Restrict shallow ETag filter routes

[JuliusHenke]

Motivation

• The global ShallowEtagHeaderFilter was being registered as an unrestricted bean which causes Spring to buffer full response bodies for ETag generation and can amplify memory/CPU usage for large public endpoints such as /relay/location/day/{day}.
• The change aims to remove the global response-buffering behavior for unbounded endpoints while preserving ETag caching for small, bounded routes.

Description

• Replace the globally auto-registered ShallowEtagHeaderFilter bean with a FilterRegistrationBean<ShallowEtagHeaderFilter> so the filter is only applied to explicitly listed small/bounded routes in backend/src/main/kotlin/org/tormap/config/AppConfig.kt.
• Limit the filter URL patterns to safe endpoints (/relay/location/days, /relay/details/relay/*, /relay/details/family/*) to avoid buffering large day-by-day relay responses.
• Update the Spring context test in backend/src/test/kotlin/org/tormap/config/SecurityConfigTest.kt to assert the FilterRegistrationBean is registered with the expected URL patterns.

Testing

• Attempted to run the SecurityConfigTest with Gradle (./gradlew --no-daemon test --tests org.tormap.config.SecurityConfigTest), but the build failed in this environment because the Kotlin Gradle plugin could not be resolved from the plugin portal. (Test not executed.)
• Attempted the same test with JAVA_HOME set to Java 17 to work around a Java parsing issue, but the run still failed due to inability to resolve the org.jetbrains.kotlin.jvm:1.9.25 plugin from the Gradle plugin repository in this environment. (Test not executed.)
• Ran repository checks (git diff --check) which reported no whitespace/diff errors on the modified files.

---

Codex Task

[JuliusHenke]

@copilot add tests that check actual existence of etag header for all desired endpoints and it being absent for the undesired endpoint.

[Copilot]

Pull request overview

This PR narrows the scope of Spring’s ShallowEtagHeaderFilter so it no longer applies globally (and thus no longer forces response-body buffering) on large/unbounded endpoints like /relay/location/day/{day}, while keeping ETag support for selected smaller routes.

Changes:

• Replace the globally-registered ShallowEtagHeaderFilter bean with a FilterRegistrationBean limited to specific URL patterns.
• Add/adjust a Spring context test to assert the filter registration URL patterns.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
backend/src/main/kotlin/org/tormap/config/AppConfig.kt	Registers ShallowEtagHeaderFilter via FilterRegistrationBean and restricts it to a small set of URL patterns.
backend/src/test/kotlin/org/tormap/config/SecurityConfigTest.kt	Adds assertions that the filter registration bean exists and is configured with the expected URL patterns.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@copilot add tests that check actual existence of etag header for all desired endpoints and it being absent for the undesired endpoint.

Implemented in commit 2b43144. Added MockMvc assertions in HttpCachingConfigTest that verify ETag is present for /relay/location/days, /relay/details/relay/{id}, and /relay/details/family/{id}, and absent for /relay/location/day/{day}.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 113.114.104.172.in-addr.arpa
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -Dorg.gradle.internal.worker.tmpdir=/home/REDACTED/work/tormap/tormap/backend/build/tmp/test/work @/home/REDACTED/.gradle/.tmp/gradle-worker-classpath12347294411810973581txt -Xmx512m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -ea worker.org.gradle.process.internal.worker.GradleWorkerMain 'Gradle Test Executor 1' (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)