Prevents Hunters from accessing hunt information before it starts

Reviewed-on: #5

.dockerignore

@@ -0,0 +1,6 @@
+.git/
+.gradle/
+build/
+Claude Notes/
+*.md
+.gitignore

.woodpecker.yaml

@@ -0,0 +1,15 @@
+when:
+  branch: main
+  event:
+    - push
+    - manual
+steps:
+  - name: build
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: git.halfbinary.net/${CI_REPO_OWNER}/scavengerhunt-api
+      registry: git.halfbinary.net
+      tags: ${CI_PIPELINE_NUMBER}
+      username: ${CI_REPO_OWNER}
+      password:
+        from_secret: docker_password

Dockerfile

@@ -0,0 +1,14 @@
+FROM amazoncorretto:21-alpine-jdk AS build
+WORKDIR /app
+COPY gradlew .
+COPY gradle/ gradle/
+COPY build.gradle.kts settings.gradle.kts ./
+RUN chmod +x gradlew && ./gradlew dependencies --no-daemon
+COPY src/ src/
+RUN ./gradlew bootJar --no-daemon
+
+FROM amazoncorretto:21-alpine-jdk
+WORKDIR /app
+COPY --from=build /app/build/libs/*.jar app.jar
+EXPOSE 8080
+ENTRYPOINT ["java", "-jar", "app.jar"]

README.md

@@ -1,3 +1,42 @@
 # Scavenger Hunt API
 
 REST API to support a community scavenger hunt app.
+
+## Prerequisites
+
+- Java 21
+- MariaDB
+- MinIO
+
+## Environment Variables
+
+| Variable | Description |
+| --- | --- |
+| `DB_URL` | JDBC URL for the MariaDB database |
+| `DB_USER` | Database username |
+| `DB_PASSWORD` | Database password |
+| `JWT_SECRET` | Secret key used to sign JWTs |
+| `MINIO_ENDPOINT` | MinIO server URL (e.g. `http://localhost:9000`) |
+| `MINIO_ACCESS_KEY` | MinIO access key |
+| `MINIO_SECRET_KEY` | MinIO secret key |
+| `MINIO_BUCKET` | MinIO bucket name for photo storage |
+
+## Running
+
+```bash
+./gradlew bootRun
+```
+
+## API Documentation
+
+Swagger UI is available at `/docs/swagger-ui.html` when the application is running.
+
+## Authentication
+
+All endpoints except `/signup` and `/login` require a JWT bearer token.
+
+1. Create an account: `POST /signup`
+2. Log in: `POST /login` — returns an access token and a refresh token
+3. Include the access token in requests: `Authorization: Bearer <token>`
+4. Refresh an expired token: `POST /refresh`
+5. Log out: `POST /logout`

build.gradle.kts

@@ -1,9 +1,9 @@
 plugins {
-    kotlin("jvm") version "2.2.21"
-    kotlin("plugin.spring") version "2.2.21"
-    id("org.springframework.boot") version "4.0.0"
+    kotlin("jvm") version "2.3.21"
+    kotlin("plugin.spring") version "2.3.21"
+    id("org.springframework.boot") version "4.0.6"
     id("io.spring.dependency-management") version "1.1.7"
-    kotlin("plugin.jpa") version "2.2.21"
+    kotlin("plugin.jpa") version "2.3.21"
 }
 
 group = "net.halfbinary"
@@ -27,18 +27,32 @@ repositories {
 }
 
 dependencies {
-    val mysqlConnectorJ = "9.5.0"
+    val mariaDriver = "3.5.8"
     val commonsValidator = "1.10.1"
     val jakartaValidation = "3.1.1"
+    val jsonWebToken = "0.13.0"
+    val springdocUi = "3.0.3"
+    val awsSdk = "2.26.0"
+    val thumbnailator = "0.4.20"
+    val tika = "3.3.0"
     implementation("org.springframework.boot:spring-boot-starter-actuator")
     implementation("org.springframework.boot:spring-boot-starter-web")
     implementation("org.springframework.boot:spring-boot-starter-data-jpa")
     implementation("org.springframework.boot:spring-boot-starter-validation")
-    implementation("jakarta.validation:jakarta.validation-api:${jakartaValidation}")
-    implementation("com.mysql:mysql-connector-j:${mysqlConnectorJ}")
+    implementation("org.springframework.boot:spring-boot-starter-security")
+    implementation("jakarta.validation:jakarta.validation-api:$jakartaValidation")
+    implementation("org.mariadb.jdbc:mariadb-java-client:${mariaDriver}")
     implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
     implementation("org.jetbrains.kotlin:kotlin-reflect")
-    implementation("commons-validator:commons-validator:${commonsValidator}")
+    implementation("commons-validator:commons-validator:$commonsValidator")
+    implementation("io.jsonwebtoken:jjwt-api:$jsonWebToken")
+    implementation("io.jsonwebtoken:jjwt-impl:$jsonWebToken")
+    implementation("io.jsonwebtoken:jjwt-jackson:$jsonWebToken")
+    implementation("org.springdoc:springdoc-openapi-starter-webmvc-ui:$springdocUi")
+    implementation(platform("software.amazon.awssdk:bom:$awsSdk"))
+    implementation("software.amazon.awssdk:s3")
+    implementation("net.coobird:thumbnailator:$thumbnailator")
+    implementation("org.apache.tika:tika-core:$tika")
     developmentOnly("org.springframework.boot:spring-boot-devtools")
     annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
     testImplementation("org.springframework.boot:spring-boot-starter-actuator-test")

docker-compose.yml

@@ -0,0 +1,70 @@
+services:
+  mariadb:
+    image: mariadb
+    environment:
+      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
+      MARIADB_DATABASE: ${DB_NAME}
+      MARIADB_USER: ${DB_USER}
+      MARIADB_PASSWORD: ${DB_PASSWORD}
+    ports:
+      - 3306:3306
+    volumes:
+      - mariadb_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      start_period: 10s
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+  adminer:
+    image: adminer
+    ports:
+      - 8080:8080
+    restart: unless-stopped
+  minio:
+    image: minio/minio
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
+      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
+    ports:
+      - 15900:9000 # API
+      - 15901:9001 # Web UI
+    volumes:
+      - minio_data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://192.168.187.181:15900/minio/health/live"]
+      start_period: 10s
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+  api:
+    image: git.halfbinary.net/aarbit/scavengerhunt-api:2
+    environment:
+      DB_URL: jdbc:mariadb://192.168.187.181:3306/${DB_NAME}
+      DB_USER: ${DB_USER}
+      DB_PASSWORD: ${DB_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+      MINIO_ENDPOINT: http://192.168.187.181:15900
+      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
+      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
+      MINIO_BUCKET: ${MINIO_BUCKET}
+    ports:
+      - 15808:8080
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://192.168.187.181:15808/actuator/health"]
+      start_period: 30s
+      interval: 15s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+volumes:
+  mariadb_data:
+  minio_data:

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.0-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

gradlew

@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/b631911858264c0b6e4d6603d677ff5218766cee/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

src/main/kotlin/net/halfbinary/scavengerhuntapi/config/AuthEntrypointJwt.kt

@@ -0,0 +1,18 @@
+package net.halfbinary.scavengerhuntapi.config
+
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.servlet.http.HttpServletResponse
+import org.springframework.security.core.AuthenticationException
+import org.springframework.security.web.AuthenticationEntryPoint
+import org.springframework.stereotype.Component
+
+@Component
+class AuthEntrypointJwt: AuthenticationEntryPoint {
+    override fun commence(
+        request: HttpServletRequest,
+        response: HttpServletResponse,
+        authException: AuthenticationException
+    ) {
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, authException.message)
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/config/AuthTokenFilter.kt

@@ -0,0 +1,51 @@
+package net.halfbinary.scavengerhuntapi.config
+
+import jakarta.servlet.FilterChain
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.servlet.http.HttpServletResponse
+import net.halfbinary.scavengerhuntapi.service.HunterDetailsService
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
+import org.springframework.security.core.context.SecurityContextHolder
+import org.springframework.security.core.userdetails.UserDetails
+import org.springframework.security.web.authentication.WebAuthenticationDetailsSource
+import org.springframework.stereotype.Component
+import org.springframework.web.filter.OncePerRequestFilter
+
+
+@Component
+class AuthTokenFilter(private val jwtUtils: JwtUtil, private val hunterDetailsService: HunterDetailsService): OncePerRequestFilter() {
+    override fun doFilterInternal(
+        request: HttpServletRequest,
+        response: HttpServletResponse,
+        filterChain: FilterChain
+    ) {
+        try {
+            val jwt: String? = parseJwt(request)
+            if (jwt != null && jwtUtils.validateJwtToken(jwt)) {
+                val username = jwtUtils.getUsernameFromToken(jwt)
+                val userDetails: UserDetails = hunterDetailsService.loadUserByUsername(username)
+                val authentication =
+                    UsernamePasswordAuthenticationToken(
+                        userDetails,
+                        null,
+                        userDetails.authorities
+                    )
+                authentication.details = WebAuthenticationDetailsSource().buildDetails(request)
+                val context = SecurityContextHolder.createEmptyContext()
+                context.authentication = authentication
+                SecurityContextHolder.setContext(context)
+            }
+        } catch (e: Exception) {
+            println("Cannot set user authentication: $e")
+        }
+        filterChain.doFilter(request, response)
+    }
+
+    private fun parseJwt(request: HttpServletRequest): String? {
+        val headerAuth = request.getHeader("Authorization")
+        if (headerAuth != null && headerAuth.startsWith("Bearer ")) {
+            return headerAuth.substring(7)
+        }
+        return null
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/config/JwtUtil.kt

@@ -0,0 +1,64 @@
+package net.halfbinary.scavengerhuntapi.config
+
+import io.jsonwebtoken.JwtException
+import io.jsonwebtoken.Jwts
+import jakarta.annotation.PostConstruct
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.stereotype.Component
+import java.util.*
+import javax.crypto.SecretKey
+import javax.crypto.spec.SecretKeySpec
+
+@Component
+class JwtUtil {
+    @Value($$"${jwt.secret}")
+    private val jwtSecret: String = ""
+
+    @Value($$"${jwt.expiration}")
+    private val jwtExpirationMs = 0
+
+    private var key: SecretKey? = null
+
+    // Initializes the key after the class is instantiated and the jwtSecret is injected,
+    // preventing the repeated creation of the key and enhancing performance
+    @PostConstruct
+    fun init() {
+        this.key = SecretKeySpec(jwtSecret.toByteArray(Charsets.UTF_8), "HmacSHA256")
+    }
+
+    // Generate JWT token
+    fun generateToken(email: String, isAdmin: Boolean): String {
+        return Jwts.builder()
+            .subject(email)
+            .claim("isAdmin", isAdmin)
+            .issuedAt(Date())
+            .expiration(Date(System.currentTimeMillis() + jwtExpirationMs))
+            .signWith(key)
+            .compact()
+    }
+
+    // Get username from JWT token
+    fun getUsernameFromToken(token: String): String {
+        return Jwts.parser()
+            .verifyWith(key)
+            .build()
+            .parseSignedClaims(token)
+            .payload
+            .subject
+    }
+
+    // Validate JWT token
+    fun validateJwtToken(token: String?): Boolean {
+        try {
+            Jwts.parser().verifyWith(key).build().parseSignedClaims(token)
+            return true
+        } catch (e: SecurityException) {
+            println("Invalid JWT signature: " + e.message)
+        } catch (e: JwtException) {
+            println("Invalid JWT token: " + e.message)
+        } catch (e: IllegalArgumentException) {
+            println("JWT claims string is empty: " + e.message)
+        }
+        return false
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/config/S3Config.kt

@@ -0,0 +1,26 @@
+package net.halfbinary.scavengerhuntapi.config
+
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import software.amazon.awssdk.auth.credentials.AwsBasicCredentials
+import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider
+import software.amazon.awssdk.regions.Region
+import software.amazon.awssdk.services.s3.S3Client
+import software.amazon.awssdk.services.s3.S3Configuration
+import java.net.URI
+
+@Configuration
+class S3Config(
+    @Value("\${minio.endpoint}") private val endpoint: String,
+    @Value("\${minio.access-key}") private val accessKey: String,
+    @Value("\${minio.secret-key}") private val secretKey: String
+) {
+    @Bean
+    fun s3Client(): S3Client = S3Client.builder()
+        .endpointOverride(URI.create(endpoint))
+        .credentialsProvider(StaticCredentialsProvider.create(AwsBasicCredentials.create(accessKey, secretKey)))
+        .region(Region.US_EAST_1)
+        .serviceConfiguration(S3Configuration.builder().pathStyleAccessEnabled(true).build())
+        .build()
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/config/SecurityConfig.kt

@@ -0,0 +1,97 @@
+package net.halfbinary.scavengerhuntapi.config
+
+import org.springframework.boot.web.servlet.FilterRegistrationBean
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.authentication.AuthenticationManager
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
+import org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer
+import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
+import org.springframework.security.config.http.SessionCreationPolicy
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
+import org.springframework.security.crypto.password.PasswordEncoder
+import org.springframework.security.web.SecurityFilterChain
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
+import org.springframework.web.cors.CorsConfiguration
+import org.springframework.web.cors.CorsConfigurationSource
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource
+
+
+
+@Configuration
+@EnableMethodSecurity
+class SecurityConfig(private val authEntrypointJwt: AuthEntrypointJwt,
+    private val authTokenFilter: AuthTokenFilter) {
+
+    @Bean
+    fun authenticationJwtTokenFilter(): AuthTokenFilter {
+        return authTokenFilter
+    }
+
+    @Bean
+    fun authTokenFilterRegistration(): FilterRegistrationBean<AuthTokenFilter> {
+        val registration = FilterRegistrationBean(authTokenFilter)
+        registration.isEnabled = false
+        return registration
+    }
+
+    @Bean
+    @Throws(Exception::class)
+    fun authenticationManager(
+        authenticationConfiguration: AuthenticationConfiguration
+    ): AuthenticationManager? {
+        return authenticationConfiguration.getAuthenticationManager()
+    }
+
+    @Bean
+    fun passwordEncoder(): PasswordEncoder {
+        return BCryptPasswordEncoder()
+    }
+
+    @Bean
+    fun corsConfigurationSource(): CorsConfigurationSource {
+        val config = CorsConfiguration()
+        config.allowedOriginPatterns = listOf("*")
+        config.allowedMethods = listOf("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
+        config.allowedHeaders = listOf("*")
+        config.allowCredentials = true
+        val source = UrlBasedCorsConfigurationSource()
+        source.registerCorsConfiguration("/**", config)
+        return source
+    }
+
+    @Bean
+    @Throws(Exception::class)
+    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain? {
+        // Updated configuration for Spring Security 6.x
+        http
+            .csrf { csrf: CsrfConfigurer<HttpSecurity> -> csrf.disable() }
+            .cors { cors -> cors.configurationSource(corsConfigurationSource()) }
+            .exceptionHandling { exceptionHandling: ExceptionHandlingConfigurer<HttpSecurity> ->
+                exceptionHandling.authenticationEntryPoint(
+                    authEntrypointJwt
+                )
+            }
+            .sessionManagement { sessionManagement: SessionManagementConfigurer<HttpSecurity> ->
+                sessionManagement.sessionCreationPolicy(
+                    SessionCreationPolicy.STATELESS
+                )
+            }
+            .authorizeHttpRequests { authorizeRequests ->
+                authorizeRequests
+                    .requestMatchers("/auth/**", "/signup", "/docs/**", "/actuator/**")
+                    .permitAll()
+                    .anyRequest().authenticated()
+            }
+
+        // Add the JWT Token filter before the UsernamePasswordAuthenticationFilter
+        http.addFilterBefore(
+            authenticationJwtTokenFilter(),
+            UsernamePasswordAuthenticationFilter::class.java
+        )
+        return http.build()
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/AdminController.kt

@@ -0,0 +1,26 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.tags.Tag
+import jakarta.validation.Valid
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.request.ReviewPhotoRequest
+import net.halfbinary.scavengerhuntapi.service.PhotoService
+import org.springframework.security.access.prepost.PreAuthorize
+import org.springframework.web.bind.annotation.PatchMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("admin")
+class AdminController(private val photoService: PhotoService) {
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @PatchMapping("/photo/{photoId}")
+    @Operation(summary = "Sets a review status for the specified photo")
+    fun reviewPhoto(@PathVariable photoId: PhotoId, @Valid @RequestBody request: ReviewPhotoRequest) {
+        photoService.updatePhotoStatus(photoId, request.status)
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/AuthController.kt

@@ -0,0 +1,43 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import jakarta.validation.Valid
+import net.halfbinary.scavengerhuntapi.config.JwtUtil
+import net.halfbinary.scavengerhuntapi.model.converter.toDomain
+import net.halfbinary.scavengerhuntapi.model.converter.toRefreshResponse
+import net.halfbinary.scavengerhuntapi.model.request.LoginRequest
+import net.halfbinary.scavengerhuntapi.model.request.LogoutRequest
+import net.halfbinary.scavengerhuntapi.model.request.RefreshRequest
+import net.halfbinary.scavengerhuntapi.model.response.LoginResponse
+import net.halfbinary.scavengerhuntapi.model.response.RefreshResponse
+import net.halfbinary.scavengerhuntapi.service.LoginService
+import net.halfbinary.scavengerhuntapi.service.RefreshTokenService
+import org.springframework.http.ResponseEntity
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+
+@RestController
+@RequestMapping("/auth")
+class AuthController(private val loginService: LoginService, private val jwtUtils: JwtUtil, private val refreshTokenService: RefreshTokenService) {
+    @PostMapping("/login")
+    fun login(@Valid @RequestBody body: LoginRequest): ResponseEntity<LoginResponse> {
+        val result = loginService.login(body.toDomain())
+        val accessToken = jwtUtils.generateToken(result.email, result.isAdmin)
+        val refreshToken  = refreshTokenService.generateRefreshToken(result.email)
+        val loginResponse = LoginResponse(accessToken, refreshToken, result.name)
+        return ResponseEntity.ok(loginResponse)
+    }
+
+    @PostMapping("/refresh")
+    fun refresh(@RequestBody body: RefreshRequest): ResponseEntity<RefreshResponse> {
+        return ResponseEntity.ok(refreshTokenService.getAccessToken(body.refreshToken).toRefreshResponse())
+    }
+
+    @PostMapping("/logout")
+    fun logout(@RequestBody body: LogoutRequest): ResponseEntity<String> {
+        refreshTokenService.removeToken(body.refreshToken)
+        return ResponseEntity.ok().build()
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/HuntController.kt

@@ -1,5 +1,7 @@
 package net.halfbinary.scavengerhuntapi.controller
 
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.tags.Tag
 import jakarta.validation.Valid
 import net.halfbinary.scavengerhuntapi.model.HuntId
 import net.halfbinary.scavengerhuntapi.model.HunterId
@@ -10,29 +12,51 @@ import net.halfbinary.scavengerhuntapi.model.request.HuntStatus
 import net.halfbinary.scavengerhuntapi.model.response.HuntResponse
 import net.halfbinary.scavengerhuntapi.service.HuntService
 import org.springframework.http.ResponseEntity
-import org.springframework.web.bind.annotation.*
+import org.springframework.security.access.prepost.PreAuthorize
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RequestParam
+import org.springframework.web.bind.annotation.RestController
 
 @RestController
 @RequestMapping("hunt")
 class HuntController(private val huntService: HuntService) {
 
     @GetMapping("/{id}")
+    @Operation(summary = "Gets the specified hunt information")
     fun getHunt(@PathVariable("id") huntId: HuntId): ResponseEntity<HuntResponse> {
         return ResponseEntity.ok(huntService.getHunt(huntId).toResponse())
     }
-
-    @GetMapping()
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @GetMapping
+    @Operation(summary = "Gets all Hunts")
     fun getAllHunts(@RequestParam status: HuntStatus?): ResponseEntity<List<HuntResponse>> {
         return ResponseEntity.ok(huntService.getAllHunts(status).map { it.toResponse() })
     }
 
-    @PostMapping()
+    @GetMapping("/unstarted")
+    @Operation(summary = "Gets list of all upcoming Hunts")
+    fun getUnstartedHunts(): ResponseEntity<List<HuntResponse>> {
+        return ResponseEntity.ok(huntService.getAllHunts(HuntStatus.UNSTARTED).map { it.toResponse() })
+    }
+
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @PostMapping
+    @Operation(summary = "Creates a new Hunt")
     fun createHunt(@Valid @RequestBody huntRequest: HuntCreateRequest): ResponseEntity<HuntResponse> {
         return ResponseEntity.ok(huntService.createHunt(huntRequest.toDomain()).toResponse())
     }
 
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
     @GetMapping("/hunter/{hunterId}")
-    fun getHuntsByHunter(@PathVariable("hunterId") hunterId: HunterId): ResponseEntity<List<HuntResponse>> {
+    @Operation(summary = "Lists all Hunts for specified Hunter")
+    fun getHuntsByHunter(@PathVariable hunterId: HunterId): ResponseEntity<List<HuntResponse>> {
         return ResponseEntity.ok(huntService.getHuntsByHunter(hunterId).map { it.toResponse() })
     }
 

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/HunterController.kt

@@ -0,0 +1,50 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.converter.toResponse
+import net.halfbinary.scavengerhuntapi.model.request.HuntStatus
+import net.halfbinary.scavengerhuntapi.model.response.HuntResponse
+import net.halfbinary.scavengerhuntapi.model.response.TeamResponse
+import net.halfbinary.scavengerhuntapi.service.HuntService
+import net.halfbinary.scavengerhuntapi.service.HunterService
+import net.halfbinary.scavengerhuntapi.service.TeamService
+import org.springframework.http.ResponseEntity
+import org.springframework.security.core.Authentication
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("/hunter")
+class HunterController(private val hunterService: HunterService,
+                       private val huntService: HuntService,
+                       private val teamService: TeamService) {
+
+    @GetMapping("/hunt/ongoing")
+    @Operation(summary = "Gets list of all currently running Hunts (filtered by the calling hunter)")
+    fun getOngoingHunts(authentication: Authentication): ResponseEntity<List<HuntResponse>> {
+        val email = authentication.name
+        val isAdmin = hunterService.getHunterByEmail(email).isAdmin
+        return if(isAdmin) {
+            ResponseEntity.ok(huntService.getAllHunts(HuntStatus.ONGOING).map { it.toResponse() })
+        } else {
+            ResponseEntity.ok(huntService.getHuntsByEmail(email, HuntStatus.ONGOING).map { it.toResponse() })
+        }
+    }
+
+    @PostMapping("/hunt/{huntId}/team/{teamId}")
+    @Operation(summary = "Joins Hunter to specified Team for specified Hunt")
+    fun joinTeamForHunt(@PathVariable huntId: HuntId, @PathVariable teamId: TeamId, authentication: Authentication) {
+        teamService.joinTeam(teamId, authentication.name)
+    }
+
+    @GetMapping("/hunt/{huntId}/team")
+    @Operation(summary = "Gets the Team for the Hunter for the specified Hunt")
+    fun getHunterHuntTeam(@PathVariable huntId: HuntId, authentication: Authentication): ResponseEntity<TeamResponse> {
+        return ResponseEntity.ok(teamService.getTeamForHunterInHunt(huntId, authentication.name).toResponse())
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/ItemController.kt

@@ -0,0 +1,65 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.tags.Tag
+import jakarta.validation.Valid
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.converter.toDomain
+import net.halfbinary.scavengerhuntapi.model.converter.toResponse
+import net.halfbinary.scavengerhuntapi.model.request.ItemRequest
+import net.halfbinary.scavengerhuntapi.model.request.ItemUpdateRequest
+import net.halfbinary.scavengerhuntapi.model.response.ItemResponse
+import net.halfbinary.scavengerhuntapi.service.HuntService
+import org.springframework.http.ResponseEntity
+import org.springframework.security.access.prepost.PreAuthorize
+import org.springframework.security.core.Authentication
+import org.springframework.web.bind.annotation.DeleteMapping
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PatchMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("hunt/{huntId}/item")
+class ItemController(private val huntService: HuntService) {
+
+    @GetMapping
+    fun getItemsForHunt(@PathVariable huntId: HuntId, authentication: Authentication): ResponseEntity<List<ItemResponse>> {
+        return ResponseEntity.ok(huntService.getItemsForHunt(huntId, authentication.name).map { it.toResponse() })
+    }
+
+    @GetMapping("/{itemId}")
+    fun getItem(@PathVariable huntId: HuntId, @PathVariable itemId: ItemId): ResponseEntity<ItemResponse> {
+        TODO("Maybe not needed: Get detailed information about the specified Item for the specified Hunt")
+    }
+
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @PostMapping
+    @Operation(summary = "Adds new Item to specified Hunt")
+    fun addItemToHunt(@PathVariable huntId: HuntId, @Valid @RequestBody body: ItemRequest): ResponseEntity<ItemResponse> {
+        return ResponseEntity.ok(huntService.addItemToHunt(huntId, body.toDomain()).toResponse())
+    }
+
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @PatchMapping("/{itemId}")
+    @Operation(summary = "Updates name and/or points for the specified Item in the specified Hunt")
+    fun updateItem(@PathVariable huntId: HuntId, @PathVariable itemId: ItemId, @RequestBody body: ItemUpdateRequest): ResponseEntity<ItemResponse> {
+        return ResponseEntity.ok(huntService.updateItem(huntId, itemId, body).toResponse())
+    }
+
+    @PreAuthorize("hasRole('ADMIN')")
+    @Tag(name = "Admin")
+    @DeleteMapping("/{itemId}")
+    @Operation(summary = "Deletes the specified Item from the specified Hunt")
+    fun deleteItem(@PathVariable huntId: HuntId, @PathVariable itemId: ItemId): ResponseEntity<Unit> {
+        huntService.deleteItem(huntId, itemId)
+        return ResponseEntity.noContent().build()
+    }
+
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/LoginController.kt

@@ -1,36 +0,0 @@
-package net.halfbinary.scavengerhuntapi.controller
-
-import jakarta.servlet.http.Cookie
-import jakarta.servlet.http.HttpServletResponse
-import jakarta.validation.Valid
-import net.halfbinary.scavengerhuntapi.model.converter.toDomain
-import net.halfbinary.scavengerhuntapi.model.converter.toLoginResponse
-import net.halfbinary.scavengerhuntapi.model.request.LoginRequest
-import net.halfbinary.scavengerhuntapi.model.response.LoginResponse
-import net.halfbinary.scavengerhuntapi.service.LoginService
-import org.springframework.http.ResponseEntity
-import org.springframework.web.bind.annotation.PostMapping
-import org.springframework.web.bind.annotation.RequestBody
-import org.springframework.web.bind.annotation.RestController
-import java.net.URLEncoder
-
-
-@RestController
-class LoginController(private val loginService: LoginService) {
-    @PostMapping("/login")
-    fun login(@Valid @RequestBody body: LoginRequest, response: HttpServletResponse): ResponseEntity<LoginResponse> {
-        val result = loginService.login(body.toDomain())
-        val creds = "${result.email}|${result.name}"
-        val encodedCreds = URLEncoder.encode(creds, "UTF-8")
-        response.addCookie(Cookie("creds", encodedCreds))
-        return ResponseEntity.ok(result.toLoginResponse())
-    }
-
-    @PostMapping("/logout")
-    fun logout(response: HttpServletResponse): ResponseEntity<String> {
-        val cookie = Cookie("creds", null)
-        cookie.maxAge = 0
-        response.addCookie(cookie)
-        return ResponseEntity.ok("OK")
-    }
-}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/PhotoController.kt

@@ -0,0 +1,29 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import net.halfbinary.scavengerhuntapi.model.ImageVersion
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.service.PhotoService
+import org.springframework.core.io.InputStreamSource
+import org.springframework.http.ResponseEntity
+import org.springframework.security.core.Authentication
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RequestParam
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("photo")
+class PhotoController(private val photoService: PhotoService) {
+    @GetMapping("/{photoId}/file")
+    @Operation(summary = "Get the binary image information for the specified Photo")
+    fun getPhoto(authentication: Authentication,
+                 @PathVariable photoId: PhotoId,
+                 @RequestParam(defaultValue = "LARGE") version: ImageVersion): ResponseEntity<InputStreamSource> {
+        val photoFile = photoService.getPhotoFile(photoId, authentication.name, version)
+        return ResponseEntity.ok()
+            .contentType(photoFile.contentType)
+            .body(photoFile.resource)
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/StatsController.kt

@@ -0,0 +1,30 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.converter.toResponse
+import net.halfbinary.scavengerhuntapi.model.response.HunterLeaderboardResponse
+import net.halfbinary.scavengerhuntapi.model.response.TeamLeaderboardResponse
+import net.halfbinary.scavengerhuntapi.service.StatsService
+import org.springframework.http.ResponseEntity
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("stats/lead/hunt/{huntId}")
+class StatsController(private val statsService: StatsService) {
+
+    @GetMapping("/team")
+    @Operation(summary = "Ranked teams with current total scores for a hunt")
+    fun getTeamLeaderboard(@PathVariable huntId: HuntId): ResponseEntity<List<TeamLeaderboardResponse>> {
+        return ResponseEntity.ok(statsService.getTeamLeaderboard(huntId).map { it.toResponse() })
+    }
+
+    @GetMapping("/hunter")
+    @Operation(summary = "Ranked hunters with current total scores for a hunt")
+    fun getHunterLeaderboard(@PathVariable huntId: HuntId): ResponseEntity<List<HunterLeaderboardResponse>> {
+        return ResponseEntity.ok(statsService.getHunterLeaderboard(huntId).map { it.toResponse() })
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/controller/TeamController.kt

@@ -0,0 +1,99 @@
+package net.halfbinary.scavengerhuntapi.controller
+
+import io.swagger.v3.oas.annotations.Operation
+import jakarta.validation.Valid
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.converter.toResponse
+import net.halfbinary.scavengerhuntapi.model.request.TeamRequest
+import net.halfbinary.scavengerhuntapi.model.response.PhotoResponse
+import net.halfbinary.scavengerhuntapi.model.response.TeamItemResponse
+import net.halfbinary.scavengerhuntapi.model.response.TeamResponse
+import net.halfbinary.scavengerhuntapi.service.PhotoService
+import net.halfbinary.scavengerhuntapi.service.TeamService
+import org.springframework.http.ResponseEntity
+import org.springframework.security.core.Authentication
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PatchMapping
+import org.springframework.web.bind.annotation.PathVariable
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestBody
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RequestParam
+import org.springframework.web.bind.annotation.RestController
+import org.springframework.web.multipart.MultipartFile
+
+@RestController
+@RequestMapping("hunt/{huntId}/team")
+class TeamController(private val teamService: TeamService, private val photoService: PhotoService) {
+    @GetMapping
+    @Operation(summary = "List all teams for the specified hunt")
+    fun listHuntTeams(@PathVariable huntId: HuntId): ResponseEntity<List<TeamResponse>> {
+        return ResponseEntity.ok(teamService.getListOfTeamsForHunt(huntId).map { it.toResponse()})
+    }
+
+    @PostMapping
+    @Operation(summary = "Create a new team for the specified hunt")
+    fun createHuntTeam(@PathVariable huntId: HuntId, @Valid @RequestBody team: TeamRequest) {
+        val teamResponse = teamService.createTeam(team.name)
+        teamService.addTeamToHunt(huntId, teamResponse.id)
+    }
+
+    @GetMapping("/{teamId}")
+    @Operation(summary = "Get team info for the specified hunt")
+    fun getTeam(@PathVariable huntId: HuntId, @PathVariable teamId: TeamId): ResponseEntity<TeamResponse> {
+        return ResponseEntity.ok(teamService.getTeamFromHunt(huntId, teamId).toResponse())
+    }
+
+    @GetMapping("/{teamId}/item/{itemId}")
+    @Operation(summary = "Get found/not found status about the Item for the specified Team, Hunt, and Item")
+    fun getItemForTeam(@PathVariable huntId: HuntId,
+                        @PathVariable teamId: TeamId,
+                        @PathVariable itemId: ItemId,
+                        authentication: Authentication): ResponseEntity<TeamItemResponse> {
+        val foundStatus = photoService.getItemFoundStatus(huntId, teamId, itemId, authentication.name)
+        return ResponseEntity.ok(TeamItemResponse(id = itemId, itemFoundStatus = foundStatus))
+    }
+
+    @GetMapping("/{teamId}/item/{itemId}/photo")
+    @Operation(summary = "Get list of photo information for the specified Team, Hunt, and Item")
+    fun getItemPhotos(@PathVariable huntId: HuntId,
+                        @PathVariable teamId: TeamId,
+                        @PathVariable itemId: ItemId,
+                        authentication: Authentication): ResponseEntity<List<PhotoResponse>> {
+        return ResponseEntity.ok(photoService.getItemPhotos(huntId, teamId, itemId, authentication.name))
+    }
+
+    @PatchMapping("/{teamId}/item/{itemId}/photo/{photoId}")
+    @Operation(summary = "Mark the specified Photo as removed")
+    fun removePhoto(@PathVariable huntId: HuntId,
+                    @PathVariable teamId: TeamId,
+                    @PathVariable itemId: ItemId,
+                    @PathVariable photoId: PhotoId,
+                    authentication: Authentication) {
+        photoService.removePhoto(huntId, teamId, itemId, photoId, authentication.name)
+    }
+
+    @GetMapping("/{teamId}/item/{itemId}/photo/{photoId}")
+    @Operation(summary = "Get photo information for the specified Team, Hunt, Item, and Photo")
+    fun getPhotoInfo(@PathVariable huntId: HuntId,
+                 @PathVariable teamId: TeamId,
+                 @PathVariable itemId: ItemId,
+                 @PathVariable photoId: PhotoId,
+                 authentication: Authentication): ResponseEntity<PhotoResponse> {
+        return ResponseEntity.ok(photoService.getPhotoInfo(huntId, teamId, itemId, photoId, authentication.name))
+    }
+
+    @PostMapping("/{teamId}/item/{itemId}/photo")
+    @Operation(summary = "Save photo information and store the binary file")
+    fun submitPhoto(@PathVariable huntId: HuntId,
+                    @PathVariable teamId: TeamId,
+                    @PathVariable itemId: ItemId,
+                    authentication: Authentication,
+                    @RequestParam file: MultipartFile) {
+        photoService.submitPhoto(huntId, itemId, authentication.name, file)
+    }
+
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/ExceptionHandler.kt

@@ -1,9 +1,13 @@
 package net.halfbinary.scavengerhuntapi.error
 
+import net.halfbinary.scavengerhuntapi.error.exception.BadFileException
+import net.halfbinary.scavengerhuntapi.error.exception.ConflictException
+import net.halfbinary.scavengerhuntapi.error.exception.ForbiddenException
 import net.halfbinary.scavengerhuntapi.error.exception.InvalidEmailException
 import net.halfbinary.scavengerhuntapi.error.exception.LoginFailedException
 import net.halfbinary.scavengerhuntapi.error.exception.NotFoundException
 import net.halfbinary.scavengerhuntapi.error.exception.PreexistingAccountException
+import org.slf4j.LoggerFactory
 import org.springframework.http.HttpStatus
 import org.springframework.http.converter.HttpMessageNotReadableException
 import org.springframework.validation.FieldError
@@ -11,11 +15,16 @@ import org.springframework.web.bind.MethodArgumentNotValidException
 import org.springframework.web.bind.annotation.ExceptionHandler
 import org.springframework.web.bind.annotation.ResponseStatus
 import org.springframework.web.bind.annotation.RestControllerAdvice
+import org.springframework.web.method.annotation.MethodArgumentTypeMismatchException
+import org.springframework.web.multipart.MaxUploadSizeExceededException
+import java.net.SocketTimeoutException
 
 
 @RestControllerAdvice
 class ExceptionHandler {
-
+    companion object {
+        private val log = LoggerFactory.getLogger(net.halfbinary.scavengerhuntapi.error.ExceptionHandler::class.java)
+    }
     @ExceptionHandler(PreexistingAccountException::class)
     @ResponseStatus(HttpStatus.CONFLICT)
     fun preexistingAccountException(e: PreexistingAccountException): String? {
@@ -40,10 +49,30 @@ class ExceptionHandler {
         return e.message
     }
 
+    @ExceptionHandler(ForbiddenException::class)
+    @ResponseStatus(HttpStatus.FORBIDDEN)
+    fun forbiddenException(e: ForbiddenException): String? {
+        return e.message
+    }
+
+    @ExceptionHandler(ConflictException::class)
+    @ResponseStatus(HttpStatus.CONFLICT)
+    fun conflictException(e: ConflictException): String? {
+        return e.message
+    }
+
     @ExceptionHandler(HttpMessageNotReadableException::class)
     @ResponseStatus(HttpStatus.BAD_REQUEST)
-    fun httpMessageNotReadableException(e: HttpMessageNotReadableException): String? {
-        return e.message
+    fun httpMessageNotReadableException(e: HttpMessageNotReadableException): Map<String, String?> {
+        if (e.message?.contains("body is missing")?:false) {
+            return simpleMap("body","Body is missing")
+        }
+        if (e.message?.contains("parameter")?:false) {
+            val missingParameter = e.message?.split("parameter ")[1]
+            return simpleMap(missingParameter?:"","Missing required parameter $missingParameter")
+        }
+        log.debug("JSON parsing issue", e)
+        return simpleMap("body", "Parsing error")
     }
 
     @ExceptionHandler(MethodArgumentNotValidException::class)
@@ -56,4 +85,32 @@ class ExceptionHandler {
             )
         }
     }
+
+    @ExceptionHandler(BadFileException::class)
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    fun badFileException(e: BadFileException): String? {
+        return e.message
+    }
+
+    @ExceptionHandler(MaxUploadSizeExceededException::class)
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    fun maxUploadSizeExceededException(e: MaxUploadSizeExceededException): String? {
+        return e.message
+    }
+
+    @ExceptionHandler(SocketTimeoutException::class)
+    @ResponseStatus(HttpStatus.SERVICE_UNAVAILABLE)
+    fun socketTimeoutException(): String {
+        return "Unable to connect. Try again later."
+    }
+
+    @ExceptionHandler(MethodArgumentTypeMismatchException::class)
+    @ResponseStatus(HttpStatus.BAD_REQUEST)
+    fun argumentMismatchException(): String? {
+        return "Invalid parameter value."
+    }
+
+    private fun simpleMap(key: String, value: String?): Map<String, String?> {
+        return mapOf(Pair(key, value))
+    }
 }

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/BadFileException.kt

@@ -0,0 +1,3 @@
+package net.halfbinary.scavengerhuntapi.error.exception
+
+class BadFileException(override val message: String): RuntimeException(message)

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/ConflictException.kt

@@ -0,0 +1,3 @@
+package net.halfbinary.scavengerhuntapi.error.exception
+
+class ConflictException(override val message: String) : RuntimeException(message)

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/ExpiredRefreshTokenException.kt

@@ -0,0 +1,5 @@
+package net.halfbinary.scavengerhuntapi.error.exception
+
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+
+class ExpiredRefreshTokenException(token: RefreshId): RuntimeException("The refresh token $token is expired.")

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/ForbiddenException.kt

@@ -0,0 +1,3 @@
+package net.halfbinary.scavengerhuntapi.error.exception
+
+class ForbiddenException: RuntimeException("Access Denied.")

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/InvalidRefreshTokenException.kt

@@ -0,0 +1,5 @@
+package net.halfbinary.scavengerhuntapi.error.exception
+
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+
+class InvalidRefreshTokenException(token: RefreshId): RuntimeException("The refresh token $token is not valid.")

src/main/kotlin/net/halfbinary/scavengerhuntapi/error/exception/LoginFailedException.kt

@@ -1,3 +1,3 @@
 package net.halfbinary.scavengerhuntapi.error.exception
 
-class LoginFailedException(): RuntimeException("The email and password combination is not correct.")
+class LoginFailedException : RuntimeException("The email and password combination is not correct.")

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/FoundStatus.kt

@@ -1,8 +1,8 @@
 package net.halfbinary.scavengerhuntapi.model
 
 enum class FoundStatus {
+    NOT_FOUND,
     SUBMITTED,
     APPROVED,
-    REJECTED,
-    REMOVED
+    REJECTED
 }

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/ImageVersion.kt

@@ -0,0 +1,5 @@
+package net.halfbinary.scavengerhuntapi.model
+
+enum class ImageVersion {
+    ORIGINAL, LARGE, MEDIUM, SMALL
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/PhotoStatus.kt

@@ -0,0 +1,8 @@
+package net.halfbinary.scavengerhuntapi.model
+
+enum class PhotoStatus {
+    SUBMITTED,
+    APPROVED,
+    REJECTED,
+    REMOVED
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/TypeAlias.kt

@@ -2,8 +2,10 @@ package net.halfbinary.scavengerhuntapi.model
 
 import java.util.*
 
-typealias FoundId = UUID
 typealias HuntId = UUID
 typealias HunterId = UUID
 typealias ItemId = UUID
 typealias TeamId = UUID
+typealias RefreshId = UUID
+typealias TeamHuntId = UUID
+typealias PhotoId = UUID

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/HuntItemConverter.kt

@@ -0,0 +1,8 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.HuntItem
+import net.halfbinary.scavengerhuntapi.model.record.HuntItemRecord
+
+fun HuntItem.toRecord() = HuntItemRecord(id = id, huntId = huntId, itemId = itemId)
+
+fun HuntItemRecord.toDomain() = HuntItem(id = id, huntId = huntId, itemId = itemId)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/HunterConverter.kt

@@ -3,7 +3,6 @@ package net.halfbinary.scavengerhuntapi.model.converter
 import net.halfbinary.scavengerhuntapi.model.domain.Hunter
 import net.halfbinary.scavengerhuntapi.model.record.HunterRecord
 import net.halfbinary.scavengerhuntapi.model.request.HunterSignupRequest
-import net.halfbinary.scavengerhuntapi.model.response.LoginResponse
 
 fun HunterSignupRequest.toDomain(): Hunter {
     return Hunter(
@@ -21,7 +20,3 @@ fun Hunter.toRecord(): HunterRecord {
 fun HunterRecord.toDomain(): Hunter {
     return Hunter(id, email, name, password, isAdmin)
 }
-
-fun Hunter.toLoginResponse(): LoginResponse {
-    return LoginResponse(email, name)
-}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/HunterLeaderboardConverter.kt

@@ -0,0 +1,10 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.HunterLeaderboardEntry
+import net.halfbinary.scavengerhuntapi.model.response.HunterLeaderboardResponse
+
+fun HunterLeaderboardEntry.toResponse() = HunterLeaderboardResponse(
+    rank = rank,
+    hunterName = hunterName,
+    score = score
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/ItemConverter.kt

@@ -0,0 +1,14 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.Item
+import net.halfbinary.scavengerhuntapi.model.record.ItemRecord
+import net.halfbinary.scavengerhuntapi.model.request.ItemRequest
+import net.halfbinary.scavengerhuntapi.model.response.ItemResponse
+
+fun ItemRequest.toDomain() = Item(name = name, points = points)
+
+fun Item.toRecord() = ItemRecord(id = id, name = name, points = points)
+
+fun ItemRecord.toDomain() = Item(id = id, name = name, points = points)
+
+fun Item.toResponse() = ItemResponse(id = id, name = name, points = points)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/PhotoConverter.kt

@@ -0,0 +1,34 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.Hunter
+import net.halfbinary.scavengerhuntapi.model.domain.Photo
+import net.halfbinary.scavengerhuntapi.model.record.PhotoRecord
+import net.halfbinary.scavengerhuntapi.model.response.PhotoResponse
+
+fun Photo.toRecord() = PhotoRecord(
+    id = id,
+    itemId = itemId,
+    huntId = huntId,
+    hunterId = hunterId,
+    foundDateTime = foundDateTime,
+    status = status,
+    statusChangeDateTime = statusChangeDateTime
+)
+
+fun PhotoRecord.toDomain() = Photo(
+    id = id,
+    itemId = itemId,
+    huntId = huntId,
+    hunterId = hunterId,
+    foundDateTime = foundDateTime,
+    status = status,
+    statusChangeDateTime = statusChangeDateTime
+)
+
+fun Photo.toResponse(hunter: Hunter) = PhotoResponse(
+    id = id,
+    hunterName = hunter.name,
+    photoUploadDateTime = foundDateTime,
+    photoStatus = status,
+    photoStatusChangeDateTime = statusChangeDateTime
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/RefreshConverter.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.response.RefreshResponse
+
+fun String.toRefreshResponse(): RefreshResponse {
+    return RefreshResponse(this)
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/TeamConverter.kt

@@ -0,0 +1,22 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.Team
+import net.halfbinary.scavengerhuntapi.model.record.TeamRecord
+import net.halfbinary.scavengerhuntapi.model.request.TeamRequest
+import net.halfbinary.scavengerhuntapi.model.response.TeamResponse
+
+fun TeamRequest.toDomain(): Team {
+    return Team(name = name)
+}
+
+fun Team.toRecord(): TeamRecord {
+    return TeamRecord(id, name)
+}
+
+fun TeamRecord.toDomain(): Team {
+    return Team(id, name)
+}
+
+fun Team.toResponse(): TeamResponse {
+    return TeamResponse(id, name)
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/TeamHuntConverter.kt

@@ -0,0 +1,12 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.TeamHunt
+import net.halfbinary.scavengerhuntapi.model.record.TeamHuntRecord
+
+fun TeamHunt.toRecord(): TeamHuntRecord {
+    return TeamHuntRecord(id, teamId, huntId)
+}
+
+fun TeamHuntRecord.toDomain(): TeamHunt {
+    return TeamHunt(id, teamId, huntId)
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/converter/TeamLeaderboardConverter.kt

@@ -0,0 +1,10 @@
+package net.halfbinary.scavengerhuntapi.model.converter
+
+import net.halfbinary.scavengerhuntapi.model.domain.TeamLeaderboardEntry
+import net.halfbinary.scavengerhuntapi.model.response.TeamLeaderboardResponse
+
+fun TeamLeaderboardEntry.toResponse() = TeamLeaderboardResponse(
+    rank = rank,
+    teamName = teamName,
+    score = score
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/Hunt.kt

@@ -10,4 +10,7 @@ data class Hunt(
     val startDateTime: LocalDateTime,
     val endDateTime: LocalDateTime,
     val isTerminated: Boolean
-)
+) {
+    val isOngoing: Boolean
+        get() = !isTerminated && startDateTime < LocalDateTime.now() && endDateTime > LocalDateTime.now()
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/HuntItem.kt

@@ -0,0 +1,11 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import java.util.*
+
+data class HuntItem(
+    val id: UUID = UUID.randomUUID(),
+    val huntId: HuntId,
+    val itemId: ItemId
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/HunterLeaderboardEntry.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+data class HunterLeaderboardEntry(
+    val rank: Int,
+    val hunterName: String,
+    val score: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/Item.kt

@@ -0,0 +1,10 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import java.util.*
+
+data class Item(
+    val id: ItemId = UUID.randomUUID(),
+    val name: String,
+    val points: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/Photo.kt

@@ -0,0 +1,19 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import java.time.LocalDateTime
+import java.util.*
+
+data class Photo(
+    val id: PhotoId = UUID.randomUUID(),
+    val itemId: ItemId,
+    val huntId: HuntId,
+    val hunterId: HunterId,
+    val foundDateTime: LocalDateTime,
+    val status: PhotoStatus,
+    val statusChangeDateTime: LocalDateTime
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/PhotoFile.kt

@@ -0,0 +1,6 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import org.springframework.core.io.InputStreamResource
+import org.springframework.http.MediaType
+
+data class PhotoFile(val resource: InputStreamResource, val contentType: MediaType)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/Team.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import java.util.*
+
+data class Team(
+    val id: TeamId = UUID.randomUUID(),
+    val name: String
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/TeamHunt.kt

@@ -0,0 +1,11 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.TeamHuntId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+
+data class TeamHunt(
+    val id: TeamHuntId = TeamHuntId.randomUUID(),
+    val teamId: TeamId,
+    val huntId: HuntId
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/domain/TeamLeaderboardEntry.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.model.domain
+
+data class TeamLeaderboardEntry(
+    val rank: Int,
+    val teamName: String,
+    val score: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/record/FoundRecord.kt

@@ -1,23 +0,0 @@
-package net.halfbinary.scavengerhuntapi.model.record
-
-import jakarta.persistence.Entity
-import jakarta.persistence.Id
-import jakarta.persistence.Table
-import net.halfbinary.scavengerhuntapi.model.*
-import java.time.LocalDateTime
-
-/**
- * Represents a found Item for a Hunt by a Hunter
- */
-@Entity
-@Table(name = "found")
-data class FoundRecord(
-    @Id
-    val id: FoundId,
-    val itemId: ItemId,
-    val huntId: HuntId,
-    val hunterId: HunterId,
-    val foundDateTime: LocalDateTime,
-    val imageName: String,
-    val status: FoundStatus
-)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/record/PhotoRecord.kt

@@ -0,0 +1,27 @@
+package net.halfbinary.scavengerhuntapi.model.record
+
+import jakarta.persistence.Entity
+import jakarta.persistence.Id
+import jakarta.persistence.Table
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import java.time.LocalDateTime
+
+/**
+ * Represents a found Item for a Hunt by a Hunter
+ */
+@Entity
+@Table(name = "photo")
+data class PhotoRecord(
+    @Id
+    val id: PhotoId,
+    val itemId: ItemId,
+    val huntId: HuntId,
+    val hunterId: HunterId,
+    val foundDateTime: LocalDateTime,
+    val status: PhotoStatus,
+    val statusChangeDateTime: LocalDateTime,
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/record/RefreshTokenRecord.kt

@@ -0,0 +1,16 @@
+package net.halfbinary.scavengerhuntapi.model.record
+
+import jakarta.persistence.Entity
+import jakarta.persistence.Id
+import jakarta.persistence.Table
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+import java.time.LocalDateTime
+
+@Entity
+@Table(name = "refresh_token")
+data class RefreshTokenRecord(
+    @Id
+    val token: RefreshId,
+    val email: String,
+    val expiryDateTime: LocalDateTime
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/record/TeamHuntRecord.kt

@@ -4,14 +4,14 @@ import jakarta.persistence.Entity
 import jakarta.persistence.Id
 import jakarta.persistence.Table
 import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.TeamHuntId
 import net.halfbinary.scavengerhuntapi.model.TeamId
-import java.util.*
 
 @Entity
 @Table(name = "team_hunt")
 data class TeamHuntRecord(
     @Id
-    val id: UUID,
+    val id: TeamHuntId,
     val teamId: TeamId,
     val huntId: HuntId
 )

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/ItemRequest.kt

@@ -0,0 +1,6 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+data class ItemRequest(
+    val name: String,
+    val points: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/ItemUpdateRequest.kt

@@ -0,0 +1,6 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+data class ItemUpdateRequest(
+    val name: String?,
+    val points: Int?
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/JoinTeamRequest.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+import jakarta.validation.constraints.NotBlank
+import net.halfbinary.scavengerhuntapi.model.TeamId
+
+data class JoinTeamRequest(
+    @field:NotBlank
+    val teamId: TeamId
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/LogoutRequest.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+import jakarta.validation.constraints.NotBlank
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+
+data class LogoutRequest(
+    @field:NotBlank(message = "You must provide a refresh token.")
+    val refreshToken: RefreshId
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/RefreshRequest.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+import jakarta.validation.constraints.NotBlank
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+
+data class RefreshRequest(
+    @field:NotBlank(message = "Refresh token cannot be blank")
+    val refreshToken: RefreshId,
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/ReviewPhotoRequest.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+import jakarta.validation.constraints.NotBlank
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+
+data class ReviewPhotoRequest(
+    @field:NotBlank(message = "Status must not be blank")
+    val status: PhotoStatus
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/request/TeamRequest.kt

@@ -0,0 +1,5 @@
+package net.halfbinary.scavengerhuntapi.model.request
+
+data class TeamRequest(
+    val name: String
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/HunterLeaderboardResponse.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+data class HunterLeaderboardResponse(
+    val rank: Int,
+    val hunterName: String,
+    val score: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/ItemResponse.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+import net.halfbinary.scavengerhuntapi.model.ItemId
+
+data class ItemResponse(
+    val id: ItemId,
+    val name: String,
+    val points: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/LoginResponse.kt

@@ -1,6 +1,9 @@
 package net.halfbinary.scavengerhuntapi.model.response
 
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+
 data class LoginResponse(
-    val email: String,
+    val accessToken: String,
+    val refreshToken: RefreshId,
     val name: String
 )

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/PhotoResponse.kt

@@ -0,0 +1,13 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import java.time.LocalDateTime
+
+data class PhotoResponse(
+    val id: PhotoId,
+    val hunterName: String,
+    val photoUploadDateTime: LocalDateTime,
+    val photoStatus: PhotoStatus,
+    val photoStatusChangeDateTime: LocalDateTime,
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/RefreshResponse.kt

@@ -0,0 +1,5 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+data class RefreshResponse(
+    val accessToken: String
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/TeamItemResponse.kt

@@ -0,0 +1,9 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+import net.halfbinary.scavengerhuntapi.model.FoundStatus
+import net.halfbinary.scavengerhuntapi.model.ItemId
+
+data class TeamItemResponse(
+    val id: ItemId,
+    val itemFoundStatus: FoundStatus
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/TeamLeaderboardResponse.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+data class TeamLeaderboardResponse(
+    val rank: Int,
+    val teamName: String,
+    val score: Int
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/model/response/TeamResponse.kt

@@ -0,0 +1,8 @@
+package net.halfbinary.scavengerhuntapi.model.response
+
+import net.halfbinary.scavengerhuntapi.model.TeamId
+
+data class TeamResponse(
+    val id: TeamId,
+    val name: String
+)

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/FoundRepository.kt

@@ -1,9 +0,0 @@
-package net.halfbinary.scavengerhuntapi.repository
-
-import net.halfbinary.scavengerhuntapi.model.FoundId
-import net.halfbinary.scavengerhuntapi.model.record.FoundRecord
-import org.springframework.data.jpa.repository.JpaRepository
-import org.springframework.stereotype.Repository
-
-@Repository
-interface FoundRepository : JpaRepository<FoundRecord, FoundId>

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/HuntItemRepository.kt

@@ -0,0 +1,13 @@
+package net.halfbinary.scavengerhuntapi.repository
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.record.HuntItemRecord
+import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.stereotype.Repository
+import java.util.*
+
+@Repository
+interface HuntItemRepository : JpaRepository<HuntItemRecord, UUID> {
+    fun findByHuntIdAndItemId(huntId: HuntId, itemId: ItemId): HuntItemRecord?
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/HuntRepository.kt

@@ -23,6 +23,17 @@ interface HuntRepository : JpaRepository<HuntRecord, HuntId> {
     """, nativeQuery = true)
     fun findAllOngoingByHunter(hunterId: HunterId): List<HuntRecord>
 
+    @Query("""
+        SELECT h.*
+            FROM hunter u
+                 INNER JOIN hunter_team ht ON u.id = ht.hunter_id
+                 INNER JOIN team t ON ht.team_id = t.id
+                 INNER JOIN team_hunt th ON t.id = th.team_id
+                 INNER JOIN hunt h ON th.hunt_id = h.id
+            WHERE u.email = :email
+    """, nativeQuery = true)
+    fun findHuntsByEmail(email: String): List<HuntRecord>
+
     @Query("""
                 SELECT h.*
             FROM hunt h

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/HunterTeamRepository.kt

@@ -0,0 +1,14 @@
+package net.halfbinary.scavengerhuntapi.repository
+
+import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.record.HunterTeamRecord
+import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.stereotype.Repository
+import java.util.*
+
+@Repository
+interface HunterTeamRepository : JpaRepository<HunterTeamRecord, UUID> {
+    fun findByHunterId(hunterId: HunterId): List<HunterTeamRecord>
+    fun findByTeamId(teamId: TeamId): List<HunterTeamRecord>
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/ItemRepository.kt

@@ -1,9 +1,19 @@
 package net.halfbinary.scavengerhuntapi.repository
 
+import net.halfbinary.scavengerhuntapi.model.HuntId
 import net.halfbinary.scavengerhuntapi.model.ItemId
 import net.halfbinary.scavengerhuntapi.model.record.ItemRecord
 import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.data.jpa.repository.Query
 import org.springframework.stereotype.Repository
 
 @Repository
-interface ItemRepository : JpaRepository<ItemRecord, ItemId>
+interface ItemRepository : JpaRepository<ItemRecord, ItemId> {
+    @Query("""
+        SELECT i.*
+            FROM item i
+                 INNER JOIN hunt_item hi ON i.id = hi.item_id
+            WHERE hi.hunt_id = :huntId
+    """, nativeQuery = true)
+    fun findAllByHuntId(huntId: HuntId): List<ItemRecord>
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/PhotoRepository.kt

@@ -0,0 +1,16 @@
+package net.halfbinary.scavengerhuntapi.repository
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import net.halfbinary.scavengerhuntapi.model.record.PhotoRecord
+import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.stereotype.Repository
+@Repository
+interface PhotoRepository : JpaRepository<PhotoRecord, PhotoId> {
+    fun findByItemId(itemId: ItemId): List<PhotoRecord>
+    fun findByHuntIdAndItemId(huntId: HuntId, itemId: ItemId): List<PhotoRecord>
+    fun findByIdAndItemIdAndHuntId(id: PhotoId, itemId: ItemId, huntId: HuntId): PhotoRecord?
+    fun findByHuntIdAndStatus(huntId: HuntId, status: PhotoStatus): List<PhotoRecord>
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/RefreshTokenRepository.kt

@@ -0,0 +1,7 @@
+package net.halfbinary.scavengerhuntapi.repository
+
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+import net.halfbinary.scavengerhuntapi.model.record.RefreshTokenRecord
+import org.springframework.data.jpa.repository.JpaRepository
+
+interface RefreshTokenRepository: JpaRepository<RefreshTokenRecord, RefreshId>

src/main/kotlin/net/halfbinary/scavengerhuntapi/repository/TeamHuntRepository.kt

@@ -0,0 +1,28 @@
+package net.halfbinary.scavengerhuntapi.repository
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.record.HuntRecord
+import net.halfbinary.scavengerhuntapi.model.record.TeamHuntRecord
+import net.halfbinary.scavengerhuntapi.model.record.TeamRecord
+import org.springframework.data.jpa.repository.JpaRepository
+import org.springframework.data.jpa.repository.Query
+import org.springframework.stereotype.Repository
+import java.util.*
+
+@Repository
+interface TeamHuntRepository : JpaRepository<TeamHuntRecord, UUID> {
+    @Query("""
+        SELECT h.* FROM hunt h
+        INNER JOIN team_hunt th ON h.id = th.hunt_id
+        WHERE th.team_id = :teamId
+    """, nativeQuery = true)
+    fun findHuntsByTeamId(teamId: TeamId): List<HuntRecord>
+
+    @Query("""
+        SELECT t.* FROM team t
+        INNER JOIN team_hunt th ON t.id = th.team_id
+        WHERE th.hunt_id = :huntId
+    """, nativeQuery = true)
+    fun findTeamsByHuntId(huntId: HuntId): List<TeamRecord>
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/FileProbeService.kt

@@ -0,0 +1,22 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import org.apache.tika.Tika
+import org.apache.tika.config.TikaConfig
+import org.springframework.stereotype.Service
+
+
+@Service
+class FileProbeService {
+    private val tika = Tika()
+
+    fun getFileType(fileBytes: ByteArray): String {
+        return tika.detect(fileBytes)
+    }
+
+    fun getFileExtension(fileType: String): String {
+        return TikaConfig.getDefaultConfig().mimeRepository.forName(fileType).extension
+    }
+    fun isImageType(fileType: String): Boolean {
+        return fileType.startsWith("image")
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/HuntService.kt

@@ -1,20 +1,33 @@
 package net.halfbinary.scavengerhuntapi.service
 
+import net.halfbinary.scavengerhuntapi.error.exception.ForbiddenException
 import net.halfbinary.scavengerhuntapi.error.exception.NotFoundException
 import net.halfbinary.scavengerhuntapi.model.HuntId
 import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.ItemId
 import net.halfbinary.scavengerhuntapi.model.converter.toDomain
 import net.halfbinary.scavengerhuntapi.model.converter.toRecord
 import net.halfbinary.scavengerhuntapi.model.domain.Hunt
+import net.halfbinary.scavengerhuntapi.model.domain.HuntItem
+import net.halfbinary.scavengerhuntapi.model.domain.Item
 import net.halfbinary.scavengerhuntapi.model.request.HuntStatus
+import net.halfbinary.scavengerhuntapi.model.request.ItemUpdateRequest
+import net.halfbinary.scavengerhuntapi.repository.HuntItemRepository
 import net.halfbinary.scavengerhuntapi.repository.HuntRepository
+import net.halfbinary.scavengerhuntapi.repository.ItemRepository
 import org.springframework.data.repository.findByIdOrNull
 import org.springframework.stereotype.Service
+import java.time.LocalDateTime
 
 @Service
-class HuntService(private val huntRepository: HuntRepository) {
+class HuntService(
+    private val huntRepository: HuntRepository,
+    private val itemRepository: ItemRepository,
+    private val huntItemRepository: HuntItemRepository,
+    private val hunterService: HunterService
+) {
     fun getHunt(huntId: HuntId): Hunt {
-        return huntRepository.findByIdOrNull(huntId)?.toDomain() ?: throw NotFoundException("No hunt with id ${huntId} found")
+        return huntRepository.findByIdOrNull(huntId)?.toDomain() ?: throw NotFoundException("No hunt with id $huntId found")
     }
 
     fun getAllHunts(status: HuntStatus?): List<Hunt> {
@@ -30,7 +43,61 @@ class HuntService(private val huntRepository: HuntRepository) {
         return huntRepository.findAllOngoingByHunter(hunterId).map { it.toDomain() }
     }
 
+    fun getHuntsByEmail(email: String, status: HuntStatus?): List<Hunt> {
+        val allHunts = huntRepository.findHuntsByEmail(email)
+        val filteredHunts = when (status) {
+            HuntStatus.ONGOING -> {
+                allHunts
+                    .filter { !it.isTerminated && it.startDateTime < LocalDateTime.now() && it.endDateTime > LocalDateTime.now() }
+                    .toList()
+            }
+            HuntStatus.CLOSED -> {
+                allHunts
+                    .filter { it.isTerminated || it.endDateTime < LocalDateTime.now() }
+            }
+            HuntStatus.UNSTARTED -> {
+                allHunts
+                    .filter { !it.isTerminated && it.startDateTime > LocalDateTime.now() }
+            }
+            else -> { allHunts }
+        }
+        return filteredHunts.map { it.toDomain() }
+    }
+
     fun createHunt(hunt: Hunt): Hunt {
         return huntRepository.save(hunt.toRecord()).toDomain()
     }
+
+    fun getItemsForHunt(huntId: HuntId, email: String): List<Item> {
+        val hunt = huntRepository.findByIdOrNull(huntId)?.toDomain() ?: throw NotFoundException("No hunt with id $huntId found")
+        val hunter = hunterService.getHunterByEmail(email)
+        if (!hunter.isAdmin && !hunt.isOngoing) throw ForbiddenException()
+        return itemRepository.findAllByHuntId(huntId).map { it.toDomain() }
+    }
+
+    fun addItemToHunt(huntId: HuntId, item: Item): Item {
+        huntRepository.findByIdOrNull(huntId) ?: throw NotFoundException("No hunt with id $huntId found")
+        val savedItem = itemRepository.save(item.toRecord()).toDomain()
+        huntItemRepository.save(HuntItem(huntId = huntId, itemId = savedItem.id).toRecord())
+        return savedItem
+    }
+
+    fun updateItem(huntId: HuntId, itemId: ItemId, request: ItemUpdateRequest): Item {
+        huntItemRepository.findByHuntIdAndItemId(huntId, itemId)
+            ?: throw NotFoundException("No item with id $itemId found in hunt $huntId")
+        val existing = itemRepository.findByIdOrNull(itemId)
+            ?: throw NotFoundException("No item with id $itemId found")
+        val updated = existing.copy(
+            name = request.name ?: existing.name,
+            points = request.points ?: existing.points
+        )
+        return itemRepository.save(updated).toDomain()
+    }
+
+    fun deleteItem(huntId: HuntId, itemId: ItemId) {
+        val huntItem = huntItemRepository.findByHuntIdAndItemId(huntId, itemId)
+            ?: throw NotFoundException("No item with id $itemId found in hunt $huntId")
+        huntItemRepository.delete(huntItem)
+        itemRepository.deleteById(itemId)
+    }
 }

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/HunterDetailsService.kt

@@ -0,0 +1,32 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.halfbinary.scavengerhuntapi.repository.HunterRepository
+import org.springframework.security.core.authority.SimpleGrantedAuthority
+import org.springframework.security.core.userdetails.User
+import org.springframework.security.core.userdetails.UserDetails
+import org.springframework.security.core.userdetails.UserDetailsService
+import org.springframework.security.core.userdetails.UsernameNotFoundException
+import org.springframework.stereotype.Service
+import java.util.*
+
+
+@Service
+class HunterDetailsService(private val hunterRepository: HunterRepository): UserDetailsService {
+    override fun loadUserByUsername(username: String): UserDetails {
+        hunterRepository.findByEmail(username)
+            ?.let { hunter ->
+                val hunterAuthorities =
+                    if (hunter.isAdmin) {
+                        SimpleGrantedAuthority("ROLE_ADMIN")
+                    } else {
+                        SimpleGrantedAuthority("ROLE_USER")
+                    }
+                return User(
+                    hunter.email,
+                    hunter.password,
+                    Collections.singleton(hunterAuthorities)
+                )
+            }
+        throw UsernameNotFoundException("User Not Found with username: $username")
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/HunterService.kt

@@ -0,0 +1,20 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.halfbinary.scavengerhuntapi.error.exception.NotFoundException
+import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.converter.toDomain
+import net.halfbinary.scavengerhuntapi.model.domain.Hunter
+import net.halfbinary.scavengerhuntapi.repository.HunterRepository
+import org.springframework.stereotype.Service
+
+@Service
+class HunterService(private val hunterRepository: HunterRepository) {
+    fun getHunterByEmail(email: String): Hunter {
+        return hunterRepository.findByEmail(email)?.toDomain()
+            ?: throw NotFoundException("No hunter with email $email found")
+    }
+
+    fun getHunterById(hunterId: HunterId): Hunter {
+        return hunterRepository.findById(hunterId).orElseThrow { NotFoundException("No hunter with id $hunterId found") }.toDomain()
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/PhotoService.kt

@@ -0,0 +1,220 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.coobird.thumbnailator.Thumbnails
+import net.coobird.thumbnailator.tasks.UnsupportedFormatException
+import net.halfbinary.scavengerhuntapi.error.exception.BadFileException
+import net.halfbinary.scavengerhuntapi.error.exception.ConflictException
+import net.halfbinary.scavengerhuntapi.error.exception.ForbiddenException
+import net.halfbinary.scavengerhuntapi.error.exception.NotFoundException
+import net.halfbinary.scavengerhuntapi.model.FoundStatus
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.ImageVersion
+import net.halfbinary.scavengerhuntapi.model.ItemId
+import net.halfbinary.scavengerhuntapi.model.PhotoId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.converter.toDomain
+import net.halfbinary.scavengerhuntapi.model.converter.toRecord
+import net.halfbinary.scavengerhuntapi.model.converter.toResponse
+import net.halfbinary.scavengerhuntapi.model.domain.Photo
+import net.halfbinary.scavengerhuntapi.model.domain.PhotoFile
+import net.halfbinary.scavengerhuntapi.model.response.PhotoResponse
+import net.halfbinary.scavengerhuntapi.repository.PhotoRepository
+import org.springframework.core.io.InputStreamResource
+import org.springframework.data.repository.findByIdOrNull
+import org.springframework.http.MediaType
+import org.springframework.stereotype.Service
+import org.springframework.web.multipart.MultipartFile
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.time.LocalDateTime
+
+private const val PHOTO_NOT_FOUND = "Photo not found"
+
+@Service
+class PhotoService(
+    private val photoRepository: PhotoRepository,
+    private val hunterService: HunterService,
+    private val teamService: TeamService,
+    private val huntService: HuntService,
+    private val s3StorageService: S3StorageService,
+    private val fileProbeService: FileProbeService
+) {
+    fun submitPhoto(huntId: HuntId, itemId: ItemId, email: String, file: MultipartFile) {
+        val hunter = hunterService.getHunterByEmail(email)
+        val hunt = huntService.getHunt(huntId)
+        if (!hunter.isAdmin && !hunt.isOngoing) throw ForbiddenException()
+
+        val originalBytes = file.bytes
+        val fileType = fileProbeService.getFileType(originalBytes)
+
+        if(!fileProbeService.isImageType(fileType)) throw BadFileException("Not an image")
+
+        val originalAsJpeg = try {
+            toJpeg(file.bytes)
+        } catch (_: UnsupportedFormatException) {
+            throw BadFileException("Image type is not supported")
+        }
+
+        val now = LocalDateTime.now()
+        val photo = Photo(
+            itemId = itemId,
+            huntId = huntId,
+            hunterId = hunter.id,
+            foundDateTime = now,
+            status = PhotoStatus.SUBMITTED,
+            statusChangeDateTime = now
+        )
+        val savedRecord = photoRepository.save(photo.toRecord())
+        val baseName = savedRecord.id.toString()
+
+        s3StorageService.upload("${baseName}_original${fileProbeService.getFileExtension(fileType)}", originalBytes, fileType)
+        s3StorageService.upload("${baseName}_large.jpg", originalAsJpeg, MediaType.IMAGE_JPEG_VALUE)
+        s3StorageService.upload("${baseName}_medium.jpg", resize(originalBytes, 800), MediaType.IMAGE_JPEG_VALUE)
+        s3StorageService.upload("${baseName}_small.jpg", resize(originalBytes, 200), MediaType.IMAGE_JPEG_VALUE)
+    }
+
+    fun getPhotoInfo(huntId: HuntId, teamId: TeamId, itemId: ItemId, photoId: PhotoId, email: String): PhotoResponse {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+        val photoRecord = photoRepository.findByIdAndItemIdAndHuntId(photoId, itemId, huntId)
+            ?: throw NotFoundException(PHOTO_NOT_FOUND)
+
+        if (!requestingHunter.isAdmin) {
+            val hunt = huntService.getHunt(huntId)
+            if (!hunt.isOngoing) throw ForbiddenException()
+            val team = try {
+                teamService.getTeamForHunterInHunt(huntId, email)
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+            if (team.id != teamId) throw ForbiddenException()
+        }
+
+        val submitter = hunterService.getHunterById(photoRecord.hunterId)
+        return photoRecord.toDomain().toResponse(submitter)
+    }
+
+    fun getPhotoFile(photoId: PhotoId, email: String, version: ImageVersion = ImageVersion.LARGE): PhotoFile {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+        val photoRecord = photoRepository.findByIdOrNull(photoId)
+            ?: throw NotFoundException(PHOTO_NOT_FOUND)
+
+        if (!requestingHunter.isAdmin) {
+            val submitter = hunterService.getHunterById(photoRecord.hunterId)
+            try {
+                val requestingTeam =
+                    teamService.getTeamForHunterInHunt(photoRecord.huntId, requestingHunter.email)
+                val submitterTeam =
+                    teamService.getTeamForHunterInHunt(photoRecord.huntId, submitter.email)
+                if (requestingTeam.id != submitterTeam.id) throw ForbiddenException()
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+        }
+
+        val key = when (version) {
+            ImageVersion.ORIGINAL -> s3StorageService.findKeyByPrefix("${photoId}_original")
+                ?: throw NotFoundException("Photo file not found")
+            ImageVersion.LARGE -> "${photoId}_large.jpg"
+            ImageVersion.MEDIUM -> "${photoId}_medium.jpg"
+            ImageVersion.SMALL -> "${photoId}_small.jpg"
+        }
+        val (stream, contentType) = s3StorageService.download(key)
+        return PhotoFile(InputStreamResource(stream), MediaType.parseMediaType(contentType))
+    }
+
+    fun getItemFoundStatus(huntId: HuntId, teamId: TeamId, itemId: ItemId, email: String): FoundStatus {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+
+        if (!requestingHunter.isAdmin) {
+            val hunt = huntService.getHunt(huntId)
+            if (!hunt.isOngoing) throw ForbiddenException()
+            val team = try {
+                teamService.getTeamForHunterInHunt(huntId, email)
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+            if (team.id != teamId) throw ForbiddenException()
+        }
+
+        val teamHunterIds = teamService.getHunterIdsForTeam(teamId)
+        val photos = photoRepository.findByHuntIdAndItemId(huntId, itemId)
+            .filter { it.hunterId in teamHunterIds && it.status != PhotoStatus.REMOVED }
+
+        return when {
+            photos.any { it.status == PhotoStatus.APPROVED } -> FoundStatus.APPROVED
+            photos.any { it.status == PhotoStatus.REJECTED } -> FoundStatus.REJECTED
+            photos.any { it.status == PhotoStatus.SUBMITTED } -> FoundStatus.SUBMITTED
+            else -> FoundStatus.NOT_FOUND
+        }
+    }
+
+    fun removePhoto(huntId: HuntId, teamId: TeamId, itemId: ItemId, photoId: PhotoId, email: String) {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+
+        if (!requestingHunter.isAdmin) {
+            val hunt = huntService.getHunt(huntId)
+            if (!hunt.isOngoing) throw ForbiddenException()
+        }
+
+        val photoRecord = photoRepository.findByIdAndItemIdAndHuntId(photoId, itemId, huntId)
+            ?: throw NotFoundException(PHOTO_NOT_FOUND)
+
+        if (!requestingHunter.isAdmin) {
+            val team = try {
+                teamService.getTeamForHunterInHunt(huntId, email)
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+            if (team.id != teamId) throw ForbiddenException()
+        }
+
+        if (photoRecord.status == PhotoStatus.APPROVED) throw ConflictException("Cannot remove an approved photo")
+
+        photoRepository.save(photoRecord.copy(status = PhotoStatus.REMOVED, statusChangeDateTime = LocalDateTime.now()))
+    }
+
+    fun getItemPhotos(huntId: HuntId, teamId: TeamId, itemId: ItemId, email: String): List<PhotoResponse> {
+        val requestingHunter = hunterService.getHunterByEmail(email)
+
+        if (!requestingHunter.isAdmin) {
+            val hunt = huntService.getHunt(huntId)
+            if (!hunt.isOngoing) throw ForbiddenException()
+            val team = try {
+                teamService.getTeamForHunterInHunt(huntId, email)
+            } catch (_: NotFoundException) {
+                throw ForbiddenException()
+            }
+            if (team.id != teamId) throw ForbiddenException()
+        }
+
+        val teamHunterIds = teamService.getHunterIdsForTeam(teamId)
+        return photoRepository.findByHuntIdAndItemId(huntId, itemId)
+            .filter { it.hunterId in teamHunterIds && it.status != PhotoStatus.REMOVED }
+            .map { it.toDomain().toResponse(hunterService.getHunterById(it.hunterId)) }
+    }
+
+    fun updatePhotoStatus(photoId: PhotoId, status: PhotoStatus) {
+        val record = photoRepository.findByIdOrNull(photoId)
+            ?: throw NotFoundException(PHOTO_NOT_FOUND)
+        photoRepository.save(record.copy(status = status, statusChangeDateTime = LocalDateTime.now()))
+    }
+
+    private fun toJpeg(bytes: ByteArray): ByteArray {
+        val output = ByteArrayOutputStream()
+        Thumbnails.of(ByteArrayInputStream(bytes))
+            .scale(1.0)
+            .outputFormat("jpg")
+            .toOutputStream(output)
+        return output.toByteArray()
+    }
+
+    private fun resize(bytes: ByteArray, width: Int): ByteArray {
+        val output = ByteArrayOutputStream()
+        Thumbnails.of(ByteArrayInputStream(bytes))
+            .width(width)
+            .outputFormat("jpg")
+            .toOutputStream(output)
+        return output.toByteArray()
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/RefreshTokenService.kt

@@ -0,0 +1,51 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.halfbinary.scavengerhuntapi.config.JwtUtil
+import net.halfbinary.scavengerhuntapi.error.exception.ExpiredRefreshTokenException
+import net.halfbinary.scavengerhuntapi.error.exception.InvalidRefreshTokenException
+import net.halfbinary.scavengerhuntapi.model.RefreshId
+import net.halfbinary.scavengerhuntapi.model.record.RefreshTokenRecord
+import net.halfbinary.scavengerhuntapi.repository.HunterRepository
+import net.halfbinary.scavengerhuntapi.repository.RefreshTokenRepository
+import org.slf4j.LoggerFactory
+import org.springframework.data.repository.findByIdOrNull
+import org.springframework.stereotype.Service
+import java.time.LocalDateTime
+import java.time.temporal.ChronoUnit
+
+@Service
+class RefreshTokenService(private val refreshTokenRepository: RefreshTokenRepository, private val jwtUtil: JwtUtil, private val hunterRepository: HunterRepository) {
+
+    companion object {
+        private val log = LoggerFactory.getLogger(RefreshTokenService::class.java)
+    }
+
+    fun getAccessToken(tokenId: RefreshId): String {
+        return getToken(tokenId)?.let { refreshToken ->
+            if (isTokenExpired(refreshToken)) {
+                removeToken(tokenId)
+                throw ExpiredRefreshTokenException(tokenId)
+            } else {
+                val isAdmin = hunterRepository.findByEmail(refreshToken.email)?.isAdmin ?: false
+                jwtUtil.generateToken(refreshToken.email, isAdmin)
+            }
+        }?: throw InvalidRefreshTokenException(tokenId)
+    }
+
+    fun generateRefreshToken(email: String): RefreshId {
+        return refreshTokenRepository.save(RefreshTokenRecord(RefreshId.randomUUID(), email, LocalDateTime.now().plus(1, ChronoUnit.MONTHS))).token
+    }
+
+    fun isTokenExpired(token: RefreshTokenRecord): Boolean {
+        return token.expiryDateTime.isBefore(LocalDateTime.now())
+    }
+
+    fun getToken(token: RefreshId): RefreshTokenRecord? {
+        return refreshTokenRepository.findByIdOrNull(token)
+    }
+
+    fun removeToken(token: RefreshId) {
+        log.debug("Removing refresh token: $token")
+        refreshTokenRepository.deleteById(token)
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/S3StorageService.kt

@@ -0,0 +1,49 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import org.springframework.beans.factory.annotation.Value
+import org.springframework.stereotype.Service
+import software.amazon.awssdk.core.sync.RequestBody
+import software.amazon.awssdk.services.s3.S3Client
+import software.amazon.awssdk.services.s3.model.GetObjectRequest
+import software.amazon.awssdk.services.s3.model.ListObjectsV2Request
+import software.amazon.awssdk.services.s3.model.PutObjectRequest
+import java.io.InputStream
+
+@Service
+class S3StorageService(
+    private val s3Client: S3Client,
+    @Value("\${minio.bucket}") private val bucket: String
+) {
+    fun upload(key: String, bytes: ByteArray, contentType: String) {
+        s3Client.putObject(
+            PutObjectRequest.builder()
+                .bucket(bucket)
+                .key(key)
+                .contentType(contentType)
+                .contentLength(bytes.size.toLong())
+                .build(),
+            RequestBody.fromBytes(bytes)
+        )
+    }
+
+    fun findKeyByPrefix(prefix: String): String? {
+        val response = s3Client.listObjectsV2(
+            ListObjectsV2Request.builder()
+                .bucket(bucket)
+                .prefix(prefix)
+                .maxKeys(1)
+                .build()
+        )
+        return response.contents().firstOrNull()?.key()
+    }
+
+    fun download(key: String): Pair<InputStream, String> {
+        val response = s3Client.getObject(
+            GetObjectRequest.builder()
+                .bucket(bucket)
+                .key(key)
+                .build()
+        )
+        return Pair(response, response.response().contentType())
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/StatsService.kt

@@ -0,0 +1,58 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.PhotoStatus
+import net.halfbinary.scavengerhuntapi.model.domain.HunterLeaderboardEntry
+import net.halfbinary.scavengerhuntapi.model.domain.TeamLeaderboardEntry
+import net.halfbinary.scavengerhuntapi.repository.ItemRepository
+import net.halfbinary.scavengerhuntapi.repository.PhotoRepository
+import org.springframework.stereotype.Service
+
+@Service
+class StatsService(
+    private val photoRepository: PhotoRepository,
+    private val itemRepository: ItemRepository,
+    private val teamService: TeamService,
+    private val hunterService: HunterService
+) {
+    fun getTeamLeaderboard(huntId: HuntId): List<TeamLeaderboardEntry> {
+        val approvedPhotos = photoRepository.findByHuntIdAndStatus(huntId, PhotoStatus.APPROVED)
+        val itemPoints = itemRepository.findAllByHuntId(huntId).associate { it.id to it.points }
+        val teams = teamService.getListOfTeamsForHunt(huntId)
+
+        val sortedScores = teams.map { team ->
+            val teamHunterIds = teamService.getHunterIdsForTeam(team.id)
+            val score = approvedPhotos
+                .filter { it.hunterId in teamHunterIds }
+                .distinctBy { it.itemId }
+                .sumOf { itemPoints[it.itemId] ?: 0 }
+            team to score
+        }.sortedByDescending { (_, score) -> score }
+
+        var rank = 1
+        return sortedScores.mapIndexed { index, (team, score) ->
+            if (index > 0 && sortedScores[index - 1].second != score) rank = index + 1
+            TeamLeaderboardEntry(rank = rank, teamName = team.name, score = score)
+        }
+    }
+
+    fun getHunterLeaderboard(huntId: HuntId): List<HunterLeaderboardEntry> {
+        val approvedPhotos = photoRepository.findByHuntIdAndStatus(huntId, PhotoStatus.APPROVED)
+        val itemPoints = itemRepository.findAllByHuntId(huntId).associate { it.id to it.points }
+
+        val sortedScores = approvedPhotos
+            .groupBy { it.hunterId }
+            .map { (hunterId, photos) ->
+                val score = photos.distinctBy { it.itemId }.sumOf { itemPoints[it.itemId] ?: 0 }
+                hunterId to score
+            }
+            .sortedByDescending { (_, score) -> score }
+
+        var rank = 1
+        return sortedScores.mapIndexed { index, (hunterId, score) ->
+            if (index > 0 && sortedScores[index - 1].second != score) rank = index + 1
+            val hunter = hunterService.getHunterById(hunterId)
+            HunterLeaderboardEntry(rank = rank, hunterName = hunter.name, score = score)
+        }
+    }
+}

src/main/kotlin/net/halfbinary/scavengerhuntapi/service/TeamService.kt

@@ -0,0 +1,65 @@
+package net.halfbinary.scavengerhuntapi.service
+
+import net.halfbinary.scavengerhuntapi.error.exception.NotFoundException
+import net.halfbinary.scavengerhuntapi.model.HuntId
+import net.halfbinary.scavengerhuntapi.model.HunterId
+import net.halfbinary.scavengerhuntapi.model.TeamId
+import net.halfbinary.scavengerhuntapi.model.converter.toDomain
+import net.halfbinary.scavengerhuntapi.model.converter.toRecord
+import net.halfbinary.scavengerhuntapi.model.domain.Team
+import net.halfbinary.scavengerhuntapi.model.domain.TeamHunt
+import net.halfbinary.scavengerhuntapi.model.record.HunterTeamRecord
+import net.halfbinary.scavengerhuntapi.model.request.TeamRequest
+import net.halfbinary.scavengerhuntapi.repository.HunterRepository
+import net.halfbinary.scavengerhuntapi.repository.HunterTeamRepository
+import net.halfbinary.scavengerhuntapi.repository.TeamHuntRepository
+import net.halfbinary.scavengerhuntapi.repository.TeamRepository
+import org.springframework.stereotype.Service
+import java.util.*
+
+@Service
+class TeamService(
+    private val teamRepository: TeamRepository,
+    private val teamHuntRepository: TeamHuntRepository,
+    private val hunterRepository: HunterRepository,
+    private val hunterTeamRepository: HunterTeamRepository,
+) {
+    fun getListOfTeamsForHunt(huntId: HuntId): List<Team> {
+        return getTeamsForHunt(huntId)
+    }
+
+    fun createTeam(name: String): Team {
+        return teamRepository.save(TeamRequest(name).toDomain().toRecord()).toDomain()
+    }
+
+    fun addTeamToHunt(huntId: HuntId, teamId: TeamId) {
+        teamHuntRepository.save(TeamHunt(teamId = teamId, huntId = huntId).toRecord()).toDomain()
+    }
+
+    fun getTeamFromHunt(huntId: HuntId, teamId: TeamId): Team {
+        return getTeamsForHunt(huntId)
+            .filter { it.id == teamId }
+            .elementAt(0)
+    }
+
+    fun getTeamForHunterInHunt(huntId: HuntId, email: String): Team {
+        val hunter = hunterRepository.findByEmail(email) ?: throw NotFoundException("No hunter with email $email found")
+        val hunterTeamIds = hunterTeamRepository.findByHunterId(hunter.id).map { it.teamId }.toSet()
+        return getTeamsForHunt(huntId)
+            .firstOrNull { it.id in hunterTeamIds }
+            ?: throw NotFoundException("No team found for hunter $email in hunt $huntId")
+    }
+
+    fun getHunterIdsForTeam(teamId: TeamId): Set<HunterId> {
+        return hunterTeamRepository.findByTeamId(teamId).map { it.hunterId }.toSet()
+    }
+
+    fun joinTeam(teamId: TeamId, email: String) {
+        val hunter = hunterRepository.findByEmail(email) ?: throw NotFoundException("No hunter with email $email found")
+        hunterTeamRepository.save(HunterTeamRecord(UUID.randomUUID(), hunter.id, teamId))
+    }
+
+    private fun getTeamsForHunt(huntId: HuntId): List<Team> {
+        return teamHuntRepository.findTeamsByHuntId(huntId).map { it.toDomain() }
+    }
+}

src/main/resources/application.properties

@@ -4,7 +4,23 @@ spring.jpa.hibernate.ddl-auto=update
 
 spring.jpa.properties.hibernate.type.preferred_uuid_jdbc_type=CHAR
 
-spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver
+spring.datasource.driverClassName=org.mariadb.jdbc.Driver
 spring.datasource.url=${DB_URL}
 spring.datasource.username=${DB_USER}
 spring.datasource.password=${DB_PASSWORD}
+
+jwt.secret=${JWT_SECRET}
+jwt.expiration=300000
+
+minio.endpoint=${MINIO_ENDPOINT}
+minio.access-key=${MINIO_ACCESS_KEY}
+minio.secret-key=${MINIO_SECRET_KEY}
+minio.bucket=${MINIO_BUCKET}
+
+spring.servlet.multipart.max-file-size=25MB
+spring.servlet.multipart.max-request-size=25MB
+
+springdoc.api-docs.enabled=true
+springdoc.api-docs.path=/docs/api-docs
+springdoc.swagger-ui.enabled=true
+springdoc.swagger-ui.path=/docs/swagger-ui.html