Enforce NPM version

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -68,7 +68,6 @@ public class ApplicationProperties {
 
     private AutoPipeline autoPipeline = new AutoPipeline();
     private ProcessExecutor processExecutor = new ProcessExecutor();
-    private PdfEditor pdfEditor = new PdfEditor();
 
     @Bean
     public PropertySource<?> dynamicYamlPropertySource(ConfigurableEnvironment environment)
@@ -101,46 +100,6 @@ public class ApplicationProperties {
         private String outputFolder;
     }
 
-    @Data
-    public static class PdfEditor {
-        private Cache cache = new Cache();
-        private FontNormalization fontNormalization = new FontNormalization();
-        private CffConverter cffConverter = new CffConverter();
-        private Type3 type3 = new Type3();
-        private String fallbackFont = "classpath:/static/fonts/NotoSans-Regular.ttf";
-
-        @Data
-        public static class Cache {
-            private long maxBytes = -1;
-            private int maxPercent = 20;
-        }
-
-        @Data
-        public static class FontNormalization {
-            private boolean enabled = false;
-        }
-
-        @Data
-        public static class CffConverter {
-            private boolean enabled = true;
-            private String method = "python";
-            private String pythonCommand = "/opt/venv/bin/python3";
-            private String pythonScript = "/scripts/convert_cff_to_ttf.py";
-            private String fontforgeCommand = "fontforge";
-        }
-
-        @Data
-        public static class Type3 {
-            private Library library = new Library();
-
-            @Data
-            public static class Library {
-                private boolean enabled = true;
-                private String index = "classpath:/type3/library/index.json";
-            }
-        }
-    }
-
     @Data
     public static class Legal {
         private String termsAndConditions;
@@ -409,12 +368,10 @@ public class ApplicationProperties {
         private TempFileManagement tempFileManagement = new TempFileManagement();
         private DatabaseBackup databaseBackup = new DatabaseBackup();
         private List<String> corsAllowedOrigins = new ArrayList<>();
-        private String backendUrl; // Backend base URL for SAML/OAuth/API callbacks (e.g.
-        // 'http://localhost:8080', 'https://api.example.com'). Required for
-        // SSO.
-        private String frontendUrl; // Frontend URL for invite email links (e.g.
+        private String
+                frontendUrl; // Base URL for frontend (used for invite links, etc.). If not set,
 
-        // 'https://app.example.com'). If not set, falls back to backendUrl.
+        // falls back to backend URL.
 
         public boolean isAnalyticsEnabled() {
             return this.getEnableAnalytics() != null && this.getEnableAnalytics();
@@ -579,7 +536,6 @@ public class ApplicationProperties {
         @ToString.Exclude private String key;
         private String UUID;
         private String appVersion;
-        private Boolean isNewServer;
     }
 
     // TODO: Remove post migration

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -94,7 +94,6 @@ public class InitialSetup {
         }
         GeneralUtils.saveKeyToSettings("AutomaticallyGenerated.appVersion", appVersion);
         applicationProperties.getAutomaticallyGenerated().setAppVersion(appVersion);
-        applicationProperties.getAutomaticallyGenerated().setIsNewServer(isNewServer);
     }
 
     public static boolean isNewServer() {

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -33,35 +33,14 @@ public class WebMvcConfig implements WebMvcConfigurer {
     public void addResourceHandlers(ResourceHandlerRegistry registry) {
         // Cache hashed assets (JS/CSS with content hashes) for 1 year
         // These files have names like index-ChAS4tCC.js that change when content changes
-        // Check customFiles/static first, then fall back to classpath
         registry.addResourceHandler("/assets/**")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath()
-                                + "assets/",
-                        "classpath:/static/assets/")
+                .addResourceLocations("classpath:/static/assets/")
                 .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
 
         // Don't cache index.html - it needs to be fresh to reference latest hashed assets
-        // Note: index.html is handled by ReactRoutingController for dynamic processing
         registry.addResourceHandler("/index.html")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath(),
-                        "classpath:/static/")
+                .addResourceLocations("classpath:/static/")
                 .setCacheControl(CacheControl.noCache().mustRevalidate());
-
-        // Handle all other static resources (js, css, images, fonts, etc.)
-        // Check customFiles/static first for user overrides
-        registry.addResourceHandler("/**")
-                .addResourceLocations(
-                        "file:"
-                                + stirling.software.common.configuration.InstallationPathConfig
-                                        .getStaticPath(),
-                        "classpath:/static/")
-                .setCacheControl(CacheControl.maxAge(1, TimeUnit.HOURS));
     }
 
     @Override

app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonExceptionHandler.java

@@ -1,60 +0,0 @@
-package stirling.software.SPDF.controller.api.converters;
-
-import java.nio.charset.StandardCharsets;
-
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.ControllerAdvice;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.SPDF.exception.CacheUnavailableException;
-
-@ControllerAdvice(assignableTypes = ConvertPdfJsonController.class)
-@Slf4j
-@RequiredArgsConstructor
-public class ConvertPdfJsonExceptionHandler {
-
-    private final ObjectMapper objectMapper;
-
-    @ExceptionHandler(CacheUnavailableException.class)
-    @ResponseBody
-    public ResponseEntity<byte[]> handleCacheUnavailable(CacheUnavailableException ex) {
-        try {
-            byte[] body =
-                    objectMapper.writeValueAsBytes(
-                            java.util.Map.of(
-                                    "error", "cache_unavailable",
-                                    "action", "reupload",
-                                    "message", ex.getMessage()));
-            return ResponseEntity.status(HttpStatus.GONE)
-                    .contentType(MediaType.APPLICATION_JSON)
-                    .body(body);
-        } catch (Exception e) {
-            log.warn("Failed to serialize cache_unavailable response", e);
-            var fallbackBody =
-                    java.util.Map.of(
-                            "error", "cache_unavailable",
-                            "action", "reupload",
-                            "message", String.valueOf(ex.getMessage()));
-            try {
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(objectMapper.writeValueAsBytes(fallbackBody));
-            } catch (Exception ignored) {
-                // Truly last-ditch fallback
-                return ResponseEntity.status(HttpStatus.GONE)
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .body(
-                                "{\"error\":\"cache_unavailable\",\"action\":\"reupload\",\"message\":\"Cache unavailable\"}"
-                                        .getBytes(StandardCharsets.UTF_8));
-            }
-        }
-    }
-}

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -3,14 +3,9 @@ package stirling.software.SPDF.controller.web;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
 
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.FileSystemResource;
-import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
@@ -19,11 +14,6 @@ import org.springframework.web.bind.annotation.GetMapping;
 import jakarta.annotation.PostConstruct;
 import jakarta.servlet.http.HttpServletRequest;
 
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.configuration.InstallationPathConfig;
-
-@Slf4j
 @Controller
 public class ReactRoutingController {
 
@@ -32,44 +22,24 @@ public class ReactRoutingController {
 
     private String cachedIndexHtml;
     private boolean indexHtmlExists = false;
-    private boolean useExternalIndexHtml = false;
 
     @PostConstruct
     public void init() {
-        log.info("Static files custom path: {}", InstallationPathConfig.getStaticPath());
-
-        // Check for external index.html first (customFiles/static/)
-        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
-        log.debug("Checking for custom index.html at: {}", externalIndexPath);
-        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
-            log.info("Using custom index.html from: {}", externalIndexPath);
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-                this.useExternalIndexHtml = true;
-                return;
-            } catch (IOException e) {
-                log.warn("Failed to load custom index.html, falling back to classpath", e);
-            }
-        }
-
-        // Fall back to classpath index.html
+        // Only cache if index.html exists (production builds)
         ClassPathResource resource = new ClassPathResource("static/index.html");
         if (resource.exists()) {
             try {
                 this.cachedIndexHtml = processIndexHtml();
                 this.indexHtmlExists = true;
-                this.useExternalIndexHtml = false;
             } catch (IOException e) {
                 // Failed to cache, will process on each request
-                log.warn("Failed to cache index.html", e);
                 this.indexHtmlExists = false;
             }
         }
     }
 
     private String processIndexHtml() throws IOException {
-        Resource resource = getIndexHtmlResource();
+        ClassPathResource resource = new ClassPathResource("static/index.html");
 
         try (InputStream inputStream = resource.getInputStream()) {
             String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
@@ -92,17 +62,6 @@ public class ReactRoutingController {
         }
     }
 
-    private Resource getIndexHtmlResource() throws IOException {
-        // Check external location first
-        Path externalIndexPath = Paths.get(InstallationPathConfig.getStaticPath(), "index.html");
-        if (Files.exists(externalIndexPath) && Files.isReadable(externalIndexPath)) {
-            return new FileSystemResource(externalIndexPath.toFile());
-        }
-
-        // Fall back to classpath
-        return new ClassPathResource("static/index.html");
-    }
-
     @GetMapping(
             value = {"/", "/index.html"},
             produces = MediaType.TEXT_HTML_VALUE)

app/core/src/main/java/stirling/software/SPDF/exception/CacheUnavailableException.java

@@ -1,8 +0,0 @@
-package stirling.software.SPDF.exception;
-
-public class CacheUnavailableException extends RuntimeException {
-
-    public CacheUnavailableException(String message) {
-        super(message);
-    }
-}

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonConversionService.java

@@ -86,6 +86,7 @@ import org.apache.pdfbox.text.PDFTextStripper;
 import org.apache.pdfbox.text.TextPosition;
 import org.apache.pdfbox.util.DateConverter;
 import org.apache.pdfbox.util.Matrix;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.web.multipart.MultipartFile;
 
@@ -143,23 +144,15 @@ public class PdfJsonConversionService {
     private final PdfJsonFontService fontService;
     private final Type3FontConversionService type3FontConversionService;
     private final Type3GlyphExtractor type3GlyphExtractor;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
     private final Map<String, PDFont> type3NormalizedFontCache = new ConcurrentHashMap<>();
     private final Map<String, Set<Integer>> type3GlyphCoverageCache = new ConcurrentHashMap<>();
 
+    @Value("${stirling.pdf.json.font-normalization.enabled:true}")
     private boolean fontNormalizationEnabled;
-    private long cacheMaxBytes;
-    private int cacheMaxPercent;
 
     /** Cache for storing PDDocuments for lazy page loading. Key is jobId. */
     private final Map<String, CachedPdfDocument> documentCache = new ConcurrentHashMap<>();
 
-    private final java.util.LinkedHashMap<String, CachedPdfDocument> lruCache =
-            new java.util.LinkedHashMap<>(16, 0.75f, true);
-    private final Object cacheLock = new Object();
-    private volatile long currentCacheBytes = 0L;
-    private volatile long cacheBudgetBytes = -1L;
-
     private volatile boolean ghostscriptAvailable;
 
     private static final float FLOAT_EPSILON = 0.0001f;
@@ -168,23 +161,7 @@ public class PdfJsonConversionService {
 
     @PostConstruct
     private void initializeToolAvailability() {
-        loadConfigurationFromProperties();
         initializeGhostscriptAvailability();
-        initializeCacheBudget();
-    }
-
-    private void loadConfigurationFromProperties() {
-        stirling.software.common.model.ApplicationProperties.PdfEditor cfg =
-                applicationProperties.getPdfEditor();
-        if (cfg != null) {
-            fontNormalizationEnabled = cfg.getFontNormalization().isEnabled();
-            cacheMaxBytes = cfg.getCache().getMaxBytes();
-            cacheMaxPercent = cfg.getCache().getMaxPercent();
-        } else {
-            fontNormalizationEnabled = false;
-            cacheMaxBytes = -1;
-            cacheMaxPercent = 20;
-        }
     }
 
     private void initializeGhostscriptAvailability() {
@@ -225,25 +202,6 @@ public class PdfJsonConversionService {
         }
     }
 
-    private void initializeCacheBudget() {
-        long effective = -1L;
-        if (cacheMaxBytes > 0) {
-            effective = cacheMaxBytes;
-        } else if (cacheMaxPercent > 0) {
-            long maxMem = Runtime.getRuntime().maxMemory();
-            effective = Math.max(0L, (maxMem * cacheMaxPercent) / 100);
-        }
-        cacheBudgetBytes = effective;
-        if (cacheBudgetBytes > 0) {
-            log.info(
-                    "PDF JSON cache budget configured: {} bytes (source: {})",
-                    cacheBudgetBytes,
-                    cacheMaxBytes > 0 ? "max-bytes" : "max-percent");
-        } else {
-            log.info("PDF JSON cache budget: unlimited");
-        }
-    }
-
     public byte[] convertPdfToJson(MultipartFile file) throws IOException {
         return convertPdfToJson(file, null, false);
     }
@@ -278,10 +236,7 @@ public class PdfJsonConversionService {
             log.debug("Generated synthetic jobId for synchronous conversion: {}", jobId);
         } else {
             jobId = contextJobId;
-            log.info(
-                    "Starting PDF to JSON conversion, jobId from context: {} (lightweight={})",
-                    jobId,
-                    lightweight);
+            log.debug("Starting PDF to JSON conversion, jobId from context: {}", jobId);
         }
 
         Consumer<PdfJsonConversionProgress> progress =
@@ -363,9 +318,9 @@ public class PdfJsonConversionService {
 
             try (PDDocument document = pdfDocumentFactory.load(workingPath, true)) {
                 int totalPages = document.getNumberOfPages();
-                // Always enable lazy mode for real async jobs so cache is available regardless of
-                // page count. Synchronous calls with synthetic jobId still do full extraction.
-                boolean useLazyImages = isRealJobId;
+                // Only use lazy images for real async jobs where client can access the cache
+                // Synchronous calls with synthetic jobId should do full extraction
+                boolean useLazyImages = totalPages > 5 && isRealJobId;
                 Map<COSBase, FontModelCacheEntry> fontCache = new IdentityHashMap<>();
                 Map<COSBase, EncodedImage> imageCache = new IdentityHashMap<>();
                 log.debug(
@@ -448,11 +403,6 @@ public class PdfJsonConversionService {
 
                 // Only cache for real async jobIds, not synthetic synchronous ones
                 if (useLazyImages && isRealJobId) {
-                    log.info(
-                            "Creating cache for jobId: {} (useLazyImages={}, isRealJobId={})",
-                            jobId,
-                            useLazyImages,
-                            isRealJobId);
                     PdfJsonDocumentMetadata docMetadata = new PdfJsonDocumentMetadata();
                     docMetadata.setMetadata(pdfJson.getMetadata());
                     docMetadata.setXmpMetadata(pdfJson.getXmpMetadata());
@@ -485,23 +435,16 @@ public class PdfJsonConversionService {
                         cachedPdfBytes = Files.readAllBytes(workingPath);
                     }
                     CachedPdfDocument cached =
-                            buildCachedDocument(
-                                    jobId, cachedPdfBytes, docMetadata, fonts, pageFontResources);
-                    putCachedDocument(jobId, cached);
-                    log.info(
-                            "Successfully cached PDF ({} bytes, {} pages, {} fonts) for jobId: {} (diskBacked={})",
-                            cached.getPdfSize(),
+                            new CachedPdfDocument(
+                                    cachedPdfBytes, docMetadata, fonts, pageFontResources);
+                    documentCache.put(jobId, cached);
+                    log.debug(
+                            "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy images, jobId: {}",
+                            cachedPdfBytes.length,
                             totalPages,
                             fonts.size(),
-                            jobId,
-                            cached.isDiskBacked());
-                    scheduleDocumentCleanup(jobId);
-                } else {
-                    log.warn(
-                            "Skipping cache creation: useLazyImages={}, isRealJobId={}, jobId={}",
-                            useLazyImages,
-                            isRealJobId,
                             jobId);
+                    scheduleDocumentCleanup(jobId);
                 }
 
                 if (lightweight) {
@@ -3030,139 +2973,6 @@ public class PdfJsonConversionService {
         }
     }
 
-    // Cache helpers
-    private CachedPdfDocument buildCachedDocument(
-            String jobId,
-            byte[] pdfBytes,
-            PdfJsonDocumentMetadata metadata,
-            Map<String, PdfJsonFont> fonts,
-            Map<Integer, Map<PDFont, String>> pageFontResources)
-            throws IOException {
-        if (pdfBytes == null) {
-            throw new IllegalArgumentException("pdfBytes must not be null");
-        }
-        long budget = cacheBudgetBytes;
-        // If single document is larger than budget, spill straight to disk
-        if (budget > 0 && pdfBytes.length > budget) {
-            TempFile tempFile = new TempFile(tempFileManager, ".pdfjsoncache");
-            Files.write(tempFile.getPath(), pdfBytes);
-            log.debug(
-                    "Cached PDF spilled to disk ({} bytes exceeds budget {}) for jobId {}",
-                    pdfBytes.length,
-                    budget,
-                    jobId);
-            return new CachedPdfDocument(
-                    null, tempFile, pdfBytes.length, metadata, fonts, pageFontResources);
-        }
-        return new CachedPdfDocument(
-                pdfBytes, null, pdfBytes.length, metadata, fonts, pageFontResources);
-    }
-
-    private void putCachedDocument(String jobId, CachedPdfDocument cached) {
-        synchronized (cacheLock) {
-            CachedPdfDocument existing = documentCache.put(jobId, cached);
-            if (existing != null) {
-                lruCache.remove(jobId);
-                currentCacheBytes = Math.max(0L, currentCacheBytes - existing.getInMemorySize());
-                existing.close();
-            }
-            lruCache.put(jobId, cached);
-            currentCacheBytes += cached.getInMemorySize();
-            enforceCacheBudget();
-        }
-    }
-
-    private CachedPdfDocument getCachedDocument(String jobId) {
-        synchronized (cacheLock) {
-            CachedPdfDocument cached = documentCache.get(jobId);
-            if (cached != null) {
-                lruCache.remove(jobId);
-                lruCache.put(jobId, cached);
-            }
-            return cached;
-        }
-    }
-
-    private void enforceCacheBudget() {
-        if (cacheBudgetBytes <= 0) {
-            return;
-        }
-        // Must be called under cacheLock
-        java.util.Iterator<java.util.Map.Entry<String, CachedPdfDocument>> it =
-                lruCache.entrySet().iterator();
-        while (currentCacheBytes > cacheBudgetBytes && it.hasNext()) {
-            java.util.Map.Entry<String, CachedPdfDocument> entry = it.next();
-            it.remove();
-            CachedPdfDocument removed = entry.getValue();
-            documentCache.remove(entry.getKey(), removed);
-            currentCacheBytes = Math.max(0L, currentCacheBytes - removed.getInMemorySize());
-            removed.close();
-            log.warn(
-                    "Evicted cached PDF for jobId {} to enforce cache budget (budget={} bytes, current={} bytes)",
-                    entry.getKey(),
-                    cacheBudgetBytes,
-                    currentCacheBytes);
-        }
-        if (currentCacheBytes > cacheBudgetBytes && !lruCache.isEmpty()) {
-            // Spill the most recently used large entry to disk
-            String key =
-                    lruCache.entrySet().stream()
-                            .reduce((first, second) -> second)
-                            .map(java.util.Map.Entry::getKey)
-                            .orElse(null);
-            if (key != null) {
-                CachedPdfDocument doc = lruCache.get(key);
-                if (doc != null && doc.getInMemorySize() > 0) {
-                    try {
-                        CachedPdfDocument diskDoc =
-                                buildCachedDocument(
-                                        key,
-                                        doc.getPdfBytes(),
-                                        doc.getMetadata(),
-                                        doc.getFonts(),
-                                        doc.getPageFontResources());
-                        lruCache.put(key, diskDoc);
-                        documentCache.put(key, diskDoc);
-                        currentCacheBytes =
-                                Math.max(0L, currentCacheBytes - doc.getInMemorySize())
-                                        + diskDoc.getInMemorySize();
-                        doc.close();
-                        log.debug("Spilled cached PDF for jobId {} to disk to satisfy budget", key);
-                    } catch (IOException ex) {
-                        log.warn(
-                                "Failed to spill cached PDF for jobId {} to disk: {}",
-                                key,
-                                ex.getMessage());
-                    }
-                }
-            }
-        }
-    }
-
-    private void removeCachedDocument(String jobId) {
-        log.warn(
-                "removeCachedDocument called for jobId: {} [CALLER: {}]",
-                jobId,
-                Thread.currentThread().getStackTrace()[2].toString());
-        CachedPdfDocument removed = null;
-        synchronized (cacheLock) {
-            removed = documentCache.remove(jobId);
-            if (removed != null) {
-                lruCache.remove(jobId);
-                currentCacheBytes = Math.max(0L, currentCacheBytes - removed.getInMemorySize());
-                log.warn(
-                        "Removed cached document for jobId: {} (size={} bytes)",
-                        jobId,
-                        removed.getInMemorySize());
-            } else {
-                log.warn("Attempted to remove jobId: {} but it was not in cache", jobId);
-            }
-        }
-        if (removed != null) {
-            removed.close();
-        }
-    }
-
     private void applyTextState(PDPageContentStream contentStream, PdfJsonTextElement element)
             throws IOException {
         if (element.getCharacterSpacing() != null) {
@@ -5501,8 +5311,6 @@ public class PdfJsonConversionService {
      */
     private static class CachedPdfDocument {
         private final byte[] pdfBytes;
-        private final TempFile pdfTempFile;
-        private final long pdfSize;
         private final PdfJsonDocumentMetadata metadata;
         private final Map<String, PdfJsonFont> fonts; // Font map with UIDs for consistency
         private final Map<Integer, Map<PDFont, String>> pageFontResources; // Page font resources
@@ -5510,14 +5318,10 @@ public class PdfJsonConversionService {
 
         public CachedPdfDocument(
                 byte[] pdfBytes,
-                TempFile pdfTempFile,
-                long pdfSize,
                 PdfJsonDocumentMetadata metadata,
                 Map<String, PdfJsonFont> fonts,
                 Map<Integer, Map<PDFont, String>> pageFontResources) {
             this.pdfBytes = pdfBytes;
-            this.pdfTempFile = pdfTempFile;
-            this.pdfSize = pdfSize;
             this.metadata = metadata;
             // Create defensive copies to prevent mutation of shared maps
             this.fonts =
@@ -5532,14 +5336,8 @@ public class PdfJsonConversionService {
         }
 
         // Getters return defensive copies to prevent external mutation
-        public byte[] getPdfBytes() throws IOException {
-            if (pdfBytes != null) {
-                return pdfBytes;
-            }
-            if (pdfTempFile != null) {
-                return Files.readAllBytes(pdfTempFile.getPath());
-            }
-            throw new IOException("Cached PDF backing missing");
+        public byte[] getPdfBytes() {
+            return pdfBytes;
         }
 
         public PdfJsonDocumentMetadata getMetadata() {
@@ -5554,18 +5352,6 @@ public class PdfJsonConversionService {
             return new java.util.concurrent.ConcurrentHashMap<>(pageFontResources);
         }
 
-        public long getPdfSize() {
-            return pdfSize;
-        }
-
-        public long getInMemorySize() {
-            return pdfBytes != null ? pdfBytes.length : 0L;
-        }
-
-        public boolean isDiskBacked() {
-            return pdfBytes == null && pdfTempFile != null;
-        }
-
         public long getTimestamp() {
             return timestamp;
         }
@@ -5577,19 +5363,7 @@ public class PdfJsonConversionService {
         public CachedPdfDocument withUpdatedFonts(
                 byte[] nextBytes, Map<String, PdfJsonFont> nextFonts) {
             Map<String, PdfJsonFont> fontsToUse = nextFonts != null ? nextFonts : this.fonts;
-            return new CachedPdfDocument(
-                    nextBytes,
-                    null,
-                    nextBytes != null ? nextBytes.length : 0,
-                    metadata,
-                    fontsToUse,
-                    pageFontResources);
-        }
-
-        public void close() {
-            if (pdfTempFile != null) {
-                pdfTempFile.close();
-            }
+            return new CachedPdfDocument(nextBytes, metadata, fontsToUse, pageFontResources);
         }
     }
 
@@ -5670,15 +5444,14 @@ public class PdfJsonConversionService {
             // Cache PDF bytes, metadata, and fonts for lazy page loading
             if (jobId != null) {
                 CachedPdfDocument cached =
-                        buildCachedDocument(jobId, pdfBytes, docMetadata, fonts, pageFontResources);
-                putCachedDocument(jobId, cached);
+                        new CachedPdfDocument(pdfBytes, docMetadata, fonts, pageFontResources);
+                documentCache.put(jobId, cached);
                 log.debug(
-                        "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy loading, jobId: {} (diskBacked={})",
-                        cached.getPdfSize(),
+                        "Cached PDF bytes ({} bytes, {} pages, {} fonts) for lazy loading, jobId: {}",
+                        pdfBytes.length,
                         totalPages,
                         fonts.size(),
-                        jobId,
-                        cached.isDiskBacked());
+                        jobId);
 
                 // Schedule cleanup after 30 minutes
                 scheduleDocumentCleanup(jobId);
@@ -5693,10 +5466,9 @@ public class PdfJsonConversionService {
 
     /** Extracts a single page from cached PDF bytes. Re-loads the PDF for each request. */
     public byte[] extractSinglePage(String jobId, int pageNumber) throws IOException {
-        CachedPdfDocument cached = getCachedDocument(jobId);
+        CachedPdfDocument cached = documentCache.get(jobId);
         if (cached == null) {
-            throw new stirling.software.SPDF.exception.CacheUnavailableException(
-                    "No cached document found for jobId: " + jobId);
+            throw new IllegalArgumentException("No cached document found for jobId: " + jobId);
         }
 
         int pageIndex = pageNumber - 1;
@@ -5708,8 +5480,8 @@ public class PdfJsonConversionService {
         }
 
         log.debug(
-                "Loading PDF from {} to extract page {} (jobId: {})",
-                cached.isDiskBacked() ? "disk cache" : "memory cache",
+                "Loading PDF from bytes ({} bytes) to extract page {} (jobId: {})",
+                cached.getPdfBytes().length,
                 pageNumber,
                 jobId);
 
@@ -5855,21 +5627,10 @@ public class PdfJsonConversionService {
         if (jobId == null || jobId.isBlank()) {
             throw new IllegalArgumentException("jobId is required for incremental export");
         }
-        log.info("Looking up cache for jobId: {}", jobId);
-        CachedPdfDocument cached = getCachedDocument(jobId);
+        CachedPdfDocument cached = documentCache.get(jobId);
         if (cached == null) {
-            log.error(
-                    "Cache not found for jobId: {}. Available cache keys: {}",
-                    jobId,
-                    documentCache.keySet());
-            throw new stirling.software.SPDF.exception.CacheUnavailableException(
-                    "No cached document available for jobId: " + jobId);
+            throw new IllegalArgumentException("No cached document available for jobId: " + jobId);
         }
-        log.info(
-                "Found cached document for jobId: {} (size={}, diskBacked={})",
-                jobId,
-                cached.getPdfSize(),
-                cached.isDiskBacked());
         if (updates == null || updates.getPages() == null || updates.getPages().isEmpty()) {
             log.debug(
                     "Incremental export requested with no page updates; returning cached PDF for jobId {}",
@@ -5948,14 +5709,7 @@ public class PdfJsonConversionService {
             document.save(baos);
             byte[] updatedBytes = baos.toByteArray();
 
-            CachedPdfDocument updated =
-                    buildCachedDocument(
-                            jobId,
-                            updatedBytes,
-                            cached.getMetadata(),
-                            mergedFonts,
-                            cached.getPageFontResources());
-            putCachedDocument(jobId, updated);
+            documentCache.put(jobId, cached.withUpdatedFonts(updatedBytes, mergedFonts));
 
             // Clear Type3 cache entries for this incremental update
             clearType3CacheEntriesForJob(updateJobId);
@@ -5970,13 +5724,11 @@ public class PdfJsonConversionService {
 
     /** Clears a cached document. */
     public void clearCachedDocument(String jobId) {
-        CachedPdfDocument cached = getCachedDocument(jobId);
-        removeCachedDocument(jobId);
+        CachedPdfDocument cached = documentCache.remove(jobId);
         if (cached != null) {
             log.debug(
-                    "Removed cached PDF ({} bytes, diskBacked={}) for jobId: {}",
-                    cached.getPdfSize(),
-                    cached.isDiskBacked(),
+                    "Removed cached PDF bytes ({} bytes) for jobId: {}",
+                    cached.getPdfBytes().length,
                     jobId);
         }
 

app/core/src/main/java/stirling/software/SPDF/service/PdfJsonFallbackFontService.java

@@ -312,29 +312,12 @@ public class PdfJsonFallbackFontService {
                                     "ttf")));
 
     private final ResourceLoader resourceLoader;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
     @Value("${stirling.pdf.fallback-font:" + DEFAULT_FALLBACK_FONT_LOCATION + "}")
-    private String legacyFallbackFontLocation;
-
     private String fallbackFontLocation;
 
     private final Map<String, byte[]> fallbackFontCache = new ConcurrentHashMap<>();
 
-    @jakarta.annotation.PostConstruct
-    private void loadConfig() {
-        String configured = null;
-        if (applicationProperties.getPdfEditor() != null) {
-            configured = applicationProperties.getPdfEditor().getFallbackFont();
-        }
-        if (configured != null && !configured.isBlank()) {
-            fallbackFontLocation = configured;
-        } else {
-            fallbackFontLocation = legacyFallbackFontLocation;
-        }
-        log.info("Using fallback font location: {}", fallbackFontLocation);
-    }
-
     public PdfJsonFont buildFallbackFontModel() throws IOException {
         return buildFallbackFontModel(FALLBACK_FONT_ID);
     }

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/PdfJsonFontService.java

@@ -5,6 +5,7 @@ import java.nio.file.Files;
 import java.util.Base64;
 import java.util.Locale;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PostConstruct;
@@ -24,16 +25,22 @@ import stirling.software.common.util.TempFileManager;
 public class PdfJsonFontService {
 
     private final TempFileManager tempFileManager;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
-    @Getter private boolean cffConversionEnabled;
+    @Getter
+    @Value("${stirling.pdf.json.cff-converter.enabled:true}")
+    private boolean cffConversionEnabled;
 
-    @Getter private String cffConverterMethod;
+    @Getter
+    @Value("${stirling.pdf.json.cff-converter.method:python}")
+    private String cffConverterMethod;
 
+    @Value("${stirling.pdf.json.cff-converter.python-command:/opt/venv/bin/python3}")
     private String pythonCommand;
 
+    @Value("${stirling.pdf.json.cff-converter.python-script:/scripts/convert_cff_to_ttf.py}")
     private String pythonScript;
 
+    @Value("${stirling.pdf.json.cff-converter.fontforge-command:fontforge}")
     private String fontforgeCommand;
 
     private volatile boolean pythonCffConverterAvailable;
@@ -41,7 +48,6 @@ public class PdfJsonFontService {
 
     @PostConstruct
     private void initialiseCffConverterAvailability() {
-        loadConfiguration();
         if (!cffConversionEnabled) {
             log.warn("[FONT-DEBUG] CFF conversion is DISABLED in configuration");
             pythonCffConverterAvailable = false;
@@ -71,22 +77,6 @@ public class PdfJsonFontService {
         log.info("[FONT-DEBUG] Selected CFF converter method: {}", cffConverterMethod);
     }
 
-    private void loadConfiguration() {
-        if (applicationProperties.getPdfEditor() != null
-                && applicationProperties.getPdfEditor().getCffConverter() != null) {
-            var cfg = applicationProperties.getPdfEditor().getCffConverter();
-            this.cffConversionEnabled = cfg.isEnabled();
-            this.cffConverterMethod = cfg.getMethod();
-            this.pythonCommand = cfg.getPythonCommand();
-            this.pythonScript = cfg.getPythonScript();
-            this.fontforgeCommand = cfg.getFontforgeCommand();
-        } else {
-            // Use defaults when config is not available
-            this.cffConversionEnabled = false;
-            log.warn("[FONT-DEBUG] PdfEditor configuration not available, CFF conversion disabled");
-        }
-    }
-
     public byte[] convertCffProgramToTrueType(byte[] fontBytes, String toUnicode) {
         if (!cffConversionEnabled || fontBytes == null || fontBytes.length == 0) {
             log.warn(

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/type3/Type3LibraryStrategy.java

@@ -2,6 +2,7 @@ package stirling.software.SPDF.service.pdfjson.type3;
 
 import java.io.IOException;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 
@@ -22,8 +23,8 @@ import stirling.software.SPDF.service.pdfjson.type3.library.Type3FontLibraryPayl
 public class Type3LibraryStrategy implements Type3ConversionStrategy {
 
     private final Type3FontLibrary fontLibrary;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
+    @Value("${stirling.pdf.json.type3.library.enabled:true}")
     private boolean enabled;
 
     @Override
@@ -41,19 +42,6 @@ public class Type3LibraryStrategy implements Type3ConversionStrategy {
         return enabled && fontLibrary != null && fontLibrary.isLoaded();
     }
 
-    @jakarta.annotation.PostConstruct
-    private void loadConfiguration() {
-        if (applicationProperties.getPdfEditor() != null
-                && applicationProperties.getPdfEditor().getType3() != null
-                && applicationProperties.getPdfEditor().getType3().getLibrary() != null) {
-            var cfg = applicationProperties.getPdfEditor().getType3().getLibrary();
-            this.enabled = cfg.isEnabled();
-        } else {
-            this.enabled = false;
-            log.warn("PdfEditor Type3 library configuration not available, disabled");
-        }
-    }
-
     @Override
     public PdfJsonFontConversionCandidate convert(
             Type3ConversionRequest request, Type3GlyphContext context) throws IOException {

app/core/src/main/java/stirling/software/SPDF/service/pdfjson/type3/library/Type3FontLibrary.java

@@ -14,6 +14,7 @@ import java.util.stream.Collectors;
 
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.font.PDType3Font;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.Resource;
 import org.springframework.core.io.ResourceLoader;
 import org.springframework.stereotype.Component;
@@ -33,8 +34,8 @@ public class Type3FontLibrary {
 
     private final ObjectMapper objectMapper;
     private final ResourceLoader resourceLoader;
-    private final stirling.software.common.model.ApplicationProperties applicationProperties;
 
+    @Value("${stirling.pdf.json.type3.library.index:classpath:/type3/library/index.json}")
     private String indexLocation;
 
     private final Map<String, Type3FontLibraryEntry> signatureIndex = new ConcurrentHashMap<>();
@@ -43,17 +44,6 @@ public class Type3FontLibrary {
 
     @jakarta.annotation.PostConstruct
     void initialise() {
-        if (applicationProperties.getPdfEditor() != null
-                && applicationProperties.getPdfEditor().getType3() != null
-                && applicationProperties.getPdfEditor().getType3().getLibrary() != null) {
-            this.indexLocation =
-                    applicationProperties.getPdfEditor().getType3().getLibrary().getIndex();
-        } else {
-            log.warn(
-                    "[TYPE3] PdfEditor Type3 library configuration not available; Type3 library disabled");
-            entries = List.of();
-            return;
-        }
         Resource resource = resourceLoader.getResource(indexLocation);
         if (!resource.exists()) {
             log.info("[TYPE3] Library index {} not found; Type3 library disabled", indexLocation);

app/core/src/main/resources/settings.yml.template

@@ -58,8 +58,6 @@ security:
     idpCert: classpath:okta.cert # The certificate your Provider will use to authenticate your app's SAML authentication requests. Provided by your Provider
     privateKey: classpath:saml-private-key.key # Your private key. Generated from your keypair
     spCert: classpath:saml-public-cert.crt # Your signing certificate. Generated from your keypair
-    # IMPORTANT: For SAML setup, download your SP metadata from the BACKEND URL: http://localhost:8080/saml2/service-provider-metadata/{registrationId}
-    # Do NOT use the frontend dev server URL (localhost:5173) as it will generate incorrect ACS URLs. Always use the backend URL (localhost:8080) for SAML configuration.
   jwt: # This feature is currently under development and not yet fully supported. Do not use in production.
     persistence: true # Set to 'true' to enable JWT key store
     enableKeyRotation: true # Set to 'true' to enable key pair rotation
@@ -134,9 +132,8 @@ system:
   enableUrlToPDF: false # Set to 'true' to enable URL to PDF, INTERNAL ONLY, known security issues, should not be used externally
   disableSanitize: false # set to true to disable Sanitize HTML; (can lead to injections in HTML)
   maxDPI: 500 # Maximum allowed DPI for PDF to image conversion
-  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS. For local development with frontend on port 5173, add 'http://localhost:5173'
-  backendUrl: '' # Backend base URL for SAML/OAuth/API callbacks (e.g. 'http://localhost:8080' for dev, 'https://api.example.com' for production). REQUIRED for SSO authentication to work correctly. This is where your IdP will send SAML responses and OAuth callbacks. Leave empty to default to 'http://localhost:8080' in development.
-  frontendUrl: '' # Frontend URL for invite email links (e.g. 'https://app.example.com'). Optional - if not set, will use backendUrl. This is the URL users click in invite emails.
+  corsAllowedOrigins: [] # List of allowed origins for CORS (e.g. ['http://localhost:5173', 'https://app.example.com']). Leave empty to disable CORS.
+  frontendUrl: '' # Base URL for frontend (e.g. 'https://pdf.example.com'). Used for generating invite links in emails. If empty, falls back to backend URL.
   serverCertificate:
     enabled: true # Enable server-side certificate for "Sign with Stirling-PDF" option
     organizationName: Stirling-PDF # Organization name for generated certificates
@@ -182,6 +179,23 @@ system:
   databaseBackup:
     cron: '0 0 0 * * ?' # Cron expression for automatic database backups "0 0 0 * * ?" daily at midnight
 
+stirling:
+  pdf:
+    fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
+    json:
+      font-normalization:
+        enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
+      cff-converter:
+        enabled: true # Wrap CFF/Type1C fonts as OpenType-CFF for browser compatibility
+        method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
+        python-command: /opt/venv/bin/python3 # Python interpreter path
+        python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
+        fontforge-command: fontforge # Override if FontForge is installed under a different name/path
+      type3:
+        library:
+          enabled: true # Match common Type3 fonts against the built-in library of converted programs
+          index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)
+
 ui:
   appNameNavbar: '' # name displayed on the navigation bar
   logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
@@ -225,21 +239,3 @@ processExecutor:
     qpdfTimeoutMinutes: 30
     ghostscriptTimeoutMinutes: 30
     ocrMyPdfTimeoutMinutes: 30
-
-pdfEditor:
-  fallback-font: classpath:/static/fonts/NotoSans-Regular.ttf # Override to point at a custom fallback font
-  cache:
-    max-bytes: -1 # Max in-memory cache size in bytes; -1 disables byte cap
-    max-percent: 20 # Max in-memory cache as % of JVM max; used when max-bytes <= 0
-  font-normalization:
-    enabled: false # IMPORTANT: Disable to preserve ToUnicode CMaps for correct font rendering. Ghostscript strips Unicode mappings from CID fonts.
-  cff-converter:
-    enabled: true # Wrap CFF/Type1CFF fonts as OpenType-CFF for browser compatibility
-    method: python # Converter method: 'python' (fontTools, recommended - wraps as OTF), 'fontforge' (legacy - converts to TTF, may hang on CID fonts)
-    python-command: /opt/venv/bin/python3 # Python interpreter path
-    python-script: /scripts/convert_cff_to_ttf.py # Path to font wrapping script
-    fontforge-command: fontforge # Override if FontForge is installed under a different name/path
-  type3:
-    library:
-      enabled: true # Match common Type3 fonts against the built-in library of converted programs
-      index: classpath:/type3/library/index.json # Override to point at a custom index.json (supports http:, file:, classpath:)

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java

@@ -94,22 +94,6 @@ public class ProprietaryUIDataController {
         this.auditRepository = auditRepository;
     }
 
-    /**
-     * Get the backend base URL for SAML/OAuth redirects. Uses system.backendUrl from config if set,
-     * otherwise defaults to http://localhost:8080
-     */
-    private String getBackendBaseUrl() {
-        String backendUrl = applicationProperties.getSystem().getBackendUrl();
-
-        // If backendUrl is configured, use it
-        if (backendUrl != null && !backendUrl.trim().isEmpty()) {
-            return backendUrl.trim();
-        }
-
-        // For development, default to localhost:8080 (backend port)
-        return "http://localhost:8080";
-    }
-
     @GetMapping("/audit-dashboard")
     @PreAuthorize("hasRole('ADMIN')")
     @EnterpriseEndpoint
@@ -201,17 +185,14 @@ public class ProprietaryUIDataController {
         }
 
         SAML2 saml2 = securityProps.getSaml2();
-        if (securityProps.isSaml2Active() && applicationProperties.getPremium().isEnabled()) {
+        if (securityProps.isSaml2Active()
+                && applicationProperties.getSystem().getEnableAlphaFunctionality()
+                && applicationProperties.getPremium().isEnabled()) {
             String samlIdp = saml2.getProvider();
             String saml2AuthenticationPath = "/saml2/authenticate/" + saml2.getRegistrationId();
 
-            // For SAML, we need to use the backend URL directly, not a relative path
-            // This ensures Spring Security generates the correct ACS URL
-            String backendUrl = getBackendBaseUrl();
-            String fullSamlPath = backendUrl + saml2AuthenticationPath;
-
             if (!applicationProperties.getPremium().getProFeatures().isSsoAutoLogin()) {
-                providerList.put(fullSamlPath, samlIdp + " (SAML 2)");
+                providerList.put(saml2AuthenticationPath, samlIdp + " (SAML 2)");
             }
         }
 

app/proprietary/src/main/java/stirling/software/proprietary/security/config/AccountWebController.java

@@ -120,7 +120,9 @@ public class AccountWebController {
 
         SAML2 saml2 = securityProps.getSaml2();
 
-        if (securityProps.isSaml2Active() && applicationProperties.getPremium().isEnabled()) {
+        if (securityProps.isSaml2Active()
+                && applicationProperties.getSystem().getEnableAlphaFunctionality()
+                && applicationProperties.getPremium().isEnabled()) {
             String samlIdp = saml2.getProvider();
             String saml2AuthenticationPath = "/saml2/authenticate/" + saml2.getRegistrationId();
 

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -334,8 +334,7 @@ public class SecurityConfiguration {
                                                                 securityProperties.getSaml2(),
                                                                 userService,
                                                                 jwtService,
-                                                                licenseSettingsService,
-                                                                applicationProperties))
+                                                                licenseSettingsService))
                                                 .failureHandler(
                                                         new CustomSaml2AuthenticationFailureHandler())
                                                 .authenticationRequestResolver(

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AuthController.java

@@ -244,13 +244,10 @@ public class AuthController {
         userMap.put("username", user.getUsername());
         userMap.put("role", user.getRolesAsString());
         userMap.put("enabled", user.isEnabled());
-        userMap.put(
-                "authenticationType",
-                user.getAuthenticationType()); // Expose authentication type for SSO detection
 
         // Add metadata for OAuth compatibility
         Map<String, Object> appMetadata = new HashMap<>();
-        appMetadata.put("provider", user.getAuthenticationType());
+        appMetadata.put("provider", user.getAuthenticationType()); // Default to email provider
         userMap.put("app_metadata", appMetadata);
 
         return userMap;

app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticationSuccessHandler.java

@@ -51,7 +51,6 @@ public class CustomSaml2AuthenticationSuccessHandler
     private final JwtServiceInterface jwtService;
     private final stirling.software.proprietary.service.UserLicenseSettingsService
             licenseSettingsService;
-    private final ApplicationProperties applicationProperties;
 
     @Override
     @Audited(type = AuditEventType.USER_LOGIN, level = AuditLevel.BASIC)
@@ -78,8 +77,8 @@ public class CustomSaml2AuthenticationSuccessHandler
                     log.warn(
                             "SAML2 login blocked for existing user '{}' - not eligible (not grandfathered and no ENTERPRISE license)",
                             username);
-                    String origin = resolveOrigin(request);
-                    response.sendRedirect(origin + "/logout?saml2RequiresLicense=true");
+                    response.sendRedirect(
+                            request.getContextPath() + "/logout?saml2RequiresLicense=true");
                     return;
                 }
             } else if (!licenseSettingsService.isSamlEligible(null)) {
@@ -87,8 +86,8 @@ public class CustomSaml2AuthenticationSuccessHandler
                 log.warn(
                         "SAML2 login blocked for new user '{}' - not eligible (no ENTERPRISE license for auto-creation)",
                         username);
-                String origin = resolveOrigin(request);
-                response.sendRedirect(origin + "/logout?saml2RequiresLicense=true");
+                response.sendRedirect(
+                        request.getContextPath() + "/logout?saml2RequiresLicense=true");
                 return;
             }
 
@@ -145,28 +144,20 @@ public class CustomSaml2AuthenticationSuccessHandler
                     log.debug(
                             "User {} exists with password but is not SSO user, redirecting to logout",
                             username);
-                    String origin = resolveOrigin(request);
-                    response.sendRedirect(origin + "/logout?oAuth2AuthenticationErrorWeb=true");
+                    response.sendRedirect(
+                            contextPath + "/logout?oAuth2AuthenticationErrorWeb=true");
                     return;
                 }
 
                 try {
-                    // Block new users only if: blockRegistration is true OR autoCreateUser is false
-                    if (!userExists
-                            && (saml2Properties.getBlockRegistration()
-                                    || !saml2Properties.getAutoCreateUser())) {
-                        log.debug(
-                                "Registration blocked for new user '{}' (blockRegistration: {}, autoCreateUser: {})",
-                                username,
-                                saml2Properties.getBlockRegistration(),
-                                saml2Properties.getAutoCreateUser());
-                        String origin = resolveOrigin(request);
-                        response.sendRedirect(origin + "/login?errorOAuth=oAuth2AdminBlockedUser");
+                    if (!userExists || saml2Properties.getBlockRegistration()) {
+                        log.debug("Registration blocked for new user: {}", username);
+                        response.sendRedirect(
+                                contextPath + "/login?errorOAuth=oAuth2AdminBlockedUser");
                         return;
                     }
                     if (!userExists && licenseSettingsService.wouldExceedLimit(1)) {
-                        String origin = resolveOrigin(request);
-                        response.sendRedirect(origin + "/logout?maxUsersReached=true");
+                        response.sendRedirect(contextPath + "/logout?maxUsersReached=true");
                         return;
                     }
 
@@ -231,30 +222,16 @@ public class CustomSaml2AuthenticationSuccessHandler
             String contextPath,
             String jwt) {
         String redirectPath = resolveRedirectPath(request, contextPath);
-        String origin = resolveOrigin(request);
+        String origin =
+                resolveForwardedOrigin(request)
+                        .orElseGet(
+                                () ->
+                                        resolveOriginFromReferer(request)
+                                                .orElseGet(() -> buildOriginFromRequest(request)));
         clearRedirectCookie(response);
         return origin + redirectPath + "#access_token=" + jwt;
     }
 
-    /**
-     * Resolve the origin (frontend URL) for redirects. First checks system.frontendUrl from config,
-     * then falls back to detecting from request headers.
-     */
-    private String resolveOrigin(HttpServletRequest request) {
-        // First check if frontendUrl is configured
-        String configuredFrontendUrl = applicationProperties.getSystem().getFrontendUrl();
-        if (configuredFrontendUrl != null && !configuredFrontendUrl.trim().isEmpty()) {
-            return configuredFrontendUrl.trim();
-        }
-
-        // Fall back to auto-detection from request headers
-        return resolveForwardedOrigin(request)
-                .orElseGet(
-                        () ->
-                                resolveOriginFromReferer(request)
-                                        .orElseGet(() -> buildOriginFromRequest(request)));
-    }
-
     private String resolveRedirectPath(HttpServletRequest request, String contextPath) {
         return extractRedirectPathFromCookie(request)
                 .filter(path -> path.startsWith("/"))

app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java

@@ -41,74 +41,22 @@ public class Saml2Configuration {
     @ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
     public RelyingPartyRegistrationRepository relyingPartyRegistrations() throws Exception {
         SAML2 samlConf = applicationProperties.getSecurity().getSaml2();
-
-        log.info(
-                "Initializing SAML2 configuration with registration ID: {}",
-                samlConf.getRegistrationId());
-
-        // Load IdP certificate
-        X509Certificate idpCert;
-        try {
-            Resource idpCertResource = samlConf.getIdpCert();
-            log.info("Loading IdP certificate from: {}", idpCertResource.getDescription());
-            if (!idpCertResource.exists()) {
-                log.error(
-                        "SAML2 IdP certificate not found at: {}", idpCertResource.getDescription());
-                throw new IllegalStateException(
-                        "SAML2 IdP certificate file does not exist: "
-                                + idpCertResource.getDescription());
-            }
-            idpCert = CertificateUtils.readCertificate(idpCertResource);
-            log.info(
-                    "Successfully loaded IdP certificate. Subject: {}",
-                    idpCert.getSubjectX500Principal().getName());
-        } catch (Exception e) {
-            log.error("Failed to load SAML2 IdP certificate: {}", e.getMessage(), e);
-            throw new IllegalStateException("Failed to load SAML2 IdP certificate", e);
-        }
-
+        X509Certificate idpCert = CertificateUtils.readCertificate(samlConf.getIdpCert());
         Saml2X509Credential verificationCredential = Saml2X509Credential.verification(idpCert);
-
-        // Load SP private key and certificate
         Resource privateKeyResource = samlConf.getPrivateKey();
         Resource certificateResource = samlConf.getSpCert();
-
-        log.info("Loading SP private key from: {}", privateKeyResource.getDescription());
-        if (!privateKeyResource.exists()) {
-            log.error("SAML2 SP private key not found at: {}", privateKeyResource.getDescription());
-            throw new IllegalStateException(
-                    "SAML2 SP private key file does not exist: "
-                            + privateKeyResource.getDescription());
-        }
-
-        log.info("Loading SP certificate from: {}", certificateResource.getDescription());
-        if (!certificateResource.exists()) {
-            log.error(
-                    "SAML2 SP certificate not found at: {}", certificateResource.getDescription());
-            throw new IllegalStateException(
-                    "SAML2 SP certificate file does not exist: "
-                            + certificateResource.getDescription());
-        }
-
-        Saml2X509Credential signingCredential;
-        try {
-            signingCredential =
-                    new Saml2X509Credential(
-                            CertificateUtils.readPrivateKey(privateKeyResource),
-                            CertificateUtils.readCertificate(certificateResource),
-                            Saml2X509CredentialType.SIGNING);
-            log.info("Successfully loaded SP credentials");
-        } catch (Exception e) {
-            log.error("Failed to load SAML2 SP credentials: {}", e.getMessage(), e);
-            throw new IllegalStateException("Failed to load SAML2 SP credentials", e);
-        }
+        Saml2X509Credential signingCredential =
+                new Saml2X509Credential(
+                        CertificateUtils.readPrivateKey(privateKeyResource),
+                        CertificateUtils.readCertificate(certificateResource),
+                        Saml2X509CredentialType.SIGNING);
         RelyingPartyRegistration rp =
                 RelyingPartyRegistration.withRegistrationId(samlConf.getRegistrationId())
                         .signingX509Credentials(c -> c.add(signingCredential))
                         .entityId(samlConf.getIdpIssuer())
                         .singleLogoutServiceBinding(Saml2MessageBinding.POST)
                         .singleLogoutServiceLocation(samlConf.getIdpSingleLogoutUrl())
-                        .singleLogoutServiceResponseLocation("{baseUrl}/login")
+                        .singleLogoutServiceResponseLocation("http://localhost:8080/login")
                         .assertionConsumerServiceBinding(Saml2MessageBinding.POST)
                         .assertionConsumerServiceLocation(
                                 "{baseUrl}/login/saml2/sso/{registrationId}")
@@ -127,14 +75,9 @@ public class Saml2Configuration {
                                                 .singleLogoutServiceLocation(
                                                         samlConf.getIdpSingleLogoutUrl())
                                                 .singleLogoutServiceResponseLocation(
-                                                        "{baseUrl}/login")
+                                                        "http://localhost:8080/login")
                                                 .wantAuthnRequestsSigned(true))
                         .build();
-
-        log.info(
-                "SAML2 configuration initialized successfully. Registration ID: {}, IdP: {}",
-                samlConf.getRegistrationId(),
-                samlConf.getIdpIssuer());
         return new InMemoryRelyingPartyRegistrationRepository(rp);
     }
 

app/proprietary/src/main/java/stirling/software/proprietary/service/UserLicenseSettingsService.java

@@ -177,13 +177,6 @@ public class UserLicenseSettingsService {
      */
     @Transactional
     public void grandfatherExistingOAuthUsers() {
-        // Only grandfather users if this is a V1→V2 upgrade, not a fresh V2 install
-        Boolean isNewServer = applicationProperties.getAutomaticallyGenerated().getIsNewServer();
-        if (Boolean.TRUE.equals(isNewServer)) {
-            log.info("Fresh V2 installation detected - skipping OAuth user grandfathering");
-            return;
-        }
-
         UserLicenseSettings settings = getOrCreateSettings();
 
         // Check if we've already run this migration
@@ -355,22 +348,30 @@ public class UserLicenseSettingsService {
         String username = (user != null) ? user.getUsername() : "<new user>";
         log.info("OAuth eligibility check for user: {}", username);
 
-        // Check license first - if paying, they're eligible (no need to check grandfathering)
-        boolean hasPaid = hasPaidLicense();
-        if (hasPaid) {
-            log.debug("User {} eligible for OAuth via paid license", username);
-            return true;
-        }
-
-        // No license - check if grandfathered (fallback for V1 users)
+        // Grandfathered users always have OAuth access
         if (user != null && user.isOauthGrandfathered()) {
-            log.info("User {} eligible for OAuth via grandfathering (no paid license)", username);
+            log.debug("User {} is grandfathered for OAuth", user.getUsername());
             return true;
         }
 
-        // Not grandfathered and no license
-        log.info("User {} NOT eligible for OAuth: no paid license and not grandfathered", username);
-        return false;
+        // todo: remove
+        if (user != null) {
+            log.info(
+                    "User {} is NOT grandfathered (isOauthGrandfathered={})",
+                    username,
+                    user.isOauthGrandfathered());
+        } else {
+            log.info("New user attempting OAuth login - checking license requirement");
+        }
+
+        // Users can use OAuth with SERVER or ENTERPRISE license
+        boolean hasPaid = hasPaidLicense();
+        log.info(
+                "OAuth eligibility result: hasPaidLicense={}, user={}, eligible={}",
+                hasPaid,
+                username,
+                hasPaid);
+        return hasPaid;
     }
 
     /**
@@ -390,26 +391,29 @@ public class UserLicenseSettingsService {
         String username = (user != null) ? user.getUsername() : "<new user>";
         log.info("SAML2 eligibility check for user: {}", username);
 
-        // Check license first - if paying, they're eligible (no need to check grandfathering)
-        boolean hasEnterprise = hasEnterpriseLicense();
-        if (hasEnterprise) {
-            log.debug("User {} eligible for SAML2 via ENTERPRISE license", username);
-            return true;
-        }
-
-        // No license - check if grandfathered (fallback for V1 users)
+        // Grandfathered users always have SAML access
         if (user != null && user.isOauthGrandfathered()) {
-            log.info(
-                    "User {} eligible for SAML2 via grandfathering (no ENTERPRISE license)",
-                    username);
+            log.info("User {} is grandfathered for SAML2 - ELIGIBLE", username);
             return true;
         }
 
-        // Not grandfathered and no license
+        if (user != null) {
+            log.info(
+                    "User {} is NOT grandfathered (isOauthGrandfathered={})",
+                    username,
+                    user.isOauthGrandfathered());
+        } else {
+            log.info("New user attempting SAML2 login - checking license requirement");
+        }
+
+        // Users can use SAML only with ENTERPRISE license
+        boolean hasEnterprise = hasEnterpriseLicense();
         log.info(
-                "User {} NOT eligible for SAML2: no ENTERPRISE license and not grandfathered",
-                username);
-        return false;
+                "SAML2 eligibility result: hasEnterpriseLicense={}, user={}, eligible={}",
+                hasEnterprise,
+                username,
+                hasEnterprise);
+        return hasEnterprise;
     }
 
     /**

app/proprietary/src/test/java/stirling/software/proprietary/service/UserLicenseSettingsServiceTest.java

@@ -33,7 +33,6 @@ class UserLicenseSettingsServiceTest {
     @Mock private UserService userService;
     @Mock private ApplicationProperties applicationProperties;
     @Mock private ApplicationProperties.Premium premium;
-    @Mock private ApplicationProperties.AutomaticallyGenerated automaticallyGenerated;
     @Mock private LicenseKeyChecker licenseKeyChecker;
     @Mock private ObjectProvider<LicenseKeyChecker> licenseKeyCheckerProvider;
 
@@ -50,8 +49,6 @@ class UserLicenseSettingsServiceTest {
         mockSettings.setGrandfatheredUserSignature("80:test-signature");
 
         when(applicationProperties.getPremium()).thenReturn(premium);
-        when(applicationProperties.getAutomaticallyGenerated()).thenReturn(automaticallyGenerated);
-        when(automaticallyGenerated.getIsNewServer()).thenReturn(false); // Default: not a new server
         when(settingsRepository.findSettings()).thenReturn(Optional.of(mockSettings));
         when(userService.getTotalUsersCount()).thenReturn(80L);
         when(settingsRepository.save(any(UserLicenseSettings.class)))

build.gradle

@@ -59,7 +59,7 @@ repositories {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.1.4'
+    version = '2.1.3'
 
     configurations.configureEach {
         exclude group: 'commons-logging', module: 'commons-logging'

frontend/.npmrc

@@ -0,0 +1 @@
+engine-strict=true

frontend/.nvmrc

@@ -0,0 +1 @@
+24.10.0

frontend/package-lock.json

@@ -108,6 +108,10 @@
         "vite-plugin-static-copy": "^3.1.4",
         "vite-tsconfig-paths": "^5.1.4",
         "vitest": "^3.2.4"
+      },
+      "engines": {
+        "node": ">=20.0.0",
+        "npm": ">=10.0.0"
       }
     },
     "node_modules/@acemir/cssom": {
@@ -457,7 +461,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -501,7 +504,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -582,7 +584,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-1.5.0.tgz",
       "integrity": "sha512-Yrh9XoVaT8cUgzgqpJ7hx5wg6BqQrCFirqqlSwVb+Ly9oNn4fZbR9GycIWmzJOU5XBnaOJjXfQSaDyoNP0woNA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/engines": "1.5.0",
         "@embedpdf/models": "1.5.0"
@@ -682,7 +683,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-1.5.0.tgz",
       "integrity": "sha512-p7PTNNaIr4gH3jLwX+eLJe1DeUXgi21kVGN6SRx/pocH8esg4jqoOeD/YiRRZoZnPOiy0jBXVhkPkwSmY7a2hQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -699,7 +699,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-1.5.0.tgz",
       "integrity": "sha512-ckHgTfvkW6c5Ta7Mc+Dl9C2foVnvEpqEJ84wyBnqrU0OWbe/jsiPhyKBVeartMGqNI/kVfaQTXupyrKhekAVmg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -717,7 +716,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-loader/-/plugin-loader-1.5.0.tgz",
       "integrity": "sha512-P4YpIZfaW69etYIjphyaL4cGl2pB14h3OdTE0tRQ2pZYZHFLTvlt4q9B3PVSdhlSrHK5nob7jfLGon2U7xCslg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -771,7 +769,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-1.5.0.tgz",
       "integrity": "sha512-ywwSj0ByrlkvrJIHKRzqxARkOZriki8VJUC+T4MV8fGyF4CzvCRJyKlPktahFz+VxhoodqTh7lBCib68dH+GvA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -806,7 +803,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-1.5.0.tgz",
       "integrity": "sha512-RNmTZCZ8X1mA8cw9M7TMDuhO9GtkOalGha2bBL3En3D1IlDRS7PzNNMSMV7eqT7OQICSTltlpJ8p8Qi5esvL/Q==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -843,7 +839,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-1.5.0.tgz",
       "integrity": "sha512-zrxLBAZQoPswDuf9q9DrYaQc6B0Ysc2U1hueTjNH/4+ydfl0BFXZkKR63C2e3YmWtXvKjkoIj0GyPzsiBORLUw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -919,7 +914,6 @@
       "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-1.5.0.tgz",
       "integrity": "sha512-G8GDyYRhfehw72+r4qKkydnA5+AU8qH67g01Y12b0DzI0VIzymh/05Z4dK8DsY3jyWPXJfw2hlg5+KDHaMBHgQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@embedpdf/models": "1.5.0"
       },
@@ -969,6 +963,7 @@
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.7.0.tgz",
       "integrity": "sha512-pJdKGq/1iquWYtv1RRSljZklxHCOCAJFJrImO5ZLKPJVJlVUcs8yFwNQlqS0Lo8xT1VAXXTCZocF9n26FWEKsw==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -980,6 +975,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
       "license": "0BSD",
       "optional": true
     },
@@ -987,6 +983,7 @@
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.7.0.tgz",
       "integrity": "sha512-oAYoQnCYaQZKVS53Fq23ceWMRxq5EhQsE0x0RdQ55jT7wagMu5k+fS39v1fiSLrtrLQlXwVINenqhLMtTrV/1Q==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -997,6 +994,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
       "license": "0BSD",
       "optional": true
     },
@@ -1004,6 +1002,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.1.0.tgz",
       "integrity": "sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1014,6 +1013,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
       "license": "0BSD",
       "optional": true
     },
@@ -1075,7 +1075,6 @@
       "resolved": "https://registry.npmjs.org/@emotion/react/-/react-11.14.0.tgz",
       "integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "@emotion/babel-plugin": "^11.13.5",
@@ -1119,7 +1118,6 @@
       "resolved": "https://registry.npmjs.org/@emotion/styled/-/styled-11.14.1.tgz",
       "integrity": "sha512-qEEJt42DuToa3gurlH4Qqc1kVpNq8wO8cJtDzU46TjlzWjDlsVyevtYCRijVq3SrHsROS+gVQ8Fnea108GnKzw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "@emotion/babel-plugin": "^11.13.5",
@@ -2150,7 +2148,6 @@
       "resolved": "https://registry.npmjs.org/@mantine/core/-/core-8.3.6.tgz",
       "integrity": "sha512-paTl+0x+O/QtgMtqVJaG8maD8sfiOdgPmLOyG485FmeGZ1L3KMdEkhxZtmdGlDFsLXhmMGQ57ducT90bvhXX5A==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@floating-ui/react": "^0.27.16",
         "clsx": "^2.1.1",
@@ -2201,7 +2198,6 @@
       "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-8.3.6.tgz",
       "integrity": "sha512-liHfaWXHAkLjJy+Bkr29UsCwAoDQ/a64WrM67lksx8F0qqyjR5RQH8zVlhuOjdpQnwtlUkE/YiTvbJiPcoI0bw==",
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "react": "^18.x || ^19.x"
       }
@@ -2269,7 +2265,6 @@
       "resolved": "https://registry.npmjs.org/@mui/material/-/material-7.3.5.tgz",
       "integrity": "sha512-8VVxFmp1GIm9PpmnQoCoYo0UWHoOrdA57tDL62vkpzEgvb/d71Wsbv4FRg7r1Gyx7PuSo0tflH34cdl/NvfHNQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.28.4",
         "@mui/core-downloads-tracker": "^7.3.5",
@@ -2651,6 +2646,7 @@
       "version": "0.2.12",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
       "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -3202,7 +3198,6 @@
       "resolved": "https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-7.9.0.tgz",
       "integrity": "sha512-ggs5k+/0FUJcIgNY08aZTqpBTtbExkJMYMLSMwyucrhtWexVOEY1KJmhBsxf+E/Q15f5rbwBpj+t0t2AW2oCsQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12.16"
       }
@@ -3321,6 +3316,7 @@
       "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.6.tgz",
       "integrity": "sha512-4awhxtMh4cx9blePWl10HRHj8Iivtqj+2QdDCSMDzxG+XKa9+VCNupQuCuvzEhYPzZSrX+0gC+0lHA/0fFKKQQ==",
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "acorn": "^8.9.0"
       }
@@ -3774,6 +3770,60 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.6.0",
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.1.0",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.6.0",
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.1.0",
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.0.7",
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.5.0",
+        "@emnapi/runtime": "^1.5.0",
+        "@tybys/wasm-util": "^0.10.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
       "version": "4.1.17",
       "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.17.tgz",
@@ -4097,7 +4147,6 @@
       "integrity": "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.10.4",
         "@babel/runtime": "^7.12.5",
@@ -4282,6 +4331,7 @@
       "version": "0.10.1",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
       "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4292,6 +4342,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
       "license": "0BSD",
       "optional": true
     },
@@ -4426,7 +4477,6 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.2.tgz",
       "integrity": "sha512-6mDvHUFSjyT2B2yeNx2nUgMxh9LtOWvkhIU3uePn2I2oyNymUAX1NIsdgviM4CH+JSrp2D2hsMvJOkxY+0wNRA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "csstype": "^3.0.2"
       }
@@ -4437,7 +4487,6 @@
       "integrity": "sha512-9KQPoO6mZCi7jcIStSnlOWn2nEF3mNmyr3rIAsGnAbQKYbRLyqmeSc39EVgtxXVia+LMT8j3knZLAZAh+xLmrw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^19.2.0"
       }
@@ -4507,7 +4556,6 @@
       "integrity": "sha512-6m1I5RmHBGTnUGS113G04DMu3CpSdxCAU/UvtjNWL4Nuf3MW9tQhiJqRlHzChIkhy6kZSAQmc+I1bcGjE3yNKg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.46.3",
         "@typescript-eslint/types": "8.46.3",
@@ -5221,6 +5269,7 @@
       "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.24.tgz",
       "integrity": "sha512-BM8kBhtlkkbnyl4q+HiF5R5BL0ycDPfihowulm02q3WYp2vxgPcJuZO866qa/0u3idbMntKEtVNuAUp5bw4teg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/shared": "3.5.24"
       }
@@ -5230,6 +5279,7 @@
       "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.24.tgz",
       "integrity": "sha512-RYP/byyKDgNIqfX/gNb2PB55dJmM97jc9wyF3jK7QUInYKypK2exmZMNwnjueWwGceEkP6NChd3D2ZVEp9undQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/reactivity": "3.5.24",
         "@vue/shared": "3.5.24"
@@ -5240,6 +5290,7 @@
       "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.24.tgz",
       "integrity": "sha512-Z8ANhr/i0XIluonHVjbUkjvn+CyrxbXRIxR7wn7+X7xlcb7dJsfITZbkVOeJZdP8VZwfrWRsWdShH6pngMxRjw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/reactivity": "3.5.24",
         "@vue/runtime-core": "3.5.24",
@@ -5252,6 +5303,7 @@
       "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.24.tgz",
       "integrity": "sha512-Yh2j2Y4G/0/4z/xJ1Bad4mxaAk++C2v4kaa8oSYTMJBJ00/ndPuxCnWeot0/7/qafQFLh5pr6xeV6SdMcE/G1w==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vue/compiler-ssr": "3.5.24",
         "@vue/shared": "3.5.24"
@@ -5278,7 +5330,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5686,6 +5737,7 @@
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
       "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">= 0.4"
       }
@@ -5962,7 +6014,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.8.19",
         "caniuse-lite": "^1.0.30001751",
@@ -7010,8 +7061,7 @@
       "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1521046.tgz",
       "integrity": "sha512-vhE6eymDQSKWUXwwA37NtTTVEzjtGVfDr3pRbsWEQ5onH/Snp2c+2xZHWJJawG/0hCCJLRGt4xVtEVUVILol4w==",
       "dev": true,
-      "license": "BSD-3-Clause",
-      "peer": true
+      "license": "BSD-3-Clause"
     },
     "node_modules/dezalgo": {
       "version": "1.0.4",
@@ -7406,7 +7456,6 @@
       "integrity": "sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -7577,7 +7626,6 @@
       "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@rtsao/scc": "^1.1.0",
         "array-includes": "^3.1.9",
@@ -7744,7 +7792,8 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
       "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/espree": {
       "version": "10.4.0",
@@ -7809,6 +7858,7 @@
       "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.1.2.tgz",
       "integrity": "sha512-DgvlIQeowRNyvLPWW4PT7Gu13WznY288Du086E751mwwbsgr29ytBiYeLzAGIo0qk3Ujob0SDk8TiSaM5WQzNg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.4.15"
       }
@@ -8899,7 +8949,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.27.6"
       },
@@ -9376,6 +9425,7 @@
       "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
       "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/estree": "^1.0.6"
       }
@@ -9696,7 +9746,6 @@
       "integrity": "sha512-Pcfm3eZ+eO4JdZCXthW9tCDT3nF4K+9dmeZ+5X39n+Kqz0DDIABRP5CAEOHRFZk8RGuC2efksTJxrjp8EXCunQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@acemir/cssom": "^0.9.19",
         "@asamuzakjp/dom-selector": "^6.7.3",
@@ -10283,7 +10332,8 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
       "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/locate-path": {
       "version": "6.0.0",
@@ -11442,7 +11492,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -11722,7 +11771,6 @@
       "resolved": "https://registry.npmjs.org/preact/-/preact-10.27.2.tgz",
       "integrity": "sha512-5SYSgFKSyhCbk6SrXyMpqjb5+MQBgfvEKE/OC+PujcY34sOpqtr+0AZQtPYx5IA6VxynQ7rUPCtKzyovpj9Bpg==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/preact"
@@ -12105,7 +12153,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.0.tgz",
       "integrity": "sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -12115,7 +12162,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.0.tgz",
       "integrity": "sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -13627,6 +13673,7 @@
       "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
       "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">= 0.4"
       }
@@ -13835,7 +13882,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -14137,7 +14183,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -14219,7 +14264,6 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "napi-postinstall": "^0.3.0"
       },
@@ -14424,7 +14468,6 @@
       "integrity": "sha512-BxAKBWmIbrDgrokdGZH1IgkIk/5mMHDreLDmCJ0qpyJaAteP8NvMhkwr/ZCQNqNH97bw/dANTE9PDzqwJghfMQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -14595,7 +14638,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -14609,7 +14651,6 @@
       "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/chai": "^5.2.2",
         "@vitest/expect": "3.2.4",
@@ -15221,7 +15262,8 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
       "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/zod": {
       "version": "3.25.76",

frontend/package.json

@@ -163,5 +163,9 @@
       "@testing-library/user-event",
       "@vitest/coverage-v8"
     ]
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "npm": ">=10.0.0"
   }
 }

frontend/public/locales/en-GB/translation.toml

@@ -449,7 +449,6 @@ required = "All fields are required."
 mismatch = "New passwords do not match."
 error = "Unable to update password. Please verify your current password and try again."
 success = "Password updated successfully. Please sign in again."
-ssoDisabled = "Password changes are managed by your identity provider."
 current = "Current password"
 currentPlaceholder = "Enter your current password"
 new = "New password"
@@ -511,7 +510,6 @@ low = "Low"
 title = "Change Credentials"
 header = "Update Your Account Details"
 changePassword = "You are using default login credentials. Please enter a new password"
-ssoManaged = "Your account is managed by your identity provider."
 newUsername = "New Username"
 oldPassword = "Current Password"
 newPassword = "New Password"

frontend/src-tauri/Cargo.lock

@@ -589,26 +589,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "const-random"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
-dependencies = [
- "const-random-macro",
-]
-
-[[package]]
-name = "const-random-macro"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
-dependencies = [
- "getrandom 0.2.16",
- "once_cell",
- "tiny-keccak",
-]
-
 [[package]]
 name = "convert_case"
 version = "0.4.0"
@@ -736,12 +716,6 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -934,15 +908,6 @@ dependencies = [
  "syn 2.0.108",
 ]
 
-[[package]]
-name = "dlv-list"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
-dependencies = [
- "const-random",
-]
-
 [[package]]
 name = "document-features"
 version = "0.2.12"
@@ -1661,12 +1626,6 @@ dependencies = [
  "ahash",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
 [[package]]
 name = "hashbrown"
 version = "0.16.0"
@@ -2861,16 +2820,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
-[[package]]
-name = "ordered-multimap"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
-dependencies = [
- "dlv-list",
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "ordered-stream"
 version = "0.2.0"
@@ -3702,16 +3651,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "rust-ini"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
-dependencies = [
- "cfg-if",
- "ordered-multimap",
-]
-
 [[package]]
 name = "rust_decimal"
 version = "1.39.0"
@@ -4317,7 +4256,6 @@ dependencies = [
  "sha2",
  "tauri",
  "tauri-build",
- "tauri-plugin-deep-link",
  "tauri-plugin-fs",
  "tauri-plugin-http",
  "tauri-plugin-log",
@@ -4677,27 +4615,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "tauri-plugin-deep-link"
-version = "2.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e82759f7c7d51de3cbde51c04b3f2332de52436ed84541182cd8944b04e9e73"
-dependencies = [
- "dunce",
- "plist",
- "rust-ini",
- "serde",
- "serde_json",
- "tauri",
- "tauri-plugin",
- "tauri-utils",
- "thiserror 2.0.17",
- "tracing",
- "url",
- "windows-registry",
- "windows-result 0.3.4",
-]
-
 [[package]]
 name = "tauri-plugin-fs"
 version = "2.4.4"
@@ -4818,7 +4735,6 @@ dependencies = [
  "serde",
  "serde_json",
  "tauri",
- "tauri-plugin-deep-link",
  "thiserror 2.0.17",
  "tracing",
  "windows-sys 0.60.2",
@@ -5038,15 +4954,6 @@ dependencies = [
  "time-core",
 ]
 
-[[package]]
-name = "tiny-keccak"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
-dependencies = [
- "crunchy",
-]
-
 [[package]]
 name = "tiny_http"
 version = "0.12.0"

frontend/src-tauri/Cargo.toml

@@ -29,10 +29,9 @@ tauri-plugin-log = "2.0.0-rc"
 tauri-plugin-shell = "2.1.0"
 tauri-plugin-fs = "2.4.4"
 tauri-plugin-http = "2.4.4"
-tauri-plugin-single-instance = { version = "2.3.6", features = ["deep-link"] }
+tauri-plugin-single-instance = "2.0.1"
 tauri-plugin-store = "2.1.0"
 tauri-plugin-opener = "2.0.0"
-tauri-plugin-deep-link = "2.4.5"
 keyring = { version = "3.6.1", features = ["apple-native", "windows-native"] }
 tokio = { version = "1.0", features = ["time", "sync"] }
 reqwest = { version = "0.11", features = ["json"] }

frontend/src-tauri/capabilities/default.json

@@ -19,8 +19,6 @@
     {
       "identifier": "fs:allow-read-file",
       "allow": [{ "path": "**" }]
-    },
-    "opener:default",
-    "shell:allow-open"
+    }
   ]
 }

frontend/src-tauri/src/lib.rs

@@ -1,4 +1,4 @@
-use tauri::{AppHandle, Emitter, Manager, RunEvent, WindowEvent};
+use tauri::{Manager, RunEvent, WindowEvent, Emitter};
 
 mod utils;
 mod commands;
@@ -28,17 +28,6 @@ use commands::{
 };
 use state::connection_state::AppConnectionState;
 use utils::{add_log, get_tauri_logs};
-use tauri_plugin_deep_link::DeepLinkExt;
-
-fn dispatch_deep_link(app: &AppHandle, url: &str) {
-  add_log(format!("🔗 Dispatching deep link: {}", url));
-  let _ = app.emit("deep-link", url.to_string());
-
-  if let Some(window) = app.get_webview_window("main") {
-    let _ = window.set_focus();
-    let _ = window.unminimize();
-  }
-}
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
@@ -53,7 +42,6 @@ pub fn run() {
     .plugin(tauri_plugin_fs::init())
     .plugin(tauri_plugin_http::init())
     .plugin(tauri_plugin_store::Builder::new().build())
-    .plugin(tauri_plugin_deep_link::init())
     .manage(AppConnectionState::default())
     .plugin(tauri_plugin_single_instance::init(|app, args, _cwd| {
       // This callback runs when a second instance tries to start
@@ -90,29 +78,6 @@ pub fn run() {
         }
       }
 
-      {
-        let app_handle = app.handle();
-        // On macOS the plugin registers schemes via bundle metadata, so runtime registration is required only on Windows/Linux
-        #[cfg(any(target_os = "linux", target_os = "windows"))]
-        if let Err(err) = app_handle.deep_link().register_all() {
-          add_log(format!("⚠️ Failed to register deep link handler: {}", err));
-        }
-
-        if let Ok(Some(urls)) = app_handle.deep_link().get_current() {
-          let initial_handle = app_handle.clone();
-          for url in urls {
-            dispatch_deep_link(&initial_handle, url.as_str());
-          }
-        }
-
-        let event_app_handle = app_handle.clone();
-        app_handle.deep_link().on_open_url(move |event| {
-          for url in event.urls() {
-            dispatch_deep_link(&event_app_handle, url.as_str());
-          }
-        });
-      }
-
       // Start backend immediately, non-blocking
       let app_handle = app.handle().clone();
 

frontend/src-tauri/tauri.conf.json

@@ -77,13 +77,6 @@
         },
         "fs": {
             "requireLiteralLeadingDot": false
-        },
-        "deep-link": {
-            "desktop": {
-                "schemes": [
-                    "stirlingpdf"
-                ]
-            }
         }
     }
 }

frontend/src/core/components/shared/AllToolsNavButton.tsx

@@ -1,5 +1,6 @@
 import React from 'react';
 import { useTranslation } from 'react-i18next';
+import { Tooltip } from '@app/components/shared/Tooltip';
 import AppsIcon from '@mui/icons-material/AppsRounded';
 import { useToolWorkflow } from '@app/contexts/ToolWorkflowContext';
 import { useNavigationState, useNavigationActions } from '@app/contexts/NavigationContext';
@@ -10,11 +11,13 @@ import QuickAccessButton from '@app/components/shared/quickAccessBar/QuickAccess
 interface AllToolsNavButtonProps {
   activeButton: string;
   setActiveButton: (id: string) => void;
+  tooltipPosition?: 'left' | 'right' | 'top' | 'bottom';
 }
 
 const AllToolsNavButton: React.FC<AllToolsNavButtonProps> = ({
   activeButton,
   setActiveButton,
+  tooltipPosition = 'right'
 }) => {
   const { t } = useTranslation();
   const { handleReaderToggle, handleBackToTools, selectedToolKey, leftPanelView } = useToolWorkflow();
@@ -52,18 +55,26 @@ const AllToolsNavButton: React.FC<AllToolsNavButtonProps> = ({
   };
 
   return (
-    <div className="mt-4 mb-2">
-      <QuickAccessButton
-        icon={<AppsIcon sx={{ fontSize: isActive ? '1.875rem' : '1.5rem' }} />}
-        label={t("quickAccess.allTools", "Tools")}
-        isActive={isActive}
-        onClick={handleNavClick}
-        href={navProps.href}
-        ariaLabel={t("quickAccess.allTools", "Tools")}
-        textClassName="all-tools-text"
-        component="a"
-      />
-    </div>
+    <Tooltip
+      content={t("quickAccess.allTools", "Tools")}
+      position={tooltipPosition}
+      arrow
+      containerStyle={{ marginTop: "-1rem" }}
+      maxWidth={200}
+    >
+      <div className="mt-4 mb-2">
+        <QuickAccessButton
+          icon={<AppsIcon sx={{ fontSize: isActive ? '1.875rem' : '1.5rem' }} />}
+          label={t("quickAccess.allTools", "Tools")}
+          isActive={isActive}
+          onClick={handleNavClick}
+          href={navProps.href}
+          ariaLabel={t("quickAccess.allTools", "Tools")}
+          textClassName="all-tools-text"
+          component="a"
+        />
+      </div>
+    </Tooltip>
   );
 };
 

frontend/src/core/components/shared/rightRail/ViewerAnnotationControls.tsx

@@ -1,9 +1,15 @@
-import React from 'react';
-import { ActionIcon } from '@mantine/core';
+import React, { useState, useEffect } from 'react';
+import { ActionIcon, Popover } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import LocalIcon from '@app/components/shared/LocalIcon';
 import { Tooltip } from '@app/components/shared/Tooltip';
 import { ViewerContext } from '@app/contexts/ViewerContext';
+import { useSignature } from '@app/contexts/SignatureContext';
+import { ColorSwatchButton, ColorPicker } from '@app/components/annotation/shared/ColorPicker';
+import { useFileState, useFileContext } from '@app/contexts/FileContext';
+import { generateThumbnailWithMetadata } from '@app/utils/thumbnailUtils';
+import { createProcessedFile } from '@app/contexts/file/fileActions';
+import { createStirlingFile, createNewStirlingFileStub } from '@app/types/fileContext';
 import { useNavigationState } from '@app/contexts/NavigationContext';
 import { useSidebarContext } from '@app/contexts/SidebarContext';
 import { useRightRailTooltipSide } from '@app/hooks/useRightRailTooltipSide';
@@ -17,14 +23,32 @@ export default function ViewerAnnotationControls({ currentView, disabled = false
   const { t } = useTranslation();
   const { sidebarRefs } = useSidebarContext();
   const { position: tooltipPosition, offset: tooltipOffset } = useRightRailTooltipSide(sidebarRefs);
+  const [selectedColor, setSelectedColor] = useState('#000000');
+  const [isColorPickerOpen, setIsColorPickerOpen] = useState(false);
+  const [isHoverColorPickerOpen, setIsHoverColorPickerOpen] = useState(false);
 
   // Viewer context for PDF controls - safely handle when not available
   const viewerContext = React.useContext(ViewerContext);
 
+  // Signature context for accessing drawing API
+  const { signatureApiRef, isPlacementMode } = useSignature();
+
+  // File state for save functionality
+  const { state, selectors } = useFileState();
+  const { actions: fileActions } = useFileContext();
+  const activeFiles = selectors.getFiles();
+
   // Check if we're in sign mode
   const { selectedTool } = useNavigationState();
   const isSignMode = selectedTool === 'sign';
 
+  // Turn off annotation mode when switching away from viewer
+  useEffect(() => {
+    if (currentView !== 'viewer' && viewerContext?.isAnnotationMode) {
+      viewerContext.setAnnotationMode(false);
+    }
+  }, [currentView, viewerContext]);
+
   // Don't show any annotation controls in sign mode
   if (isSignMode) {
     return null;
@@ -41,7 +65,7 @@ export default function ViewerAnnotationControls({ currentView, disabled = false
           onClick={() => {
             viewerContext?.toggleAnnotationsVisibility();
           }}
-          disabled={disabled || currentView !== 'viewer'}
+          disabled={disabled || currentView !== 'viewer' || viewerContext?.isAnnotationMode || isPlacementMode}
         >
           <LocalIcon
             icon={viewerContext?.isAnnotationsVisible ? "visibility" : "visibility-off-rounded"}
@@ -50,6 +74,164 @@ export default function ViewerAnnotationControls({ currentView, disabled = false
           />
         </ActionIcon>
       </Tooltip>
+
+      {/* Annotation Mode Toggle with Drawing Controls */}
+      {viewerContext?.isAnnotationMode ? (
+        // When active: Show color picker on hover
+        <div
+          onMouseEnter={() => setIsHoverColorPickerOpen(true)}
+          onMouseLeave={() => setIsHoverColorPickerOpen(false)}
+          style={{ display: 'inline-flex' }}
+        >
+          <Popover
+            opened={isHoverColorPickerOpen}
+            onClose={() => setIsHoverColorPickerOpen(false)}
+            position="left"
+            withArrow
+            shadow="md"
+            offset={8}
+          >
+            <Popover.Target>
+              <ActionIcon
+                variant="filled"
+                color="blue"
+                radius="md"
+                className="right-rail-icon"
+                onClick={() => {
+                  viewerContext?.toggleAnnotationMode();
+                  setIsHoverColorPickerOpen(false); // Close hover color picker when toggling off
+                  // Deactivate drawing tool when exiting annotation mode
+                  if (signatureApiRef?.current) {
+                    try {
+                      signatureApiRef.current.deactivateTools();
+                    } catch (error) {
+                      console.log('Signature API not ready:', error);
+                    }
+                  }
+                }}
+              disabled={disabled}
+                aria-label="Drawing mode active"
+              >
+                <LocalIcon icon="edit" width="1.5rem" height="1.5rem" />
+              </ActionIcon>
+            </Popover.Target>
+            <Popover.Dropdown>
+              <div style={{ minWidth: '8rem' }}>
+                <div style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', gap: '0.5rem', padding: '0.5rem' }}>
+                  <div style={{ fontSize: '0.8rem', fontWeight: 500 }}>Drawing Color</div>
+                  <ColorSwatchButton
+                    color={selectedColor}
+                    size={32}
+                    onClick={() => {
+                      setIsHoverColorPickerOpen(false); // Close hover picker
+                      setIsColorPickerOpen(true); // Open main color picker modal
+                    }}
+                  />
+                </div>
+              </div>
+            </Popover.Dropdown>
+          </Popover>
+        </div>
+      ) : (
+        // When inactive: Show "Draw" tooltip
+        <Tooltip content={t('rightRail.draw', 'Draw')} position={tooltipPosition} offset={tooltipOffset} arrow portalTarget={document.body}>
+          <ActionIcon
+            variant="subtle"
+            radius="md"
+            className="right-rail-icon"
+            onClick={() => {
+              viewerContext?.toggleAnnotationMode();
+              // Activate ink drawing tool when entering annotation mode
+              if (signatureApiRef?.current && currentView === 'viewer') {
+                try {
+                  signatureApiRef.current.activateDrawMode();
+                  signatureApiRef.current.updateDrawSettings(selectedColor, 2);
+                } catch (error) {
+                  console.log('Signature API not ready:', error);
+                }
+              }
+            }}
+            disabled={disabled}
+            aria-label={typeof t === 'function' ? t('rightRail.draw', 'Draw') : 'Draw'}
+          >
+            <LocalIcon icon="edit" width="1.5rem" height="1.5rem" />
+          </ActionIcon>
+        </Tooltip>
+      )}
+
+      {/* Save PDF with Annotations */}
+      <Tooltip content={t('rightRail.save', 'Save')} position={tooltipPosition} offset={tooltipOffset} arrow portalTarget={document.body}>
+        <ActionIcon
+          variant="subtle"
+          radius="md"
+          className="right-rail-icon"
+          onClick={async () => {
+            if (viewerContext?.exportActions?.saveAsCopy && currentView === 'viewer') {
+              try {
+                const pdfArrayBuffer = await viewerContext.exportActions.saveAsCopy();
+                if (pdfArrayBuffer) {
+                  // Create new File object with flattened annotations
+                  const blob = new Blob([pdfArrayBuffer], { type: 'application/pdf' });
+
+                  // Get the original file name or use a default
+                  const originalFileName = activeFiles.length > 0 ? activeFiles[0].name : 'document.pdf';
+                  const newFile = new File([blob], originalFileName, { type: 'application/pdf' });
+
+                  // Replace the current file in context with the saved version (exact same logic as Sign tool)
+                  if (activeFiles.length > 0) {
+                    // Generate thumbnail and metadata for the saved file
+                    const thumbnailResult = await generateThumbnailWithMetadata(newFile);
+                    const processedFileMetadata = createProcessedFile(thumbnailResult.pageCount, thumbnailResult.thumbnail);
+
+                    // Get current file info
+                    const currentFileIds = state.files.ids;
+                    if (currentFileIds.length > 0) {
+                      const currentFileId = currentFileIds[0];
+                      const currentRecord = selectors.getStirlingFileStub(currentFileId);
+
+                      if (!currentRecord) {
+                        console.error('No file record found for:', currentFileId);
+                        return;
+                      }
+
+                      // Create output stub and file (exact same as Sign tool)
+                      const outputStub = createNewStirlingFileStub(newFile, undefined, thumbnailResult.thumbnail, processedFileMetadata);
+                      const outputStirlingFile = createStirlingFile(newFile, outputStub.id);
+
+                      // Replace the original file with the saved version
+                      await fileActions.consumeFiles([currentFileId], [outputStirlingFile], [outputStub]);
+                    }
+                  }
+                }
+              } catch (error) {
+                console.error('Error saving PDF:', error);
+              }
+            }
+          }}
+          disabled={disabled}
+        >
+          <LocalIcon icon="save" width="1.5rem" height="1.5rem" />
+        </ActionIcon>
+      </Tooltip>
+
+      {/* Color Picker Modal */}
+      <ColorPicker
+        isOpen={isColorPickerOpen}
+        onClose={() => setIsColorPickerOpen(false)}
+        selectedColor={selectedColor}
+        onColorChange={(color) => {
+          setSelectedColor(color);
+          // Update drawing tool color if annotation mode is active
+          if (viewerContext?.isAnnotationMode && signatureApiRef?.current && currentView === 'viewer') {
+            try {
+              signatureApiRef.current.updateDrawSettings(color, 2);
+            } catch (error) {
+              console.log('Unable to update drawing settings:', error);
+            }
+          }
+        }}
+        title="Choose Drawing Color"
+      />
     </>
   );
 }

frontend/src/core/components/viewer/EmbedPdfViewer.tsx

@@ -51,7 +51,6 @@ const EmbedPdfViewerContent = ({
     getScrollState,
     getRotationState,
     isAnnotationMode,
-    setAnnotationMode,
     isAnnotationsVisible,
     exportActions,
   } = useViewer();
@@ -83,18 +82,15 @@ const EmbedPdfViewerContent = ({
   // Navigation guard for unsaved changes
   const { setHasUnsavedChanges, registerUnsavedChangesChecker, unregisterUnsavedChangesChecker } = useNavigationGuard();
 
-  // Check if we're in an annotation tool
+  // Check if we're in signature mode OR viewer annotation mode
   const { selectedTool } = useNavigationState();
-  // Tools that require the annotation layer (Sign, Add Text, Add Image)
-  const isInAnnotationTool = selectedTool === 'sign' || selectedTool === 'addText' || selectedTool === 'addImage';
-
-  // Sync isAnnotationMode in ViewerContext with current tool
-  useEffect(() => {
-    setAnnotationMode(isInAnnotationTool);
-  }, [isInAnnotationTool, setAnnotationMode]);
+  // Tools that use the stamp/signature placement system with hover preview
+  const isSignatureMode = selectedTool === 'sign' || selectedTool === 'addText' || selectedTool === 'addImage';
 
+  // Enable annotations when: in sign mode, OR annotation mode is active, OR we want to show existing annotations
+  const shouldEnableAnnotations = isSignatureMode || isAnnotationMode || isAnnotationsVisible;
   const isPlacementOverlayActive = Boolean(
-    isInAnnotationTool && isPlacementMode && signatureConfig
+    isSignatureMode && shouldEnableAnnotations && isPlacementMode && signatureConfig
   );
 
   // Track which file tab is active
@@ -337,8 +333,7 @@ const EmbedPdfViewerContent = ({
               key={currentFile && isStirlingFile(currentFile) ? currentFile.fileId : (effectiveFile.file instanceof File ? effectiveFile.file.name : effectiveFile.url)}
               file={effectiveFile.file}
               url={effectiveFile.url}
-              enableAnnotations={isAnnotationMode}
-              showBakedAnnotations={isAnnotationsVisible}
+              enableAnnotations={shouldEnableAnnotations}
               signatureApiRef={signatureApiRef as React.RefObject<any>}
               historyApiRef={historyApiRef as React.RefObject<any>}
               onSignatureAdded={() => {

frontend/src/core/components/viewer/LocalEmbedPDF.tsx

@@ -52,13 +52,12 @@ interface LocalEmbedPDFProps {
   file?: File | Blob;
   url?: string | null;
   enableAnnotations?: boolean;
-  showBakedAnnotations?: boolean;
   onSignatureAdded?: (annotation: any) => void;
   signatureApiRef?: React.RefObject<SignatureAPI>;
   historyApiRef?: React.RefObject<HistoryAPI>;
 }
 
-export function LocalEmbedPDF({ file, url, enableAnnotations = false, showBakedAnnotations = true, onSignatureAdded, signatureApiRef, historyApiRef }: LocalEmbedPDFProps) {
+export function LocalEmbedPDF({ file, url, enableAnnotations = false, onSignatureAdded, signatureApiRef, historyApiRef }: LocalEmbedPDFProps) {
   const { t } = useTranslation();
   const [pdfUrl, setPdfUrl] = useState<string | null>(null);
   const [, setAnnotations] = useState<Array<{id: string, pageIndex: number, rect: any}>>([]);
@@ -101,7 +100,7 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, showBakedA
       }),
       createPluginRegistration(RenderPluginPackage, {
         withForms: true,
-        withAnnotations: showBakedAnnotations && !enableAnnotations, // Show baked annotations only when: visibility is ON and annotation layer is OFF
+        withAnnotations: true,
       }),
 
       // Register interaction manager (required for zoom and selection features)
@@ -167,7 +166,7 @@ export function LocalEmbedPDF({ file, url, enableAnnotations = false, showBakedA
       // Register print plugin for printing PDFs
       createPluginRegistration(PrintPluginPackage),
     ];
-  }, [pdfUrl, enableAnnotations, showBakedAnnotations]);
+  }, [pdfUrl]);
 
   // Initialize the engine with the React hook - use local WASM for offline support
   const { engine, isLoading, error } = usePdfiumEngine({

frontend/src/core/components/viewer/PdfViewerToolbar.tsx

@@ -2,7 +2,6 @@ import { useState, useEffect } from 'react';
 import { Button, Paper, Group, NumberInput } from '@mantine/core';
 import { useTranslation } from 'react-i18next';
 import { useViewer } from '@app/contexts/ViewerContext';
-import { Tooltip } from '@app/components/shared/Tooltip';
 import FirstPageIcon from '@mui/icons-material/FirstPage';
 import ArrowBackIosIcon from '@mui/icons-material/ArrowBackIos';
 import ArrowForwardIosIcon from '@mui/icons-material/ArrowForwardIos';
@@ -210,27 +209,21 @@ export function PdfViewerToolbar({
         </Button>
 
         {/* Dual Page Toggle */}
-        <Tooltip
-          content={
+        <Button
+          variant={isDualPageActive ? "filled" : "light"}
+          color="blue"
+          size="md"
+          radius="xl"
+          onClick={handleDualPageToggle}
+          style={{ minWidth: '2.5rem' }}
+          title={
             isDualPageActive
               ? t("viewer.singlePageView", "Single Page View")
               : t("viewer.dualPageView", "Dual Page View")
           }
-          position="top"
-          arrow
         >
-          <Button
-            variant={isDualPageActive ? "filled" : "light"}
-            color="blue"
-            size="md"
-            radius="xl"
-            onClick={handleDualPageToggle}
-            disabled={scrollState.totalPages <= 1}
-            style={{ minWidth: '2.5rem' }}
-          >
-            {isDualPageActive ? <DescriptionIcon fontSize="small" /> : <ViewWeekIcon fontSize="small" />}
-          </Button>
-        </Tooltip>
+          {isDualPageActive ? <DescriptionIcon fontSize="small" /> : <ViewWeekIcon fontSize="small" />}
+        </Button>
 
         {/* Zoom Controls */}
         <Group gap={4} align="center" style={{ marginLeft: 16 }}>

frontend/src/core/contexts/ViewerContext.tsx

@@ -95,6 +95,7 @@ interface ViewerContextType {
   // Annotation/drawing mode for viewer
   isAnnotationMode: boolean;
   setAnnotationMode: (enabled: boolean) => void;
+  toggleAnnotationMode: () => void;
 
   // Active file index for multi-file viewing
   activeFileIndex: number;
@@ -229,6 +230,10 @@ export const ViewerProvider: React.FC<ViewerProviderProps> = ({ children }) => {
     setIsAnnotationModeState(enabled);
   };
 
+  const toggleAnnotationMode = () => {
+    setIsAnnotationModeState(prev => !prev);
+  };
+
   // State getters - read from bridge refs
   const getScrollState = (): ScrollState => {
     return bridgeRefs.current.scroll?.state || { currentPage: 1, totalPages: 0 };
@@ -313,6 +318,7 @@ export const ViewerProvider: React.FC<ViewerProviderProps> = ({ children }) => {
     toggleAnnotationsVisibility,
     isAnnotationMode,
     setAnnotationMode,
+    toggleAnnotationMode,
 
     // Active file index
     activeFileIndex,

frontend/src/core/tools/pdfTextEditor/PdfTextEditor.tsx

@@ -238,7 +238,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   const originalImagesRef = useRef<PdfJsonImageElement[][]>([]);
   const originalGroupsRef = useRef<TextGroup[][]>([]);
   const imagesByPageRef = useRef<PdfJsonImageElement[][]>([]);
-  const lastLoadedFileRef = useRef<File | null>(null);
   const autoLoadKeyRef = useRef<string | null>(null);
   const sourceFileIdRef = useRef<string | null>(null);
   const loadRequestIdRef = useRef(0);
@@ -252,10 +251,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   const pagePreviewsRef = useRef<Map<number, string>>(pagePreviews);
   const previewScaleRef = useRef<Map<number, number>>(new Map());
   const cachedJobIdRef = useRef<string | null>(null);
-  const previousCachedJobIdRef = useRef<string | null>(null);
-  const cacheRecoveryInProgressRef = useRef(false);
-  const cacheRecoveryAttemptsRef = useRef(0);
-  const recoverCacheAndReloadRef = useRef<() => Promise<boolean>>(async () => false);
 
   // Keep ref in sync with state for access in async callbacks
   useEffect(() => {
@@ -284,13 +279,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     };
   }, []);
 
-  const isCacheUnavailableError = useCallback((error: any): boolean => {
-    const status = error?.response?.status;
-    // Treat any 410 as cache unavailable, since responseType: 'blob' makes
-    // it impossible to reliably check the JSON body
-    return status === 410;
-  }, []);
-
   const dirtyPages = useMemo(
     () => getDirtyPages(groupsByPage, imagesByPage, originalGroupsRef.current, originalImagesRef.current),
     [groupsByPage, imagesByPage],
@@ -328,9 +316,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
       loadedImagePagesRef.current = new Set();
       loadingImagePagesRef.current = new Set();
       setSelectedPage(0);
-      setIsLazyMode(false);
-      setCachedJobId(null);
-      cachedJobIdRef.current = null;
       return;
     }
     const cloned = deepCloneDocument(document);
@@ -380,14 +365,11 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
   }, []);
 
   useEffect(() => {
-    // Clear old cached job when job ID changes
-    const previousJobId = previousCachedJobIdRef.current;
+    const previousJobId = cachedJobIdRef.current;
     if (previousJobId && previousJobId !== cachedJobId) {
-      console.log(`[PdfTextEditor] Clearing old cache for jobId: ${previousJobId}, new jobId: ${cachedJobId}`);
       clearCachedJob(previousJobId);
     }
-    // Update the previous jobId ref for next time
-    previousCachedJobIdRef.current = cachedJobId;
+    cachedJobIdRef.current = cachedJobId;
   }, [cachedJobId, clearCachedJob]);
 
   const initializePdfPreview = useCallback(
@@ -507,11 +489,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         );
       } catch (error) {
         console.error(`[loadImagesForPage] Failed to load images for page ${pageNumber}:`, error);
-        if (isCacheUnavailableError(error)) {
-          console.log('[loadImagesForPage] Cache expired, triggering automatic recovery...');
-          // Automatically recover by reloading the file
-          void recoverCacheAndReloadRef.current();
-        }
       } finally {
         loadingImagePagesRef.current.delete(pageIndex);
         setLoadingImagePages((prev) => {
@@ -521,7 +498,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         });
       }
     },
-    [isLazyMode, cachedJobId, isCacheUnavailableError],
+    [isLazyMode, cachedJobId],
   );
 
   const handleLoadFile = useCallback(
@@ -530,7 +507,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         return;
       }
 
-      lastLoadedFileRef.current = file;
       const requestId = loadRequestIdRef.current + 1;
       loadRequestIdRef.current = requestId;
 
@@ -579,35 +555,59 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
             message: 'Starting conversion...',
           });
 
-        let jobComplete = false;
-        let attempts = 0;
-        const maxAttempts = 600;
-        let pollDelay = 500;
+          let jobComplete = false;
+          let attempts = 0;
+          const maxAttempts = 600;
 
-        while (!jobComplete && attempts < maxAttempts) {
-          await new Promise((resolve) => setTimeout(resolve, pollDelay));
-          attempts += 1;
-          if (pollDelay < 10000) {
-            pollDelay = Math.min(10000, Math.floor(pollDelay * 1.5));
-          }
+          while (!jobComplete && attempts < maxAttempts) {
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            attempts += 1;
 
             try {
               const statusResponse = await apiClient.get(`/api/v1/general/job/${jobId}`);
               const jobStatus = statusResponse.data;
               console.log(`Job status (attempt ${attempts}):`, jobStatus);
 
-              const percent = Math.min(Math.max(jobStatus.progress ?? 0, 0), 100);
-              const stage = jobStatus.stage || 'processing';
-              const message = jobStatus.note || 'Converting PDF to JSON...';
-              const current = jobStatus.current ?? undefined;
-              const total = jobStatus.total ?? undefined;
-              setConversionProgress({
-                percent,
-                stage,
-                message,
-                current,
-                total,
-              });
+              if (jobStatus.notes && jobStatus.notes.length > 0) {
+                const lastNote = jobStatus.notes[jobStatus.notes.length - 1];
+                console.log('Latest note:', lastNote);
+                const matchWithCount = lastNote.match(
+                  /\[(\d+)%\]\s+(\w+):\s+(.+?)\s+\((\d+)\/(\d+)\)/,
+                );
+                if (matchWithCount) {
+                  const percent = parseInt(matchWithCount[1], 10);
+                  const stage = matchWithCount[2];
+                  const message = matchWithCount[3];
+                  const current = parseInt(matchWithCount[4], 10);
+                  const total = parseInt(matchWithCount[5], 10);
+                  setConversionProgress({
+                    percent,
+                    stage,
+                    message,
+                    current,
+                    total,
+                  });
+                } else {
+                  const match = lastNote.match(/\[(\d+)%\]\s+(\w+):\s+(.+)/);
+                  if (match) {
+                    const percent = parseInt(match[1], 10);
+                    const stage = match[2];
+                    const message = match[3];
+                    setConversionProgress({
+                      percent,
+                      stage,
+                      message,
+                    });
+                  }
+                }
+              } else if (jobStatus.progress !== undefined) {
+                const percent = Math.min(Math.max(jobStatus.progress, 0), 100);
+                setConversionProgress({
+                  percent,
+                  stage: jobStatus.stage || 'processing',
+                  message: jobStatus.note || 'Converting PDF to JSON...',
+                });
+              }
 
               if (jobStatus.complete) {
                 if (jobStatus.error) {
@@ -701,9 +701,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         setLoadedDocument(parsed);
         resetToDocument(parsed, groupingMode);
         setIsLazyMode(shouldUseLazyMode);
-        const newJobId = shouldUseLazyMode ? pendingJobId : null;
-        setCachedJobId(newJobId);
-        cachedJobIdRef.current = newJobId;
+        setCachedJobId(shouldUseLazyMode ? pendingJobId : null);
         setFileName(file.name);
         setErrorMessage(null);
       } catch (error: any) {
@@ -721,9 +719,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         setLoadedDocument(null);
         resetToDocument(null, groupingMode);
         clearPdfPreview();
-        setIsLazyMode(false);
-        setCachedJobId(null);
-        cachedJobIdRef.current = null;
 
         if (isPdf) {
           const errorMsg =
@@ -748,38 +743,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     [groupingMode, resetToDocument, t],
   );
 
-  const recoverCacheAndReload = useCallback(async () => {
-    if (cacheRecoveryInProgressRef.current) {
-      return false;
-    }
-    if (cacheRecoveryAttemptsRef.current >= 2) {
-      console.warn('[PdfTextEditor] Cache recovery limit reached');
-      return false;
-    }
-    cacheRecoveryAttemptsRef.current += 1;
-    const file = lastLoadedFileRef.current;
-    if (!file) {
-      console.warn('[PdfTextEditor] No file available for cache recovery');
-      return false;
-    }
-    cacheRecoveryInProgressRef.current = true;
-    try {
-      console.log('[PdfTextEditor] Automatically reloading file due to cache expiration...');
-      await handleLoadFile(file);
-      console.log('[PdfTextEditor] Cache recovery successful');
-      return true;
-    } catch (error) {
-      console.error('[PdfTextEditor] Cache recovery failed', error);
-      return false;
-    } finally {
-      cacheRecoveryInProgressRef.current = false;
-    }
-  }, [handleLoadFile]);
-
-  useEffect(() => {
-    recoverCacheAndReloadRef.current = recoverCacheAndReload;
-  }, [recoverCacheAndReload]);
-
   // Wrapper for loading files from the dropzone - adds to workbench first
   const handleLoadFileFromDropzone = useCallback(
     async (file: File) => {
@@ -1094,7 +1057,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
         try {
           const payload = buildPayload();
           if (!payload) {
-            throw new Error('Failed to build payload');
+            return;
           }
 
           const { document, filename } = payload;
@@ -1113,7 +1076,7 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
           const baseName = sanitizeBaseName(filename).replace(/-edited$/u, '');
           const expectedName = `${baseName || 'document'}.pdf`;
           const response = await apiClient.post(
-            `/api/v1/convert/pdf/text-editor/partial/${cachedJobIdRef.current}?filename=${encodeURIComponent(expectedName)}`,
+            `/api/v1/convert/pdf/text-editor/partial/${cachedJobId}?filename=${encodeURIComponent(expectedName)}`,
             partialDocument,
             {
               responseType: 'blob',
@@ -1137,7 +1100,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
             '[handleGeneratePdf] Incremental export failed, falling back to full export',
             incrementalError,
           );
-          // Fall through to full export below
         }
       }
 
@@ -1674,7 +1636,6 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     }, 0);
   }, [navigationActions, navigationState.selectedTool]);
 
-  // Register workbench view (re-runs when dependencies change)
   useEffect(() => {
     registerCustomWorkbenchView({
       id: WORKBENCH_VIEW_ID,
@@ -1685,29 +1646,23 @@ const PdfTextEditor = ({ onComplete, onError }: BaseToolProps) => {
     });
     setLeftPanelView('hidden');
     setCustomWorkbenchViewData(WORKBENCH_VIEW_ID, latestViewDataRef.current);
-  }, [
-    registerCustomWorkbenchView,
-    setCustomWorkbenchViewData,
-    setLeftPanelView,
-    viewLabel,
-  ]);
 
-  // Cleanup ONLY on component unmount (not on re-renders)
-  useEffect(() => {
     return () => {
-      // Clear backend cache when leaving the tool
-      const jobId = cachedJobIdRef.current;
-      if (jobId) {
-        console.log(`[PdfTextEditor] Cleaning up cached document on unmount: ${jobId}`);
-        apiClient.post(`/api/v1/convert/pdf/text-editor/clear-cache/${jobId}`).catch((error) => {
-          console.warn('[PdfTextEditor] Failed to clear cache on unmount:', error);
-        });
-      }
+      // Clear backend cache if we were using lazy loading
+      clearCachedJob(cachedJobIdRef.current);
       clearCustomWorkbenchViewData(WORKBENCH_VIEW_ID);
       unregisterCustomWorkbenchView(WORKBENCH_VIEW_ID);
       setLeftPanelView('toolPicker');
     };
-  }, []); // Empty deps = cleanup only on unmount
+  }, [
+    clearCachedJob,
+    clearCustomWorkbenchViewData,
+    registerCustomWorkbenchView,
+    setCustomWorkbenchViewData,
+    setLeftPanelView,
+    viewLabel,
+    unregisterCustomWorkbenchView,
+  ]);
 
   // Note: Compare tool doesn't auto-force workbench, and neither should we
   // The workbench should be set when the tool is selected via proper channels

frontend/src/desktop/components/SetupWizard/SaaSLoginScreen.tsx

@@ -14,7 +14,6 @@ interface SaaSLoginScreenProps {
   onLogin: (username: string, password: string) => Promise<void>;
   onOAuthSuccess: (userInfo: UserInfo) => Promise<void>;
   onSelfHostedClick: () => void;
-  onSwitchToSignup: () => void;
   loading: boolean;
   error: string | null;
 }
@@ -24,7 +23,6 @@ export const SaaSLoginScreen: React.FC<SaaSLoginScreenProps> = ({
   onLogin,
   onOAuthSuccess,
   onSelfHostedClick,
-  onSwitchToSignup,
   loading,
   error,
 }) => {
@@ -91,20 +89,6 @@ export const SaaSLoginScreen: React.FC<SaaSLoginScreenProps> = ({
         submitButtonText={t('setup.login.submit', 'Login')}
       />
 
-      <div className="navigation-link-container" style={{ marginTop: '0.5rem', textAlign: 'right' }}>
-        <button
-          type="button"
-          onClick={() => {
-            setValidationError(null);
-            onSwitchToSignup();
-          }}
-          className="navigation-link-button"
-          disabled={loading}
-        >
-          {t('signup.signUp', 'Sign Up')}
-        </button>
-      </div>
-
       <SelfHostedLink onClick={onSelfHostedClick} disabled={loading} />
     </>
   );

frontend/src/desktop/components/SetupWizard/SaaSSignupScreen.tsx

@@ -1,104 +0,0 @@
-import React, { useState } from 'react';
-import { useTranslation } from 'react-i18next';
-import LoginHeader from '@app/routes/login/LoginHeader';
-import ErrorMessage from '@app/routes/login/ErrorMessage';
-import SignupForm from '@app/routes/signup/SignupForm';
-import { useSignupFormValidation, SignupFieldErrors } from '@app/routes/signup/SignupFormValidation';
-import { authService } from '@app/services/authService';
-import '@app/routes/authShared/auth.css';
-
-interface SaaSSignupScreenProps {
-  loading: boolean;
-  error: string | null;
-  onLogin: (username: string, password: string) => Promise<void>;
-  onSwitchToLogin: () => void;
-}
-
-export const SaaSSignupScreen: React.FC<SaaSSignupScreenProps> = ({
-  loading,
-  error,
-  onLogin: _onLogin,
-  onSwitchToLogin: _onSwitchToLogin,
-}) => {
-  const { t } = useTranslation();
-  const [email, setEmail] = useState('');
-  const [password, setPassword] = useState('');
-  const [confirmPassword, setConfirmPassword] = useState('');
-  const [validationError, setValidationError] = useState<string | null>(null);
-  const [signupFieldErrors, setSignupFieldErrors] = useState<SignupFieldErrors>({});
-  const [signupSuccessMessage, setSignupSuccessMessage] = useState<string | null>(null);
-  const [isSignupSubmitting, setIsSignupSubmitting] = useState(false);
-  const { validateSignupForm } = useSignupFormValidation();
-
-  const displayError = error || validationError;
-
-  const handleSignupSubmit = async () => {
-    setValidationError(null);
-    setSignupSuccessMessage(null);
-    setSignupFieldErrors({});
-
-    const validation = validateSignupForm(email, password, confirmPassword);
-    if (!validation.isValid) {
-      setValidationError(validation.error);
-      setSignupFieldErrors(validation.fieldErrors || {});
-      return;
-    }
-
-    try {
-      setIsSignupSubmitting(true);
-      await authService.signUpSaas(email.trim(), password);
-      setSignupSuccessMessage(t('signup.checkEmailConfirmation', 'Check your email for a confirmation link to complete your registration.'));
-      setSignupFieldErrors({});
-      setValidationError(null);
-    } catch (err) {
-      setSignupSuccessMessage(null);
-      const message = err instanceof Error ? err.message : t('signup.unexpectedError', { message: 'Unknown error' });
-      setValidationError(message);
-    } finally {
-      setIsSignupSubmitting(false);
-    }
-  };
-
-  return (
-    <>
-      <LoginHeader
-        title={t('signup.title', 'Create an account')}
-        subtitle={t('signup.subtitle', 'Join Stirling PDF')}
-      />
-
-      <ErrorMessage error={displayError} />
-      {signupSuccessMessage && (
-        <div className="success-message">
-          <p className="success-message-text">{signupSuccessMessage}</p>
-        </div>
-      )}
-
-      <SignupForm
-        email={email}
-        password={password}
-        confirmPassword={confirmPassword}
-        setEmail={(value) => {
-          setEmail(value);
-          setValidationError(null);
-          setSignupFieldErrors({});
-        }}
-        setPassword={(value) => {
-          setPassword(value);
-          setValidationError(null);
-          setSignupFieldErrors({});
-        }}
-        setConfirmPassword={(value) => {
-          setConfirmPassword(value);
-          setValidationError(null);
-          setSignupFieldErrors({});
-        }}
-        onSubmit={handleSignupSubmit}
-        isSubmitting={loading || isSignupSubmitting}
-        fieldErrors={signupFieldErrors}
-        showName={false}
-        showTerms={false}
-      />
-
-    </>
-  );
-};

frontend/src/desktop/components/SetupWizard/index.tsx

@@ -2,20 +2,16 @@ import React, { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { DesktopAuthLayout } from '@app/components/SetupWizard/DesktopAuthLayout';
 import { SaaSLoginScreen } from '@app/components/SetupWizard/SaaSLoginScreen';
-import { SaaSSignupScreen } from '@app/components/SetupWizard/SaaSSignupScreen';
 import { ServerSelectionScreen } from '@app/components/SetupWizard/ServerSelectionScreen';
 import { SelfHostedLoginScreen } from '@app/components/SetupWizard/SelfHostedLoginScreen';
 import { ServerConfig, connectionModeService } from '@app/services/connectionModeService';
 import { authService, UserInfo } from '@app/services/authService';
 import { tauriBackendService } from '@app/services/tauriBackendService';
 import { STIRLING_SAAS_URL } from '@desktop/constants/connection';
-import { listen } from '@tauri-apps/api/event';
-import { useEffect } from 'react';
 import '@app/routes/authShared/auth.css';
 
 enum SetupStep {
   SaaSLogin,
-  SaaSSignup,
   ServerSelection,
   SelfHostedLogin,
 }
@@ -84,16 +80,6 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({ onComplete }) => {
     setActiveStep(SetupStep.ServerSelection);
   };
 
-  const handleSwitchToSignup = () => {
-    setError(null);
-    setActiveStep(SetupStep.SaaSSignup);
-  };
-
-  const handleSwitchToLogin = () => {
-    setError(null);
-    setActiveStep(SetupStep.SaaSLogin);
-  };
-
   const handleServerSelection = (config: ServerConfig) => {
     setServerConfig(config);
     setError(null);
@@ -142,48 +128,6 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({ onComplete }) => {
     }
   };
 
-  useEffect(() => {
-    const unsubscribePromise = listen<string>('deep-link', async (event) => {
-      const url = event.payload;
-      if (!url) return;
-
-      try {
-        const parsed = new URL(url);
-
-        // Supabase sends tokens in the URL hash
-        const hash = parsed.hash.replace(/^#/, '');
-        const params = new URLSearchParams(hash);
-        const accessToken = params.get('access_token');
-        const type = params.get('type') || parsed.searchParams.get('type');
-
-        if (!type || (type !== 'signup' && type !== 'recovery' && type !== 'magiclink')) {
-          return;
-        }
-
-        if (!accessToken) {
-          console.error('[SetupWizard] Deep link missing access_token');
-          return;
-        }
-
-        setLoading(true);
-        setError(null);
-
-        await authService.completeSupabaseSession(accessToken, serverConfig?.url || STIRLING_SAAS_URL);
-        await connectionModeService.switchToSaaS(serverConfig?.url || STIRLING_SAAS_URL);
-        tauriBackendService.startBackend().catch(console.error);
-        onComplete();
-      } catch (err) {
-        console.error('[SetupWizard] Failed to handle deep link', err);
-        setError(err instanceof Error ? err.message : 'Failed to complete signup');
-        setLoading(false);
-      }
-    });
-
-    return () => {
-      void unsubscribePromise.then((unsub) => unsub());
-    };
-  }, [onComplete, serverConfig?.url]);
-
   const handleBack = () => {
     setError(null);
     if (activeStep === SetupStep.SelfHostedLogin) {
@@ -191,8 +135,6 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({ onComplete }) => {
     } else if (activeStep === SetupStep.ServerSelection) {
       setActiveStep(SetupStep.SaaSLogin);
       setServerConfig({ url: STIRLING_SAAS_URL });
-    } else if (activeStep === SetupStep.SaaSSignup) {
-      setActiveStep(SetupStep.SaaSLogin);
     }
   };
 
@@ -205,21 +147,11 @@ export const SetupWizard: React.FC<SetupWizardProps> = ({ onComplete }) => {
           onLogin={handleSaaSLogin}
           onOAuthSuccess={handleSaaSLoginOAuth}
           onSelfHostedClick={handleSelfHostedClick}
-          onSwitchToSignup={handleSwitchToSignup}
           loading={loading}
           error={error}
         />
       )}
 
-      {activeStep === SetupStep.SaaSSignup && (
-        <SaaSSignupScreen
-          loading={loading}
-          error={error}
-          onLogin={handleSaaSLogin}
-          onSwitchToLogin={handleSwitchToLogin}
-        />
-      )}
-
       {activeStep === SetupStep.ServerSelection && (
         <ServerSelectionScreen
           onSelect={handleServerSelection}

frontend/src/desktop/constants/connection.ts

@@ -6,12 +6,6 @@
 // The SaaS authentication server
 export const STIRLING_SAAS_URL: string = import.meta.env.VITE_SAAS_SERVER_URL || '';
 
-// SaaS signup URL for creating new cloud accounts
-export const STIRLING_SAAS_SIGNUP_URL: string = import.meta.env.VITE_SAAS_SIGNUP_URL || '';
-
 // Supabase publishable key from environment variable
 // Used for SaaS authentication
 export const SUPABASE_KEY: string = import.meta.env.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb';
-
-// Desktop deep link callback for Supabase email confirmations
-export const DESKTOP_DEEP_LINK_CALLBACK = 'stirlingpdf://auth/callback';

frontend/src/desktop/services/authService.ts

@@ -1,6 +1,6 @@
 import { invoke } from '@tauri-apps/api/core';
 import axios from 'axios';
-import { DESKTOP_DEEP_LINK_CALLBACK, STIRLING_SAAS_URL, SUPABASE_KEY } from '@app/constants/connection';
+import { STIRLING_SAAS_URL, SUPABASE_KEY } from '@app/constants/connection';
 
 export interface UserInfo {
   username: string;
@@ -131,67 +131,6 @@ export class AuthService {
     this.notifyListeners();
   }
 
-  async completeSupabaseSession(accessToken: string, serverUrl: string): Promise<UserInfo> {
-    if (!accessToken || !accessToken.trim()) {
-      throw new Error('Invalid access token');
-    }
-    if (!SUPABASE_KEY) {
-      throw new Error('VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY is not configured');
-    }
-
-    await this.saveTokenEverywhere(accessToken);
-
-    const userInfo = await this.fetchSupabaseUserInfo(serverUrl, accessToken);
-
-    await invoke('save_user_info', {
-      username: userInfo.username,
-      email: userInfo.email || null,
-    });
-
-    this.setAuthStatus('authenticated', userInfo);
-    return userInfo;
-  }
-
-  async signUpSaas(email: string, password: string): Promise<void> {
-    if (!STIRLING_SAAS_URL) {
-      throw new Error('VITE_SAAS_SERVER_URL is not configured');
-    }
-    if (!SUPABASE_KEY) {
-      throw new Error('VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY is not configured');
-    }
-
-    const redirectParam = encodeURIComponent(DESKTOP_DEEP_LINK_CALLBACK);
-    const signupUrl = `${STIRLING_SAAS_URL.replace(/\/$/, '')}/auth/v1/signup?redirect_to=${redirectParam}`;
-
-    try {
-      const response = await axios.post(
-        signupUrl,
-        { email, password, email_redirect_to: DESKTOP_DEEP_LINK_CALLBACK },
-        {
-          headers: {
-            'Content-Type': 'application/json;charset=UTF-8',
-            apikey: SUPABASE_KEY,
-            Authorization: `Bearer ${SUPABASE_KEY}`,
-          },
-        }
-      );
-
-      if (response.status >= 400) {
-        throw new Error('Sign up failed');
-      }
-    } catch (error) {
-      if (axios.isAxiosError(error)) {
-        const message =
-          error.response?.data?.error_description ||
-          error.response?.data?.msg ||
-          error.response?.data?.message ||
-          error.message;
-        throw new Error(message || 'Sign up failed');
-      }
-      throw error instanceof Error ? error : new Error('Sign up failed');
-    }
-  }
-
   async login(serverUrl: string, username: string, password: string): Promise<UserInfo> {
     try {
       console.log('Logging in to:', serverUrl);

frontend/src/proprietary/auth/springAuthClient.test.ts

@@ -343,7 +343,7 @@ describe('SpringAuthClient', () => {
       });
 
       const result = await springAuth.signInWithOAuth({
-        provider: '/oauth2/authorization/github',
+        provider: 'github',
         options: { redirectTo: '/auth/callback' },
       });
 

frontend/src/proprietary/auth/springAuthClient.ts

@@ -60,7 +60,6 @@ export interface User {
   enabled?: boolean;
   is_anonymous?: boolean;
   isFirstLogin?: boolean;
-  authenticationType?: string;
   app_metadata?: Record<string, any>;
 }
 
@@ -250,11 +249,11 @@ class SpringAuthClient {
   }
 
   /**
-   * Sign in with OAuth/SAML provider (GitHub, Google, Authentik, etc.)
-   * This redirects to the Spring OAuth2/SAML2 authorization endpoint
+   * Sign in with OAuth provider (GitHub, Google, Authentik, etc.)
+   * This redirects to the Spring OAuth2 authorization endpoint
    *
-   * @param params.provider - Full auth path from backend (e.g., '/oauth2/authorization/google', '/saml2/authenticate/stirling')
-   *                          The backend provides the complete path including the auth type and provider ID
+   * @param params.provider - OAuth provider ID (e.g., 'github', 'google', 'authentik', 'mycompany')
+   *                          Can be any known provider or custom string - the backend determines available providers
    */
   async signInWithOAuth(params: {
     provider: OAuthProvider;
@@ -264,16 +263,15 @@ class SpringAuthClient {
       const redirectPath = normalizeRedirectPath(params.options?.redirectTo);
       persistRedirectPath(redirectPath);
 
-      // Use the full path provided by the backend
-      // This supports both OAuth2 (/oauth2/authorization/...) and SAML2 (/saml2/authenticate/...)
-      const redirectUrl = params.provider;
-      // console.log('[SpringAuth] Redirecting to SSO:', redirectUrl);
+      // Redirect to Spring OAuth2 endpoint (Vite will proxy to backend)
+      const redirectUrl = `/oauth2/authorization/${params.provider}`;
+      // console.log('[SpringAuth] Redirecting to OAuth:', redirectUrl);
       // Use window.location.assign for full page navigation
       window.location.assign(redirectUrl);
       return { error: null };
     } catch (error) {
       return {
-        error: { message: error instanceof Error ? error.message : 'SSO redirect failed' },
+        error: { message: error instanceof Error ? error.message : 'OAuth redirect failed' },
       };
     }
   }

frontend/src/proprietary/components/shared/config/configSections/AccountSection.tsx

@@ -24,17 +24,6 @@ const AccountSection: React.FC = () => {
   const [usernameError, setUsernameError] = useState('');
   const [usernameSubmitting, setUsernameSubmitting] = useState(false);
 
-  const authTypeFromMetadata = useMemo(() => {
-    const metadata = user?.app_metadata as { authType?: string; authenticationType?: string } | undefined;
-    return metadata?.authenticationType ?? metadata?.authType;
-  }, [user?.app_metadata]);
-
-  const normalizedAuthType = useMemo(
-    () => (user?.authenticationType ?? authTypeFromMetadata ?? '').toLowerCase(),
-    [authTypeFromMetadata, user?.authenticationType]
-  );
-  const isSsoUser = useMemo(() => ['sso', 'oauth2', 'saml2'].includes(normalizedAuthType), [normalizedAuthType]);
-
   const userIdentifier = useMemo(() => user?.email || user?.username || '', [user?.email, user?.username]);
 
   const redirectToLogin = useCallback(() => {
@@ -52,11 +41,6 @@ const AccountSection: React.FC = () => {
   const handlePasswordSubmit = async (event: React.FormEvent) => {
     event.preventDefault();
 
-    if (isSsoUser) {
-      setPasswordError(t('settings.security.password.ssoDisabled', 'Password changes are managed by your identity provider.'));
-      return;
-    }
-
     if (!currentPassword || !newPassword || !confirmPassword) {
       setPasswordError(t('settings.security.password.required', 'All fields are required.'));
       return;
@@ -97,11 +81,6 @@ const AccountSection: React.FC = () => {
   const handleUsernameSubmit = async (event: React.FormEvent) => {
     event.preventDefault();
 
-    if (isSsoUser) {
-      setUsernameError(t('changeCreds.ssoManaged', 'Your account is managed by your identity provider.'));
-      return;
-    }
-
     if (!currentPasswordForUsername || !newUsername) {
       setUsernameError(t('settings.security.password.required', 'All fields are required.'));
       return;
@@ -153,35 +132,23 @@ const AccountSection: React.FC = () => {
               : t('account.accountSettings', 'Account Settings')}
           </Text>
 
-          <Stack gap="xs">
-            {isSsoUser && (
-              <Alert icon={<LocalIcon icon="info" width="1rem" height="1rem" />} color="blue" variant="light">
-                {t('changeCreds.ssoManaged', 'Your account is managed by your identity provider.')}
-              </Alert>
-            )}
+          <Group gap="sm" wrap="wrap">
+            <Button leftSection={<LocalIcon icon="key-rounded" />} onClick={() => setPasswordModalOpen(true)}>
+              {t('settings.security.password.update', 'Update password')}
+            </Button>
 
-            <Group gap="sm" wrap="wrap">
-              {!isSsoUser && (
-                <Button leftSection={<LocalIcon icon="key-rounded" />} onClick={() => setPasswordModalOpen(true)}>
-                  {t('settings.security.password.update', 'Update password')}
-                </Button>
-              )}
+            <Button
+              variant="light"
+              leftSection={<LocalIcon icon="edit-rounded" />}
+              onClick={() => setUsernameModalOpen(true)}
+            >
+              {t('account.changeUsername', 'Change username')}
+            </Button>
 
-              {!isSsoUser && (
-                <Button
-                  variant="light"
-                  leftSection={<LocalIcon icon="edit-rounded" />}
-                  onClick={() => setUsernameModalOpen(true)}
-                >
-                  {t('account.changeUsername', 'Change username')}
-                </Button>
-              )}
-
-              <Button variant="outline" color="red" leftSection={<LocalIcon icon="logout-rounded" />} onClick={handleLogout}>
-                {t('settings.general.logout', 'Log out')}
-              </Button>
-            </Group>
-          </Stack>
+            <Button variant="outline" color="red" leftSection={<LocalIcon icon="logout-rounded" />} onClick={handleLogout}>
+              {t('settings.general.logout', 'Log out')}
+            </Button>
+          </Group>
         </Stack>
       </Paper>
 

frontend/src/proprietary/routes/Login.test.tsx

@@ -295,9 +295,9 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use full path directly, NOT map to 'oidc'
+      // Should use 'authentik' directly, NOT map to 'oidc'
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: '/oauth2/authorization/authentik',
+        provider: 'authentik',
         options: { redirectTo: '/auth/callback' }
       });
     });
@@ -338,10 +338,10 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use full path directly - this is the critical fix
+      // Should use 'mycompany' directly - this is the critical fix
       // Previously it would map unknown providers to 'oidc'
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: '/oauth2/authorization/mycompany',
+        provider: 'mycompany',
         options: { redirectTo: '/auth/callback' }
       });
     });
@@ -382,9 +382,9 @@ describe('Login', () => {
     await user.click(oauthButton);
 
     await waitFor(() => {
-      // Should use full path when explicitly configured
+      // Should use 'oidc' when explicitly configured
       expect(springAuth.signInWithOAuth).toHaveBeenCalledWith({
-        provider: '/oauth2/authorization/oidc',
+        provider: 'oidc',
         options: { redirectTo: '/auth/callback' }
       });
     });

frontend/src/proprietary/routes/Login.tsx

@@ -109,12 +109,13 @@ export default function Login() {
           updateSupportedLanguages(data.languages, data.defaultLocale);
         }
 
-        // Use the full paths from providerList as provider identifiers
-        // The backend provides paths like "/oauth2/authorization/google" or "/saml2/authenticate/stirling"
-        // We'll use these full paths so the auth client knows where to redirect
-        const providerPaths = Object.keys(data.providerList || {});
+        // Extract provider IDs from the providerList map
+        // The keys are like "/oauth2/authorization/google" - extract the last part
+        const providerIds = Object.keys(data.providerList || {})
+          .map(key => key.split('/').pop())
+          .filter((id): id is string => id !== undefined);
 
-        setEnabledProviders(providerPaths);
+        setEnabledProviders(providerIds);
       } catch (err) {
         console.error('[Login] Failed to fetch enabled providers:', err);
       }

frontend/src/proprietary/routes/login/OAuthButtons.tsx

@@ -26,7 +26,7 @@ interface OAuthButtonsProps {
   onProviderClick: (provider: OAuthProvider) => void
   isSubmitting: boolean
   layout?: 'vertical' | 'grid' | 'icons'
-  enabledProviders?: OAuthProvider[]  // List of full auth paths from backend (e.g., '/oauth2/authorization/google', '/saml2/authenticate/stirling')
+  enabledProviders?: OAuthProvider[]  // List of enabled provider IDs from backend
 }
 
 export default function OAuthButtons({ onProviderClick, isSubmitting, layout = 'vertical', enabledProviders = [] }: OAuthButtonsProps) {
@@ -37,24 +37,19 @@ export default function OAuthButtons({ onProviderClick, isSubmitting, layout = '
     ? Object.keys(oauthProviderConfig)
     : enabledProviders;
 
-  // Build provider list - extract provider ID from full path for display
-  const providers = providersToShow.map(pathOrId => {
-    // Extract provider ID from full path (e.g., '/saml2/authenticate/stirling' -> 'stirling')
-    const providerId = pathOrId.split('/').pop() || pathOrId;
-
-    if (providerId in oauthProviderConfig) {
+  // Build provider list - use provider ID to determine icon and label
+  const providers = providersToShow.map(id => {
+    if (id in oauthProviderConfig) {
       // Known provider - use predefined icon and label
       return {
-        id: pathOrId,  // Keep full path for redirect
-        providerId,    // Store extracted ID for display lookup
-        ...oauthProviderConfig[providerId]
+        id,
+        ...oauthProviderConfig[id]
       };
     }
     // Unknown provider - use generic icon and capitalize ID for label
     return {
-      id: pathOrId,  // Keep full path for redirect
-      providerId,    // Store extracted ID for display lookup
-      label: providerId.charAt(0).toUpperCase() + providerId.slice(1),
+      id,
+      label: id.charAt(0).toUpperCase() + id.slice(1),
       file: GENERIC_PROVIDER_ICON
     };
   });

frontend/vite.config.ts

@@ -55,24 +55,12 @@ export default defineConfig(({ mode }) => {
           secure: false,
           xfwd: true,
         },
-        '/saml2': {
-          target: 'http://localhost:8080',
-          changeOrigin: true,
-          secure: false,
-          xfwd: true,
-        },
         '/login/oauth2': {
           target: 'http://localhost:8080',
           changeOrigin: true,
           secure: false,
           xfwd: true,
         },
-        '/login/saml2': {
-          target: 'http://localhost:8080',
-          changeOrigin: true,
-          secure: false,
-          xfwd: true,
-        },
         '/swagger-ui': {
           target: 'http://localhost:8080',
           changeOrigin: true,