Added locations tracking

src/main/java/com/crimeLink/analyzer/config/JwtAuthenticationFilter.java

@@ -30,8 +30,7 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
     protected void doFilterInternal(
             @NonNull HttpServletRequest request,
             @NonNull HttpServletResponse response,
-            @NonNull FilterChain filterChain
-    ) throws ServletException, IOException {
+            @NonNull FilterChain filterChain) throws ServletException, IOException {
 
         // ✅ Allow preflight
         if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
@@ -40,10 +39,12 @@ protected void doFilterInternal(
         }
 
         String path = request.getServletPath();
+        System.out.println("🔍 JwtAuthFilter - Path: " + path);
 
         // ✅ Public endpoints (do not try to parse JWT)
-        if (path.startsWith("/api/auth")
-                || path.startsWith("/api/mobile/auth")
+        if (path.startsWith("/api/auth/login")
+                || path.startsWith("/api/auth/refresh")
+                || path.startsWith("/api/mobile/auth/login")
                 || path.startsWith("/api/health")
                 || path.startsWith("/api/duties")
                 || path.startsWith("/api/leaves")){
@@ -52,9 +53,12 @@ protected void doFilterInternal(
         }
 
         final String authHeader = request.getHeader("Authorization");
+        System.out.println("🔍 Auth Header: "
+                + (authHeader != null ? authHeader.substring(0, Math.min(20, authHeader.length())) + "..." : "NULL"));
 
         // ✅ No token -> continue (SecurityConfig will decide permit/deny)
         if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            System.out.println("❌ No Bearer token found");
             filterChain.doFilter(request, response);
             return;
         }
@@ -67,20 +71,26 @@ protected void doFilterInternal(
                 UserDetails userDetails = this.userDetailsService.loadUserByUsername(userEmail);
 
                 if (jwtService.isTokenValid(jwt, userDetails)) {
-                    UsernamePasswordAuthenticationToken authToken =
-                            new UsernamePasswordAuthenticationToken(
-                                    userDetails,
-                                    null,
-                                    userDetails.getAuthorities()
-                            );
+                    UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
+                            userDetails,
+                            null,
+                            userDetails.getAuthorities());
 
                     authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                     SecurityContextHolder.getContext().setAuthentication(authToken);
+
+                    // 🔍 DEBUG: Log authentication success
+                    System.out.println("✅ JWT Auth Success: " + userEmail);
+                    System.out.println("   Authorities: " + userDetails.getAuthorities());
+                    System.out.println("   Accessing: " + path);
+                } else {
+                    System.out.println("❌ JWT Invalid for user: " + userEmail);
                 }
             }
         } catch (Exception ex) {
             // ✅ DO NOT block request just because token is bad
             // Let SecurityConfig handle authorization
+            System.out.println("⚠️ JWT parsing error: " + ex.getMessage());
         }
 
         filterChain.doFilter(request, response);

src/main/java/com/crimeLink/analyzer/config/SecurityConfig.java

@@ -1,5 +1,8 @@
 package com.crimeLink.analyzer.config;
 
+import java.util.Arrays;
+import java.util.List;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -21,9 +24,6 @@
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
-import java.util.Arrays;
-import java.util.List;
-
 @Configuration
 @EnableWebSecurity
 @EnableMethodSecurity
@@ -41,32 +41,34 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
                 .csrf(csrf -> csrf.disable())
                 // CRITICAL FIX: Enable CORS using the bean configuration
                 .cors(cors -> cors.configurationSource(corsConfigurationSource()))
-                .cors(cors -> cors.configure(http))
                 .authorizeHttpRequests(auth -> auth
                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                         .requestMatchers("/api/auth/**").permitAll()
                         .requestMatchers("/api/health").permitAll()
                         .requestMatchers("/api/admin/health").permitAll()
                         .requestMatchers("/api/database/**").permitAll()
-                        .requestMatchers("/api/vehicles/**").permitAll()
-                        .requestMatchers("/api/mobile/auth/**").permitAll()
-                        .requestMatchers("/api/duty-schedules/**").hasRole("OIC")
-                        .requestMatchers("/api/mobile/**").hasRole("FieldOfficer")
                         .requestMatchers("/api/test").permitAll()
-                        .requestMatchers("/api/leaves/**").permitAll()
+                        .requestMatchers("/api/debug/**").permitAll() // 🔍 Debug endpoints
 
-                        // Allow duty schedule operations for OIC
-                        .requestMatchers("/api/duty-schedules/**").hasRole("OIC")
+                        // Public endpoints
+                        .requestMatchers("/api/vehicle**").permitAll()
+                        .requestMatchers("/api/mobile/auth/**").permitAll()
+                        .requestMatchers("/api/duties/**").permitAll()
+                        .requestMatchers("/api/crime-reports/map").permitAll()
 
+                        // Field Officer routes
+                        .requestMatchers("/api/officers/me/**").hasRole("FieldOfficer")
+                        .requestMatchers("/api/mobile/**").hasRole("FieldOfficer")
+                        .requestMatchers("/api/leaves/**").permitAll()
 
-                        // Allow duty schedule operations for OIC
+                        // OIC-only routes
                         .requestMatchers("/api/duty-schedules/**").hasRole("OIC")
-
-                        // Allow weapon operations for OIC
                         .requestMatchers("/api/weapon/**").hasRole("OIC")
                         .requestMatchers("/api/weapon-issue/**").hasRole("OIC")
-                        .requestMatchers("/api/duties/**").permitAll()
-                        .requestMatchers("/duties/**").permitAll()
+
+                        // Admin/OIC routes (officer data, locations, users)
+                        .requestMatchers("/api/users/field-officers").hasAnyRole("Admin", "OIC")
+                        .requestMatchers("/api/admin/**").hasAnyRole("OIC", "Admin")
 
                         .anyRequest().authenticated())
                 .sessionManagement(session -> session

src/main/java/com/crimeLink/analyzer/controller/AuthController.java

@@ -44,25 +44,34 @@ public ResponseEntity<LoginResponse> login(
     public ResponseEntity<TokenRefreshResponse> refreshToken(@RequestBody TokenRefreshRequest request) {
         String refreshTokenStr = request.getRefreshToken();
 
-        return refreshTokenService.findByToken(refreshTokenStr)
-                .map(refreshTokenService::verifyExpiration)
-                .map(RefreshToken::getUser)
-                .map(user -> {
+        if (refreshTokenStr == null || refreshTokenStr.isBlank()) {
+            return ResponseEntity.badRequest().body(new TokenRefreshResponse(
+                    false,
+                    "Refresh token is required",
+                    null,
+                    null
+            ));
+        }
+
+        return refreshTokenService.findValidToken(refreshTokenStr)
+                .map(validToken -> {
+                    RefreshToken rotated = refreshTokenService.rotateRefreshToken(validToken);
+                    User user = rotated.getUser();
                     String accessToken = jwtService.generateToken(user);
+
                     return ResponseEntity.ok(new TokenRefreshResponse(
                             true,
                             "Token refreshed successfully",
                             accessToken,
-                            refreshTokenStr
+                            rotated.getToken()
                     ));
                 })
-                .orElseGet(() -> ResponseEntity.status(401)
-                        .body(new TokenRefreshResponse(
-                                false,
-                                "Invalid refresh token",
-                                null,
-                                null
-                        )));
+                .orElseGet(() -> ResponseEntity.status(401).body(new TokenRefreshResponse(
+                        false,
+                        "Invalid or expired refresh token",
+                        null,
+                        null
+                )));
     }
 
     @PostMapping("/logout")

src/main/java/com/crimeLink/analyzer/controller/DutyScheduleController.java

@@ -34,6 +34,10 @@ public ResponseEntity<List<OfficerDutyRowDTO>> getOfficersForDate(
         List<OfficerDutyRowDTO> rows = dutyService.getOfficerRowsForDate(date);
         return ResponseEntity.ok(rows);
     }
+    @GetMapping("/locations")
+    public ResponseEntity<List<String>> getDutyLocations() {
+        return ResponseEntity.ok(dutyService.getDutyLocations());
+    }
     // 2) Create / Save a duty (upsert via service.saveDuty)
     @PostMapping
     public ResponseEntity<?> createDuty(@RequestBody DutyScheduleRequest request) {

src/main/java/com/crimeLink/analyzer/controller/LocationController.java

@@ -0,0 +1,85 @@
+package com.crimeLink.analyzer.controller;
+
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.format.annotation.DateTimeFormat;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.crimeLink.analyzer.dto.LocationPointDTO;
+import com.crimeLink.analyzer.entity.User;
+import com.crimeLink.analyzer.service.impl.LocationServiceImpl;
+
+import lombok.RequiredArgsConstructor;
+
+@RestController
+@RequestMapping("/api")
+@RequiredArgsConstructor
+public class LocationController {
+    private final LocationServiceImpl service;
+
+    @PostMapping("/officers/me/locations/bulk")
+    public void uploadMyLocations(@AuthenticationPrincipal User user, @RequestBody List<LocationPointDTO> points) {
+        System.out.println("Received locations: " + points.size()); // REMOVE: for testing
+        if (user == null) {
+            throw new RuntimeException("Unauthorized");
+        }
+
+        if (!"FieldOfficer".equalsIgnoreCase(user.getRole())) {
+            throw new RuntimeException("Only field officers can upload locations");
+        }
+
+        String officerBadgeNo = user.getBadgeNo();
+        if (officerBadgeNo == null || officerBadgeNo.isBlank()) {
+            throw new RuntimeException("Badge number missing");
+        }
+        service.saveBulk(officerBadgeNo, points);
+    }
+
+    @GetMapping("/admin/officers/{officerBadgeNo}/locations")
+    public Object history(
+            @AuthenticationPrincipal User user,
+            @PathVariable String officerBadgeNo,
+            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) Instant from,
+            @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) Instant to) {
+        System.out.println("📍 LocationController.history() called");
+        System.out.println("   Badge: " + officerBadgeNo);
+        System.out.println("   From: " + from + ", To: " + to);
+        System.out.println("   User: " + (user != null ? user.getEmail() : "NULL"));
+        System.out.println("   Role: " + (user != null ? user.getRole() : "NULL"));
+        System.out.println("   Authorities: " + (user != null ? user.getAuthorities() : "NULL"));
+        return service.getHistory(officerBadgeNo, from, to);
+    }
+
+    @GetMapping("/debug/whoami")
+    public Map<String, Object> whoAmI(@AuthenticationPrincipal User user) {
+        Map<String, Object> info = new HashMap<>();
+        if (user != null) {
+            info.put("email", user.getEmail());
+            info.put("name", user.getName());
+            info.put("role", user.getRole());
+            info.put("authorities", user.getAuthorities().stream()
+                    .map(auth -> auth.getAuthority())
+                    .toList());
+            info.put("userId", user.getUserId());
+            info.put("badgeNo", user.getBadgeNo());
+        } else {
+            info.put("error", "No authenticated user");
+        }
+        return info;
+    }
+
+    @GetMapping("/admin/officers/{officerBadgeNo}/locations/last")
+    public Object lastLocation(@PathVariable String officerBadgeNo) {
+        return service.getLastLocation(officerBadgeNo);
+    }
+}

src/main/java/com/crimeLink/analyzer/dto/LocationPointDTO.java

@@ -0,0 +1,16 @@
+package com.crimeLink.analyzer.dto;
+
+import java.time.Instant;
+import java.util.Map;
+
+public record LocationPointDTO(
+        Instant ts,
+        double latitude,
+        double longitude,
+        Float accuracyM,
+        Float speedMps,
+        Float headingDeg,
+        String provider,
+        Map<String, Object> meta) {
+
+}

src/main/java/com/crimeLink/analyzer/entity/LocationPoint.java

@@ -0,0 +1,49 @@
+package com.crimeLink.analyzer.entity;
+
+import java.time.Instant;
+
+import org.hibernate.annotations.JdbcTypeCode;
+import org.hibernate.type.SqlTypes;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Index;
+import jakarta.persistence.Table;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+@Entity
+@AllArgsConstructor
+@NoArgsConstructor
+@Getter
+@Setter
+@Table(name = "location_points", indexes = {
+        @Index(name = "idx_location_points_officer_ts", columnList = "officer_badge_no, ts") })
+public class LocationPoint {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(name = "officer_badge_no", nullable = false, length = 20)
+    private String officerBadgeNo;
+    private Instant ts;
+    private double latitude;
+    private double longitude;
+
+    private Float accuracyM;
+    private Float speedMps;
+    private Float headingDeg;
+
+    private String provider;
+
+    @JdbcTypeCode(SqlTypes.JSON)
+    @Column(name = "meta", columnDefinition = "jsonb")
+    private JsonNode meta;
+}

src/main/java/com/crimeLink/analyzer/repository/DutyScheduleRepository.java

@@ -2,6 +2,7 @@
 
 import com.crimeLink.analyzer.entity.DutySchedule;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
 import org.springframework.stereotype.Repository;
 
 import java.time.LocalDate;
@@ -38,4 +39,13 @@ long countByAssignedOfficer_UserIdAndDateBetween(
             LocalDate start,
             LocalDate end
     );
+
+    @Query("""
+            SELECT DISTINCT d.location
+            FROM DutySchedule d
+            WHERE d.location IS NOT NULL
+              AND LENGTH(TRIM(d.location)) > 0
+            ORDER BY d.location
+            """)
+    List<String> findDistinctLocations();
 }

src/main/java/com/crimeLink/analyzer/repository/LocationPointRepository.java

@@ -0,0 +1,15 @@
+package com.crimeLink.analyzer.repository;
+
+import java.time.Instant;
+import java.util.List;
+
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import com.crimeLink.analyzer.entity.LocationPoint;
+
+public interface LocationPointRepository extends JpaRepository<LocationPoint, Long> {
+    List<LocationPoint> findByOfficerBadgeNoAndTsBetweenOrderByTsAsc(String officerBadgeNo, Instant from, Instant to);
+
+    List<LocationPoint> findByOfficerBadgeNoOrderByTsDesc(String officerBadgeNo, Pageable pageable);
+}

src/main/java/com/crimeLink/analyzer/repository/RefreshTokenRepository.java

@@ -13,6 +13,9 @@
 @Repository
 public interface RefreshTokenRepository extends JpaRepository<RefreshToken, Long> {
     Optional<RefreshToken> findByToken(String token);
+
+    @Query("SELECT rt FROM RefreshToken rt JOIN FETCH rt.user WHERE rt.token = ?1")
+    Optional<RefreshToken> findByTokenWithUser(String token);
 
     @Modifying
     @Query("DELETE FROM RefreshToken rt WHERE rt.expiryDate < ?1")