resolving conflicts

# Conflicts:
#	frontend/public/locales/en-US/translation.json
#	frontend/src/core/components/AppProviders.tsx
#	frontend/src/core/components/viewer/useViewerRightRailButtons.tsx

.dockerignore

@@ -5,7 +5,6 @@ frontend/dist
 frontend/build
 frontend/.vite
 frontend/.tauri
-frontend/src-tauri/target
 
 # Gradle build artifacts
 .gradle

.github/scripts/check_language_json.py

@@ -1,6 +1,6 @@
 """
 Author: Ludy87
-Description: This script processes TOML translation files for localization checks. It compares translation files in a branch with
+Description: This script processes JSON translation files for localization checks. It compares translation files in a branch with
 a reference file to ensure consistency. The script performs two main checks:
 1. Verifies that the number of translation keys in the translation files matches the reference file.
 2. Ensures that all keys in the translation files are present in the reference file and vice versa.
@@ -9,10 +9,10 @@ The script also provides functionality to update the translation files to match
 adjusting the format.
 
 Usage:
-    python check_language_toml.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+    python check_language_json.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
 """
 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_json.py --reference-file frontend/public/locales/en-GB/translation.json --branch "" --files frontend/public/locales/de-DE/translation.json frontend/public/locales/fr-FR/translation.json
 
 import copy
 import glob
@@ -20,14 +20,12 @@ import os
 import argparse
 import re
 import json
-import tomllib  # Python 3.11+ (stdlib)
-import tomli_w  # For writing TOML files
 
 
 def find_duplicate_keys(file_path, keys=None, prefix=""):
     """
-    Identifies duplicate keys in a TOML file (including nested keys).
-    :param file_path: Path to the TOML file.
+    Identifies duplicate keys in a JSON file (including nested keys).
+    :param file_path: Path to the JSON file.
     :param keys: Dictionary to track keys (used for recursion).
     :param prefix: Prefix for nested keys.
     :return: List of tuples (key, first_occurrence_path, duplicate_path).
@@ -37,9 +35,8 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
 
     duplicates = []
 
-    # Load TOML file
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def process_dict(obj, current_prefix=""):
         for key, value in obj.items():
@@ -57,18 +54,18 @@ def find_duplicate_keys(file_path, keys=None, prefix=""):
     return duplicates
 
 
-# Maximum size for TOML files (e.g., 500 KB)
+# Maximum size for JSON files (e.g., 500 KB)
 MAX_FILE_SIZE = 500 * 1024
 
 
-def parse_toml_file(file_path):
+def parse_json_file(file_path):
     """
-    Parses a TOML translation file and returns a flat dictionary of all keys.
-    :param file_path: Path to the TOML file.
+    Parses a JSON translation file and returns a flat dictionary of all keys.
+    :param file_path: Path to the JSON file.
     :return: Dictionary with flattened keys.
     """
-    with open(file_path, 'rb') as file:
-        data = tomllib.load(file)
+    with open(file_path, "r", encoding="utf-8") as file:
+        data = json.load(file)
 
     def flatten_dict(d, parent_key="", sep="."):
         items = {}
@@ -102,37 +99,38 @@ def unflatten_dict(d, sep="."):
     return result
 
 
-def write_toml_file(file_path, updated_properties):
+def write_json_file(file_path, updated_properties):
     """
-    Writes updated properties back to the TOML file.
-    :param file_path: Path to the TOML file.
+    Writes updated properties back to the JSON file.
+    :param file_path: Path to the JSON file.
     :param updated_properties: Dictionary of updated properties to write.
     """
     nested_data = unflatten_dict(updated_properties)
 
-    with open(file_path, "wb") as file:
-        tomli_w.dump(nested_data, file)
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        json.dump(nested_data, file, ensure_ascii=False, indent=2)
+        file.write("\n")  # Add trailing newline
 
 
 def update_missing_keys(reference_file, file_list, branch=""):
     """
     Updates missing keys in the translation files based on the reference file.
-    :param reference_file: Path to the reference TOML file.
+    :param reference_file: Path to the reference JSON file.
     :param file_list: List of translation files to update.
     :param branch: Branch where the files are located.
     """
-    reference_properties = parse_toml_file(reference_file)
+    reference_properties = parse_json_file(reference_file)
 
     for file_path in file_list:
         basename_current_file = os.path.basename(os.path.join(branch, file_path))
         if (
             basename_current_file == os.path.basename(reference_file)
-            or not file_path.endswith(".toml")
+            or not file_path.endswith(".json")
             or not os.path.dirname(file_path).endswith("locales")
         ):
             continue
 
-        current_properties = parse_toml_file(os.path.join(branch, file_path))
+        current_properties = parse_json_file(os.path.join(branch, file_path))
         updated_properties = {}
 
         for ref_key, ref_value in reference_properties.items():
@@ -143,16 +141,16 @@ def update_missing_keys(reference_file, file_list, branch=""):
                 # Add missing key with reference value
                 updated_properties[ref_key] = ref_value
 
-        write_toml_file(os.path.join(branch, file_path), updated_properties)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
 
 
 def check_for_missing_keys(reference_file, file_list, branch):
     update_missing_keys(reference_file, file_list, branch)
 
 
-def read_toml_keys(file_path):
+def read_json_keys(file_path):
     if os.path.isfile(file_path) and os.path.exists(file_path):
-        return parse_toml_file(file_path)
+        return parse_json_file(file_path)
     return {}
 
 
@@ -162,7 +160,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
     report = []
     report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
-    reference_keys = read_toml_keys(reference_file)
+    reference_keys = read_json_keys(reference_file)
     has_differences = False
 
     only_reference_file = True
@@ -199,12 +197,12 @@ def check_for_differences(reference_file, file_list, branch, actor):
         ):
             continue
 
-        if not file_normpath.endswith(".toml") or basename_current_file != "translation.toml":
+        if not file_normpath.endswith(".json") or basename_current_file != "translation.json":
             continue
 
         only_reference_file = False
         report.append(f"#### 📃 **File Check:** `{locale_dir}/{basename_current_file}`")
-        current_keys = read_toml_keys(os.path.join(branch, file_path))
+        current_keys = read_json_keys(os.path.join(branch, file_path))
         reference_key_count = len(reference_keys)
         current_key_count = len(current_keys)
 
@@ -274,7 +272,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
         report.append("## ❌ Overall Check Status: **_Failed_**")
         report.append("")
         report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.json](https://github.com/Stirling-Tools/Stirling-PDF/blob/V2/frontend/public/locales/en-GB/translation.json)"
         )
     else:
         report.append("## ✅ Overall Check Status: **_Success_**")
@@ -288,7 +286,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
 
 
 if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Find missing keys in TOML translation files")
+    parser = argparse.ArgumentParser(description="Find missing keys")
     parser.add_argument(
         "--actor",
         required=False,
@@ -339,9 +337,9 @@ if __name__ == "__main__":
                     "public",
                     "locales",
                     "*",
-                    "translation.toml",
+                    "translation.json",
                 )
             )
         update_missing_keys(args.reference_file, file_list)
     else:
-        check_for_differences(args.reference_file, file_list, args.branch, args.actor)
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/scripts/check_language_properties.py

@@ -0,0 +1,403 @@
+"""
+Author: Ludy87
+Description: This script processes .properties files for localization checks. It compares translation files in a branch with
+a reference file to ensure consistency. The script performs two main checks:
+1. Verifies that the number of lines (including comments and empty lines) in the translation files matches the reference file.
+2. Ensures that all keys in the translation files are present in the reference file and vice versa.
+
+The script also provides functionality to update the translation files to match the reference file by adding missing keys and
+adjusting the format.
+
+Usage:
+    python check_language_properties.py --reference-file <path_to_reference_file> --branch <branch_name> [--actor <actor_name>] [--files <list_of_changed_files>]
+"""
+# Sample for Windows:
+# python .github/scripts/check_language_properties.py --reference-file src\main\resources\messages_en_GB.properties --branch "" --files src\main\resources\messages_de_DE.properties src\main\resources\messages_uk_UA.properties
+
+import copy
+import glob
+import os
+import argparse
+import re
+
+
+def find_duplicate_keys(file_path):
+    """
+    Identifies duplicate keys in a .properties file.
+    :param file_path: Path to the .properties file.
+    :return: List of tuples (key, first_occurrence_line, duplicate_line).
+    """
+    keys = {}
+    duplicates = []
+
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Skip empty lines and comments
+            if not stripped_line or stripped_line.startswith("#"):
+                continue
+
+            # Split the line into key and value
+            if "=" in stripped_line:
+                key, _ = stripped_line.split("=", 1)
+                key = key.strip()
+
+                # Check if the key already exists
+                if key in keys:
+                    duplicates.append((key, keys[key], line_number))
+                else:
+                    keys[key] = line_number
+
+    return duplicates
+
+
+# Maximum size for properties files (e.g., 200 KB)
+MAX_FILE_SIZE = 200 * 1024
+
+
+def parse_properties_file(file_path):
+    """
+    Parses a .properties file and returns a structured list of its contents.
+    :param file_path: Path to the .properties file.
+    :return: List of dictionaries representing each line in the file.
+    """
+    properties_list = []
+    with open(file_path, "r", encoding="utf-8") as file:
+        for line_number, line in enumerate(file, start=1):
+            stripped_line = line.strip()
+
+            # Handle empty lines
+            if not stripped_line:
+                properties_list.append(
+                    {"line_number": line_number, "type": "empty", "content": ""}
+                )
+                continue
+
+            # Handle comments
+            if stripped_line.startswith("#"):
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "comment",
+                        "content": stripped_line,
+                    }
+                )
+                continue
+
+            # Handle key-value pairs
+            match = re.match(r"^([^=]+)=(.*)$", line)
+            if match:
+                key, value = match.groups()
+                properties_list.append(
+                    {
+                        "line_number": line_number,
+                        "type": "entry",
+                        "key": key.strip(),
+                        "value": value.strip(),
+                    }
+                )
+
+    return properties_list
+
+
+def write_json_file(file_path, updated_properties):
+    """
+    Writes updated properties back to the file in their original format.
+    :param file_path: Path to the .properties file.
+    :param updated_properties: List of updated properties to write.
+    """
+    updated_lines = {entry["line_number"]: entry for entry in updated_properties}
+
+    # Sort lines by their numbers and retain comments and empty lines
+    all_lines = sorted(set(updated_lines.keys()))
+
+    original_format = []
+    for line in all_lines:
+        if line in updated_lines:
+            entry = updated_lines[line]
+        else:
+            entry = None
+        ref_entry = updated_lines[line]
+        if ref_entry["type"] in ["comment", "empty"]:
+            original_format.append(ref_entry)
+        elif entry is None:
+            # Add missing entries from the reference file
+            original_format.append(ref_entry)
+        elif entry["type"] == "entry":
+            # Replace entries with those from the current JSON
+            original_format.append(entry)
+
+    # Write the updated content back to the file
+    with open(file_path, "w", encoding="utf-8", newline="\n") as file:
+        for entry in original_format:
+            if entry["type"] == "comment":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "empty":
+                file.write(f"{entry['content']}\n")
+            elif entry["type"] == "entry":
+                file.write(f"{entry['key']}={entry['value']}\n")
+
+
+def update_missing_keys(reference_file, file_list, branch=""):
+    """
+    Updates missing keys in the translation files based on the reference file.
+    :param reference_file: Path to the reference .properties file.
+    :param file_list: List of translation files to update.
+    :param branch: Branch where the files are located.
+    """
+    reference_properties = parse_properties_file(reference_file)
+    for file_path in file_list:
+        basename_current_file = os.path.basename(os.path.join(branch, file_path))
+        if (
+            basename_current_file == os.path.basename(reference_file)
+            or not file_path.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+
+        current_properties = parse_properties_file(os.path.join(branch, file_path))
+        updated_properties = []
+        for ref_entry in reference_properties:
+            ref_entry_copy = copy.deepcopy(ref_entry)
+            for current_entry in current_properties:
+                if current_entry["type"] == "entry":
+                    if ref_entry_copy["type"] != "entry":
+                        continue
+                    if ref_entry_copy["key"].lower() == current_entry["key"].lower():
+                        ref_entry_copy["value"] = current_entry["value"]
+            updated_properties.append(ref_entry_copy)
+        write_json_file(os.path.join(branch, file_path), updated_properties)
+
+
+def check_for_missing_keys(reference_file, file_list, branch):
+    update_missing_keys(reference_file, file_list, branch)
+
+
+def read_properties(file_path):
+    if os.path.isfile(file_path) and os.path.exists(file_path):
+        with open(file_path, "r", encoding="utf-8") as file:
+            return file.read().splitlines()
+    return [""]
+
+
+def check_for_differences(reference_file, file_list, branch, actor):
+    reference_branch = reference_file.split("/")[0]
+    basename_reference_file = os.path.basename(reference_file)
+
+    report = []
+    report.append(f"#### 🔄 Reference Branch: `{reference_branch}`")
+    reference_lines = read_properties(reference_file)
+    has_differences = False
+
+    only_reference_file = True
+
+    file_arr = file_list
+
+    if len(file_list) == 1:
+        file_arr = file_list[0].split()
+    base_dir = os.path.abspath(
+        os.path.join(os.getcwd(), "app", "core", "src", "main", "resources")
+    )
+
+    for file_path in file_arr:
+        file_normpath = os.path.normpath(file_path)
+        absolute_path = os.path.abspath(file_normpath)
+        # Verify that file is within the expected directory
+        if not absolute_path.startswith(base_dir):
+            raise ValueError(f"Unsafe file found: {file_normpath}")
+        # Verify file size before processing
+        if os.path.getsize(os.path.join(branch, file_normpath)) > MAX_FILE_SIZE:
+            raise ValueError(
+                f"The file {file_normpath} is too large and could pose a security risk."
+            )
+
+        basename_current_file = os.path.basename(os.path.join(branch, file_normpath))
+        if (
+            basename_current_file == basename_reference_file
+            or (
+                # only local windows command
+                not file_normpath.startswith(
+                    os.path.join(
+                        "", "app", "core", "src", "main", "resources", "messages_"
+                    )
+                )
+                and not file_normpath.startswith(
+                    os.path.join(
+                        os.getcwd(),
+                        "app",
+                        "core",
+                        "src",
+                        "main",
+                        "resources",
+                        "messages_",
+                    )
+                )
+            )
+            or not file_normpath.endswith(".properties")
+            or not basename_current_file.startswith("messages_")
+        ):
+            continue
+        only_reference_file = False
+        report.append(f"#### 📃 **File Check:** `{basename_current_file}`")
+        current_lines = read_properties(os.path.join(branch, file_path))
+        reference_line_count = len(reference_lines)
+        current_line_count = len(current_lines)
+
+        if reference_line_count != current_line_count:
+            report.append("")
+            report.append("1. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            has_differences = True
+            if reference_line_count > current_line_count:
+                report.append(
+                    f"    - **_Mismatched line count_**: {reference_line_count} (reference) vs {current_line_count} (current). Comments, empty lines, or translation strings are missing."
+                )
+            elif reference_line_count < current_line_count:
+                report.append(
+                    f"    - **_Too many lines_**: {reference_line_count} (reference) vs {current_line_count} (current). Please verify if there is an additional line that needs to be removed."
+                )
+        else:
+            report.append("1. **Test Status:** ✅ **_Passed_**")
+
+        # Check for missing or extra keys
+        current_keys = []
+        reference_keys = []
+        for line in current_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                current_keys.append(key)
+        for line in reference_lines:
+            if not line.startswith("#") and line != "" and "=" in line:
+                key, _ = line.split("=", 1)
+                reference_keys.append(key)
+
+        current_keys_set = set(current_keys)
+        reference_keys_set = set(reference_keys)
+        missing_keys = current_keys_set.difference(reference_keys_set)
+        extra_keys = reference_keys_set.difference(current_keys_set)
+        missing_keys_list = list(missing_keys)
+        extra_keys_list = list(extra_keys)
+
+        if missing_keys_list or extra_keys_list:
+            has_differences = True
+            missing_keys_str = "`, `".join(missing_keys_list)
+            extra_keys_str = "`, `".join(extra_keys_list)
+            report.append("2. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            if missing_keys_list:
+                spaces_keys_list = []
+                for key in missing_keys_list:
+                    if " " in key:
+                        spaces_keys_list.append(key)
+                if spaces_keys_list:
+                    spaces_keys_str = "`, `".join(spaces_keys_list)
+                    report.append(
+                        f"    - **_Keys containing unnecessary spaces_**: `{spaces_keys_str}`!"
+                    )
+                report.append(
+                    f"    - **_Extra keys in `{basename_current_file}`_**: `{missing_keys_str}` that are not present in **_`{basename_reference_file}`_**."
+                )
+            if extra_keys_list:
+                report.append(
+                    f"    - **_Missing keys in `{basename_reference_file}`_**: `{extra_keys_str}` that are not present in **_`{basename_current_file}`_**."
+                )
+        else:
+            report.append("2. **Test Status:** ✅ **_Passed_**")
+
+        if find_duplicate_keys(os.path.join(branch, file_normpath)):
+            has_differences = True
+            output = "\n".join(
+                [
+                    f"      - `{key}`: first at line {first}, duplicate at `line {duplicate}`"
+                    for key, first, duplicate in find_duplicate_keys(
+                        os.path.join(branch, file_normpath)
+                    )
+                ]
+            )
+            report.append("3. **Test Status:** ❌ **_Failed_**")
+            report.append("  - **Issue:**")
+            report.append("    - duplicate entries were found:")
+            report.append(output)
+        else:
+            report.append("3. **Test Status:** ✅ **_Passed_**")
+
+        report.append("")
+        report.append("---")
+        report.append("")
+    if has_differences:
+        report.append("## ❌ Overall Check Status: **_Failed_**")
+        report.append("")
+        report.append(
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/resources/messages_en_GB.properties)"
+        )
+    else:
+        report.append("## ✅ Overall Check Status: **_Success_**")
+        report.append("")
+        report.append(
+            f"Thanks @{actor} for your help in keeping the translations up to date."
+        )
+
+    if not only_reference_file:
+        print("\n".join(report))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Find missing keys")
+    parser.add_argument(
+        "--actor",
+        required=False,
+        help="Actor from PR.",
+    )
+    parser.add_argument(
+        "--reference-file",
+        required=True,
+        help="Path to the reference file.",
+    )
+    parser.add_argument(
+        "--branch",
+        type=str,
+        required=True,
+        help="Branch name.",
+    )
+    parser.add_argument(
+        "--check-file",
+        type=str,
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="+",
+        required=False,
+        help="List of changed files, separated by spaces.",
+    )
+    args = parser.parse_args()
+
+    # Sanitize --actor input to avoid injection attacks
+    if args.actor:
+        args.actor = re.sub(r"[^a-zA-Z0-9_\\-]", "", args.actor)
+
+    # Sanitize --branch input to avoid injection attacks
+    if args.branch:
+        args.branch = re.sub(r"[^a-zA-Z0-9\\-]", "", args.branch)
+
+    file_list = args.files
+    if file_list is None:
+        if args.check_file:
+            file_list = [args.check_file]
+        else:
+            file_list = glob.glob(
+                os.path.join(
+                    os.getcwd(),
+                    "app",
+                    "core",
+                    "src",
+                    "main",
+                    "resources",
+                    "messages_*.properties",
+                )
+            )
+        update_missing_keys(args.reference_file, file_list)
+    else:
+        check_for_differences(args.reference_file, file_list, args.branch, args.actor)

.github/workflows/PR-Demo-Comment-with-react.yml

@@ -14,7 +14,6 @@ jobs:
     permissions:
       issues: write
     if: |
-      vars.CI_PROFILE != 'lite' &&
       github.event.issue.pull_request &&
       (
         contains(github.event.comment.body, 'prdeploy') ||
@@ -181,7 +180,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: VERSION_TAG=alpha

.github/workflows/build.yml

@@ -262,13 +262,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - docker-rev: docker/embedded/Dockerfile
-            artifact-suffix: Dockerfile
-          - docker-rev: docker/embedded/Dockerfile.ultra-lite
-            artifact-suffix: Dockerfile.ultra-lite
-          - docker-rev: docker/embedded/Dockerfile.fat
-            artifact-suffix: Dockerfile.fat
+        docker-rev: ["Dockerfile", "Dockerfile.ultra-lite", "Dockerfile.fat"]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -278,13 +272,6 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Free disk space on runner
-        run: |
-          echo "Disk space before cleanup:" && df -h
-          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
-          docker system prune -af || true
-          echo "Disk space after cleanup:" && df -h
-
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
@@ -314,7 +301,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./${{ matrix.docker-rev }}
+          file: ./docker/backend/${{ matrix.docker-rev }}
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -326,7 +313,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: reports-docker-${{ matrix.artifact-suffix }}
+          name: reports-docker-${{ matrix.docker-rev }}
           path: |
             build/reports/tests/
             build/test-results/

.github/workflows/check_properties.yml

@@ -1,14 +1,19 @@
-name: Check TOML Translation Files on PR
-
-# This workflow validates TOML translation files
+name: Check Properties Files on PR
 
 on:
   pull_request_target:
     types: [opened, synchronize, reopened]
     paths:
-      - "frontend/public/locales/*/translation.toml"
+      - "app/core/src/main/resources/messages_*.properties"
 
 # cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
   cancel-in-progress: true
@@ -68,22 +73,22 @@ jobs:
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
-          # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
-            echo "Error: PR number is empty"
-            exit 1
-          fi
-          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
-          # Check if any files were found
-          if [ ! -s changed_files.txt ]; then
-            echo "No TOML translation files changed in this PR"
-            echo "Workflow will exit early as no relevant files to check"
-            exit 0
-          fi
-          echo "Found $(wc -l < changed_files.txt) matching TOML files"
+                   # Check if PR number exists
+            if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+              echo "Error: PR number is empty"
+              exit 1
+            fi
+            # Get changed files and filter for properties files, handle case where no matches are found
+            gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^app/core/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR"
+            # Check if any files were found
+            if [ ! -s changed_files.txt ]; then
+              echo "No properties files changed in this PR"
+              echo "Workflow will exit early as no relevant files to check"
+              exit 0
+            fi
+            echo "Found $(wc -l < changed_files.txt) matching properties files"
 
-      - name: Determine reference file
+      - name: Determine reference file test
         id: determine-file
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -120,11 +125,11 @@ jobs:
               pull_number: prNumber,
             });
 
-            // Filter for relevant TOML files based on the PR changes
+            // Filter for relevant files based on the PR changes
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^app\/core\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -164,16 +169,16 @@ jobs:
 
             // Determine reference file
             let referenceFilePath;
-            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
+            if (changedFiles.includes("app/core/src/main/resources/messages_en_GB.properties")) {
               console.log("Using PR branch reference file.");
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: prRepoOwner,
                 repo: prRepoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: branch,
               });
 
-              referenceFilePath = "pr-branch-translation-en-GB.toml";
+              referenceFilePath = "pr-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             } else {
@@ -181,11 +186,11 @@ jobs:
               const { data: fileContent } = await github.rest.repos.getContent({
                 owner: repoOwner,
                 repo: repoName,
-                path: "frontend/public/locales/en-GB/translation.toml",
+                path: "app/core/src/main/resources/messages_en_GB.properties",
                 ref: "main",
               });
 
-              referenceFilePath = "main-branch-translation-en-GB.toml";
+              referenceFilePath = "main-branch-messages_en_GB.properties";
               const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
               fs.writeFileSync(referenceFilePath, content);
             }
@@ -193,20 +198,11 @@ jobs:
             console.log(`Reference file path: ${referenceFilePath}`);
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Python dependencies
-        run: |
-          pip install tomli-w
-
       - name: Run Python script to check files
         id: run-check
         run: |
-          echo "Running Python script to check TOML files..."
-          python .github/scripts/check_language_toml.py \
+          echo "Running Python script to check files..."
+          python .github/scripts/check_language_properties.py \
             --actor ${{ github.event.pull_request.user.login }} \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
@@ -217,7 +213,7 @@ jobs:
         id: capture-output
         run: |
           if [ -f result.txt ] && [ -s result.txt ]; then
-            echo "Capturing output..."
+            echo "Test, capturing output..."
             SCRIPT_OUTPUT=$(cat result.txt)
             echo "SCRIPT_OUTPUT<<EOF" >> $GITHUB_ENV
             echo "$SCRIPT_OUTPUT" >> $GITHUB_ENV
@@ -231,7 +227,7 @@ jobs:
               echo "FAIL_JOB=false" >> $GITHUB_ENV
             fi
           else
-            echo "No output found."
+            echo "No update found."
             echo "SCRIPT_OUTPUT=" >> $GITHUB_ENV
             echo "FAIL_JOB=false" >> $GITHUB_ENV
           fi
@@ -253,7 +249,7 @@ jobs:
               issue_number: issueNumber
             });
 
-            const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
+            const comment = comments.data.find(c => c.body.includes("## 🚀 Translation Verification Summary"));
 
             // Only update or create comments by the action user
             const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
@@ -264,7 +260,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 comment_id: comment.id,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Updated existing comment.");
             } else if (!comment) {
@@ -273,7 +269,7 @@ jobs:
                 owner: repoOwner,
                 repo: repoName,
                 issue_number: issueNumber,
-                body: `## 🌐 TOML Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
+                body: `## 🚀 Translation Verification Summary\n\n\n${SCRIPT_OUTPUT}\n`
               });
               console.log("Created new comment.");
             } else {
@@ -291,6 +287,6 @@ jobs:
         run: |
           echo "Cleaning up temporary files..."
           rm -rf pr-branch
-          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
+          rm -f pr-branch-messages_en_GB.properties main-branch-messages_en_GB.properties changed_files.txt result.txt
           echo "Cleanup complete."
         continue-on-error: true # Ensure cleanup runs even if previous steps fail

.github/workflows/multiOSReleases.yml

@@ -31,7 +31,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}

.github/workflows/push-docker-v2.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches:
       - V2-master
-      - alljavadocker
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -24,7 +23,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-24.04-8core
     permissions:
       packages: write
@@ -95,10 +93,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}
             type=raw,value=latest
 
-      - name: Generate tags for latest (alljavadocker branch - test)
+      - name: Generate tags for latest (V2-demo branch - test)
         id: meta-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -112,7 +110,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./docker/Dockerfile.unified
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -151,10 +149,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat
             type=raw,value=latest-fat
 
-      - name: Generate tags for latest-fat (alljavadocker branch - test)
+      - name: Generate tags for latest-fat (V2-demo branch - test)
         id: meta-fat-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -168,7 +166,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./docker/Dockerfile.unified
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -205,10 +203,10 @@ jobs:
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite
             type=raw,value=latest-ultra-lite
 
-      - name: Generate tags for ultra-lite (alljavadocker branch - test)
+      - name: Generate tags for ultra-lite (V2-demo branch - test)
         id: meta-lite-test
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
-        if: github.ref == 'refs/heads/alljavadocker'
+        if: github.ref == 'refs/heads/V2-demo'
         with:
           images: |
             ghcr.io/stirling-tools/stirling-pdf-test
@@ -222,7 +220,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./docker/Dockerfile.unified-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/push-docker.yml

@@ -24,7 +24,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -108,7 +107,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -153,7 +152,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         with:
           context: .
-          file: ./docker/embedded/Dockerfile.ultra-lite
+          file: ./Dockerfile.ultra-lite
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -184,7 +183,7 @@ jobs:
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .
-          file: ./docker/embedded/Dockerfile.fat
+          file: ./Dockerfile.fat
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/scorecards.yml

@@ -17,7 +17,6 @@ permissions: read-all
 
 jobs:
   analysis:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:

.github/workflows/sonarqube.yml

@@ -27,7 +27,6 @@ permissions:
 
 jobs:
   sonarqube:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/stale.yml

@@ -10,7 +10,6 @@ permissions:
 
 jobs:
   stale:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/swagger.yml

@@ -23,7 +23,6 @@ permissions:
 
 jobs:
   push:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/sync_files.yml

@@ -0,0 +1,122 @@
+name: Sync Files
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "build.gradle"
+      - "README.md"
+      - "app/core/src/main/resources/messages_*.properties"
+      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
+      - "scripts/ignore_translation.toml"
+
+# cancel in-progress jobs if a new job is triggered
+# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
+# or a pull request is updated.
+# It helps to save resources and time by ensuring that only the latest commit is built and tested
+# This is particularly useful for long-running jobs that may take a while to complete.
+# The `group` is set to a combination of the workflow name, event name, and branch name.
+# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
+# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-files:
+    runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+          cache: "pip" # caching pip dependencies
+
+      - name: Sync translation property files
+        run: |
+          python .github/scripts/check_language_properties.py --reference-file "app/core/src/main/resources/messages_en_GB.properties" --branch main
+
+      - name: Commit translation files
+        run: |
+          git add app/core/src/main/resources/messages_*.properties
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
+
+      - name: Install dependencies
+        # Wheels-only + Hash-Pinning
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
+
+      - name: Sync README.md
+        run: |
+          python scripts/counter_translation.py
+
+      - name: Run git add
+        run: |
+          git add README.md scripts/ignore_translation.toml
+          git diff --staged --quiet || git commit -m ":memo: Sync README.md & scripts/ignore_translation.toml" || echo "No changes detected"
+
+      - name: Create Pull Request
+        if: always()
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: Update files
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync_readme
+          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          body: |
+            ### Description of Changes
+
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+
+            #### **1. Synchronization of Translation Files**
+            - Updated translation files (`messages_*.properties`) to reflect changes in the reference file `messages_en_GB.properties`.
+            - Ensured consistency and synchronization across all supported language files.
+            - Highlighted any missing or incomplete translations.
+
+            #### **2. Update README.md**
+            - Generated the translation progress table in `README.md`.
+            - Added a summary of the current translation status for all supported languages.
+            - Included up-to-date statistics on translation coverage.
+
+            #### **Why these changes are necessary**
+            - Keeps translation files aligned with the latest reference updates.
+            - Ensures the documentation reflects the current translation progress.
+
+            ---
+
+            Auto-generated by [create-pull-request][1].
+
+            [1]: https://github.com/peter-evans/create-pull-request
+          draft: false
+          delete-branch: true
+          labels: github-actions
+          sign-commits: true
+          add-paths: |
+            README.md
+            app/core/src/main/resources/messages_*.properties

.github/workflows/sync_files_v2.yml

@@ -1,15 +1,15 @@
-name: Sync Files (TOML)
+name: Sync Files V2
 
 on:
   workflow_dispatch:
   push:
     branches:
-      - main
+      - V2
       - syncLangTest
     paths:
       - "build.gradle"
       - "README.md"
-      - "frontend/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.json"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
       - "scripts/ignore_translation.toml"
 
@@ -52,25 +52,21 @@ jobs:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
 
-      - name: Install Python dependencies
+      - name: Sync translation JSON files
         run: |
-          pip install tomli-w
-
-      - name: Sync translation TOML files
-        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main
+          python .github/scripts/check_language_json.py --reference-file "frontend/public/locales/en-GB/translation.json" --branch V2
 
       - name: Commit translation files
         run: |
-          git add frontend/public/locales/*/translation.toml
-          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"
+          git add frontend/public/locales/*/translation.json
+          git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected"
 
-      - name: Install README dependencies
+      - name: Install dependencies
         run: pip install --require-hashes -r ./.github/scripts/requirements_sync_readme.txt
 
       - name: Sync README.md
         run: |
-          python scripts/counter_translation_v3.py
+          python scripts/counter_translation_v2.py
 
       - name: Run git add
         run: |
@@ -86,22 +82,21 @@ jobs:
           committer: ${{ steps.setup-bot.outputs.committer }}
           author: ${{ steps.setup-bot.outputs.committer }}
           signoff: true
-          branch: sync_readme_v3
-          base: main
-          title: ":globe_with_meridians: Sync Translations + Update README Progress Table"
+          branch: sync_readme_v2
+          base: V2
+          title: ":globe_with_meridians: [V2] Sync Translations + Update README Progress Table"
           body: |
             ### Description of Changes
 
-            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:
+            This Pull Request was automatically generated to synchronize updates to translation files and documentation for the **V2 branch**. Below are the details of the changes made:
 
             #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.json`) to reflect changes in the reference file `en-GB/translation.json`.
             - Ensured consistency and synchronization across all supported language files.
             - Highlighted any missing or incomplete translations.
-            - **Format**: TOML
 
             #### **2. Update README.md**
-            - Generated the translation progress table in `README.md` using `counter_translation_v3.py`.
+            - Generated the translation progress table in `README.md`.
             - Added a summary of the current translation status for all supported languages.
             - Included up-to-date statistics on translation coverage.
 
@@ -120,5 +115,4 @@ jobs:
           sign-commits: true
           add-paths: |
             README.md
-            frontend/public/locales/*/translation.toml
-            scripts/ignore_translation.toml
+            frontend/public/locales/*/translation.json

.github/workflows/tauri-build.yml

@@ -28,7 +28,6 @@ permissions:
 
 jobs:
   determine-matrix:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -637,8 +636,6 @@ jobs:
           if [ "${{ needs.build.result }}" = "success" ]; then
             echo "✅ All Tauri builds completed successfully!"
             echo "Artifacts are ready for distribution."
-          elif [ "${{ needs.build.result }}" = "skipped" ]; then
-            echo "⏭️  Tauri builds skipped (CI lite mode enabled)"
           else
             echo "❌ Some Tauri builds failed."
             echo "Please check the logs and fix any issues."

.github/workflows/testdriver.yml

@@ -21,7 +21,6 @@ permissions:
 
 jobs:
   deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
@@ -67,7 +66,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: .
-          file: ./docker/embedded/Dockerfile
+          file: ./Dockerfile
           push: true
           tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
           build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}

ADDING_TOOLS.md

@@ -202,10 +202,10 @@ const [ToolName] = (props: BaseToolProps) => {
 ## 5. Add Translations
 Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.
 
-**File to update:** `frontend/public/locales/en-GB/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.json`
 
 **Required Translation Keys**:
-```toml
+```json
 {
   "home": {
     "[toolName]": {
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-GB` files** - other langu
 ```
 
 **Translation Notes:**
-- **Only update `en-GB/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.json`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions

README.md

@@ -1,69 +1,173 @@
-<p align="center">
-  <img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80" alt="Stirling PDF logo">
-</p>
+<p align="center"><img src="https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/main/docs/stirling.png" width="80"></p>
+<h1 align="center">Stirling-PDF</h1>
 
-<h1 align="center">Stirling PDF - The Open-Source PDF Platform</h1>
+[![Docker Pulls](https://img.shields.io/docker/pulls/frooodle/s-pdf)](https://hub.docker.com/r/frooodle/s-pdf)
+[![Discord](https://img.shields.io/discord/1068636748814483718?label=Discord)](https://discord.gg/HYmhKj45pU)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge)](https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF)
+[![GitHub Repo stars](https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social)](https://github.com/Stirling-Tools/stirling-pdf)
 
-Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.
+<a href="https://www.producthunt.com/posts/stirling-pdf?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-stirling&#0045;pdf" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=641239&theme=light" alt="Stirling&#0032;PDF - Open&#0032;source&#0032;locally&#0032;hosted&#0032;web&#0032;PDF&#0032;editor | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/apps/new?repo=https://github.com/Stirling-Tools/Stirling-PDF/tree/digitalOcean&refcode=c3210994b1af)
 
-<p align="center">
-  <a href="https://hub.docker.com/r/stirlingtools/stirling-pdf">
-    <img src="https://img.shields.io/docker/pulls/frooodle/s-pdf" alt="Docker Pulls">
-  </a>
-  <a href="https://discord.gg/HYmhKj45pU">
-    <img src="https://img.shields.io/discord/1068636748814483718?label=Discord" alt="Discord">
-  </a>
-  <a href="https://scorecard.dev/viewer/?uri=github.com/Stirling-Tools/Stirling-PDF">
-    <img src="https://api.scorecard.dev/projects/github.com/Stirling-Tools/Stirling-PDF/badge" alt="OpenSSF Scorecard">
-  </a>
-  <a href="https://github.com/Stirling-Tools/stirling-pdf">
-    <img src="https://img.shields.io/github/stars/stirling-tools/stirling-pdf?style=social" alt="GitHub Repo stars">
-  </a>
-</p>
+[Stirling-PDF](https://www.stirlingpdf.com) is a robust, locally hosted web-based PDF manipulation tool using Docker. It enables you to carry out various operations on PDF files, including splitting, merging, converting, reorganizing, adding images, rotating, compressing, and more. This locally hosted web application has evolved to encompass a comprehensive set of features, addressing all your PDF requirements.
 
-![Stirling PDF - Dashboard](images/home-light.png)
+All files and PDFs exist either exclusively on the client side, reside in server memory only during task execution, or temporarily reside in a file solely for the execution of the task. Any file downloaded by the user will have been deleted from the server by that point.
 
-## Key Capabilities
+Homepage: [https://stirlingpdf.com](https://stirlingpdf.com)
 
-- **Everywhere you work** - Desktop client, browser UI, and self-hosted server with a private API.
-- **50+ PDF tools** - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
-- **Automation & workflows** - No-code pipelines direct in UI with APIs to process millions of PDFs.
-- **Enterprise‑grade** - SSO, auditing, and flexible on‑prem deployments.
-- **Developer platform** - REST APIs available for nearly all tools to integrate into your existing systems.
-- **Global UI** - Interface available in 40+ languages.
+All documentation available at [https://docs.stirlingpdf.com/](https://docs.stirlingpdf.com/)
 
-For a full feature list, see the docs: **https://docs.stirlingpdf.com**
+![stirling-home](images/stirling-home.jpg)
 
-## Quick Start
+## Features
 
-```bash
-docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
-```
+- 50+ PDF Operations
+- Parallel file processing and downloads
+- Dark mode support
+- Custom download options
+- Custom 'Pipelines' to run multiple features in a automated queue
+- API for integration with external scripts
+- Optional Login and Authentication support (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/System%20and%20Security) for documentation)
+- Database Backup and Import (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/DATABASE) for documentation)
+- Enterprise features like SSO (see [here](https://docs.stirlingpdf.com/Advanced%20Configuration/Single%20Sign-On%20Configuration) for documentation)
 
-Then open: http://localhost:8080
+## PDF Features
 
-For full installation options (including desktop and Kubernetes), see our [Documentation Guide](https://docs.stirlingpdf.com/#documentation-guide).
+### Page Operations
 
-## Resources
+- View and modify PDFs - View multi-page PDFs with custom viewing, sorting, and searching. Plus, on-page edit features like annotating, drawing, and adding text and images. (Using PDF.js with Joxit and Liberation fonts)
+- Full interactive GUI for merging/splitting/rotating/moving PDFs and their pages
+- Merge multiple PDFs into a single resultant file
+- Split PDFs into multiple files at specified page numbers or extract all pages as individual files
+- Reorganize PDF pages into different orders
+- Rotate PDFs in 90-degree increments
+- Remove pages
+- Multi-page layout (format PDFs into a multi-paged page)
+- Scale page contents size by set percentage
+- Adjust contrast
+- Crop PDF
+- Auto-split PDF (with physically scanned page dividers)
+- Extract page(s)
+- Convert PDF to a single page
+- Overlay PDFs on top of each other
+- PDF to a single page
+- Split PDF by sections
 
-- [**Documentation**](https://docs.stirlingpdf.com)
-- [**Homepage**](https://stirling.com)
-- [**API Docs**](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)
-- [**Server Plan & Enterprise**](https://docs.stirlingpdf.com/Paid-Offerings)
+### Conversion Operations
 
-## Support
+- Convert PDFs to and from images
+- Convert any common file to PDF (using LibreOffice)
+- Convert PDF to Word/PowerPoint/others (using LibreOffice)
+- Convert HTML to PDF
+- Convert PDF to XML
+- Convert PDF to CSV
+- URL to PDF
+- Markdown to PDF
 
-- **Community** [Discord](https://discord.gg/HYmhKj45pU)
-- **Bug Reports**: [Github issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+### Security & Permissions
 
-## Contributing
+- Add and remove passwords
+- Change/set PDF permissions
+- Add watermark(s)
+- Certify/sign PDFs
+- Sanitize PDFs
+- Auto-redact text
 
-We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+### Other Operations
 
-For development setup, see the [Developer Guide](DeveloperGuide.md).
+- Add/generate/write signatures
+- Split by Size or PDF
+- Repair PDFs
+- Detect and remove blank pages
+- Compare two PDFs and show differences in text
+- Add images to PDFs
+- Compress PDFs to decrease their filesize (using qpdf)
+- Extract images from PDF
+- Remove images from PDF
+- Extract images from scans
+- Remove annotations
+- Add page numbers
+- Auto-rename files by detecting PDF header text
+- OCR on PDF (using Tesseract OCR)
+- PDF/A conversion (using LibreOffice)
+- Edit metadata
+- Flatten PDFs
+- Get all information on a PDF to view or export as JSON
+- Show/detect embedded JavaScript
 
-For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).
 
-## License
 
-Stirling PDF is open-core. See [LICENSE](LICENSE) for details.
+# 📖 Get Started
+
+Visit our comprehensive documentation at [docs.stirlingpdf.com](https://docs.stirlingpdf.com) for:
+
+- Installation guides for all platforms
+- Configuration options
+- Feature documentation
+- API reference
+- Security setup
+- Enterprise features
+
+
+## Supported Languages
+
+Stirling-PDF currently supports 40 languages!
+
+| Language                                     | Progress                               |
+| -------------------------------------------- | -------------------------------------- |
+| Arabic (العربية) (ar_AR)                        | ![87%](https://geps.dev/progress/87)   |
+| Azerbaijani (Azərbaycan Dili) (az_AZ)        | ![86%](https://geps.dev/progress/86)   |
+| Basque (Euskara) (eu_ES)                     | ![86%](https://geps.dev/progress/86)   |
+| Bulgarian (Български) (bg_BG)                | ![86%](https://geps.dev/progress/86)   |
+| Catalan (Català) (ca_CA)                     | ![85%](https://geps.dev/progress/85)   |
+| Croatian (Hrvatski) (hr_HR)                  | ![86%](https://geps.dev/progress/86)   |
+| Czech (Česky) (cs_CZ)                        | ![84%](https://geps.dev/progress/84)   |
+| Danish (Dansk) (da_DK)                       | ![85%](https://geps.dev/progress/85)   |
+| Dutch (Nederlands) (nl_NL)                   | ![85%](https://geps.dev/progress/85)   |
+| English (English) (en_GB)                    | ![100%](https://geps.dev/progress/100) |
+| English (US) (en_US)                         | ![100%](https://geps.dev/progress/100) |
+| French (Français) (fr_FR)                    | ![85%](https://geps.dev/progress/85)   |
+| German (Deutsch) (de_DE)                     | ![86%](https://geps.dev/progress/86)   |
+| Greek (Ελληνικά) (el_GR)                     | ![86%](https://geps.dev/progress/86)   |
+| Hindi (हिंदी) (hi_IN)                          | ![86%](https://geps.dev/progress/86)   |
+| Hungarian (Magyar) (hu_HU)                   | ![86%](https://geps.dev/progress/86)   |
+| Indonesian (Bahasa Indonesia) (id_ID)        | ![85%](https://geps.dev/progress/85)   |
+| Irish (Gaeilge) (ga_IE)                      | ![86%](https://geps.dev/progress/86)   |
+| Italian (Italiano) (it_IT)                   | ![85%](https://geps.dev/progress/85)   |
+| Japanese (日本語) (ja_JP)                    | ![86%](https://geps.dev/progress/86)   |
+| Korean (한국어) (ko_KR)                      | ![86%](https://geps.dev/progress/86)   |
+| Norwegian (Norsk) (no_NB)                    | ![86%](https://geps.dev/progress/86)   |
+| Persian (فارسی) (fa_IR)                      | ![86%](https://geps.dev/progress/86)   |
+| Polish (Polski) (pl_PL)                      | ![86%](https://geps.dev/progress/86)   |
+| Portuguese (Português) (pt_PT)               | ![86%](https://geps.dev/progress/86)   |
+| Portuguese Brazilian (Português) (pt_BR)     | ![86%](https://geps.dev/progress/86)   |
+| Romanian (Română) (ro_RO)                    | ![85%](https://geps.dev/progress/85)   |
+| Russian (Русский) (ru_RU)                    | ![86%](https://geps.dev/progress/86)   |
+| Serbian Latin alphabet (Srpski) (sr_LATN_RS) | ![86%](https://geps.dev/progress/86)   |
+| Simplified Chinese (简体中文) (zh_CN)         | ![87%](https://geps.dev/progress/87)   |
+| Slovakian (Slovensky) (sk_SK)                | ![86%](https://geps.dev/progress/86)   |
+| Slovenian (Slovenščina) (sl_SI)              | ![86%](https://geps.dev/progress/86)   |
+| Spanish (Español) (es_ES)                    | ![86%](https://geps.dev/progress/86)   |
+| Swedish (Svenska) (sv_SE)                    | ![86%](https://geps.dev/progress/86)   |
+| Thai (ไทย) (th_TH)                           | ![86%](https://geps.dev/progress/86)   |
+| Tibetan (བོད་ཡིག་) (bo_CN)                     | ![65%](https://geps.dev/progress/65) |
+| Traditional Chinese (繁體中文) (zh_TW)        | ![87%](https://geps.dev/progress/87)   |
+| Turkish (Türkçe) (tr_TR)                     | ![86%](https://geps.dev/progress/86)   |
+| Ukrainian (Українська) (uk_UA)               | ![86%](https://geps.dev/progress/86)   |
+| Vietnamese (Tiếng Việt) (vi_VN)              | ![86%](https://geps.dev/progress/86)   |
+| Malayalam (മലയാളം) (ml_IN)              | ![73%](https://geps.dev/progress/73)   |
+
+## Stirling PDF Enterprise
+
+Stirling PDF offers an Enterprise edition of its software. This is the same great software but with added features, support and comforts.
+Check out our [Enterprise docs](https://docs.stirlingpdf.com/Pro)
+
+
+## 🤝 Looking to contribute?
+
+Join our community:
+- [Contribution Guidelines](CONTRIBUTING.md)
+- [Translation Guide (How to add custom languages)](devGuide/HowToAddNewLanguage.md)
+- [Developer Guide](devGuide/DeveloperGuide.md)
+- [Issue Tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues)
+- [Discord Community](https://discord.gg/HYmhKj45pU)

app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java

@@ -112,6 +112,7 @@ public class ApplicationProperties {
     @Data
     public static class Security {
         private Boolean enableLogin;
+        private Boolean csrfDisabled;
         private InitialLogin initialLogin = new InitialLogin();
         private OAUTH2 oauth2 = new OAUTH2();
         private SAML2 saml2 = new SAML2();
@@ -574,16 +575,6 @@ public class ApplicationProperties {
         private String username;
         @ToString.Exclude private String password;
         private String from;
-        // STARTTLS upgrades a plain SMTP connection to TLS after connecting (RFC 3207)
-        private Boolean startTlsEnable = true;
-        private Boolean startTlsRequired;
-        // SSL/TLS wrapper for implicit TLS (typically port 465)
-        private Boolean sslEnable;
-        // Hostnames or patterns (e.g., "smtp.example.com" or "*") to trust for TLS certificates;
-        // defaults to "*" (trust all) when not set
-        private String sslTrust;
-        // Enables hostname verification for TLS connections
-        private Boolean sslCheckServerIdentity;
     }
 
     @Data
@@ -599,6 +590,7 @@ public class ApplicationProperties {
             private boolean ssoAutoLogin;
             private boolean database;
             private CustomMetadata customMetadata = new CustomMetadata();
+            private Chatbot chatbot = new Chatbot();
 
             @Data
             public static class CustomMetadata {
@@ -617,6 +609,61 @@ public class ApplicationProperties {
                             : producer;
                 }
             }
+
+            @Data
+            public static class Chatbot {
+                private boolean enabled;
+                private boolean alphaWarning = true;
+                private Cache cache = new Cache();
+                private Models models = new Models();
+                private Rag rag = new Rag();
+                private Ocr ocr = new Ocr();
+                private Audit audit = new Audit();
+                private long maxPromptCharacters = 4000;
+                private double minConfidenceNano = 0.65;
+                private Usage usage = new Usage();
+
+                @Data
+                public static class Cache {
+                    private long ttlMinutes = 720;
+                    private long maxEntries = 200;
+                    private long maxDocumentCharacters = 200000;
+                }
+
+                @Data
+                public static class Models {
+                    private String provider = "openai";
+                    private String primary = "gpt-5-nano";
+                    private String fallback = "gpt-5-mini";
+                    private String embedding = "text-embedding-3-small";
+                    private double topP = 0.95;
+                    private long connectTimeoutMillis = 10000;
+                    private long readTimeoutMillis = 60000;
+                }
+
+                @Data
+                public static class Rag {
+                    private int chunkSizeTokens = 512;
+                    private int chunkOverlapTokens = 128;
+                    private int topK = 8;
+                }
+
+                @Data
+                public static class Ocr {
+                    private boolean enabledByDefault;
+                }
+
+                @Data
+                public static class Audit {
+                    private boolean enabled = true;
+                }
+
+                @Data
+                public static class Usage {
+                    private long perUserMonthlyTokens = 200000;
+                    private double warnAtRatio = 0.7;
+                }
+            }
         }
 
         @Data

app/common/src/main/java/stirling/software/common/service/PostHogService.java

@@ -254,7 +254,10 @@ public class PostHogService {
                 properties,
                 "security_enableLogin",
                 applicationProperties.getSecurity().getEnableLogin());
-        addIfNotEmpty(properties, "security_csrfDisabled", true);
+        addIfNotEmpty(
+                properties,
+                "security_csrfDisabled",
+                applicationProperties.getSecurity().getCsrfDisabled());
         addIfNotEmpty(
                 properties,
                 "security_loginAttemptCount",

app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java

@@ -39,7 +39,6 @@ public class RequestUriUtils {
         // Specific static files bundled with the frontend
         if (normalizedUri.equals("/robots.txt")
                 || normalizedUri.equals("/favicon.ico")
-                || normalizedUri.equals("/manifest.json")
                 || normalizedUri.equals("/site.webmanifest")
                 || normalizedUri.equals("/manifest-classic.json")
                 || normalizedUri.equals("/index.html")) {
@@ -162,9 +161,10 @@ public class RequestUriUtils {
                 // enableLogin)
                 || trimmedUri.startsWith(
                         "/api/v1/ui-data/footer-info") // Public footer configuration
+                || trimmedUri.startsWith("/v1/api-docs")
                 || trimmedUri.startsWith("/api/v1/invite/validate")
                 || trimmedUri.startsWith("/api/v1/invite/accept")
-                || trimmedUri.startsWith("/v1/api-docs");
+                || trimmedUri.contains("/v1/api-docs");
     }
 
     private static String stripContextPath(String contextPath, String requestURI) {

app/core/src/main/java/stirling/software/SPDF/config/InitialSetup.java

@@ -34,6 +34,7 @@ public class InitialSetup {
     public void init() throws IOException {
         initUUIDKey();
         initSecretKey();
+        initEnableCSRFSecurity();
         initLegalUrls();
         initSetAppVersion();
         GeneralUtils.extractPipeline();
@@ -59,6 +60,18 @@ public class InitialSetup {
         }
     }
 
+    public void initEnableCSRFSecurity() throws IOException {
+        if (GeneralUtils.isVersionHigher(
+                "0.46.0", applicationProperties.getAutomaticallyGenerated().getAppVersion())) {
+            Boolean csrf = applicationProperties.getSecurity().getCsrfDisabled();
+            if (!csrf) {
+                GeneralUtils.saveKeyToSettings("security.csrfDisabled", false);
+                GeneralUtils.saveKeyToSettings("system.enableAnalytics", true);
+                applicationProperties.getSecurity().setCsrfDisabled(false);
+            }
+        }
+    }
+
     public void initLegalUrls() throws IOException {
         // Initialize Terms and Conditions
         String termsUrl = applicationProperties.getLegal().getTermsAndConditions();
@@ -82,7 +95,7 @@ public class InitialSetup {
         isNewServer =
                 existingVersion == null
                         || existingVersion.isEmpty()
-                        || "0.0.0".equals(existingVersion);
+                        || existingVersion.equals("0.0.0");
 
         String appVersion = "0.0.0";
         Resource resource = new ClassPathResource("version.properties");

app/core/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java

@@ -62,15 +62,10 @@ public class OpenApiConfig {
 
         // Add server configuration from environment variable
         String swaggerServerUrl = System.getenv("SWAGGER_SERVER_URL");
-        Server server;
         if (swaggerServerUrl != null && !swaggerServerUrl.trim().isEmpty()) {
-            server = new Server().url(swaggerServerUrl).description("API Server");
-        } else {
-            // Use relative path so Swagger uses the current browser origin to avoid CORS issues
-            // when accessing via different ports
-            server = new Server().url("/").description("Current Server");
+            Server server = new Server().url(swaggerServerUrl).description("API Server");
+            openAPI.addServersItem(server);
         }
-        openAPI.addServersItem(server);
 
         // Add ErrorResponse schema to components
         Schema<?> errorResponseSchema =

app/core/src/main/java/stirling/software/SPDF/config/WebMvcConfig.java

@@ -1,14 +1,10 @@
 package stirling.software.SPDF.config;
 
-import java.util.concurrent.TimeUnit;
-
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.http.CacheControl;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
-import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import lombok.RequiredArgsConstructor;
@@ -29,20 +25,6 @@ public class WebMvcConfig implements WebMvcConfigurer {
         registry.addInterceptor(endpointInterceptor);
     }
 
-    @Override
-    public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        // Cache hashed assets (JS/CSS with content hashes) for 1 year
-        // These files have names like index-ChAS4tCC.js that change when content changes
-        registry.addResourceHandler("/assets/**")
-                .addResourceLocations("classpath:/static/assets/")
-                .setCacheControl(CacheControl.maxAge(365, TimeUnit.DAYS).cachePublic());
-
-        // Don't cache index.html - it needs to be fresh to reference latest hashed assets
-        registry.addResourceHandler("/index.html")
-                .addResourceLocations("classpath:/static/")
-                .setCacheControl(CacheControl.noCache().mustRevalidate());
-    }
-
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         // Check if running in Tauri mode

app/core/src/main/java/stirling/software/SPDF/controller/api/SettingsController.java

@@ -124,6 +124,7 @@ public class SettingsController {
         ApplicationProperties.Security security = applicationProperties.getSecurity();
 
         settings.put("enableLogin", security.getEnableLogin());
+        settings.put("csrfDisabled", security.getCsrfDisabled());
         settings.put("loginMethod", security.getLoginMethod());
         settings.put("loginAttemptCount", security.getLoginAttemptCount());
         settings.put("loginResetTimeMinutes", security.getLoginResetTimeMinutes());
@@ -158,6 +159,12 @@ public class SettingsController {
                     .getSecurity()
                     .setEnableLogin((Boolean) settings.get("enableLogin"));
         }
+        if (settings.containsKey("csrfDisabled")) {
+            GeneralUtils.saveKeyToSettings("security.csrfDisabled", settings.get("csrfDisabled"));
+            applicationProperties
+                    .getSecurity()
+                    .setCsrfDisabled((Boolean) settings.get("csrfDisabled"));
+        }
         if (settings.containsKey("loginMethod")) {
             GeneralUtils.saveKeyToSettings("security.loginMethod", settings.get("loginMethod"));
             applicationProperties

app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java

@@ -74,7 +74,6 @@ public class ConfigController {
             configData.put("appNameNavbar", applicationProperties.getUi().getAppNameNavbar());
             configData.put("languages", applicationProperties.getUi().getLanguages());
             configData.put("logoStyle", applicationProperties.getUi().getLogoStyle());
-            configData.put("defaultLocale", applicationProperties.getSystem().getDefaultLocale());
 
             // Security settings
             // enableLogin requires both the config flag AND proprietary features to be loaded

app/core/src/main/java/stirling/software/SPDF/controller/web/ReactRoutingController.java

@@ -1,88 +1,20 @@
 package stirling.software.SPDF.controller.web;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 
-import jakarta.annotation.PostConstruct;
-import jakarta.servlet.http.HttpServletRequest;
-
 @Controller
 public class ReactRoutingController {
 
-    @Value("${server.servlet.context-path:/}")
-    private String contextPath;
-
-    private String cachedIndexHtml;
-    private boolean indexHtmlExists = false;
-
-    @PostConstruct
-    public void init() {
-        // Only cache if index.html exists (production builds)
-        ClassPathResource resource = new ClassPathResource("static/index.html");
-        if (resource.exists()) {
-            try {
-                this.cachedIndexHtml = processIndexHtml();
-                this.indexHtmlExists = true;
-            } catch (IOException e) {
-                // Failed to cache, will process on each request
-                this.indexHtmlExists = false;
-            }
-        }
-    }
-
-    private String processIndexHtml() throws IOException {
-        ClassPathResource resource = new ClassPathResource("static/index.html");
-
-        try (InputStream inputStream = resource.getInputStream()) {
-            String html = new String(inputStream.readAllBytes(), StandardCharsets.UTF_8);
-
-            // Replace %BASE_URL% with the actual context path for base href
-            String baseUrl = contextPath.endsWith("/") ? contextPath : contextPath + "/";
-            html = html.replace("%BASE_URL%", baseUrl);
-            // Also rewrite any existing <base> tag (Vite may have baked one in)
-            html =
-                    html.replaceFirst(
-                            "<base href=\\\"[^\\\"]*\\\"\\s*/?>",
-                            "<base href=\\\"" + baseUrl + "\\\" />");
-
-            // Inject context path as a global variable for API calls
-            String contextPathScript =
-                    "<script>window.STIRLING_PDF_API_BASE_URL = '" + baseUrl + "';</script>";
-            html = html.replace("</head>", contextPathScript + "</head>");
-
-            return html;
-        }
+    @GetMapping(
+            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*$}")
+    public String forwardRootPaths() {
+        return "forward:/index.html";
     }
 
     @GetMapping(
-            value = {"/", "/index.html"},
-            produces = MediaType.TEXT_HTML_VALUE)
-    public ResponseEntity<String> serveIndexHtml(HttpServletRequest request) throws IOException {
-        if (indexHtmlExists && cachedIndexHtml != null) {
-            return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(cachedIndexHtml);
-        }
-        // Fallback: process on each request (dev mode or cache failed)
-        return ResponseEntity.ok().contentType(MediaType.TEXT_HTML).body(processIndexHtml());
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|robots\\.txt|favicon\\.ico|manifest.*\\.json|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*$}")
-    public ResponseEntity<String> forwardRootPaths(HttpServletRequest request) throws IOException {
-        return serveIndexHtml(request);
-    }
-
-    @GetMapping(
-            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js|assets|locales|modern-logo|classic-logo|Login|og_images|samples)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
-    public ResponseEntity<String> forwardNestedPaths(HttpServletRequest request)
-            throws IOException {
-        return serveIndexHtml(request);
+            "/{path:^(?!api|static|pipeline|pdfjs|pdfjs-legacy|fonts|images|files|css|js)[^\\.]*}/{subpath:^(?!.*\\.).*$}")
+    public String forwardNestedPaths() {
+        return "forward:/index.html";
     }
 }

app/core/src/main/java/stirling/software/SPDF/service/SharedSignatureService.java

@@ -179,7 +179,7 @@ public class SharedSignatureService {
                     StandardOpenOption.TRUNCATE_EXISTING);
 
             // Store reference to image file
-            response.setDataUrl("/api/v1/general/signatures/" + imageFileName);
+            response.setDataUrl("/api/v1/general/sign/" + imageFileName);
         }
 
         log.info("Saved signature {} for user {}", request.getId(), username);
@@ -207,7 +207,7 @@ public class SharedSignatureService {
                                         sig.setLabel(id); // Use ID as label
                                         sig.setType("image"); // Default type
                                         sig.setScope("personal");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
+                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
                                         sig.setCreatedAt(
                                                 Files.getLastModifiedTime(path).toMillis());
                                         sig.setUpdatedAt(
@@ -238,7 +238,7 @@ public class SharedSignatureService {
                                         sig.setLabel(id); // Use ID as label
                                         sig.setType("image"); // Default type
                                         sig.setScope("shared");
-                                        sig.setDataUrl("/api/v1/general/signatures/" + fileName);
+                                        sig.setDataUrl("/api/v1/general/sign/" + fileName);
                                         sig.setCreatedAt(
                                                 Files.getLastModifiedTime(path).toMillis());
                                         sig.setUpdatedAt(

app/core/src/main/resources/application.properties

@@ -4,9 +4,8 @@ logging.level.org.springframework.security=WARN
 logging.level.org.hibernate=WARN
 logging.level.org.eclipse.jetty=WARN
 #logging.level.org.springframework.security.oauth2=DEBUG
-#logging.level.org.springframework.security=DEBUG
 #logging.level.org.opensaml=DEBUG
-#logging.level.stirling.software.proprietary.security=DEBUG
+logging.level.stirling.software.proprietary.security=DEBUG
 logging.level.com.zaxxer.hikari=WARN
 logging.level.stirling.software.SPDF.service.PdfJsonConversionService=INFO
 logging.level.stirling.software.common.service.JobExecutorService=INFO
@@ -52,9 +51,39 @@ server.servlet.session.timeout:30m
 springdoc.api-docs.path=/v1/api-docs
 # Set the URL of the OpenAPI JSON for the Swagger UI
 springdoc.swagger-ui.url=/v1/api-docs
-springdoc.swagger-ui.path=/swagger-ui.html
+
+# Spring AI OpenAI Configuration
+# Uses GPT-5-nano as primary model and GPT-5-mini as fallback (configured in settings.yml)
+spring.ai.openai.enabled=true
+#spring.ai.openai.api-key=# todo <API-KEY-HERE>
+spring.ai.openai.base-url=https://api.openai.com
+spring.ai.openai.chat.enabled=true
+spring.ai.openai.chat.options.model=gpt-5-nano
+# Note: Some models only support default temperature value of 1.0
+spring.ai.openai.chat.options.temperature=1.0
+# For newer models, use max-completion-tokens instead of max-tokens
+spring.ai.openai.chat.options.max-completion-tokens=4000
+spring.ai.openai.embedding.enabled=true
+spring.ai.openai.embedding.options.model=text-embedding-ada-002
+# Increase timeout for OpenAI API calls (default is 10 seconds)
+spring.ai.openai.chat.options.connection-timeout=60s
+spring.ai.openai.chat.options.read-timeout=60s
+spring.ai.openai.embedding.options.connection-timeout=60s
+spring.ai.openai.embedding.options.read-timeout=60s
+
+# Spring AI Ollama Configuration (disabled to avoid bean conflicts)
+spring.ai.ollama.enabled=false
+spring.ai.ollama.base-url=http://localhost:11434
+spring.ai.ollama.chat.enabled=false
+spring.ai.ollama.chat.options.model=llama3
+spring.ai.ollama.chat.options.temperature=1.0
+spring.ai.ollama.embedding.enabled=false
+spring.ai.ollama.embedding.options.model=nomic-embed-text
+
 # Force OpenAPI 3.0 specification version
+springdoc.swagger-ui.path=/swagger-ui.html
 springdoc.api-docs.version=OPENAPI_3_0
+
 posthog.api.key=phc_fiR65u5j6qmXTYL56MNrLZSWqLaDW74OrZH0Insd2xq
 posthog.host=https://eu.i.posthog.com
 

app/core/src/main/resources/settings.yml.template

@@ -12,6 +12,7 @@
 
 security:
   enableLogin: true # set to 'true' to enable login
+  csrfDisabled: false # set to 'true' to disable CSRF protection (not recommended for production)
   loginAttemptCount: 5 # lock user account after 5 tries; when using e.g. Fail2Ban you can deactivate the function with -1
   loginResetTimeMinutes: 120 # lock account for 2 hours after x attempts
   loginMethod: all # Accepts values like 'all' and 'normal'(only Login with Username/Password), 'oauth2'(only Login with OAuth2) or 'saml2'(only Login with SAML2)
@@ -90,6 +91,32 @@ premium:
       author: username
       creator: Stirling-PDF
       producer: Stirling-PDF
+    chatbot:
+      enabled: false # Master toggle for Stirling PDF chatbot feature
+      alphaWarning: true # Display alpha-state warning before any processing
+      cache:
+        ttlMinutes: 720 # Cache entry lifetime (12h)
+        maxEntries: 200 # Maximum number of cached documents per node
+        maxDocumentCharacters: 600000 # Reject uploads exceeding this character count
+      models:
+        primary: gpt-5-nano # Default lightweight model
+        fallback: gpt-5-mini # Escalation model for complex prompts
+        embedding: text-embedding-3-small # Embedding model for vector store usage
+        temperature: 0.2 # Sampling temperature for LLM responses
+        topP: 0.95 # Top-p (nucleus) sampling for LLM responses
+      rag:
+        chunkSizeTokens: 512 # Token window used when chunking text
+        chunkOverlapTokens: 128 # Overlap between successive chunks
+        topK: 8 # Number of chunks to retrieve per query
+      ocr:
+        enabledByDefault: false # Whether OCR pre-processing is opted-in automatically
+      audit:
+        enabled: true # Emit audit records for chatbot activity
+      maxPromptCharacters: 4000 # Server-side guardrail for incoming prompts
+      minConfidenceNano: 0.65 # Minimum nano confidence to avoid escalation
+      usage:
+        perUserMonthlyTokens: 200000 # Monthly RAG + chat token budget per user
+        warnAtRatio: 0.7 # Warn users when usage exceeds 70%
   enterpriseFeatures:
     audit:
       enabled: true # Enable audit logging
@@ -104,11 +131,6 @@ mail:
   username: '' # SMTP server username
   password: '' # SMTP server password
   from: '' # sender email address
-  startTlsEnable: true # enable STARTTLS (explicit TLS upgrade after connecting) when supported by the SMTP server
-  startTlsRequired: false # require STARTTLS; connection fails if the upgrade command is not supported
-  sslEnable: false # enable SSL/TLS wrapper for implicit TLS (typically used with port 465)
-  sslTrust: '' # optional trusted host override, e.g. "smtp.example.com" or "*"; defaults to "*" (trust all) when empty
-  sslCheckServerIdentity: false # enable hostname verification when using SSL/TLS
 
 legal:
   termsAndConditions: https://www.stirling.com/legal/terms-of-service # URL to the terms and conditions of your application (e.g. https://example.com/terms). Empty string to disable or filename to load from local file in static folder

app/proprietary/build.gradle

@@ -41,6 +41,8 @@ dependencies {
     api 'org.springframework:spring-webmvc'
     api 'org.springframework.session:spring-session-core'
     api "org.springframework.security:spring-security-core:$springSecuritySamlVersion"
+    api "org.springframework.security:spring-security-web:$springSecuritySamlVersion"
+    api "org.springframework.security:spring-security-config:$springSecuritySamlVersion"
     api "org.springframework.security:spring-security-saml2-service-provider:$springSecuritySamlVersion"
     api 'org.springframework.boot:spring-boot-starter-jetty'
     api 'org.springframework.boot:spring-boot-starter-security'
@@ -50,12 +52,16 @@ dependencies {
     api 'org.springframework.boot:spring-boot-starter-cache'
     api 'com.github.ben-manes.caffeine:caffeine'
     api 'io.swagger.core.v3:swagger-core-jakarta:2.2.38'
+    implementation 'org.springframework.ai:spring-ai-starter-model-openai'
+    implementation 'org.springframework.ai:spring-ai-starter-model-ollama'
+    implementation 'org.springframework.ai:spring-ai-starter-vector-store-redis'
+    implementation 'redis.clients:jedis:5.1.0'
     implementation 'com.bucket4j:bucket4j_jdk17-core:8.15.0'
 
     // https://mvnrepository.com/artifact/com.bucket4j/bucket4j_jdk17
     implementation 'org.bouncycastle:bcprov-jdk18on:1.82'
 
-    implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5:3.1.3.RELEASE'
+    // implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5:3.1.3.RELEASE' // Removed - UI moved to React frontend
     api 'io.micrometer:micrometer-registry-prometheus'
     implementation 'com.unboundid.product.scim2:scim2-sdk-client:4.0.0'
 

app/proprietary/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertPdfJsonController.java

@@ -31,10 +31,12 @@ import stirling.software.common.model.api.PDFFile;
 import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.util.ExceptionUtils;
 import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.security.config.PremiumEndpoint;
 
 @Slf4j
 @ConvertApi
 @RequiredArgsConstructor
+@PremiumEndpoint
 public class ConvertPdfJsonController {
 
     private final PdfJsonConversionService pdfJsonConversionService;

app/proprietary/src/main/java/stirling/software/SPDF/service/PdfJsonFallbackFontService.java

@@ -33,12 +33,8 @@ public class PdfJsonFallbackFontService {
     public static final String FALLBACK_FONT_CJK_ID = "fallback-noto-cjk";
     public static final String FALLBACK_FONT_JP_ID = "fallback-noto-jp";
     public static final String FALLBACK_FONT_KR_ID = "fallback-noto-korean";
-    public static final String FALLBACK_FONT_TC_ID = "fallback-noto-tc";
     public static final String FALLBACK_FONT_AR_ID = "fallback-noto-arabic";
     public static final String FALLBACK_FONT_TH_ID = "fallback-noto-thai";
-    public static final String FALLBACK_FONT_DEVANAGARI_ID = "fallback-noto-devanagari";
-    public static final String FALLBACK_FONT_MALAYALAM_ID = "fallback-noto-malayalam";
-    public static final String FALLBACK_FONT_TIBETAN_ID = "fallback-noto-tibetan";
 
     // Font name aliases map PDF font names to available fallback fonts
     // This provides better visual consistency when editing PDFs
@@ -63,22 +59,6 @@ public class PdfJsonFallbackFontService {
                     Map.entry("dejavuserif", "fallback-dejavu-serif"),
                     Map.entry("dejavumono", "fallback-dejavu-mono"),
                     Map.entry("dejavusansmono", "fallback-dejavu-mono"),
-                    // Traditional Chinese fonts (Taiwan, Hong Kong, Macau)
-                    Map.entry("mingliu", "fallback-noto-tc"),
-                    Map.entry("pmingliu", "fallback-noto-tc"),
-                    Map.entry("microsoftjhenghei", "fallback-noto-tc"),
-                    Map.entry("jhenghei", "fallback-noto-tc"),
-                    Map.entry("kaiti", "fallback-noto-tc"),
-                    Map.entry("kaiu", "fallback-noto-tc"),
-                    Map.entry("dfkaib5", "fallback-noto-tc"),
-                    Map.entry("dfkai", "fallback-noto-tc"),
-                    // Simplified Chinese fonts (Mainland China) - more common
-                    Map.entry("simsun", "fallback-noto-cjk"),
-                    Map.entry("simhei", "fallback-noto-cjk"),
-                    Map.entry("microsoftyahei", "fallback-noto-cjk"),
-                    Map.entry("yahei", "fallback-noto-cjk"),
-                    Map.entry("songti", "fallback-noto-cjk"),
-                    Map.entry("heiti", "fallback-noto-cjk"),
                     // Noto Sans - Google's universal font (use as last resort generic fallback)
                     Map.entry("noto", "fallback-noto-sans"),
                     Map.entry("notosans", "fallback-noto-sans"));
@@ -103,12 +83,6 @@ public class PdfJsonFallbackFontService {
                                     "classpath:/static/fonts/NotoSansKR-Regular.ttf",
                                     "NotoSansKR-Regular",
                                     "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_TC_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansTC-Regular.ttf",
-                                    "NotoSansTC-Regular",
-                                    "ttf")),
                     Map.entry(
                             FALLBACK_FONT_AR_ID,
                             new FallbackFontSpec(
@@ -121,24 +95,6 @@ public class PdfJsonFallbackFontService {
                                     "classpath:/static/fonts/NotoSansThai-Regular.ttf",
                                     "NotoSansThai-Regular",
                                     "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_DEVANAGARI_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansDevanagari-Regular.ttf",
-                                    "NotoSansDevanagari-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_MALAYALAM_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSansMalayalam-Regular.ttf",
-                                    "NotoSansMalayalam-Regular",
-                                    "ttf")),
-                    Map.entry(
-                            FALLBACK_FONT_TIBETAN_ID,
-                            new FallbackFontSpec(
-                                    "classpath:/static/fonts/NotoSerifTibetan-Regular.ttf",
-                                    "NotoSerifTibetan-Regular",
-                                    "ttf")),
                     // Liberation Sans family
                     Map.entry(
                             "fallback-liberation-sans",
@@ -528,20 +484,6 @@ public class PdfJsonFallbackFontService {
      */
     public String resolveFallbackFontId(int codePoint) {
         Character.UnicodeBlock block = Character.UnicodeBlock.of(codePoint);
-
-        // Bopomofo is primarily used in Taiwan for Traditional Chinese phonetic annotation
-        if (block == Character.UnicodeBlock.BOPOMOFO
-                || block == Character.UnicodeBlock.BOPOMOFO_EXTENDED) {
-            return FALLBACK_FONT_TC_ID;
-        }
-
-        // Compatibility ideographs are primarily used by Traditional Chinese encodings (e.g., Big5,
-        // HKSCS) so prefer the Traditional Chinese fallback here.
-        if (block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS
-                || block == Character.UnicodeBlock.CJK_COMPATIBILITY_IDEOGRAPHS_SUPPLEMENT) {
-            return FALLBACK_FONT_TC_ID;
-        }
-
         if (block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS
                 || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_A
                 || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_B
@@ -550,23 +492,19 @@ public class PdfJsonFallbackFontService {
                 || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_E
                 || block == Character.UnicodeBlock.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_F
                 || block == Character.UnicodeBlock.CJK_SYMBOLS_AND_PUNCTUATION
+                || block == Character.UnicodeBlock.BOPOMOFO
+                || block == Character.UnicodeBlock.BOPOMOFO_EXTENDED
                 || block == Character.UnicodeBlock.HALFWIDTH_AND_FULLWIDTH_FORMS) {
             return FALLBACK_FONT_CJK_ID;
         }
 
         Character.UnicodeScript script = Character.UnicodeScript.of(codePoint);
         return switch (script) {
-            // HAN script is used by both Simplified and Traditional Chinese
-            // Default to Simplified (mainland China, 1.4B speakers) as it's more common
-            // Traditional Chinese PDFs are detected via font name aliases (MingLiU, PMingLiU, etc.)
             case HAN -> FALLBACK_FONT_CJK_ID;
             case HIRAGANA, KATAKANA -> FALLBACK_FONT_JP_ID;
             case HANGUL -> FALLBACK_FONT_KR_ID;
             case ARABIC -> FALLBACK_FONT_AR_ID;
             case THAI -> FALLBACK_FONT_TH_ID;
-            case DEVANAGARI -> FALLBACK_FONT_DEVANAGARI_ID;
-            case MALAYALAM -> FALLBACK_FONT_MALAYALAM_ID;
-            case TIBETAN -> FALLBACK_FONT_TIBETAN_ID;
             default -> FALLBACK_FONT_ID;
         };
     }

app/proprietary/src/main/java/stirling/software/proprietary/config/ChatbotRedisConfig.java

@@ -0,0 +1,102 @@
+package stirling.software.proprietary.config;
+
+import org.apache.commons.pool2.impl.GenericObjectPoolConfig;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import lombok.extern.slf4j.Slf4j;
+
+import redis.clients.jedis.Connection;
+import redis.clients.jedis.DefaultJedisClientConfig;
+import redis.clients.jedis.HostAndPort;
+import redis.clients.jedis.JedisClientConfig;
+import redis.clients.jedis.JedisPooled;
+
+@Configuration
+@ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
+@Slf4j
+public class ChatbotRedisConfig {
+
+    @Value("${spring.data.redis.host:localhost}")
+    private String redisHost;
+
+    @Value("${spring.data.redis.port:6379}")
+    private int redisPort;
+
+    @Value("${spring.data.redis.password:}")
+    private String redisPassword;
+
+    @Value("${spring.data.redis.timeout:60000}")
+    private int redisTimeout;
+
+    @Value("${spring.data.redis.ssl.enabled:false}")
+    private boolean sslEnabled;
+
+    @Bean
+    public JedisPooled jedisPooled() {
+        try {
+            log.info("Creating JedisPooled connection to {}:{}", redisHost, redisPort);
+
+            // Create pool configuration
+            GenericObjectPoolConfig<Connection> poolConfig = new GenericObjectPoolConfig<>();
+            poolConfig.setMaxTotal(50);
+            poolConfig.setMaxIdle(25);
+            poolConfig.setMinIdle(5);
+            poolConfig.setTestOnBorrow(true);
+            poolConfig.setTestOnReturn(true);
+            poolConfig.setTestWhileIdle(true);
+
+            // Create host and port configuration
+            HostAndPort hostAndPort = new HostAndPort(redisHost, redisPort);
+
+            // Create client configuration with authentication if password is provided
+            JedisClientConfig clientConfig;
+            if (redisPassword != null && !redisPassword.trim().isEmpty()) {
+                clientConfig =
+                        DefaultJedisClientConfig.builder()
+                                .password(redisPassword)
+                                .connectionTimeoutMillis(redisTimeout)
+                                .socketTimeoutMillis(redisTimeout)
+                                .ssl(sslEnabled)
+                                .build();
+            } else {
+                clientConfig =
+                        DefaultJedisClientConfig.builder()
+                                .connectionTimeoutMillis(redisTimeout)
+                                .socketTimeoutMillis(redisTimeout)
+                                .ssl(sslEnabled)
+                                .build();
+            }
+
+            // Create JedisPooled with configuration
+            JedisPooled jedisPooled = new JedisPooled(poolConfig, hostAndPort, clientConfig);
+
+            // Test the connection
+            try {
+                jedisPooled.ping();
+                log.info("Successfully connected to Redis at {}:{}", redisHost, redisPort);
+            } catch (Exception pingException) {
+                log.warn(
+                        "Redis ping failed at {}:{} - {}. Redis might be unavailable.",
+                        redisHost,
+                        redisPort,
+                        pingException.getMessage());
+                // Close the pool if ping fails
+                try {
+                    jedisPooled.close();
+                } catch (Exception closeException) {
+                    // Ignore close exceptions
+                }
+                return null;
+            }
+
+            return jedisPooled;
+        } catch (Exception e) {
+            log.error("Failed to create JedisPooled connection", e);
+            // Return null to fall back to SimpleVectorStore
+            return null;
+        }
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/config/ChatbotVectorStoreConfig.java

@@ -0,0 +1,52 @@
+package stirling.software.proprietary.config;
+
+import org.springframework.ai.embedding.EmbeddingModel;
+import org.springframework.ai.vectorstore.SimpleVectorStore;
+import org.springframework.ai.vectorstore.VectorStore;
+import org.springframework.ai.vectorstore.redis.RedisVectorStore;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+
+import lombok.extern.slf4j.Slf4j;
+
+import redis.clients.jedis.JedisPooled;
+
+@Configuration
+@ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
+@Slf4j
+public class ChatbotVectorStoreConfig {
+
+    private static final String DEFAULT_INDEX = "stirling-chatbot-index";
+    private static final String DEFAULT_PREFIX = "stirling:chatbot:";
+
+    @Bean
+    @Primary
+    public VectorStore chatbotVectorStore(
+            @Autowired(required = false) JedisPooled jedisPooled, EmbeddingModel embeddingModel) {
+        if (jedisPooled != null) {
+            try {
+                log.info("Initialising Redis vector store for chatbot usage");
+                return RedisVectorStore.builder(jedisPooled, embeddingModel)
+                        .indexName(DEFAULT_INDEX)
+                        .prefix(DEFAULT_PREFIX)
+                        .initializeSchema(true)
+                        .build();
+            } catch (RuntimeException ex) {
+                log.warn(
+                        "Redis vector store unavailable ({}). Falling back to SimpleVectorStore.",
+                        sanitize(ex.getMessage()));
+            }
+        } else {
+            log.info("No Redis connection detected; using SimpleVectorStore for chatbot.");
+        }
+
+        return SimpleVectorStore.builder(embeddingModel).build();
+    }
+
+    private String sanitize(String message) {
+        return message == null ? "unknown error" : message.replaceAll("\\s+", " ").trim();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/config/SpringAIConfig.java

@@ -0,0 +1,82 @@
+package stirling.software.proprietary.config;
+
+import java.time.Duration;
+
+import org.springframework.ai.chat.model.ChatModel;
+import org.springframework.ai.embedding.EmbeddingModel;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.boot.web.client.RestTemplateBuilder;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.http.client.SimpleClientHttpRequestFactory;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.client.RestTemplate;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Spring AI Configuration for Stirling PDF Chatbot
+ *
+ * <p>This configuration enables Spring AI auto-configuration for chatbot features. The actual
+ * ChatModel and EmbeddingModel beans are provided by Spring Boot's auto-configuration based on the
+ * spring.ai.* properties in application-proprietary.properties
+ *
+ * <p>For OpenAI: - spring.ai.openai.enabled=true - spring.ai.openai.api-key=your-api-key
+ *
+ * <p>For Ollama (as fallback): - spring.ai.ollama.enabled=true -
+ * spring.ai.ollama.base-url=http://localhost:11434
+ */
+@Configuration
+@Slf4j
+public class SpringAIConfig {
+
+    public SpringAIConfig() {
+        log.info("Spring AI Configuration enabled for Stirling PDF Chatbot");
+        log.info(
+                "ChatModel and EmbeddingModel beans will be auto-configured based on spring.ai.* properties");
+    }
+
+    /** Primary ChatModel bean that delegates to OpenAI's auto-configured bean */
+    @Bean
+    @Primary
+    public ChatModel primaryChatModel(@Qualifier("openAiChatModel") ChatModel openAiChatModel) {
+        log.info("Using OpenAI ChatModel as primary");
+        return openAiChatModel;
+    }
+
+    /** Primary EmbeddingModel bean that delegates to OpenAI's auto-configured bean */
+    @Bean
+    @Primary
+    public EmbeddingModel primaryEmbeddingModel(
+            @Qualifier("openAiEmbeddingModel") EmbeddingModel openAiEmbeddingModel) {
+        log.info("Using OpenAI EmbeddingModel as primary");
+        return openAiEmbeddingModel;
+    }
+
+    /**
+     * Custom RestTemplate for Spring AI OpenAI client with increased timeouts. This helps prevent
+     * timeout errors when processing large documents or complex queries.
+     */
+    @Bean(name = "openAiRestTemplate")
+    public RestTemplate openAiRestTemplate(RestTemplateBuilder builder) {
+        log.info("Creating custom RestTemplate for OpenAI with 60s timeouts");
+        return builder.connectTimeout(Duration.ofSeconds(60))
+                .readTimeout(Duration.ofSeconds(60))
+                .build();
+    }
+
+    /**
+     * Custom RestClient for Spring AI OpenAI with increased timeouts. Spring AI 1.0.3+ prefers
+     * RestClient over RestTemplate.
+     */
+    @Bean(name = "openAiRestClient")
+    public RestClient openAiRestClient() {
+        log.info("Creating custom RestClient for OpenAI with 60s timeouts");
+        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
+        factory.setConnectTimeout(Duration.ofSeconds(60));
+        factory.setReadTimeout(Duration.ofSeconds(60));
+
+        return RestClient.builder().requestFactory(factory).build();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/configuration/ChatbotAiClientConfiguration.java

@@ -0,0 +1,60 @@
+package stirling.software.proprietary.configuration;
+
+import java.net.http.HttpClient;
+import java.time.Duration;
+import java.util.Optional;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.web.client.RestClientCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.client.JdkClientHttpRequestFactory;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.Premium;
+import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures;
+import stirling.software.common.model.ApplicationProperties.Premium.ProFeatures.Chatbot;
+
+@Configuration
+@ConditionalOnClass(RestClientCustomizer.class)
+@ConditionalOnProperty(value = "spring.ai.openai.enabled", havingValue = "true")
+public class ChatbotAiClientConfiguration {
+
+    @Bean
+    public RestClientCustomizer chatbotRestClientCustomizer(
+            ApplicationProperties applicationProperties) {
+        long connectTimeout = resolveConnectTimeout(applicationProperties);
+        long readTimeout = resolveReadTimeout(applicationProperties);
+        return builder -> builder.requestFactory(createRequestFactory(connectTimeout, readTimeout));
+    }
+
+    private JdkClientHttpRequestFactory createRequestFactory(
+            long connectTimeoutMillis, long readTimeoutMillis) {
+        HttpClient httpClient =
+                HttpClient.newBuilder()
+                        .connectTimeout(Duration.ofMillis(connectTimeoutMillis))
+                        .build();
+        JdkClientHttpRequestFactory factory = new JdkClientHttpRequestFactory(httpClient);
+        factory.setReadTimeout((int) readTimeoutMillis);
+        return factory;
+    }
+
+    private long resolveConnectTimeout(ApplicationProperties properties) {
+        long configured = resolveChatbot(properties).getModels().getConnectTimeoutMillis();
+        return configured > 0 ? configured : 30000L;
+    }
+
+    private long resolveReadTimeout(ApplicationProperties properties) {
+        long configured = resolveChatbot(properties).getModels().getReadTimeoutMillis();
+        return configured > 0 ? configured : 120000L;
+    }
+
+    private Chatbot resolveChatbot(ApplicationProperties properties) {
+        return Optional.ofNullable(properties)
+                .map(ApplicationProperties::getPremium)
+                .map(Premium::getProFeatures)
+                .map(ProFeatures::getChatbot)
+                .orElseGet(Chatbot::new);
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/ChatbotController.java

@@ -0,0 +1,126 @@
+package stirling.software.proprietary.controller;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.chatbot.ChatbotQueryRequest;
+import stirling.software.proprietary.model.chatbot.ChatbotResponse;
+import stirling.software.proprietary.model.chatbot.ChatbotSession;
+import stirling.software.proprietary.model.chatbot.ChatbotSessionCreateRequest;
+import stirling.software.proprietary.model.chatbot.ChatbotSessionResponse;
+import stirling.software.proprietary.model.chatbot.ChatbotUsageSummary;
+import stirling.software.proprietary.service.chatbot.ChatbotCacheService;
+import stirling.software.proprietary.service.chatbot.ChatbotFeatureProperties;
+import stirling.software.proprietary.service.chatbot.ChatbotFeatureProperties.ChatbotSettings;
+import stirling.software.proprietary.service.chatbot.ChatbotService;
+import stirling.software.proprietary.service.chatbot.ChatbotSessionRegistry;
+import stirling.software.proprietary.service.chatbot.exception.ChatbotException;
+
+@Slf4j
+@RestController
+@RequiredArgsConstructor
+@RequestMapping("/api/v1/internal/chatbot")
+public class ChatbotController {
+
+    private final ChatbotService chatbotService;
+    private final ChatbotSessionRegistry sessionRegistry;
+    private final ChatbotCacheService cacheService;
+    private final ChatbotFeatureProperties featureProperties;
+
+    @PostMapping("/session")
+    public ResponseEntity<ChatbotSessionResponse> createSession(
+            @RequestBody ChatbotSessionCreateRequest request) {
+        ChatbotSession session = chatbotService.createSession(request);
+        ChatbotSettings settings = featureProperties.current();
+        ChatbotSessionResponse response = toResponse(session, settings);
+        return ResponseEntity.status(HttpStatus.CREATED).body(response);
+    }
+
+    @PostMapping("/query")
+    public ResponseEntity<ChatbotResponse> query(@RequestBody ChatbotQueryRequest request) {
+        ChatbotResponse response = chatbotService.ask(request);
+        return ResponseEntity.ok(response);
+    }
+
+    @GetMapping("/session/{sessionId}")
+    public ResponseEntity<ChatbotSessionResponse> getSession(@PathVariable String sessionId) {
+        ChatbotSettings settings = featureProperties.current();
+        ChatbotSession session =
+                sessionRegistry
+                        .findById(sessionId)
+                        .orElseThrow(() -> new ChatbotException("Session not found"));
+        ChatbotSessionResponse response = toResponse(session, settings);
+        return ResponseEntity.ok(response);
+    }
+
+    @GetMapping("/document/{documentId}")
+    public ResponseEntity<ChatbotSessionResponse> getSessionByDocument(
+            @PathVariable String documentId) {
+        ChatbotSettings settings = featureProperties.current();
+        ChatbotSession session =
+                sessionRegistry
+                        .findByDocumentId(documentId)
+                        .orElseThrow(() -> new ChatbotException("Session not found"));
+        return ResponseEntity.ok(toResponse(session, settings));
+    }
+
+    @DeleteMapping("/session/{sessionId}")
+    public ResponseEntity<Void> closeSession(@PathVariable String sessionId) {
+        chatbotService.close(sessionId);
+        return ResponseEntity.noContent().build();
+    }
+
+    private List<String> sessionWarnings(ChatbotSettings settings, ChatbotSession session) {
+        List<String> warnings = new ArrayList<>();
+
+        if (session != null && session.isImageContentDetected()) {
+            warnings.add("Images detected - Images are not currently supported.");
+        }
+
+        warnings.add("Images are not yet supported. Only extracted text is sent for analysis.");
+        if (session != null && session.isOcrRequested()) {
+            warnings.add("OCR requested – uses credits .");
+        }
+
+        if (session != null && session.getUsageSummary() != null) {
+            ChatbotUsageSummary usage = session.getUsageSummary();
+            if (usage.isLimitExceeded()) {
+                warnings.add("Monthly chatbot allocation exceeded – requests may be throttled.");
+            } else if (usage.isNearingLimit()) {
+                warnings.add("You are approaching the monthly chatbot allocation.");
+            }
+        }
+
+        return warnings;
+    }
+
+    private ChatbotSessionResponse toResponse(ChatbotSession session, ChatbotSettings settings) {
+        return ChatbotSessionResponse.builder()
+                .sessionId(session.getSessionId())
+                .documentId(session.getDocumentId())
+                .alphaWarning(settings.alphaWarning())
+                .ocrRequested(session.isOcrRequested())
+                .imageContentDetected(session.isImageContentDetected())
+                .textCharacters(session.getTextCharacters())
+                .estimatedTokens(session.getEstimatedTokens())
+                .maxCachedCharacters(cacheService.getMaxDocumentCharacters())
+                .createdAt(session.getCreatedAt())
+                .warnings(sessionWarnings(settings, session))
+                .metadata(session.getMetadata())
+                .usageSummary(session.getUsageSummary())
+                .build();
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/ChatbotExceptionHandler.java

@@ -0,0 +1,57 @@
+package stirling.software.proprietary.controller;
+
+import java.time.Instant;
+import java.util.Map;
+
+import org.eclipse.jetty.client.HttpResponseException;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.service.chatbot.ChatbotService;
+import stirling.software.proprietary.service.chatbot.exception.ChatbotException;
+import stirling.software.proprietary.service.chatbot.exception.NoTextDetectedException;
+
+@RestControllerAdvice(assignableTypes = ChatbotController.class)
+@Slf4j
+// @ConditionalOnProperty(value = "premium.proFeatures.chatbot.enabled", havingValue = "true")
+@ConditionalOnBean(ChatbotService.class)
+public class ChatbotExceptionHandler {
+
+    @ExceptionHandler(NoTextDetectedException.class)
+    public ResponseEntity<Map<String, Object>> handleNoText(NoTextDetectedException ex) {
+        return buildResponse(HttpStatus.UNPROCESSABLE_ENTITY, ex.getMessage());
+    }
+
+    @ExceptionHandler(ChatbotException.class)
+    public ResponseEntity<Map<String, Object>> handleChatbot(ChatbotException ex) {
+        log.debug("Chatbot exception: {}", ex.getMessage());
+        return buildResponse(HttpStatus.BAD_REQUEST, ex.getMessage());
+    }
+
+    @ExceptionHandler(IllegalArgumentException.class)
+    public ResponseEntity<Map<String, Object>> handleIllegalArgument(IllegalArgumentException ex) {
+        return buildResponse(HttpStatus.BAD_REQUEST, ex.getMessage());
+    }
+
+    @ExceptionHandler(HttpResponseException.class)
+    public ResponseEntity<Map<String, Object>> handleProvider(HttpResponseException ex) {
+        log.warn("Chatbot provider error", ex);
+        return buildResponse(
+                HttpStatus.BAD_GATEWAY,
+                "Chatbot provider rejected the request: " + ex.getMessage());
+    }
+
+    private ResponseEntity<Map<String, Object>> buildResponse(HttpStatus status, String message) {
+        Map<String, Object> payload =
+                Map.of(
+                        "timestamp", Instant.now().toString(),
+                        "status", status.value(),
+                        "error", message);
+        return ResponseEntity.status(status).body(payload);
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java

@@ -205,10 +205,6 @@ public class ProprietaryUIDataController {
         data.setLoginMethod(securityProps.getLoginMethod());
         data.setAltLogin(!providerList.isEmpty() && securityProps.isAltLogin());
 
-        // Add language configuration for login page
-        data.setLanguages(applicationProperties.getUi().getLanguages());
-        data.setDefaultLocale(applicationProperties.getSystem().getDefaultLocale());
-
         return ResponseEntity.ok(data);
     }
 
@@ -332,7 +328,6 @@ public class ProprietaryUIDataController {
         data.setGrandfatheredUserCount(grandfatheredCount);
         data.setLicenseMaxUsers(licenseMaxUsers);
         data.setPremiumEnabled(premiumEnabled);
-        data.setMailEnabled(applicationProperties.getMail().isEnabled());
 
         return ResponseEntity.ok(data);
     }
@@ -381,7 +376,7 @@ public class ProprietaryUIDataController {
         data.setUsername(username);
         data.setRole(user.get().getRolesAsString());
         data.setSettings(settingsJson);
-        data.setChangeCredsFlag(user.get().isFirstLogin() || user.get().isForcePasswordChange());
+        data.setChangeCredsFlag(user.get().isFirstLogin());
         data.setOAuth2Login(isOAuth2Login);
         data.setSaml2Login(isSaml2Login);
 
@@ -496,8 +491,6 @@ public class ProprietaryUIDataController {
         private boolean altLogin;
         private boolean firstTimeSetup;
         private boolean showDefaultCredentials;
-        private List<String> languages;
-        private String defaultLocale;
     }
 
     @Data
@@ -517,7 +510,6 @@ public class ProprietaryUIDataController {
         private int grandfatheredUserCount;
         private int licenseMaxUsers;
         private boolean premiumEnabled;
-        private boolean mailEnabled;
     }
 
     @Data

app/proprietary/src/main/java/stirling/software/proprietary/controller/api/SignatureController.java

@@ -1,12 +1,7 @@
 package stirling.software.proprietary.controller.api;
 
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.Paths;
 import java.util.List;
-import java.util.Map;
-import java.util.stream.Stream;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -23,7 +18,6 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.annotations.api.UserApi;
-import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.proprietary.model.api.signature.SavedSignatureRequest;
 import stirling.software.proprietary.model.api.signature.SavedSignatureResponse;
 import stirling.software.proprietary.security.service.UserService;
@@ -44,7 +38,6 @@ public class SignatureController {
 
     private final SignatureService signatureService;
     private final UserService userService;
-    private static final String ALL_USERS_FOLDER = "ALL_USERS";
 
     /**
      * Save a new signature for the authenticated user. Enforces storage limits and authentication
@@ -91,105 +84,19 @@ public class SignatureController {
     }
 
     /**
-     * Update a signature label. Users can update labels for their own personal signatures and for
-     * shared signatures.
-     */
-    @PostMapping("/{signatureId}/label")
-    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
-    public ResponseEntity<Void> updateSignatureLabel(
-            @PathVariable String signatureId, @RequestBody Map<String, String> body) {
-        try {
-            String username = userService.getCurrentUsername();
-            String newLabel = body.get("label");
-
-            if (newLabel == null || newLabel.trim().isEmpty()) {
-                log.warn("Invalid label update request");
-                return ResponseEntity.badRequest().build();
-            }
-
-            signatureService.updateSignatureLabel(username, signatureId, newLabel);
-            log.info("User {} updated label for signature {}", username, signatureId);
-            return ResponseEntity.noContent().build();
-        } catch (IOException e) {
-            log.warn("Failed to update signature label: {}", e.getMessage());
-            return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
-        }
-    }
-
-    /**
-     * Delete a signature owned by the authenticated user. Users can delete their own personal
-     * signatures. Admins can also delete shared signatures.
+     * Delete a signature owned by the authenticated user. Users can only delete their own personal
+     * signatures, not shared ones.
      */
     @DeleteMapping("/{signatureId}")
-    @PreAuthorize("!hasAuthority('ROLE_DEMO_USER')")
     public ResponseEntity<Void> deleteSignature(@PathVariable String signatureId) {
         try {
             String username = userService.getCurrentUsername();
-            boolean isAdmin = userService.isCurrentUserAdmin();
-
-            // Validate filename to prevent path traversal
-            if (signatureId.contains("..")
-                    || signatureId.contains("/")
-                    || signatureId.contains("\\")) {
-                log.warn("Invalid signature ID: {}", signatureId);
-                return ResponseEntity.badRequest().build();
-            }
-
-            // Try to delete from personal folder first
-            try {
-                signatureService.deleteSignature(username, signatureId);
-                log.info("User {} deleted personal signature {}", username, signatureId);
-                return ResponseEntity.noContent().build();
-            } catch (IOException e) {
-                // If not found in personal folder, check if it's in shared folder
-                if (isAdmin) {
-                    // Admin can delete from shared folder
-                    if (deleteFromSharedFolder(signatureId)) {
-                        log.info("Admin {} deleted shared signature {}", username, signatureId);
-                        return ResponseEntity.noContent().build();
-                    }
-                }
-                // If not admin or not found in shared folder either, return 404
-                throw e;
-            }
+            signatureService.deleteSignature(username, signatureId);
+            log.info("User {} deleted signature {}", username, signatureId);
+            return ResponseEntity.noContent().build();
         } catch (IOException e) {
             log.warn("Failed to delete signature {} for user: {}", signatureId, e.getMessage());
             return ResponseEntity.status(HttpStatus.NOT_FOUND).build();
         }
     }
-
-    /**
-     * Delete a signature from the shared (ALL_USERS) folder. Only admins should call this method.
-     */
-    private boolean deleteFromSharedFolder(String signatureId) throws IOException {
-        String signatureBasePath = InstallationPathConfig.getSignaturesPath();
-        Path sharedFolder = Paths.get(signatureBasePath, ALL_USERS_FOLDER);
-        boolean deleted = false;
-
-        if (Files.exists(sharedFolder)) {
-            try (Stream<Path> stream = Files.list(sharedFolder)) {
-                List<Path> matchingFiles =
-                        stream.filter(
-                                        path ->
-                                                path.getFileName()
-                                                        .toString()
-                                                        .startsWith(signatureId + "."))
-                                .toList();
-                for (Path file : matchingFiles) {
-                    Files.delete(file);
-                    deleted = true;
-                    log.info("Deleted shared signature file: {}", file);
-                }
-            }
-
-            // Also delete metadata file if it exists
-            Path metadataPath = sharedFolder.resolve(signatureId + ".json");
-            if (Files.exists(metadataPath)) {
-                Files.delete(metadataPath);
-                log.info("Deleted shared signature metadata: {}", metadataPath);
-            }
-        }
-
-        return deleted;
-    }
 }

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotDocumentCacheEntry.java

@@ -0,0 +1,30 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.Map;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotDocumentCacheEntry {
+
+    private String cacheKey;
+    private String sessionId;
+    private String documentId;
+    private Map<String, String> metadata;
+    private boolean ocrApplied;
+    private boolean imageContentDetected;
+    private long textCharacters;
+    private Instant storedAt;
+
+    public Map<String, String> getMetadata() {
+        return metadata == null ? Collections.emptyMap() : metadata;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotHistoryEntry.java

@@ -0,0 +1,7 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.time.Instant;
+
+/** Simple record representing a stored chatbot conversation turn. */
+public record ChatbotHistoryEntry(
+        String role, String content, String documentId, String documentName, Instant timestamp) {}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotQueryRequest.java

@@ -0,0 +1,17 @@
+package stirling.software.proprietary.model.chatbot;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotQueryRequest {
+
+    private String sessionId;
+    private String prompt;
+    private boolean allowEscalation;
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotResponse.java

@@ -0,0 +1,41 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotResponse {
+
+    private String sessionId;
+    private String modelUsed;
+    private double confidence;
+    private String answer;
+    private boolean escalated;
+    private boolean servedFromNanoOnly;
+    private boolean cacheHit;
+    private Instant respondedAt;
+    private List<String> warnings;
+    private Map<String, Object> metadata;
+    private long promptTokens;
+    private long completionTokens;
+    private long totalTokens;
+    private ChatbotUsageSummary usageSummary;
+
+    public List<String> getWarnings() {
+        return warnings == null ? Collections.emptyList() : warnings;
+    }
+
+    public Map<String, Object> getMetadata() {
+        return metadata == null ? Collections.emptyMap() : metadata;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSession.java

@@ -0,0 +1,37 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.Map;
+import java.util.UUID;
+
+import lombok.Builder;
+import lombok.Data;
+
+@Data
+@Builder
+public class ChatbotSession {
+
+    private String sessionId;
+    private String documentId;
+    private String userId;
+    private Map<String, String> metadata;
+    private boolean ocrRequested;
+    private boolean warningsAccepted;
+    private boolean alphaWarningRequired;
+    private boolean imageContentDetected;
+    private long textCharacters;
+    private long estimatedTokens;
+    private String cacheKey;
+    private String vectorStoreId;
+    private Instant createdAt;
+    private ChatbotUsageSummary usageSummary;
+
+    public static String randomSessionId() {
+        return UUID.randomUUID().toString();
+    }
+
+    public Map<String, String> getMetadata() {
+        return metadata == null ? Collections.emptyMap() : metadata;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSessionCreateRequest.java

@@ -0,0 +1,24 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.util.Map;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotSessionCreateRequest {
+
+    private String sessionId;
+    private String documentId;
+    private String userId;
+    private String text;
+    private Map<String, String> metadata;
+    private boolean ocrRequested;
+    private boolean warningsAccepted;
+    private boolean imagesDetected;
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotSessionResponse.java

@@ -0,0 +1,39 @@
+package stirling.software.proprietary.model.chatbot;
+
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotSessionResponse {
+
+    private String sessionId;
+    private String documentId;
+    private boolean alphaWarning;
+    private boolean ocrRequested;
+    private boolean imageContentDetected;
+    private long maxCachedCharacters;
+    private long textCharacters;
+    private long estimatedTokens;
+    private Instant createdAt;
+    private List<String> warnings;
+    private Map<String, String> metadata;
+    private ChatbotUsageSummary usageSummary;
+
+    public List<String> getWarnings() {
+        return warnings == null ? Collections.emptyList() : warnings;
+    }
+
+    public Map<String, String> getMetadata() {
+        return metadata == null ? Collections.emptyMap() : metadata;
+    }
+}

app/proprietary/src/main/java/stirling/software/proprietary/model/chatbot/ChatbotUsageSummary.java

@@ -0,0 +1,22 @@
+package stirling.software.proprietary.model.chatbot;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ChatbotUsageSummary {
+
+    private long allocatedTokens;
+    private long consumedTokens;
+    private long remainingTokens;
+    private double usageRatio;
+    private boolean nearingLimit;
+    private boolean limitExceeded;
+    private long lastIncrementTokens;
+    private String window;
+}

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/MailConfig.java

@@ -33,8 +33,7 @@ public class MailConfig {
 
         // Creates a new instance of JavaMailSenderImpl, which is a Spring implementation
         JavaMailSenderImpl mailSender = new JavaMailSenderImpl();
-        String host = mailProperties.getHost();
-        mailSender.setHost(host);
+        mailSender.setHost(mailProperties.getHost());
         mailSender.setPort(mailProperties.getPort());
         mailSender.setDefaultEncoding("UTF-8");
 
@@ -71,32 +70,8 @@ public class MailConfig {
             log.info("SMTP authentication disabled - no credentials provided");
         }
 
-        boolean startTlsEnabled =
-                mailProperties.getStartTlsEnable() == null || mailProperties.getStartTlsEnable();
         // Enables STARTTLS to encrypt the connection if supported by the SMTP server
-        props.put("mail.smtp.starttls.enable", Boolean.toString(startTlsEnabled));
-        if (mailProperties.getStartTlsRequired() != null) {
-            props.put(
-                    "mail.smtp.starttls.required", mailProperties.getStartTlsRequired().toString());
-        }
-
-        if (mailProperties.getSslEnable() != null) {
-            props.put("mail.smtp.ssl.enable", mailProperties.getSslEnable().toString());
-        }
-
-        // Trust the configured host to allow STARTTLS with self-signed certificates
-        String sslTrust = mailProperties.getSslTrust();
-        if (sslTrust == null || sslTrust.trim().isEmpty()) {
-            sslTrust = "*";
-        }
-        if (sslTrust != null && !sslTrust.trim().isEmpty()) {
-            props.put("mail.smtp.ssl.trust", sslTrust);
-        }
-        if (mailProperties.getSslCheckServerIdentity() != null) {
-            props.put(
-                    "mail.smtp.ssl.checkserveridentity",
-                    mailProperties.getSslCheckServerIdentity().toString());
-        }
+        props.put("mail.smtp.starttls.enable", "true");
 
         // Returns the configured mail sender, ready to send emails
         return mailSender;

app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java

@@ -1,6 +1,7 @@
 package stirling.software.proprietary.security.configuration;
 
 import java.util.List;
+import java.util.Optional;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -24,6 +25,8 @@ import org.springframework.security.saml2.provider.service.web.authentication.Op
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
 import org.springframework.security.web.savedrequest.NullRequestCache;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 import org.springframework.web.cors.CorsConfiguration;
@@ -44,6 +47,7 @@ import stirling.software.proprietary.security.database.repository.PersistentLogi
 import stirling.software.proprietary.security.filter.IPRateLimitingFilter;
 import stirling.software.proprietary.security.filter.JwtAuthenticationFilter;
 import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
+import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.oauth2.CustomOAuth2AuthenticationSuccessHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
@@ -55,6 +59,7 @@ import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.LoginAttemptService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
 
 @Slf4j
 @Configuration
@@ -80,8 +85,7 @@ public class SecurityConfiguration {
     private final GrantedAuthoritiesMapper oAuth2userAuthoritiesMapper;
     private final RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations;
     private final OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver;
-    private final stirling.software.proprietary.service.UserLicenseSettingsService
-            licenseSettingsService;
+    private final UserLicenseSettingsService licenseSettingsService;
 
     public SecurityConfiguration(
             PersistentLoginRepository persistentLoginRepository,
@@ -102,8 +106,7 @@ public class SecurityConfiguration {
                     RelyingPartyRegistrationRepository saml2RelyingPartyRegistrations,
             @Autowired(required = false)
                     OpenSaml4AuthenticationRequestResolver saml2AuthenticationRequestResolver,
-            stirling.software.proprietary.service.UserLicenseSettingsService
-                    licenseSettingsService) {
+            UserLicenseSettingsService licenseSettingsService) {
         this.userDetailsService = userDetailsService;
         this.userService = userService;
         this.loginEnabledValue = loginEnabledValue;
@@ -194,19 +197,84 @@ public class SecurityConfiguration {
             http.cors(cors -> cors.disable());
         }
 
-        http.csrf(CsrfConfigurer::disable);
+        if (securityProperties.getCsrfDisabled() || !loginEnabledValue) {
+            http.csrf(CsrfConfigurer::disable);
+        }
 
         if (loginEnabledValue) {
+            boolean v2Enabled = appConfig.v2Enabled();
 
             http.addFilterBefore(
                             userAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
                     .addFilterBefore(rateLimitingFilter, UsernamePasswordAuthenticationFilter.class)
                     .addFilterBefore(jwtAuthenticationFilter, UserAuthenticationFilter.class);
 
+            if (!securityProperties.getCsrfDisabled()) {
+                CookieCsrfTokenRepository cookieRepo =
+                        CookieCsrfTokenRepository.withHttpOnlyFalse();
+                CsrfTokenRequestAttributeHandler requestHandler =
+                        new CsrfTokenRequestAttributeHandler();
+                requestHandler.setCsrfRequestAttributeName(null);
+                http.csrf(
+                        csrf ->
+                                csrf.ignoringRequestMatchers(
+                                                request -> {
+                                                    String uri = request.getRequestURI();
+                                                    String contextPath = request.getContextPath();
+                                                    String trimmedUri =
+                                                            uri.startsWith(contextPath)
+                                                                    ? uri.substring(
+                                                                            contextPath.length())
+                                                                    : uri;
+
+                                                    // Ignore CSRF for auth endpoints + oauth/saml
+                                                    if (trimmedUri.startsWith("/api/v1/auth/")
+                                                            || trimmedUri.startsWith("/oauth2")
+                                                            || trimmedUri.startsWith("/saml2")
+                                                            || trimmedUri.startsWith(
+                                                                    "/login/oauth2/code/")) {
+                                                        return true;
+                                                    }
+
+                                                    String apiKey = request.getHeader("X-API-KEY");
+                                                    // If there's no API key, don't ignore CSRF
+                                                    // (return false)
+                                                    if (apiKey == null || apiKey.trim().isEmpty()) {
+                                                        return false;
+                                                    }
+                                                    // Validate API key using existing UserService
+                                                    try {
+                                                        Optional<User> user =
+                                                                userService.getUserByApiKey(apiKey);
+                                                        // If API key is valid, ignore CSRF (return
+                                                        // true)
+                                                        // If API key is invalid, don't ignore CSRF
+                                                        // (return false)
+                                                        return user.isPresent();
+                                                    } catch (Exception e) {
+                                                        // If there's any error validating the API
+                                                        // key, don't ignore CSRF
+                                                        return false;
+                                                    }
+                                                })
+                                        .csrfTokenRepository(cookieRepo)
+                                        .csrfTokenRequestHandler(requestHandler));
+            }
+
             http.sessionManagement(
-                    sessionManagement ->
+                    sessionManagement -> {
+                        if (v2Enabled) {
                             sessionManagement.sessionCreationPolicy(
-                                    SessionCreationPolicy.STATELESS));
+                                    SessionCreationPolicy.STATELESS);
+                        } else {
+                            sessionManagement
+                                    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
+                                    .maximumSessions(10)
+                                    .maxSessionsPreventsLogin(false)
+                                    .sessionRegistry(sessionRegistry)
+                                    .expiredUrl("/login?logout=true");
+                        }
+                    });
             http.authenticationProvider(daoAuthenticationProvider());
             http.requestCache(requestCache -> requestCache.requestCache(new NullRequestCache()));
 
@@ -265,16 +333,10 @@ public class SecurityConfiguration {
                                     .authenticated());
             // Handle User/Password Logins
             if (securityProperties.isUserPass()) {
-                // v2: Authentication is handled via API (/api/v1/auth/login), not form login
-                // We configure form login to handle Spring Security redirects,
-                // but use /perform_login as the processing URL so /login remains a React route
                 http.formLogin(
                         formLogin ->
                                 formLogin
-                                        .loginPage("/login") // Redirect here when unauthenticated
-                                        .loginProcessingUrl(
-                                                "/perform_login") // Process form posts here (not
-                                        // /login)
+                                        .loginPage("/login")
                                         .successHandler(
                                                 new CustomAuthenticationSuccessHandler(
                                                         loginAttemptService,
@@ -289,14 +351,26 @@ public class SecurityConfiguration {
             if (securityProperties.isOauth2Active()) {
                 http.oauth2Login(
                         oauth2 -> {
-                            oauth2.loginPage("/login")
+                            // v1: Use /oauth2 as login page for Thymeleaf templates
+                            if (!v2Enabled) {
+                                oauth2.loginPage("/oauth2");
+                            }
+
+                            // v2: Don't set loginPage, let default OAuth2 flow handle it
+                            oauth2
+                                    /*
+                                       This Custom handler is used to check if the OAUTH2 user trying to log in, already exists in the database.
+                                       If user exists, login proceeds as usual. If user does not exist, then it is auto-created but only if 'OAUTH2AutoCreateUser'
+                                       is set as true, else login fails with an error message advising the same.
+                                    */
                                     .successHandler(
                                             new CustomOAuth2AuthenticationSuccessHandler(
                                                     loginAttemptService,
                                                     securityProperties.getOauth2(),
                                                     userService,
                                                     jwtService,
-                                                    licenseSettingsService))
+                                                    licenseSettingsService,
+                                                    applicationProperties))
                                     .failureHandler(new CustomOAuth2AuthenticationFailureHandler())
                                     // Add existing Authorities from the database
                                     .userInfoEndpoint(
@@ -323,8 +397,12 @@ public class SecurityConfiguration {
                         .saml2Login(
                                 saml2 -> {
                                     try {
-                                        saml2.loginPage("/login")
-                                                .relyingPartyRegistrationRepository(
+                                        // Only set login page for v1/Thymeleaf mode
+                                        if (!v2Enabled) {
+                                            saml2.loginPage("/saml2");
+                                        }
+
+                                        saml2.relyingPartyRegistrationRepository(
                                                         saml2RelyingPartyRegistrations)
                                                 .authenticationManager(
                                                         new ProviderManager(authenticationProvider))

app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UserController.java

@@ -7,7 +7,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.UUID;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -19,7 +18,6 @@ import org.springframework.security.oauth2.core.user.OAuth2User;
 import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
 import org.springframework.web.bind.annotation.*;
 
-import jakarta.mail.MessagingException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.transaction.Transactional;
@@ -238,8 +236,6 @@ public class UserController {
             return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                     .body(Map.of("error", "incorrectPassword", "message", "Incorrect password"));
         }
-        // Set flags before changing password so they're saved together
-        user.setForcePasswordChange(false);
         userService.changePassword(user, newPassword);
         userService.changeFirstUse(user, false);
         // Logout using Spring's utility
@@ -588,79 +584,6 @@ public class UserController {
         return ResponseEntity.ok(Map.of("message", "User role updated successfully"));
     }
 
-    @PreAuthorize("hasRole('ROLE_ADMIN')")
-    @PostMapping("/admin/changePasswordForUser")
-    public ResponseEntity<?> changePasswordForUser(
-            @RequestParam(name = "username") String username,
-            @RequestParam(name = "newPassword", required = false) String newPassword,
-            @RequestParam(name = "generateRandom", defaultValue = "false") boolean generateRandom,
-            @RequestParam(name = "sendEmail", defaultValue = "false") boolean sendEmail,
-            @RequestParam(name = "includePassword", defaultValue = "false") boolean includePassword,
-            @RequestParam(name = "forcePasswordChange", defaultValue = "false")
-                    boolean forcePasswordChange,
-            HttpServletRequest request,
-            Authentication authentication)
-            throws SQLException, UnsupportedProviderException, MessagingException {
-        Optional<User> userOpt = userService.findByUsernameIgnoreCase(username);
-        if (userOpt.isEmpty()) {
-            return ResponseEntity.status(HttpStatus.NOT_FOUND)
-                    .body(Map.of("error", "User not found."));
-        }
-
-        String currentUsername = authentication.getName();
-        if (currentUsername.equalsIgnoreCase(username)) {
-            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                    .body(Map.of("error", "Cannot change your own password."));
-        }
-
-        User user = userOpt.get();
-
-        String finalPassword = newPassword;
-        if (generateRandom) {
-            finalPassword = UUID.randomUUID().toString().replace("-", "").substring(0, 12);
-        }
-
-        if (finalPassword == null || finalPassword.trim().isEmpty()) {
-            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                    .body(Map.of("error", "New password is required."));
-        }
-
-        // Set force password change flag before changing password so both are saved together
-        user.setForcePasswordChange(forcePasswordChange);
-        userService.changePassword(user, finalPassword);
-
-        // Invalidate all active sessions to force reauthentication
-        userService.invalidateUserSessions(username);
-
-        if (sendEmail) {
-            if (emailService.isEmpty() || !applicationProperties.getMail().isEnabled()) {
-                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                        .body(Map.of("error", "Email is not configured."));
-            }
-
-            String userEmail = user.getUsername();
-            // Check if username is a valid email format
-            if (userEmail == null || userEmail.isBlank() || !userEmail.contains("@")) {
-                return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-                        .body(
-                                Map.of(
-                                        "error",
-                                        "User's email is not a valid email address. Notifications are disabled."));
-            }
-
-            String loginUrl = buildLoginUrl(request);
-            emailService
-                    .get()
-                    .sendPasswordChangedNotification(
-                            userEmail,
-                            user.getUsername(),
-                            includePassword ? finalPassword : null,
-                            loginUrl);
-        }
-
-        return ResponseEntity.ok(Map.of("message", "User password updated successfully"));
-    }
-
     @PreAuthorize("hasRole('ROLE_ADMIN')")
     @PostMapping("/admin/changeUserEnabled/{username}")
     public ResponseEntity<?> changeUserEnabled(

app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java

@@ -56,19 +56,6 @@ public interface UserRepository extends JpaRepository<User, Long> {
                     + "OR LOWER(u.authenticationType) IN ('sso', 'oauth2', 'saml2')")
     List<User> findAllSsoUsers();
 
-    /**
-     * Finds SSO users who have never created a session (pending activation) and are not yet
-     * grandfathered.
-     */
-    @Query(
-            "SELECT u FROM User u "
-                    + "LEFT JOIN SessionEntity s ON u.username = s.principalName "
-                    + "WHERE (u.ssoProvider IS NOT NULL "
-                    + "OR LOWER(u.authenticationType) IN ('sso', 'oauth2', 'saml2')) "
-                    + "AND (u.oauthGrandfathered IS NULL OR u.oauthGrandfathered = false) "
-                    + "AND s.sessionId IS NULL")
-    List<User> findPendingSsoUsersWithoutSession();
-
     /**
      * Counts all SSO users - those with sso_provider set OR authenticationType is sso/oauth2/saml2.
      */

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java

@@ -26,7 +26,6 @@ import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 
-import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.model.ApplicationProperties;
@@ -40,7 +39,6 @@ import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.UserService;
 
 @Slf4j
-@RequiredArgsConstructor
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
     private final JwtServiceInterface jwtService;
@@ -49,6 +47,19 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
     private final AuthenticationEntryPoint authenticationEntryPoint;
     private final ApplicationProperties.Security securityProperties;
 
+    public JwtAuthenticationFilter(
+            JwtServiceInterface jwtService,
+            UserService userService,
+            CustomUserDetailsService userDetailsService,
+            AuthenticationEntryPoint authenticationEntryPoint,
+            ApplicationProperties.Security securityProperties) {
+        this.jwtService = jwtService;
+        this.userService = userService;
+        this.userDetailsService = userDetailsService;
+        this.authenticationEntryPoint = authenticationEntryPoint;
+        this.securityProperties = securityProperties;
+    }
+
     @Override
     protected void doFilterInternal(
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
@@ -57,11 +68,7 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             filterChain.doFilter(request, response);
             return;
         }
-
-        String requestURI = request.getRequestURI();
-        String contextPath = request.getContextPath();
-
-        if (isStaticResource(contextPath, requestURI)) {
+        if (isStaticResource(request.getContextPath(), request.getRequestURI())) {
             filterChain.doFilter(request, response);
             return;
         }
@@ -70,7 +77,10 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             String jwtToken = jwtService.extractToken(request);
 
             if (jwtToken == null) {
-                // Allow auth endpoints to pass through without JWT
+                // Allow specific auth endpoints to pass through without JWT
+                String requestURI = request.getRequestURI();
+                String contextPath = request.getContextPath();
+
                 if (!isPublicAuthEndpoint(requestURI, contextPath)) {
                     // For API requests, return 401 JSON
                     String acceptHeader = request.getHeader("Accept");
@@ -95,18 +105,22 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             }
 
             try {
+                log.debug("Validating JWT token");
                 jwtService.validateToken(jwtToken);
+                log.debug("JWT token validated successfully");
             } catch (AuthenticationFailureException e) {
-                log.debug("JWT validation failed: {}", e.getMessage());
+                log.warn("JWT validation failed: {}", e.getMessage());
                 handleAuthenticationFailure(request, response, e);
                 return;
             }
 
             Map<String, Object> claims = jwtService.extractClaims(jwtToken);
             String tokenUsername = claims.get("sub").toString();
+            log.debug("JWT token username: {}", tokenUsername);
 
             try {
                 authenticate(request, claims);
+                log.debug("Authentication successful for user: {}", tokenUsername);
             } catch (SQLException | UnsupportedProviderException e) {
                 log.error("Error processing user authentication for user: {}", tokenUsername, e);
                 handleAuthenticationFailure(

app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java

@@ -241,6 +241,24 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
         filterChain.doFilter(request, response);
     }
 
+    private static boolean isPublicAuthEndpoint(String requestURI, String contextPath) {
+        // Remove context path from URI to normalize path matching
+        String trimmedUri =
+                requestURI.startsWith(contextPath)
+                        ? requestURI.substring(contextPath.length())
+                        : requestURI;
+
+        // Public auth endpoints that don't require authentication
+        return trimmedUri.startsWith("/login")
+                || trimmedUri.startsWith("/auth/")
+                || trimmedUri.startsWith("/oauth2")
+                || trimmedUri.startsWith("/saml2")
+                || trimmedUri.startsWith("/api/v1/auth/login")
+                || trimmedUri.startsWith("/api/v1/auth/refresh")
+                || trimmedUri.startsWith("/api/v1/auth/logout")
+                || trimmedUri.startsWith("/api/v1/proprietary/ui-data/login");
+    }
+
     private enum UserLoginType {
         USERDETAILS("UserDetails"),
         OAUTH2USER("OAuth2User"),