Infrastructure & Deployment

1. DNS Stack (us-east-1) → Creates certificates for CloudFront
2. Network Stack → VPC, security groups, regional API certificate
3. Secrets Stack → AWS Secrets Manager, KMS keys
4. Database Stack → RDS PostgreSQL, automated backups
5. Storage Stack → S3 buckets, CloudFront CDN
6. EventBus Stack → EventBridge for domain events
7. Monitoring Stack → CloudWatch dashboards, alarms, GitHub issues integration
8. CI/CD Stack → ECR repositories, GitHub Actions OIDC roles
9. Cognito Stack → User pools, identity providers
10. SES Stack → Email templates, bounce handling
11. Cluster Stack → ECS Fargate cluster (staging/production only)
12. Domain Service Stacks → Each microservice deployed separately
    - Event Management Stack
    - Speaker Coordination Stack
    - Partner Coordination Stack
    - Attendee Experience Stack
    - Company Management Stack
    - API Gateway Service Stack (Spring Boot)
13. API Gateway Stack → AWS HTTP API (proxy to Spring Boot)
14. Frontend Stack → React SPA on S3 + CloudFront

# 1. Start local PostgreSQL
docker compose -f docker-compose-dev.yml up -d

# 2. Start all services natively (recommended)
make dev-native-up

# 3. First time only: Sync users from production Cognito
./scripts/auth/get-token.sh staging your-email@example.com your-password
./scripts/dev/sync-users-from-cognito.sh

# Running services:
# → PostgreSQL on localhost:5432 (Docker)
# → api-gateway on http://localhost:8080 (native)
# → company-user-management on http://localhost:8081 (native)
# → event-management on http://localhost:8082 (native)
# → speaker-coordination on http://localhost:8083 (native)
# → partner-coordination on http://localhost:8084 (native)
# → attendee-experience on http://localhost:8085 (native)
# → React frontend on http://localhost:3000 (Vite)

# Morning: Start development environment
docker compose -f docker-compose-dev.yml up -d  # PostgreSQL
make dev-native-up                              # All services

# During development:
# - Make code changes → services auto-reload
# - Local PostgreSQL → instant database queries
# - Staging Cognito → realistic auth testing
# - View logs: make dev-native-logs

# Evening: Stop services
make dev-native-down

# application-production.yml
spring:
  cache:
    type: caffeine
    caffeine:
      spec: maximumSize=500,expireAfterWrite=10m

# Scale up RDS instance
aws rds modify-db-instance \
  --db-instance-identifier batbern-production \
  --db-instance-class db.t4g.small \
  --apply-immediately

# Scale back down
aws rds modify-db-instance \
  --db-instance-identifier batbern-production \
  --db-instance-class db.t4g.micro \
  --apply-immediately

Alarms:
  RDS_HighCPU:
    Metric: CPUUtilization
    Threshold: 80%
    Action: SNS notification to ops team

  RDS_HighConnections:
    Metric: DatabaseConnections
    Threshold: 80
    Action: SNS notification

  API_HighLatency:
    Metric: P95Latency
    Threshold: 500ms
    Action: Slack alert #dev-alerts

  CostAnomaly:
    Metric: EstimatedCharges
    Threshold: $150
    Action: Email + PagerDuty

// infrastructure/lib/stacks/api-gateway-stack.ts
const httpApi = new HttpApi(this, 'BATbernHttpApi', {
  defaultAuthorizer: new HttpJwtAuthorizer('CognitoAuthorizer',
    cognitoIssuer, {
      jwtAudience: [userPoolClient.userPoolClientId],
    }
  ),
  defaultDomainMapping: {
    domainName: apiDomain, // api.batbern.ch
    certificate: apiCertificate,
  },
  corsPreflight: {
    allowOrigins: ['https://www.batbern.ch'],
    allowMethods: [CorsHttpMethod.GET, CorsHttpMethod.POST,
                   CorsHttpMethod.PUT, CorsHttpMethod.DELETE],
    allowHeaders: ['Authorization', 'Content-Type', 'X-Correlation-ID'],
  },
});

// Proxy ALL requests to Spring Boot API Gateway
httpApi.addRoutes({
  path: '/{proxy+}',
  methods: [HttpMethod.ANY],
  integration: new HttpAlbIntegration('SpringGatewayIntegration',
    springBootApiGatewayAlb.listener),
});

# api-gateway/src/main/resources/application.yml
spring:
  cloud:
    gateway:
      routes:
        # Event Management Service
        - id: event-management
          uri: ${EVENT_MANAGEMENT_SERVICE_URL} # Internal ALB DNS
          predicates:
            - Path=/api/v1/events/**, /api/v1/organizers/**
          filters:
            - AddRequestHeader=X-Service-Name, event-management
            - CircuitBreaker=eventManagementCircuitBreaker

        # Speaker Coordination Service
        - id: speaker-coordination
          uri: ${SPEAKER_COORDINATION_SERVICE_URL}
          predicates:
            - Path=/api/v1/speakers/**, /api/v1/sessions/**, /api/v1/materials/**
          filters:
            - AddRequestHeader=X-Service-Name, speaker-coordination
            - CircuitBreaker=speakerCircuitBreaker

        # Partner Coordination Service
        - id: partner-coordination
          uri: ${PARTNER_COORDINATION_SERVICE_URL}
          predicates:
            - Path=/api/v1/partners/**, /api/v1/topics/**
          filters:
            - AddRequestHeader=X-Service-Name, partner-coordination

        # Attendee Experience Service
        - id: attendee-experience
          uri: ${ATTENDEE_EXPERIENCE_SERVICE_URL}
          predicates:
            - Path=/api/v1/content/**, /api/v1/registrations/**
          filters:
            - AddRequestHeader=X-Service-Name, attendee-experience

        # Company & User Management Service
        - id: company-management
          uri: ${COMPANY_USER_MANAGEMENT_SERVICE_URL}
          predicates:
            - Path=/api/v1/companies/**, /api/v1/users/**
          filters:
            - AddRequestHeader=X-Service-Name, company-management

EVENT_MANAGEMENT_SERVICE_URL=http://internal-event-mgmt-alb-xxx.eu-central-1.elb.amazonaws.com
SPEAKER_COORDINATION_SERVICE_URL=http://internal-speaker-alb-xxx.eu-central-1.elb.amazonaws.com
PARTNER_COORDINATION_SERVICE_URL=http://internal-partner-alb-xxx.eu-central-1.elb.amazonaws.com
ATTENDEE_EXPERIENCE_SERVICE_URL=http://internal-attendee-alb-xxx.eu-central-1.elb.amazonaws.com
COMPANY_USER_MANAGEMENT_SERVICE_URL=http://internal-company-alb-xxx.eu-central-1.elb.amazonaws.com

# Full deployment (infrastructure changes or shared-kernel)
npm run deploy:staging -- --all --context environment=staging

# Selective deployment (specific service changes)
# Automatically run by CI/CD based on changed files
npm run deploy:staging:selective -- \
  BATbern-staging-SpeakerCoordination \
  --context environment=staging \
  --require-approval never

# View current checks
gh api repos/nissimbuchs/BATbern2/branches/develop/protection/required_status_checks

# Update checks (e.g., after adding a new service)
gh api repos/nissimbuchs/BATbern2/branches/develop/protection/required_status_checks \
  --method PATCH --input checks.json

# .github/workflows/build.yml
on:
  push:
    branches: [develop]

jobs:
  build-shared-kernel:
    - Build shared-kernel JAR
    - Run unit tests
    - Publish to package registry

  build-services:
    needs: build-shared-kernel
    strategy:
      matrix:
        service:
          - event-management
          - speaker-coordination
          - partner-coordination
          - attendee-experience
          - company-user-management
          - api-gateway
    steps:
      - Build Gradle project
      - Run unit tests (parallel)
      - Build Docker image (ARM64)
      - Tag: {sha}-staging.{run-number}
      - Push to Amazon ECR

  build-frontend:
    - Install dependencies (npm ci)
    - Build with Vite
    - Run unit tests (Vitest)
    - Build artifacts for CDK

# .github/workflows/deploy-staging.yml
on:
  workflow_call: # Called from build.yml
  workflow_dispatch: # Manual trigger

jobs:
  deploy-to-staging:
    steps:
      1. Detect changed components (Git diff analysis)
      2. Create database backup (if needed)
      3. Build frontend (Vite with staging env vars)
      4. Deploy changed CDK stacks
      5. Wait for ECS service stabilization
      6. Run smoke tests
      7. Run CORS validation tests
      8. Run header propagation tests
      9. Run Bruno API contract tests
      10. Notify on success/failure

# Production Frontend Build (deployed via staging workflow)
VITE_API_URL=https://api.batbern.ch
VITE_AWS_REGION=eu-central-1
VITE_COGNITO_USER_POOL_ID=${STAGING_COGNITO_USER_POOL_ID}
VITE_COGNITO_CLIENT_ID=${STAGING_COGNITO_CLIENT_ID}

# Build workflow creates images with format:
${SHORT_SHA}-staging.${BUILD_RUN_NUMBER}

# Example:
# a1b2c3d-staging.142
# ↑       ↑        ↑
# commit  env      build number

# .github/workflows/deploy-production.yml
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to deploy (e.g., v1.2.3)'
        required: true
      migrate_database:
        description: 'Run database migrations'
        type: boolean
        default: true

jobs:
  pre-deployment-checks:
    - Verify version tag exists
    - Check staging deployment status
    - Validate version matches staging

  backup-database:
    - Create RDS snapshot
    - Wait for snapshot completion
    - Store snapshot ID for potential rollback

  blue-green-deployment:
    - Checkout version tag
    - Deploy infrastructure (CDK)
    - Wait for ECS service stabilization
    - Run comprehensive E2E tests

  smoke-tests:
    - Run smoke tests
    - Run CORS validation
    - Run header propagation tests
    - Run Bruno API contract tests
    - Verify critical endpoints

  rollback-on-failure:
    if: failure()
    - Restore previous ECS task definitions
    - Restore database snapshot (if needed)
    - Notify team of rollback

# GitHub Actions assumes AWS role via OIDC
- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::188701360969:role/batbern-staging-github-actions-role
    aws-region: eu-central-1

# No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY needed!
# Short-lived credentials automatically refreshed

Inbound:
  - 0.0.0.0/0 → 443 (HTTPS) - Public internet access

Outbound:
  - ECS-Gateway SG → 8080 (HTTP) - Forward to Spring Boot Gateway

Inbound:
  - ALB-Public SG → 8080 (HTTP) - Receive from public ALB

Outbound:
  - ALB-Internal SG → 80 (HTTP) - Route to domain microservices
  - 0.0.0.0/0 → 443 (HTTPS) - AWS services via NAT

Inbound:
  - ECS-Gateway SG → 80 (HTTP) - Receive from API Gateway

Outbound:
  - ECS-Services SG → 8080 (HTTP) - Forward to microservices

Inbound:
  - ALB-Internal SG → 8080 (HTTP) - Receive from internal ALBs

Outbound:
  - RDS-SG → 5432 (PostgreSQL) - Database access
  - 0.0.0.0/0 → 443 (HTTPS) - AWS services (S3, SES, Cognito) via NAT

Inbound:
  - ECS-Services SG → 5432 (PostgreSQL) - Microservices access
  - Bastion-SG → 5432 (PostgreSQL) - Development environment only

Outbound:
  - None (database doesn't initiate connections)

### AWS Route53 Configuration Benefits
- **Automatic DNS management** - No manual CNAME configuration required
- **Health checks and failover** - Built-in monitoring and automatic failover
- **SSL certificate validation** - Automatic domain validation for Let's Encrypt
- **Global DNS resolution** - AWS Route53 global network for fast DNS resolution
- **Cost optimization** - Eliminate external DNS provider costs

This approach provides full AWS infrastructure integration with native Route53 DNS management, eliminating external dependencies while maintaining proper Swiss hosting compliance.

## AWS SES Email Infrastructure

### SES Configuration Architecture

The BATbern platform uses AWS Simple Email Service (SES) for all transactional and marketing email delivery with comprehensive tracking and deliverability monitoring.

#### Domain Verification and Authentication

```typescript
// CDK Stack for SES Email Infrastructure
import * as ses from 'aws-cdk-lib/aws-ses';
import * as route53 from 'aws-cdk-lib/aws-route53';
import * as sns from 'aws-cdk-lib/aws-sns';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';

export class EmailInfrastructureStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: StackProps) {
    super(scope, id, props);

    // Import existing Route53 hosted zone
    const hostedZone = route53.HostedZone.fromLookup(this, 'BATbernZone', {
      domainName: 'batbern.ch',
    });

    // SES Domain Identity with DKIM
    const emailIdentity = new ses.EmailIdentity(this, 'BATbernEmailIdentity', {
      identity: ses.Identity.publicHostedZone(hostedZone),
      mailFromDomain: 'mail.batbern.ch',
      dkimSigning: true,
    });

    // Configuration Set for tracking and reputation management
    const configSet = new ses.ConfigurationSet(this, 'BATbernConfigSet', {
      configurationSetName: 'batbern-notifications',
      reputationMetrics: true,
      sendingEnabled: true,
      customTrackingRedirectDomain: 'track.batbern.ch',
    });

    // SNS Topics for bounce and complaint handling
    const bouncesTopic = new sns.Topic(this, 'EmailBounces', {
      displayName: 'BATbern Email Bounces',
    });

    const complaintsTopic = new sns.Topic(this, 'EmailComplaints', {
      displayName: 'BATbern Email Complaints',
    });

    // Event destinations for bounce/complaint handling
    configSet.addEventDestination('BounceEvents', {
      destination: ses.EventDestination.snsTopic(bouncesTopic),
      events: [ses.EmailSendingEvent.BOUNCE, ses.EmailSendingEvent.REJECT],
    });

    configSet.addEventDestination('ComplaintEvents', {
      destination: ses.EventDestination.snsTopic(complaintsTopic),
      events: [ses.EmailSendingEvent.COMPLAINT],
    });

    configSet.addEventDestination('DeliveryEvents', {
      destination: ses.EventDestination.snsTopic(new sns.Topic(this, 'EmailDeliveries')),
      events: [ses.EmailSendingEvent.DELIVERY],
    });

    // CloudWatch Alarms for delivery monitoring
    new cloudwatch.Alarm(this, 'HighBounceRate', {
      metric: new cloudwatch.Metric({
        namespace: 'AWS/SES',
        metricName: 'Reputation.BounceRate',
        statistic: 'Average',
        period: cdk.Duration.hours(1),
      }),
      threshold: 0.05, // 5% bounce rate
      evaluationPeriods: 1,
      alarmDescription: 'Email bounce rate exceeds 5% threshold',
      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
    });

    new cloudwatch.Alarm(this, 'HighComplaintRate', {
      metric: new cloudwatch.Metric({
        namespace: 'AWS/SES',
        metricName: 'Reputation.ComplaintRate',
        statistic: 'Average',
        period: cdk.Duration.hours(1),
      }),
      threshold: 0.001, // 0.1% complaint rate
      evaluationPeriods: 1,
      alarmDescription: 'Email complaint rate exceeds 0.1% threshold',
      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
    });

    // Daily sending quota alarm
    new cloudwatch.Alarm(this, 'SendingQuotaExceeded', {
      metric: new cloudwatch.Metric({
        namespace: 'AWS/SES',
        metricName: 'Send',
        statistic: 'Sum',
        period: cdk.Duration.hours(24),
      }),
      threshold: 45000, // 90% of 50,000 daily quota
      evaluationPeriods: 1,
      alarmDescription: 'Daily sending approaching quota limit',
    });
  }
}

package ch.batbern.notification.service;

import com.amazonaws.services.simpleemail.AmazonSimpleEmailService;
import com.amazonaws.services.simpleemail.model.*;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

@Service
public class SESTemplateService {
    private final AmazonSimpleEmailService sesClient;
    private final EmailTemplateRepository templateRepository;

    public SESTemplateService(AmazonSimpleEmailService sesClient,
                              EmailTemplateRepository templateRepository) {
        this.sesClient = sesClient;
        this.templateRepository = templateRepository;
    }

    @Transactional
    public void syncTemplateToSES(EmailTemplate template) {
        String sesTemplateName = generateSESTemplateName(template);

        Template sesTemplate = new Template()
            .withTemplateName(sesTemplateName)
            .withSubjectPart(template.getSubject())
            .withHtmlPart(template.getHtmlBody())
            .withTextPart(template.getTextBody());

        try {
            // Try to update existing template first
            UpdateTemplateRequest updateRequest = new UpdateTemplateRequest()
                .withTemplate(sesTemplate);
            sesClient.updateTemplate(updateRequest);

        } catch (TemplateDoesNotExistException e) {
            // Template doesn't exist, create it
            CreateTemplateRequest createRequest = new CreateTemplateRequest()
                .withTemplate(sesTemplate);
            sesClient.createTemplate(createRequest);
        }
    }

    public void sendTemplatedEmail(String templateId, String recipient,
                                    Map<String, String> templateData) {
        EmailTemplate template = templateRepository.findById(UUID.fromString(templateId))
            .orElseThrow(() -> new TemplateNotFoundException(templateId));

        String sesTemplateName = generateSESTemplateName(template);

        SendTemplatedEmailRequest request = new SendTemplatedEmailRequest()
            .withSource("noreply@berner-architekten-treffen.ch")
            .withDestination(new Destination().withToAddresses(recipient))
            .withTemplate(sesTemplateName)
            .withTemplateData(new ObjectMapper().writeValueAsString(templateData))
            .withConfigurationSetName("batbern-notifications");

        SendTemplatedEmailResult result = sesClient.sendTemplatedEmail(request);

        // Log notification with SES Message ID
        logNotification(recipient, templateId, result.getMessageId());
    }

    private String generateSESTemplateName(EmailTemplate template) {
        return String.format("%s_%s_v%d",
            template.getTemplateType(),
            template.getLanguage(),
            template.getVersion());
    }
}

package ch.batbern.notification.handler;

import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;
import com.amazonaws.services.lambda.runtime.events.SNSEvent;
import org.springframework.stereotype.Component;

@Component
public class SESBounceHandler implements RequestHandler<SNSEvent, Void> {

    private final NotificationLogRepository logRepository;
    private final UserService userService;

    @Override
    public Void handleRequest(SNSEvent event, Context context) {
        for (SNSEvent.SNSRecord record : event.getRecords()) {
            String message = record.getSNS().getMessage();
            SESNotification notification = parseNotification(message);

            if ("Bounce".equals(notification.getNotificationType())) {
                handleBounce(notification.getBounce());
            } else if ("Complaint".equals(notification.getNotificationType())) {
                handleComplaint(notification.getComplaint());
            }
        }
        return null;
    }

    private void handleBounce(Bounce bounce) {
        for (BouncedRecipient recipient : bounce.getBouncedRecipients()) {
            // Update notification log
            logRepository.updateDeliveryStatus(
                bounce.getFeedbackId(),
                DeliveryStatus.BOUNCED,
                recipient.getDiagnosticCode()
            );

            // If hard bounce, disable email notifications for user
            if ("Permanent".equals(bounce.getBounceType())) {
                userService.disableEmailNotifications(recipient.getEmailAddress());
            }
        }
    }

    private void handleComplaint(Complaint complaint) {
        for (ComplainedRecipient recipient : complaint.getComplainedRecipients()) {
            // Update notification log
            logRepository.updateDeliveryStatus(
                complaint.getFeedbackId(),
                DeliveryStatus.COMPLAINED,
                "User marked email as spam"
            );

            // Automatically unsubscribe user from all marketing emails
            userService.unsubscribeFromMarketing(recipient.getEmailAddress());
        }
    }
}

# SES Configuration
AWS_SES_REGION=eu-central-1
AWS_SES_CONFIGURATION_SET=batbern-notifications
AWS_SES_FROM_ADDRESS=noreply@berner-architekten-treffen.ch
AWS_SES_REPLY_TO_ADDRESS=info@berner-architekten-treffen.ch.ch
AWS_SES_DAILY_QUOTA=50000
AWS_SES_RATE_LIMIT=14  # emails per second

# Monitoring
AWS_SES_BOUNCE_TOPIC_ARN=arn:aws:sns:eu-central-1:ACCOUNT:EmailBounces
AWS_SES_COMPLAINT_TOPIC_ARN=arn:aws:sns:eu-central-1:ACCOUNT:EmailComplaints

// Illustrative — see infrastructure/lib/stacks/storage-stack.ts for the canonical version
import * as cdk from 'aws-cdk-lib';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as sns from 'aws-cdk-lib/aws-sns';
import { Construct } from 'constructs';

export interface ContentStorageStackProps extends cdk.StackProps {
  environment: string; // 'development' | 'staging' | 'production'
}

export class ContentStorageStack extends cdk.Stack {
  public readonly presentationsBucket: s3.Bucket;
  public readonly logosBucket: s3.Bucket;
  public readonly profilesBucket: s3.Bucket;
  public readonly archivesBucket: s3.Bucket;
  public readonly contentDistribution: cloudfront.Distribution;

  constructor(scope: Construct, id: string, props: ContentStorageStackProps) {
    super(scope, id, props);

    const { environment } = props;

    // Create content buckets with consistent configuration
    this.presentationsBucket = this.createContentBucket('presentations', environment, {
      maxSizeBytes: 100 * 1024 * 1024, // 100 MB
      lifecycleTransitionDays: 365,
    });

    this.logosBucket = this.createContentBucket('logos', environment, {
      maxSizeBytes: 5 * 1024 * 1024, // 5 MB
      lifecycleTransitionDays: 730, // 2 years
    });

    this.profilesBucket = this.createContentBucket('profiles', environment, {
      maxSizeBytes: 10 * 1024 * 1024, // 10 MB
      lifecycleTransitionDays: 365,
    });

    this.archivesBucket = this.createContentBucket('archives', environment, {
      maxSizeBytes: 20 * 1024 * 1024, // 20 MB per file
      lifecycleTransitionDays: 365,
    });

    // CloudFront Origin Access Identity for secure S3 access
    const originAccessIdentity = new cloudfront.OriginAccessIdentity(this, 'ContentOAI', {
      comment: `OAI for BATbern ${environment} content delivery`,
    });

    // Grant CloudFront read access to buckets
    [this.presentationsBucket, this.logosBucket, this.profilesBucket, this.archivesBucket]
      .forEach(bucket => {
        bucket.grantRead(originAccessIdentity);
      });

    // Lambda@Edge for image optimization
    const imageOptimizationFunction = new cloudfront.experimental.EdgeFunction(
      this,
      'ImageOptimization',
      {
        runtime: lambda.Runtime.NODEJS_18_X,
        handler: 'index.handler',
        code: lambda.Code.fromAsset('lambda/image-optimization'),
        memorySize: 512,
        timeout: cdk.Duration.seconds(5),
      }
    );

    // CloudFront distribution for content delivery
    this.contentDistribution = new cloudfront.Distribution(this, 'ContentDistribution', {
      comment: `BATbern ${environment} Content CDN`,
      defaultBehavior: {
        origin: new origins.S3Origin(this.presentationsBucket, {
          originAccessIdentity,
        }),
        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
        compress: true,
        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
        responseHeadersPolicy: this.createSecurityHeadersPolicy(),
      },
      additionalBehaviors: {
        '/logos/*': {
          origin: new origins.S3Origin(this.logosBucket, { originAccessIdentity }),
          viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          compress: true,
          cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
          edgeLambdas: [{
            functionVersion: imageOptimizationFunction.currentVersion,
            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_RESPONSE,
          }],
        },
        '/profiles/*': {
          origin: new origins.S3Origin(this.profilesBucket, { originAccessIdentity }),
          viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          compress: true,
          cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
          edgeLambdas: [{
            functionVersion: imageOptimizationFunction.currentVersion,
            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_RESPONSE,
          }],
        },
        '/archives/*': {
          origin: new origins.S3Origin(this.archivesBucket, { originAccessIdentity }),
          viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          compress: true,
          cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
        },
      },
      priceClass: cloudfront.PriceClass.PRICE_CLASS_100, // Europe + US
      enableLogging: true,
      logBucket: new s3.Bucket(this, 'CDNLogBucket', {
        bucketName: `batbern-${environment}-cdn-logs`,
        encryption: s3.BucketEncryption.S3_MANAGED,
        lifecycleRules: [{
          expiration: cdk.Duration.days(90),
        }],
        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      }),
      certificate: this.getCertificate(environment),
      domainNames: this.getDomainNames(environment),
    });

    // Cross-region replication for production
    if (environment === 'production') {
      this.setupCrossRegionReplication(this.presentationsBucket, 'eu-central-1');
      this.setupCrossRegionReplication(this.logosBucket, 'eu-central-1');
      this.setupCrossRegionReplication(this.profilesBucket, 'eu-central-1');
      this.setupCrossRegionReplication(this.archivesBucket, 'eu-central-1');
    }

    // CloudWatch alarms for storage monitoring
    this.createStorageAlarms(environment);

    // Outputs
    new cdk.CfnOutput(this, 'CDNDomain', {
      value: this.contentDistribution.distributionDomainName,
      description: 'CloudFront CDN domain for content delivery',
      exportName: `${environment}-cdn-domain`,
    });

    new cdk.CfnOutput(this, 'PresentationsBucketName', {
      value: this.presentationsBucket.bucketName,
      exportName: `${environment}-presentations-bucket`,
    });

    new cdk.CfnOutput(this, 'LogosBucketName', {
      value: this.logosBucket.bucketName,
      exportName: `${environment}-logos-bucket`,
    });

    new cdk.CfnOutput(this, 'ProfilesBucketName', {
      value: this.profilesBucket.bucketName,
      exportName: `${environment}-profiles-bucket`,
    });

    new cdk.CfnOutput(this, 'ArchivesBucketName', {
      value: this.archivesBucket.bucketName,
      exportName: `${environment}-archives-bucket`,
    });
  }

  private createContentBucket(
    contentType: string,
    environment: string,
    config: { maxSizeBytes: number; lifecycleTransitionDays: number }
  ): s3.Bucket {
    const bucket = new s3.Bucket(this, `${contentType}Bucket`, {
      bucketName: `batbern-${environment}-${contentType}`,
      encryption: s3.BucketEncryption.S3_MANAGED,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      versioned: true,
      lifecycleRules: [
        {
          id: 'TransitionToIA',
          enabled: true,
          transitions: [{
            storageClass: s3.StorageClass.INFREQUENT_ACCESS,
            transitionAfter: cdk.Duration.days(config.lifecycleTransitionDays),
          }],
        },
        {
          id: 'TransitionToGlacier',
          enabled: true,
          transitions: [{
            storageClass: s3.StorageClass.GLACIER,
            transitionAfter: cdk.Duration.days(config.lifecycleTransitionDays + 730), // +2 years
          }],
        },
        {
          id: 'CleanupIncompleteUploads',
          enabled: true,
          abortIncompleteMultipartUploadAfter: cdk.Duration.days(7),
        },
        {
          id: 'DeleteOldVersions',
          enabled: true,
          noncurrentVersionExpiration: cdk.Duration.days(30),
        },
      ],
      cors: [{
        allowedMethods: [s3.HttpMethods.GET, s3.HttpMethods.PUT, s3.HttpMethods.POST],
        allowedOrigins: this.getCorsOrigins(environment),
        allowedHeaders: ['*'],
        exposedHeaders: ['ETag', 'x-amz-version-id'],
        maxAge: 3000,
      }],
    });

    // Enable S3 inventory for disaster recovery
    bucket.addInventory({
      inventoryId: `${contentType}-inventory`,
      frequency: s3.InventoryFrequency.DAILY,
      destination: {
        bucket,
        prefix: 'inventory/',
      },
      includeObjectVersions: s3.InventoryObjectVersion.CURRENT,
      optionalFields: [
        'Size',
        'LastModifiedDate',
        'ETag',
        'StorageClass',
      ],
    });

    // Add bucket metrics for monitoring
    bucket.addMetric({
      id: `${contentType}-all-requests`,
    });

    return bucket;
  }

  private createSecurityHeadersPolicy(): cloudfront.ResponseHeadersPolicy {
    // Matches the deployed `batbern-content-cache-*` ResponseHeadersPolicy in
    // infrastructure/lib/stacks/storage-stack.ts.
    //
    // Story 12.12 review (finding #3): users can upload SVGs (profile pictures,
    // logos) which CloudFront serves as image/svg+xml. An SVG can carry <script>,
    // which executes when the object URL is opened top-level — stored XSS on the
    // cdn origin. CSP `sandbox` blocks script execution in top-level SVG documents
    // (a resource's CSP only applies when it IS the document; <img> rendering of
    // PNG/JPEG/WebP/SVG is unaffected); nosniff stops MIME-sniffing surprises.
    // See 08-operations-security.md §Frontend Security → "CDN SVG hardening".
    return new cloudfront.ResponseHeadersPolicy(this, 'ContentCacheHeaders', {
      comment: 'Immutable Cache-Control + SVG-safe security headers for content-addressed media',
      securityHeadersBehavior: {
        contentSecurityPolicy: {
          contentSecurityPolicy: 'sandbox',
          override: true,
        },
        contentTypeOptions: { override: true },  // X-Content-Type-Options: nosniff
      },
      customHeadersBehavior: {
        customHeaders: [{
          // Media keys are content-addressed (UUID filenames) → effectively immutable.
          // override:false — the image-resize Lambda already emits this header on
          // resized responses; the policy only fills it in for pass-through objects.
          header: 'Cache-Control',
          value: 'public, max-age=31536000, immutable',
          override: false,
        }],
      },
    });
  }

  private setupCrossRegionReplication(bucket: s3.Bucket, targetRegion: string): void {
    // Create replication destination bucket in secondary region
    const replicationBucket = new s3.Bucket(this, `${bucket.node.id}Replica`, {
      bucketName: `${bucket.bucketName}-replica`,
      encryption: s3.BucketEncryption.S3_MANAGED,
      versioned: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
    });

    // IAM role for replication
    const replicationRole = new iam.Role(this, `${bucket.node.id}ReplicationRole`, {
      assumedBy: new iam.ServicePrincipal('s3.amazonaws.com'),
      description: `Replication role for ${bucket.bucketName}`,
    });

    bucket.grantRead(replicationRole);
    replicationBucket.grantWrite(replicationRole);

    // Configure replication rule
    const cfnBucket = bucket.node.defaultChild as s3.CfnBucket;
    cfnBucket.replicationConfiguration = {
      role: replicationRole.roleArn,
      rules: [{
        id: 'ReplicateAll',
        status: 'Enabled',
        priority: 1,
        filter: {},
        destination: {
          bucket: replicationBucket.bucketArn,
          replicationTime: {
            status: 'Enabled',
            time: { minutes: 15 },
          },
          metrics: {
            status: 'Enabled',
            eventThreshold: { minutes: 15 },
          },
          storageClass: 'STANDARD_IA',
        },
      }],
    };
  }

  private createStorageAlarms(environment: string): void {
    const alarmTopic = new sns.Topic(this, 'StorageAlarmTopic', {
      displayName: `BATbern ${environment} Storage Alarms`,
    });

    // Alarm for high storage usage on presentations bucket
    new cloudwatch.Alarm(this, 'HighPresentationsStorage', {
      metric: this.presentationsBucket.metricBucketSizeBytes({
        statistic: 'Average',
        period: cdk.Duration.days(1),
      }),
      threshold: 100 * 1024 * 1024 * 1024, // 100 GB
      evaluationPeriods: 1,
      alarmDescription: 'Presentations bucket exceeds 100GB storage',
      actionsEnabled: true,
    }).addAlarmAction(new cloudwatch.SnsAction(alarmTopic));

    // Alarm for high error rate
    new cloudwatch.Alarm(this, 'High4xxErrorRate', {
      metric: new cloudwatch.Metric({
        namespace: 'AWS/S3',
        metricName: '4xxErrors',
        statistic: 'Sum',
        period: cdk.Duration.minutes(5),
        dimensionsMap: {
          BucketName: this.presentationsBucket.bucketName,
        },
      }),
      threshold: 100,
      evaluationPeriods: 2,
      alarmDescription: 'High rate of 4xx errors on S3 requests',
      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
    }).addAlarmAction(new cloudwatch.SnsAction(alarmTopic));

    // Alarm for replication lag (production only)
    if (environment === 'production') {
      new cloudwatch.Alarm(this, 'ReplicationLag', {
        metric: new cloudwatch.Metric({
          namespace: 'AWS/S3',
          metricName: 'ReplicationLatency',
          statistic: 'Maximum',
          period: cdk.Duration.minutes(5),
          dimensionsMap: {
            SourceBucket: this.presentationsBucket.bucketName,
          },
        }),
        threshold: 3600, // 1 hour in seconds
        evaluationPeriods: 1,
        alarmDescription: 'S3 replication lag exceeds 1 hour',
        treatMissingData: cloudwatch.TreatMissingData.BREACHING,
      }).addAlarmAction(new cloudwatch.SnsAction(alarmTopic));
    }
  }

  private getCorsOrigins(environment: string): string[] {
    switch (environment) {
      case 'staging': // Staging account serves production traffic
      case 'production':
        return ['https://www.batbern.ch', 'https://api.batbern.ch'];
      case 'development':
        return ['https://dev.batbern.ch', 'https://api-dev.batbern.ch', 'http://localhost:3000'];
      default:
        return ['http://localhost:3000'];
    }
  }

  private getCertificate(environment: string): cloudfront.ICertificate {
    // Import existing certificate from us-east-1 (required for CloudFront)
    // Certificate should be created in a separate stack in us-east-1
    return cloudfront.Certificate.fromCertificateArn(
      this,
      'CDNCertificate',
      `arn:aws:acm:us-east-1:ACCOUNT:certificate/${environment}-cdn-cert-id`
    );
  }

  private getDomainNames(environment: string): string[] {
    switch (environment) {
      case 'staging': // Staging account serves production traffic
      case 'production':
        return ['cdn.batbern.ch'];
      case 'development':
        // Development uses CloudFront auto-generated domain (no custom domain)
        return [];
      default:
        return [];
    }
  }
}

// lambda/image-optimization/index.js
const AWS = require('aws-sdk');
const sharp = require('sharp');

exports.handler = async (event) => {
  const { request, response } = event.Records[0].cf;

  // Only process image files
  const isImage = /\.(jpg|jpeg|png|webp)$/i.test(request.uri);
  if (!isImage) {
    return response;
  }

  // Parse query string for transformations
  const params = new URLSearchParams(request.querystring);
  const width = parseInt(params.get('w')) || null;
  const height = parseInt(params.get('h')) || null;
  const quality = parseInt(params.get('q')) || 80;
  const format = params.get('f') || 'auto';

  // If no transformations requested, return original
  if (!width && !height && format === 'auto') {
    return response;
  }

  try {
    // Get original image from S3
    const s3 = new AWS.S3();
    const bucket = response.headers['x-amz-bucket'][0].value;
    const key = request.uri.substring(1); // Remove leading /

    const s3Object = await s3.getObject({
      Bucket: bucket,
      Key: key,
    }).promise();

    // Transform image
    let transformer = sharp(s3Object.Body);

    if (width || height) {
      transformer = transformer.resize(width, height, {
        fit: 'inside',
        withoutEnlargement: true,
      });
    }

    // Format conversion
    if (format === 'webp' || (format === 'auto' && request.headers['accept']?.[0]?.value?.includes('image/webp'))) {
      transformer = transformer.webp({ quality });
      response.headers['content-type'] = [{ key: 'Content-Type', value: 'image/webp' }];
    } else if (format === 'avif') {
      transformer = transformer.avif({ quality });
      response.headers['content-type'] = [{ key: 'Content-Type', value: 'image/avif' }];
    } else {
      transformer = transformer.jpeg({ quality });
    }

    const transformedImage = await transformer.toBuffer();

    // Update response
    response.status = 200;
    response.body = transformedImage.toString('base64');
    response.bodyEncoding = 'base64';
    response.headers['cache-control'] = [{ key: 'Cache-Control', value: 'public, max-age=31536000, immutable' }];

    return response;
  } catch (error) {
    console.error('Image transformation error:', error);
    return response; // Return original on error
  }
};

package ch.batbern.content.service;

import software.amazon.awssdk.services.s3.S3Client;
import software.amazon.awssdk.services.s3.model.*;
import software.amazon.awssdk.services.s3.presigner.S3Presigner;
import software.amazon.awssdk.services.s3.presigner.model.*;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.beans.factory.annotation.Value;

import java.time.Duration;
import java.time.Instant;
import java.util.Map;
import java.util.UUID;

@Service
public class ContentStorageService {
    private final S3Client s3Client;
    private final S3Presigner s3Presigner;
    private final ContentMetadataRepository metadataRepository;
    private final StorageQuotaService quotaService;

    @Value("${aws.s3.buckets.presentations}")
    private String presentationsBucket;

    @Value("${aws.s3.buckets.logos}")
    private String logosBucket;

    @Value("${aws.s3.buckets.profiles}")
    private String profilesBucket;

    @Value("${aws.s3.buckets.archives}")
    private String archivesBucket;

    @Value("${aws.cloudfront.domain}")
    private String cloudFrontDomain;

    public ContentStorageService(
        S3Client s3Client,
        S3Presigner s3Presigner,
        ContentMetadataRepository metadataRepository,
        StorageQuotaService quotaService
    ) {
        this.s3Client = s3Client;
        this.s3Presigner = s3Presigner;
        this.metadataRepository = metadataRepository;
        this.quotaService = quotaService;
    }

    @Transactional
    public PresignedUploadUrl generatePresignedUploadUrl(
            String userId,
            ContentType contentType,
            String filename,
            long fileSizeBytes,
            String mimeType) {

        // Validate file size against content type limits
        validateFileSize(contentType, fileSizeBytes);

        // Check storage quota
        quotaService.validateQuota(userId, contentType, fileSizeBytes);

        // Generate unique S3 key
        String s3Key = generateS3Key(contentType, userId, filename);
        String bucket = getBucketForContentType(contentType);

        // Generate unique file ID
        String fileId = UUID.randomUUID().toString();

        // Create presigned PUT URL (15 minute expiration)
        PutObjectRequest objectRequest = PutObjectRequest.builder()
            .bucket(bucket)
            .key(s3Key)
            .contentType(mimeType)
            .metadata(Map.of(
                "file-id", fileId,
                "uploaded-by", userId,
                "original-filename", filename,
                "upload-timestamp", Instant.now().toString()
            ))
            .build();

        PutObjectPresignRequest presignRequest = PutObjectPresignRequest.builder()
            .signatureDuration(Duration.ofMinutes(15))
            .putObjectRequest(objectRequest)
            .build();

        PresignedPutObjectRequest presignedRequest =
            s3Presigner.presignPutObject(presignRequest);

        // Store metadata in database
        ContentMetadata metadata = new ContentMetadata();
        metadata.setFileId(fileId);
        metadata.setS3Key(s3Key);
        metadata.setS3Bucket(bucket);
        metadata.setOriginalFilename(filename);
        metadata.setFileSizeBytes(fileSizeBytes);
        metadata.setMimeType(mimeType);
        metadata.setUploadedBy(userId);
        metadata.setContentType(contentType);
        metadata.setUploadStatus(UploadStatus.PENDING);
        metadata.setCreatedAt(Instant.now());
        metadataRepository.save(metadata);

        return new PresignedUploadUrl(
            presignedRequest.url().toString(),
            fileId,
            Duration.ofMinutes(15).toSeconds(),
            Map.of("Content-Type", mimeType)
        );
    }

    @Transactional
    public ContentMetadata confirmUpload(String fileId, String checksum) {
        ContentMetadata metadata = metadataRepository.findByFileId(fileId)
            .orElseThrow(() -> new FileNotFoundException("File not found: " + fileId));

        // Verify file exists in S3
        HeadObjectRequest headRequest = HeadObjectRequest.builder()
            .bucket(metadata.getS3Bucket())
            .key(metadata.getS3Key())
            .build();

        try {
            HeadObjectResponse response = s3Client.headObject(headRequest);

            // Verify checksum if provided
            if (checksum != null && !response.eTag().equals(checksum)) {
                throw new ChecksumMismatchException("Checksum verification failed");
            }

            // Update metadata
            metadata.setUploadStatus(UploadStatus.COMPLETED);
            metadata.setChecksum(response.eTag());
            metadata.setUploadedAt(Instant.now());

            // Generate CloudFront URL
            String cloudFrontUrl = String.format("https://%s/%s/%s",
                cloudFrontDomain,
                metadata.getContentType().getFolderName(),
                metadata.getS3Key().substring(metadata.getS3Key().lastIndexOf('/') + 1)
            );
            metadata.setCloudFrontUrl(cloudFrontUrl);

            metadataRepository.save(metadata);

            // Update user quota
            quotaService.incrementUsage(
                metadata.getUploadedBy(),
                metadata.getFileSizeBytes()
            );

            return metadata;
        } catch (S3Exception e) {
            metadata.setUploadStatus(UploadStatus.FAILED);
            metadataRepository.save(metadata);
            throw new FileUploadException("Failed to verify upload: " + e.getMessage());
        }
    }

    public PresignedDownloadUrl generatePresignedDownloadUrl(String fileId) {
        ContentMetadata metadata = metadataRepository.findByFileId(fileId)
            .orElseThrow(() -> new FileNotFoundException("File not found: " + fileId));

        if (metadata.getUploadStatus() != UploadStatus.COMPLETED) {
            throw new IllegalStateException("File upload not completed");
        }

        GetObjectRequest getObjectRequest = GetObjectRequest.builder()
            .bucket(metadata.getS3Bucket())
            .key(metadata.getS3Key())
            .responseContentDisposition("attachment; filename=\"" + metadata.getOriginalFilename() + "\"")
            .build();

        GetObjectPresignRequest presignRequest = GetObjectPresignRequest.builder()
            .signatureDuration(Duration.ofMinutes(15))
            .getObjectRequest(getObjectRequest)
            .build();

        PresignedGetObjectRequest presignedRequest =
            s3Presigner.presignGetObject(presignRequest);

        return new PresignedDownloadUrl(
            presignedRequest.url().toString(),
            metadata.getOriginalFilename(),
            metadata.getFileSizeBytes(),
            metadata.getMimeType(),
            Duration.ofMinutes(15).toSeconds()
        );
    }

    @Transactional
    public void deleteFile(String fileId, String userId) {
        ContentMetadata metadata = metadataRepository.findByFileId(fileId)
            .orElseThrow(() -> new FileNotFoundException("File not found: " + fileId));

        // Verify ownership
        if (!metadata.getUploadedBy().equals(userId)) {
            throw new UnauthorizedException("Not authorized to delete this file");
        }

        // Delete from S3
        DeleteObjectRequest deleteRequest = DeleteObjectRequest.builder()
            .bucket(metadata.getS3Bucket())
            .key(metadata.getS3Key())
            .build();

        s3Client.deleteObject(deleteRequest);

        // Update quota
        quotaService.decrementUsage(userId, metadata.getFileSizeBytes());

        // Mark as deleted in database (soft delete for audit trail)
        metadata.setUploadStatus(UploadStatus.DELETED);
        metadata.setUpdatedAt(Instant.now());
        metadataRepository.save(metadata);
    }

    private String generateS3Key(ContentType contentType, String userId, String filename) {
        int year = java.time.Year.now().getValue();
        String uuid = UUID.randomUUID().toString().substring(0, 8);
        String extension = filename.substring(filename.lastIndexOf('.'));
        String sanitizedFilename = sanitizeFilename(
            filename.substring(0, filename.lastIndexOf('.'))
        );

        return String.format("%s/%d/%s/%s-%s%s",
            contentType.getFolderName(),
            year,
            userId,
            sanitizedFilename,
            uuid,
            extension
        );
    }

    private String sanitizeFilename(String filename) {
        return filename
            .replaceAll("[^a-zA-Z0-9.-]", "-")
            .replaceAll("-+", "-")
            .toLowerCase();
    }

    private String getBucketForContentType(ContentType contentType) {
        return switch (contentType) {
            case PRESENTATION -> presentationsBucket;
            case LOGO -> logosBucket;
            case SPEAKER_PHOTO, SPEAKER_CV -> profilesBucket;
            case EVENT_PHOTO, ARCHIVE_MATERIAL -> archivesBucket;
        };
    }

    private void validateFileSize(ContentType contentType, long fileSizeBytes) {
        long maxSize = switch (contentType) {
            case LOGO -> 5 * 1024 * 1024; // 5 MB
            case SPEAKER_CV -> 5 * 1024 * 1024; // 5 MB
            case SPEAKER_PHOTO -> 10 * 1024 * 1024; // 10 MB
            case EVENT_PHOTO -> 20 * 1024 * 1024; // 20 MB
            case PRESENTATION -> 100 * 1024 * 1024; // 100 MB
            case ARCHIVE_MATERIAL -> 20 * 1024 * 1024; // 20 MB
        };

        if (fileSizeBytes > maxSize) {
            throw new FileSizeExceededException(
                String.format("File size %d bytes exceeds maximum %d bytes for %s",
                    fileSizeBytes, maxSize, contentType)
            );
        }
    }
}

package ch.batbern.content.service;

import ch.batbern.shared.model.UserRole;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.time.Instant;
import java.util.Map;

@Service
public class StorageQuotaService {
    private final StorageQuotaRepository quotaRepository;
    private final StorageUsageLogRepository usageLogRepository;
    private final UserService userService;
    private final NotificationService notificationService;

    private static final Map<UserRole, Long> QUOTA_LIMITS = Map.of(
        UserRole.ORGANIZER, -1L, // Unlimited
        UserRole.SPEAKER, 200L * 1024 * 1024, // 200 MB
        UserRole.PARTNER, 50L * 1024 * 1024,  // 50 MB
        UserRole.ATTENDEE, 10L * 1024 * 1024   // 10 MB
    );

    private static final double SOFT_LIMIT_THRESHOLD = 0.8; // 80%

    public StorageQuotaService(
        StorageQuotaRepository quotaRepository,
        StorageUsageLogRepository usageLogRepository,
        UserService userService,
        NotificationService notificationService
    ) {
        this.quotaRepository = quotaRepository;
        this.usageLogRepository = usageLogRepository;
        this.userService = userService;
        this.notificationService = notificationService;
    }

    @Transactional(readOnly = true)
    public void validateQuota(String userId, ContentType contentType, long fileSizeBytes) {
        UserRole role = userService.getUserRole(userId);
        long quotaLimit = QUOTA_LIMITS.get(role);

        // Organizers have unlimited storage
        if (quotaLimit == -1L) {
            return;
        }

        StorageQuota quota = quotaRepository.findByUserId(userId)
            .orElseGet(() -> createDefaultQuota(userId, role));

        long newUsage = quota.getCurrentUsageBytes() + fileSizeBytes;

        if (newUsage > quotaLimit) {
            throw new StorageQuotaExceededException(
                String.format("Storage quota exceeded. Limit: %d MB, Current: %d MB, Requested: %d MB",
                    quotaLimit / 1024 / 1024,
                    quota.getCurrentUsageBytes() / 1024 / 1024,
                    fileSizeBytes / 1024 / 1024
                )
            );
        }

        // Soft limit warning at 80%
        double currentPercentage = (double) quota.getCurrentUsageBytes() / quotaLimit;
        double newPercentage = (double) newUsage / quotaLimit;

        if (newPercentage >= SOFT_LIMIT_THRESHOLD && currentPercentage < SOFT_LIMIT_THRESHOLD) {
            notificationService.sendQuotaWarning(
                userId,
                quota.getCurrentUsageBytes(),
                quotaLimit
            );

            quota.setQuotaWarningIssued(true);
            quotaRepository.save(quota);
        }
    }

    @Transactional
    public void incrementUsage(String userId, long fileSizeBytes) {
        StorageQuota quota = quotaRepository.findByUserId(userId)
            .orElseThrow(() -> new QuotaNotFoundException("Quota not found for user: " + userId));

        long newUsage = quota.getCurrentUsageBytes() + fileSizeBytes;
        quota.setCurrentUsageBytes(newUsage);
        quota.setFileCount(quota.getFileCount() + 1);
        quota.setLastUpdated(Instant.now());

        quotaRepository.save(quota);

        // Log usage change
        StorageUsageLog log = new StorageUsageLog();
        log.setUserId(userId);
        log.setAction("upload");
        log.setFileSizeBytes(fileSizeBytes);
        log.setNewTotalUsageBytes(newUsage);
        log.setTimestamp(Instant.now());
        usageLogRepository.save(log);
    }

    @Transactional
    public void decrementUsage(String userId, long fileSizeBytes) {
        StorageQuota quota = quotaRepository.findByUserId(userId)
            .orElseThrow(() -> new QuotaNotFoundException("Quota not found for user: " + userId));

        long newUsage = Math.max(0, quota.getCurrentUsageBytes() - fileSizeBytes);
        quota.setCurrentUsageBytes(newUsage);
        quota.setFileCount(Math.max(0, quota.getFileCount() - 1));
        quota.setLastUpdated(Instant.now());

        // Reset warning flag if usage drops below threshold
        UserRole role = userService.getUserRole(userId);
        long quotaLimit = QUOTA_LIMITS.get(role);
        if (quotaLimit > 0 && newUsage < (quotaLimit * SOFT_LIMIT_THRESHOLD)) {
            quota.setQuotaWarningIssued(false);
        }

        quotaRepository.save(quota);

        // Log usage change
        StorageUsageLog log = new StorageUsageLog();
        log.setUserId(userId);
        log.setAction("delete");
        log.setFileSizeBytes(fileSizeBytes);
        log.setNewTotalUsageBytes(newUsage);
        log.setTimestamp(Instant.now());
        usageLogRepository.save(log);
    }

    @Transactional(readOnly = true)
    public StorageQuotaInfo getQuotaInfo(String userId) {
        UserRole role = userService.getUserRole(userId);
        long quotaLimit = QUOTA_LIMITS.get(role);

        StorageQuota quota = quotaRepository.findByUserId(userId)
            .orElseGet(() -> createDefaultQuota(userId, role));

        double percentageUsed = quotaLimit > 0
            ? (double) quota.getCurrentUsageBytes() / quotaLimit * 100
            : 0.0;

        return new StorageQuotaInfo(
            quotaLimit,
            quota.getCurrentUsageBytes(),
            quota.getFileCount(),
            percentageUsed,
            SOFT_LIMIT_THRESHOLD * 100,
            Math.max(0, quotaLimit - quota.getCurrentUsageBytes())
        );
    }

    private StorageQuota createDefaultQuota(String userId, UserRole role) {
        StorageQuota quota = new StorageQuota();
        quota.setUserId(userId);
        quota.setUserRole(role);
        quota.setQuotaLimitBytes(QUOTA_LIMITS.get(role));
        quota.setCurrentUsageBytes(0L);
        quota.setFileCount(0);
        quota.setQuotaWarningIssued(false);
        quota.setLastUpdated(Instant.now());
        return quotaRepository.save(quota);
    }
}

Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

# CloudWatch Alarms for S3 Storage
Alarms:
  HighStorageUsage:
    Metric: BucketSizeBytes
    Threshold: 100 GB
    Period: 1 day
    Action: SNS notification to ops team

  ReplicationLag:
    Metric: ReplicationLatency
    Threshold: 1 hour
    Period: 5 minutes
    Action: PagerDuty alert (production only)

  HighErrorRate:
    Metric: 4xxErrors
    Threshold: 100 errors per 5 minutes
    Period: 2 evaluation periods
    Action: Slack #dev-alerts

  HighCDNRequestRate:
    Metric: CloudFront Requests
    Threshold: 10,000 requests/minute
    Period: 5 minutes
    Action: SNS notification (potential DDoS or viral content)

// Error Tracking Configuration
import * as Sentry from "@sentry/react";

Sentry.init({
  dsn: process.env.REACT_APP_SENTRY_DSN,
  environment: process.env.NODE_ENV,
  integrations: [
    new Sentry.BrowserTracing({
      tracingOrigins: ["https://api.batbern.ch"],
      routingInstrumentation: Sentry.reactRouterV6Instrumentation(
        React.useEffect,
        useLocation,
        useNavigationType,
        createRoutesFromChildren,
        matchRoutes
      ),
    }),
  ],
  tracesSampleRate: 0.1,
  beforeSend: (event) => {
    // Filter out sensitive data
    if (event.user) {
      delete event.user.email;
    }
    return event;
  },
});

// Custom Metrics Configuration (Micrometer + CloudWatch)
@Configuration
@EnableConfigurationProperties(MetricsProperties.class)
public class MetricsConfiguration {

    @Bean
    public MeterRegistry meterRegistry() {
        return CloudWatchMeterRegistry.builder(CloudWatchConfig.DEFAULT)
            .cloudWatchClient(CloudWatchAsyncClient.create())
            .namespace("BATbern")
            .step(Duration.ofMinutes(1))
            .build();
    }

    @Bean
    public TimedAspect timedAspect(MeterRegistry registry) {
        return new TimedAspect(registry);
    }
}

// Service-level metrics
@Service
@Timed(value = "speaker.coordination.service", description = "Speaker coordination service operations")
public class SpeakerCoordinationService {

    private final Counter invitationsSent = Counter.builder("invitations.sent")
        .description("Total invitations sent")
        .tag("service", "speaker-coordination")
        .register(Metrics.globalRegistry);

    @Timed(value = "speaker.invitation.send", description = "Time to send invitation")
    public void sendInvitation(SpeakerInvitation invitation) {
        // Business logic
        invitationsSent.increment();
    }
}

# CloudWatch Custom Dashboard Configuration
Dashboards:
  BATbernPlatformOverview:
    Widgets:
      - Type: "metric"
        Properties:
          metrics:
            - ["AWS/ECS", "CPUUtilization", "ServiceName", "event-management"]
            - ["AWS/ECS", "MemoryUtilization", "ServiceName", "event-management"]
          period: 300
          stat: "Average"
          region: "eu-central-1"
          title: "Event Management Service Health"

      - Type: "log"
        Properties:
          query: |
            SOURCE '/aws/ecs/event-management'
            | fields @timestamp, @message
            | filter @message like /ERROR/
            | sort @timestamp desc
            | limit 20
          region: "eu-central-1"
          title: "Recent Errors"

# Grafana Alert Rules
groups:
  - name: batbern-critical-alerts
    rules:
      - alert: ServiceDown
        expr: up{job="batbern-services"} == 0
        for: 1m
        severity: P0
        annotations:
          summary: "Service {{ $labels.service }} is down"
          description: "Service has been down for more than 1 minute"

      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.01
        for: 2m
        severity: P1
        annotations:
          summary: "High error rate on {{ $labels.service }}"

      - alert: DatabaseConnectionPoolExhausted
        expr: hikaricp_connections_active / hikaricp_connections_max > 0.9
        for: 3m
        severity: P1
        annotations:
          summary: "Database connection pool nearly exhausted"

<!-- logback-spring.xml -->
<configuration>
    <springProfile name="!local">
        <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
            <encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
                <providers>
                    <timestamp/>
                    <logLevel/>
                    <loggerName/>
                    <mdc/>
                    <arguments/>
                    <message/>
                    <stackTrace/>
                </providers>
            </encoder>
        </appender>
    </springProfile>

    <logger name="ch.batbern" level="INFO"/>
    <logger name="org.springframework.web" level="DEBUG"/>
    <logger name="org.springframework.security" level="DEBUG"/>

    <root level="INFO">
        <appender-ref ref="STDOUT"/>
    </root>
</configuration>

@Component
@Slf4j
public class RequestCorrelationFilter implements Filter {
    private static final String CORRELATION_ID_HEADER = "X-Correlation-ID";

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        String correlationId = ((HttpServletRequest) request).getHeader(CORRELATION_ID_HEADER);
        if (correlationId == null) {
            correlationId = UUID.randomUUID().toString();
        }

        MDC.put("correlationId", correlationId);
        ((HttpServletResponse) response).setHeader(CORRELATION_ID_HEADER, correlationId);

        try {
            chain.doFilter(request, response);
        } finally {
            MDC.clear();
        }
    }
}

@RestController
@RequestMapping("/actuator/health")
public class HealthController {

    @Autowired
    private DatabaseHealthIndicator databaseHealth;

    @Autowired
    private CaffeineHealthIndicator caffeineHealth;

    @GetMapping
    public ResponseEntity<Map<String, Object>> health() {
        Map<String, Object> health = new HashMap<>();
        health.put("status", "UP");
        health.put("database", databaseHealth.health());
        health.put("cache", caffeineHealth.health());
        health.put("timestamp", Instant.now());

        return ResponseEntity.ok(health);
    }

    @GetMapping("/ready")
    public ResponseEntity<String> readiness() {
        // Check if service can handle requests
        return ResponseEntity.ok("READY");
    }

    @GetMapping("/live")
    public ResponseEntity<String> liveness() {
        // Check if service should be restarted
        return ResponseEntity.ok("LIVE");
    }
}