basic login implementation at localhost:3000//login

apps/workspace-api/data/voyage-db.lock.db

@@ -0,0 +1,6 @@
+#FileLock
+#Tue Jan 27 18:25:29 CET 2026
+hostName=macbook-air-von-melika.fritz.box
+id=19c007d24ac0d06a483d34679bbb29160d6d33ed895
+method=file
+server=192.168.178.68\:58736

apps/workspace-api/src/main/java/com/voyage/workspace/config/SecurityConfig.java

@@ -2,10 +2,12 @@ package com.voyage.workspace.config;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 
 @Configuration
 public class SecurityConfig {
@@ -14,7 +16,7 @@ public class SecurityConfig {
     SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
 
         http.authorizeHttpRequests(auth -> auth
-                .requestMatchers("/health", "/error").permitAll()
+                .requestMatchers("/health", "/error", "/login", "/login-redirect").permitAll()
                 .requestMatchers("/h2-console/**").permitAll()
 
                 // Admin-only user management
@@ -27,8 +29,25 @@ public class SecurityConfig {
                 .anyRequest().authenticated()
         );
 
+        // IMPORTANT: For API calls, return 401 instead of redirecting to /login (HTML)
+        http.exceptionHandling(ex -> ex
+                .defaultAuthenticationEntryPointFor(
+                        new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED),
+                        request -> request.getRequestURI() != null && request.getRequestURI().startsWith("/api/")
+                )
+        );
+
         http.formLogin(form -> form
-                .defaultSuccessUrl("http://localhost:3000/", true)
+                .successHandler((request, response, authentication) -> {
+                    String target = request.getParameter("redirect");
+                    if (target == null) {
+                        Object saved = request.getSession().getAttribute("LOGIN_REDIRECT");
+                        if (saved != null) target = saved.toString();
+                    }
+
+                    boolean allowed = target != null && target.startsWith("http://localhost:3000/");
+                    response.sendRedirect(allowed ? target : "http://localhost:3000/admin");
+                })
         );
 
         http.logout(logout -> logout

apps/workspace-api/src/main/java/com/voyage/workspace/controller/HealthController.java

@@ -1,4 +1,4 @@
-package com.voyage.workspace;
+package com.voyage.workspace.controller;
 
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;

apps/workspace-api/src/main/java/com/voyage/workspace/controller/LoginRedirectController.java

@@ -0,0 +1,16 @@
+package com.voyage.workspace.controller;
+
+import jakarta.servlet.http.HttpSession;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+@Controller
+public class LoginRedirectController {
+
+    @GetMapping("/login-redirect")
+    public String loginRedirect(@RequestParam("redirect") String redirect, HttpSession session) {
+        session.setAttribute("LOGIN_REDIRECT", redirect);
+        return "redirect:/login";
+    }
+}

apps/workspace-api/src/main/java/com/voyage/workspace/controller/MeController.java

@@ -0,0 +1,19 @@
+package com.voyage.workspace.controller;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+@RestController
+public class MeController {
+
+    @GetMapping("/api/me")
+    public Map<String, Object> me(Authentication auth) {
+        return Map.of(
+                "name", auth.getName(),
+                "authorities", auth.getAuthorities()
+        );
+    }
+}