chore(ci): Align GH Workflows with Docker SSoT, new paths; minimal SSoT guard; staticAnalysis (#23)

* chore(MP-21): snapshot pre-refactor state (Epic 1) * chore(MP-22): scaffold new repo structure, relocate Docker Compose, move frontend/backend modules, update Makefile; add docs mapping and env template * MP-22 Epic 2: Erfolgreich umgesetzt und verifiziert * MP-23 Epic 3: Gradle/Build Governance zentralisieren * MP-23 Epic 3: Gradle/Build Governance zentralisieren * chore(devops)!: Docker-SSoT (.env) konsolidiert, Compose-Mounts ergänzt, Makefile entfernt - ENV Single Source of Truth - docker/.env.example neu (inkl. REDIS_PASSWORD, Ports, Build-Overrides) - config/.env(.example) als DEPRECATED markiert (Verweis auf docker/.env[.example]) - Docker Compose vereinheitlicht (docker/docker-compose.yaml) - Postgres: zentralen postgresql.conf mounten (../config/postgres/postgresql.conf) und Start mit -c config_file=/etc/postgresql/postgresql.conf - Redis: zentralen redis.conf mounten (../config/redis/redis.conf) und Start via "redis-server … ${REDIS_PASSWORD:+--requirepass $REDIS_PASSWORD}" - Web-Nginx: ../config/nginx/nginx.prod.conf → /etc/nginx/nginx.conf (ro) - Monitoring: Prometheus/Grafana nutzen ../config/monitoring/* als SSoT - Frontend/DI/Network (MP-23 Grundlage) - :frontend:core:network Modul mit Koin `apiClient` (Ktor + JSON/Retry/Timeout/Logging) - Plattform-Basis-URL-Auflösung (JVM: ENV API_BASE_URL; JS: globalThis.API_BASE_URL / Same-Origin) - Web index.html setzt API_BASE_URL (Query `?apiBaseUrl=…` > Same-Origin > Fallback) - Build/Gradle & Module-Refs - settings.gradle.kts: neue Frontend-/Backend-Pfade bereits inkludiert - Features/Shell: Abhängigkeiten auf :frontend:shared / :frontend:core:* angepasst - Ping-API-Refs auf :backend:services:ping:ping-api vereinheitlicht - Dockerfiles angepasst - backend/infrastructure/gateway/Dockerfile → Tasks/Pfade auf :backend:gateway - backend/services/ping/Dockerfile → Tasks/Pfade auf :backend:services:ping:ping-service - Static Analysis / Guards - config/detekt/detekt.yml hinzugefügt - Leichter Arch-Guard (Frontend) gegen manuelle Authorization-Header vorbereitet - Doku - docs/ARCHITECTURE.md (Struktur, Mapping, Next Steps) ergänzt - docs/adr/README.md angelegt BREAKING CHANGES: - Makefile komplett entfernt (bitte direkt `docker compose` verwenden) - ENV-Quelle ist jetzt docker/.env (statt config/.env oder Root) - Compose-Datei unter docker/docker-compose.yaml (nicht mehr compose.yaml im Repo-Root) Verifikation (lokal): - ENV anlegen: `cp docker/.env.example docker/.env` (Werte anpassen) - Compose prüfen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml config` - Infrastruktur: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle up -d postgres redis keycloak web-app` - Services bauen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle build api-gateway ping-service --no-cache --progress=plain` Refs: MP-22 (Epic 2), MP-23 (Epic 3) * chore(devops)!: Docker-SSoT (.env) konsolidiert, Compose-Mounts ergänzt, Makefile entfernt - ENV Single Source of Truth - docker/.env.example neu (inkl. REDIS_PASSWORD, Ports, Build-Overrides) - config/.env(.example) als DEPRECATED markiert (Verweis auf docker/.env[.example]) - Docker Compose vereinheitlicht (docker/docker-compose.yaml) - Postgres: zentralen postgresql.conf mounten (../config/postgres/postgresql.conf) und Start mit -c config_file=/etc/postgresql/postgresql.conf - Redis: zentralen redis.conf mounten (../config/redis/redis.conf) und Start via "redis-server … ${REDIS_PASSWORD:+--requirepass $REDIS_PASSWORD}" - Web-Nginx: ../config/nginx/nginx.prod.conf → /etc/nginx/nginx.conf (ro) - Monitoring: Prometheus/Grafana nutzen ../config/monitoring/* als SSoT - Frontend/DI/Network (MP-23 Grundlage) - :frontend:core:network Modul mit Koin `apiClient` (Ktor + JSON/Retry/Timeout/Logging) - Plattform-Basis-URL-Auflösung (JVM: ENV API_BASE_URL; JS: globalThis.API_BASE_URL / Same-Origin) - Web index.html setzt API_BASE_URL (Query `?apiBaseUrl=…` > Same-Origin > Fallback) - Build/Gradle & Module-Refs - settings.gradle.kts: neue Frontend-/Backend-Pfade bereits inkludiert - Features/Shell: Abhängigkeiten auf :frontend:shared / :frontend:core:* angepasst - Ping-API-Refs auf :backend:services:ping:ping-api vereinheitlicht - Dockerfiles angepasst - backend/infrastructure/gateway/Dockerfile → Tasks/Pfade auf :backend:gateway - backend/services/ping/Dockerfile → Tasks/Pfade auf :backend:services:ping:ping-service - Static Analysis / Guards - config/detekt/detekt.yml hinzugefügt - Leichter Arch-Guard (Frontend) gegen manuelle Authorization-Header vorbereitet - Doku - docs/ARCHITECTURE.md (Struktur, Mapping, Next Steps) ergänzt - docs/adr/README.md angelegt BREAKING CHANGES: - Makefile komplett entfernt (bitte direkt `docker compose` verwenden) - ENV-Quelle ist jetzt docker/.env (statt config/.env oder Root) - Compose-Datei unter docker/docker-compose.yaml (nicht mehr compose.yaml im Repo-Root) Verifikation (lokal): - ENV anlegen: `cp docker/.env.example docker/.env` (Werte anpassen) - Compose prüfen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml config` - Infrastruktur: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle up -d postgres redis keycloak web-app` - Services bauen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle build api-gateway ping-service --no-cache --progress=plain` Refs: MP-22 (Epic 2), MP-23 (Epic 3) * chore(devops)!: Docker-SSoT (.env) konsolidiert, Compose-Mounts ergänzt, Makefile entfernt - ENV Single Source of Truth - docker/.env.example neu (inkl. REDIS_PASSWORD, Ports, Build-Overrides) - config/.env(.example) als DEPRECATED markiert (Verweis auf docker/.env[.example]) - Docker Compose vereinheitlicht (docker/docker-compose.yaml) - Postgres: zentralen postgresql.conf mounten (../config/postgres/postgresql.conf) und Start mit -c config_file=/etc/postgresql/postgresql.conf - Redis: zentralen redis.conf mounten (../config/redis/redis.conf) und Start via "redis-server … ${REDIS_PASSWORD:+--requirepass $REDIS_PASSWORD}" - Web-Nginx: ../config/nginx/nginx.prod.conf → /etc/nginx/nginx.conf (ro) - Monitoring: Prometheus/Grafana nutzen ../config/monitoring/* als SSoT - Frontend/DI/Network (MP-23 Grundlage) - :frontend:core:network Modul mit Koin `apiClient` (Ktor + JSON/Retry/Timeout/Logging) - Plattform-Basis-URL-Auflösung (JVM: ENV API_BASE_URL; JS: globalThis.API_BASE_URL / Same-Origin) - Web index.html setzt API_BASE_URL (Query `?apiBaseUrl=…` > Same-Origin > Fallback) - Build/Gradle & Module-Refs - settings.gradle.kts: neue Frontend-/Backend-Pfade bereits inkludiert - Features/Shell: Abhängigkeiten auf :frontend:shared / :frontend:core:* angepasst - Ping-API-Refs auf :backend:services:ping:ping-api vereinheitlicht - Dockerfiles angepasst - backend/infrastructure/gateway/Dockerfile → Tasks/Pfade auf :backend:gateway - backend/services/ping/Dockerfile → Tasks/Pfade auf :backend:services:ping:ping-service - Static Analysis / Guards - config/detekt/detekt.yml hinzugefügt - Leichter Arch-Guard (Frontend) gegen manuelle Authorization-Header vorbereitet - Doku - docs/ARCHITECTURE.md (Struktur, Mapping, Next Steps) ergänzt - docs/adr/README.md angelegt BREAKING CHANGES: - Makefile komplett entfernt (bitte direkt `docker compose` verwenden) - ENV-Quelle ist jetzt docker/.env (statt config/.env oder Root) - Compose-Datei unter docker/docker-compose.yaml (nicht mehr compose.yaml im Repo-Root) Verifikation (lokal): - ENV anlegen: `cp docker/.env.example docker/.env` (Werte anpassen) - Compose prüfen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml config` - Infrastruktur: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle up -d postgres redis keycloak web-app` - Services bauen: `docker compose --env-file docker/.env -f docker/docker-compose.yaml -p meldestelle build api-gateway ping-service --no-cache --progress=plain` Refs: MP-22 (Epic 2), MP-23 (Epic 3) * chore(ci): Workflows an Docker-SSoT & neue Struktur angepasst, minimaler SSoT-Guard - ssot-guard.yml: Option B (minimal) → `docker compose -f docker/docker-compose.yaml config` als Lint - integration-tests.yml: `./gradlew staticAnalysis` vor Integrationstests - docs-kdoc-sync.yml: Dokka-Task Fallback (dokkaGfmAll || dokkaGfm), YouTrack-Sync nur wenn Script vorhanden - deploy-proxmox.yml: Compose-Pfade auf docker/docker-compose.yaml + `--env-file docker/.env`; Build/Test Schritte vereinheitlicht - ci-main.yml: SSoT-Skripte per `if: hashFiles(...)` guarded, Compose-Lint Fallback; OpenAPI‑Pfad → backend/gateway; ADR‑Pfade → docs/adr/**; `staticAnalysis` in Build integriert - youtrack-sync.yml: unverändert (funktional) Refs: MP-22, MP-23 * chore(ci): Workflows an Docker-SSoT & neue Struktur angepasst, minimaler SSoT-Guard - ssot-guard.yml: Option B (minimal) → `docker compose -f docker/docker-compose.yaml config` als Lint - integration-tests.yml: `./gradlew staticAnalysis` vor Integrationstests - docs-kdoc-sync.yml: Dokka-Task Fallback (dokkaGfmAll || dokkaGfm), YouTrack-Sync nur wenn Script vorhanden - deploy-proxmox.yml: Compose-Pfade auf docker/docker-compose.yaml + `--env-file docker/.env`; Build/Test Schritte vereinheitlicht - ci-main.yml: SSoT-Skripte per `if: hashFiles(...)` guarded, Compose-Lint Fallback; OpenAPI‑Pfad → backend/gateway; ADR‑Pfade → docs/adr/**; `staticAnalysis` in Build integriert - youtrack-sync.yml: unverändert (funktional) Refs: MP-22, MP-23 * fix(ci): create .env from example before validating compose config * fix(ci): update ssot-guard filename (.yaml) and sync workflow state * fixing * fix(webpack): correct sql.js fallback configuration for webpack 5
2025-12-03 12:03:40 +01:00
parent 034892e890
commit 95fe3e0573
365 changed files with 2283 additions and 15142 deletions
@@ -0,0 +1,242 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.Test
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.context.annotation.Import
+import org.springframework.http.HttpStatus
+import org.springframework.test.context.ActiveProfiles
+import org.springframework.test.web.reactive.server.WebTestClient
+
+/**
+ * Tests für den Fallback Controller, der Circuit Breaker Szenarien behandelt.
+ * Testet alle Fallback-Endpunkte für verschiedene Services.
+ */
+@SpringBootTest(
+    classes = [GatewayApplication::class],
+    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = [
+        // Externe Abhängigkeiten für Fallback-Tests deaktivieren
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        // Circuit Breaker Health Indicator deaktivieren um Interferenzen zu vermeiden
+        "resilience4j.circuitbreaker.configs.default.registerHealthIndicator=false",
+        "management.health.circuitbreakers.enabled=false",
+        // Custom Filter für reine Fallback-Tests deaktivieren
+        "gateway.security.jwt.enabled=false",
+        // Reaktiven Web-Anwendungstyp verwenden
+        "spring.main.web-application-type=reactive",
+        // Gateway Discovery deaktivieren
+        "spring.cloud.gateway.server.webflux.discovery.locator.enabled=false",
+        // Actuator Security deaktivieren
+        "management.security.enabled=false",
+        // Zufälligen Port setzen
+        "server.port=0"
+    ]
+)
+@ActiveProfiles("test")
+@Import(TestSecurityConfig::class)
+class FallbackControllerTests {
+
+    @Autowired
+    lateinit var webTestClient: WebTestClient
+
+    @Test
+    fun `sollte Members Service Fallback Response zurueckgeben`() {
+        webTestClient.get()
+            .uri("/fallback/members")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectHeader().valueEquals("Content-Type", "application/json")
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Member operations are temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("members-service")
+            .jsonPath("$.status").isEqualTo(503)
+            .jsonPath("$.suggestion")
+            .isEqualTo("Please try again in a few moments. If the problem persists, contact support.")
+            .jsonPath("$.timestamp").exists()
+    }
+
+    @Test
+    fun `sollte Horses Service Fallback Response zurueckgeben`() {
+        webTestClient.get()
+            .uri("/fallback/horses")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectHeader().valueEquals("Content-Type", "application/json")
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Horse registry operations are temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("horses-service")
+            .jsonPath("$.status").isEqualTo(503)
+            .jsonPath("$.suggestion").exists()
+    }
+
+    @Test
+    fun `sollte Events Service Fallback Response zurueckgeben`() {
+        webTestClient.get()
+            .uri("/fallback/events")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Event management operations are temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("events-service")
+            .jsonPath("$.status").isEqualTo(503)
+    }
+
+    @Test
+    fun `should return masterdata service fallback response`() {
+        webTestClient.get()
+            .uri("/fallback/masterdata")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Master data operations are temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("masterdata-service")
+            .jsonPath("$.status").isEqualTo(503)
+    }
+
+    @Test
+    fun `should return auth service fallback response`() {
+        webTestClient.get()
+            .uri("/fallback/auth")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Authentication operations are temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("auth-service")
+            .jsonPath("$.status").isEqualTo(503)
+    }
+
+    @Test
+    fun `should return default fallback response for unknown service`() {
+        webTestClient.get()
+            .uri("/fallback")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.message").isEqualTo("Service is temporarily unavailable")
+            .jsonPath("$.service").isEqualTo("unknown-service")
+            .jsonPath("$.status").isEqualTo(503)
+    }
+
+    @Test
+    fun `should handle POST requests to members fallback`() {
+        webTestClient.post()
+            .uri("/fallback/members")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("members-service")
+    }
+
+    @Test
+    fun `should handle POST requests to horses fallback`() {
+        webTestClient.post()
+            .uri("/fallback/horses")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("horses-service")
+    }
+
+    @Test
+    fun `should handle POST requests to events fallback`() {
+        webTestClient.post()
+            .uri("/fallback/events")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("events-service")
+    }
+
+    @Test
+    fun `should handle POST requests to masterdata fallback`() {
+        webTestClient.post()
+            .uri("/fallback/masterdata")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("masterdata-service")
+    }
+
+    @Test
+    fun `should handle POST requests to auth fallback`() {
+        webTestClient.post()
+            .uri("/fallback/auth")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("auth-service")
+    }
+
+    @Test
+    fun `should handle POST requests to default fallback`() {
+        webTestClient.post()
+            .uri("/fallback")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .jsonPath("$.error").isEqualTo("SERVICE_UNAVAILABLE")
+            .jsonPath("$.service").isEqualTo("unknown-service")
+    }
+
+    @Test
+    fun `should return valid JSON structure for all fallback responses`() {
+        val fallbackPaths = listOf(
+            "/fallback/members",
+            "/fallback/horses",
+            "/fallback/events",
+            "/fallback/masterdata",
+            "/fallback/auth",
+            "/fallback"
+        )
+
+        fallbackPaths.forEach { path ->
+            webTestClient.get()
+                .uri(path)
+                .exchange()
+                .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+                .expectHeader().valueEquals("Content-Type", "application/json")
+                .expectBody()
+                .jsonPath("$.error").isNotEmpty
+                .jsonPath("$.message").isNotEmpty
+                .jsonPath("$.service").isNotEmpty
+                .jsonPath("$.timestamp").isNotEmpty
+                .jsonPath("$.status").isNumber
+                .jsonPath("$.suggestion").isNotEmpty
+        }
+    }
+
+    @Test
+    fun `should have consistent error response structure`() {
+        webTestClient.get()
+            .uri("/fallback/members")
+            .exchange()
+            .expectStatus().isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
+            .expectBody()
+            .consumeWith { result ->
+                val body = String(result.responseBody ?: byteArrayOf())
+                assert(body.contains("error"))
+                assert(body.contains("message"))
+                assert(body.contains("service"))
+                assert(body.contains("timestamp"))
+                assert(body.contains("status"))
+                assert(body.contains("suggestion"))
+            }
+    }
+}
@@ -0,0 +1,47 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.Test
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.context.annotation.Import
+import org.springframework.test.context.ActiveProfiles
+
+/**
+ * Basis-Test zur Überprüfung, dass der Gateway-Anwendungskontext erfolgreich lädt.
+ * Verwendet Test-Profil um Produktions-Filter und externe Abhängigkeiten zu deaktivieren.
+ */
+@SpringBootTest(
+    classes = [GatewayApplication::class],
+    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = [
+        // Alle externen Abhängigkeiten für Context-Loading-Test deaktivieren
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        // Circuit Breaker für Tests deaktivieren
+        "resilience4j.circuitbreaker.configs.default.registerHealthIndicator=false",
+        "management.health.circuitbreakers.enabled=false",
+        // Custom Security und Filter deaktivieren
+        "gateway.security.jwt.enabled=false",
+        // Reaktiven Web-Anwendungstyp verwenden
+        "spring.main.web-application-type=reactive",
+        // Gateway Discovery deaktivieren
+        "spring.cloud.gateway.server.webflux.discovery.locator.enabled=false",
+        // Actuator Security deaktivieren
+        "management.security.enabled=false",
+        // Zufälligen Port setzen
+        "server.port=0"
+    ]
+)
+@ActiveProfiles("test")
+@Import(TestSecurityConfig::class)
+class GatewayApplicationTests {
+
+    @Test
+    fun contextLoads() {
+        // Dieser Test ist erfolgreich, wenn der Spring-Anwendungskontext erfolgreich lädt
+        // ohne Konfigurationsfehler oder fehlende Bean-Abhängigkeiten
+    }
+}
@@ -0,0 +1,194 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.Test
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.cloud.gateway.route.RouteLocator
+import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Import
+import org.springframework.test.context.ActiveProfiles
+import org.springframework.test.web.reactive.server.WebTestClient
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+/**
+ * Tests for Gateway custom filters: CorrelationId, Enhanced Logging, and Rate Limiting.
+ * Tests filter behavior without disabling them (unlike other test classes).
+ */
+@SpringBootTest(
+    classes = [GatewayApplication::class],
+    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = [
+        // Disable external dependencies
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        // Disable circuit breaker for filter tests
+        "resilience4j.circuitbreaker.configs.default.registerHealthIndicator=false",
+        "management.health.circuitbreakers.enabled=false",
+        // Keep custom filters enabled for testing
+        "gateway.security.jwt.enabled=false", // Disable JWT but keep other filters
+        // Use reactive web application type
+        "spring.main.web-application-type=reactive",
+        // Disable gateway discovery - use explicit routes
+        "spring.cloud.gateway.server.webflux.discovery.locator.enabled=false",
+        // Disable actuator security
+        "management.security.enabled=false",
+        // Set random port
+        "server.port=0"
+    ]
+)
+@ActiveProfiles("dev") // Use dev profile to enable filters
+@AutoConfigureWebTestClient
+@Import(TestSecurityConfig::class, GatewayFiltersTests.TestFilterConfig::class)
+class GatewayFiltersTests {
+
+    @Autowired
+    lateinit var webTestClient: WebTestClient
+
+    @Test
+    fun `should add correlation ID header when not present`() {
+        webTestClient.get()
+            .uri("/test/correlation")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("X-Correlation-ID")
+            .expectBody(String::class.java)
+            .isEqualTo("correlation-test")
+    }
+
+    @Test
+    fun `should preserve existing correlation ID header`() {
+        val existingCorrelationId = "test-correlation-123"
+
+        webTestClient.get()
+            .uri("/test/correlation")
+            .header("X-Correlation-ID", existingCorrelationId)
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().valueEquals("X-Correlation-ID", existingCorrelationId)
+            .expectBody(String::class.java)
+            .isEqualTo("correlation-test")
+    }
+
+    @Test
+    fun `should add rate limiting headers`() {
+        webTestClient.get()
+            .uri("/test/ratelimit")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("X-RateLimit-Enabled")
+            .expectHeader().exists("X-RateLimit-Limit")
+            .expectHeader().exists("X-RateLimit-Remaining")
+            .expectHeader().valueEquals("X-RateLimit-Enabled", "true")
+    }
+
+    @Test
+    fun `should apply different rate limits for auth endpoints`() {
+        // This test validates rate-limit headers only; endpoint body/status may vary based on route mapping
+        webTestClient.get()
+            .uri("/api/auth/test")
+            .exchange()
+            .expectHeader().valueEquals("X-RateLimit-Limit", "20") // AUTH_ENDPOINT_LIMIT
+    }
+
+    @Test
+    fun `should apply higher rate limit for authenticated users`() {
+        webTestClient.get()
+            .uri("/test/ratelimit")
+            .header("Authorization", "Bearer test-token")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().valueEquals("X-RateLimit-Limit", "200") // AUTHENTICATED_LIMIT
+    }
+
+    @Test
+    fun `should apply admin rate limit for admin users`() {
+        webTestClient.get()
+            .uri("/test/ratelimit")
+            .header("Authorization", "Bearer test-token")
+            .header("X-User-Role", "ADMIN")
+            .header("X-User-ID", "admin-test-user") // Required for admin detection security
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().valueEquals("X-RateLimit-Limit", "500") // ADMIN_LIMIT
+    }
+
+    @Test
+    fun `should enforce rate limiting after exceeding limit`() {
+        // This test would need multiple requests to test actual rate limiting
+        // For simplicity, we just verify the headers are present
+        val responses = (1..5).map {
+            webTestClient.get()
+                .uri("/test/ratelimit")
+                .exchange()
+                .expectStatus().isOk
+                .expectHeader().exists("X-RateLimit-Remaining")
+                .returnResult(String::class.java)
+        }
+
+        // Verify that remaining count decreases
+        assert(responses.isNotEmpty())
+    }
+
+    @Test
+    fun `should handle requests with X-Forwarded-For header`() {
+        webTestClient.get()
+            .uri("/test/ratelimit")
+            .header("X-Forwarded-For", "192.168.1.100, 10.0.0.1")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("X-RateLimit-Enabled")
+    }
+
+    /**
+     * Test configuration that provides routes for filter testing.
+     */
+    @Configuration
+    class TestFilterConfig {
+
+        @Bean
+        fun filterTestRoutes(builder: RouteLocatorBuilder): RouteLocator = builder.routes()
+            .route("test-correlation") { r ->
+                r.path("/test/correlation")
+                    .uri("forward:/mock/correlation-test")
+            }
+            .route("test-ratelimit") { r ->
+                r.path("/test/ratelimit")
+                    .uri("forward:/mock/ratelimit-test")
+            }
+            .route("test-auth-endpoint") { r ->
+                r.path("/api/auth/**")
+                    .filters { f -> f.stripPrefix(1) }
+                    .uri("forward:/mock/auth-test")
+            }
+            .build()
+
+        @Bean
+        fun filterTestController(): FilterTestController = FilterTestController()
+    }
+
+    /**
+     * Mock controller for filter testing.
+     */
+    @RestController
+    @RequestMapping("/mock")
+    class FilterTestController {
+
+        @GetMapping("/correlation-test")
+        fun correlationTest(): String = "correlation-test"
+
+        @GetMapping("/ratelimit-test")
+        fun rateLimitTest(): String = "ratelimit-test"
+
+        @GetMapping("/auth-test")
+        fun authEndpointTest(): String = "auth-endpoint-test"
+    }
+}
@@ -0,0 +1,202 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.Test
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.cloud.gateway.route.RouteLocator
+import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Import
+import org.springframework.test.context.ActiveProfiles
+import org.springframework.test.web.reactive.server.WebTestClient
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PostMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+/**
+ * Tests for Gateway routing functionality.
+ * Uses mock backend services to test route forwarding.
+ */
+@SpringBootTest(
+    classes = [GatewayApplication::class],
+    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = [
+        // Disable external dependencies
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        // Disable circuit breaker for routing tests
+        "resilience4j.circuitbreaker.configs.default.registerHealthIndicator=false",
+        "management.health.circuitbreakers.enabled=false",
+        // Disable custom filters for pure routing tests
+        "gateway.security.jwt.enabled=false",
+        // Use reactive web application type
+        "spring.main.web-application-type=reactive",
+        // Disable gateway discovery - use explicit routes
+        "spring.cloud.gateway.server.webflux.discovery.locator.enabled=false",
+        // Disable actuator security
+        "management.security.enabled=false",
+        // Set random port
+        "server.port=0"
+    ]
+)
+@ActiveProfiles("test")
+@AutoConfigureWebTestClient
+@Import(TestSecurityConfig::class, GatewayRoutingTests.TestRoutesConfig::class)
+class GatewayRoutingTests {
+
+    @Autowired
+    lateinit var webTestClient: WebTestClient
+
+    @Test
+    fun `should route members service requests`() {
+        webTestClient.get()
+            .uri("/api/members/test")
+            .exchange()
+            .expectStatus().isOk
+            .expectBody(String::class.java)
+            .isEqualTo("members-service-mock")
+    }
+
+    @Test
+    fun `should route horses service requests`() {
+        webTestClient.get()
+            .uri("/api/horses/test")
+            .exchange()
+            .expectStatus().isOk
+            .expectBody(String::class.java)
+            .isEqualTo("horses-service-mock")
+    }
+
+    @Test
+    fun `should route events service requests`() {
+        webTestClient.get()
+            .uri("/api/events/test")
+            .exchange()
+            .expectStatus().isOk
+            .expectBody(String::class.java)
+            .isEqualTo("events-service-mock")
+    }
+
+    @Test
+    fun `should route masterdata service requests`() {
+        webTestClient.get()
+            .uri("/api/masterdata/test")
+            .exchange()
+            .expectStatus().isOk
+            .expectBody(String::class.java)
+            .isEqualTo("masterdata-service-mock")
+    }
+
+    @Test
+    fun `auth route is not configured anymore`() {
+        webTestClient.post()
+            .uri("/api/auth/login")
+            .exchange()
+            .expectStatus().isNotFound
+    }
+
+    @Test
+    fun `should route ping service requests`() {
+        webTestClient.get()
+            .uri("/api/ping/health")
+            .exchange()
+            .expectStatus().isOk
+            .expectBody(String::class.java)
+            .isEqualTo("ping-service-mock")
+    }
+
+    @Test
+    fun `should handle gateway info path request`() {
+        webTestClient.get()
+            .uri("/gateway-info")
+            .exchange()
+            .expectStatus().isOk
+    }
+
+    /**
+     * Test configuration that provides mock backend services and custom routes.
+     */
+    @Configuration
+    class TestRoutesConfig {
+
+        @Bean
+        fun testRouteLocator(builder: RouteLocatorBuilder): RouteLocator = builder.routes()
+            .route("test-members") { r ->
+                r.path("/api/members/**")
+                    .filters { f -> f.setPath("/mock/members") }
+                    .uri("forward:/")
+            }
+            .route("test-horses") { r ->
+                r.path("/api/horses/**")
+                    .filters { f -> f.setPath("/mock/horses") }
+                    .uri("forward:/")
+            }
+            .route("test-events") { r ->
+                r.path("/api/events/**")
+                    .filters { f -> f.setPath("/mock/events") }
+                    .uri("forward:/")
+            }
+            .route("test-masterdata") { r ->
+                r.path("/api/masterdata/**")
+                    .filters { f -> f.setPath("/mock/masterdata") }
+                    .uri("forward:/")
+            }
+            // no dedicated auth route anymore – clients should talk to Keycloak directly
+            .route("test-ping") { r ->
+                r.path("/api/ping/**")
+                    .filters { f -> f.setPath("/mock/ping") }
+                    .uri("forward:/")
+            }
+            .route("test-root") { r ->
+                r.path("/gateway-info")
+                    .uri("forward:/mock/gateway-info")
+            }
+            .build()
+
+        @Bean
+        fun mockBackendController(): MockBackendController = MockBackendController()
+    }
+
+    /**
+     * Mock backend controller that simulates the responses from actual microservices.
+     */
+    @RestController
+    @RequestMapping("/mock")
+    class MockBackendController {
+
+        @GetMapping(value = ["/members", "/members/**"])
+        @PostMapping(value = ["/members", "/members/**"])
+        fun membersServiceMock(): String = "members-service-mock"
+
+        @GetMapping(value = ["/horses", "/horses/**"])
+        @PostMapping(value = ["/horses", "/horses/**"])
+        fun horsesServiceMock(): String = "horses-service-mock"
+
+        @GetMapping(value = ["/events", "/events/**"])
+        @PostMapping(value = ["/events", "/events/**"])
+        fun eventsServiceMock(): String = "events-service-mock"
+
+        @GetMapping(value = ["/masterdata", "/masterdata/**"])
+        @PostMapping(value = ["/masterdata", "/masterdata/**"])
+        fun masterdataServiceMock(): String = "masterdata-service-mock"
+
+        // removed auth mock endpoints – not needed anymore
+
+        @GetMapping(value = ["/ping", "/ping/**"])
+        @PostMapping(value = ["/ping", "/ping/**"])
+        fun pingServiceMock(): String = "ping-service-mock"
+
+        @GetMapping("/gateway-info")
+        fun gatewayInfoMock(): Map<String, String> = mapOf(
+            "service" to "api-gateway",
+            "status" to "running"
+        )
+    }
+}
@@ -0,0 +1,269 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.BeforeEach
+import org.junit.jupiter.api.Test
+import org.springframework.beans.factory.annotation.Autowired
+import org.springframework.boot.test.autoconfigure.web.reactive.AutoConfigureWebTestClient
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.boot.test.web.server.LocalServerPort
+import org.springframework.cloud.gateway.route.RouteLocator
+import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.context.annotation.Import
+import org.springframework.test.context.ActiveProfiles
+import org.springframework.test.web.reactive.server.WebTestClient
+import org.springframework.web.bind.annotation.*
+
+/**
+ * Tests for Gateway security configuration including CORS settings.
+ * Tests the overall security setup and cross-origin request handling.
+ */
+@SpringBootTest(
+    classes = [GatewayApplication::class],
+    webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = [
+        // Disable external dependencies
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        // Disable circuit breaker for security tests
+        "resilience4j.circuitbreaker.configs.default.registerHealthIndicator=false",
+        "management.health.circuitbreakers.enabled=false",
+        // Disable JWT for CORS testing
+        "gateway.security.jwt.enabled=false",
+        // Use reactive web application type
+        "spring.main.web-application-type=reactive",
+        // Disable gateway discovery - use explicit routes
+        "spring.cloud.gateway.server.webflux.discovery.locator.enabled=false",
+        // Disable actuator security
+        "management.security.enabled=false",
+        // Set random port
+        "server.port=0"
+    ]
+)
+@ActiveProfiles("test") // Use test profile to disable unrelated global filters; CORS config is present in application-test.yml
+@AutoConfigureWebTestClient
+@Import(TestSecurityConfig::class, GatewaySecurityTests.TestSecurityConfig::class)
+class GatewaySecurityTests {
+
+    @Autowired
+    lateinit var webTestClient: WebTestClient
+
+    @LocalServerPort
+    private var port: Int = 0
+
+    @BeforeEach
+    fun setUpClient() {
+        // Ensure absolute base URL with a scheme to satisfy the CORS processor
+        webTestClient = webTestClient.mutate()
+            .baseUrl("http://localhost:$port")
+            .build()
+    }
+
+    @Test
+    fun `should handle CORS preflight requests`() {
+        webTestClient.options()
+            .uri("/api/members/test")
+            .header("Origin", "http://localhost:3000")
+            .header("Access-Control-Request-Method", "GET")
+            .header("Access-Control-Request-Headers", "Content-Type,Authorization")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+            .expectHeader().exists("Access-Control-Allow-Methods")
+            .expectHeader().exists("Access-Control-Allow-Headers")
+    }
+
+    @Test
+    fun `should allow requests from localhost origins`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should allow requests from meldestelle domain`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .header("Origin", "https://app.meldestelle.at")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should handle POST requests with CORS headers`() {
+        webTestClient.post()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .header("Content-Type", "application/json")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should handle PUT requests with CORS headers`() {
+        webTestClient.put()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:8080")
+            .header("Content-Type", "application/json")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should handle DELETE requests with CORS headers`() {
+        webTestClient.delete()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:4200")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should set max age for CORS requests`() {
+        webTestClient.options()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .header("Access-Control-Request-Method", "GET")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Max-Age")
+    }
+
+    @Test
+    fun `should allow credentials in CORS requests`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().valueEquals("Access-Control-Allow-Credentials", "true")
+    }
+
+    @Test
+    fun `should handle complex CORS scenarios`() {
+        // Simulate a complex frontend request with custom headers
+        webTestClient.options()
+            .uri("/api/members/complex")
+            .header("Origin", "https://frontend.meldestelle.at")
+            .header("Access-Control-Request-Method", "POST")
+            .header("Access-Control-Request-Headers", "Authorization,Content-Type,X-Requested-With")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+            .expectHeader().exists("Access-Control-Allow-Methods")
+            .expectHeader().exists("Access-Control-Allow-Headers")
+            .expectHeader().valueEquals("Access-Control-Allow-Credentials", "true")
+    }
+
+    @Test
+    fun `should not duplicate CORS headers due to deduplication filter`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+            .expectHeader().exists("Access-Control-Allow-Credentials")
+            // Verify headers appear only once (DedupeResponseHeader filter should work)
+    }
+
+    @Test
+    fun `should handle different HTTP methods allowed in CORS`() {
+        val allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "PATCH")
+
+        allowedMethods.forEach { method ->
+            webTestClient.options()
+                .uri("/test/cors")
+                .header("Origin", "http://localhost:3000")
+                .header("Access-Control-Request-Method", method)
+                .exchange()
+                .expectStatus().isOk
+                .expectHeader().exists("Access-Control-Allow-Methods")
+        }
+    }
+
+    @Test
+    fun `should handle authorization headers in CORS requests`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .header("Origin", "http://localhost:3000")
+            .header("Authorization", "Bearer test-token")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Access-Control-Allow-Origin")
+    }
+
+    @Test
+    fun `should maintain security headers in responses`() {
+        webTestClient.get()
+            .uri("/test/cors")
+            .exchange()
+            .expectStatus().isOk
+            .expectHeader().exists("Content-Type")
+    }
+
+    /**
+     * Test configuration for security and CORS testing.
+     */
+    @Configuration
+    class TestSecurityConfig {
+
+        @Bean
+        fun securityTestRoutes(builder: RouteLocatorBuilder): RouteLocator = builder.routes()
+            .route("test-cors") { r ->
+                r.path("/test/cors")
+                    .uri("forward:/mock/cors-test")
+            }
+            .route("test-members-complex") { r ->
+                r.path("/api/members/**")
+                    .filters { f -> f.stripPrefix(1) }
+                    .uri("forward:/mock/members-complex")
+            }
+            .build()
+
+        @Bean
+        fun securityTestController(): SecurityTestController = SecurityTestController()
+    }
+
+    /**
+     * Mock controller for security and CORS testing.
+     */
+    @RestController
+    @RequestMapping("/mock")
+    class SecurityTestController {
+
+        @RequestMapping(
+            value = ["/cors-test"],
+            method = [
+                RequestMethod.GET,
+                RequestMethod.POST,
+                RequestMethod.PUT,
+                RequestMethod.DELETE
+            ]
+        )
+        fun corsTest(): Map<String, String> = mapOf(
+            "message" to "CORS test successful",
+            "timestamp" to System.currentTimeMillis().toString()
+        )
+
+        @CrossOrigin
+        @GetMapping("/members-complex")
+        @PostMapping("/members-complex")
+        fun membersComplex(): Map<String, String> = mapOf(
+            "message" to "Complex CORS request handled",
+            "service" to "members"
+        )
+    }
+}
@@ -0,0 +1,47 @@
+package at.mocode.infrastructure.gateway
+
+import at.mocode.infrastructure.gateway.config.TestSecurityConfig
+import org.junit.jupiter.api.Test
+import org.springframework.boot.test.context.SpringBootTest
+import org.springframework.context.annotation.Import
+import org.springframework.test.context.ActiveProfiles
+import org.springframework.test.context.TestPropertySource
+
+/**
+ * Simplified integration test for Keycloak Gateway integration.
+ * This test verifies that the Spring context can initialize properly with Keycloak configuration
+ * without requiring actual Testcontainers, focusing on resolving the OAuth2 ResourceServer
+ * autoconfiguration timing issue.
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@ActiveProfiles("keycloak-integration-test")
+@TestPropertySource(
+    properties = [
+        "gateway.security.keycloak.enabled=true",
+        "spring.cloud.discovery.enabled=false",
+        "spring.cloud.consul.enabled=false",
+        "spring.cloud.consul.config.enabled=false",
+        "spring.cloud.consul.discovery.register=false",
+        "spring.cloud.loadbalancer.enabled=false",
+        "management.security.enabled=false"
+    ]
+)
+@Import(TestSecurityConfig::class)
+class KeycloakGatewayIntegrationTest {
+
+    @Test
+    fun `should initialize Spring context with Keycloak configuration`() {
+        // This test verifies that the Spring context can start without the previous
+        // IllegalStateException related to OAuth2 ResourceServer auto-configuration.
+        //
+        // The key fix was excluding ReactiveOAuth2ResourceServerAutoConfiguration
+        // from auto-configuration in application-keycloak-integration-test.yml
+        // to prevent early issuer-uri validation before containers are ready.
+
+        println("✅ Spring context initialized successfully with Keycloak configuration")
+        println("✅ OAuth2 ResourceServer auto-configuration timing issue resolved")
+
+        // Test passes if context loads without IllegalStateException
+        assert(true) { "Spring context should initialize without errors" }
+    }
+}
@@ -0,0 +1,59 @@
+package at.mocode.infrastructure.gateway.config
+
+import org.springframework.boot.test.context.TestConfiguration
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Primary
+import org.springframework.security.config.web.server.ServerHttpSecurity
+import org.springframework.security.config.web.server.invoke
+import org.springframework.security.oauth2.jwt.Jwt
+import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder
+import org.springframework.security.web.server.SecurityWebFilterChain
+import reactor.core.publisher.Mono
+import java.time.Instant
+
+/**
+ * Test-Konfiguration für Security-Beans.
+ * Stellt einen Mock ReactiveJwtDecoder und eine Security-Konfiguration bereit,
+ * die alle Anfragen für Test-Zwecke erlaubt.
+ */
+@TestConfiguration
+class TestSecurityConfig {
+
+    /**
+     * Mock ReactiveJwtDecoder für Tests.
+     * Validiert keine echten JWTs, sondern akzeptiert alle Token für Test-Zwecke.
+     */
+    @Bean
+    @Primary
+    fun mockReactiveJwtDecoder(): ReactiveJwtDecoder {
+        return ReactiveJwtDecoder { token ->
+            // Erstelle ein Mock-JWT mit minimalen Claims
+            val jwt = Jwt.withTokenValue(token)
+                .header("alg", "none")
+                .header("typ", "JWT")
+                .claim("sub", "test-user")
+                .claim("scope", "read write")
+                .claim("preferred_username", "test-user")
+                .issuedAt(Instant.now())
+                .expiresAt(Instant.now().plusSeconds(3600))
+                .build()
+
+            Mono.just(jwt)
+        }
+    }
+
+    /**
+     * Test Security Web Filter Chain, die alle Anfragen erlaubt.
+     * Dies ermöglicht Tests von Routing, CORS und Filtern ohne Authentifizierung.
+     */
+    @Bean
+    @Primary
+    fun testSecurityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+        return http {
+            csrf { disable() }
+            authorizeExchange {
+                authorize(anyExchange, permitAll)
+            }
+        }
+    }
+}
@@ -0,0 +1,70 @@
+server:
+  port: 0
+
+spring:
+  application:
+    name: api-gateway-dev-test
+  main:
+    web-application-type: reactive
+  cloud:
+    discovery:
+      enabled: false
+    consul:
+      enabled: false
+      config:
+        enabled: false
+      discovery:
+        register: false
+    loadbalancer:
+      enabled: false
+    gateway:
+      server:
+        webflux:
+          httpclient:
+            connect-timeout: 1000
+            response-timeout: 5s
+          discovery:
+            locator:
+              enabled: false
+          routes:
+            [ ]
+          globalcors:
+            cors-configurations:
+              '[/**]':
+                allowedOriginPatterns:
+                  - "http://localhost:*"
+                  - "https://*.meldestelle.at"
+                allowedMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - DELETE
+                  - PATCH
+                  - OPTIONS
+                allowedHeaders:
+                  - "*"
+                allowCredentials: true
+                maxAge: 3600
+      # Override production routes: keep empty in tests running with dev profile
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info
+  endpoint:
+    health:
+      show-details: always
+  health:
+    circuitbreakers:
+      enabled: false
+
+logging:
+  level:
+    org.springframework.cloud.gateway: WARN
+    at.mocode.infrastructure.gateway: DEBUG
+
+gateway:
+  security:
+    jwt:
+      enabled: false
@@ -0,0 +1,83 @@
+server:
+  port: 0
+
+spring:
+  application:
+    name: api-gateway-keycloak-integration-test
+  main:
+    web-application-type: reactive
+  # Exclude OAuth2 ResourceServer auto-configuration to prevent early issuer-uri validation
+  # The OAuth2 configuration will be set dynamically after Testcontainers start
+  autoconfigure:
+    exclude:
+      - org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
+  # OAuth2 configuration will be set by @DynamicPropertySource after containers start
+  # Do not set static issuer-uri here as it will fail validation before containers are ready
+  cloud:
+    discovery:
+      enabled: false
+    consul:
+      enabled: false
+      config:
+        enabled: false
+      discovery:
+        register: false
+    loadbalancer:
+      enabled: false
+    gateway:
+      # IMPORTANT: Do not load production lb:// routes in tests
+      server:
+        webflux:
+          discovery:
+            locator:
+              enabled: false
+          httpclient:
+            connect-timeout: 1000
+            response-timeout: 5s
+          routes:
+            [ ]
+          globalcors:
+            cors-configurations:
+              '[/**]':
+                allowedOriginPatterns:
+                  - "http://localhost:*"
+                  - "https://*.meldestelle.at"
+                allowedMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - DELETE
+                  - PATCH
+                  - OPTIONS
+                allowedHeaders:
+                  - "*"
+                allowCredentials: true
+                maxAge: 3600
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info
+  endpoint:
+    health:
+      show-details: always
+  health:
+    circuit breakers:
+      enabled: false
+  security:
+    enabled: false
+
+# Enable JWT authentication through OAuth2 Resource Server for integration testing
+gateway:
+  security:
+    jwt:
+      enabled: false # Disable custom JWT filter
+    keycloak:
+      enabled: true # Enable Keycloak integration
+
+logging:
+  level:
+    org.springframework.cloud.gateway: WARN
+    org.springframework.security: DEBUG
+    at.mocode.infrastructure.gateway: DEBUG
@@ -0,0 +1,70 @@
+server:
+  port: 0
+
+spring:
+  application:
+    name: api-gateway-test
+  main:
+    web-application-type: reactive
+  autoconfigure:
+    exclude:
+      # Disable OAuth2 ResourceServer autoconfiguration in tests
+      #  use mock JwtAuthenticationFilter instead of real JWT validation
+      - org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration
+  cloud:
+    discovery:
+      enabled: false
+    consul:
+      enabled: false
+      config:
+        enabled: false
+      discovery:
+        register: false
+    loadbalancer:
+      enabled: false
+    gateway:
+      # IMPORTANT: Do not load production lb:// routes in tests
+      server:
+        webflux:
+          discovery:
+            locator:
+              enabled: false
+          httpclient:
+            connect-timeout: 1000
+            response-timeout: 5s
+          routes:
+            [ ]
+          globalcors:
+            cors-configurations:
+              '[/**]':
+                allowedOriginPatterns:
+                  - "http://localhost:*"
+                  - "https://*.meldestelle.at"
+                allowedMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - DELETE
+                  - PATCH
+                  - OPTIONS
+                allowedHeaders:
+                  - "*"
+                allowCredentials: true
+                maxAge: 3600
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info
+  endpoint:
+    health:
+      show-details: always
+  health:
+    circuit breakers:
+      enabled: false
+
+logging:
+  level:
+    org.springframework.cloud.gateway: WARN
+    at.mocode.infrastructure.gateway: DEBUG
@@ -0,0 +1,17 @@
+<configuration>
+    <!-- Minimale Konfiguration für stabilere Tests -->
+    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>
+
+    <!-- Weniger verbose Logging für Tests -->
+    <root level="WARN">
+        <appender-ref ref="CONSOLE" />
+    </root>
+
+    <!-- Spezifische Logger für wichtige Test-Komponenten -->
+    <logger name="org.springframework.test" level="INFO" />
+    <logger name="at.mocode" level="DEBUG" />
+</configuration>
@@ -0,0 +1,19 @@
+-- Testcontainers an init script for Keycloak schema
+-- Creates the schema and basic privileges for the test DB user
+
+CREATE SCHEMA IF NOT EXISTS keycloak;
+
+GRANT USAGE ON SCHEMA keycloak TO meldestelle;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA keycloak TO meldestelle;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA keycloak TO meldestelle;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak
+    GRANT ALL PRIVILEGES ON TABLES TO meldestelle;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak
+    GRANT ALL PRIVILEGES ON SEQUENCES TO meldestelle;
+
+DO $$
+BEGIN
+    RAISE NOTICE 'Test Keycloak schema initialized';
+END $$;