Supplog

People on regular supplements or medicine can't always remember whether they already took a dose, and the people close to them can't support the routine from a distance. Supplog grew out of that simple real-life problem.

• Layered REST architecture: DTO contracts, Bean Validation and centralized exception handling
• Stateless JWT authentication; tokenVersion invalidates old tokens after a password change
• ROLE_USER / ROLE_ADMIN authorization plus resource ownership checks
• Dose tracking: pending, completed, skipped, missed, with a configurable grace period per routine

1. Web clientReact and TypeScript UI in a separate repo, on Vercel
2. Security filter chainJwtAuthenticationFilter: signature, user and tokenVersion checks
3. ControllerREST endpoints under /api/v1, DTOs and validation
4. ServiceBusiness rules, ownership checks, scheduled missed-dose scan
5. RepositorySpring Data JPA, Hibernate
6. PostgreSQLFlyway migrations (V1–V8), constraints and indexes

1. Making stateless JWTs revocable

   Problem

   Because JWTs are stateless, an issued token stays valid until it expires. Old sessions had to end when a password changed or an account was deactivated.

   Trade-off

   A separate token blacklist means another store and cleanup work. A counter on the user record means reading the user on every request.

   Solution

   I added a tokenVersion claim to the token, and JwtAuthenticationFilter compares it with the stored value. A password change, an admin password reset, a role change or an account deactivation increments the counter.

   Result

   Old tokens are rejected without an extra store, and deactivated accounts cannot authenticate.

2. Marking missed doses without race conditions

   Problem

   A dose that isn't marked in time should become missed. But the scheduler could mark a dose missed while the user marks it completed at the same moment.

   Trade-off

   A fixed window didn't suit everyone, while a per-routine window made the calculation and data model larger.

   Solution

   I added a missedGracePeriod of 30, 60, 90 or 120 minutes to each routine and compute missedAt for every dose. The scheduler only marks expired PENDING records as missed, completing or skipping after missedAt is rejected, and a unique index per routine and day prevents duplicate records.

   Result

   I wrote PostgreSQL concurrency tests that check the scheduler and a completion cannot overwrite each other.

3. Scoped access for supporters

   Problem

   A user wants to share a routine with someone close without exposing all of their data.

   Trade-off

   A single share switch is simple but coarse; per-routine permissions need more rules and checks.

   Solution

   A support relationship goes through request, accept, reject, cancel and revoke steps. Access scope is ALL_ROUTINES or SELECTED_ROUTINES, and supporters only see explicitly authorized active routines.

   Result

   Sharing stays under the user's control, and an admin can revoke a relationship when needed.

• Stateless JWT authentication with Spring Security, passwords stored with BCrypt
• Custom JSON responses for 401 and 403
• Users only reach their own data; admin operations live under /api/v1/admin and require ROLE_ADMIN
• Admins cannot deactivate or demote themselves, and the last active admin cannot be removed

• User, Supplement, Routine and RoutineExecution relationships, with support relationships in their own table
• Soft delete: user, supplement and routine records are never physically removed
• Schema changes are managed with Flyway; ddl-auto=validate catches entity and table mismatches at startup
• Constraints and query indexes are added through migrations

• POST/api/v1/auth/login

  Logs in and returns a JWT

  Public
• PATCH/api/v1/users/me/password

  Changes the password and invalidates old tokens

  Signed-in user
• POST/api/v1/routines

  Creates a routine

  Signed-in user
• GET/api/v1/routine-executions/today

  Creates and lists today's scheduled doses

  Signed-in user
• PATCH/api/v1/routine-executions/routines/{routineId}/today/complete

  Marks today's dose as completed

  Signed-in user
• PATCH/api/v1/support/connections/{relationshipId}/access-scope

  Changes a supporter's access scope

  Signed-in user
• GET/api/v1/admin/users

  Lists users

  Admin only
• PATCH/api/v1/admin/users/{userId}/deactivate

  Deactivates a user account

  Admin only

A selected summary of the controller mappings. See the README on GitHub for the full list and setup.

1. v1.0CurrentOctober 2026
   • Routines, daily dose tracking and the missed-dose scan
   • Supporter sharing, JWT login, admin APIs
   • Not yet: reminders and notifications, as-needed (AS_NEEDED) routines