fix: harden portfolio storefront QA and flash sale polish

Author: Nguyen Son

.gitignore

@@ -69,6 +69,8 @@ playwright-report/
 frontend/playwright-report/
 frontend/test-results/
 frontend/artifacts/
+docs/portfolio/screenshots/
+frontend/docs/portfolio/qa-current/
 
 # Cursor
 .cursor/

backend/src/main/java/com/bookstore/config/CatalogDataSeeder.java

@@ -9,11 +9,13 @@
 import org.slf4j.Logger;
 
 import java.math.BigDecimal;
+import java.text.Normalizer;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.Random;
 import java.util.Set;
 
@@ -29,6 +31,50 @@ public final class CatalogDataSeeder {
             "Tái bản chọn lọc",
             "Bản sưu tầm"
     };
+    private static final Map<String, String> PRIORITY_GENERATED_COVERS = Map.ofEntries(
+            Map.entry("nghe-thuat/mau-sac-va-cam-xuc-an-ban-dac-biet", "/images/books/generated/nghe-thuat-mau-sac-va-cam-xuc-an-ban-dac-biet.png"),
+            Map.entry("nghe-thuat/anh-dep-quanh-ta-an-ban-dac-biet", "/images/books/generated/nghe-thuat-anh-dep-quanh-ta-an-ban-dac-biet.png"),
+            Map.entry("nghe-thuat/nhap-mon-hoi-hoa-an-ban-dac-biet", "/images/books/generated/nghe-thuat-nhap-mon-hoi-hoa-an-ban-dac-biet.png"),
+            Map.entry("nghe-thuat/so-tay-sang-tao", "/images/books/generated/nghe-thuat-so-tay-sang-tao.png"),
+            Map.entry("nghe-thuat/chat-lieu-va-anh-sang", "/images/books/generated/nghe-thuat-chat-lieu-va-anh-sang.png"),
+            Map.entry("nghe-thuat/bo-cuc-trong-thiet-ke", "/images/books/generated/nghe-thuat-bo-cuc-trong-thiet-ke.png"),
+            Map.entry("nghe-thuat/cau-chuyen-my-thuat", "/images/books/generated/nghe-thuat-cau-chuyen-my-thuat.png"),
+            Map.entry("nghe-thuat/nhiep-anh-duong-pho", "/images/books/generated/nghe-thuat-nhiep-anh-duong-pho.png"),
+            Map.entry("nghe-thuat/thiet-ke-tu-co-ban", "/images/books/generated/nghe-thuat-thiet-ke-tu-co-ban.png"),
+            Map.entry("nghe-thuat/ky-hoa-moi-ngay", "/images/books/generated/nghe-thuat-ky-hoa-moi-ngay.png"),
+            Map.entry("nghe-thuat/mau-sac-va-cam-xuc", "/images/books/generated/nghe-thuat-mau-sac-va-cam-xuc.png"),
+            Map.entry("nghe-thuat/anh-dep-quanh-ta", "/images/books/generated/nghe-thuat-anh-dep-quanh-ta.png"),
+            Map.entry("nghe-thuat/nhap-mon-hoi-hoa", "/images/books/generated/nghe-thuat-nhap-mon-hoi-hoa.png"),
+            Map.entry("am-thuc/cam-nang-lam-banh-an-ban-dac-biet", "/images/books/generated/am-thuc-cam-nang-lam-banh-an-ban-dac-biet.png"),
+            Map.entry("am-thuc/mon-viet-cuoi-tuan-an-ban-dac-biet", "/images/books/generated/am-thuc-mon-viet-cuoi-tuan-an-ban-dac-biet.png"),
+            Map.entry("am-thuc/bep-nha-an-yen-an-ban-dac-biet", "/images/books/generated/am-thuc-bep-nha-an-yen-an-ban-dac-biet.png"),
+            Map.entry("am-thuc/nghe-thuat-pha-che", "/images/books/generated/am-thuc-nghe-thuat-pha-che.png"),
+            Map.entry("am-thuc/thuc-don-30-ngay", "/images/books/generated/am-thuc-thuc-don-30-ngay.png"),
+            Map.entry("am-thuc/mon-ngon-dai-khach", "/images/books/generated/am-thuc-mon-ngon-dai-khach.png"),
+            Map.entry("am-thuc/huong-vi-mien-trung", "/images/books/generated/am-thuc-huong-vi-mien-trung.png"),
+            Map.entry("am-thuc/bep-chay-moi-ngay", "/images/books/generated/am-thuc-bep-chay-moi-ngay.png"),
+            Map.entry("am-thuc/bua-com-gia-dinh", "/images/books/generated/am-thuc-bua-com-gia-dinh.png"),
+            Map.entry("sach-giao-khoa/toan-lop-1", "/images/books/generated/sach-giao-khoa-toan-lop-1.png"),
+            Map.entry("phat-trien-ban-than/doc-vi-ban-than", "/images/books/generated/phat-trien-ban-than-doc-vi-ban-than.png"),
+            Map.entry("lich-su/lich-su-viet-nam", "/images/books/generated/lich-su-lich-su-viet-nam.png"),
+            Map.entry("tieu-thuyet/dac-nhan-tam", "/images/books/generated/tieu-thuyet-dac-nhan-tam.png"),
+            Map.entry("sach-thieu-nhi/co-be-ban-diem", "/images/books/generated/sach-thieu-nhi-co-be-ban-diem.png"),
+            Map.entry("tho/dac-nhan-tam", "/images/books/generated/tho-dac-nhan-tam.png"),
+            Map.entry("marketing/nghi-lon", "/images/books/generated/marketing-nghi-lon.png"),
+            Map.entry("lanh-dao/nghi-lon", "/images/books/generated/lanh-dao-nghi-lon.png"),
+            Map.entry("cong-nghe/co-the-cua-ban", "/images/books/generated/cong-nghe-co-the-cua-ban.png"),
+            Map.entry("sach-thieu-nhi/doraemon-tap-1-50", "/images/books/generated/sach-thieu-nhi-doraemon-tap-1-50.png"),
+            Map.entry("sach-giao-khoa/vat-ly-lop-10", "/images/books/generated/sach-giao-khoa-vat-ly-lop-10.png"),
+            Map.entry("sach-thieu-nhi/alice-o-xu-so-than-tien", "/images/books/generated/sach-thieu-nhi-alice-o-xu-so-than-tien.png"),
+            Map.entry("tho/harry-potter-va-hon-da-phu-thuy", "/images/books/generated/tho-harry-potter-va-hon-da-phu-thuy.png"),
+            Map.entry("van-hoc-co-dien/harry-potter-va-hon-da-phu-thuy", "/images/books/generated/van-hoc-co-dien-harry-potter-va-hon-da-phu-thuy.png"),
+            Map.entry("sach-ngoai-van/1984-george-orwell", "/images/books/generated/sach-ngoai-van-1984-george-orwell.png"),
+            Map.entry("am-thuc/cam-nang-lam-banh", "/images/books/generated/am-thuc-cam-nang-lam-banh.png"),
+            Map.entry("sach-ngoai-van/pride-and-prejudice", "/images/books/generated/sach-ngoai-van-pride-and-prejudice.png"),
+            Map.entry("lanh-dao/khoi-nghiep-tu-san-sau", "/images/books/generated/lanh-dao-khoi-nghiep-tu-san-sau.png"),
+            Map.entry("sach-thieu-nhi/harry-potter-bo-day-du", "/images/books/generated/sach-thieu-nhi-harry-potter-bo-day-du.png"),
+            Map.entry("khoa-hoc-tu-nhien/nguoi-dan-duong", "/images/books/generated/khoa-hoc-tu-nhien-nguoi-dan-duong.png")
+    );
 
     private CatalogDataSeeder() {
     }
@@ -354,7 +400,7 @@ private static List<Product> buildSampleProducts(List<Category> categorySlots, L
                 boolean isFeatured = i < 3;
                 boolean isBestseller = i < 4;
                 boolean isNew = i >= 2 && i < 6;
-                String imageUrl = resolvePlaceholderPath(cat);
+                String imageUrl = resolveProductImagePath(cat, title);
                 String shortDesc = buildShortDescription(cat.getName(), author, publisher);
                 String description = buildLongDescription(cat.getName(), author, publisher, pages);
 
@@ -535,11 +581,27 @@ private static String resolvePlaceholderPath(Category category) {
         };
     }
 
+    private static String resolveProductImagePath(Category category, String title) {
+        String generatedCoverPath = resolveGeneratedCoverPath(category, title);
+        if (generatedCoverPath != null) {
+            return generatedCoverPath;
+        }
+
+        return resolvePlaceholderPath(category);
+    }
+
     private static String resolveNormalizedImageUrl(Product product) {
         if (product != null && ShowcaseBookCatalog.isCuratedIsbn(product.getIsbn())) {
             return ShowcaseBookCatalog.localCoverPath(product.getIsbn());
         }
 
+        String generatedCoverPath = resolveGeneratedCoverPath(
+                product != null ? product.getCategory() : null,
+                product != null ? product.getName() : null);
+        if (generatedCoverPath != null) {
+            return generatedCoverPath;
+        }
+
         if (product != null && product.getImages() != null) {
             for (String image : product.getImages()) {
                 if (image != null && !image.isBlank() && image.startsWith("/")) {
@@ -562,15 +624,22 @@ private static List<String> resolveNormalizedImages(Product product, String norm
             images.add(ShowcaseBookCatalog.localCoverPath(product.getIsbn()));
         }
 
+        String generatedCoverPath = resolveGeneratedCoverPath(
+                product != null ? product.getCategory() : null,
+                product != null ? product.getName() : null);
+        if (generatedCoverPath != null) {
+            images.add(generatedCoverPath);
+        }
+
         if (product != null && product.getImages() != null) {
             for (String image : product.getImages()) {
-                if (image != null && !image.isBlank() && image.startsWith("/")) {
+                if (isReusableLocalImagePath(image, generatedCoverPath)) {
                     images.add(image);
                 }
             }
         }
 
-        if (product != null && product.getImageUrl() != null && !product.getImageUrl().isBlank() && product.getImageUrl().startsWith("/")) {
+        if (product != null && isReusableLocalImagePath(product.getImageUrl(), generatedCoverPath)) {
             images.add(product.getImageUrl());
         }
 
@@ -580,4 +649,43 @@ private static List<String> resolveNormalizedImages(Product product, String norm
 
         return List.copyOf(images);
     }
+
+    private static String resolveGeneratedCoverPath(Category category, String title) {
+        String key = generatedCoverKey(category, title);
+        if (key.isBlank()) {
+            return null;
+        }
+
+        return PRIORITY_GENERATED_COVERS.get(key);
+    }
+
+    private static String generatedCoverKey(Category category, String title) {
+        if (category == null || title == null || title.isBlank()) {
+            return "";
+        }
+
+        return slugifyCoverKey(category.getName()) + "/" + slugifyCoverKey(title);
+    }
+
+    private static String slugifyCoverKey(String value) {
+        if (value == null || value.isBlank()) {
+            return "";
+        }
+
+        return Normalizer.normalize(value, Normalizer.Form.NFD)
+                .replaceAll("\\p{M}+", "")
+                .replace('\u0111', 'd')
+                .replace('\u0110', 'D')
+                .toLowerCase(Locale.ROOT)
+                .replaceAll("[^a-z0-9]+", "-")
+                .replaceAll("(^-+|-+$)", "");
+    }
+
+    private static boolean isReusableLocalImagePath(String image, String generatedCoverPath) {
+        if (image == null || image.isBlank() || !image.startsWith("/")) {
+            return false;
+        }
+
+        return generatedCoverPath == null || !image.contains("/images/books/placeholders/");
+    }
 }

backend/src/main/java/com/bookstore/config/RateLimitingFilter.java

@@ -15,12 +15,8 @@
 import java.util.concurrent.atomic.AtomicInteger;
 
 /**
- * Rate Limiting Filter để bảo vệ ứng dụng khỏi brute-force attacks và DDoS.
- * 
- * Giới hạn:
- * - Auth endpoints: 5 requests/phút/IP
- * - API endpoints: 100 requests/phút/IP
- * - Public endpoints: 200 requests/phút/IP
+ * Rate limiting filter for protecting auth and API endpoints from brute-force
+ * and burst traffic.
  */
 @Component
 @Order(1)
@@ -29,25 +25,25 @@ public class RateLimitingFilter implements Filter {
 
     private final Map<String, RateLimitEntry> rateLimitMap = new ConcurrentHashMap<>();
 
-    @Value("${app.rate-limit.enabled:true}")
+    @Value("${app.rate-limit.enabled:${rate.limit.enabled:true}}")
     private boolean rateLimitEnabled;
 
-    @Value("${app.rate-limit.auth-limit:5}")
+    @Value("${app.rate-limit.auth-limit:${rate.limit.auth.limit:5}}")
     private int authLimit;
 
-    @Value("${app.rate-limit.auth-window-ms:60000}")
+    @Value("${app.rate-limit.auth-window-ms:${rate.limit.auth.window.ms:60000}}")
     private long authWindowMs;
 
-    @Value("${app.rate-limit.api-limit:100}")
+    @Value("${app.rate-limit.api-limit:${rate.limit.api.limit:100}}")
     private int apiLimit;
 
-    @Value("${app.rate-limit.api-window-ms:60000}")
+    @Value("${app.rate-limit.api-window-ms:${rate.limit.api.window.ms:60000}}")
     private long apiWindowMs;
 
-    @Value("${app.rate-limit.public-limit:200}")
+    @Value("${app.rate-limit.public-limit:${rate.limit.public.limit:200}}")
     private int publicLimit;
 
-    @Value("${app.rate-limit.public-window-ms:60000}")
+    @Value("${app.rate-limit.public-window-ms:${rate.limit.public.window.ms:60000}}")
     private long publicWindowMs;
 
     @Override
@@ -66,10 +62,8 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
         String requestUri = request.getRequestURI();
         String key = clientIp + ":" + requestUri;
 
-        // Xác định loại endpoint để áp dụng limit phù hợp
         RateLimitConfig config = getRateLimitConfig(request.getMethod(), requestUri);
 
-        // Kiểm tra rate limit
         RateLimitEntry entry = rateLimitMap.computeIfAbsent(key, k -> new RateLimitEntry(config.limit, config.windowMs));
 
         if (!entry.tryConsume()) {
@@ -86,7 +80,6 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
             return;
         }
 
-        // Thêm headers vào response
         response.setHeader("X-RateLimit-Limit", String.valueOf(config.limit));
         response.setHeader("X-RateLimit-Remaining", String.valueOf(entry.getRemaining()));
         response.setHeader("X-RateLimit-Reset", String.valueOf(entry.getResetTime() / 1000));

backend/src/main/java/com/bookstore/config/SecurityConfig.java

@@ -37,7 +37,8 @@
 public class SecurityConfig {
 
     private static final String DEFAULT_ALLOWED_ORIGINS =
-            "http://localhost:3000,http://localhost:3001,http://localhost:5173";
+            "http://localhost:3000,http://localhost:3001,http://localhost:5173,"
+                    + "http://127.0.0.1:3000,http://127.0.0.1:3001";
     static final String CONTENT_SECURITY_POLICY = String.join(" ",
             "default-src 'self';",
             "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com;",

backend/src/main/java/com/bookstore/config/WebMvcConfig.java

@@ -43,7 +43,12 @@ public void addResourceHandlers(ResourceHandlerRegistry registry) {
     public void addCorsMappings(CorsRegistry registry) {
         // CORS handled by SecurityConfig - this is fallback only
         registry.addMapping("/**")
-                .allowedOriginPatterns("http://localhost:3000", "http://localhost:3001", "http://localhost:5173")
+                .allowedOriginPatterns(
+                        "http://localhost:3000",
+                        "http://localhost:3001",
+                        "http://localhost:5173",
+                        "http://127.0.0.1:3000",
+                        "http://127.0.0.1:3001")
                 .allowedMethods("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS")
                 .allowedHeaders("*")
                 .exposedHeaders("Authorization", "X-Request-ID")

backend/src/main/resources/application-prod.properties

@@ -41,13 +41,13 @@ jwt.secret=${JWT_SECRET}
 # ===========================================
 # Rate Limiting Configuration (Production)
 # ===========================================
-app.rate-limit.enabled=true
-app.rate-limit.auth-limit=5
-app.rate-limit.auth-window-ms=60000
-app.rate-limit.api-limit=100
-app.rate-limit.api-window-ms=60000
-app.rate-limit.public-limit=200
-app.rate-limit.public-window-ms=60000
+app.rate-limit.enabled=${RATE_LIMIT_ENABLED:true}
+app.rate-limit.auth-limit=${RATE_LIMIT_AUTH_LIMIT:5}
+app.rate-limit.auth-window-ms=${RATE_LIMIT_AUTH_WINDOW_MS:60000}
+app.rate-limit.api-limit=${RATE_LIMIT_API_LIMIT:100}
+app.rate-limit.api-window-ms=${RATE_LIMIT_API_WINDOW_MS:60000}
+app.rate-limit.public-limit=${RATE_LIMIT_PUBLIC_LIMIT:200}
+app.rate-limit.public-window-ms=${RATE_LIMIT_PUBLIC_WINDOW_MS:60000}
 
 # ===========================================
 # Input Validation Configuration (Production)

docker-compose.e2e.yml

@@ -84,12 +84,12 @@ services:
       APP_DEMO_MANAGER_PASSWORD: E2ETestDemoManagerPasswordForBookStore123!
       APP_DEMO_CUSTOMER_PASSWORD: E2ETestDemoCustomerPasswordForBookStore123!
       # CORS
-      CORS_ORIGINS: http://localhost:3000,http://localhost:3001,http://frontend:3000
+      CORS_ORIGINS: http://localhost:3000,http://localhost:3001,http://127.0.0.1:3000,http://127.0.0.1:3001,http://frontend:3000
       # JPA
       JPA_DDL_AUTO: create-drop
       # Rate Limiting
       RATE_LIMIT_ENABLED: "true"
-      RATE_LIMIT_AUTH_LIMIT: "10"
+      RATE_LIMIT_AUTH_LIMIT: "500"
       RATE_LIMIT_API_LIMIT: "200"
       RATE_LIMIT_PUBLIC_LIMIT: "500"
       # Input Validation

frontend/e2e/additional.spec.ts

@@ -245,8 +245,6 @@ test.describe('Performance', () => {
 // ============================================
 
 test.describe('Wishlist', () => {
-  test.use({ storageState: 'storageState.json' } as any);
-
   test('Wishlist button is visible on product card', async ({ page }) => {
     await page.goto(`${BASE_URL}/products`);
     await page.waitForLoadState('networkidle');

frontend/e2e/admin-portfolio.spec.ts

@@ -36,20 +36,10 @@ async function capture(page: Page, testInfo: TestInfo, name: string) {
 
 async function assertNoMojibake(page: Page) {
   const bodyText = await page.locator("body").innerText();
-  const suspiciousSequences = [
-    "\u00c3",
-    "\u00c2",
-    "\u00c6",
-    "\u00c4",
-    "\u00e1\u00ba",
-    "\u00e1\u00bb",
-  ];
-
-  for (const sequence of suspiciousSequences) {
-    expect(bodyText).not.toContain(sequence);
-  }
+  const mojibakePattern =
+    /[\u00c2\u00c3\u00c4\u00c6][\u0080-\u00bf]|\u00e1[\u00ba\u00bb]|\ufffd/u;
 
-  expect(bodyText).not.toContain("\ufffd");
+  expect(bodyText).not.toMatch(mojibakePattern);
 }
 
 async function login(page: Page, email: string, password: string) {