fix: revert the eager security-header write and tighten the async-timeout branch

The eager HeaderWriterFilter write broke image and screenshot caching. Spring
Security's CacheControlHeadersWriter normally runs last and skips when the header
is already present; writing eagerly meant it set `no-cache, no-store` first and
ImageStorageController, which uses addHeader, then appended a second value — plus
`Pragma: no-cache` and `Expires: 0` that nothing overrides. That is a worse
regression than the race it was fixing, so it is reverted and
StreamingBodyDatabasePoolHealthTest keeps its ignoreTestOnSpringBug wrapper.
spring-security#9175 stays an open pre-existing hazard that higher streaming
concurrency makes more likely.

The async-timeout handler no longer infers "the stream already started" from
response.isCommitted: a servlet response only commits once ~8KB is buffered, so a
slow import-progress or MT stream that timed out having written a few lines was
being reclassified as capacity and hidden from Sentry. The streaming provider now
records that the body actually began, and the handler branches on that.

Also: the three tests that customise the Spring context are tagged
@ContextRecreatingTest, which is what stops them accumulating contexts and running
the standard suite out of heap; @primary is dropped from the background executor
since nothing needed it; and the internal streaming endpoint stages the same
headers the real export endpoints do, so the rejection path's header handling is
actually exercised.

Author: JanCizmar

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/administration/ProjectExportImportController.kt

@@ -58,7 +58,7 @@ class ProjectExportImportController(
     val export = projectExportImportExporter.exportToTempFile(projectId, versionProvider.version)
     val tempFile = export.path
     // A saturated streaming pool rejects the body after this method returns, so the delete below
-    // never runs. Bound that rather than leaking the temp file for the life of the pod.
+    // never runs; this is the backstop, at JVM exit.
     tempFile.toFile().deleteOnExit()
     try {
       val body =

backend/app/src/main/kotlin/io/tolgee/ExceptionHandlers.kt

@@ -17,6 +17,7 @@ import io.tolgee.security.ratelimit.RateLimitBlockedException
 import io.tolgee.security.ratelimit.RateLimitResponseBody
 import io.tolgee.security.ratelimit.RateLimitedException
 import io.tolgee.util.Logging
+import io.tolgee.util.StreamingResponseBodyProvider
 import io.tolgee.util.logger
 import jakarta.persistence.EntityNotFoundException
 import jakarta.servlet.http.HttpServletRequest
@@ -273,33 +274,31 @@ class ExceptionHandlers : Logging {
     ex: RejectedExecutionException,
     response: HttpServletResponse,
   ): ResponseEntity<ErrorResponseBody> {
-    // Spring wraps the policy's exception in TaskRejectedException. Any other rejection — a shutting
-    // down executor, some other pool — belongs on the generic path, Sentry included.
-    if (generateSequence(ex as Throwable) { it.cause }.none { it is StreamingCapacityExceededException }) {
+    if (!isStreamingRejection(ex)) {
       return handleOtherExceptions(ex)
     }
     logger.debug("Streaming pool saturated, rejecting request", ex)
     return serverBusy(response)
   }
 
-  /**
-   * A request that aged out of the streaming queue never started writing, so it is the same capacity
-   * condition as an outright rejection — and answering it generically would raise a Sentry event per
-   * overloaded request. A stream that timed out mid-write is a different animal: its response is
-   * already committed, nothing can be said to the client, and it is worth reporting.
-   */
   @ExceptionHandler(AsyncRequestTimeoutException::class)
   fun handleAsyncRequestTimeout(
     ex: AsyncRequestTimeoutException,
+    request: HttpServletRequest,
     response: HttpServletResponse,
   ): ResponseEntity<ErrorResponseBody> {
-    if (response.isCommitted) {
+    // A stream that ran and still timed out is a slowness regression, not capacity, and reporting it
+    // is the point. Only one that never left the queue is the same condition as a rejection.
+    if (request.getAttribute(StreamingResponseBodyProvider.STREAM_STARTED_ATTRIBUTE) != null) {
       return handleOtherExceptions(ex)
     }
     logger.debug("Request timed out waiting for a streaming thread", ex)
     return serverBusy(response)
   }
 
+  private fun isStreamingRejection(ex: Throwable): Boolean =
+    generateSequence(ex) { it.cause }.any { it is StreamingCapacityExceededException }
+
   private fun serverBusy(response: HttpServletResponse): ResponseEntity<ErrorResponseBody> {
     dropStagedStreamingHeaders(response)
     return ResponseEntity
@@ -308,13 +307,7 @@ class ExceptionHandlers : Logging {
       .body(ErrorResponseBody(Message.SERVER_BUSY.code, null))
   }
 
-  /**
-   * The streaming return-value handler stages Content-Disposition and an ETag before the task is
-   * submitted, and a caching proxy would happily key this 503 against that ETag. Only reset() clears
-   * them, but it also clears everything the filter chain has already written — CORS, the version
-   * header, and the security headers HeaderWriterFilter now writes eagerly. So everything unrelated
-   * to streaming is put back.
-   */
+  /** A caching proxy would key this 503 against the ETag the streaming handler already staged. */
   private fun dropStagedStreamingHeaders(response: HttpServletResponse) {
     if (response.isCommitted) return
     val preserved =

backend/app/src/main/kotlin/io/tolgee/configuration/AsyncMethodConfiguration.kt

@@ -4,7 +4,6 @@ import io.tolgee.configuration.tolgee.TolgeeProperties
 import org.springframework.beans.factory.ObjectProvider
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.context.annotation.Primary
 import org.springframework.scheduling.annotation.AsyncConfigurer
 import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor
 import java.util.concurrent.Executor
@@ -19,7 +18,6 @@ class AsyncMethodConfiguration(
 ) : AsyncConfigurer {
   override fun getAsyncExecutor(): Executor = backgroundAsyncExecutor()
 
-  @Primary
   @Bean(BACKGROUND_EXECUTOR_BEAN_NAME)
   fun backgroundAsyncExecutor(): ThreadPoolTaskExecutor {
     val factory = asyncExecutorFactory.getObject()

backend/app/src/main/kotlin/io/tolgee/configuration/WebSecurityConfig.kt

@@ -45,7 +45,6 @@ import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.access.intercept.AuthorizationFilter
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
-import org.springframework.security.web.header.HeaderWriterFilter
 import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer
@@ -105,18 +104,6 @@ class WebSecurityConfig(
         it.requestMatchers("/api/**", "/v2/**").authenticated()
         it.anyRequest().permitAll()
       }.headers { headers ->
-        // Write the security headers before the chain proceeds. By default HeaderWriterFilter writes
-        // them while unwinding, which races a StreamingResponseBody task already writing the same
-        // response — spring-security#9175, the ConcurrentModificationException that
-        // io.tolgee.fixtures.springBug works around.
-        headers.withObjectPostProcessor(
-          object : ObjectPostProcessor<HeaderWriterFilter> {
-            override fun <O : HeaderWriterFilter?> postProcess(filter: O): O {
-              filter?.setShouldWriteHeadersEagerly(true)
-              return filter
-            }
-          },
-        )
         headers.xssProtection(Customizer.withDefaults())
         headers.contentTypeOptions(Customizer.withDefaults())
         headers.frameOptions {

backend/app/src/test/kotlin/io/tolgee/ExceptionHandlersAsyncCapacityTest.kt

@@ -4,10 +4,12 @@ import io.tolgee.component.VersionFilter
 import io.tolgee.constants.Message
 import io.tolgee.exceptions.StreamingCapacityExceededException
 import io.tolgee.testing.assert
+import io.tolgee.util.StreamingResponseBodyProvider
 import org.junit.jupiter.api.Test
 import org.springframework.core.task.TaskRejectedException
 import org.springframework.http.HttpHeaders
 import org.springframework.http.HttpStatus
+import org.springframework.mock.web.MockHttpServletRequest
 import org.springframework.mock.web.MockHttpServletResponse
 import org.springframework.web.context.request.async.AsyncRequestTimeoutException
 import java.util.concurrent.RejectedExecutionException
@@ -87,7 +89,12 @@ class ExceptionHandlersAsyncCapacityTest {
     val response = MockHttpServletResponse()
     response.setHeader(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=export.zip")
 
-    val result = exceptionHandlers.handleAsyncRequestTimeout(AsyncRequestTimeoutException(), response)
+    val result =
+      exceptionHandlers.handleAsyncRequestTimeout(
+        AsyncRequestTimeoutException(),
+        MockHttpServletRequest(),
+        response,
+      )
 
     result.statusCode.assert.isEqualTo(HttpStatus.SERVICE_UNAVAILABLE)
     result.body
@@ -96,13 +103,17 @@ class ExceptionHandlersAsyncCapacityTest {
     response.getHeader(HttpHeaders.CONTENT_DISPOSITION).assert.isNull()
   }
 
+  /** A slow stream writes far less than one 8KB buffer, so commitment is not the signal. */
   @Test
-  fun `reports a stream that timed out after it started writing`() {
+  fun `reports a stream that ran and still timed out, even with nothing flushed`() {
+    val request = MockHttpServletRequest()
+    request.setAttribute(StreamingResponseBodyProvider.STREAM_STARTED_ATTRIBUTE, true)
     val response = MockHttpServletResponse()
-    response.flushBuffer()
 
-    val result = exceptionHandlers.handleAsyncRequestTimeout(AsyncRequestTimeoutException(), response)
+    val result =
+      exceptionHandlers.handleAsyncRequestTimeout(AsyncRequestTimeoutException(), request, response)
 
+    response.isCommitted.assert.isFalse()
     result.statusCode.assert.isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR)
   }
 

backend/app/src/test/kotlin/io/tolgee/StreamingBodyDatabasePoolHealthTest.kt

@@ -19,6 +19,7 @@ package io.tolgee
 import com.zaxxer.hikari.HikariDataSource
 import io.tolgee.development.testDataBuilder.data.TranslationsTestData
 import io.tolgee.fixtures.andIsOk
+import io.tolgee.fixtures.ignoreTestOnSpringBug
 import io.tolgee.fixtures.waitForNotThrowing
 import io.tolgee.testing.annotations.ProjectJWTAuthTestMethod
 import io.tolgee.testing.assert
@@ -50,25 +51,22 @@ class StreamingBodyDatabasePoolHealthTest : ProjectAuthControllerTest("/v2/proje
     projectSupplier = { testData.project }
   }
 
-  /**
-   * Deliberately not wrapped in ignoreTestOnSpringBug: WebSecurityConfig now makes HeaderWriterFilter
-   * write eagerly, so the request thread no longer races the streaming task over the response
-   * headers. If that regresses, this must fail rather than quietly skip.
-   */
   @Test
   @ProjectJWTAuthTestMethod
   fun `streaming responses do not cause a database connection pool exhaustion`() {
-    val hikariDataSource = dataSource as HikariDataSource
-    val pool = hikariDataSource.hikariPoolMXBean
+    ignoreTestOnSpringBug {
+      val hikariDataSource = dataSource as HikariDataSource
+      val pool = hikariDataSource.hikariPoolMXBean
 
-    waitForNotThrowing(pollTime = 50, timeout = 5000) {
-      pool.activeConnections.assert.isEqualTo(0)
-    }
-    repeat(50) {
-      performProjectAuthGet("export").andIsOk
-    }
-    waitForNotThrowing(pollTime = 50, timeout = 5000) {
-      pool.activeConnections.assert.isEqualTo(0)
+      waitForNotThrowing(pollTime = 50, timeout = 5000) {
+        pool.activeConnections.assert.isEqualTo(0)
+      }
+      repeat(50) {
+        performProjectAuthGet("export").andIsOk
+      }
+      waitForNotThrowing(pollTime = 50, timeout = 5000) {
+        pool.activeConnections.assert.isEqualTo(0)
+      }
     }
   }
 }

backend/app/src/test/kotlin/io/tolgee/configuration/AsyncDispatchTargetTest.kt

@@ -1,5 +1,6 @@
 package io.tolgee.configuration
 
+import io.tolgee.testing.ContextRecreatingTest
 import io.tolgee.testing.assert
 import org.junit.jupiter.api.Test
 import org.springframework.beans.factory.annotation.Autowired
@@ -11,6 +12,7 @@ import org.springframework.scheduling.annotation.Async
 import java.util.concurrent.CompletableFuture
 import java.util.concurrent.TimeUnit
 
+@ContextRecreatingTest
 @SpringBootTest
 @Import(AsyncDispatchTargetTest.AsyncProbeConfiguration::class)
 class AsyncDispatchTargetTest {

backend/app/src/test/kotlin/io/tolgee/configuration/AsyncExecutorConfigurationTest.kt

@@ -15,8 +15,6 @@ import org.springframework.boot.test.context.SpringBootTest
 import org.springframework.scheduling.annotation.Async
 import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor
 import org.springframework.security.task.DelegatingSecurityContextAsyncTaskExecutor
-import org.springframework.security.web.SecurityFilterChain
-import org.springframework.security.web.header.HeaderWriterFilter
 import org.springframework.test.util.ReflectionTestUtils
 import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter
 import java.util.concurrent.CyclicBarrier
@@ -38,9 +36,6 @@ class AsyncExecutorConfigurationTest {
   @Autowired
   private lateinit var requestMappingHandlerAdapter: RequestMappingHandlerAdapter
 
-  @Autowired
-  private lateinit var securityFilterChain: SecurityFilterChain
-
   @Autowired
   private lateinit var tolgeeProperties: TolgeeProperties
 
@@ -132,17 +127,6 @@ class AsyncExecutorConfigurationTest {
     delegate.assert.isSameAs(streamingAsyncExecutor)
   }
 
-  @Test
-  fun `security headers are written before the chain, not while it unwinds`() {
-    val headerWriterFilter =
-      securityFilterChain.filters.filterIsInstance<HeaderWriterFilter>().single()
-
-    ReflectionTestUtils
-      .getField(headerWriterFilter, "shouldWriteHeadersEagerly")
-      .assert
-      .isEqualTo(true)
-  }
-
   @Test
   fun `the task decorator survives construction`() {
     ReflectionTestUtils

backend/app/src/test/kotlin/io/tolgee/configuration/AsyncPropertyBindingTest.kt

@@ -1,12 +1,14 @@
 package io.tolgee.configuration
 
+import io.tolgee.testing.ContextRecreatingTest
 import io.tolgee.testing.assert
 import org.junit.jupiter.api.Test
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.beans.factory.annotation.Qualifier
 import org.springframework.boot.test.context.SpringBootTest
 import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor
 
+@ContextRecreatingTest
 @SpringBootTest(
   properties = [
     "tolgee.async.streaming.max-threads = 7",

backend/app/src/test/kotlin/io/tolgee/configuration/StreamingBackpressureHttpTest.kt

@@ -1,6 +1,7 @@
 package io.tolgee.configuration
 
 import io.tolgee.Metrics
+import io.tolgee.testing.ContextRecreatingTest
 import io.tolgee.testing.assert
 import org.junit.jupiter.api.AfterEach
 import org.junit.jupiter.api.Test
@@ -23,6 +24,7 @@ import java.util.concurrent.TimeUnit
  * an unset async result whether or not the 503 actually reaches a client. Only a real container
  * proves the rejection becomes a response.
  */
+@ContextRecreatingTest
 @SpringBootTest(
   webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
   properties = [