[FA-17] Update auth

- Fix GraphQL authorization attributes to use string[] instead of string for roles
- Remove admin role requirement from ImportNovel endpoint
- Add comprehensive OIDC configuration validation with specific error messages
- Validate Authority, ClientId, and Audience are properly configured
- Ensure HTTPS requirement except for localhost development

Co-authored-by: conco <conco@users.noreply.local>

.gitea/workflows/build-gateway.yml

@@ -0,0 +1,166 @@
+name: Build Gateway
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*.*.*'
+
+env:
+  REGISTRY: ${{ gitea.server_url }}
+  IMAGE_NAME: ${{ gitea.repository_owner }}/fictionarchive-api
+
+jobs:
+  build-subgraphs:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        service:
+          - name: novel-service
+            project: FictionArchive.Service.NovelService
+            subgraph: Novel
+          - name: translation-service
+            project: FictionArchive.Service.TranslationService
+            subgraph: Translation
+          - name: scheduler-service
+            project: FictionArchive.Service.SchedulerService
+            subgraph: Scheduler
+          - name: user-service
+            project: FictionArchive.Service.UserService
+            subgraph: User
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Install Fusion CLI
+        run: dotnet tool install -g HotChocolate.Fusion.CommandLine
+        
+      - name: Add .NET tools to PATH
+        run: echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
+
+      - name: Restore dependencies
+        run: dotnet restore ${{ matrix.service.project }}/${{ matrix.service.project }}.csproj
+
+      - name: Build
+        run: dotnet build ${{ matrix.service.project }}/${{ matrix.service.project }}.csproj -c Release --no-restore
+
+      - name: Export schema
+        run: |
+          dotnet run -c Release --no-launch-profile \
+            --project ${{ matrix.service.project }}/${{ matrix.service.project }}.csproj \
+            -- schema export --output schema.graphql
+
+      - name: Pack subgraph
+        run: fusion subgraph pack -w ${{ matrix.service.project }}
+
+      - name: Upload subgraph package
+        uses: christopherhx/gitea-upload-artifact@v4
+        with:
+          name: ${{ matrix.service.name }}-subgraph
+          path: ${{ matrix.service.project }}/*.fsp
+          retention-days: 30
+
+  build-gateway:
+    runs-on: ubuntu-latest
+    needs: build-subgraphs
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Install Fusion CLI
+        run: dotnet tool install -g HotChocolate.Fusion.CommandLine
+
+      - name: Add .NET tools to PATH
+        run: echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
+
+      - name: Create subgraphs directory
+        run: mkdir -p subgraphs
+
+      - name: Download Novel Service subgraph
+        uses: christopherhx/gitea-download-artifact@v4
+        with:
+          name: novel-service-subgraph
+          path: subgraphs/novel
+
+      - name: Download Translation Service subgraph
+        uses: christopherhx/gitea-download-artifact@v4
+        with:
+          name: translation-service-subgraph
+          path: subgraphs/translation
+
+      - name: Download Scheduler Service subgraph
+        uses: christopherhx/gitea-download-artifact@v4
+        with:
+          name: scheduler-service-subgraph
+          path: subgraphs/scheduler
+
+      - name: Download User Service subgraph
+        uses: christopherhx/gitea-download-artifact@v4
+        with:
+          name: user-service-subgraph
+          path: subgraphs/user
+
+      - name: Configure subgraph URLs for Docker
+        run: |
+          for fsp in subgraphs/*/*.fsp; do
+            if [ -f "$fsp" ]; then
+              dir=$(dirname "$fsp")
+              name=$(basename "$dir")
+              url="http://${name}-service:8080/graphql"
+              echo "Setting $name URL to $url"
+              fusion subgraph config set http --url "$url" -c "$fsp"
+            fi
+          done
+
+      - name: Compose gateway
+        run: |
+          cd FictionArchive.API
+          rm -f gateway.fgp
+          for fsp in ../subgraphs/*/*.fsp; do
+            if [ -f "$fsp" ]; then
+              echo "Composing: $fsp"
+              fusion compose -p gateway.fgp -s "$fsp"
+            fi
+          done
+
+      - name: Restore dependencies
+        run: dotnet restore FictionArchive.API/FictionArchive.API.csproj
+
+      - name: Build gateway
+        run: dotnet build FictionArchive.API/FictionArchive.API.csproj -c Release --no-restore -p:SkipFusionBuild=true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract registry hostname
+        id: registry
+        run: echo "HOST=$(echo '${{ gitea.server_url }}' | sed 's|https\?://||')" >> $GITHUB_OUTPUT
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: FictionArchive.API/Dockerfile
+          push: true
+          tags: |
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_NAME }}:latest
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_NAME }}:${{ gitea.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitea/workflows/build.yml

@@ -0,0 +1,74 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  build-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Restore dependencies
+        run: dotnet restore FictionArchive.sln
+
+      - name: Build solution
+        run: dotnet build FictionArchive.sln --configuration Release --no-restore /p:SkipFusionBuild=true
+
+      - name: Run tests
+        run: |
+          dotnet test FictionArchive.sln --configuration Release --no-build --verbosity normal \
+            --logger "trx;LogFileName=test-results.trx" \
+            --collect:"XPlat Code Coverage" \
+            --results-directory ./TestResults
+
+      - name: Upload test results
+        uses: christopherhx/gitea-upload-artifact@v4
+        if: always()
+        with:
+          name: test-results
+          path: ./TestResults/**/*.trx
+          retention-days: 30
+
+      - name: Upload coverage results
+        uses: christopherhx/gitea-upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-results
+          path: ./TestResults/**/coverage.cobertura.xml
+          retention-days: 30
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: fictionarchive-web
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6.0.0
+        with:
+          node-version: '20'
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build

.gitea/workflows/claude_assistant.yml

@@ -0,0 +1,49 @@
+name: Claude PR Assistant
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude-code-action:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && contains(github.event.issue.body, '@claude'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Claude PR Action
+        uses: markwylde/claude-code-gitea-action@v1.0.20
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          gitea_token: ${{ secrets.CLAUDE_GITEA_TOKEN }}
+          # Or use OAuth token instead:
+          # claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          timeout_minutes: "60"
+          # mode: tag  # Default: responds to @claude mentions
+          # Optional: Restrict network access to specific domains only
+          # experimental_allowed_domains: |
+          #   .anthropic.com
+          #   .github.com
+          #   api.github.com
+          #   .githubusercontent.com
+          #   bun.sh
+          #   registry.npmjs.org
+          #   .blob.core.windows.net

.gitea/workflows/release.yml

@@ -0,0 +1,104 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+env:
+  REGISTRY: ${{ gitea.server_url }}
+  IMAGE_PREFIX: ${{ gitea.repository_owner }}/fictionarchive
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        service:
+          - name: novel-service
+            dockerfile: FictionArchive.Service.NovelService/Dockerfile
+          - name: user-service
+            dockerfile: FictionArchive.Service.UserService/Dockerfile
+          - name: translation-service
+            dockerfile: FictionArchive.Service.TranslationService/Dockerfile
+          - name: file-service
+            dockerfile: FictionArchive.Service.FileService/Dockerfile
+          - name: scheduler-service
+            dockerfile: FictionArchive.Service.SchedulerService/Dockerfile
+          - name: authentication-service
+            dockerfile: FictionArchive.Service.AuthenticationService/Dockerfile
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+
+      - name: Extract registry hostname
+        id: registry
+        run: echo "HOST=$(echo '${{ gitea.server_url }}' | sed 's|https\?://||')" >> $GITHUB_OUTPUT
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.service.dockerfile }}
+          push: true
+          tags: |
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_PREFIX }}-${{ matrix.service.name }}:${{ steps.version.outputs.VERSION }}
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_PREFIX }}-${{ matrix.service.name }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+
+      - name: Extract registry hostname
+        id: registry
+        run: echo "HOST=$(echo '${{ gitea.server_url }}' | sed 's|https\?://||')" >> $GITHUB_OUTPUT
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push frontend Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./fictionarchive-web
+          file: fictionarchive-web/Dockerfile
+          push: true
+          build-args: |
+            VITE_GRAPHQL_URI=${{ vars.VITE_GRAPHQL_URI }}
+            VITE_OIDC_AUTHORITY=${{ vars.VITE_OIDC_AUTHORITY }}
+            VITE_OIDC_CLIENT_ID=${{ vars.VITE_OIDC_CLIENT_ID }}
+            VITE_OIDC_REDIRECT_URI=${{ vars.VITE_OIDC_REDIRECT_URI }}
+            VITE_OIDC_POST_LOGOUT_REDIRECT_URI=${{ vars.VITE_OIDC_POST_LOGOUT_REDIRECT_URI }}
+          tags: |
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_PREFIX }}-frontend:${{ steps.version.outputs.VERSION }}
+            ${{ steps.registry.outputs.HOST }}/${{ env.IMAGE_PREFIX }}-frontend:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Documentation/ARCHITECTURE.md

@@ -0,0 +1,405 @@
+# FictionArchive Architecture Overview
+
+## High-Level Architecture
+
+```
+┌────────────────────────────────────────────────────────────────┐
+│                    React 19 Frontend                           │
+│         (Apollo Client, TailwindCSS, OIDC Auth)               │
+└───────────────────────────┬────────────────────────────────────┘
+                            │ GraphQL
+                            ▼
+┌────────────────────────────────────────────────────────────────┐
+│              Hot Chocolate Fusion Gateway                      │
+│                   (FictionArchive.API)                         │
+└──────┬────────┬────────┬────────┬────────┬─────────────────────┘
+       │        │        │        │        │
+       ▼        ▼        ▼        ▼        ▼
+┌──────────┐┌──────────┐┌───────────┐┌──────────┐┌──────────────┐
+│  Novel   ││   User   ││Translation││Scheduler ││    File      │
+│ Service  ││ Service  ││  Service  ││ Service  ││   Service    │
+└────┬─────┘└────┬─────┘└─────┬─────┘└────┬─────┘└──────┬───────┘
+     │           │            │           │             │
+     └───────────┴────────────┴───────────┴─────────────┘
+                            │
+                   ┌────────┴────────┐
+                   │    RabbitMQ     │
+                   │   (Event Bus)   │
+                   └─────────────────┘
+                            │
+                   ┌────────┴────────┐
+                   │   PostgreSQL    │
+                   │  (per service)  │
+                   └─────────────────┘
+```
+
+## Technology Stack
+
+| Layer | Technology | Version |
+|-------|------------|---------|
+| Runtime | .NET | 8.0 |
+| GraphQL | Hot Chocolate / Fusion | 13+ |
+| Database | PostgreSQL | 12+ |
+| ORM | Entity Framework Core | 8.0 |
+| Message Broker | RabbitMQ | 3.12+ |
+| Job Scheduler | Quartz.NET | Latest |
+| Object Storage | AWS S3 / Garage | - |
+| Date/Time | NodaTime | Latest |
+| Frontend | React | 19.2 |
+| Frontend Build | Vite | 7.2 |
+| GraphQL Client | Apollo Client | 4.0 |
+| Auth | OIDC Client TS | 3.4 |
+| Styling | TailwindCSS | 3.4 |
+| UI Components | Radix UI | Latest |
+
+## Project Structure
+
+```
+FictionArchive.sln
+├── FictionArchive.Common              # Shared enums and extensions
+├── FictionArchive.API                 # GraphQL Fusion Gateway
+├── FictionArchive.Service.Shared      # Shared infrastructure
+├── FictionArchive.Service.NovelService
+├── FictionArchive.Service.UserService
+├── FictionArchive.Service.TranslationService
+├── FictionArchive.Service.FileService
+├── FictionArchive.Service.SchedulerService
+├── FictionArchive.Service.AuthenticationService
+├── FictionArchive.Service.NovelService.Tests
+└── fictionarchive-web                 # React frontend
+```
+
+## Services
+
+### FictionArchive.API - GraphQL Fusion Gateway
+
+- **Role**: Single entry point for all GraphQL queries
+- **Port**: 5001 (HTTPS)
+- **Endpoints**:
+  - `/graphql` - GraphQL endpoint
+  - `/healthz` - Health check
+- **Responsibilities**:
+  - Compose GraphQL schemas from all subgraphs
+  - Route queries to appropriate services
+  - CORS policy management
+
+### FictionArchive.Service.NovelService
+
+- **Role**: Novel/fiction content management
+- **Port**: 8081 (HTTPS)
+- **Database**: `FictionArchive_NovelService`
+- **GraphQL Operations**:
+  - `GetNovels` - Paginated, filterable novel listing
+  - `ImportNovel` - Trigger novel import
+  - `FetchChapterContents` - Fetch chapter content
+- **Models**: Novel, Chapter, Source, NovelTag, Image, LocalizationKey
+- **External Integration**: Novelpia adapter
+- **Events Published**: `TranslationRequestCreatedEvent`, `FileUploadRequestCreatedEvent`
+- **Events Subscribed**: `TranslationRequestCompletedEvent`, `NovelUpdateRequestedEvent`, `ChapterPullRequestedEvent`, `FileUploadRequestStatusUpdateEvent`
+
+### FictionArchive.Service.UserService
+
+- **Role**: User identity and profile management
+- **Port**: 8081 (HTTPS)
+- **Database**: `FictionArchive_UserService`
+- **Models**: User (with OAuth provider linking)
+- **Events Subscribed**: `AuthUserAddedEvent`
+
+### FictionArchive.Service.TranslationService
+
+- **Role**: Text translation orchestration
+- **Port**: 8081 (HTTPS)
+- **Database**: `FictionArchive_TranslationService`
+- **External Integration**: DeepL API
+- **Models**: TranslationRequest
+- **Events Published**: `TranslationRequestCompletedEvent`
+- **Events Subscribed**: `TranslationRequestCreatedEvent`
+
+### FictionArchive.Service.FileService
+
+- **Role**: File storage and S3 proxy
+- **Port**: 8080 (HTTP)
+- **Protocol**: REST only (not GraphQL)
+- **Endpoints**: `GET /api/{*path}` - S3 file proxy
+- **External Integration**: S3-compatible storage (AWS S3 / Garage)
+- **Events Published**: `FileUploadRequestStatusUpdateEvent`
+- **Events Subscribed**: `FileUploadRequestCreatedEvent`
+
+### FictionArchive.Service.SchedulerService
+
+- **Role**: Job scheduling and automation
+- **Port**: 8081 (HTTPS)
+- **Database**: `FictionArchive_SchedulerService`
+- **Scheduler**: Quartz.NET with persistent job store
+- **GraphQL Operations**: `ScheduleEventJob`, `GetScheduledJobs`
+- **Models**: SchedulerJob, EventJobTemplate
+
+### FictionArchive.Service.AuthenticationService
+
+- **Role**: OAuth/OIDC webhook receiver
+- **Port**: 8080 (HTTP)
+- **Protocol**: REST only
+- **Endpoints**: `POST /api/AuthenticationWebhook/UserRegistered`
+- **Events Published**: `AuthUserAddedEvent`
+- **No Database** - Stateless webhook handler
+
+## Communication Patterns
+
+### GraphQL Federation
+
+- Hot Chocolate Fusion Gateway composes subgraph schemas
+- Schema export automated via `build_gateway.py`
+- Each service defines its own Query/Mutation types
+
+### Event-Driven Architecture (RabbitMQ)
+
+- Direct exchange: `fiction-archive-event-bus`
+- Per-service queues based on `ClientIdentifier`
+- Routing key = event class name
+- Headers: `X-Created-At`, `X-Event-Id`
+- NodaTime JSON serialization
+
+### Event Flow Examples
+
+**Novel Import:**
+```
+1. Frontend → importNovel mutation
+2. NovelService publishes NovelUpdateRequestedEvent
+3. NovelUpdateRequestedEventHandler processes
+4. Fetches metadata via NovelpiaAdapter
+5. Publishes FileUploadRequestCreatedEvent (for cover)
+6. FileService uploads to S3
+7. FileService publishes FileUploadRequestStatusUpdateEvent
+8. NovelService updates image path
+```
+
+**Translation:**
+```
+1. NovelService publishes TranslationRequestCreatedEvent
+2. TranslationService translates via DeepL
+3. TranslationService publishes TranslationRequestCompletedEvent
+4. NovelService updates chapter translation
+```
+
+## Data Storage
+
+### Database Pattern
+- Database per service (PostgreSQL)
+- Connection string format: `Host=localhost;Database=FictionArchive_{ServiceName};...`
+- Auto-migration on startup via `dbContext.UpdateDatabase()`
+
+### Audit Trail
+- `AuditInterceptor` auto-sets `CreatedTime` and `LastUpdatedTime`
+- `IAuditable` interface with NodaTime `Instant` fields
+- `BaseEntity<TKey>` abstract base class
+
+### Object Storage
+- S3-compatible (AWS S3 or Garage)
+- Path-style URLs for Garage compatibility
+- Proxied through FileService
+
+## Frontend Architecture
+
+### Structure
+```
+fictionarchive-web/
+├── src/
+│   ├── auth/           # OIDC authentication
+│   ├── components/     # React components
+│   │   └── ui/         # Radix-based primitives
+│   ├── pages/          # Route pages
+│   ├── layouts/        # Layout components
+│   ├── graphql/        # GraphQL queries
+│   ├── __generated__/  # Codegen output
+│   └── lib/            # Utilities
+└── codegen.ts          # GraphQL Codegen config
+```
+
+### Authentication
+- OIDC via `oidc-client-ts`
+- Environment variables for configuration
+- `useAuth` hook for state access
+
+### State Management
+- Apollo Client for GraphQL state
+- React Context for auth state
+
+## Infrastructure
+
+### Docker
+- Multi-stage builds
+- Base: `mcr.microsoft.com/dotnet/aspnet:8.0`
+- Non-root user for security
+- Ports: 8080 (HTTP) or 8081 (HTTPS)
+
+### Health Checks
+- All services expose `/healthz`
+
+### Configuration
+- `appsettings.json` - Default settings
+- `appsettings.Development.json` - Dev overrides
+- `appsettings.Local.json` - Local secrets (not committed)
+
+---
+
+# Improvement Recommendations
+
+## Critical
+
+### 1. Event Bus - No Dead Letter Queue or Retry Logic
+**Location**: `FictionArchive.Service.Shared/Services/EventBus/Implementations/RabbitMQEventBus.cs:126-133`
+
+**Issue**: Events are always ACK'd even on failure. No DLQ configuration for poison messages. Failed events are lost forever.
+
+**Recommendation**: Implement retry with exponential backoff, dead-letter exchange, and poison message handling.
+
+```csharp
+// Example: Add retry and DLQ
+catch (Exception e)
+{
+    _logger.LogError(e, "Error handling event");
+    if (retryCount < maxRetries)
+    {
+        await channel.BasicNackAsync(@event.DeliveryTag, false, true); // requeue
+    }
+    else
+    {
+        // Send to DLQ
+        await channel.BasicNackAsync(@event.DeliveryTag, false, false);
+    }
+}
+```
+
+### 2. CORS Configuration is Insecure
+**Location**: `FictionArchive.API/Program.cs:24-33`
+
+**Issue**: `AllowAnyOrigin()` allows requests from any domain, unsuitable for production.
+
+**Recommendation**: Configure specific allowed origins via appsettings:
+```csharp
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("Production", policy =>
+    {
+        policy.WithOrigins(builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>())
+              .AllowAnyMethod()
+              .AllowAnyHeader();
+    });
+});
+```
+
+### 3. Auto-Migration on Startup
+**Location**: `FictionArchive.Service.Shared/Services/Database/FictionArchiveDbContext.cs:23-38`
+
+**Issue**: Running migrations at startup can cause race conditions with multiple instances and potential data corruption during rolling deployments.
+
+**Recommendation**: Use a migration job, init container, or CLI tool instead of startup code.
+
+## Important
+
+### 4. No Circuit Breaker Pattern
+**Issue**: External service calls (DeepL, Novelpia, S3) lack resilience patterns.
+
+**Recommendation**: Add Polly for circuit breaker, retry, and timeout policies:
+```csharp
+builder.Services.AddHttpClient<ISourceAdapter, NovelpiaAdapter>()
+    .AddPolicyHandler(GetRetryPolicy())
+    .AddPolicyHandler(GetCircuitBreakerPolicy());
+```
+
+### 5. Missing Request Validation/Rate Limiting
+**Issue**: No visible rate limiting on GraphQL mutations. `ImportNovel` could be abused.
+
+**Recommendation**: Add rate limiting middleware and input validation.
+
+### 6. Hardcoded Exchange Name
+**Location**: `RabbitMQEventBus.cs:24`
+
+**Issue**: `fiction-archive-event-bus` is hardcoded.
+
+**Recommendation**: Move to configuration for environment flexibility.
+
+### 7. No Distributed Tracing
+**Issue**: Event correlation exists (`X-Event-Id` header) but not integrated with tracing.
+
+**Recommendation**: Add OpenTelemetry for end-to-end request tracing across services.
+
+### 8. Singleton AuditInterceptor
+**Location**: `FictionArchiveDbContext.cs:20`
+
+**Issue**: `new AuditInterceptor()` created per DbContext instance.
+
+**Recommendation**: Register as singleton in DI and inject.
+
+## Minor / Code Quality
+
+### 9. Limited Test Coverage
+**Issue**: Only `NovelService.Tests` exists. No integration tests for event handlers.
+
+**Recommendation**: Add unit and integration tests for each service, especially event handlers.
+
+### 10. Inconsistent Port Configuration
+**Issue**: Some services use 8080 (HTTP), others 8081 (HTTPS).
+
+**Recommendation**: Standardize on HTTPS with proper cert management.
+
+### 11. No API Versioning
+**Issue**: GraphQL schemas have no versioning strategy.
+
+**Recommendation**: Consider schema versioning or deprecation annotations for breaking changes.
+
+### 12. Frontend - No Error Boundary
+**Issue**: React app lacks error boundaries for graceful failure handling.
+
+**Recommendation**: Add React Error Boundaries around routes.
+
+### 13. Missing Health Check Depth
+**Issue**: Health checks only verify service is running, not dependencies.
+
+**Recommendation**: Add database, RabbitMQ, and S3 health checks:
+```csharp
+builder.Services.AddHealthChecks()
+    .AddNpgSql(connectionString)
+    .AddRabbitMQ()
+    .AddS3(options => { });
+```
+
+### 14. Synchronous File Operations in Event Handlers
+**Issue**: File uploads may block event handling thread for large files.
+
+**Recommendation**: Consider async streaming for large files.
+
+## Architectural Suggestions
+
+### 15. Consider Outbox Pattern
+**Issue**: Publishing events and saving to DB aren't transactional, could lead to inconsistent state.
+
+**Recommendation**: Implement transactional outbox pattern for guaranteed delivery:
+```
+1. Save entity + outbox message in same transaction
+2. Background worker publishes from outbox
+3. Delete outbox message after successful publish
+```
+
+### 16. Gateway Schema Build Process
+**Issue**: Python script (`build_gateway.py`) for schema composition requires manual execution.
+
+**Recommendation**: Integrate into CI/CD pipeline or consider runtime schema polling.
+
+### 17. Secret Management
+**Issue**: Credentials in appsettings files.
+
+**Recommendation**: Use Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, or similar secret management solution.
+
+---
+
+## Key Files Reference
+
+| File | Purpose |
+|------|---------|
+| `FictionArchive.API/Program.cs` | Gateway setup |
+| `FictionArchive.API/build_gateway.py` | Schema composition script |
+| `FictionArchive.Service.Shared/Services/EventBus/` | Event bus implementation |
+| `FictionArchive.Service.Shared/Extensions/` | Service registration helpers |
+| `FictionArchive.Service.Shared/Services/Database/` | DB infrastructure |
+| `fictionarchive-web/src/auth/AuthContext.tsx` | Frontend auth state |

Documentation/CICD.md

@@ -0,0 +1,297 @@
+# CI/CD Configuration
+
+This document describes the CI/CD pipeline configuration for FictionArchive using Gitea Actions.
+
+## Workflows Overview
+
+| Workflow | File | Trigger | Purpose |
+|----------|------|---------|---------|
+| CI | `build.yml` | Push/PR to master | Build and test all projects |
+| Build Gateway | `build-gateway.yml` | Tag `v*.*.*` or manual | Build subgraphs, compose gateway, push API image |
+| Release | `release.yml` | Tag `v*.*.*` | Build and push all Docker images |
+| Claude PR Assistant | `claude_assistant.yml` | Issue/PR comments with @claude | AI-assisted code review and issue handling |
+
+## Pipeline Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                         Push to master                               │
+└─────────────────────────────┬───────────────────────────────────────┘
+                              │
+                              ▼
+                ┌─────────────────────────┐
+                │      build.yml          │
+                │     (CI checks)         │
+                └─────────────────────────┘
+
+┌─────────────────────────────────────────────────────────────────────┐
+│                        Push tag v*.*.*                               │
+└─────────────────────────────┬───────────────────────────────────────┘
+                              │
+              ┌───────────────┴───────────────┐
+              ▼                               ▼
+┌─────────────────────────┐     ┌─────────────────────────┐
+│      release.yml        │     │   build-gateway.yml     │
+│  (build & push all      │     │  (build subgraphs &     │
+│   backend + frontend)   │     │   push API gateway)     │
+└─────────────────────────┘     └─────────────────────────┘
+
+┌─────────────────────────────────────────────────────────────────────┐
+│              Issue/PR comment containing @claude                     │
+└─────────────────────────────┬───────────────────────────────────────┘
+                              │
+                              ▼
+                ┌─────────────────────────┐
+                │  claude_assistant.yml   │
+                │  (AI code assistance)   │
+                └─────────────────────────┘
+```
+
+## Required Configuration
+
+### Repository Secrets
+
+Configure these in **Settings → Actions → Secrets**:
+
+| Secret | Description | Required By |
+|--------|-------------|-------------|
+| `REGISTRY_TOKEN` | Gitea access token with `write:package` scope | `release.yml`, `build-gateway.yml` |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code OAuth token | `claude_assistant.yml` |
+| `CLAUDE_GITEA_TOKEN` | Gitea token for Claude assistant | `claude_assistant.yml` |
+
+#### Creating Access Tokens
+
+1. Go to **Settings → Applications → Access Tokens**
+2. Create a new token with the following scopes:
+   - `write:package` - Push container images
+   - `write:repository` - For Claude assistant to push commits
+3. Copy the token and add it as a repository secret
+
+### Repository Variables
+
+Configure these in **Settings → Actions → Variables**:
+
+| Variable | Description | Example | Required By |
+|----------|-------------|---------|-------------|
+| `VITE_GRAPHQL_URI` | GraphQL API endpoint URL | `https://api.fictionarchive.example.com/graphql/` | `release.yml` |
+| `VITE_OIDC_AUTHORITY` | OIDC provider authority URL | `https://auth.example.com/application/o/fiction-archive/` | `release.yml` |
+| `VITE_OIDC_CLIENT_ID` | OIDC client identifier | `your-client-id` | `release.yml` |
+| `VITE_OIDC_REDIRECT_URI` | Post-login redirect URL | `https://fictionarchive.example.com/` | `release.yml` |
+| `VITE_OIDC_POST_LOGOUT_REDIRECT_URI` | Post-logout redirect URL | `https://fictionarchive.example.com/` | `release.yml` |
+
+## Workflow Details
+
+### CI (`build.yml`)
+
+**Trigger:** Push or pull request to `master`
+
+**Jobs:**
+1. `build-backend` - Builds .NET solution and runs tests
+2. `build-frontend` - Builds React application with linting
+
+**Requirements:**
+- .NET 8.0 SDK
+- Node.js 20
+
+**Steps (Backend):**
+1. Checkout repository
+2. Setup .NET 8.0
+3. Restore dependencies
+4. Build solution (Release, with `SkipFusionBuild=true`)
+5. Run tests
+
+**Steps (Frontend):**
+1. Checkout repository
+2. Setup Node.js 20
+3. Install dependencies (`npm ci`)
+4. Run linter (`npm run lint`)
+5. Build application (`npm run build`)
+
+### Build Gateway (`build-gateway.yml`)
+
+**Trigger:**
+- Manual dispatch (`workflow_dispatch`)
+- Push tag matching `v*.*.*`
+
+**Jobs:**
+
+#### 1. `build-subgraphs` (Matrix Job)
+Builds GraphQL subgraph packages for each service:
+
+| Service | Project | Subgraph Name |
+|---------|---------|---------------|
+| novel-service | FictionArchive.Service.NovelService | Novel |
+| translation-service | FictionArchive.Service.TranslationService | Translation |
+| scheduler-service | FictionArchive.Service.SchedulerService | Scheduler |
+| user-service | FictionArchive.Service.UserService | User |
+
+**Note:** File Service and Authentication Service are not subgraphs (no GraphQL schema).
+
+**Steps:**
+1. Checkout repository
+2. Setup .NET 8.0
+3. Install HotChocolate Fusion CLI
+4. Restore and build service project
+5. Export GraphQL schema (`schema export`)
+6. Pack subgraph into `.fsp` file
+7. Upload artifact (retained 30 days)
+
+#### 2. `build-gateway` (Depends on `build-subgraphs`)
+Composes the API gateway from subgraph packages.
+
+**Steps:**
+1. Checkout repository
+2. Setup .NET 8.0 and Fusion CLI
+3. Download all subgraph artifacts
+4. Configure Docker-internal URLs (`http://{service}-service:8080/graphql`)
+5. Compose gateway schema using Fusion CLI
+6. Build gateway project
+7. Build and push Docker image
+
+**Image Tags:**
+- `<registry>/<owner>/fictionarchive-api:latest`
+- `<registry>/<owner>/fictionarchive-api:<commit-sha>`
+
+### Release (`release.yml`)
+
+**Trigger:** Push tag matching `v*.*.*` (e.g., `v1.0.0`)
+
+**Jobs:**
+
+#### 1. `build-and-push` (Matrix Job)
+Builds and pushes all backend service images:
+
+| Service | Dockerfile |
+|---------|------------|
+| novel-service | FictionArchive.Service.NovelService/Dockerfile |
+| user-service | FictionArchive.Service.UserService/Dockerfile |
+| translation-service | FictionArchive.Service.TranslationService/Dockerfile |
+| file-service | FictionArchive.Service.FileService/Dockerfile |
+| scheduler-service | FictionArchive.Service.SchedulerService/Dockerfile |
+| authentication-service | FictionArchive.Service.AuthenticationService/Dockerfile |
+
+#### 2. `build-frontend`
+Builds and pushes the frontend image with environment-specific build arguments.
+
+**Build Args:**
+- `VITE_GRAPHQL_URI`
+- `VITE_OIDC_AUTHORITY`
+- `VITE_OIDC_CLIENT_ID`
+- `VITE_OIDC_REDIRECT_URI`
+- `VITE_OIDC_POST_LOGOUT_REDIRECT_URI`
+
+**Image Tags:**
+- `<registry>/<owner>/fictionarchive-<service>:<version>`
+- `<registry>/<owner>/fictionarchive-<service>:latest`
+
+### Claude PR Assistant (`claude_assistant.yml`)
+
+**Trigger:** Comments or issues containing `@claude`:
+- Issue comments
+- Pull request review comments
+- Pull request reviews
+- New issues (opened or assigned)
+
+**Permissions Required:**
+- `contents: write`
+- `pull-requests: write`
+- `issues: write`
+- `id-token: write`
+
+**Usage:**
+Mention `@claude` in any issue or PR comment to invoke the AI assistant for:
+- Code review assistance
+- Bug analysis
+- Implementation suggestions
+- Documentation help
+
+## Container Registry
+
+Images are pushed to the Gitea Container Registry at:
+```
+<gitea-server-url>/<repository-owner>/fictionarchive-<service>:<tag>
+```
+
+### Image Naming Convention
+
+| Image | Description |
+|-------|-------------|
+| `fictionarchive-api` | API Gateway (GraphQL Federation) |
+| `fictionarchive-novel-service` | Novel Service |
+| `fictionarchive-user-service` | User Service |
+| `fictionarchive-translation-service` | Translation Service |
+| `fictionarchive-file-service` | File Service |
+| `fictionarchive-scheduler-service` | Scheduler Service |
+| `fictionarchive-authentication-service` | Authentication Service |
+| `fictionarchive-frontend` | Web Frontend |
+
+### Pulling Images
+
+```bash
+# Login to registry
+docker login <gitea-server-url> -u <username> -p <token>
+
+# Pull an image
+docker pull <gitea-server-url>/<owner>/fictionarchive-api:latest
+```
+
+## Creating a Release
+
+1. Ensure all changes are committed and pushed to `master`
+2. Create and push a version tag:
+   ```bash
+   git tag v1.0.0
+   git push origin v1.0.0
+   ```
+3. The release workflow will automatically build and push all images
+4. Monitor progress in **Actions** tab
+
+## Troubleshooting
+
+### Build Failures
+
+**"REGISTRY_TOKEN secret not found"**
+- Ensure the `REGISTRY_TOKEN` secret is configured in repository settings
+- Verify the token has `write:package` scope
+
+**"No subgraph artifacts found"**
+- The gateway build requires subgraph artifacts from the `build-subgraphs` job
+- If subgraph builds failed, check the matrix job logs for errors
+
+**"Schema export failed"**
+- Ensure the service project has a valid `subgraph-config.json`
+- Check that the service starts correctly for schema export
+
+### Frontend Build Failures
+
+**"VITE_* variables are empty"**
+- Ensure all required variables are configured in repository settings
+- Variables use `vars.*` context, not `secrets.*`
+
+### Docker Push Failures
+
+**"unauthorized: authentication required"**
+- Verify `REGISTRY_TOKEN` has correct permissions
+- Check that the token hasn't expired
+
+### Claude Assistant Failures
+
+**"Claude assistant not responding"**
+- Verify `CLAUDE_CODE_OAUTH_TOKEN` is configured
+- Verify `CLAUDE_GITEA_TOKEN` is configured and has write permissions
+- Check that the comment contains `@claude` mention
+
+## Local Testing
+
+To test workflows locally before pushing:
+
+```bash
+# Install act (GitHub Actions local runner)
+# Note: act has partial Gitea Actions compatibility
+
+# Run CI workflow
+act push -W .gitea/workflows/build.yml
+
+# Run with specific event
+act push --eventpath .gitea/test-event.json
+```

Documentation/README.md

@@ -0,0 +1,187 @@
+# FictionArchive
+
+A distributed microservices-based web application for managing fiction and novel content. Features include importing from external sources, multi-language translation, file storage, and user management.
+
+## Architecture
+
+FictionArchive uses a GraphQL Fusion gateway pattern to orchestrate multiple domain services with event-driven communication via RabbitMQ.
+More information available in [ARCHITECTURE.md](ARCHITECTURE.md)
+
+## Prerequisites
+
+- .NET SDK 8.0+
+- Node.js 20+
+- Python 3 (for gateway build script)
+- Docker & Docker Compose
+- PostgreSQL 16+
+- RabbitMQ 3+
+
+**Required CLI Tools**
+```bash
+# Hot Chocolate Fusion CLI
+dotnet tool install -g HotChocolate.Fusion.CommandLine
+```
+
+## Getting Started
+
+### Local Development
+
+1. **Clone the repository**
+   ```bash
+   git clone <repository-url>
+   cd FictionArchive
+   ```
+
+2. **Start infrastructure** (PostgreSQL, RabbitMQ)
+   ```bash
+   docker compose up -d postgres rabbitmq
+   ```
+
+3. **Build and run backend**
+   ```bash
+   dotnet restore
+   dotnet build FictionArchive.sln
+
+   # Start services (in separate terminals or use a process manager)
+   dotnet run --project FictionArchive.Service.NovelService
+   dotnet run --project FictionArchive.Service.UserService
+   dotnet run --project FictionArchive.Service.TranslationService
+   dotnet run --project FictionArchive.Service.FileService
+   dotnet run --project FictionArchive.Service.SchedulerService
+   dotnet run --project FictionArchive.Service.AuthenticationService
+
+   # Start the gateway (builds fusion schema automatically)
+   dotnet run --project FictionArchive.API
+   ```
+
+4. **Build and run frontend**
+   ```bash
+   cd fictionarchive-web
+   npm install
+   npm run codegen    # Generate GraphQL types
+   npm run dev        # Start dev server at http://localhost:5173
+   ```
+
+### Docker Deployment
+
+1. **Create environment file**
+   ```bash
+   cp .env.example .env
+   # Edit .env with your configuration
+   ```
+
+2. **Start all services**
+   ```bash
+   docker compose up -d
+   ```
+
+## Configuration
+
+### Environment Variables
+
+Create a `.env` file in the project root:
+
+```bash
+# PostgreSQL
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=your-secure-password
+
+# RabbitMQ
+RABBITMQ_USER=guest
+RABBITMQ_PASSWORD=your-secure-password
+
+# External Services
+NOVELPIA_USERNAME=your-username
+NOVELPIA_PASSWORD=your-password
+DEEPL_API_KEY=your-api-key
+
+# S3 Storage
+S3_ENDPOINT=https://s3.example.com
+S3_BUCKET=fictionarchive
+S3_ACCESS_KEY=your-access-key
+S3_SECRET_KEY=your-secret-key
+
+# OIDC Authentication
+OIDC_AUTHORITY=https://auth.example.com/application/o/fiction-archive/
+OIDC_CLIENT_ID=your-client-id
+```
+
+### Frontend Environment
+
+Create `fictionarchive-web/.env.local`:
+
+```bash
+VITE_GRAPHQL_URI=http://localhost:5234/graphql/
+VITE_OIDC_AUTHORITY=https://auth.example.com/application/o/fiction-archive/
+VITE_OIDC_CLIENT_ID=your-client-id
+VITE_OIDC_REDIRECT_URI=http://localhost:5173/
+VITE_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:5173/
+```
+
+## Building the GraphQL Gateway
+
+The API gateway uses Hot Chocolate Fusion to compose schemas from all subgraphs. The gateway schema is rebuilt automatically when building the API project.
+
+**Manual rebuild:**
+```bash
+cd FictionArchive.API
+python build_gateway.py
+```
+
+**Skip specific services** by adding them to `FictionArchive.API/gateway_skip.txt`:
+```
+FictionArchive.Service.NovelService.Tests
+```
+
+## CI/CD
+
+The project uses Gitea Actions with the following workflows:
+
+| Workflow | Trigger | Description |
+|----------|---------|-------------|
+| `build.yml` | Push/PR to master | CI checks - builds and tests |
+| `build-subgraphs.yml` | Service changes on master | Builds subgraph `.fsp` packages |
+| `build-gateway.yml` | Gateway changes or subgraph builds | Composes gateway and builds Docker image |
+| `release.yml` | Tag `v*.*.*` | Builds and pushes all Docker images |
+
+### Release Process
+
+```bash
+git tag v1.0.0
+git push origin v1.0.0
+```
+
+## Project Structure
+
+```
+FictionArchive/
+├── FictionArchive.sln
+├── FictionArchive.Common/              # Shared enums and extensions
+├── FictionArchive.Service.Shared/      # Shared infrastructure (EventBus, DB)
+├── FictionArchive.API/                 # GraphQL Fusion Gateway
+├── FictionArchive.Service.NovelService/
+├── FictionArchive.Service.UserService/
+├── FictionArchive.Service.TranslationService/
+├── FictionArchive.Service.FileService/
+├── FictionArchive.Service.SchedulerService/
+├── FictionArchive.Service.AuthenticationService/
+├── FictionArchive.Service.NovelService.Tests/
+├── fictionarchive-web/                 # React frontend
+├── docker-compose.yml
+└── .gitea/workflows/                   # CI/CD workflows
+```
+
+## Testing
+
+```bash
+# Run all tests
+dotnet test FictionArchive.sln
+
+# Run specific test project
+dotnet test FictionArchive.Service.NovelService.Tests
+```
+
+## Documentation
+
+- [ARCHITECTURE.md](ARCHITECTURE.md) - Detailed architecture documentation
+- [AGENTS.md](AGENTS.md) - Development guidelines and coding standards

FictionArchive.API/Dockerfile

@@ -7,15 +7,23 @@ EXPOSE 8081
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ARG BUILD_CONFIGURATION=Release
 WORKDIR /src
+
 COPY ["FictionArchive.API/FictionArchive.API.csproj", "FictionArchive.API/"]
+COPY ["FictionArchive.Common/FictionArchive.Common.csproj", "FictionArchive.Common/"]
+COPY ["FictionArchive.Service.Shared/FictionArchive.Service.Shared.csproj", "FictionArchive.Service.Shared/"]
 RUN dotnet restore "FictionArchive.API/FictionArchive.API.csproj"
-COPY . .
+
+COPY FictionArchive.API/ FictionArchive.API/
+COPY FictionArchive.Common/ FictionArchive.Common/
+COPY FictionArchive.Service.Shared/ FictionArchive.Service.Shared/
+
 WORKDIR "/src/FictionArchive.API"
-RUN dotnet build "./FictionArchive.API.csproj" -c $BUILD_CONFIGURATION -o /app/build
+# Skip fusion build - gateway.fgp should be pre-composed in CI
+RUN dotnet build "./FictionArchive.API.csproj" -c $BUILD_CONFIGURATION -o /app/build -p:SkipFusionBuild=true
 
 FROM build AS publish
 ARG BUILD_CONFIGURATION=Release
-RUN dotnet publish "./FictionArchive.API.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
+RUN dotnet publish "./FictionArchive.API.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false /p:SkipFusionBuild=true
 
 FROM base AS final
 WORKDIR /app

FictionArchive.API/FictionArchive.API.csproj

@@ -13,6 +13,7 @@
         <PackageReference Include="HotChocolate.Data.EntityFramework" Version="15.1.11" />
         <PackageReference Include="HotChocolate.Fusion" Version="15.1.11" />
         <PackageReference Include="HotChocolate.Types.Scalars" Version="15.1.11" />
+        <PackageReference Include="Microsoft.AspNetCore.HeaderPropagation" Version="8.0.22" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.11">
           <PrivateAssets>all</PrivateAssets>
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -20,11 +21,12 @@
         <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="9.0.11" />
         <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="8.0.7" />
         <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2"/>
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.11" />
     </ItemGroup>
     
-    <!-- Builds the Fusion graph file before building the application itself -->
-    <Target Name="RunFusionBuild" BeforeTargets="BeforeBuild">
-        <Exec Command="python build_gateway.py" WorkingDirectory="$(ProjectDir)" />
+    <!-- Builds the Fusion graph file before building the application itself (skipped in CI) -->
+    <Target Name="RunFusionBuild" BeforeTargets="BeforeBuild" Condition="'$(SkipFusionBuild)' != 'true'">
+        <Exec Command="python build_gateway.py $(FusionBuildArgs)" WorkingDirectory="$(ProjectDir)" />
     </Target>
 
     <ItemGroup>

FictionArchive.API/Program.cs

@@ -12,7 +12,11 @@ public class Program
         
         #region Fusion Gateway
 
-        builder.Services.AddHttpClient("Fusion");
+        builder.Services.AddHttpClient("Fusion")
+            .AddHeaderPropagation(opt =>
+            {
+                opt.Headers.Add("Authorization");
+            });
 
         builder.Services
             .AddFusionGatewayServer()
@@ -21,14 +25,31 @@ public class Program
         
         #endregion
         
+        // Add authentication
+        builder.Services.AddOidcAuthentication(builder.Configuration);
+        
+        builder.Services.AddCors(options =>
+        {
+            options.AddPolicy("AllowFictionArchiveOrigins",
+                policyBuilder =>
+                {
+                    policyBuilder.WithOrigins("https://fictionarchive.orfl.xyz", "http://localhost:5173")
+                        .AllowAnyMethod()
+                        .AllowAnyHeader()
+                        .AllowCredentials();
+                });
+        });
+
         var app = builder.Build();
 
-        app.UseHttpsRedirection();
+        app.UseCors("AllowFictionArchiveOrigins");
         
         app.MapHealthChecks("/healthz");
 
+        app.UseHeaderPropagation();
+
         app.MapGraphQL();
 
-        app.Run();
+        app.RunWithGraphQLCommands(args);
     }
 }

FictionArchive.API/appsettings.json

@@ -5,5 +5,15 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "fictionarchive-api",
+    "Audience": "fictionarchive-api",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  }
 }

FictionArchive.API/build_gateway.py

@@ -1,12 +1,22 @@
 #!/usr/bin/env python3
+"""
+Local development script for building the Fusion gateway.
+
+This script is used for local development only. In CI/CD, subgraphs are built
+separately and the gateway is composed from pre-built .fsp artifacts.
+
+Usage:
+    python build_gateway.py
+
+Requirements:
+    - .NET 8.0 SDK
+    - HotChocolate Fusion CLI (dotnet tool install -g HotChocolate.Fusion.CommandLine)
+"""
 import subprocess
 import sys
 import os
 from pathlib import Path
 
-# ----------------------------------------
-# Helpers
-# ----------------------------------------
 
 def run(cmd, cwd=None):
     """Run a command and exit on failure."""
@@ -19,7 +29,7 @@ def run(cmd, cwd=None):
 
 def load_skip_list(skip_file: Path):
     if not skip_file.exists():
-        print(f"WARNING: skip-projects.txt not found at {skip_file}")
+        print(f"WARNING: gateway_skip.txt not found at {skip_file}")
         return set()
 
     lines = skip_file.read_text().splitlines()
@@ -53,7 +63,7 @@ print("----------------------------------------")
 
 service_dirs = [
     d for d in services_dir.glob("FictionArchive.Service.*")
-    if d.is_dir()
+    if d.is_dir() and (d / "subgraph-config.json").exists()
 ]
 
 selected_services = []

FictionArchive.API/gateway_skip.txt

@@ -2,3 +2,4 @@
 FictionArchive.Service.Shared
 FictionArchive.Service.AuthenticationService
 FictionArchive.Service.FileService
+FictionArchive.Service.NovelService.Tests

FictionArchive.Common/FictionArchive.Common.csproj

@@ -9,14 +9,8 @@
     <ItemGroup>
       <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="9.0.11" />
       <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="9.0.11" />
+      <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.0" />
       <PackageReference Include="NodaTime" Version="3.2.2" />
     </ItemGroup>
 
-    <ItemGroup>
-      <Reference Include="Microsoft.Extensions.Configuration.Abstractions" />
-      <Reference Include="Microsoft.Extensions.Hosting.Abstractions">
-        <HintPath>..\..\..\..\..\..\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.15\Microsoft.Extensions.Hosting.Abstractions.dll</HintPath>
-      </Reference>
-    </ItemGroup>
-
 </Project>

FictionArchive.Service.FileService/Controllers/S3ProxyController.cs

@@ -2,6 +2,7 @@ using System.Web;
 using Amazon.S3;
 using Amazon.S3.Model;
 using FictionArchive.Service.FileService.Models;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
@@ -10,6 +11,7 @@ namespace FictionArchive.Service.FileService.Controllers
 {
     [Route("api/{*path}")]
     [ApiController]
+    [Authorize]
     public class S3ProxyController : ControllerBase
     {
         private readonly AmazonS3Client _amazonS3Client;

FictionArchive.Service.FileService/Dockerfile

@@ -7,17 +7,17 @@ EXPOSE 8081
 FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 ARG BUILD_CONFIGURATION=Release
 WORKDIR /src
-COPY ["FictionArchive.Service.ImageService/FictionArchive.Service.ImageService.csproj", "FictionArchive.Service.ImageService/"]
-RUN dotnet restore "FictionArchive.Service.ImageService/FictionArchive.Service.ImageService.csproj"
+COPY ["FictionArchive.Service.FileService/FictionArchive.Service.FileService.csproj", "FictionArchive.Service.FileService/"]
+RUN dotnet restore "FictionArchive.Service.FileService/FictionArchive.Service.FileService.csproj"
 COPY . .
-WORKDIR "/src/FictionArchive.Service.ImageService"
-RUN dotnet build "./FictionArchive.Service.ImageService.csproj" -c $BUILD_CONFIGURATION -o /app/build
+WORKDIR "/src/FictionArchive.Service.FileService"
+RUN dotnet build "./FictionArchive.Service.FileService.csproj" -c $BUILD_CONFIGURATION -o /app/build
 
 FROM build AS publish
 ARG BUILD_CONFIGURATION=Release
-RUN dotnet publish "./FictionArchive.Service.ImageService.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
+RUN dotnet publish "./FictionArchive.Service.FileService.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false
 
 FROM base AS final
 WORKDIR /app
 COPY --from=publish /app/publish .
-ENTRYPOINT ["dotnet", "FictionArchive.Service.ImageService.dll"]
+ENTRYPOINT ["dotnet", "FictionArchive.Service.FileService.dll"]

FictionArchive.Service.FileService/FictionArchive.Service.FileService.csproj

@@ -21,6 +21,7 @@
       <PackageReference Include="AWSSDK.S3" Version="4.0.13.1" />
       <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="9.0.0" />
       <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
+      <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.11" />
     </ItemGroup>
 
     <ItemGroup>

FictionArchive.Service.FileService/Program.cs

@@ -34,6 +34,10 @@ public class Program
         
         #endregion
         
+        // Add authentication with cookie support
+        builder.Services.AddOidcCookieAuthentication(builder.Configuration);
+        builder.Services.AddFictionArchiveAuthorization();
+        
         builder.Services.Configure<ProxyConfiguration>(builder.Configuration.GetSection("ProxyConfiguration"));
         
         // Add S3 Client
@@ -60,6 +64,9 @@ public class Program
             app.UseSwaggerUI();
         }
 
+        app.UseAuthentication();
+        app.UseAuthorization();
+        
         app.MapHealthChecks("/healthz");
         
         app.MapControllers();

FictionArchive.Service.FileService/appsettings.json

@@ -18,5 +18,15 @@
     "AccessKey": "REPLACE_ME",
     "SecretKey": "REPLACE_ME"
   },
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "fictionarchive-files",
+    "Audience": "fictionarchive-api",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  },
   "AllowedHosts": "*"
 }

FictionArchive.Service.NovelService/GraphQL/Mutation.cs

@@ -6,32 +6,24 @@ using FictionArchive.Service.NovelService.Models.SourceAdapters;
 using FictionArchive.Service.NovelService.Services;
 using FictionArchive.Service.NovelService.Services.SourceAdapters;
 using FictionArchive.Service.Shared.Services.EventBus;
+using HotChocolate.Authorization;
 using Microsoft.EntityFrameworkCore;
 
 namespace FictionArchive.Service.NovelService.GraphQL;
 
 public class Mutation
 {
-    public async Task<NovelUpdateRequestedEvent> ImportNovel(string novelUrl, IEventBus eventBus)
+    [Authorize]
+    public async Task<NovelUpdateRequestedEvent> ImportNovel(string novelUrl, NovelUpdateService service)
     {
-        var importNovelRequestEvent = new NovelUpdateRequestedEvent()
-        {
-            NovelUrl = novelUrl
-        };
-        await eventBus.Publish(importNovelRequestEvent);
-        return importNovelRequestEvent;
+        return await service.QueueNovelImport(novelUrl);
     }
 
+    [Authorize]
     public async Task<ChapterPullRequestedEvent> FetchChapterContents(uint novelId,
         uint chapterNumber,
-        IEventBus eventBus)
+        NovelUpdateService service)
     {
-        var chapterPullEvent = new ChapterPullRequestedEvent()
-        {
-            NovelId = novelId,
-            ChapterNumber = chapterNumber
-        };
-        await eventBus.Publish(chapterPullEvent);
-        return chapterPullEvent;
+        return await service.QueueChapterPull(novelId, chapterNumber);
     }
 }

FictionArchive.Service.NovelService/GraphQL/Query.cs

@@ -1,5 +1,6 @@
 using FictionArchive.Service.NovelService.Models.Novels;
 using FictionArchive.Service.NovelService.Services;
+using HotChocolate.Authorization;
 using HotChocolate.Data;
 using HotChocolate.Types;
 
@@ -7,6 +8,7 @@ namespace FictionArchive.Service.NovelService.GraphQL;
 
 public class Query
 {
+    [Authorize]
     [UsePaging]
     [UseProjection]
     [UseFiltering]

FictionArchive.Service.NovelService/Program.cs

@@ -6,6 +6,7 @@ using FictionArchive.Service.NovelService.Services;
 using FictionArchive.Service.NovelService.Services.EventHandlers;
 using FictionArchive.Service.NovelService.Services.SourceAdapters;
 using FictionArchive.Service.NovelService.Services.SourceAdapters.Novelpia;
+using FictionArchive.Service.Shared;
 using FictionArchive.Service.Shared.Extensions;
 using FictionArchive.Service.Shared.Services.EventBus.Implementations;
 using FictionArchive.Service.Shared.Services.GraphQL;
@@ -17,6 +18,8 @@ public class Program
 {
     public static void Main(string[] args)
     {
+        var isSchemaExport = SchemaExportDetector.IsSchemaExportMode(args);
+
         var builder = WebApplication.CreateBuilder(args);
         builder.AddLocalAppsettings();
         
@@ -24,6 +27,8 @@ public class Program
         
         #region Event Bus
 
+        if (!isSchemaExport)
+        {
             builder.Services.AddRabbitMQ(opt =>
             {
                 builder.Configuration.GetSection("RabbitMQ").Bind(opt);
@@ -32,18 +37,22 @@ public class Program
                 .Subscribe<NovelUpdateRequestedEvent, NovelUpdateRequestedEventHandler>()
                 .Subscribe<ChapterPullRequestedEvent, ChapterPullRequestedEventHandler>()
                 .Subscribe<FileUploadRequestStatusUpdateEvent, FileUploadRequestStatusUpdateEventHandler>();
+        }
 
         #endregion
         
         #region GraphQL
 
-        builder.Services.AddDefaultGraphQl<Query, Mutation>();
+        builder.Services.AddDefaultGraphQl<Query, Mutation>()
+            .AddAuthorization();
         
         #endregion
         
         #region Database
 
-        builder.Services.RegisterDbContext<NovelServiceDbContext>(builder.Configuration.GetConnectionString("DefaultConnection"));
+        builder.Services.RegisterDbContext<NovelServiceDbContext>(
+            builder.Configuration.GetConnectionString("DefaultConnection"),
+            skipInfrastructure: isSchemaExport);
         
         #endregion
         
@@ -67,11 +76,16 @@ public class Program
         
         builder.Services.AddHealthChecks();
 
+        // Authentication & Authorization
+        builder.Services.AddOidcAuthentication(builder.Configuration);
+        builder.Services.AddFictionArchiveAuthorization();
+
         var app = builder.Build();
         
-        // Update database
-        using (var scope = app.Services.CreateScope())
+        // Update database (skip in schema export mode)
+        if (!isSchemaExport)
         {
+            using var scope = app.Services.CreateScope();
             var dbContext = scope.ServiceProvider.GetRequiredService<NovelServiceDbContext>();
             dbContext.UpdateDatabase();
         }
@@ -80,6 +94,9 @@ public class Program
 
         app.MapHealthChecks("/healthz");
 
+        app.UseAuthentication();
+        app.UseAuthorization();
+
         app.MapGraphQL();
 
         app.RunWithGraphQLCommands(args);

FictionArchive.Service.NovelService/Services/NovelUpdateService.cs

@@ -2,6 +2,7 @@ using FictionArchive.Service.FileService.IntegrationEvents;
 using FictionArchive.Service.NovelService.Models.Configuration;
 using FictionArchive.Service.NovelService.Models.Enums;
 using FictionArchive.Service.NovelService.Models.Images;
+using FictionArchive.Service.NovelService.Models.IntegrationEvents;
 using FictionArchive.Service.NovelService.Models.Localization;
 using FictionArchive.Service.NovelService.Models.Novels;
 using FictionArchive.Service.NovelService.Models.SourceAdapters;
@@ -201,4 +202,25 @@ public class NovelUpdateService
         
         await _dbContext.SaveChangesAsync();
     }
+
+    public async Task<NovelUpdateRequestedEvent> QueueNovelImport(string novelUrl)
+    {
+        var importNovelRequestEvent = new NovelUpdateRequestedEvent()
+        {
+            NovelUrl = novelUrl
+        };
+        await _eventBus.Publish(importNovelRequestEvent);
+        return importNovelRequestEvent;
+    }
+
+    public async Task<ChapterPullRequestedEvent> QueueChapterPull(uint novelId, uint chapterNumber)
+    {
+        var chapterPullEvent = new ChapterPullRequestedEvent()
+        {
+            NovelId = novelId,
+            ChapterNumber = chapterNumber
+        };
+        await _eventBus.Publish(chapterPullEvent);
+        return chapterPullEvent;
+    }
 }

FictionArchive.Service.NovelService/appsettings.json

@@ -19,5 +19,15 @@
     "ConnectionString": "amqp://localhost",
     "ClientIdentifier": "NovelService"
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "ldi5IpEidq2WW0Ka1lehVskb2SOBjnYRaZCpEyBh",
+    "Audience": "ldi5IpEidq2WW0Ka1lehVskb2SOBjnYRaZCpEyBh",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  }
 }

FictionArchive.Service.NovelService/subgraph-config.json

@@ -1,6 +1,6 @@
 {
   "subgraph": "Novels",
   "http": {
-    "baseAddress": "http://localhost:5101/graphql"
+    "baseAddress": "https://localhost:7208/graphql"
   }
 }

FictionArchive.Service.SchedulerService/GraphQL/Mutation.cs

@@ -1,6 +1,8 @@
 using System.Data;
 using FictionArchive.Service.SchedulerService.Models;
 using FictionArchive.Service.SchedulerService.Services;
+using FictionArchive.Service.Shared.Constants;
+using HotChocolate.Authorization;
 using HotChocolate.Types;
 using Quartz;
 
@@ -10,18 +12,21 @@ public class Mutation
 {
     [Error<DuplicateNameException>]
     [Error<FormatException>]
+    [Authorize(Roles = [AuthorizationConstants.Roles.Admin])]
     public async Task<SchedulerJob> ScheduleEventJob(string key, string description, string eventType, string eventData, string cronSchedule, JobManagerService jobManager)
     {
         return await jobManager.ScheduleEventJob(key, description, eventType, eventData, cronSchedule);
     }
 
     [Error<JobPersistenceException>]
+    [Authorize(Roles = [AuthorizationConstants.Roles.Admin])]
     public async Task<bool> RunJob(string jobKey, JobManagerService jobManager)
     {
         return await jobManager.TriggerJob(jobKey);
     }
 
     [Error<KeyNotFoundException>]
+    [Authorize(Roles = [AuthorizationConstants.Roles.Admin])]
     public async Task<bool> DeleteJob(string jobKey, JobManagerService jobManager)
     {
         bool deleted = await jobManager.DeleteJob(jobKey);

FictionArchive.Service.SchedulerService/Program.cs

@@ -1,5 +1,6 @@
 using FictionArchive.Service.SchedulerService.GraphQL;
 using FictionArchive.Service.SchedulerService.Services;
+using FictionArchive.Service.Shared;
 using FictionArchive.Service.Shared.Extensions;
 using FictionArchive.Service.Shared.Services.EventBus.Implementations;
 using Quartz;
@@ -11,30 +12,52 @@ public class Program
 {
     public static void Main(string[] args)
     {
+        var isSchemaExport = SchemaExportDetector.IsSchemaExportMode(args);
+
         var builder = WebApplication.CreateBuilder(args);
         
         // Services
-        builder.Services.AddDefaultGraphQl<Query, Mutation>();
+        builder.Services.AddDefaultGraphQl<Query, Mutation>()
+            .AddAuthorization();
         builder.Services.AddHealthChecks();
         builder.Services.AddTransient<JobManagerService>();
 
+        // Authentication & Authorization
+        builder.Services.AddOidcAuthentication(builder.Configuration);
+        builder.Services.AddFictionArchiveAuthorization();
+
         #region Database
         
-        builder.Services.RegisterDbContext<SchedulerServiceDbContext>(builder.Configuration.GetConnectionString("DefaultConnection"));
+        builder.Services.RegisterDbContext<SchedulerServiceDbContext>(
+            builder.Configuration.GetConnectionString("DefaultConnection"),
+            skipInfrastructure: isSchemaExport);
         
         #endregion
         
         #region Event Bus
 
+        if (!isSchemaExport)
+        {
             builder.Services.AddRabbitMQ(opt =>
             {
                 builder.Configuration.GetSection("RabbitMQ").Bind(opt);
             });
+        }
 
         #endregion
         
         #region Quartz
 
+        if (isSchemaExport)
+        {
+            // Schema export mode: use in-memory store (no DB connection needed)
+            builder.Services.AddQuartz(opt =>
+            {
+                opt.UseInMemoryStore();
+            });
+        }
+        else
+        {
             builder.Services.AddQuartz(opt =>
             {
                 opt.UsePersistentStore(pso =>
@@ -52,13 +75,16 @@ public class Program
             {
                 opt.WaitForJobsToComplete = true;
             });
+        }
 
         #endregion
         
         var app = builder.Build();
         
-        using (var scope = app.Services.CreateScope())
+        // Update database (skip in schema export mode)
+        if (!isSchemaExport)
         {
+            using var scope = app.Services.CreateScope();
             var dbContext = scope.ServiceProvider.GetRequiredService<SchedulerServiceDbContext>();
             dbContext.UpdateDatabase();
         }
@@ -67,6 +93,9 @@ public class Program
 
         app.MapHealthChecks("/healthz");
 
+        app.UseAuthentication();
+        app.UseAuthorization();
+
         app.MapGraphQL();
         
         app.RunWithGraphQLCommands(args);

FictionArchive.Service.SchedulerService/appsettings.json

@@ -12,5 +12,15 @@
   "ConnectionStrings": {
     "DefaultConnection": "Host=localhost;Database=FictionArchive_SchedulerService;Username=postgres;password=postgres"
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "fictionarchive-api",
+    "Audience": "fictionarchive-api",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  }
 }

FictionArchive.Service.Shared/Constants/AuthorizationConstants.cs

@@ -0,0 +1,15 @@
+namespace FictionArchive.Service.Shared.Constants;
+
+public static class AuthorizationConstants
+{
+    public static class Roles
+    {
+        public const string Admin = "admin";
+    }
+
+    public static class Policies
+    {
+        public const string Admin = "Admin";
+        public const string User = "User";
+    }
+}

FictionArchive.Service.Shared/Extensions/AuthenticationExtensions.cs

@@ -0,0 +1,168 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using Microsoft.IdentityModel.Tokens;
+using FictionArchive.Service.Shared.Constants;
+using FictionArchive.Service.Shared.Models.Authentication;
+using System.Linq;
+
+namespace FictionArchive.Service.Shared.Extensions;
+
+public static class AuthenticationExtensions
+{
+    public static IServiceCollection AddOidcAuthentication(this IServiceCollection services, IConfiguration configuration)
+    {
+        var oidcConfig = configuration.GetSection("OIDC").Get<OidcConfiguration>();
+        
+        if (oidcConfig == null)
+        {
+            throw new InvalidOperationException("OIDC configuration is required but not found in app settings");
+        }
+        
+        ValidateOidcConfiguration(oidcConfig);
+
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
+            {
+                options.Authority = oidcConfig.Authority;
+                options.Audience = oidcConfig.Audience;
+                options.RequireHttpsMetadata = !string.IsNullOrEmpty(oidcConfig.Authority) && oidcConfig.Authority.StartsWith("https://");
+
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = oidcConfig.ValidateIssuer,
+                    ValidIssuer = oidcConfig.ValidIssuer,
+                    ValidateAudience = oidcConfig.ValidateAudience,
+                    ValidateLifetime = oidcConfig.ValidateLifetime,
+                    ValidateIssuerSigningKey = oidcConfig.ValidateIssuerSigningKey,
+                    ClockSkew = TimeSpan.FromMinutes(5)
+                };
+
+                options.Events = CreateLoggingJwtBearerEvents();
+            });
+
+        return services;
+    }
+
+    private static JwtBearerEvents CreateLoggingJwtBearerEvents(JwtBearerEvents? existingEvents = null)
+    {
+        return new JwtBearerEvents
+        {
+            OnMessageReceived = existingEvents?.OnMessageReceived ?? (_ => Task.CompletedTask),
+            OnAuthenticationFailed = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogWarning(context.Exception, "JWT authentication failed: {Message}", context.Exception.Message);
+
+                return existingEvents?.OnAuthenticationFailed?.Invoke(context) ?? Task.CompletedTask;
+            },
+            OnChallenge = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogDebug(
+                    "JWT challenge issued. Error: {Error}, ErrorDescription: {ErrorDescription}",
+                    context.Error,
+                    context.ErrorDescription);
+
+                return existingEvents?.OnChallenge?.Invoke(context) ?? Task.CompletedTask;
+            },
+            OnTokenValidated = context =>
+            {
+                var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>()
+                    .CreateLogger("JwtBearerAuthentication");
+
+                logger.LogDebug(
+                    "JWT token validated for subject: {Subject}",
+                    context.Principal?.FindFirst("sub")?.Value ?? "unknown");
+
+                return existingEvents?.OnTokenValidated?.Invoke(context) ?? Task.CompletedTask;
+            }
+        };
+    }
+
+    public static IServiceCollection AddOidcCookieAuthentication(this IServiceCollection services, IConfiguration configuration, string cookieName = "fa_session")
+    {
+        var oidcConfig = configuration.GetSection("OIDC").Get<OidcConfiguration>();
+        
+        if (oidcConfig == null)
+        {
+            throw new InvalidOperationException("OIDC configuration is required but not found in app settings");
+        }
+        
+        ValidateOidcConfiguration(oidcConfig);
+
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
+            {
+                options.Authority = oidcConfig.Authority;
+                options.Audience = oidcConfig.Audience;
+                options.RequireHttpsMetadata = !string.IsNullOrEmpty(oidcConfig.Authority) && oidcConfig.Authority.StartsWith("https://");
+
+                var cookieEvents = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        // Try to get token from cookie first, then from Authorization header
+                        if (context.Request.Cookies.ContainsKey(cookieName))
+                        {
+                            context.Token = context.Request.Cookies[cookieName];
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+                options.Events = CreateLoggingJwtBearerEvents(cookieEvents);
+
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = oidcConfig.ValidateIssuer,
+                    ValidIssuer = oidcConfig.ValidIssuer,
+                    ValidateAudience = oidcConfig.ValidateAudience,
+                    ValidateLifetime = oidcConfig.ValidateLifetime,
+                    ValidateIssuerSigningKey = oidcConfig.ValidateIssuerSigningKey,
+                    ClockSkew = TimeSpan.FromMinutes(5)
+                };
+            });
+
+        return services;
+    }
+
+    public static IServiceCollection AddFictionArchiveAuthorization(this IServiceCollection services)
+    {
+        services.AddAuthorizationBuilder()
+            .AddPolicy(AuthorizationConstants.Policies.Admin, policy => policy.RequireRole(AuthorizationConstants.Roles.Admin))
+            .AddPolicy(AuthorizationConstants.Policies.User, policy => policy.RequireAuthenticatedUser());
+
+        return services;
+    }
+
+    private static void ValidateOidcConfiguration(OidcConfiguration config)
+    {
+        var errors = new List<string>();
+
+        if (string.IsNullOrWhiteSpace(config.Authority))
+            errors.Add("OIDC Authority is required");
+
+        if (string.IsNullOrWhiteSpace(config.ClientId))
+            errors.Add("OIDC ClientId is required");
+
+        if (string.IsNullOrWhiteSpace(config.Audience))
+            errors.Add("OIDC Audience is required");
+
+        if (!Uri.TryCreate(config.Authority, UriKind.Absolute, out var authorityUri))
+            errors.Add($"OIDC Authority '{config.Authority}' is not a valid URI");
+        else if (!authorityUri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase) && 
+                 !authorityUri.Host.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+            errors.Add("OIDC Authority must use HTTPS unless running on localhost");
+
+        if (errors.Any())
+        {
+            throw new InvalidOperationException($"OIDC configuration validation failed:{Environment.NewLine}{string.Join(Environment.NewLine, errors)}");
+        }
+    }
+}

FictionArchive.Service.Shared/Extensions/DatabaseExtensions.cs

@@ -6,8 +6,20 @@ namespace FictionArchive.Service.Shared.Extensions;
 
 public static class DatabaseExtensions
 {
-    public static IServiceCollection RegisterDbContext<TContext>(this IServiceCollection services,
-        string connectionString) where TContext : FictionArchiveDbContext
+    public static IServiceCollection RegisterDbContext<TContext>(
+        this IServiceCollection services,
+        string connectionString,
+        bool skipInfrastructure = false) where TContext : FictionArchiveDbContext
+    {
+        if (skipInfrastructure)
+        {
+            // For schema export: use in-memory provider to allow EF Core entity discovery
+            services.AddDbContext<TContext>(options =>
+            {
+                options.UseInMemoryDatabase($"SchemaExport_{typeof(TContext).Name}");
+            });
+        }
+        else
         {
             services.AddDbContext<TContext>(options =>
             {
@@ -16,6 +28,7 @@ public static class DatabaseExtensions
                     o.UseNodaTime();
                 });
             });
+        }
         return services;
     }
 }

FictionArchive.Service.Shared/FictionArchive.Service.Shared.csproj

@@ -9,6 +9,7 @@
     <ItemGroup>
         <PackageReference Include="GraphQL.Server.Ui.GraphiQL" Version="8.3.3" />
         <PackageReference Include="HotChocolate.AspNetCore" Version="15.1.11" />
+        <PackageReference Include="HotChocolate.AspNetCore.Authorization" Version="15.1.11" />
         <PackageReference Include="HotChocolate.AspNetCore.CommandLine" Version="15.1.11" />
         <PackageReference Include="HotChocolate.Data.EntityFramework" Version="15.1.11" />
         <PackageReference Include="HotChocolate.Types.Scalars" Version="15.1.11" />
@@ -18,6 +19,7 @@
             <PrivateAssets>all</PrivateAssets>
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
+        <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="9.0.11" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="9.0.11" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="9.0.11">
             <PrivateAssets>all</PrivateAssets>
@@ -28,6 +30,7 @@
         <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
         <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL.NodaTime" Version="9.0.4" />
         <PackageReference Include="RabbitMQ.Client" Version="7.2.0" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.11" />
     </ItemGroup>
     
     <ItemGroup>

FictionArchive.Service.Shared/Models/Authentication/OidcConfiguration.cs

@@ -0,0 +1,13 @@
+namespace FictionArchive.Service.Shared.Models.Authentication;
+
+public class OidcConfiguration
+{
+    public string Authority { get; set; } = string.Empty;
+    public string ClientId { get; set; } = string.Empty;
+    public string Audience { get; set; } = string.Empty;
+    public string? ValidIssuer { get; set; }
+    public bool ValidateIssuer { get; set; } = true;
+    public bool ValidateAudience { get; set; } = true;
+    public bool ValidateLifetime { get; set; } = true;
+    public bool ValidateIssuerSigningKey { get; set; } = true;
+}

FictionArchive.Service.Shared/SchemaExportDetector.cs

@@ -0,0 +1,22 @@
+namespace FictionArchive.Service.Shared;
+
+/// <summary>
+/// Detects if the application is running in schema export mode (for HotChocolate CLI commands).
+/// In this mode, infrastructure like RabbitMQ and databases should not be initialized.
+/// </summary>
+public static class SchemaExportDetector
+{
+    /// <summary>
+    /// Checks if the current run is a schema export command.
+    /// </summary>
+    /// <param name="args">Command line arguments passed to Main()</param>
+    /// <returns>True if running schema export, false otherwise</returns>
+    public static bool IsSchemaExportMode(string[] args)
+    {
+        // HotChocolate CLI pattern: "schema export" after "--" delimiter
+        // Handles: dotnet run -- schema export --output schema.graphql
+        var normalizedArgs = args.SkipWhile(a => a == "--").ToArray();
+        return normalizedArgs.Length > 0 &&
+               normalizedArgs[0].Equals("schema", StringComparison.OrdinalIgnoreCase);
+    }
+}

FictionArchive.Service.TranslationService/GraphQL/Mutation.cs

@@ -5,11 +5,13 @@ using FictionArchive.Service.TranslationService.Models.Enums;
 using FictionArchive.Service.TranslationService.Services;
 using FictionArchive.Service.TranslationService.Services.Database;
 using FictionArchive.Service.TranslationService.Services.TranslationEngines;
+using HotChocolate.Authorization;
 
 namespace FictionArchive.Service.TranslationService.GraphQL;
 
 public class Mutation
 {
+    [Authorize]
     public async Task<TranslationResult> TranslateText(string text, Language from, Language to, string translationEngineKey, TranslationEngineService translationEngineService)
     {
         var result = await translationEngineService.Translate(from, to, text, translationEngineKey);

FictionArchive.Service.TranslationService/GraphQL/Query.cs

@@ -2,12 +2,14 @@ using FictionArchive.Service.TranslationService.Models;
 using FictionArchive.Service.TranslationService.Models.Database;
 using FictionArchive.Service.TranslationService.Services.Database;
 using FictionArchive.Service.TranslationService.Services.TranslationEngines;
+using HotChocolate.Authorization;
 using Microsoft.EntityFrameworkCore;
 
 namespace FictionArchive.Service.TranslationService.GraphQL;
 
 public class Query
 {
+    [Authorize]
     [UseFiltering]
     [UseSorting]
     public IEnumerable<TranslationEngineDescriptor> GetTranslationEngines(IEnumerable<ITranslationEngine> engines)
@@ -15,6 +17,7 @@ public class Query
         return engines.Select(engine => engine.Descriptor);
     }
 
+    [Authorize]
     [UsePaging]
     [UseProjection]
     [UseFiltering]

FictionArchive.Service.TranslationService/Program.cs

@@ -1,5 +1,6 @@
 using DeepL;
 using FictionArchive.Common.Extensions;
+using FictionArchive.Service.Shared;
 using FictionArchive.Service.Shared.Extensions;
 using FictionArchive.Service.Shared.Services.EventBus.Implementations;
 using FictionArchive.Service.Shared.Services.GraphQL;
@@ -18,6 +19,8 @@ public class Program
 {
     public static void Main(string[] args)
     {
+        var isSchemaExport = SchemaExportDetector.IsSchemaExportMode(args);
+
         var builder = WebApplication.CreateBuilder(args);
         builder.AddLocalAppsettings();
 
@@ -25,24 +28,30 @@ public class Program
         
         #region Event Bus
 
+        if (!isSchemaExport)
+        {
             builder.Services.AddRabbitMQ(opt =>
             {
                 builder.Configuration.GetSection("RabbitMQ").Bind(opt);
             })
             .Subscribe<TranslationRequestCreatedEvent, TranslationRequestCreatedEventHandler>();
+        }
 
         #endregion
         
         
         #region Database
         
-        builder.Services.RegisterDbContext<TranslationServiceDbContext>(builder.Configuration.GetConnectionString("DefaultConnection"));
+        builder.Services.RegisterDbContext<TranslationServiceDbContext>(
+            builder.Configuration.GetConnectionString("DefaultConnection"),
+            skipInfrastructure: isSchemaExport);
         
         #endregion
         
         #region GraphQL
         
-        builder.Services.AddDefaultGraphQl<Query, Mutation>();
+        builder.Services.AddDefaultGraphQl<Query, Mutation>()
+            .AddAuthorization();
         
         #endregion
         
@@ -58,11 +67,16 @@ public class Program
 
         #endregion
 
+        // Authentication & Authorization
+        builder.Services.AddOidcAuthentication(builder.Configuration);
+        builder.Services.AddFictionArchiveAuthorization();
+
         var app = builder.Build();
         
-        // Update database
-        using (var scope = app.Services.CreateScope())
+        // Update database (skip in schema export mode)
+        if (!isSchemaExport)
         {
+            using var scope = app.Services.CreateScope();
             var dbContext = scope.ServiceProvider.GetRequiredService<TranslationServiceDbContext>();
             dbContext.UpdateDatabase();
         }
@@ -71,6 +85,9 @@ public class Program
 
         app.MapHealthChecks("/healthz");
 
+        app.UseAuthentication();
+        app.UseAuthorization();
+
         app.MapGraphQL();
 
         app.RunWithGraphQLCommands(args);

FictionArchive.Service.TranslationService/appsettings.json

@@ -15,5 +15,15 @@
     "ConnectionString": "amqp://localhost",
     "ClientIdentifier": "TranslationService"
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "fictionarchive-api",
+    "Audience": "fictionarchive-api",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  }
 }

FictionArchive.Service.UserService/GraphQL/Mutation.cs

@@ -1,10 +1,13 @@
+using FictionArchive.Service.Shared.Constants;
 using FictionArchive.Service.UserService.Models.Database;
 using FictionArchive.Service.UserService.Services;
+using HotChocolate.Authorization;
 
 namespace FictionArchive.Service.UserService.GraphQL;
 
 public class Mutation
 {
+    [Authorize(Roles = [AuthorizationConstants.Roles.Admin])]
     public async Task<User> RegisterUser(string username, string email, string oAuthProviderId,
         string? inviterOAuthProviderId, UserManagementService userManagementService)
     {

FictionArchive.Service.UserService/GraphQL/Query.cs

@@ -1,10 +1,12 @@
 using FictionArchive.Service.UserService.Models.Database;
 using FictionArchive.Service.UserService.Services;
+using HotChocolate.Authorization;
 
 namespace FictionArchive.Service.UserService.GraphQL;
 
 public class Query
 {
+    [Authorize]
     public async Task<IQueryable<User>> GetUsers(UserManagementService userManagementService)
     {
         return userManagementService.GetUsers();

FictionArchive.Service.UserService/Program.cs

@@ -1,3 +1,5 @@
+using FictionArchive.Common.Extensions;
+using FictionArchive.Service.Shared;
 using FictionArchive.Service.Shared.Extensions;
 using FictionArchive.Service.Shared.Services.EventBus.Implementations;
 using FictionArchive.Service.UserService.GraphQL;
@@ -11,38 +13,55 @@ public class Program
 {
     public static void Main(string[] args)
     {
+        var isSchemaExport = SchemaExportDetector.IsSchemaExportMode(args);
+
         var builder = WebApplication.CreateBuilder(args);
+        builder.AddLocalAppsettings();
 
         #region Event Bus
 
+        if (!isSchemaExport)
+        {
             builder.Services.AddRabbitMQ(opt =>
             {
                 builder.Configuration.GetSection("RabbitMQ").Bind(opt);
             })
             .Subscribe<AuthUserAddedEvent, AuthUserAddedEventHandler>();
+        }
 
         #endregion
         
         #region GraphQL
         
-        builder.Services.AddDefaultGraphQl<Query, Mutation>();
+        builder.Services.AddDefaultGraphQl<Query, Mutation>()
+            .AddAuthorization();
         
         #endregion
         
-        builder.Services.RegisterDbContext<UserServiceDbContext>(builder.Configuration.GetConnectionString("DefaultConnection"));
+        builder.Services.RegisterDbContext<UserServiceDbContext>(
+            builder.Configuration.GetConnectionString("DefaultConnection"),
+            skipInfrastructure: isSchemaExport);
         builder.Services.AddTransient<UserManagementService>();
 
         builder.Services.AddHealthChecks();
 
+        // Authentication & Authorization
+        builder.Services.AddOidcAuthentication(builder.Configuration);
+        builder.Services.AddFictionArchiveAuthorization();
+
         var app = builder.Build();
         
-        // Update database
-        using (var scope = app.Services.CreateScope())
+        // Update database (skip in schema export mode)
+        if (!isSchemaExport)
         {
+            using var scope = app.Services.CreateScope();
             var dbContext = scope.ServiceProvider.GetRequiredService<UserServiceDbContext>();
             dbContext.UpdateDatabase();
         }
         
+        app.UseAuthentication();
+        app.UseAuthorization();
+
         app.MapGraphQL();
 
         app.MapHealthChecks("/healthz");

FictionArchive.Service.UserService/appsettings.json

@@ -12,5 +12,15 @@
     "ConnectionString": "amqp://localhost",
     "ClientIdentifier": "UserService"
   },
-  "AllowedHosts": "*"
+  "AllowedHosts": "*",
+  "OIDC": {
+    "Authority": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ClientId": "fictionarchive-api",
+    "Audience": "fictionarchive-api",
+    "ValidIssuer": "https://auth.orfl.xyz/application/o/fiction-archive/",
+    "ValidateIssuer": true,
+    "ValidateAudience": true,
+    "ValidateLifetime": true,
+    "ValidateIssuerSigningKey": true
+  }
 }

README.md

@@ -0,0 +1,10 @@
+# FictionArchive
+
+A distributed microservices-based web application for managing fiction and novel content.
+
+## Documentation
+
+- [README](Documentation/README.md) - Getting started and project overview
+- [ARCHITECTURE](Documentation/ARCHITECTURE.md) - System architecture and design
+- [CICD](Documentation/CICD.md) - CI/CD pipeline configuration
+- [AGENTS](Documentation/AGENTS.md) - Development guidelines and coding standards

docker-compose.yml

@@ -0,0 +1,201 @@
+services:
+  # ===========================================
+  # Infrastructure
+  # ===========================================
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  rabbitmq:
+    image: rabbitmq:3-management-alpine
+    environment:
+      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-guest}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-guest}
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq
+    healthcheck:
+      test: ["CMD", "rabbitmq-diagnostics", "check_running"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  # ===========================================
+  # Backend Services
+  # ===========================================
+  novel-service:
+    image: git.orfl.xyz/conco/fictionarchive-novel-service:latest
+    environment:
+      ConnectionStrings__DefaultConnection: Host=postgres;Database=FictionArchive_NovelService;Username=${POSTGRES_USER:-postgres};Password=${POSTGRES_PASSWORD:-postgres}
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+      Novelpia__Username: ${NOVELPIA_USERNAME}
+      Novelpia__Password: ${NOVELPIA_PASSWORD}
+      NovelUpdateService__PendingImageUrl: https://files.fictionarchive.orfl.xyz/api/pendingupload.png
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    depends_on:
+      postgres:
+        condition: service_healthy
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  translation-service:
+    image: git.orfl.xyz/conco/fictionarchive-translation-service:latest
+    environment:
+      ConnectionStrings__DefaultConnection: Host=postgres;Database=FictionArchive_TranslationService;Username=${POSTGRES_USER:-postgres};Password=${POSTGRES_PASSWORD:-postgres}
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+      DeepL__ApiKey: ${DEEPL_API_KEY}
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    depends_on:
+      postgres:
+        condition: service_healthy
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  scheduler-service:
+    image: git.orfl.xyz/conco/fictionarchive-scheduler-service:latest
+    environment:
+      ConnectionStrings__DefaultConnection: Host=postgres;Database=FictionArchive_SchedulerService;Username=${POSTGRES_USER:-postgres};Password=${POSTGRES_PASSWORD:-postgres}
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    depends_on:
+      postgres:
+        condition: service_healthy
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  user-service:
+    image: git.orfl.xyz/conco/fictionarchive-user-service:latest
+    environment:
+      ConnectionStrings__DefaultConnection: Host=postgres;Database=FictionArchive_UserService;Username=${POSTGRES_USER:-postgres};Password=${POSTGRES_PASSWORD:-postgres}
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    depends_on:
+      postgres:
+        condition: service_healthy
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  authentication-service:
+    image: git.orfl.xyz/conco/fictionarchive-authentication-service:latest
+    environment:
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    depends_on:
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  file-service:
+    image: git.orfl.xyz/conco/fictionarchive-file-service:latest
+    environment:
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+      S3__Endpoint: ${S3_ENDPOINT:-https://s3.orfl.xyz}
+      S3__Bucket: ${S3_BUCKET:-fictionarchive}
+      S3__AccessKey: ${S3_ACCESS_KEY}
+      S3__SecretKey: ${S3_SECRET_KEY}
+      Proxy__BaseUrl: https://files.orfl.xyz/api
+      OIDC__Authority: https://auth.orfl.xyz/application/o/fictionarchive/
+      OIDC__ClientId: fictionarchive-files
+      OIDC__Audience: fictionarchive-api
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.file-service.rule=Host(`files.orfl.xyz`)"
+      - "traefik.http.routers.file-service.entrypoints=websecure"
+      - "traefik.http.routers.file-service.tls.certresolver=letsencrypt"
+      - "traefik.http.services.file-service.loadbalancer.server.port=8080"
+    depends_on:
+      rabbitmq:
+        condition: service_healthy
+    restart: unless-stopped
+
+  # ===========================================
+  # API Gateway
+  # ===========================================
+  api-gateway:
+    image: git.orfl.xyz/conco/fictionarchive-api:latest
+    environment:
+      ConnectionStrings__RabbitMQ: amqp://${RABBITMQ_USER:-guest}:${RABBITMQ_PASSWORD:-guest}@rabbitmq
+      OIDC__Authority: https://auth.orfl.xyz/application/o/fictionarchive/
+      OIDC__ClientId: fictionarchive-api
+      OIDC__Audience: fictionarchive-api
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api-gateway.rule=Host(`api.fictionarchive.orfl.xyz`)"
+      - "traefik.http.routers.api-gateway.entrypoints=websecure"
+      - "traefik.http.routers.api-gateway.tls.certresolver=letsencrypt"
+      - "traefik.http.services.api-gateway.loadbalancer.server.port=8080"
+    depends_on:
+      - novel-service
+      - translation-service
+      - scheduler-service
+      - user-service
+      - authentication-service
+      - file-service
+    restart: unless-stopped
+
+  # ===========================================
+  # Frontend
+  # ===========================================
+  frontend:
+    image: git.orfl.xyz/conco/fictionarchive-frontend:latest
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.frontend.rule=Host(`fictionarchive.orfl.xyz`)"
+      - "traefik.http.routers.frontend.entrypoints=websecure"
+      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.frontend.loadbalancer.server.port=80"
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  rabbitmq_data:
+  letsencrypt:

fictionarchive-web/.dockerignore

@@ -0,0 +1,40 @@
+# Dependencies
+node_modules
+
+# Build output
+dist
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# IDE and editor
+.vscode
+.idea
+*.swp
+*.swo
+
+# Git
+.git
+.gitignore
+
+# Logs
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Test coverage
+coverage
+
+# Docker
+Dockerfile
+.dockerignore
+docker-compose*
+
+# Documentation
+README.md
+*.md
+
+# TypeScript build info
+*.tsbuildinfo

fictionarchive-web/.env

@@ -0,0 +1 @@
+VITE_GRAPHQL_URI=http://localhost:5234/graphql/

fictionarchive-web/.gitignore

@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?

fictionarchive-web/Dockerfile

@@ -0,0 +1,32 @@
+FROM node:20-alpine AS build
+
+WORKDIR /app
+
+# Build arguments for Vite environment variables
+ARG VITE_GRAPHQL_URI
+ARG VITE_OIDC_AUTHORITY
+ARG VITE_OIDC_CLIENT_ID
+ARG VITE_OIDC_REDIRECT_URI
+ARG VITE_OIDC_POST_LOGOUT_REDIRECT_URI
+
+# Set environment variables for build
+ENV VITE_GRAPHQL_URI=$VITE_GRAPHQL_URI
+ENV VITE_OIDC_AUTHORITY=$VITE_OIDC_AUTHORITY
+ENV VITE_OIDC_CLIENT_ID=$VITE_OIDC_CLIENT_ID
+ENV VITE_OIDC_REDIRECT_URI=$VITE_OIDC_REDIRECT_URI
+ENV VITE_OIDC_POST_LOGOUT_REDIRECT_URI=$VITE_OIDC_POST_LOGOUT_REDIRECT_URI
+
+COPY package*.json ./
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+FROM nginx:alpine
+
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]

fictionarchive-web/README.md

@@ -0,0 +1,42 @@
+# FictionArchive React Starter
+
+A minimal React + Vite + Apollo Client scaffold ready to connect to the FictionArchive Fusion gateway. Point it at your own endpoint by changing `VITE_GRAPHQL_URI`.
+
+## Getting started
+
+```bash
+cd fictionarchive-web
+npm install
+npm run dev
+```
+
+Then open the printed local URL. Update `.env` (create it if missing) with your endpoint:
+
+```
+VITE_GRAPHQL_URI=https://localhost:5001/graphql
+VITE_OIDC_AUTHORITY=https://your-idp
+VITE_OIDC_CLIENT_ID=fictionarchive-web
+VITE_OIDC_REDIRECT_URI=http://localhost:5173
+VITE_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:5173
+# Optional: token used only by codegen if your gateway requires auth
+VITE_CODEGEN_TOKEN=your_api_token
+```
+
+## Scripts
+
+- `npm run dev`: start Vite dev server.
+- `npm run build`: type-check + production build.
+- `npm run codegen`: generate typed hooks from `src/**/*.graphql` into `src/__generated__/graphql.ts`. **Run this manually after changing GraphQL operations or when the gateway schema changes.**
+
+## Project notes
+
+- `src/apolloClient.ts` configures the Apollo client with `InMemoryCache`, reads `VITE_GRAPHQL_URI`, and attaches an `Authorization: Bearer` header when an OIDC user is present.
+- GraphQL code generation is configured via `codegen.ts` (loads `.env`/`.env.local` automatically); run `npm run codegen` to emit typed hooks to `src/__generated__/graphql.ts` (ignored by git) or rely on the `prebuild` hook.
+- Routing is handled in `src/App.tsx` with `react-router-dom`; `/` renders the novels listing and `/novels/:id` is stubbed for future detail pages.
+- Styles live primarily in `src/index.css` alongside the shared UI components.
+
+## Codegen tips
+
+- Default schema URL: `CODEGEN_SCHEMA_URL` (falls back to `VITE_GRAPHQL_URI`, then `https://localhost:5001/graphql`).
+- Add `VITE_CODEGEN_TOKEN` (or `CODEGEN_TOKEN`) if your gateway requires a bearer token during introspection.
+- Generated outputs land in `src/__generated__/graphql.ts` (committed to git). Run `npm run codegen` after schema/operation changes.

fictionarchive-web/codegen.ts

@@ -0,0 +1,42 @@
+import type { CodegenConfig } from '@graphql-codegen/cli'
+
+const schema =
+  process.env.CODEGEN_SCHEMA_URL ??
+  process.env.VITE_GRAPHQL_URI ??
+  'https://localhost:5001/graphql'
+
+const authToken = process.env.VITE_CODEGEN_TOKEN ?? process.env.CODEGEN_TOKEN
+const headers = authToken
+  ? {
+      Authorization: `Bearer ${authToken}`,
+    }
+  : undefined
+
+const config: CodegenConfig = {
+  schema: {
+    [schema]: { headers },
+  },
+  documents: 'src/**/*.graphql',
+  generates: {
+    'src/__generated__/graphql.ts': {
+      plugins: [
+        'typescript',
+        'typescript-operations',
+        'typed-document-node',
+      ],
+      config: {
+        avoidOptionals: {
+          field: true,
+          inputValue: false,
+        },
+        enumsAsConst: true,
+        maybeValue: 'T | null',
+        skipTypename: true,
+        useTypeImports: true,
+      },
+    },
+  },
+  ignoreNoDocuments: true,
+}
+
+export default config

fictionarchive-web/eslint.config.js

@@ -0,0 +1,23 @@
+import js from '@eslint/js'
+import globals from 'globals'
+import reactHooks from 'eslint-plugin-react-hooks'
+import reactRefresh from 'eslint-plugin-react-refresh'
+import tseslint from 'typescript-eslint'
+import { defineConfig, globalIgnores } from 'eslint/config'
+
+export default defineConfig([
+  globalIgnores(['dist', 'src/__generated__']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      js.configs.recommended,
+      tseslint.configs.recommended,
+      reactHooks.configs.flat.recommended,
+      reactRefresh.configs.vite,
+    ],
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: globals.browser,
+    },
+  },
+])

fictionarchive-web/index.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/png" href="/favicon-32.png" sizes="32x32" />
+    <link rel="icon" type="image/png" href="/favicon-64.png" sizes="64x64" />
+    <link rel="apple-touch-icon" href="/favicon-180.png" sizes="180x180" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>FictionArchive</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

fictionarchive-web/nginx.conf

@@ -0,0 +1,21 @@
+server {
+    listen 80;
+    server_name localhost;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+    # Handle SPA routing - serve index.html for all routes
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Cache static assets
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}

fictionarchive-web/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "fictionarchive-web",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "codegen": "graphql-codegen --config codegen.ts -r dotenv/config --use-system-ca",
+    "lint": "eslint .",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@apollo/client": "^4.0.9",
+    "@radix-ui/react-slot": "^1.1.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "graphql": "^16.12.0",
+    "oidc-client-ts": "^3.4.1",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-router-dom": "^6.27.0",
+    "tailwind-merge": "^2.5.4"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.1",
+    "@graphql-codegen/cli": "^5.0.3",
+    "@graphql-codegen/typed-document-node": "^6.1.1",
+    "@graphql-codegen/typescript": "^4.0.9",
+    "@graphql-codegen/typescript-operations": "^4.0.9",
+    "@types/node": "^24.10.1",
+    "@types/react": "^19.2.5",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^5.1.1",
+    "autoprefixer": "^10.4.20",
+    "dotenv": "^16.4.5",
+    "eslint": "^9.39.1",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-refresh": "^0.4.24",
+    "globals": "^16.5.0",
+    "postcss": "^8.4.49",
+    "tailwindcss": "^3.4.16",
+    "tailwindcss-animate": "^1.0.7",
+    "typescript": "~5.9.3",
+    "typescript-eslint": "^8.46.4",
+    "vite": "^7.2.4"
+  }
+}

fictionarchive-web/postcss.config.cjs

@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+}

fictionarchive-web/public/vite.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>

fictionarchive-web/src/App.css

@@ -0,0 +1,158 @@
+.page {
+  max-width: 960px;
+  margin: 0 auto;
+  padding: 2.5rem 1.5rem 3rem;
+}
+
+.card {
+  background: #ffffff;
+  border: 1px solid #e2e8f0;
+  border-radius: 16px;
+  padding: 1.5rem;
+  box-shadow: 0 18px 60px -30px rgba(15, 23, 42, 0.3);
+}
+
+.card + .card {
+  margin-top: 1.25rem;
+}
+
+.intro {
+  text-align: left;
+}
+
+.eyebrow {
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  font-size: 0.75rem;
+  color: #475569;
+  margin: 0 0 0.35rem;
+}
+
+.lede {
+  color: #475569;
+  margin: 0.5rem 0 0;
+}
+
+.header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+}
+
+.pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  padding: 0.3rem 0.7rem;
+  border-radius: 999px;
+  background: #eef2ff;
+  color: #312e81;
+  border: 1px solid #c7d2fe;
+  font-weight: 600;
+}
+
+.muted {
+  color: #475569;
+  margin: 0.35rem 0 0;
+}
+
+.query-form {
+  margin: 1rem 0;
+  display: grid;
+  gap: 0.35rem;
+}
+
+.label {
+  font-weight: 600;
+  color: #0f172a;
+}
+
+.field-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.field-row input {
+  flex: 1;
+  padding: 0.65rem 0.75rem;
+  border: 1px solid #cbd5e1;
+  border-radius: 12px;
+  font-size: 1rem;
+  color: #0f172a;
+  background: #f8fafc;
+}
+
+.field-row input:focus {
+  outline: none;
+  border-color: #6366f1;
+  box-shadow: 0 0 0 3px rgba(99, 102, 241, 0.15);
+}
+
+.field-row button {
+  padding: 0.65rem 0.9rem;
+  border: 1px solid #312e81;
+  background: linear-gradient(135deg, #4338ca, #312e81);
+  color: #fff;
+  border-radius: 12px;
+  font-weight: 700;
+  cursor: pointer;
+  transition: transform 150ms ease, box-shadow 150ms ease;
+}
+
+.field-row button:hover {
+  transform: translateY(-1px);
+  box-shadow: 0 8px 24px -10px rgba(49, 46, 129, 0.6);
+}
+
+.field-row button:active {
+  transform: translateY(0);
+  box-shadow: none;
+}
+
+.country {
+  margin-top: 1rem;
+}
+
+.country__headline {
+  display: flex;
+  align-items: center;
+  gap: 0.8rem;
+  margin-bottom: 1rem;
+}
+
+.country h3 {
+  margin: 0.2rem 0 0;
+}
+
+.emoji {
+  font-size: 2rem;
+}
+
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 1rem;
+}
+
+dt {
+  font-size: 0.9rem;
+  color: #475569;
+  margin-bottom: 0.2rem;
+}
+
+dd {
+  margin: 0;
+  font-weight: 600;
+  color: #0f172a;
+}
+
+.error {
+  color: #b91c1c;
+  background: #fef2f2;
+  border: 1px solid #fecdd3;
+  border-radius: 12px;
+  padding: 0.75rem 1rem;
+  margin: 0.75rem 0 0;
+}

fictionarchive-web/src/App.tsx

@@ -0,0 +1,19 @@
+import { Route, Routes } from 'react-router-dom'
+import { AppLayout } from './layouts/AppLayout'
+import { NovelsPage } from './pages/NovelsPage'
+import { NovelDetailPage } from './pages/NovelDetailPage'
+import { NotFoundPage } from './pages/NotFoundPage'
+
+function App() {
+  return (
+    <Routes>
+      <Route path="/" element={<AppLayout />}>
+        <Route index element={<NovelsPage />} />
+        <Route path="novels/:id" element={<NovelDetailPage />} />
+        <Route path="*" element={<NotFoundPage />} />
+      </Route>
+    </Routes>
+  )
+}
+
+export default App

fictionarchive-web/src/__generated__/graphql.ts

@@ -0,0 +1,774 @@
+import type { TypedDocumentNode as DocumentNode } from '@graphql-typed-document-node/core';
+export type Maybe<T> = T | null;
+export type InputMaybe<T> = T | null;
+export type Exact<T extends { [key: string]: unknown }> = { [K in keyof T]: T[K] };
+export type MakeOptional<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]?: Maybe<T[SubKey]> };
+export type MakeMaybe<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]: Maybe<T[SubKey]> };
+export type MakeEmpty<T extends { [key: string]: unknown }, K extends keyof T> = { [_ in K]?: never };
+export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never };
+/** All built-in and custom scalars, mapped to their actual values */
+export type Scalars = {
+  ID: { input: string; output: string; }
+  String: { input: string; output: string; }
+  Boolean: { input: boolean; output: boolean; }
+  Int: { input: number; output: number; }
+  Float: { input: number; output: number; }
+  Instant: { input: any; output: any; }
+  UUID: { input: any; output: any; }
+  UnsignedInt: { input: any; output: any; }
+};
+
+export type Chapter = {
+  body: LocalizationKey;
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UnsignedInt']['output'];
+  images: Array<Image>;
+  lastUpdatedTime: Scalars['Instant']['output'];
+  name: LocalizationKey;
+  order: Scalars['UnsignedInt']['output'];
+  revision: Scalars['UnsignedInt']['output'];
+  url: Maybe<Scalars['String']['output']>;
+};
+
+export type ChapterFilterInput = {
+  and?: InputMaybe<Array<ChapterFilterInput>>;
+  body?: InputMaybe<LocalizationKeyFilterInput>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  images?: InputMaybe<ListFilterInputTypeOfImageFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  name?: InputMaybe<LocalizationKeyFilterInput>;
+  or?: InputMaybe<Array<ChapterFilterInput>>;
+  order?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  revision?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  url?: InputMaybe<StringOperationFilterInput>;
+};
+
+export type ChapterPullRequestedEvent = {
+  chapterNumber: Scalars['UnsignedInt']['output'];
+  novelId: Scalars['UnsignedInt']['output'];
+};
+
+export type ChapterSortInput = {
+  body?: InputMaybe<LocalizationKeySortInput>;
+  createdTime?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  name?: InputMaybe<LocalizationKeySortInput>;
+  order?: InputMaybe<SortEnumType>;
+  revision?: InputMaybe<SortEnumType>;
+  url?: InputMaybe<SortEnumType>;
+};
+
+export type DeleteJobError = KeyNotFoundError;
+
+export type DeleteJobInput = {
+  jobKey: Scalars['String']['input'];
+};
+
+export type DeleteJobPayload = {
+  boolean: Maybe<Scalars['Boolean']['output']>;
+  errors: Maybe<Array<DeleteJobError>>;
+};
+
+export type DuplicateNameError = Error & {
+  message: Scalars['String']['output'];
+};
+
+export type Error = {
+  message: Scalars['String']['output'];
+};
+
+export type FetchChapterContentsInput = {
+  chapterNumber: Scalars['UnsignedInt']['input'];
+  novelId: Scalars['UnsignedInt']['input'];
+};
+
+export type FetchChapterContentsPayload = {
+  chapterPullRequestedEvent: Maybe<ChapterPullRequestedEvent>;
+};
+
+export type FormatError = Error & {
+  message: Scalars['String']['output'];
+};
+
+export type Image = {
+  chapter: Maybe<Chapter>;
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UUID']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  newPath: Maybe<Scalars['String']['output']>;
+  originalPath: Scalars['String']['output'];
+};
+
+export type ImageFilterInput = {
+  and?: InputMaybe<Array<ImageFilterInput>>;
+  chapter?: InputMaybe<ChapterFilterInput>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UuidOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  newPath?: InputMaybe<StringOperationFilterInput>;
+  or?: InputMaybe<Array<ImageFilterInput>>;
+  originalPath?: InputMaybe<StringOperationFilterInput>;
+};
+
+export type ImageSortInput = {
+  chapter?: InputMaybe<ChapterSortInput>;
+  createdTime?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  newPath?: InputMaybe<SortEnumType>;
+  originalPath?: InputMaybe<SortEnumType>;
+};
+
+export type ImportNovelInput = {
+  novelUrl: Scalars['String']['input'];
+};
+
+export type ImportNovelPayload = {
+  novelUpdateRequestedEvent: Maybe<NovelUpdateRequestedEvent>;
+};
+
+export type InstantFilterInput = {
+  and?: InputMaybe<Array<InstantFilterInput>>;
+  or?: InputMaybe<Array<InstantFilterInput>>;
+};
+
+export type JobKey = {
+  group: Scalars['String']['output'];
+  name: Scalars['String']['output'];
+};
+
+export type JobPersistenceError = Error & {
+  message: Scalars['String']['output'];
+};
+
+export type KeyNotFoundError = Error & {
+  message: Scalars['String']['output'];
+};
+
+export type KeyValuePairOfStringAndString = {
+  key: Scalars['String']['output'];
+  value: Scalars['String']['output'];
+};
+
+export const Language = {
+  Ch: 'CH',
+  En: 'EN',
+  Ja: 'JA',
+  Kr: 'KR'
+} as const;
+
+export type Language = typeof Language[keyof typeof Language];
+export type LanguageOperationFilterInput = {
+  eq?: InputMaybe<Language>;
+  in?: InputMaybe<Array<Language>>;
+  neq?: InputMaybe<Language>;
+  nin?: InputMaybe<Array<Language>>;
+};
+
+export type ListFilterInputTypeOfChapterFilterInput = {
+  all?: InputMaybe<ChapterFilterInput>;
+  any?: InputMaybe<Scalars['Boolean']['input']>;
+  none?: InputMaybe<ChapterFilterInput>;
+  some?: InputMaybe<ChapterFilterInput>;
+};
+
+export type ListFilterInputTypeOfImageFilterInput = {
+  all?: InputMaybe<ImageFilterInput>;
+  any?: InputMaybe<Scalars['Boolean']['input']>;
+  none?: InputMaybe<ImageFilterInput>;
+  some?: InputMaybe<ImageFilterInput>;
+};
+
+export type ListFilterInputTypeOfLocalizationTextFilterInput = {
+  all?: InputMaybe<LocalizationTextFilterInput>;
+  any?: InputMaybe<Scalars['Boolean']['input']>;
+  none?: InputMaybe<LocalizationTextFilterInput>;
+  some?: InputMaybe<LocalizationTextFilterInput>;
+};
+
+export type ListFilterInputTypeOfNovelFilterInput = {
+  all?: InputMaybe<NovelFilterInput>;
+  any?: InputMaybe<Scalars['Boolean']['input']>;
+  none?: InputMaybe<NovelFilterInput>;
+  some?: InputMaybe<NovelFilterInput>;
+};
+
+export type ListFilterInputTypeOfNovelTagFilterInput = {
+  all?: InputMaybe<NovelTagFilterInput>;
+  any?: InputMaybe<Scalars['Boolean']['input']>;
+  none?: InputMaybe<NovelTagFilterInput>;
+  some?: InputMaybe<NovelTagFilterInput>;
+};
+
+export type LocalizationKey = {
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UUID']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  texts: Array<LocalizationText>;
+};
+
+export type LocalizationKeyFilterInput = {
+  and?: InputMaybe<Array<LocalizationKeyFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UuidOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  or?: InputMaybe<Array<LocalizationKeyFilterInput>>;
+  texts?: InputMaybe<ListFilterInputTypeOfLocalizationTextFilterInput>;
+};
+
+export type LocalizationKeySortInput = {
+  createdTime?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+};
+
+export type LocalizationText = {
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UUID']['output'];
+  language: Language;
+  lastUpdatedTime: Scalars['Instant']['output'];
+  text: Scalars['String']['output'];
+  translationEngine: Maybe<TranslationEngine>;
+};
+
+export type LocalizationTextFilterInput = {
+  and?: InputMaybe<Array<LocalizationTextFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UuidOperationFilterInput>;
+  language?: InputMaybe<LanguageOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  or?: InputMaybe<Array<LocalizationTextFilterInput>>;
+  text?: InputMaybe<StringOperationFilterInput>;
+  translationEngine?: InputMaybe<TranslationEngineFilterInput>;
+};
+
+export type Mutation = {
+  deleteJob: DeleteJobPayload;
+  fetchChapterContents: FetchChapterContentsPayload;
+  importNovel: ImportNovelPayload;
+  registerUser: RegisterUserPayload;
+  runJob: RunJobPayload;
+  scheduleEventJob: ScheduleEventJobPayload;
+  translateText: TranslateTextPayload;
+};
+
+
+export type MutationDeleteJobArgs = {
+  input: DeleteJobInput;
+};
+
+
+export type MutationFetchChapterContentsArgs = {
+  input: FetchChapterContentsInput;
+};
+
+
+export type MutationImportNovelArgs = {
+  input: ImportNovelInput;
+};
+
+
+export type MutationRegisterUserArgs = {
+  input: RegisterUserInput;
+};
+
+
+export type MutationRunJobArgs = {
+  input: RunJobInput;
+};
+
+
+export type MutationScheduleEventJobArgs = {
+  input: ScheduleEventJobInput;
+};
+
+
+export type MutationTranslateTextArgs = {
+  input: TranslateTextInput;
+};
+
+export type Novel = {
+  author: Person;
+  chapters: Array<Chapter>;
+  coverImage: Maybe<Image>;
+  createdTime: Scalars['Instant']['output'];
+  description: LocalizationKey;
+  externalId: Scalars['String']['output'];
+  id: Scalars['UnsignedInt']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  name: LocalizationKey;
+  rawLanguage: Language;
+  rawStatus: NovelStatus;
+  source: Source;
+  statusOverride: Maybe<NovelStatus>;
+  tags: Array<NovelTag>;
+  url: Scalars['String']['output'];
+};
+
+export type NovelFilterInput = {
+  and?: InputMaybe<Array<NovelFilterInput>>;
+  author?: InputMaybe<PersonFilterInput>;
+  chapters?: InputMaybe<ListFilterInputTypeOfChapterFilterInput>;
+  coverImage?: InputMaybe<ImageFilterInput>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  description?: InputMaybe<LocalizationKeyFilterInput>;
+  externalId?: InputMaybe<StringOperationFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  name?: InputMaybe<LocalizationKeyFilterInput>;
+  or?: InputMaybe<Array<NovelFilterInput>>;
+  rawLanguage?: InputMaybe<LanguageOperationFilterInput>;
+  rawStatus?: InputMaybe<NovelStatusOperationFilterInput>;
+  source?: InputMaybe<SourceFilterInput>;
+  statusOverride?: InputMaybe<NullableOfNovelStatusOperationFilterInput>;
+  tags?: InputMaybe<ListFilterInputTypeOfNovelTagFilterInput>;
+  url?: InputMaybe<StringOperationFilterInput>;
+};
+
+export type NovelSortInput = {
+  author?: InputMaybe<PersonSortInput>;
+  coverImage?: InputMaybe<ImageSortInput>;
+  createdTime?: InputMaybe<SortEnumType>;
+  description?: InputMaybe<LocalizationKeySortInput>;
+  externalId?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  name?: InputMaybe<LocalizationKeySortInput>;
+  rawLanguage?: InputMaybe<SortEnumType>;
+  rawStatus?: InputMaybe<SortEnumType>;
+  source?: InputMaybe<SourceSortInput>;
+  statusOverride?: InputMaybe<SortEnumType>;
+  url?: InputMaybe<SortEnumType>;
+};
+
+export const NovelStatus = {
+  Abandoned: 'ABANDONED',
+  Completed: 'COMPLETED',
+  Hiatus: 'HIATUS',
+  InProgress: 'IN_PROGRESS',
+  Unknown: 'UNKNOWN'
+} as const;
+
+export type NovelStatus = typeof NovelStatus[keyof typeof NovelStatus];
+export type NovelStatusOperationFilterInput = {
+  eq?: InputMaybe<NovelStatus>;
+  in?: InputMaybe<Array<NovelStatus>>;
+  neq?: InputMaybe<NovelStatus>;
+  nin?: InputMaybe<Array<NovelStatus>>;
+};
+
+export type NovelTag = {
+  createdTime: Scalars['Instant']['output'];
+  displayName: LocalizationKey;
+  id: Scalars['UnsignedInt']['output'];
+  key: Scalars['String']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  novels: Array<Novel>;
+  source: Maybe<Source>;
+  tagType: TagType;
+};
+
+export type NovelTagFilterInput = {
+  and?: InputMaybe<Array<NovelTagFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  displayName?: InputMaybe<LocalizationKeyFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  key?: InputMaybe<StringOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  novels?: InputMaybe<ListFilterInputTypeOfNovelFilterInput>;
+  or?: InputMaybe<Array<NovelTagFilterInput>>;
+  source?: InputMaybe<SourceFilterInput>;
+  tagType?: InputMaybe<TagTypeOperationFilterInput>;
+};
+
+export type NovelUpdateRequestedEvent = {
+  novelUrl: Scalars['String']['output'];
+};
+
+/** A connection to a list of items. */
+export type NovelsConnection = {
+  /** A list of edges. */
+  edges: Maybe<Array<NovelsEdge>>;
+  /** A flattened list of the nodes. */
+  nodes: Maybe<Array<Novel>>;
+  /** Information to aid in pagination. */
+  pageInfo: PageInfo;
+};
+
+/** An edge in a connection. */
+export type NovelsEdge = {
+  /** A cursor for use in pagination. */
+  cursor: Scalars['String']['output'];
+  /** The item at the end of the edge. */
+  node: Novel;
+};
+
+export type NullableOfNovelStatusOperationFilterInput = {
+  eq?: InputMaybe<NovelStatus>;
+  in?: InputMaybe<Array<InputMaybe<NovelStatus>>>;
+  neq?: InputMaybe<NovelStatus>;
+  nin?: InputMaybe<Array<InputMaybe<NovelStatus>>>;
+};
+
+/** Information about pagination in a connection. */
+export type PageInfo = {
+  /** When paginating forwards, the cursor to continue. */
+  endCursor: Maybe<Scalars['String']['output']>;
+  /** Indicates whether more edges exist following the set defined by the clients arguments. */
+  hasNextPage: Scalars['Boolean']['output'];
+  /** Indicates whether more edges exist prior the set defined by the clients arguments. */
+  hasPreviousPage: Scalars['Boolean']['output'];
+  /** When paginating backwards, the cursor to continue. */
+  startCursor: Maybe<Scalars['String']['output']>;
+};
+
+export type Person = {
+  createdTime: Scalars['Instant']['output'];
+  externalUrl: Maybe<Scalars['String']['output']>;
+  id: Scalars['UnsignedInt']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  name: LocalizationKey;
+};
+
+export type PersonFilterInput = {
+  and?: InputMaybe<Array<PersonFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  externalUrl?: InputMaybe<StringOperationFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  name?: InputMaybe<LocalizationKeyFilterInput>;
+  or?: InputMaybe<Array<PersonFilterInput>>;
+};
+
+export type PersonSortInput = {
+  createdTime?: InputMaybe<SortEnumType>;
+  externalUrl?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  name?: InputMaybe<LocalizationKeySortInput>;
+};
+
+export type Query = {
+  jobs: Array<SchedulerJob>;
+  novels: Maybe<NovelsConnection>;
+  translationEngines: Array<TranslationEngineDescriptor>;
+  translationRequests: Maybe<TranslationRequestsConnection>;
+  users: Array<User>;
+};
+
+
+export type QueryNovelsArgs = {
+  after?: InputMaybe<Scalars['String']['input']>;
+  before?: InputMaybe<Scalars['String']['input']>;
+  first?: InputMaybe<Scalars['Int']['input']>;
+  last?: InputMaybe<Scalars['Int']['input']>;
+  order?: InputMaybe<Array<NovelSortInput>>;
+  where?: InputMaybe<NovelFilterInput>;
+};
+
+
+export type QueryTranslationEnginesArgs = {
+  order?: InputMaybe<Array<TranslationEngineDescriptorSortInput>>;
+  where?: InputMaybe<TranslationEngineDescriptorFilterInput>;
+};
+
+
+export type QueryTranslationRequestsArgs = {
+  after?: InputMaybe<Scalars['String']['input']>;
+  before?: InputMaybe<Scalars['String']['input']>;
+  first?: InputMaybe<Scalars['Int']['input']>;
+  last?: InputMaybe<Scalars['Int']['input']>;
+  order?: InputMaybe<Array<TranslationRequestSortInput>>;
+  where?: InputMaybe<TranslationRequestFilterInput>;
+};
+
+export type RegisterUserInput = {
+  email: Scalars['String']['input'];
+  inviterOAuthProviderId?: InputMaybe<Scalars['String']['input']>;
+  oAuthProviderId: Scalars['String']['input'];
+  username: Scalars['String']['input'];
+};
+
+export type RegisterUserPayload = {
+  user: Maybe<User>;
+};
+
+export type RunJobError = JobPersistenceError;
+
+export type RunJobInput = {
+  jobKey: Scalars['String']['input'];
+};
+
+export type RunJobPayload = {
+  boolean: Maybe<Scalars['Boolean']['output']>;
+  errors: Maybe<Array<RunJobError>>;
+};
+
+export type ScheduleEventJobError = DuplicateNameError | FormatError;
+
+export type ScheduleEventJobInput = {
+  cronSchedule: Scalars['String']['input'];
+  description: Scalars['String']['input'];
+  eventData: Scalars['String']['input'];
+  eventType: Scalars['String']['input'];
+  key: Scalars['String']['input'];
+};
+
+export type ScheduleEventJobPayload = {
+  errors: Maybe<Array<ScheduleEventJobError>>;
+  schedulerJob: Maybe<SchedulerJob>;
+};
+
+export type SchedulerJob = {
+  cronSchedule: Array<Scalars['String']['output']>;
+  description: Scalars['String']['output'];
+  jobData: Array<KeyValuePairOfStringAndString>;
+  jobKey: JobKey;
+  jobTypeName: Scalars['String']['output'];
+};
+
+export const SortEnumType = {
+  Asc: 'ASC',
+  Desc: 'DESC'
+} as const;
+
+export type SortEnumType = typeof SortEnumType[keyof typeof SortEnumType];
+export type Source = {
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UnsignedInt']['output'];
+  key: Scalars['String']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  name: Scalars['String']['output'];
+  url: Scalars['String']['output'];
+};
+
+export type SourceFilterInput = {
+  and?: InputMaybe<Array<SourceFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  key?: InputMaybe<StringOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  name?: InputMaybe<StringOperationFilterInput>;
+  or?: InputMaybe<Array<SourceFilterInput>>;
+  url?: InputMaybe<StringOperationFilterInput>;
+};
+
+export type SourceSortInput = {
+  createdTime?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  key?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  name?: InputMaybe<SortEnumType>;
+  url?: InputMaybe<SortEnumType>;
+};
+
+export type StringOperationFilterInput = {
+  and?: InputMaybe<Array<StringOperationFilterInput>>;
+  contains?: InputMaybe<Scalars['String']['input']>;
+  endsWith?: InputMaybe<Scalars['String']['input']>;
+  eq?: InputMaybe<Scalars['String']['input']>;
+  in?: InputMaybe<Array<InputMaybe<Scalars['String']['input']>>>;
+  ncontains?: InputMaybe<Scalars['String']['input']>;
+  nendsWith?: InputMaybe<Scalars['String']['input']>;
+  neq?: InputMaybe<Scalars['String']['input']>;
+  nin?: InputMaybe<Array<InputMaybe<Scalars['String']['input']>>>;
+  nstartsWith?: InputMaybe<Scalars['String']['input']>;
+  or?: InputMaybe<Array<StringOperationFilterInput>>;
+  startsWith?: InputMaybe<Scalars['String']['input']>;
+};
+
+export const TagType = {
+  External: 'EXTERNAL',
+  Genre: 'GENRE',
+  System: 'SYSTEM',
+  UserDefined: 'USER_DEFINED'
+} as const;
+
+export type TagType = typeof TagType[keyof typeof TagType];
+export type TagTypeOperationFilterInput = {
+  eq?: InputMaybe<TagType>;
+  in?: InputMaybe<Array<TagType>>;
+  neq?: InputMaybe<TagType>;
+  nin?: InputMaybe<Array<TagType>>;
+};
+
+export type TranslateTextInput = {
+  from: Language;
+  text: Scalars['String']['input'];
+  to: Language;
+  translationEngineKey: Scalars['String']['input'];
+};
+
+export type TranslateTextPayload = {
+  translationResult: Maybe<TranslationResult>;
+};
+
+export type TranslationEngine = {
+  createdTime: Scalars['Instant']['output'];
+  id: Scalars['UnsignedInt']['output'];
+  key: Scalars['String']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+};
+
+export type TranslationEngineDescriptor = {
+  displayName: Scalars['String']['output'];
+  key: Scalars['String']['output'];
+};
+
+export type TranslationEngineDescriptorFilterInput = {
+  and?: InputMaybe<Array<TranslationEngineDescriptorFilterInput>>;
+  displayName?: InputMaybe<StringOperationFilterInput>;
+  key?: InputMaybe<StringOperationFilterInput>;
+  or?: InputMaybe<Array<TranslationEngineDescriptorFilterInput>>;
+};
+
+export type TranslationEngineDescriptorSortInput = {
+  displayName?: InputMaybe<SortEnumType>;
+  key?: InputMaybe<SortEnumType>;
+};
+
+export type TranslationEngineFilterInput = {
+  and?: InputMaybe<Array<TranslationEngineFilterInput>>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  id?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  key?: InputMaybe<StringOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  or?: InputMaybe<Array<TranslationEngineFilterInput>>;
+};
+
+export type TranslationRequest = {
+  billedCharacterCount: Scalars['UnsignedInt']['output'];
+  createdTime: Scalars['Instant']['output'];
+  from: Language;
+  id: Scalars['UUID']['output'];
+  lastUpdatedTime: Scalars['Instant']['output'];
+  originalText: Scalars['String']['output'];
+  status: TranslationRequestStatus;
+  to: Language;
+  translatedText: Maybe<Scalars['String']['output']>;
+  translationEngineKey: Scalars['String']['output'];
+};
+
+export type TranslationRequestFilterInput = {
+  and?: InputMaybe<Array<TranslationRequestFilterInput>>;
+  billedCharacterCount?: InputMaybe<UnsignedIntOperationFilterInputType>;
+  createdTime?: InputMaybe<InstantFilterInput>;
+  from?: InputMaybe<LanguageOperationFilterInput>;
+  id?: InputMaybe<UuidOperationFilterInput>;
+  lastUpdatedTime?: InputMaybe<InstantFilterInput>;
+  or?: InputMaybe<Array<TranslationRequestFilterInput>>;
+  originalText?: InputMaybe<StringOperationFilterInput>;
+  status?: InputMaybe<TranslationRequestStatusOperationFilterInput>;
+  to?: InputMaybe<LanguageOperationFilterInput>;
+  translatedText?: InputMaybe<StringOperationFilterInput>;
+  translationEngineKey?: InputMaybe<StringOperationFilterInput>;
+};
+
+export type TranslationRequestSortInput = {
+  billedCharacterCount?: InputMaybe<SortEnumType>;
+  createdTime?: InputMaybe<SortEnumType>;
+  from?: InputMaybe<SortEnumType>;
+  id?: InputMaybe<SortEnumType>;
+  lastUpdatedTime?: InputMaybe<SortEnumType>;
+  originalText?: InputMaybe<SortEnumType>;
+  status?: InputMaybe<SortEnumType>;
+  to?: InputMaybe<SortEnumType>;
+  translatedText?: InputMaybe<SortEnumType>;
+  translationEngineKey?: InputMaybe<SortEnumType>;
+};
+
+export const TranslationRequestStatus = {
+  Failed: 'FAILED',
+  Pending: 'PENDING',
+  Success: 'SUCCESS'
+} as const;
+
+export type TranslationRequestStatus = typeof TranslationRequestStatus[keyof typeof TranslationRequestStatus];
+export type TranslationRequestStatusOperationFilterInput = {
+  eq?: InputMaybe<TranslationRequestStatus>;
+  in?: InputMaybe<Array<TranslationRequestStatus>>;
+  neq?: InputMaybe<TranslationRequestStatus>;
+  nin?: InputMaybe<Array<TranslationRequestStatus>>;
+};
+
+/** A connection to a list of items. */
+export type TranslationRequestsConnection = {
+  /** A list of edges. */
+  edges: Maybe<Array<TranslationRequestsEdge>>;
+  /** A flattened list of the nodes. */
+  nodes: Maybe<Array<TranslationRequest>>;
+  /** Information to aid in pagination. */
+  pageInfo: PageInfo;
+};
+
+/** An edge in a connection. */
+export type TranslationRequestsEdge = {
+  /** A cursor for use in pagination. */
+  cursor: Scalars['String']['output'];
+  /** The item at the end of the edge. */
+  node: TranslationRequest;
+};
+
+export type TranslationResult = {
+  billedCharacterCount: Scalars['UnsignedInt']['output'];
+  from: Language;
+  originalText: Scalars['String']['output'];
+  status: TranslationRequestStatus;
+  to: Language;
+  translatedText: Maybe<Scalars['String']['output']>;
+  translationEngineKey: Scalars['String']['output'];
+};
+
+export type UnsignedIntOperationFilterInputType = {
+  eq?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  gt?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  gte?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  in?: InputMaybe<Array<InputMaybe<Scalars['UnsignedInt']['input']>>>;
+  lt?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  lte?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  neq?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  ngt?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  ngte?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  nin?: InputMaybe<Array<InputMaybe<Scalars['UnsignedInt']['input']>>>;
+  nlt?: InputMaybe<Scalars['UnsignedInt']['input']>;
+  nlte?: InputMaybe<Scalars['UnsignedInt']['input']>;
+};
+
+export type User = {
+  createdTime: Scalars['Instant']['output'];
+  disabled: Scalars['Boolean']['output'];
+  email: Scalars['String']['output'];
+  id: Scalars['UUID']['output'];
+  inviter: Maybe<User>;
+  lastUpdatedTime: Scalars['Instant']['output'];
+  oAuthProviderId: Scalars['String']['output'];
+  username: Scalars['String']['output'];
+};
+
+export type UuidOperationFilterInput = {
+  eq?: InputMaybe<Scalars['UUID']['input']>;
+  gt?: InputMaybe<Scalars['UUID']['input']>;
+  gte?: InputMaybe<Scalars['UUID']['input']>;
+  in?: InputMaybe<Array<InputMaybe<Scalars['UUID']['input']>>>;
+  lt?: InputMaybe<Scalars['UUID']['input']>;
+  lte?: InputMaybe<Scalars['UUID']['input']>;
+  neq?: InputMaybe<Scalars['UUID']['input']>;
+  ngt?: InputMaybe<Scalars['UUID']['input']>;
+  ngte?: InputMaybe<Scalars['UUID']['input']>;
+  nin?: InputMaybe<Array<InputMaybe<Scalars['UUID']['input']>>>;
+  nlt?: InputMaybe<Scalars['UUID']['input']>;
+  nlte?: InputMaybe<Scalars['UUID']['input']>;
+};
+
+export type NovelsQueryVariables = Exact<{
+  first?: InputMaybe<Scalars['Int']['input']>;
+  after?: InputMaybe<Scalars['String']['input']>;
+}>;
+
+
+export type NovelsQuery = { novels: { edges: Array<{ cursor: string, node: { id: any, url: string, name: { texts: Array<{ language: Language, text: string }> }, description: { texts: Array<{ language: Language, text: string }> }, coverImage: { originalPath: string, newPath: string | null } | null } }> | null, pageInfo: { hasNextPage: boolean, endCursor: string | null } } | null };
+
+
+export const NovelsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"Novels"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"first"}},"type":{"kind":"NamedType","name":{"kind":"Name","value":"Int"}}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"after"}},"type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"novels"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"first"},"value":{"kind":"Variable","name":{"kind":"Name","value":"first"}}},{"kind":"Argument","name":{"kind":"Name","value":"after"},"value":{"kind":"Variable","name":{"kind":"Name","value":"after"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"edges"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"cursor"}},{"kind":"Field","name":{"kind":"Name","value":"node"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"url"}},{"kind":"Field","name":{"kind":"Name","value":"name"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"texts"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"language"}},{"kind":"Field","name":{"kind":"Name","value":"text"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"description"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"texts"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"language"}},{"kind":"Field","name":{"kind":"Name","value":"text"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"coverImage"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"originalPath"}},{"kind":"Field","name":{"kind":"Name","value":"newPath"}}]}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"pageInfo"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"hasNextPage"}},{"kind":"Field","name":{"kind":"Name","value":"endCursor"}}]}}]}}]}}]} as unknown as DocumentNode<NovelsQuery, NovelsQueryVariables>;

fictionarchive-web/src/apolloClient.ts

@@ -0,0 +1,30 @@
+import { ApolloClient, HttpLink, InMemoryCache } from '@apollo/client'
+import {SetContextLink} from '@apollo/client/link/context'
+import { userManager } from './auth/oidcClient'
+
+const uri = import.meta.env.VITE_GRAPHQL_URI ?? 'https://localhost:5001/graphql'
+
+const httpLink = new HttpLink({ uri })
+
+const authLink = new SetContextLink(async ({ headers }) => {
+  if (!userManager) return { headers }
+  try {
+    const user = await userManager.getUser()
+    const token = user?.access_token
+    if (!token) return { headers }
+    return {
+      headers: {
+        ...headers,
+        Authorization: `Bearer ${token}`,
+      },
+    }
+  } catch (error) {
+    console.warn('Failed to load user for auth header', error)
+    return { headers }
+  }
+})
+
+export const apolloClient = new ApolloClient({
+  link: authLink.concat(httpLink),
+  cache: new InMemoryCache(),
+})

fictionarchive-web/src/assets/react.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

fictionarchive-web/src/auth/AuthContext.tsx

@@ -0,0 +1,168 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from 'react'
+import type { User } from 'oidc-client-ts'
+import { isOidcConfigured, userManager } from './oidcClient'
+
+// Cookie management helper functions
+function setCookieFromUser(user: User) {
+  if (!user?.access_token) return
+  
+  const isProduction = window.location.hostname !== 'localhost'
+  const domain = isProduction ? '.orfl.xyz' : undefined
+  const secure = isProduction
+  const sameSite = isProduction ? 'None' : 'Lax'
+  
+  // Set cookie with JWT token from user
+  const cookieValue = `fa_session=${user.access_token}; path=/; ${secure ? 'secure; ' : ''}samesite=${sameSite}${domain ? `; domain=${domain}` : ''}`
+  document.cookie = cookieValue
+}
+
+function clearFaSessionCookie() {
+  const isProduction = window.location.hostname !== 'localhost'
+  const domain = isProduction ? '.orfl.xyz' : undefined
+  
+  // Clear cookie by setting expiration date in the past
+  const cookieValue = `fa_session=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT${domain ? `; domain=${domain}` : ''}`
+  document.cookie = cookieValue
+}
+
+type AuthContextValue = {
+  user: User | null
+  isLoading: boolean
+  isConfigured: boolean
+  login: () => Promise<void>
+  logout: () => Promise<void>
+}
+
+const AuthContext = createContext<AuthContextValue | undefined>(undefined)
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<User | null>(null)
+  const [isLoading, setIsLoading] = useState(!!userManager)
+  const callbackHandledRef = useRef(false)
+
+  useEffect(() => {
+    if (!userManager) {
+      return
+    }
+
+    let cancelled = false
+    userManager
+      .getUser()
+      .then((loadedUser) => {
+        if (!cancelled) {
+          setUser(loadedUser ?? null)
+          if (loadedUser) {
+            setCookieFromUser(loadedUser)
+          }
+        }
+      })
+      .finally(() => {
+        if (!cancelled) setIsLoading(false)
+      })
+
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  useEffect(() => {
+    const manager = userManager
+    if (!manager) return
+
+    const handleLoaded = (nextUser: User) => {
+      setUser(nextUser)
+      setCookieFromUser(nextUser)
+    }
+    const handleUnloaded = () => {
+      setUser(null)
+      clearFaSessionCookie()
+    }
+
+    manager.events.addUserLoaded(handleLoaded)
+    manager.events.addUserUnloaded(handleUnloaded)
+    manager.events.addUserSignedOut(handleUnloaded)
+
+    return () => {
+      manager.events.removeUserLoaded(handleLoaded)
+      manager.events.removeUserUnloaded(handleUnloaded)
+      manager.events.removeUserSignedOut(handleUnloaded)
+    }
+  }, [])
+
+  useEffect(() => {
+    const manager = userManager
+    if (!manager || callbackHandledRef.current) return
+
+    const url = new URL(window.location.href)
+    const hasAuthParams =
+      url.searchParams.has('code') ||
+      url.searchParams.has('id_token') ||
+      url.searchParams.has('error')
+
+    if (!hasAuthParams) return
+
+    callbackHandledRef.current = true
+    manager
+      .signinRedirectCallback()
+      .then((nextUser) => {
+        setUser(nextUser ?? null)
+        if (nextUser) {
+          setCookieFromUser(nextUser)
+        }
+      })
+      .catch((error) => {
+        console.error('Failed to complete sign-in redirect', error)
+      })
+      .finally(() => {
+        const cleanUrl = `${url.origin}${url.pathname}`
+        window.history.replaceState({}, document.title, cleanUrl)
+      })
+  }, [])
+
+  const login = useCallback(async () => {
+    const manager = userManager
+    if (!manager) {
+      console.warn('OIDC is not configured; set VITE_OIDC_* environment variables.')
+      return
+    }
+    await manager.signinRedirect()
+  }, [])
+
+  const logout = useCallback(async () => {
+    const manager = userManager
+    if (!manager) {
+      console.warn('OIDC is not configured; set VITE_OIDC_* environment variables.')
+      return
+    }
+    try {
+      await manager.signoutRedirect()
+    } catch (error) {
+      console.error('Failed to sign out via redirect, clearing local session instead.', error)
+      await manager.removeUser()
+      setUser(null)
+      clearFaSessionCookie()
+    }
+  }, [])
+
+  const value = useMemo<AuthContextValue>(
+    () => ({
+      user,
+      isLoading,
+      isConfigured: isOidcConfigured,
+      login,
+      logout,
+    }),
+    [isLoading, login, logout, user],
+  )
+
+  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
+}
+
+// eslint-disable-next-line react-refresh/only-export-components
+export function useAuth() {
+  const context = useContext(AuthContext)
+  if (!context) {
+    throw new Error('useAuth must be used within an AuthProvider')
+  }
+  return context
+}

fictionarchive-web/src/auth/oidcClient.ts

@@ -0,0 +1,36 @@
+import { UserManager, WebStorageStateStore, type UserManagerSettings } from 'oidc-client-ts'
+
+const authority = import.meta.env.VITE_OIDC_AUTHORITY
+const clientId = import.meta.env.VITE_OIDC_CLIENT_ID
+const redirectUri = import.meta.env.VITE_OIDC_REDIRECT_URI
+const postLogoutRedirectUri =
+  import.meta.env.VITE_OIDC_POST_LOGOUT_REDIRECT_URI ?? redirectUri
+const scope = import.meta.env.VITE_OIDC_SCOPE ?? 'openid profile email'
+
+export const isOidcConfigured =
+  Boolean(authority) && Boolean(clientId) && Boolean(redirectUri)
+
+function buildSettings(): UserManagerSettings | null {
+  if (!isOidcConfigured) return null
+
+  return {
+    authority: authority!,
+    client_id: clientId!,
+    redirect_uri: redirectUri!,
+    post_logout_redirect_uri: postLogoutRedirectUri,
+    response_type: 'code',
+    scope,
+    loadUserInfo: true,
+    automaticSilentRenew: true,
+    userStore:
+      typeof window !== 'undefined'
+        ? new WebStorageStateStore({ store: window.localStorage })
+        : undefined,
+  }
+}
+
+export const userManager = (() => {
+  const settings = buildSettings()
+  if (!settings) return null
+  return new UserManager(settings)
+})()

fictionarchive-web/src/components/AuthenticationDisplay.tsx

@@ -0,0 +1,103 @@
+import { useEffect, useMemo, useRef, useState } from 'react'
+import { useAuth } from '../auth/AuthContext'
+import { Button } from './ui/button'
+
+export function AuthenticationDisplay() {
+  const { user, isConfigured, isLoading, login, logout } = useAuth()
+  const [isOpen, setIsOpen] = useState(false)
+  const menuRef = useRef<HTMLDivElement>(null)
+
+  const email = useMemo(
+    () =>
+      user?.profile?.email ??
+      user?.profile?.preferred_username ??
+      user?.profile?.name ??
+      user?.profile?.sub ??
+      null,
+    [user],
+  )
+
+  useEffect(() => {
+    if (!isOpen) return
+
+    const handleClickOutside = (event: MouseEvent) => {
+      if (!menuRef.current) return
+      if (!menuRef.current.contains(event.target as Node)) {
+        setIsOpen(false)
+      }
+    }
+
+    const handleEscape = (event: KeyboardEvent) => {
+      if (event.key === 'Escape') setIsOpen(false)
+    }
+
+    document.addEventListener('mousedown', handleClickOutside)
+    document.addEventListener('keydown', handleEscape)
+
+    return () => {
+      document.removeEventListener('mousedown', handleClickOutside)
+      document.removeEventListener('keydown', handleEscape)
+    }
+  }, [isOpen])
+
+  if (isLoading) {
+    return (
+      <Button variant="outline" size="sm" disabled>
+        Loading...
+      </Button>
+    )
+  }
+
+  if (!isConfigured) {
+    return (
+      <Button
+        variant="secondary"
+        size="sm"
+        onClick={() =>
+          alert('OIDC is not configured. Set VITE_OIDC_* environment variables to enable login.')
+        }
+      >
+        Configure OIDC
+      </Button>
+    )
+  }
+
+  if (!user) {
+    return (
+      <Button variant="secondary" size="sm" onClick={login}>
+        Login
+      </Button>
+    )
+  }
+
+  return (
+    <div className="relative" ref={menuRef}>
+      <Button
+        variant="ghost"
+        size="sm"
+        className="flex items-center gap-2 text-foreground"
+        onClick={() => setIsOpen((open) => !open)}
+        aria-expanded={isOpen}
+        aria-haspopup="menu"
+      >
+        <span className="inline-flex h-7 w-7 items-center justify-center rounded-full bg-primary/10 text-sm font-semibold text-primary">
+          {(email ?? 'User').slice(0, 1).toUpperCase()}
+        </span>
+        <span className="max-w-[12ch] truncate">{email ?? 'User'}</span>
+      </Button>
+      {isOpen && (
+        <div className="absolute right-0 top-full mt-2 w-56 rounded-lg border bg-white p-2 shadow-lg">
+          <div className="px-3 py-2">
+            <p className="text-xs font-semibold uppercase tracking-wide text-muted-foreground">
+              Signed in
+            </p>
+            <p className="truncate text-sm font-medium text-foreground">{email ?? 'User'}</p>
+          </div>
+          <Button variant="ghost" size="sm" className="w-full justify-start" onClick={logout}>
+            Log out
+          </Button>
+        </div>
+      )}
+    </div>
+  )
+}

fictionarchive-web/src/components/Navbar.tsx

@@ -0,0 +1,50 @@
+import { Link, NavLink } from 'react-router-dom'
+import { AuthenticationDisplay } from './AuthenticationDisplay'
+import { Button } from './ui/button'
+import { Input } from './ui/input'
+
+export function Navbar() {
+  return (
+    <nav className="sticky top-0 z-10 border-b bg-white/80 backdrop-blur">
+      <div className="mx-auto flex max-w-6xl items-center gap-6 px-4 py-3 sm:px-6 lg:px-8">
+        <div className="flex items-center gap-3">
+          <Link to="/" className="flex items-center gap-3">
+            <div
+              className="flex h-10 w-10 select-none items-center justify-center rounded-xl bg-primary text-primary-foreground font-bold shadow-md shadow-primary/20"
+              translate="no"
+              aria-label="FictionArchive"
+            >
+              FA
+            </div>
+            <div>
+              <p className="text-sm font-semibold text-foreground">FictionArchive</p>
+              <p className="text-xs text-muted-foreground">GraphQL playground</p>
+            </div>
+          </Link>
+        </div>
+        <div className="flex items-center gap-2 text-sm font-medium text-muted-foreground">
+          <Button variant="ghost" size="sm" asChild>
+            <NavLink
+              to="/"
+              className={({ isActive }) =>
+                isActive ? 'text-foreground' : 'text-muted-foreground'
+              }
+            >
+              Novels
+            </NavLink>
+          </Button>
+        </div>
+        <div className="ml-auto flex items-center gap-3">
+          <div className="flex items-center gap-2">
+            <Input
+              placeholder="Search"
+              className="w-48 sm:w-64"
+              aria-label="Search"
+            />
+          </div>
+          <AuthenticationDisplay />
+        </div>
+      </div>
+    </nav>
+  )
+}

fictionarchive-web/src/components/NovelCard.tsx

@@ -0,0 +1,49 @@
+import type { NovelsQuery } from '../__generated__/graphql'
+import { Card, CardContent, CardHeader, CardTitle } from './ui/card'
+
+type NovelNode = NonNullable<NonNullable<NovelsQuery['novels']>['edges']>[number]['node']
+
+type NovelCardProps = {
+  novel: NovelNode
+}
+
+function pickText(novelText?: NovelNode['name'] | NovelNode['description']) {
+  const texts = novelText?.texts ?? []
+  const english = texts.find((t) => t.language === 'EN')
+  return (english ?? texts[0])?.text ?? 'No description available.'
+}
+
+export function NovelCard({ novel }: NovelCardProps) {
+  const title = pickText(novel.name)
+  const description = pickText(novel.description)
+  const cover = novel.coverImage
+
+  const coverSrc = cover?.newPath ?? cover?.originalPath
+
+  return (
+    <Card className="overflow-hidden border shadow-sm hover:shadow-md transition-shadow">
+      {coverSrc ? (
+        <div className="aspect-[3/4] w-full overflow-hidden bg-muted/50">
+          <img
+            src={coverSrc}
+            alt={title}
+            className="h-full w-full object-cover"
+            loading="lazy"
+          />
+        </div>
+      ) : (
+        <div className="aspect-[3/4] w-full bg-muted/50" />
+      )}
+      <CardHeader className="space-y-2">
+        <CardTitle className="line-clamp-2 text-lg leading-tight">
+          {title}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="pt-0">
+        <p className="line-clamp-3 text-sm text-muted-foreground">
+          {description}
+        </p>
+      </CardContent>
+    </Card>
+  )
+}

fictionarchive-web/src/components/ui/badge.tsx

@@ -0,0 +1,35 @@
+import * as React from 'react'
+import { cva, type VariantProps } from 'class-variance-authority'
+
+import { cn } from '../../lib/utils'
+
+const badgeVariants = cva(
+  'inline-flex items-center rounded-full border px-2.5 py-0.5 text-xs font-semibold transition-colors focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2',
+  {
+    variants: {
+      variant: {
+        default:
+          'border-transparent bg-primary text-primary-foreground shadow hover:bg-primary/90',
+        secondary:
+          'border-transparent bg-secondary text-secondary-foreground hover:bg-secondary/80',
+        outline: 'text-foreground',
+      },
+    },
+    defaultVariants: {
+      variant: 'default',
+    },
+  }
+)
+
+export interface BadgeProps
+  extends React.HTMLAttributes<HTMLDivElement>,
+    VariantProps<typeof badgeVariants> {}
+
+function Badge({ className, variant, ...props }: BadgeProps) {
+  return (
+    <div className={cn(badgeVariants({ variant }), className)} {...props} />
+  )
+}
+
+// eslint-disable-next-line react-refresh/only-export-components
+export { Badge, badgeVariants }

fictionarchive-web/src/components/ui/button.tsx

@@ -0,0 +1,55 @@
+import * as React from 'react'
+
+import { Slot } from '@radix-ui/react-slot'
+import { cva, type VariantProps } from 'class-variance-authority'
+
+import { cn } from '../../lib/utils'
+
+const buttonVariants = cva(
+  'inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 ring-offset-background',
+  {
+    variants: {
+      variant: {
+        default: 'bg-primary text-primary-foreground shadow hover:bg-primary/90',
+        secondary:
+          'bg-secondary text-secondary-foreground hover:bg-secondary/80',
+        outline:
+          'border border-input bg-background hover:bg-accent hover:text-accent-foreground shadow-sm',
+        ghost: 'hover:bg-accent hover:text-accent-foreground',
+      },
+      size: {
+        default: 'h-10 px-4 py-2',
+        sm: 'h-9 rounded-md px-3',
+        lg: 'h-11 rounded-md px-8',
+        icon: 'h-10 w-10',
+      },
+    },
+    defaultVariants: {
+      variant: 'default',
+      size: 'default',
+    },
+  }
+)
+
+export interface ButtonProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
+    VariantProps<typeof buttonVariants> {
+  asChild?: boolean
+}
+
+const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+  ({ className, variant, size, asChild = false, ...props }, ref) => {
+    const Comp = asChild ? Slot : 'button'
+    return (
+      <Comp
+        className={cn(buttonVariants({ variant, size, className }))}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Button.displayName = 'Button'
+
+// eslint-disable-next-line react-refresh/only-export-components
+export { Button, buttonVariants }

fictionarchive-web/src/components/ui/card.tsx

@@ -0,0 +1,76 @@
+import * as React from 'react'
+
+import { cn } from '../../lib/utils'
+
+const Card = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn(
+      'rounded-xl border bg-card text-card-foreground shadow-sm',
+      className
+    )}
+    {...props}
+  />
+))
+Card.displayName = 'Card'
+
+const CardHeader = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn('flex flex-col space-y-1.5 p-6', className)}
+    {...props}
+  />
+))
+CardHeader.displayName = 'CardHeader'
+
+const CardTitle = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLHeadingElement>
+>(({ className, ...props }, ref) => (
+  <h3
+    ref={ref}
+    className={cn('text-2xl font-semibold leading-none tracking-tight', className)}
+    {...props}
+  />
+))
+CardTitle.displayName = 'CardTitle'
+
+const CardDescription = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, ...props }, ref) => (
+  <p
+    ref={ref}
+    className={cn('text-sm text-muted-foreground', className)}
+    {...props}
+  />
+))
+CardDescription.displayName = 'CardDescription'
+
+const CardContent = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div ref={ref} className={cn('p-6 pt-0', className)} {...props} />
+))
+CardContent.displayName = 'CardContent'
+
+const CardFooter = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn('flex items-center p-6 pt-0', className)}
+    {...props}
+  />
+))
+CardFooter.displayName = 'CardFooter'
+
+export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent }

fictionarchive-web/src/components/ui/input.tsx

@@ -0,0 +1,24 @@
+import * as React from 'react'
+
+import { cn } from '../../lib/utils'
+
+export type InputProps = React.InputHTMLAttributes<HTMLInputElement>
+
+const Input = React.forwardRef<HTMLInputElement, InputProps>(
+  ({ className, type, ...props }, ref) => {
+    return (
+      <input
+        type={type}
+        className={cn(
+          'flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm shadow-sm transition-colors file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50',
+          className
+        )}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Input.displayName = 'Input'
+
+export { Input }

fictionarchive-web/src/graphql/novels.graphql

@@ -0,0 +1,31 @@
+query Novels($first: Int, $after: String) {
+  novels(first: $first, after: $after) {
+    edges {
+      cursor
+      node {
+        id
+        url
+        name {
+          texts {
+            language
+            text
+          }
+        }
+        description {
+          texts {
+            language
+            text
+          }
+        }
+        coverImage {
+          originalPath
+          newPath
+        }
+      }
+    }
+    pageInfo {
+      hasNextPage
+      endCursor
+    }
+  }
+}

fictionarchive-web/src/index.css

@@ -0,0 +1,69 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+:root {
+  --background: 210 40% 98%;
+  --foreground: 222 47% 11%;
+  --muted: 214 32% 91%;
+  --muted-foreground: 215 16% 47%;
+  --popover: 0 0% 100%;
+  --popover-foreground: 222 47% 11%;
+  --card: 0 0% 100%;
+  --card-foreground: 222 47% 11%;
+  --border: 214 32% 91%;
+  --input: 214 32% 91%;
+  --primary: 243 75% 59%;
+  --primary-foreground: 0 0% 100%;
+  --secondary: 240 33% 94%;
+  --secondary-foreground: 222 47% 11%;
+  --accent: 220 70% 96%;
+  --accent-foreground: 222 47% 11%;
+  --destructive: 0 84% 60%;
+  --destructive-foreground: 0 0% 100%;
+  --ring: 243 75% 59%;
+  --radius: 12px;
+  --font-sans: 'Inter', 'Segoe UI', system-ui, -apple-system, sans-serif;
+}
+
+.dark {
+  --background: 222 47% 11%;
+  --foreground: 210 40% 98%;
+  --muted: 222 47% 14%;
+  --muted-foreground: 215 20% 65%;
+  --popover: 222 47% 11%;
+  --popover-foreground: 210 40% 98%;
+  --card: 222 47% 11%;
+  --card-foreground: 210 40% 98%;
+  --border: 222 47% 20%;
+  --input: 222 47% 20%;
+  --primary: 243 75% 70%;
+  --primary-foreground: 222 47% 11%;
+  --secondary: 222 47% 20%;
+  --secondary-foreground: 210 40% 98%;
+  --accent: 222 47% 20%;
+  --accent-foreground: 210 40% 98%;
+  --destructive: 0 84% 60%;
+  --destructive-foreground: 210 40% 98%;
+  --ring: 243 75% 70%;
+}
+
+* {
+  @apply border-border;
+}
+
+body {
+  @apply bg-background text-foreground min-h-screen antialiased;
+  background-image: radial-gradient(circle at 20% 20%, #eef2ff, transparent 32%),
+    radial-gradient(circle at 80% 10%, #dcfce7, transparent 25%),
+    radial-gradient(circle at 50% 80%, #fee2e2, transparent 20%),
+    linear-gradient(180deg, rgba(255, 255, 255, 0.9), rgba(248, 250, 252, 0.95));
+}
+
+a {
+  @apply text-primary font-medium;
+}
+
+a:hover {
+  @apply underline;
+}

fictionarchive-web/src/layouts/AppLayout.tsx

@@ -0,0 +1,13 @@
+import { Outlet } from 'react-router-dom'
+import { Navbar } from '../components/Navbar'
+
+export function AppLayout() {
+  return (
+    <div className="min-h-screen bg-slate-50">
+      <Navbar />
+      <main className="mx-auto flex max-w-6xl flex-col gap-6 px-4 py-8 sm:px-6 lg:px-8">
+        <Outlet />
+      </main>
+    </div>
+  )
+}

fictionarchive-web/src/lib/utils.ts

@@ -0,0 +1,6 @@
+import { type ClassValue, clsx } from 'clsx'
+import { twMerge } from 'tailwind-merge'
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}

fictionarchive-web/src/main.tsx

@@ -0,0 +1,20 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import './index.css'
+import App from './App.tsx'
+import { ApolloProvider } from '@apollo/client/react'
+import { apolloClient } from './apolloClient.ts'
+import { AuthProvider } from './auth/AuthContext'
+import { BrowserRouter } from 'react-router-dom'
+
+createRoot(document.getElementById('root')!).render(
+  <StrictMode>
+    <AuthProvider>
+      <ApolloProvider client={apolloClient}>
+        <BrowserRouter>
+          <App />
+        </BrowserRouter>
+      </ApolloProvider>
+    </AuthProvider>
+  </StrictMode>,
+)

fictionarchive-web/src/pages/NotFoundPage.tsx

@@ -0,0 +1,17 @@
+import { Card, CardContent, CardHeader, CardTitle } from '../components/ui/card'
+
+export function NotFoundPage() {
+  return (
+    <Card className="shadow-md shadow-primary/10">
+      <CardHeader>
+        <CardTitle>Page not found</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <p className="text-sm text-muted-foreground">
+          The page you are looking for does not exist. Head back to the novels
+          list to continue.
+        </p>
+      </CardContent>
+    </Card>
+  )
+}

fictionarchive-web/src/pages/NovelDetailPage.tsx

@@ -0,0 +1,17 @@
+import { Card, CardContent, CardHeader, CardTitle } from '../components/ui/card'
+
+export function NovelDetailPage() {
+  return (
+    <Card className="shadow-md shadow-primary/10">
+      <CardHeader>
+        <CardTitle>Novel details</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <p className="text-sm text-muted-foreground">
+          Detail view coming soon. Select a novel to explore chapters and
+          metadata once implemented.
+        </p>
+      </CardContent>
+    </Card>
+  )
+}

fictionarchive-web/src/pages/NovelsPage.tsx

@@ -0,0 +1,111 @@
+import { useMemo } from 'react'
+
+import { useQuery } from '@apollo/client/react'
+import { NovelsDocument } from '../__generated__/graphql'
+import { NovelCard } from '../components/NovelCard'
+import { Button } from '../components/ui/button'
+import { Card, CardContent, CardHeader, CardTitle } from '../components/ui/card'
+
+const PAGE_SIZE = 12
+
+export function NovelsPage() {
+  const { data, loading, error, fetchMore } = useQuery(NovelsDocument, {
+    variables: { first: PAGE_SIZE, after: null },
+    notifyOnNetworkStatusChange: true,
+  })
+
+  const pageInfo = data?.novels?.pageInfo
+  const hasNextPage = pageInfo?.hasNextPage ?? false
+  const endCursor = pageInfo?.endCursor ?? null
+
+  const novels = useMemo(
+    () => (data?.novels?.edges ?? []).map((edge) => edge?.node).filter(Boolean),
+    [data?.novels?.edges]
+  )
+
+  async function handleLoadMore() {
+    if (!hasNextPage || !endCursor) return
+    await fetchMore({
+      variables: { after: endCursor, first: PAGE_SIZE },
+      updateQuery: (prev, { fetchMoreResult }) => {
+        if (!fetchMoreResult?.novels?.edges) return prev
+        const mergedEdges = [
+          ...(prev.novels?.edges ?? []),
+          ...fetchMoreResult.novels.edges,
+        ]
+        return {
+          ...prev,
+          novels: {
+            ...fetchMoreResult.novels,
+            edges: mergedEdges,
+          },
+        }
+      },
+    })
+  }
+
+  return (
+    <div className="space-y-4">
+      <Card className="shadow-md shadow-primary/10">
+        <CardHeader>
+          <CardTitle>Latest Novels</CardTitle>
+          <p className="text-sm text-muted-foreground">
+            Novels that have recently been updated.
+          </p>
+        </CardHeader>
+      </Card>
+
+      {loading && !data && (
+        <Card>
+          <CardContent>
+            <div className="flex items-center justify-center py-8">
+              <div className="h-10 w-10 animate-spin rounded-full border-2 border-primary border-t-transparent" aria-label="Loading novels" />
+            </div>
+          </CardContent>
+        </Card>
+      )}
+
+      {error && (
+        <Card className="border-destructive/40 bg-destructive/5">
+          <CardContent>
+            <p className="py-4 text-sm text-destructive">
+              Could not load novels: {error.message}
+            </p>
+          </CardContent>
+        </Card>
+      )}
+
+      {!loading && novels.length === 0 && !error && (
+        <Card>
+          <CardContent>
+            <p className="py-4 text-sm text-muted-foreground">
+              No novels found yet. Try adding content to the gateway.
+            </p>
+          </CardContent>
+        </Card>
+      )}
+
+      {novels.length > 0 && (
+        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+          {novels.map(
+            (novel) =>
+              novel && <NovelCard key={novel.id.toString()} novel={novel} />
+          )}
+        </div>
+      )}
+
+      {hasNextPage && (
+        <div className="flex justify-center">
+          <Button
+            onClick={handleLoadMore}
+            variant="outline"
+            disabled={loading}
+            className="min-w-[160px]"
+          >
+            {loading ? 'Loading...' : 'Load more'}
+          </Button>
+        </div>
+      )}
+    </div>
+  )
+}

fictionarchive-web/tailwind.config.cjs

@@ -0,0 +1,69 @@
+const { fontFamily } = require('tailwindcss/defaultTheme')
+
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  darkMode: ['class'],
+  content: ['./index.html', './src/**/*.{ts,tsx}'],
+  theme: {
+    extend: {
+      colors: {
+        border: 'hsl(var(--border))',
+        input: 'hsl(var(--input))',
+        ring: 'hsl(var(--ring))',
+        background: 'hsl(var(--background))',
+        foreground: 'hsl(var(--foreground))',
+        primary: {
+          DEFAULT: 'hsl(var(--primary))',
+          foreground: 'hsl(var(--primary-foreground))',
+        },
+        secondary: {
+          DEFAULT: 'hsl(var(--secondary))',
+          foreground: 'hsl(var(--secondary-foreground))',
+        },
+        destructive: {
+          DEFAULT: 'hsl(var(--destructive))',
+          foreground: 'hsl(var(--destructive-foreground))',
+        },
+        muted: {
+          DEFAULT: 'hsl(var(--muted))',
+          foreground: 'hsl(var(--muted-foreground))',
+        },
+        accent: {
+          DEFAULT: 'hsl(var(--accent))',
+          foreground: 'hsl(var(--accent-foreground))',
+        },
+        popover: {
+          DEFAULT: 'hsl(var(--popover))',
+          foreground: 'hsl(var(--popover-foreground))',
+        },
+        card: {
+          DEFAULT: 'hsl(var(--card))',
+          foreground: 'hsl(var(--card-foreground))',
+        },
+      },
+      borderRadius: {
+        lg: 'var(--radius)',
+        md: 'calc(var(--radius) - 2px)',
+        sm: 'calc(var(--radius) - 4px)',
+      },
+      fontFamily: {
+        sans: ['var(--font-sans)', ...fontFamily.sans],
+      },
+      keyframes: {
+        'accordion-down': {
+          from: { height: '0' },
+          to: { height: 'var(--radix-accordion-content-height)' },
+        },
+        'accordion-up': {
+          from: { height: 'var(--radix-accordion-content-height)' },
+          to: { height: '0' },
+        },
+      },
+      animation: {
+        'accordion-down': 'accordion-down 0.2s ease-out',
+        'accordion-up': 'accordion-up 0.2s ease-out',
+      },
+    },
+  },
+  plugins: [require('tailwindcss-animate')],
+}

fictionarchive-web/tsconfig.app.json

@@ -0,0 +1,28 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "types": ["vite/client"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["src"]
+}

fictionarchive-web/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}

fictionarchive-web/tsconfig.node.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["vite.config.ts"]
+}

fictionarchive-web/vite.config.ts

@@ -0,0 +1,22 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+import path from 'node:path'
+
+// https://vite.dev/config/
+export default defineConfig({
+  plugins: [react()],
+  resolve: {
+    alias: {
+      react: path.resolve(__dirname, 'node_modules/react'),
+      'react-dom': path.resolve(__dirname, 'node_modules/react-dom'),
+      'react/jsx-runtime': path.resolve(
+        __dirname,
+        'node_modules/react/jsx-runtime'
+      ),
+      'react/jsx-dev-runtime': path.resolve(
+        __dirname,
+        'node_modules/react/jsx-dev-runtime'
+      ),
+    },
+  },
+})