期，请重新登录");
+            }
+
+            var user = userWrapper.get();
+            var roles = userRoleManager.findAllByUserId(user.getId());
+            var authorities = roles.stream()
+                    .map(r -> new SimpleGrantedAuthority(r.getRole()))
+                    .collect(Collectors.toList());
+            var authentication = UsernamePasswordAuthentication.authenticated(user, authorities);
+            SecurityContextHolder.getContext().setAuthentication(authentication);
+
+            if (shouldRenew(decodedToken.getExpiresAt().toInstant())) {
+                var renewedToken = tokenClient.generateToken(user);
+                var renewedTokenCookie = cookieManager.buildCookie("AccessToken", renewedToken);
+                response.addHeader(HttpHeaders.SET_COOKIE, renewedTokenCookie.toString());
+            }
+
+            filterChain.doFilter(request, response);
+        } catch (JWTVerificationException e) {
+            log.error("JWT verification failed.", e);
+            handlerExceptionResolver.resolveException(request, response, null,
+                    new UnauthorisedException("登录已过期，请重新登录"));
+        } catch (ResponseStatusException e) {
+            handlerExceptionResolver.resolveException(request, response, null, e);
+        }
+    }
+
+    private boolean shouldRenew(Instant expiresAt) {
+        return Duration.between(Instant.now(), expiresAt).compareTo(ACCESS_TOKEN_RENEW_THRESHOLD) < 0;
+    }
+}
+

server/src/main/java/com/onixbyte/ahsarahguide/filter/WebhookFilter.java

@@ -0,0 +1,22 @@
+package com.onixbyte.ahsarahguide.filter;
+
+import com.onixbyte.ahsarahguide.wrapper.RepeatedlyReadRequestWrapper;
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+public class WebhookFilter implements Filter {
+    @Override
+    public void doFilter(
+            ServletRequest request,
+            ServletResponse response,
+            FilterChain chain
+    ) throws IOException, ServletException {
+        var httpRequest = (HttpServletRequest) request;
+        var wrappedRequest = new RepeatedlyReadRequestWrapper(httpRequest);
+        chain.doFilter(wrappedRequest, response);
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/interceptor/GitHubWebhookInterceptor.java

@@ -0,0 +1,83 @@
+package com.onixbyte.ahsarahguide.interceptor;
+
+import com.onixbyte.crypto.util.CryptoUtil;
+import com.onixbyte.ahsarahguide.exeption.InternalServerErrorException;
+import com.onixbyte.ahsarahguide.exeption.UnauthorisedException;
+import com.onixbyte.ahsarahguide.manager.WebhookManager;
+import com.onixbyte.ahsarahguide.shared.GitHubWebhookHeader;
+import com.onixbyte.ahsarahguide.wrapper.RepeatedlyReadRequestWrapper;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.NonNull;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+/**
+ * Verifies GitHub webhook requests by validating the {@code X-Hub-Signature-256}
+ * header against the configured secret using HMAC-SHA256.
+ *
+ * <p>Verification is skipped when no secret is configured. The signature format is
+ * {@code sha256=<hex-digest>} as documented by GitHub.
+ */
+@Component
+public class GitHubWebhookInterceptor implements HandlerInterceptor {
+
+    private static final Logger log = LoggerFactory.getLogger(GitHubWebhookInterceptor.class);
+
+    private final WebhookManager webhookManager;
+
+    public GitHubWebhookInterceptor(WebhookManager webhookManager) {
+        this.webhookManager = webhookManager;
+    }
+
+    @Override
+    public boolean preHandle(
+            @NonNull HttpServletRequest request,
+            @NonNull HttpServletResponse response,
+            @NonNull Object handler
+    ) {
+        if (!(request instanceof RepeatedlyReadRequestWrapper req)) {
+            throw new InternalServerErrorException(
+                    "Request body is not readable");
+        }
+
+        var secret = webhookManager.secret();
+        if (secret == null || secret.isBlank()) {
+            log.debug("No GitHub webhook secret configured, skipping signature verification");
+            return true;
+        }
+
+        var signatureHeader = req.getHeader(GitHubWebhookHeader.SIGNATURE_256);
+        if (signatureHeader == null || signatureHeader.isBlank()) {
+            log.warn("Missing {} header from ip={}",
+                    GitHubWebhookHeader.SIGNATURE_256, request.getRemoteAddr());
+            throw new UnauthorisedException(
+                    "Missing webhook signature header");
+        }
+
+        var body = req.getBodyString();
+        try {
+            var computed = "sha256=" + CryptoUtil.hmacSha256(body, secret);
+
+            if (!MessageDigest.isEqual(
+                    computed.getBytes(StandardCharsets.UTF_8),
+                    signatureHeader.getBytes(StandardCharsets.UTF_8))) {
+                log.warn("Invalid webhook signature from ip={}", request.getRemoteAddr());
+                throw new UnauthorisedException("Invalid webhook signature");
+            }
+
+            return true;
+        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+            log.error("Failed to compute HMAC-SHA256", e);
+            throw new InternalServerErrorException(
+                    "Failed to verify webhook signature");
+        }
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/interceptor/TrafficInterceptor.java

@@ -0,0 +1,46 @@
+package com.onixbyte.ahsarahguide.interceptor;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.NonNull;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+@Component
+public class TrafficInterceptor implements HandlerInterceptor {
+
+    private static final Logger log = LoggerFactory.getLogger(TrafficInterceptor.class);
+
+    @Override
+    public boolean preHandle(
+            @NonNull HttpServletRequest request,
+            @NonNull HttpServletResponse response,
+            @NonNull Object handler
+    ) {
+        var ip = resolveClientIp(request);
+        var method = request.getMethod();
+        var uri = request.getRequestURI();
+        var query = request.getQueryString();
+        var contentType = request.getContentType();
+        var contentLength = request.getContentLength();
+        var userAgent = request.getHeader("User-Agent");
+
+        log.debug("Request method={}, uri={}, query={}, ip={}, content-type={}, content-length={}, user-agent={}",
+                method, uri, query, ip, contentType, contentLength, userAgent);
+        return true;
+    }
+
+    private String resolveClientIp(HttpServletRequest request) {
+        var xForwardedFor = request.getHeader("X-Forwarded-For");
+        if (xForwardedFor != null && !xForwardedFor.isBlank()) {
+            return xForwardedFor.split(",")[0].trim();
+        }
+        var xRealIp = request.getHeader("X-Real-IP");
+        if (xRealIp != null && !xRealIp.isBlank()) {
+            return xRealIp.trim();
+        }
+        return request.getRemoteAddr();
+    }
+}

server/src/main/java/com/onixbyte/ahsarahguide/manager/AppManager.java

@@ -0,0 +1,27 @@
+package com.onixbyte.ahsarahguide.manager;
+
+import org.springframework.boot.info.BuildProperties;
+import org.springframework.stereotype.Component;
+
+@Component
+public class AppManager {
+
+    private final BuildProperties buildProperties;
+
+    public AppManager(BuildProperties buildProperties) {
+        this.buildProperties = buildProperties;
+    }
+
+    /**
+     * Retrieves the application version.
+     *
+     * @return the version string of this application
+     */
+    public String getVersion() {
+        return "v%s-%s by @%s".formatted(
+                buildProperties.getVersion(),
+                buildProperties.get("channel"),
+                buildProperties.get("vendor")
+        );
+    }
+}