sequenceDiagram
    actor User
    participant Controller as AuthController
    participant Service as UserService
    participant Security as HttpServletRequest
    participant Repo as SchoolRepository
    participant DB as Database

    User->>Controller: POST /register (email, password)
    
    %% Phase 1: Validation
    Controller->>Controller: Validate Input (@Valid)
    alt Validation Failed
        Controller-->>User: Return "auth/registerForm" (Display Errors)
    else Validation Passed
        
        %% Phase 2: Registration
        Note right of Controller: 1. Create Account
        Controller->>Service: registerNewUser(user)
        Service->>Service: Hash Password (BCrypt)
        Service->>DB: Save User & Roles
        DB-->>Service: Saved User
        Service-->>Controller: Return User

        %% Phase 3: Auto-Login
        Note right of Controller: 2. Auto-Login
        Controller->>Security: login(email, rawPassword)
        Security->>Security: Authenticate & Create Session
        Security-->>Controller: Session Established (JSESSIONID)

        %% Phase 4: School Detection
        Note right of Controller: 3. Domain Resolution
        loop Recursive Domain Check
            Controller->>Repo: findByDomain(currentDomain)
            Repo-->>Controller: Optional<School>
            opt School Not Found
                Controller->>Controller: Strip subdomain (student.kirkwood.edu -> kirkwood.edu)
            end
        end

        %% Phase 5: Redirect
        alt School Found
            Controller->>Controller: Add Flash Attribute (messageSuccess)
            Controller-->>User: Redirect to /schools/{id}
        else No School Found
            Controller->>Controller: Add Flash Attribute (messageWarning)
            Controller-->>User: Redirect to /
        end
    end

@Autowired
private VetRepository vets;

@Autowired
private UserRepository users;

@Autowired
private SchoolRepository schools;

@Test
void testFindAll() {
	vets.findAll();
	vets.findAll(); // served from cache
	assertThat(vets.findAll()).isNotEmpty();
	users.findAll();
	users.findAll(); // served from cache
	assertThat(users.findAll()).isNotEmpty();
	schools.findAll();
	schools.findAll(); // served from cache
	assertThat(schools.findAll()).isNotEmpty();
}

CREATE TABLE IF NOT EXISTS users (
  id INT AUTO_INCREMENT PRIMARY KEY,
  first_name VARCHAR(50),
  last_name VARCHAR(50),
  nickname VARCHAR(50),
  nickname_is_flagged TINYINT DEFAULT 0,
  email VARCHAR(255) NOT NULL,
  public_email TINYINT DEFAULT 0,
  phone VARCHAR(255),
  public_phone TINYINT DEFAULT 0,
  password_hash VARCHAR(255),
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  deleted_at DATETIME,
  UNIQUE INDEX idx_users_email (email),
  INDEX idx_users_name (last_name, first_name)
);

CREATE TABLE IF NOT EXISTS roles (
   id INT AUTO_INCREMENT PRIMARY KEY,
   name VARCHAR(50) NOT NULL UNIQUE,
   description VARCHAR(255)
);

CREATE TABLE IF NOT EXISTS permissions (
   id INT AUTO_INCREMENT PRIMARY KEY,
   name VARCHAR(100) NOT NULL UNIQUE,
   description VARCHAR(255)
);

CREATE TABLE IF NOT EXISTS user_roles (
  user_id INT NOT NULL,
  role_id INT NOT NULL,
  PRIMARY KEY (user_id, role_id),
  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
  FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE
);

CREATE TABLE IF NOT EXISTS permission_role (
   permission_id INT NOT NULL,
   role_id INT NOT NULL,
   PRIMARY KEY (permission_id, role_id),
   FOREIGN KEY (permission_id) REFERENCES permissions(id) ON DELETE CASCADE,
   FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE
);

CREATE TABLE IF NOT EXISTS schools (
  id INT AUTO_INCREMENT PRIMARY KEY,
  name VARCHAR(255) NOT NULL,
  domain VARCHAR(255) NOT NULL,
  status_id ENUM('ACTIVE', 'INACTIVE', 'SUSPENDED') DEFAULT 'ACTIVE',
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  deleted_at DATETIME DEFAULT NULL,
  UNIQUE INDEX idx_schools_domain (domain)
  );

CREATE TABLE IF NOT EXISTS locations (
  id INT AUTO_INCREMENT PRIMARY KEY,
  school_id INT NOT NULL,
  parent_location_id INT NULL,
  name VARCHAR(255) NOT NULL,
  description TEXT,
  address VARCHAR(255),
  latitude DECIMAL(8,4),
  longitude DECIMAL(8,4),
  status_id ENUM('DRAFT', 'ACTIVE', 'CLOSED', 'COMING_SOON') DEFAULT 'ACTIVE',
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  deleted_at DATETIME DEFAULT NULL,
  CONSTRAINT fk_locations_school FOREIGN KEY (school_id) REFERENCES schools(id) ON DELETE CASCADE,
  CONSTRAINT fk_locations_parent FOREIGN KEY (parent_location_id) REFERENCES locations(id) ON DELETE SET NULL
);

INSERT IGNORE INTO roles (name, description) VALUES
('SCHOOL_ADMIN', 'Rec Center Admin: Can manage facilities, leagues, scores, and users.'),
('STUDENT', 'Student: Can join leagues, create teams, and view schedules.');

INSERT IGNORE INTO permissions (name, description) VALUES
('MANAGE_OWN_PROFILE', 'Allows user to update their personal info and password.'),
('USE_MESSAGING', 'Allows user to send/receive messages with other participants.'),
('VIEW_LEAGUES', 'Allows user to browse and search available leagues and activities.'),
('REGISTER_FOR_LEAGUE', 'Allows user to register as an individual for a league.'),
('CREATE_TEAM', 'Allows user to create a new team as a captain.'),
('MANAGE_TEAM_INVITATIONS', 'Allows user to accept or decline invitations to a team.'),
('VIEW_OWN_SCHEDULE', 'Allows user to view their personal and team game schedule.'),
('VIEW_STANDINGS', 'Allows user to view league standings and team statistics.'),
('MANAGE_FACILITIES', 'Allows user to C/R/U/D locations, fields, and courts.'),
('MANAGE_SCHEDULES', 'Allows user to C/R/U/D leagues, activities, and games.'),
('MANAGE_REGISTRATIONS', 'Allows user to view and approve team registrations.'),
('MANAGE_SCORES', 'Allows user to enter and confirm game scores.'),
('SEND_ANNOUNCEMENTS', 'Allows user to send messages to individuals, teams, and leagues.');

INSERT IGNORE INTO permission_role (role_id, permission_id) VALUES
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'MANAGE_OWN_PROFILE')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'USE_MESSAGING')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'VIEW_LEAGUES')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'REGISTER_FOR_LEAGUE')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'CREATE_TEAM')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'MANAGE_TEAM_INVITATIONS')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'VIEW_OWN_SCHEDULE')),
((SELECT id FROM roles WHERE name = 'STUDENT'), (SELECT id FROM permissions WHERE name = 'VIEW_STANDINGS'));

INSERT IGNORE INTO permission_role (role_id, permission_id) VALUES
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_OWN_PROFILE')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'USE_MESSAGING')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'VIEW_LEAGUES')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'REGISTER_FOR_LEAGUE')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'CREATE_TEAM')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_TEAM_INVITATIONS')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'VIEW_OWN_SCHEDULE')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'VIEW_STANDINGS')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_FACILITIES')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_SCHEDULES')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_REGISTRATIONS')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'MANAGE_SCORES')),
((SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN'), (SELECT id FROM permissions WHERE name = 'SEND_ANNOUNCEMENTS'));

INSERT IGNORE INTO users (first_name, last_name, email, password_hash) VALUES
('Brett', 'School Admin', 'brett.baumgart@kirkwood.edu', 'hashed_password_for_brett'),
('Alex', 'Student', 'alex.student@student.kirkwood.edu', 'hashed_password_for_alex');

INSERT IGNORE INTO user_roles (user_id, role_id) VALUES
((SELECT id FROM users WHERE email = 'brett.baumgart@kirkwood.edu'), (SELECT id FROM roles WHERE name = 'SCHOOL_ADMIN')),
((SELECT id FROM users WHERE email = 'alex.student@student.kirkwood.edu'), (SELECT id FROM roles WHERE name = 'STUDENT'));

INSERT IGNORE INTO schools (name, domain, status_id) VALUES
('Kirkwood Community College', 'kirkwood.edu', 'active'),
('University of Iowa', 'uiowa.edu', 'active'),
('Iowa State University', 'iastate.edu', 'active'),
('University of Northern Iowa', 'uni.edu', 'active'),
('Coe College', 'coe.edu', 'active'),
('Mount Mercy University', 'mtmercy.edu', 'active'),
('Drake University', 'drake.edu', 'active'),
('Grinnell College', 'grinnell.edu', 'active'),
('Luther College', 'luther.edu', 'active'),
('Simpson College', 'simpson.edu', 'inactive'), -- Testing status
('Wartburg College', 'wartburg.edu', 'active'),
('Cornell College', 'cornellcollege.edu', 'active'),
('Loras College', 'loras.edu', 'active'),
('Clarke University', 'clarke.edu', 'suspended'), -- Testing status
('St. Ambrose University', 'sau.edu', 'active');

INSERT IGNORE INTO locations (school_id, name, description, address, status_id) VALUES
(1, 'Main Campus', 'The primary campus in Cedar Rapids', '6301 Kirkwood Blvd SW, Cedar Rapids, IA', 'active');

INSERT IGNORE INTO locations (school_id, name, description, address, status_id) VALUES
(2, 'Carver-Hawkeye Arena', 'Main sports arena', '1 Elliott Dr, Iowa City, IA', 'active');

INSERT IGNORE INTO locations (school_id, parent_location_id, name, description, status_id) VALUES
(1, 1, 'Michael J Gould Rec Center', 'Student recreation facility', 'active'),
(1, 1, 'Johnson Hall', 'Athletics building and gymnasium', 'active');

INSERT IGNORE INTO locations (school_id, parent_location_id, name, description, status_id) VALUES
(2, 2, 'Main Court', 'The primary basketball court', 'active'),
(2, 2, 'Weight Room', 'Athlete training facility', 'coming_soon');

INSERT IGNORE INTO locations (school_id, parent_location_id, name, description, status_id) VALUES
(1, 3, 'Basketball Court 1', 'North court', 'active'),
(1, 3, 'Basketball Court 2', 'South court', 'active');

@Test
void testSchoolDetails() {
    RestTemplate template = builder.rootUri("http://localhost:" + port).build();
    ResponseEntity<String> result = template.exchange(RequestEntity.get("/schools/1").build(), String.class);
    assertThat(result.getStatusCode()).isEqualTo(HttpStatus.OK);
    assertThat(result.getBody()).contains("Kirkwood Community College");
}

@GetMapping("/schools/{schoolId}")
public ModelAndView showSchool(@PathVariable("schoolId") int schoolId) {
	ModelAndView mav = new ModelAndView("schools/schoolDetails");
	School school = schoolRepository.findById(schoolId)
		.orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "School not found"));
	mav.addObject(school);
	return mav;
}

<!DOCTYPE html>
<html xmlns:th="https://www.thymeleaf.org"
      th:replace="~{fragments/layout :: layout (~{::body},'schools')}">

<body>

<h2 class="text-center">Welcome to <span th:text="${school.name}">School Name</span></h2>

<div class="container mt-4">

  <div class="alert alert-info">
    <h4 class="alert-heading">Coming Soon!</h4>
    <p>Upcoming leagues, intramural events, and registration for
      <strong th:text="${school.name}">this school</strong> will appear here shortly.
    </p>
  </div>

</div>

</body>
</html>

// Matches ONLY numbers (e.g., /schools/1)
@GetMapping("/schools/{schoolId:\\d+}")
public ModelAndView showSchoolById(@PathVariable("schoolId") int schoolId) {
	ModelAndView mav = new ModelAndView("schools/schoolDetails");
	School school = schoolRepository.findById(schoolId)
		.orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "School not found"));
	mav.addObject(school);
	return mav;
}

// Matches text (e.g., /schools/kirkwood)
@GetMapping("/schools/{slug:[a-zA-Z-]+}")
public ModelAndView showSchoolBySlug(@PathVariable("slug") String slug) {
	// Reconstruct the domain (User asked to assume ".edu")
	String fullDomain = slug + ".edu";

	ModelAndView mav = new ModelAndView("schools/schoolDetails");
	School school = schoolRepository.findByDomain(fullDomain)
		.orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "School not found"));
	mav.addObject(school);
	return mav;
}

package org.springframework.samples.petclinic.user;

import jakarta.validation.Valid;
import org.springframework.samples.petclinic.school.School;
import org.springframework.samples.petclinic.school.SchoolRepository;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;

import java.util.Optional;

@Controller
public class AuthController {

    private final UserService userService;
    private final SchoolRepository schoolRepository;

    public AuthController(UserService userService, SchoolRepository schoolRepository) {
        this.userService = userService;
        this.schoolRepository = schoolRepository;
    }

    @GetMapping("/register")
    public String initRegisterForm(Model model) {
        model.addAttribute("user", new User());
        return "auth/registerForm";
    }

    @PostMapping("/register")
    public String processRegisterForm(@Valid User user, BindingResult result) {
        if (result.hasErrors()) {
            return "auth/registerForm";
        }

        // 1. Save the User (UserService handles password hashing)
        try {
            userService.registerNewUser(user);
        } catch (RuntimeException ex) {
            // Handle duplicate email or other service errors
            result.rejectValue("email", "duplicate", "This email is already registered");
            return "auth/registerForm";
        }

        // 2. Parse Domain and Redirect
        String email = user.getEmail();
        String domain = email.substring(email.indexOf("@") + 1);

        Optional<School> school = schoolRepository.findByDomain(domain);

        if (school.isPresent()) {
            return "redirect:/schools/" + school.get().getId();
        } else {
            // Fallback if no school matches the email domain
            return "redirect:/";
        }
    }
    
    @GetMapping("/login")
    public String initLoginForm() {
        return "auth/loginForm";
    }
}

package org.springframework.samples.petclinic.school;

import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.data.repository.Repository;
import org.springframework.transaction.annotation.Transactional;
import java.util.Collection;
import java.util.Optional;

public interface SchoolRepository extends Repository<School, Integer> {
	/**
	 * Get a School by its domain.
	 */
	@Transactional(readOnly = true)
	Optional<School> findByDomain(String domain);
	
	/**
	 * Retrieve all Schools from the data store.
	 */
	@Transactional(readOnly = true)
	Collection<School> findAll();

	/**
	 * Retrieve Schools by page (for pagination in the UI)
	 */
	@Transactional(readOnly = true)
	Page<School> findAll(Pageable pageable);

	/**
	 * Save a School to the data store, either inserting or updating it.
	 */
	void save(School school);

	/**
	 * Retrieve a School by its id.
	 */
	@Transactional(readOnly = true)
	School findById(Integer id);
}

<html xmlns:th="https://www.thymeleaf.org"
      th:replace="~{fragments/layout :: layout (~{::body},'register')}">

<body>

<h2 th:text="#{title.register.new}">Register New Student</h2>

<form th:object="${user}" class="form-horizontal" method="post">

    <input th:replace="~{fragments/inputField :: input ('firstName', 'First Name', 'text')}" />
    <input th:replace="~{fragments/inputField :: input ('lastName', 'Last Name', 'text')}" />
    <input th:replace="~{fragments/inputField :: input ('email', 'Email', 'text')}" />
    <input th:replace="~{fragments/inputField :: input ('password', 'Password', 'password')}" />

    <div class="form-group">
        <div class="col-sm-offset-2 col-sm-10">
            <button class="btn btn-primary" type="submit" th:text="#{button.register}">Register</button>
        </div>
    </div>
    
    <div class="form-group">
        <div class="col-sm-offset-2 col-sm-10">
            <p>
                <span th:text="#{text.auth.existing}">Already have an account?</span> 
                <a th:href="@{/login}" th:text="#{link.auth.login}">Login here</a>
            </p>
        </div>
    </div>

</form>

</body>
</html>

# Auth / Registration
title.register.new=Register New Student
button.register=Register
text.auth.existing=Already have an account?
link.auth.login=Login here

<ul class="navbar-nav ms-auto">

  <li class="nav-item" sec:authorize="!isAuthenticated()">
    <a class="nav-link" th:href="@{/register}"
       th:classappend="${menu == 'register' ? 'active' : ''}">
      <span class="fa fa-user-plus"></span> Register
    </a>
  </li>

  <li class="nav-item" sec:authorize="!isAuthenticated()">
    <a class="nav-link" th:href="@{/login}"
       th:classappend="${menu == 'login' ? 'active' : ''}">
      <span class="fa fa-sign-in"></span> Login
    </a>
  </li>

  <li class="nav-item" sec:authorize="isAuthenticated()">
    <a class="nav-link" th:href="@{/users/profile}"
       th:classappend="${menu == 'profile' ? 'active' : ''}">
      <span class="fa fa-user"></span> Edit Profile
    </a>
  </li>

  <li class="nav-item" sec:authorize="isAuthenticated()">
    <form th:action="@{/logout}" method="post" class="d-flex" style="height: 100%; margin: 0;">
      <button type="submit" class="nav-link btn btn-link"
              style="border: none; background: transparent; cursor: pointer; display: flex; align-items: center;">
        <span class="fa fa-sign-out" style="margin-right: 5px;"></span> Logout
      </button>
    </form>
  </li>

</ul>

<style>
  .navbar-nav button.nav-link {
    border: none;
    border-radius: 0;
    cursor: pointer;
    padding: 28px 8px;
    display: flex;
    align-items: center;
    text-transform: uppercase;
    font-size: 14px;
    font-family: 'montserratregular', sans-serif;
  }
  @media (max-width: 991.98px) {
    .navbar-nav form {
      width: 100%;
    }
    .navbar-nav button.nav-link {
      padding: 28px 20px;
      width: 100%;
      justify-content: flex-start; /* Moves icon/text to the left */
      text-align: left; /* Fallback for older browsers */
    }
  }
</style>

<script src="https://code.jquery.com/jquery-3.7.1.min.js" integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=" crossorigin="anonymous"></script>
<script>
  $(document).ready(function(){
    $('.navbar-nav button.nav-link').hover(
      function() {
        // Code to execute on mouse enter (function_in)
        $(this).css("background-color", "#6db33f");
      },
      function() {
        // Code to execute on mouse leave (function_out)
        $(this).css("background-color", "rgba(0, 0, 0, 0)");
      }
    );
  });
</script>

package org.springframework.samples.petclinic.user;

import jakarta.persistence.*;
import jakarta.validation.constraints.*;
import lombok.*;

import java.util.Set;

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
	@Id
	@GeneratedValue(strategy = GenerationType.IDENTITY)
	private Integer id;

	@Column(name="first_name", nullable = true, length = 50)
	private String firstName;

	@Column(name="last_name", nullable = true, length = 50)
	private String lastName;

	@Column(nullable = false, unique = true, length = 100)
	@NotEmpty(message = "Email is required") // Stops empty strings
	@Email(message = "Please enter a valid email") // Enforces email format
	private String email;

	@Column(name="password_hash", nullable = false, length = 255)
	@NotEmpty(message = "Password is required")
	@Size(min = 8, message = "Password must be at least 8 characters")
	@Pattern(regexp = "^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z]).{8,}$", message = "Password must contain uppercase, lowercase, and number")
	private String password;

	@ManyToMany(fetch = FetchType.EAGER)
	@JoinTable(
		name = "user_roles",
		joinColumns = @JoinColumn(name = "user_id"),
		inverseJoinColumns = @JoinColumn(name = "role_id")
	)
	@EqualsAndHashCode.Exclude
	private Set<Role> roles;
}

package org.springframework.samples.petclinic.user;

import jakarta.validation.Valid;
import org.springframework.samples.petclinic.school.School;
import org.springframework.samples.petclinic.school.SchoolRepository;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;

import java.util.Optional;

@Controller
public class AuthController {

	private final UserService userService;
	private final SchoolRepository schoolRepository;

	public AuthController(UserService userService, SchoolRepository schoolRepository) {
		this.userService = userService;
		this.schoolRepository = schoolRepository;
	}

	@GetMapping("/register")
	public String initRegisterForm(Model model) {
		model.addAttribute("user", new User());
		return "auth/registerForm";
	}

	@PostMapping("/register")
	public String processRegisterForm(@Valid User user, BindingResult result) {
		if (result.hasErrors()) {
			return "auth/registerForm";
		}

		// 1. Save the User (UserService handles password hashing)
		try {
			userService.registerNewUser(user);
		} catch (RuntimeException ex) {
			// Handle duplicate email or other service errors
			result.rejectValue("email", "duplicate", "This email is already registered");
			return "auth/registerForm";
		}

		// 2. Parse Domain and Redirect
		String email = user.getEmail();
		Optional<School> school = findSchoolByRecursiveDomain(email);

		if (school.isPresent()) {
			return "redirect:/schools/" + school.get().getId();
		} else {
			// Fallback if no school matches the email domain
			return "redirect:/";
		}
	}

	@GetMapping("/login")
	public String initLoginForm() {
		return "auth/loginForm";
	}

	private Optional<School> findSchoolByRecursiveDomain(String email) {
		// 1. Extract the initial domain (e.g., "student.kirkwood.edu")
		String domain = email.substring(email.indexOf("@") + 1);

		// 2. Loop while the domain is valid (has at least one dot)
		while (domain.contains(".")) {
			// 3. Check Database
			Optional<School> school = schoolRepository.findByDomain(domain);
			if (school.isPresent()) {
				return school; // Found match (e.g., "kirkwood.edu")
			}

			// 4. Strip the first part (e.g., "student.kirkwood.edu" -> "kirkwood.edu")
			int dotIndex = domain.indexOf(".");
			domain = domain.substring(dotIndex + 1);
		}

		return Optional.empty();
	}
}

package org.springframework.samples.petclinic.user;

import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.condition.DisabledInNativeImage;
import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
import org.springframework.samples.petclinic.school.School;
import org.springframework.samples.petclinic.school.SchoolRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.test.context.aot.DisabledInAotMode;
import org.springframework.test.context.bean.override.mockito.MockitoBean;
import org.springframework.test.web.servlet.MockMvc;

import java.util.Optional;

import static org.mockito.ArgumentMatchers.any;
import static org.mockito.BDDMockito.given;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

@WebMvcTest(AuthController.class)
@DisabledInNativeImage
@DisabledInAotMode
class AuthControllerTest {

	@Autowired
	private MockMvc mockMvc;

	@MockitoBean
	private SchoolRepository schoolRepository;

	@MockitoBean
	private UserService userService;

	@MockitoBean
	private AuthenticationManager authenticationManager;

	@Test
	void testProcessRegister_WithSubdomainRedirect() throws Exception {
		// Mock: School exists for "kirkwood.edu"
		School kirkwood = new School();
		kirkwood.setId(1);
		kirkwood.setName("Kirkwood");
		kirkwood.setDomain("kirkwood.edu");

		// Repository only knows "kirkwood.edu"
		given(schoolRepository.findByDomain("kirkwood.edu")).willReturn(Optional.of(kirkwood));
		// Repository does NOT know "student.kirkwood.edu"
		given(schoolRepository.findByDomain("student.kirkwood.edu")).willReturn(Optional.empty());

		given(userService.registerNewUser(any(User.class))).willReturn(new User());

		// MOCK THE LOGIN-When the controller asks to authenticate, return a dummy "Success" token
		given(authenticationManager.authenticate(any(UsernamePasswordAuthenticationToken.class)))
			.willReturn(new TestingAuthenticationToken("user", "password", "ROLE_STUDENT"));

		// User registers with SUBDOMAIN
		mockMvc.perform(post("/register")
				.with(csrf())
				.param("email", "alex@student.kirkwood.edu") // <--- Subdomain input
				.param("password", "StrongPass1!"))
			.andExpect(status().is3xxRedirection())
			.andExpect(redirectedUrl("/schools/1")); // Should still find ID 1
	}
}

import org.springframework.web.servlet.mvc.support.RedirectAttributes;


@Controller
public class AuthController {

	@PostMapping("/register")
	public String processRegisterForm(@Valid User user, 
                                      BindingResult result, 
                                      RedirectAttributes redirectAttributes) { // <--- Inject RedirectAttributes
		// code omitted

		if (school.isPresent()) {
			// 1. Set the Success Message
			redirectAttributes.addFlashAttribute("messageSuccess",
				"Your user account is created. You have been redirected to " + school.get().getName() + "'s school page.");
			return "redirect:/schools/" + school.get().getId();
		} else {
			// 1b. Set a Generic Message (Warn them since they didn't match a school)
			redirectAttributes.addFlashAttribute("messageWarning",
				"Your user account is created, but we could not find a school matching your email domain.");
			// Fallback if no school matches the email domain
			return "redirect:/";
		}
	}
    
 }

</nav>
<div class="container-fluid">
  <div class="container xd-container">
    <div th:if="${messageSuccess}"
         class="alert alert-success alert-dismissible fade show flash-message"
         role="alert">
      <i class="fa fa-check-circle"></i>
      <span th:text="${messageSuccess}">Success</span>
      <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
    </div>

    <div th:if="${messageWarning}"
         class="alert alert-warning alert-dismissible fade show flash-message"
         role="alert">
      <i class="fa fa-exclamation-circle"></i>
      <span th:text="${messageWarning}">Warning</span>
      <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
    </div>

    <div th:if="${messageDanger}"
         class="alert alert-danger alert-dismissible fade show flash-message"
         role="alert">
      <i class="fa fa-times-circle"></i>
      <span th:text="${messageDanger}">Error</span>
      <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
    </div>
    <th:block th:insert="${template}" />

<script>
  $(document).ready(function(){
    $('.navbar-nav button.nav-link').hover(
      function() {
        // Code to execute on mouse enter (function_in)
        $(this).css("background-color", "#6db33f");
      },
      function() {
        // Code to execute on mouse leave (function_out)
        $(this).css("background-color", "rgba(0, 0, 0, 0)");
      }
    );

    const $flash = $('.flash-message');
    if ($flash.length) {
      setTimeout(function() {
        // slideUp creates a smooth "disappearing" animation
        $flash.slideUp(500, function() {
          // Once animation is done, remove from DOM
          $(this).remove();
        });
      }, 10000);
    }
  });
</script>

// Add these imports
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.ServletException;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;

@Controller
public class AuthController {

    private final UserService userService;
    private final SchoolRepository schoolRepository;
    private final AuthenticationManager authenticationManager; // Add this field

    // Add to Constructor
    public AuthController(UserService userService, SchoolRepository schoolRepository, AuthenticationManager authenticationManager) {
        this.userService = userService;
        this.schoolRepository = schoolRepository;
        this.authenticationManager = authenticationManager;
    }

	@PostMapping("/register")
	public String processRegisterForm(@Valid User user, 
									  BindingResult result, 
									  RedirectAttributes redirectAttributes) {
		if (result.hasErrors()) {
			return "auth/registerForm";
		}

		String rawPassword = user.getPassword();

		// 1. Save the User (UserService handles password hashing)
		try {
			userService.registerNewUser(user);
		} catch (RuntimeException ex) {
			// Handle duplicate email or other service errors
			result.rejectValue("email", "duplicate", "This email is already registered");
			return "auth/registerForm";
		}

		// 2. LOGIN using the authenticationManager.
		try {
			UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(user.getEmail(), rawPassword);
			Authentication authentication = authenticationManager.authenticate(authToken);
			SecurityContextHolder.getContext().setAuthentication(authentication);
		} catch (Exception e) {
			redirectAttributes.addFlashAttribute("messageDanger", "Account created, but auto-login failed.");
			return "redirect:/login";
		}

		// 3. REDIRECT
		Optional<School> school = findSchoolByRecursiveDomain(user.getEmail());
        
        // existing code omitted
	}
    
 }

.authorizeHttpRequests(authorize -> authorize
    .requestMatchers(HttpMethod.GET).permitAll()
    .requestMatchers("/register", "/login").permitAll()
    
    // TEMPORARY: Allow anonymous users to POST to these forms
    .requestMatchers(HttpMethod.POST, "/schools/new", "/owners/new").permitAll()
    
    .anyRequest().authenticated()
)

name: Build and Push Docker Image

on:
  push:
    branches: [ "main" ]

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    steps:
    # 1. Download your code
    - name: Checkout code
      uses: actions/checkout@v4

    # 2. Set up Java 17 (Same as your local environment)
    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin' # or 'microsoft' if you prefer

    # 3. Build the JAR file with Gradle
    # We skip tests here to speed it up, but you can remove '-x test' to be safer
    - name: Build with Gradle
      run: ./gradlew clean bootJar -x test -x jar

    # 4. Set up Docker Buildx (required for modern Docker builds)
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    # 5. Log in to Docker Hub
    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    # 6. Build and Push the Docker image
    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ secrets.DOCKERHUB_USERNAME }}/petclinic:latest

DROP TABLE IF EXISTS leagues;
CREATE TABLE leagues (
    id INT AUTO_INCREMENT PRIMARY KEY,
    school_id INT NOT NULL,
    location_id INT, -- Default location
    user_id INT, -- League Manager/Contact
    name VARCHAR(255) NOT NULL,
    description TEXT,
    registration_start DATETIME,
    registration_end DATETIME,
    league_start DATETIME,
    league_end DATETIME,
    is_public TINYINT DEFAULT 1,
    type ENUM('male', 'female', 'coed') NOT NULL,
    capacity INT,
    capacity_type ENUM('team', 'individual') NOT NULL,
    fee DECIMAL(6,2),
    status_id ENUM('draft', 'active', 'inactive', 'postponed', 'cancelled', 'past') DEFAULT 'draft',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_leagues_school FOREIGN KEY (school_id) REFERENCES schools(id) ON DELETE CASCADE,
    CONSTRAINT fk_leagues_location FOREIGN KEY (location_id) REFERENCES locations(id) ON DELETE SET NULL,
    CONSTRAINT fk_leagues_manager FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL,

    -- Performance: Quickly find active leagues for a specific school
    INDEX idx_leagues_school_status (school_id, status_id)
);

DROP TABLE IF EXISTS teams;
CREATE TABLE teams (
    id INT AUTO_INCREMENT PRIMARY KEY,
    league_id INT NOT NULL,
    captain_user_id INT NOT NULL,
    name VARCHAR(255) NOT NULL,
    logo_url VARCHAR(255),
    status_id ENUM('active', 'inactive', 'suspended') DEFAULT 'active',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_teams_league FOREIGN KEY (league_id) REFERENCES leagues(id) ON DELETE CASCADE,
    CONSTRAINT fk_teams_captain FOREIGN KEY (captain_user_id) REFERENCES users(id) ON DELETE CASCADE,

    -- Performance: List all teams in a league
    INDEX idx_teams_league (league_id)
);

DROP TABLE IF EXISTS team_users;
CREATE TABLE team_users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    team_id INT NOT NULL,
    user_id INT NOT NULL,
    role ENUM('member', 'captain') DEFAULT 'member',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_team_users_team FOREIGN KEY (team_id) REFERENCES teams(id) ON DELETE CASCADE,
    CONSTRAINT fk_team_users_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

    -- Integrity: A user cannot join the same team twice
    UNIQUE INDEX idx_team_users_unique (team_id, user_id)
);

DROP TABLE IF EXISTS events;
CREATE TABLE events (
    id INT AUTO_INCREMENT PRIMARY KEY,
    league_id INT NOT NULL,
    location_id INT,
    user_id INT, -- Event organizer/referee
    name VARCHAR(255) NOT NULL,
    description TEXT,
    event_start DATETIME,
    event_end DATETIME,
    status_id ENUM('draft', 'active', 'ongoing', 'postponed', 'cancelled', 'final') DEFAULT 'draft',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_events_league FOREIGN KEY (league_id) REFERENCES leagues(id) ON DELETE CASCADE,
    CONSTRAINT fk_events_location FOREIGN KEY (location_id) REFERENCES locations(id) ON DELETE SET NULL,
    CONSTRAINT fk_events_contact FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL,

    -- Integrity & Performance: Check for double-bookings at a location
    INDEX idx_events_location_time (location_id, event_start)
);

DROP TABLE IF EXISTS matches;
CREATE TABLE matches (
    id INT AUTO_INCREMENT PRIMARY KEY,
    event_id INT NOT NULL,
    home_team_id INT,
    away_team_id INT,
    winner_team_id INT,
    home_score INT DEFAULT 0,
    away_score INT DEFAULT 0,
    status ENUM('scheduled', 'in_progress', 'final', 'forfeit') DEFAULT 'scheduled',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_matches_event FOREIGN KEY (event_id) REFERENCES events(id) ON DELETE CASCADE,
    CONSTRAINT fk_matches_home FOREIGN KEY (home_team_id) REFERENCES teams(id) ON DELETE SET NULL,
    CONSTRAINT fk_matches_away FOREIGN KEY (away_team_id) REFERENCES teams(id) ON DELETE SET NULL,
    CONSTRAINT fk_matches_winner FOREIGN KEY (winner_team_id) REFERENCES teams(id) ON DELETE SET NULL,

    -- Performance: Essential for calculating standings (W/L records)
    INDEX idx_matches_home (home_team_id),
    INDEX idx_matches_away (away_team_id)
);

DROP TABLE IF EXISTS messages;
CREATE TABLE messages (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id_from INT NOT NULL,
    user_id_to INT,
    league_id INT,
    event_id INT,
    parent_message_id INT, -- For threaded replies
    message VARCHAR(255) NOT NULL,
    is_flagged TINYINT DEFAULT 0,
    status_id ENUM('draft', 'active', 'hidden') DEFAULT 'active',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

    CONSTRAINT fk_messages_from FOREIGN KEY (user_id_from) REFERENCES users(id) ON DELETE CASCADE,
    CONSTRAINT fk_messages_to FOREIGN KEY (user_id_to) REFERENCES users(id) ON DELETE SET NULL,
    CONSTRAINT fk_messages_league FOREIGN KEY (league_id) REFERENCES leagues(id) ON DELETE CASCADE,
    CONSTRAINT fk_messages_event FOREIGN KEY (event_id) REFERENCES events(id) ON DELETE CASCADE,
    CONSTRAINT fk_messages_parent FOREIGN KEY (parent_message_id) REFERENCES messages(id) ON DELETE CASCADE,

    -- Performance: Quickly load chat history for a league or event
    INDEX idx_messages_context (league_id, event_id)
);

DROP TABLE IF EXISTS message_reactions;
CREATE TABLE message_reactions (
    id INT AUTO_INCREMENT PRIMARY KEY,
    message_id INT NOT NULL,
    user_id INT NOT NULL,
    reaction ENUM('like', 'dislike', 'love', 'hug', 'sad', 'angry'),
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    
    CONSTRAINT fk_reactions_message FOREIGN KEY (message_id) REFERENCES messages(id) ON DELETE CASCADE,
    CONSTRAINT fk_reactions_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,

    -- Integrity: One reaction per user per message
    UNIQUE INDEX idx_reactions_unique (message_id, user_id)
);

// This method is for Thymeleaf (Returns a View)
@GetMapping("/vets.html")
public String showVetList(...) { ... }

// This method is for External Clients/JS Frameworks (Returns JSON/XML)
@GetMapping({ "/vets" })
public @ResponseBody Vets showResourcesVetList() {
    Vets vets = new Vets();
    vets.getVetList().addAll(this.vetRepository.findAll());
    return vets;
}