initial commit

2025-12-06 01:10:22 +03:00 · 2024-08-12 11:00:25 +02:00
commit eaff977b22
241 changed files with 14378 additions and 0 deletions
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1 @@
+PUBLIC_APP_URL=http://localhost
--- a/.env.test
+++ b/.env.test
@@ -0,0 +1,2 @@
+APP_ENV=test
+PUBLIC_APP_URL=http://localhost
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1,2 @@
+# These are supported funding model platforms
+github: stonith404
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -0,0 +1,37 @@
+name: "🐛 Bug Report"
+description: "Report something that is not working as expected"
+title: "🐛 Bug Report: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out our bug report form 🙏
+  - type: textarea
+    id: steps-to-reproduce
+    validations:
+      required: true
+    attributes:
+      label: "Reproduction steps"
+      description: "How do you trigger this bug? Please walk us through it step by step."
+      placeholder: "When I ..."
+  - type: textarea
+    id: expected-behavior
+    validations:
+      required: true
+    attributes:
+      label: "Expected behavior"
+      description: "What did you think would happen?"
+      placeholder: "It should ..."
+  - type: textarea
+    id: actual-behavior
+    validations:
+      required: true
+    attributes:
+      label: "Actual Behavior"
+      description: "What did actually happen? Add screenshots, if applicable."
+      placeholder: "It actually ..."
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting, please check if the issues hasn't been raised before.
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1 @@
+blank_issues_enabled: false
--- a/.github/ISSUE_TEMPLATE/feature.yml
+++ b/.github/ISSUE_TEMPLATE/feature.yml
@@ -0,0 +1,25 @@
+name: 🚀 Feature
+description: "Submit a proposal for a new feature"
+title: "🚀 Feature: "
+labels: [feature]
+body:
+  - type: textarea
+    id: feature-description
+    validations:
+      required: true
+    attributes:
+      label: "Feature description"
+      description: "A clear and concise description of what the feature is."
+      placeholder: "You should add ..."
+  - type: textarea
+    id: pitch
+    validations:
+      required: true
+    attributes:
+      label: "Pitch"
+      description: "Please explain why this feature should be implemented and how it would be used. Add examples, if applicable."
+      placeholder: "In my use-case, ..."
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting, please check if the feature hasn't been proposed before.
--- a/.github/ISSUE_TEMPLATE/question.yml
+++ b/.github/ISSUE_TEMPLATE/question.yml
@@ -0,0 +1,17 @@
+name: ❓ Question
+description: "Ask a question
+title: "❓ Question:"
+labels: [question]
+body:
+  - type: textarea
+    id: feature-description
+    validations:
+      required: true
+    attributes:
+      label: "🙋Question"
+      description: "A clear question. Please provide as much detail as possible."
+      placeholder: "How do I ...?"
+  - type: markdown
+    attributes:
+      value: |
+        Before submitting, please check if the question hasn't been asked before.
--- a/.github/workflows/build-and-push-docker-image.yml
+++ b/.github/workflows/build-and-push-docker-image.yml
@@ -0,0 +1,34 @@
+name: Build and Push Docker Image
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to Docker registry
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
+          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: stonith404/pocket-id:latest,stonith404/pocket-id:${{  github.ref_name }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -0,0 +1,45 @@
+name: E2E Tests
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  build-and-test:
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+      
+      - name: Build Docker Image
+        run: docker build -t stonith404/pocket-id .
+      - name: Run Docker Container
+        run: docker run -d --name pocket-id -p 80:80 --env-file .env.test stonith404/pocket-id
+
+      - name: Install frontend dependencies
+        working-directory: ./frontend
+        run: npm ci
+
+      - name: Install Playwright Browsers
+        working-directory: ./frontend
+        run: npx playwright install --with-deps chromium
+
+      - name: Run Playwright tests
+        working-directory: ./frontend
+        run: npx playwright test
+
+      - name: Get container logs
+        if: always()
+        run: docker logs pocket-id
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-report
+          path: frontend/tests/.output
+          retention-days: 15
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,37 @@
+# JetBrains
+**/.idea
+
+node_modules
+
+# Output
+.output
+.vercel
+/frontend/.svelte-kit
+/frontend/build
+/backend/bin
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Application specific
+data
+/frontend/tests/.auth
+pocket-id-backend
--- a/.version
+++ b/.version
@@ -0,0 +1 @@
+0.0.0
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,73 @@
+# Contributing
+
+I am happy that you want to contribute to Pocket ID and help to make it better! All contributions are welcome, including issues, suggestions, pull requests and more.
+
+## Getting started
+
+You've found a bug, have suggestion or something else, just create an issue on GitHub and we can get in touch.
+
+## Submit a Pull Request
+
+Before you submit the pull request for review please ensure that
+
+- The pull request naming follows the [Conventional Commits specification](https://www.conventionalcommits.org):
+
+  `<type>[optional scope]: <description>`
+
+  example:
+
+  ```
+  feat(share): add password protection
+  ```
+
+  Where `TYPE` can be:
+
+  - **feat** - is a new feature
+  - **doc** - documentation only changes
+  - **fix** - a bug fix
+  - **refactor** - code change that neither fixes a bug nor adds a feature
+
+- Your pull request has a detailed description
+- You run `npm run format` to format the code
+
+## Setup project
+
+Pocket ID consists of a frontend, backend and a reverse proxy.
+
+### Backend
+
+The backend is built with [Gin](https://gin-gonic.com) and written in Go.
+
+#### Setup
+
+1. Open the `backend` folder
+2. Copy the `.env.example` file to `.env` and change the `APP_ENV` to `development`
+3. Start the backend with `go run cmd/main.go`
+
+### Frontend
+
+The frontend is built with [SvelteKit](https://kit.svelte.dev) and written in TypeScript.
+
+#### Setup
+
+1. Open the `frontend` folder
+2. Copy the `.env.example` file to `.env`
+3. Install the dependencies with `npm install`
+4. Start the frontend with `npm run dev`
+
+You're all set!
+
+### Reverse Proxy
+We use [Caddy](https://caddyserver.com) as a reverse proxy. You can use any other reverse proxy if you want but you have to configure it yourself.
+
+#### Setup
+Run `caddy run --config Caddyfile` in the root folder.
+
+### Testing
+
+We are using [Playwright](https://playwright.dev) for end-to-end testing.
+
+The tests can be run like this:
+1. Start the backend normally
+2. Start the frontend in production mode with `npm run build && node build/index.js`
+3. Run the tests with `npm run test`
--- a/10
+++ b/10
@@ -0,0 +1,10 @@
+:80 {
+    reverse_proxy /api/* http://localhost:8080
+    reverse_proxy /.well-known/* http://localhost:8080
+    reverse_proxy /* http://localhost:3000
+
+    log {
+        output file /var/log/caddy/access.log
+        level WARN
+    }
+}
--- a/42
+++ b/42
@@ -0,0 +1,42 @@
+# Stage 1: Build Frontend
+FROM node:20-alpine AS frontend-builder
+WORKDIR /app/frontend
+COPY ./frontend/package*.json ./
+RUN npm ci
+COPY ./frontend ./
+RUN npm run build
+RUN npm prune --production
+
+# Stage 2: Build Backend
+FROM golang:1.22-alpine AS backend-builder
+WORKDIR /app/backend
+COPY ./backend/go.mod ./backend/go.sum ./
+RUN go mod download
+
+RUN apk add --no-cache gcc musl-dev
+
+COPY ./backend ./
+WORKDIR /app/backend/cmd
+RUN CGO_ENABLED=1 GOOS=linux go build -o /app/backend/pocket-id-backend .
+
+# Stage 3: Production Image
+FROM node:20-alpine
+RUN apk add --no-cache caddy
+COPY ./Caddyfile /etc/caddy/Caddyfile
+
+WORKDIR /app
+COPY --from=frontend-builder /app/frontend/build ./frontend/build
+COPY --from=frontend-builder /app/frontend/node_modules ./frontend/node_modules
+COPY --from=frontend-builder /app/frontend/package.json ./frontend/package.json
+
+COPY --from=backend-builder /app/backend/pocket-id-backend ./backend/pocket-id-backend
+COPY --from=backend-builder /app/backend/migrations ./backend/migrations
+COPY --from=backend-builder /app/backend/images ./backend/images
+
+COPY ./scripts ./scripts
+
+EXPOSE 3000
+ENV APP_ENV=production
+
+# Use a shell form to run both the frontend and backend
+CMD ["sh", "./scripts/docker-entrypoint.sh"]
--- a/25
+++ b/25
@@ -0,0 +1,25 @@
+BSD 2-Clause License
+
+Copyright (c) 2024, Elias Schneider
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/README.md
+++ b/README.md
@@ -0,0 +1,139 @@
+# <div align="center"><img  src="https://github.com/user-attachments/assets/03307a88-c35a-4bd9-bf93-e4287c2cdaad" width="100"/> </br>Pocket ID</div>
+
+Pocket ID is a simple OIDC provider that allows users to authenticate with their passkeys to your services.
+
+<img src="https://github.com/user-attachments/assets/e0bdc1e3-854c-479c-8c3d-6c1aa4f712f4" width="1200"/>
+
+The goal of Pocket ID is to be a simple and easy-to-use. There are other self-hosted OIDC providers like [Keycloak](https://www.keycloak.org/) or [ORY Hydra](https://www.ory.sh/hydra/) but they are often too complex for simple use cases. Additionally, Pocket ID only support passkey authentication which is a passwordless authentication method.
+
+## Setup
+
+> [!WARNING]  
+> Pocket ID is in its early stages and may contain bugs.
+
+### Installation with Docker (recommended)
+
+1. Download the `docker-compose.yml` and `.env` file:
+
+   ```bash
+    curl -O https://raw.githubusercontent.com/stonith404/pocket-id/main/docker-compose.yml
+
+    curl -o .env https://raw.githubusercontent.com/stonith404/pocket-id/main/.env.example
+   ```
+
+2. Edit the `.env` file so that it fits your needs. See the [environment variables](#environment-variables) section for more information.
+3. Run `docker compose up -d`
+
+You can now sign in with the admin account on `http://localhost/login/setup`.
+
+### Stand-alone Installation
+
+Required tools:
+
+- [Node.js](https://nodejs.org/en/download/) >= 20
+- [Go](https://golang.org/doc/install) >= 1.22
+- [Git](https://git-scm.com/downloads)
+- [PM2](https://pm2.keymetrics.io/)
+- [Caddy](https://caddyserver.com/docs/install) (optional)
+
+1. Copy the `.env.example` file in the `frontend` and `backend` folder to `.env` and change it so that it fits your needs.
+   
+   ```bash
+   cp frontend/.env.example frontend/.env
+   cp backend/.env.example backend/.env
+   ```
+2. Run the following commands:
+
+    ```bash
+    git clone https://github.com/stonith404/pocket-id
+    cd pocket-id
+
+    # Checkout the latest version
+    git fetch --tags && git checkout $(git describe --tags `git rev-list --tags --max-count=1`)
+
+    # Start the backend
+    cd backend/cmd
+    go build -o ../pocket-id-backend
+    cd ..
+    pm2 start pocket-id-backend --name pocket-id-backend
+
+    # Start the frontend
+    cd ../frontend
+    npm install
+    npm run build
+    pm2 start --name pocket-id-frontend --node-args="--env-file .env" build/index.js
+
+    # Optional: Start Caddy (You can use any other reverse proxy)
+    cd ..
+    pm2 start --name pocket-id-caddy caddy -- run --config Caddyfile
+    ```
+
+You can now sign in with the admin account on `http://localhost/login/setup`.
+
+### Add Pocket ID as an OIDC provider
+
+You can add a new OIDC client on `https://<your-domain>/settings/admin/oidc-clients`
+
+After you have added the client, you can obtain the client ID and client secret.
+
+You may need the following information:
+
+- **Authorization URL**: `https://<your-domain>/authorize`
+- **Token URL**: `https://<your-domain>/api/oidc/token`
+- **Certificate URL**: `https://<your-domain>/.well-known/jwks.json`
+- **OIDC Discovery URL**: `https://<your-domain>/.well-known/openid-configuration`
+- **PKCE**: `false` as this is not supported yet.
+
+### Update
+
+#### Docker
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+#### Stand-alone
+
+1. Stop the running services:
+   ```bash
+   pm2 delete pocket-id-backend pocket-id-frontend pocket-id-caddy
+   ```
+2. Run the following commands:
+
+   ```bash
+   cd pocket-id
+
+   # Checkout the latest version
+   git fetch --tags && git checkout $(git describe --tags `git rev-list --tags --max-count=1`)
+
+   # Start the backend
+   cd backend/cmd
+   go build -o ../pocket-id-backend
+   cd ..
+   pm2 start pocket-id-backend --name pocket-id-backend
+
+   # Start the frontend
+   cd ../frontend
+   npm install
+   npm run build
+   pm2 start build/index.js --name pocket-id-frontend
+
+   # Optional: Start Caddy (You can use any other reverse proxy)
+   cd ..
+   pm2 start caddy --name pocket-id-caddy -- run --config Caddyfile
+   ```
+
+### Environment variables
+
+| Variable         | Default Value       | Recommended to change | Description                                   |
+| ---------------- | ------------------- | --------------------- | --------------------------------------------- |
+| `PUBLIC_APP_URL` | `http://localhost`  | yes                   | The URL where you will access the app.        |
+| `DB_PATH`        | `data/pocket-id.db` | no                    | The path to the SQLite database.              |
+| `UPLOAD_PATH`    | `data/uploads`      | no                    | The path where the uploaded files are stored. |
+| `PORT`           | `3000`              | no                    | The port on which the frontend should listen. |
+| `BACKEND_PORT`   | `8080`              | no                    | The port on which the backend should listen.  |
+
+## Contribute
+
+You're very welcome to contribute to Pocket ID! Please follow the [contribution guide](/CONTRIBUTING.md) to get started.
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,9 @@
+# Security Policy
+
+## Supported Versions
+
+As Pocket ID is in its early stages, older versions don't get security updates. Please consider to update Pocket ID regularly. Updates can be automated with e.g [Watchtower](https://github.com/containrrr/watchtower).
+
+## Reporting a Vulnerability
+
+Thank you for taking the time to report a vulnerability. Please DO NOT create an issue on GitHub because the vulnerability could get exploited. Instead please write an email to [elias@eliasschneider.com](mailto:elias@eliasschneider.com).
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -0,0 +1,6 @@
+APP_ENV=production
+PUBLIC_APP_URL=http://localhost
+DB_PATH=data/pocket-id.db
+UPLOAD_PATH=data/uploads
+PORT=8080
+HOST=localhost
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -0,0 +1,16 @@
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+./data
--- a/backend/cmd/main.go
+++ b/backend/cmd/main.go
@@ -0,0 +1,9 @@
+package main
+
+import (
+	"golang-rest-api-template/internal/bootstrap"
+)
+
+func main() {
+	bootstrap.Bootstrap()
+}
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -0,0 +1,63 @@
+module golang-rest-api-template
+
+go 1.22
+
+require (
+	github.com/caarlos0/env/v11 v11.2.0
+	github.com/fxamacker/cbor/v2 v2.7.0
+	github.com/gin-contrib/cors v1.7.2
+	github.com/gin-gonic/gin v1.10.0
+	github.com/go-co-op/gocron/v2 v2.11.0
+	github.com/go-webauthn/webauthn v0.11.0
+	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/golang-migrate/migrate/v4 v4.17.1
+	github.com/google/uuid v1.6.0
+	github.com/joho/godotenv v1.5.1
+	golang.org/x/crypto v0.25.0
+	golang.org/x/time v0.6.0
+	gorm.io/driver/sqlite v1.5.6
+	gorm.io/gorm v1.25.11
+)
+
+require (
+	github.com/bytedance/sonic v1.12.1 // indirect
+	github.com/bytedance/sonic/loader v0.2.0 // indirect
+	github.com/cloudwego/base64x v0.1.4 // indirect
+	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.22.0 // indirect
+	github.com/go-webauthn/x v0.1.12 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/google/go-tpm v0.9.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/jonboulle/clockwork v0.4.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
+	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	golang.org/x/arch v0.9.0 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	golang.org/x/net v0.27.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -0,0 +1,151 @@
+github.com/bytedance/sonic v1.12.1 h1:jWl5Qz1fy7X1ioY74WqO0KjAMtAGQs4sYnjiEBiyX24=
+github.com/bytedance/sonic v1.12.1/go.mod h1:B8Gt/XvtZ3Fqj+iSKMypzymZxw/FVwgIGKzMzT9r/rk=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/bytedance/sonic/loader v0.2.0 h1:zNprn+lsIP06C/IqCHs3gPQIvnvpKbbxyXQP1iU4kWM=
+github.com/bytedance/sonic/loader v0.2.0/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/caarlos0/env/v11 v11.2.0 h1:kvB1ZmwdWgI3JsuuVUE7z4cY/6Ujr03D0w2WkOOH4Xs=
+github.com/caarlos0/env/v11 v11.2.0/go.mod h1:LwgkYk1kDvfGpHthrWWLof3Ny7PezzFwS4QrsJdHTMo=
+github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
+github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/gabriel-vasile/mimetype v1.4.5 h1:J7wGKdGu33ocBOhGy0z653k/lFKLFDPJMG8Gql0kxn4=
+github.com/gabriel-vasile/mimetype v1.4.5/go.mod h1:ibHel+/kbxn9x2407k1izTA1S81ku1z/DlgOW2QE0M4=
+github.com/gin-contrib/cors v1.7.2 h1:oLDHxdg8W/XDoN/8zamqk/Drgt4oVZDvaV0YmvVICQw=
+github.com/gin-contrib/cors v1.7.2/go.mod h1:SUJVARKgQ40dmrzgXEVxj2m7Ig1v1qIboQkPDTQ9t2E=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
+github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/go-co-op/gocron/v2 v2.11.0 h1:IOowNA6SzwdRFnD4/Ol3Kj6G2xKfsoiiGq2Jhhm9bvE=
+github.com/go-co-op/gocron/v2 v2.11.0/go.mod h1:xY7bJxGazKam1cz04EebrlP4S9q4iWdiAylMGP3jY9w=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.22.0 h1:k6HsTZ0sTnROkhS//R0O+55JgM8C4Bx7ia+JlgcnOao=
+github.com/go-playground/validator/v10 v10.22.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/go-webauthn/webauthn v0.11.0 h1:2U0jWuGeoiI+XSZkHPFRtwaYtqmMUsqABtlfSq1rODo=
+github.com/go-webauthn/webauthn v0.11.0/go.mod h1:57ZrqsZzD/eboQDVtBkvTdfqFYAh/7IwzdPT+sPWqB0=
+github.com/go-webauthn/x v0.1.12 h1:RjQ5cvApzyU/xLCiP+rub0PE4HBZsLggbxGR5ZpUf/A=
+github.com/go-webauthn/x v0.1.12/go.mod h1:XlRcGkNH8PT45TfeJYc6gqpOtiOendHhVmnOxh+5yHs=
+github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-migrate/migrate/v4 v4.17.1 h1:4zQ6iqL6t6AiItphxJctQb3cFqWiSpMnX7wLTPnnYO4=
+github.com/golang-migrate/migrate/v4 v4.17.1/go.mod h1:m8hinFyWBn0SA4QKHuKh175Pm9wjmxj3S2Mia7dbXzM=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-tpm v0.9.1 h1:0pGc4X//bAlmZzMKf8iz6IsDo1nYTbYJ6FZN/rg4zdM=
+github.com/google/go-tpm v0.9.1/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
+github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
+github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/arch v0.9.0 h1:ub9TgUInamJ8mrZIGlBG6/4TqWeMszd4N8lNorbrr6k=
+golang.org/x/arch v0.9.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
+golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
+golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
+golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
+golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
+golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/sqlite v1.5.6 h1:fO/X46qn5NUEEOZtnjJRWRzZMe8nqJiQ9E+0hi+hKQE=
+gorm.io/driver/sqlite v1.5.6/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
+gorm.io/gorm v1.25.11 h1:/Wfyg1B/je1hnDx3sMkX+gAlxrlZpn6X0BXRlwXlvHg=
+gorm.io/gorm v1.25.11/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
--- a/backend/images/background.jpg
+++ b/backend/images/background.jpg
--- a/backend/images/favicon.ico
+++ b/backend/images/favicon.ico
--- a/backend/images/logo.svg
+++ b/backend/images/logo.svg
@@ -0,0 +1,17 @@
+<svg id="a"
+    xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1015 1015">
+    <path d="M838.28,380.27c-13.38-135.36-124.37-245.08-263.77-257.28H227.96c-1.36,265.01-2.72,530.01-4.08,795.02h194.34c12.77-139.2,25.54-278.4,38.31-417.61-31.04-21.02-51.45-56.57-51.45-96.89,0-64.58,52.36-116.94,116.94-116.94s116.94,52.36,116.94,116.94c0,40.38-20.47,75.98-51.6,96.99,7.45,62.93,14.9,125.86,22.34,188.8,144.56-31.24,242.69-166.22,228.57-309.03Z"/>
+    <style>
+     @media (prefers-color-scheme: dark) {
+            #a path {
+                fill: #ffffff;
+            }
+        }
+
+        @media (prefers-color-scheme: light) {
+            #a path {
+                fill: #000000;
+            }
+        }
+    </style>
+</svg>
--- a/backend/internal/bootstrap/bootstrap.go
+++ b/backend/internal/bootstrap/bootstrap.go
@@ -0,0 +1,78 @@
+package bootstrap
+
+import (
+	"github.com/gin-gonic/gin"
+	_ "github.com/golang-migrate/migrate/v4/source/file"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/common/middleware"
+	"golang-rest-api-template/internal/handler"
+	"golang-rest-api-template/internal/job"
+	"golang-rest-api-template/internal/utils"
+	"golang.org/x/time/rate"
+	"log"
+	"os"
+	"time"
+)
+
+func Bootstrap() {
+	common.InitDatabase()
+	common.InitDbConfig()
+	initApplicationImages()
+	job.RegisterJobs()
+	initRouter()
+}
+
+func initRouter() {
+	switch common.EnvConfig.AppEnv {
+	case "production":
+		gin.SetMode(gin.ReleaseMode)
+	case "development":
+		gin.SetMode(gin.DebugMode)
+	case "test":
+		gin.SetMode(gin.TestMode)
+	}
+
+	r := gin.Default()
+
+	r.Use(gin.Logger())
+
+	r.Use(middleware.Cors())
+	r.Use(middleware.RateLimiter(rate.Every(time.Second), 60))
+
+	apiGroup := r.Group("/api")
+	handler.RegisterRoutes(apiGroup)
+	handler.RegisterOIDCRoutes(apiGroup)
+	handler.RegisterUserRoutes(apiGroup)
+	handler.RegisterConfigurationRoutes(apiGroup)
+	if common.EnvConfig.AppEnv != "production" {
+		handler.RegisterTestRoutes(apiGroup)
+	}
+
+	baseGroup := r.Group("/")
+	handler.RegisterWellKnownRoutes(baseGroup)
+
+	if err := r.Run(common.EnvConfig.Host + ":" + common.EnvConfig.Port); err != nil {
+		log.Fatal(err)
+	}
+
+}
+
+func initApplicationImages() {
+	dirPath := common.EnvConfig.UploadPath + "/application-images"
+
+	files, err := os.ReadDir(dirPath)
+	if err != nil && !os.IsNotExist(err) {
+		log.Fatalf("Error reading directory: %v", err)
+	}
+
+	// Skip if files already exist
+	if len(files) > 1 {
+		return
+	}
+
+	// Copy files from source to destination
+	err = utils.CopyDirectory("./images", dirPath)
+	if err != nil {
+		log.Fatalf("Error copying directory: %v", err)
+	}
+}
--- a/backend/internal/common/config.go
+++ b/backend/internal/common/config.go
@@ -0,0 +1,133 @@
+package common
+
+import (
+	"github.com/caarlos0/env/v11"
+	_ "github.com/joho/godotenv/autoload"
+	"golang-rest-api-template/internal/model"
+	"log"
+	"reflect"
+)
+
+type EnvConfigSchema struct {
+	AppEnv     string `env:"APP_ENV"`
+	AppURL     string `env:"PUBLIC_APP_URL"`
+	DBPath     string `env:"DB_PATH"`
+	UploadPath string `env:"UPLOAD_PATH"`
+	Port       string `env:"BACKEND_PORT"`
+	Host       string `env:"HOST"`
+}
+
+var EnvConfig = &EnvConfigSchema{
+	AppEnv:     "production",
+	DBPath:     "data/pocket-id.db",
+	UploadPath: "data/uploads",
+	AppURL:     "http://localhost",
+	Port:       "8080",
+	Host:       "localhost",
+}
+
+var DbConfig = NewDefaultDbConfig()
+
+func NewDefaultDbConfig() model.ApplicationConfiguration {
+	return model.ApplicationConfiguration{
+		AppName: model.ApplicationConfigurationVariable{
+			Key:      "appName",
+			Type:     "string",
+			IsPublic: true,
+			Value:    "Pocket ID",
+		},
+		BackgroundImageType: model.ApplicationConfigurationVariable{
+			Key:        "backgroundImageType",
+			Type:       "string",
+			IsInternal: true,
+			Value:      "jpg",
+		},
+		LogoImageType: model.ApplicationConfigurationVariable{
+			Key:        "logoImageType",
+			Type:       "string",
+			IsInternal: true,
+			Value:      "svg",
+		},
+	}
+}
+
+// LoadDbConfigFromDb refreshes the database configuration by loading the current values
+// from the database and updating the DbConfig struct.
+func LoadDbConfigFromDb() error {
+	dbConfigReflectValue := reflect.ValueOf(&DbConfig).Elem()
+
+	for i := 0; i < dbConfigReflectValue.NumField(); i++ {
+		dbConfigField := dbConfigReflectValue.Field(i)
+		currentConfigVar := dbConfigField.Interface().(model.ApplicationConfigurationVariable)
+		var storedConfigVar model.ApplicationConfigurationVariable
+		if err := DB.First(&storedConfigVar, "key = ?", currentConfigVar.Key).Error; err != nil {
+			return err
+		}
+
+		dbConfigField.Set(reflect.ValueOf(storedConfigVar))
+	}
+
+	return nil
+}
+
+// InitDbConfig creates the default configuration values in the database if they do not exist,
+// updates existing configurations if they differ from the default, and deletes any configurations
+// that are not in the default configuration.
+func InitDbConfig() {
+	// Reflect to get the underlying value of DbConfig and its default configuration
+	dbConfigReflectValue := reflect.ValueOf(&DbConfig).Elem()
+	defaultDbConfig := NewDefaultDbConfig()
+	defaultConfigReflectValue := reflect.ValueOf(&defaultDbConfig).Elem()
+	defaultKeys := make(map[string]struct{})
+
+	// Iterate over the fields of DbConfig
+	for i := 0; i < dbConfigReflectValue.NumField(); i++ {
+		dbConfigField := dbConfigReflectValue.Field(i)
+		currentConfigVar := dbConfigField.Interface().(model.ApplicationConfigurationVariable)
+		defaultConfigVar := defaultConfigReflectValue.Field(i).Interface().(model.ApplicationConfigurationVariable)
+		defaultKeys[currentConfigVar.Key] = struct{}{}
+
+		var storedConfigVar model.ApplicationConfigurationVariable
+		if err := DB.First(&storedConfigVar, "key = ?", currentConfigVar.Key).Error; err != nil {
+			// If the configuration does not exist, create it
+			if err := DB.Create(&defaultConfigVar).Error; err != nil {
+				log.Fatalf("Failed to create default configuration: %v", err)
+			}
+			dbConfigField.Set(reflect.ValueOf(defaultConfigVar))
+			continue
+		}
+
+		// Update existing configuration if it differs from the default
+		if storedConfigVar.Type != defaultConfigVar.Type || storedConfigVar.IsPublic != defaultConfigVar.IsPublic || storedConfigVar.IsInternal != defaultConfigVar.IsInternal {
+			storedConfigVar.Type = defaultConfigVar.Type
+			storedConfigVar.IsPublic = defaultConfigVar.IsPublic
+			storedConfigVar.IsInternal = defaultConfigVar.IsInternal
+			if err := DB.Save(&storedConfigVar).Error; err != nil {
+				log.Fatalf("Failed to update configuration: %v", err)
+			}
+		}
+
+		// Set the value in DbConfig
+		dbConfigField.Set(reflect.ValueOf(storedConfigVar))
+	}
+
+	// Delete any configurations not in the default keys
+	var allConfigVars []model.ApplicationConfigurationVariable
+	if err := DB.Find(&allConfigVars).Error; err != nil {
+		log.Fatalf("Failed to retrieve existing configurations: %v", err)
+	}
+
+	for _, config := range allConfigVars {
+		if _, exists := defaultKeys[config.Key]; !exists {
+			if err := DB.Delete(&config).Error; err != nil {
+				log.Fatalf("Failed to delete outdated configuration: %v", err)
+			}
+		}
+	}
+}
+
+func init() {
+	if err := env.ParseWithOptions(EnvConfig, env.Options{}); err != nil {
+		log.Fatal(err)
+	}
+}
--- a/backend/internal/common/db.go
+++ b/backend/internal/common/db.go
@@ -0,0 +1,84 @@
+package common
+
+import (
+	"errors"
+	"github.com/golang-migrate/migrate/v4"
+	"github.com/golang-migrate/migrate/v4/database/sqlite3"
+	"gorm.io/gorm/logger"
+	"log"
+	"os"
+	"time"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+var DB *gorm.DB
+
+func InitDatabase() {
+	connectDatabase()
+	sqlDb, err := DB.DB()
+	if err != nil {
+		log.Fatal("failed to get sql db", err)
+	}
+	driver, err := sqlite3.WithInstance(sqlDb, &sqlite3.Config{})
+	m, err := migrate.NewWithDatabaseInstance(
+		"file://migrations",
+		"postgres", driver)
+	if err != nil {
+		log.Fatal("failed to create migration instance", err)
+	}
+
+	err = m.Up()
+	if err != nil && !errors.Is(err, migrate.ErrNoChange) {
+		log.Fatal("failed to run migrations", err)
+	}
+}
+
+func connectDatabase() {
+	var database *gorm.DB
+	var err error
+
+	dbPath := EnvConfig.DBPath
+	if EnvConfig.AppEnv == "test" {
+		dbPath = "file::memory:?cache=shared"
+	}
+
+	for i := 1; i <= 3; i++ {
+		database, err = gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+			TranslateError: true,
+			Logger:         getLogger(),
+		})
+		if err == nil {
+			break
+		} else {
+			log.Printf("Attempt %d: Failed to initialize database. Retrying...", i)
+			time.Sleep(3 * time.Second)
+		}
+	}
+
+	DB = database
+}
+
+func getLogger() logger.Interface {
+	isProduction := EnvConfig.AppEnv == "production"
+
+	var logLevel logger.LogLevel
+	if isProduction {
+		logLevel = logger.Error
+	} else {
+		logLevel = logger.Info
+	}
+
+	// Create the GORM logger
+	return logger.New(
+		log.New(os.Stdout, "\r\n", log.LstdFlags),
+		logger.Config{
+			SlowThreshold:             200 * time.Millisecond,
+			LogLevel:                  logLevel,
+			IgnoreRecordNotFoundError: isProduction,
+			ParameterizedQueries:      isProduction,
+			Colorful:                  !isProduction,
+		},
+	)
+}
--- a/backend/internal/common/jwt.go
+++ b/backend/internal/common/jwt.go
@@ -0,0 +1,207 @@
+package common
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"github.com/golang-jwt/jwt/v5"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"log"
+	"math/big"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+)
+
+var (
+	PrivateKey *rsa.PrivateKey
+	PublicKey  *rsa.PublicKey
+)
+
+const (
+	privateKeyPath = "data/keys/jwt_private_key.pem"
+	publicKeyPath  = "data/keys/jwt_public_key.pem"
+)
+
+type accessTokenJWTClaims struct {
+	jwt.RegisteredClaims
+	IsAdmin bool `json:"isAdmin,omitempty"`
+}
+
+// GenerateIDToken generates an ID token for the given user, clientID, scope and nonce.
+func GenerateIDToken(user model.User, clientID string, scope string, nonce string) (tokenString string, err error) {
+	profileClaims := map[string]interface{}{
+		"given_name":         user.FirstName,
+		"family_name":        user.LastName,
+		"email":              user.Email,
+		"preferred_username": user.Username,
+	}
+
+	claims := jwt.MapClaims{
+		"sub": user.ID,
+		"aud": clientID,
+		"exp": jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+		"iat": jwt.NewNumericDate(time.Now()),
+	}
+
+	if nonce != "" {
+		claims["nonce"] = nonce
+	}
+	if strings.Contains(scope, "profile") {
+		for k, v := range profileClaims {
+			claims[k] = v
+		}
+	}
+	if strings.Contains(scope, "email") {
+		claims["email"] = user.Email
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	signedToken, err := token.SignedString(PrivateKey)
+	if err != nil {
+		return "", err
+	}
+
+	return signedToken, nil
+}
+
+// GenerateAccessToken generates an access token for the given user.
+func GenerateAccessToken(user model.User) (tokenString string, err error) {
+	claim := accessTokenJWTClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   user.ID,
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Audience:  jwt.ClaimStrings{utils.GetHostFromURL(EnvConfig.AppURL)},
+		},
+		IsAdmin: user.IsAdmin,
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claim)
+	tokenString, err = token.SignedString(PrivateKey)
+	return tokenString, err
+}
+
+// VerifyAccessToken verifies the given access token and returns the claims if the token is valid.
+func VerifyAccessToken(tokenString string) (*accessTokenJWTClaims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &accessTokenJWTClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return PublicKey, nil
+	})
+	if err != nil || !token.Valid {
+		return nil, errors.New("couldn't handle this token")
+	}
+
+	claims, isValid := token.Claims.(*accessTokenJWTClaims)
+	if !isValid {
+		return nil, errors.New("can't parse claims")
+	}
+
+	if !slices.Contains(claims.Audience, utils.GetHostFromURL(EnvConfig.AppURL)) {
+		return nil, errors.New("audience doesn't match")
+	}
+	return claims, nil
+}
+
+type JWK struct {
+	Kty string `json:"kty"`
+	Use string `json:"use"`
+	Kid string `json:"kid"`
+	Alg string `json:"alg"`
+	N   string `json:"n"`
+	E   string `json:"e"`
+}
+
+// GetJWK returns the JSON Web Key (JWK) for the public key.
+func GetJWK() (JWK, error) {
+	if PublicKey == nil {
+		return JWK{}, errors.New("public key is not initialized")
+	}
+
+	// Create JWK from RSA public key
+	jwk := JWK{
+		Kty: "RSA",
+		Use: "sig",
+		Kid: "1", // Key ID can be set to any identifier. Here it's statically set to "1"
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(PublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(PublicKey.E)).Bytes()),
+	}
+
+	return jwk, nil
+}
+
+// generateKeys generates a new RSA key pair and saves the private and public keys to the data folder.
+func generateKeys() {
+	if err := os.MkdirAll(filepath.Dir(privateKeyPath), 0700); err != nil {
+		log.Fatal("Failed to create directories for keys", err)
+	}
+
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		log.Fatal("Failed to generate private key", err)
+	}
+
+	privateKeyFile, err := os.Create(privateKeyPath)
+	if err != nil {
+		log.Fatal("Failed to create private key file", err)
+	}
+	defer privateKeyFile.Close()
+
+	privateKeyPEM := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
+		},
+	)
+	_, err = privateKeyFile.Write(privateKeyPEM)
+	if err != nil {
+		log.Fatal("Failed to write private key file", err)
+	}
+
+	publicKey := &privateKey.PublicKey
+	publicKeyFile, err := os.Create(publicKeyPath)
+	if err != nil {
+		log.Fatal("Failed to create public key file", err)
+	}
+	defer publicKeyFile.Close()
+
+	publicKeyPEM := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "RSA PUBLIC KEY",
+			Bytes: x509.MarshalPKCS1PublicKey(publicKey),
+		},
+	)
+	_, err = publicKeyFile.Write(publicKeyPEM)
+	if err != nil {
+		log.Fatal("Failed to write public key file", err)
+	}
+}
+
+func init() {
+	if _, err := os.Stat(privateKeyPath); os.IsNotExist(err) {
+		generateKeys()
+	}
+
+	privateKeyBytes, err := os.ReadFile(privateKeyPath)
+	if err != nil {
+		log.Fatal("Can't read jwt private key", err)
+	}
+	PrivateKey, err = jwt.ParseRSAPrivateKeyFromPEM(privateKeyBytes)
+	if err != nil {
+		log.Fatal("Can't parse jwt private key", err)
+	}
+
+	publicKeyBytes, err := os.ReadFile(publicKeyPath)
+	if err != nil {
+		log.Fatal("Can't read jwt public key", err)
+	}
+	PublicKey, err = jwt.ParseRSAPublicKeyFromPEM(publicKeyBytes)
+	if err != nil {
+		log.Fatal("Can't parse jwt public key", err)
+	}
+}
--- a/backend/internal/common/middleware/cors.go
+++ b/backend/internal/common/middleware/cors.go
@@ -0,0 +1,18 @@
+package middleware
+
+import (
+	"golang-rest-api-template/internal/common"
+	"time"
+
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+)
+
+func Cors() gin.HandlerFunc {
+	return cors.New(cors.Config{
+		AllowOrigins: []string{common.EnvConfig.AppURL},
+		AllowMethods: []string{"*"},
+		AllowHeaders: []string{"*"},
+		MaxAge:       12 * time.Hour,
+	})
+}
--- a/backend/internal/common/middleware/file_size_limit.go
+++ b/backend/internal/common/middleware/file_size_limit.go
@@ -0,0 +1,40 @@
+package middleware
+
+import (
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/utils"
+	"net/http"
+)
+
+func LimitFileSize(maxSize int64) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxSize)
+		if err := c.Request.ParseMultipartForm(maxSize); err != nil {
+			utils.HandlerError(c, http.StatusRequestEntityTooLarge, fmt.Sprintf("The file can't be larger than %s bytes", formatFileSize(maxSize)))
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+// formatFileSize formats a file size in bytes to a human-readable string
+func formatFileSize(size int64) string {
+	const (
+		KB = 1 << (10 * 1)
+		MB = 1 << (10 * 2)
+		GB = 1 << (10 * 3)
+	)
+
+	switch {
+	case size >= GB:
+		return fmt.Sprintf("%.2f GB", float64(size)/GB)
+	case size >= MB:
+		return fmt.Sprintf("%.2f MB", float64(size)/MB)
+	case size >= KB:
+		return fmt.Sprintf("%.2f KB", float64(size)/KB)
+	default:
+		return fmt.Sprintf("%d bytes", size)
+	}
+}
--- a/backend/internal/common/middleware/jwt_auth.go
+++ b/backend/internal/common/middleware/jwt_auth.go
@@ -0,0 +1,47 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/utils"
+	"net/http"
+	"strings"
+)
+
+func JWTAuth(adminOnly bool) gin.HandlerFunc {
+	return func(c *gin.Context) {
+
+		// Extract the token from the cookie or the Authorization header
+		token, err := c.Cookie("access_token")
+		if err != nil {
+			authorizationHeaderSplitted := strings.Split(c.GetHeader("Authorization"), " ")
+			if len(authorizationHeaderSplitted) == 2 {
+				token = authorizationHeaderSplitted[1]
+			} else {
+				utils.HandlerError(c, http.StatusUnauthorized, "You're not signed in")
+				c.Abort()
+				return
+			}
+
+		}
+
+		// Verify the token
+		claims, err := common.VerifyAccessToken(token)
+		if err != nil {
+			utils.HandlerError(c, http.StatusUnauthorized, "You're not signed in")
+			c.Abort()
+			return
+		}
+
+		// Check if the user is an admin
+		if adminOnly && !claims.IsAdmin {
+			utils.HandlerError(c, http.StatusForbidden, "You don't have permission to access this resource")
+			c.Abort()
+			return
+		}
+
+		c.Set("userID", claims.Subject)
+		c.Set("userIsAdmin", claims.IsAdmin)
+		c.Next()
+	}
+}
--- a/backend/internal/common/middleware/rate_limit.go
+++ b/backend/internal/common/middleware/rate_limit.go
@@ -0,0 +1,76 @@
+package middleware
+
+import (
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/utils"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/time/rate"
+)
+
+// RateLimiter is a Gin middleware for rate limiting based on client IP
+func RateLimiter(limit rate.Limit, burst int) gin.HandlerFunc {
+	// Start the cleanup routine
+	go cleanupClients()
+
+	return func(c *gin.Context) {
+		ip := c.ClientIP()
+
+		// Skip rate limiting for localhost and test environment
+		// If the client ip is localhost the request comes from the frontend
+		if ip == "127.0.0.1" || ip == "::1" || common.EnvConfig.AppEnv == "test" {
+			c.Next()
+			return
+		}
+
+		limiter := getLimiter(ip, limit, burst)
+		if !limiter.Allow() {
+			utils.HandlerError(c, http.StatusTooManyRequests, "Too many requests. Please wait a while before trying again.")
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}
+
+type client struct {
+	limiter  *rate.Limiter
+	lastSeen time.Time
+}
+
+// Map to store the rate limiters per IP
+var clients = make(map[string]*client)
+var mu sync.Mutex
+
+// Cleanup routine to remove stale clients that haven't been seen for a while
+func cleanupClients() {
+	for {
+		time.Sleep(time.Minute)
+		mu.Lock()
+		for ip, client := range clients {
+			if time.Since(client.lastSeen) > 3*time.Minute {
+				delete(clients, ip)
+			}
+		}
+		mu.Unlock()
+	}
+}
+
+// getLimiter retrieves the rate limiter for a given IP address, creating one if it doesn't exist
+func getLimiter(ip string, limit rate.Limit, burst int) *rate.Limiter {
+	mu.Lock()
+	defer mu.Unlock()
+
+	if client, exists := clients[ip]; exists {
+		client.lastSeen = time.Now()
+		return client.limiter
+	}
+
+	limiter := rate.NewLimiter(limit, burst)
+	clients[ip] = &client{limiter: limiter, lastSeen: time.Now()}
+	return limiter
+}
--- a/backend/internal/common/webauthn.go
+++ b/backend/internal/common/webauthn.go
@@ -0,0 +1,37 @@
+package common
+
+import (
+	"github.com/go-webauthn/webauthn/webauthn"
+	"golang-rest-api-template/internal/utils"
+	"log"
+	"time"
+)
+
+var (
+	WebAuthn *webauthn.WebAuthn
+	err      error
+)
+
+func init() {
+	config := &webauthn.Config{
+		RPDisplayName: DbConfig.AppName.Value,
+		RPID:          utils.GetHostFromURL(EnvConfig.AppURL),
+		RPOrigins:     []string{EnvConfig.AppURL},
+		Timeouts: webauthn.TimeoutsConfig{
+			Login: webauthn.TimeoutConfig{
+				Enforce:    true,
+				Timeout:    time.Second * 60,
+				TimeoutUVD: time.Second * 60,
+			},
+			Registration: webauthn.TimeoutConfig{
+				Enforce:    true,
+				Timeout:    time.Second * 60,
+				TimeoutUVD: time.Second * 60,
+			},
+		},
+	}
+
+	if WebAuthn, err = webauthn.New(config); err != nil {
+		log.Fatal(err)
+	}
+}
--- a/backend/internal/handler/application_configuration.go
+++ b/backend/internal/handler/application_configuration.go
@@ -0,0 +1,190 @@
+package handler
+
+import (
+	"errors"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/common/middleware"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"gorm.io/gorm"
+	"net/http"
+	"os"
+	"reflect"
+)
+
+func RegisterConfigurationRoutes(group *gin.RouterGroup) {
+	group.GET("/application-configuration", listApplicationConfigurationHandler)
+	group.PUT("/application-configuration", updateApplicationConfigurationHandler)
+
+	group.GET("/application-configuration/logo", getLogoHandler)
+	group.GET("/application-configuration/background-image", getBackgroundImageHandler)
+	group.GET("/application-configuration/favicon", getFaviconHandler)
+	group.PUT("/application-configuration/logo", middleware.JWTAuth(true), updateLogoHandler)
+	group.PUT("/application-configuration/favicon", middleware.JWTAuth(true), updateFaviconHandler)
+	group.PUT("/application-configuration/background-image", middleware.JWTAuth(true), updateBackgroundImageHandler)
+}
+
+func listApplicationConfigurationHandler(c *gin.Context) {
+	// Return also the private configuration variables if the user is admin and showAll is true
+	showAll := c.GetBool("userIsAdmin") && c.DefaultQuery("showAll", "false") == "true"
+
+	var configuration []model.ApplicationConfigurationVariable
+	var err error
+
+	if showAll {
+		err = common.DB.Find(&configuration).Error
+	} else {
+		err = common.DB.Find(&configuration, "is_public = true").Error
+	}
+
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(200, configuration)
+}
+
+func updateApplicationConfigurationHandler(c *gin.Context) {
+	var input model.ApplicationConfigurationUpdateDto
+	if err := c.ShouldBindJSON(&input); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	savedConfigVariables := make([]model.ApplicationConfigurationVariable, 10)
+
+	tx := common.DB.Begin()
+	rt := reflect.ValueOf(input).Type()
+	rv := reflect.ValueOf(input)
+
+	// Loop over the input struct fields and update the related configuration variables
+	for i := 0; i < rt.NumField(); i++ {
+		field := rt.Field(i)
+		key := field.Tag.Get("json")
+		value := rv.FieldByName(field.Name).String()
+
+		// Get the existing configuration variable from the db
+		var applicationConfigurationVariable model.ApplicationConfigurationVariable
+		if err := tx.First(&applicationConfigurationVariable, "key = ? AND is_internal = false", key).Error; err != nil {
+			tx.Rollback()
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.HandlerError(c, http.StatusNotFound, fmt.Sprintf("Invalid configuration variable '%s'", value))
+			} else {
+				utils.UnknownHandlerError(c, err)
+			}
+			return
+		}
+
+		// Update the value of the existing configuration variable and save it
+		applicationConfigurationVariable.Value = value
+		if err := tx.Save(&applicationConfigurationVariable).Error; err != nil {
+			tx.Rollback()
+			utils.UnknownHandlerError(c, err)
+			return
+		}
+
+		savedConfigVariables[i] = applicationConfigurationVariable
+	}
+
+	tx.Commit()
+
+	if err := common.LoadDbConfigFromDb(); err != nil {
+		utils.UnknownHandlerError(c, err)
+	}
+
+	c.JSON(http.StatusOK, savedConfigVariables)
+
+}
+
+func getLogoHandler(c *gin.Context) {
+	imagType := common.DbConfig.LogoImageType.Value
+	getImage(c, "logo", imagType)
+}
+
+func getFaviconHandler(c *gin.Context) {
+	getImage(c, "favicon", "ico")
+}
+
+func getBackgroundImageHandler(c *gin.Context) {
+	imageType := common.DbConfig.BackgroundImageType.Value
+	getImage(c, "background", imageType)
+}
+
+func updateLogoHandler(c *gin.Context) {
+	imageType := common.DbConfig.LogoImageType.Value
+	updateImage(c, "logo", imageType)
+}
+
+func updateFaviconHandler(c *gin.Context) {
+	file, err := c.FormFile("file")
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	fileType := utils.GetFileExtension(file.Filename)
+	if fileType != "ico" {
+		utils.HandlerError(c, http.StatusBadRequest, "File must be of type .ico")
+		return
+	}
+	updateImage(c, "favicon", "ico")
+}
+
+func updateBackgroundImageHandler(c *gin.Context) {
+	imagType := common.DbConfig.BackgroundImageType.Value
+	updateImage(c, "background", imagType)
+}
+
+func getImage(c *gin.Context, name string, imageType string) {
+	imagePath := fmt.Sprintf("%s/application-images/%s.%s", common.EnvConfig.UploadPath, name, imageType)
+	mimeType := utils.GetImageMimeType(imageType)
+
+	c.Header("Content-Type", mimeType)
+	c.File(imagePath)
+}
+
+func updateImage(c *gin.Context, imageName string, oldImageType string) {
+	file, err := c.FormFile("file")
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	fileType := utils.GetFileExtension(file.Filename)
+	if mimeType := utils.GetImageMimeType(fileType); mimeType == "" {
+		utils.HandlerError(c, http.StatusBadRequest, "File type not supported")
+		return
+	}
+
+	// Delete the old image if it has a different file type
+	if fileType != oldImageType {
+		oldImagePath := fmt.Sprintf("%s/application-images/%s.%s", common.EnvConfig.UploadPath, imageName, oldImageType)
+		if err := os.Remove(oldImagePath); err != nil {
+			utils.UnknownHandlerError(c, err)
+			return
+		}
+	}
+
+	imagePath := fmt.Sprintf("%s/application-images/%s.%s", common.EnvConfig.UploadPath, imageName, fileType)
+	err = c.SaveUploadedFile(file, imagePath)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	// Update the file type in the database
+	key := fmt.Sprintf("%sImageType", imageName)
+	err = common.DB.Model(&model.ApplicationConfigurationVariable{}).Where("key = ?", key).Update("value", fileType).Error
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	if err := common.LoadDbConfigFromDb(); err != nil {
+		utils.UnknownHandlerError(c, err)
+	}
+
+	c.Status(http.StatusNoContent)
+}
--- a/backend/internal/handler/oidc.go
+++ b/backend/internal/handler/oidc.go
@@ -0,0 +1,415 @@
+package handler
+
+import (
+	"errors"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/common/middleware"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"net/http"
+	"os"
+	"time"
+)
+
+func RegisterOIDCRoutes(group *gin.RouterGroup) {
+	group.POST("/oidc/authorize", middleware.JWTAuth(false), authorizeHandler)
+	group.POST("/oidc/authorize/new-client", middleware.JWTAuth(false), authorizeNewClientHandler)
+	group.POST("/oidc/token", createIDTokenHandler)
+
+	group.GET("/oidc/clients", middleware.JWTAuth(true), listClientsHandler)
+	group.POST("/oidc/clients", middleware.JWTAuth(true), createClientHandler)
+	group.GET("/oidc/clients/:id", getClientHandler)
+	group.PUT("/oidc/clients/:id", middleware.JWTAuth(true), updateClientHandler)
+	group.DELETE("/oidc/clients/:id", middleware.JWTAuth(true), deleteClientHandler)
+
+	group.POST("/oidc/clients/:id/secret", middleware.JWTAuth(true), createClientSecretHandler)
+
+	group.GET("/oidc/clients/:id/logo", getClientLogoHandler)
+	group.DELETE("/oidc/clients/:id/logo", deleteClientLogoHandler)
+	group.POST("/oidc/clients/:id/logo", middleware.JWTAuth(true), middleware.LimitFileSize(2<<20), updateClientLogoHandler)
+}
+
+type AuthorizeRequest struct {
+	ClientID string `json:"clientID" binding:"required"`
+	Scope    string `json:"scope" binding:"required"`
+	Nonce    string `json:"nonce"`
+}
+
+func authorizeHandler(c *gin.Context) {
+	var parsedBody AuthorizeRequest
+	if err := c.ShouldBindJSON(&parsedBody); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	var userAuthorizedOIDCClient model.UserAuthorizedOidcClient
+	common.DB.First(&userAuthorizedOIDCClient, "client_id = ? AND user_id = ?", parsedBody.ClientID, c.GetString("userID"))
+
+	// If the record isn't found or the scope is different return an error
+	// The client will have to call the authorizeNewClientHandler
+	if userAuthorizedOIDCClient.Scope != parsedBody.Scope {
+		utils.HandlerError(c, http.StatusForbidden, "missing authorization")
+		return
+	}
+
+	authorizationCode, err := createAuthorizationCode(parsedBody.ClientID, c.GetString("userID"), parsedBody.Scope, parsedBody.Nonce)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"code": authorizationCode})
+}
+
+// authorizeNewClientHandler authorizes a new client for the user
+// a new client is a new client when the user has not authorized the client before
+func authorizeNewClientHandler(c *gin.Context) {
+	var parsedBody model.AuthorizeNewClientDto
+	if err := c.ShouldBindJSON(&parsedBody); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	userAuthorizedClient := model.UserAuthorizedOidcClient{
+		UserID:   c.GetString("userID"),
+		ClientID: parsedBody.ClientID,
+		Scope:    parsedBody.Scope,
+	}
+	err := common.DB.Create(&userAuthorizedClient).Error
+
+	if err != nil && errors.Is(err, gorm.ErrDuplicatedKey) {
+		err = common.DB.Model(&userAuthorizedClient).Update("scope", parsedBody.Scope).Error
+	}
+
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	authorizationCode, err := createAuthorizationCode(parsedBody.ClientID, c.GetString("userID"), parsedBody.Scope, parsedBody.Nonce)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"code": authorizationCode})
+
+}
+
+func createIDTokenHandler(c *gin.Context) {
+	var body model.OidcIdTokenDto
+
+	if err := c.ShouldBind(&body); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	// Currently only authorization_code grant type is supported
+	if body.GrantType != "authorization_code" {
+		utils.HandlerError(c, http.StatusBadRequest, "grant type not supported")
+		return
+	}
+
+	clientID := body.ClientID
+	clientSecret := body.ClientSecret
+
+	// Client id and secret can also be passed over the Authorization header
+	if clientID == "" || clientSecret == "" {
+		var ok bool
+		clientID, clientSecret, ok = c.Request.BasicAuth()
+		if !ok {
+			utils.HandlerError(c, http.StatusBadRequest, "Client id and secret not provided")
+			return
+		}
+	}
+
+	// Get the client
+	var client model.OidcClient
+	err := common.DB.First(&client, "id = ?", clientID, clientSecret).Error
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "OIDC OIDC client not found")
+		return
+	}
+
+	// Check if client secret is correct
+	err = bcrypt.CompareHashAndPassword([]byte(client.Secret), []byte(clientSecret))
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid client secret")
+		return
+	}
+
+	var authorizationCodeMetaData model.OidcAuthorizationCode
+	err = common.DB.Preload("User").First(&authorizationCodeMetaData, "code = ?", body.Code).Error
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid authorization code")
+		return
+	}
+
+	// Check if the client id matches the client id in the authorization code and if the code has expired
+	if authorizationCodeMetaData.ClientID != clientID && authorizationCodeMetaData.ExpiresAt.Before(time.Now()) {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid authorization code")
+		return
+	}
+
+	idToken, e := common.GenerateIDToken(authorizationCodeMetaData.User, clientID, authorizationCodeMetaData.Scope, authorizationCodeMetaData.Nonce)
+	if e != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	// Delete the authorization code after it has been used
+	common.DB.Delete(&authorizationCodeMetaData)
+
+	c.JSON(http.StatusOK, gin.H{"id_token": idToken})
+}
+
+func getClientHandler(c *gin.Context) {
+	clientId := c.Param("id")
+
+	var client model.OidcClient
+	err := common.DB.First(&client, "id = ?", clientId).Error
+	if err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+		return
+	}
+
+	c.JSON(http.StatusOK, client)
+}
+
+func listClientsHandler(c *gin.Context) {
+	var clients []model.OidcClient
+	searchTerm := c.Query("search")
+
+	query := common.DB.Model(&model.OidcClient{})
+
+	if searchTerm != "" {
+		searchPattern := "%" + searchTerm + "%"
+		query = query.Where("name LIKE ?", searchPattern)
+	}
+
+	pagination, err := utils.Paginate(c, query, &clients)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"data":       clients,
+		"pagination": pagination,
+	})
+}
+
+func createClientHandler(c *gin.Context) {
+	var input model.OidcClientCreateDto
+	if err := c.ShouldBindJSON(&input); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	client := model.OidcClient{
+		Name:        input.Name,
+		CallbackURL: input.CallbackURL,
+		CreatedByID: c.GetString("userID"),
+	}
+
+	if err := common.DB.Create(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusCreated, client)
+}
+
+func deleteClientHandler(c *gin.Context) {
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "OIDC OIDC client not found")
+		return
+	}
+
+	if err := common.DB.Delete(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func updateClientHandler(c *gin.Context) {
+	var input model.OidcClientCreateDto
+	if err := c.ShouldBindJSON(&input); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	client.Name = input.Name
+	client.CallbackURL = input.CallbackURL
+
+	if err := common.DB.Save(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusNoContent, client)
+}
+
+// createClientSecretHandler creates a new secret for the client and revokes the old one
+func createClientSecretHandler(c *gin.Context) {
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	clientSecret, err := utils.GenerateRandomAlphanumericString(32)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	hashedSecret, err := bcrypt.GenerateFromPassword([]byte(clientSecret), bcrypt.DefaultCost)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	client.Secret = string(hashedSecret)
+	if err := common.DB.Save(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"secret": clientSecret})
+}
+
+func getClientLogoHandler(c *gin.Context) {
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+		return
+	}
+
+	if client.ImageType == nil {
+		utils.HandlerError(c, http.StatusNotFound, "image not found")
+		return
+	}
+
+	imageType := *client.ImageType
+
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, imageType)
+	mimeType := utils.GetImageMimeType(imageType)
+
+	c.Header("Content-Type", mimeType)
+	c.File(imagePath)
+}
+
+func updateClientLogoHandler(c *gin.Context) {
+	file, err := c.FormFile("file")
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	fileType := utils.GetFileExtension(file.Filename)
+	if mimeType := utils.GetImageMimeType(fileType); mimeType == "" {
+		utils.HandlerError(c, http.StatusBadRequest, "file type not supported")
+		return
+	}
+
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, c.Param("id"), fileType)
+	err = c.SaveUploadedFile(file, imagePath)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+		return
+	}
+
+	// Delete the old image if it has a different file type
+	if client.ImageType != nil && fileType != *client.ImageType {
+		oldImagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
+		if err := os.Remove(oldImagePath); err != nil {
+			utils.UnknownHandlerError(c, err)
+			return
+		}
+	}
+
+	client.ImageType = &fileType
+	if err := common.DB.Save(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func deleteClientLogoHandler(c *gin.Context) {
+	var client model.OidcClient
+	if err := common.DB.First(&client, "id = ?", c.Param("id")).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "OIDC client not found")
+		return
+	}
+
+	if client.ImageType == nil {
+		utils.HandlerError(c, http.StatusNotFound, "image not found")
+		return
+	}
+
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
+	if err := os.Remove(imagePath); err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	client.ImageType = nil
+	if err := common.DB.Save(&client).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func createAuthorizationCode(clientID string, userID string, scope string, nonce string) (string, error) {
+	randomString, err := utils.GenerateRandomAlphanumericString(32)
+	if err != nil {
+		return "", err
+	}
+
+	oidcAuthorizationCode := model.OidcAuthorizationCode{
+		ExpiresAt: time.Now().Add(15 * time.Minute),
+		Code:      randomString,
+		ClientID:  clientID,
+		UserID:    userID,
+		Scope:     scope,
+		Nonce:     nonce,
+	}
+
+	if err := common.DB.Create(&oidcAuthorizationCode).Error; err != nil {
+		return "", err
+	}
+
+	return randomString, nil
+}
--- a/backend/internal/handler/test.go
+++ b/backend/internal/handler/test.go
@@ -0,0 +1,237 @@
+package handler
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/base64"
+	"log"
+	"os"
+	"time"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/gin-gonic/gin"
+	"github.com/go-webauthn/webauthn/protocol"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"gorm.io/gorm"
+)
+
+func RegisterTestRoutes(group *gin.RouterGroup) {
+	group.POST("/test/reset", resetAndSeedHandler)
+}
+
+func resetAndSeedHandler(c *gin.Context) {
+	if err := resetDatabase(); err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	if err := resetApplicationImages(); err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	if err := seedDatabase(); err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(200, gin.H{"message": "Database reset and seeded"})
+}
+
+// seedDatabase seeds the database with initial data and uses a transaction to ensure atomicity.
+func seedDatabase() error {
+	return common.DB.Transaction(func(tx *gorm.DB) error {
+		users := []model.User{
+			{
+				Base: model.Base{
+					ID: "f4b89dc2-62fb-46bf-9f5f-c34f4eafe93e",
+				},
+				Username:  "tim",
+				Email:     "tim.cook@test.com",
+				FirstName: "Tim",
+				LastName:  "Cook",
+				IsAdmin:   true,
+			},
+			{
+				Base: model.Base{
+					ID: "1cd19686-f9a6-43f4-a41f-14a0bf5b4036",
+				},
+				Username:  "craig",
+				Email:     "craig.federighi@test.com",
+				FirstName: "Craig",
+				LastName:  "Federighi",
+				IsAdmin:   false,
+			},
+		}
+		for _, user := range users {
+			if err := tx.Create(&user).Error; err != nil {
+				return err
+			}
+		}
+
+		oidcClients := []model.OidcClient{
+			{
+				Base: model.Base{
+					ID: "3654a746-35d4-4321-ac61-0bdcff2b4055",
+				},
+				Name:        "Nextcloud",
+				Secret:      "$2a$10$9dypwot8nGuCjT6wQWWpJOckZfRprhe2EkwpKizxS/fpVHrOLEJHC", // w2mUeZISmEvIDMEDvpY0PnxQIpj1m3zY
+				CallbackURL: "http://nextcloud/auth/callback",
+				ImageType:   utils.StringPointer("png"),
+				CreatedByID: users[0].ID,
+			},
+			{
+				Base: model.Base{
+					ID: "606c7782-f2b1-49e5-8ea9-26eb1b06d018",
+				},
+				Name:        "Immich",
+				Secret:      "$2a$10$Ak.FP8riD1ssy2AGGbG.gOpnp/rBpymd74j0nxNMtW0GG1Lb4gzxe", // PYjrE9u4v9GVqXKi52eur0eb2Ci4kc0x
+				CallbackURL: "http://immich/auth/callback",
+				CreatedByID: users[0].ID,
+			},
+		}
+		for _, client := range oidcClients {
+			if err := tx.Create(&client).Error; err != nil {
+				return err
+			}
+		}
+
+		authCode := model.OidcAuthorizationCode{
+			Code:      "auth-code",
+			Scope:     "openid profile",
+			Nonce:     "nonce",
+			ExpiresAt: time.Now().Add(1 * time.Hour),
+			UserID:    users[0].ID,
+			ClientID:  oidcClients[0].ID,
+		}
+		if err := tx.Create(&authCode).Error; err != nil {
+			return err
+		}
+
+		accessToken := model.OneTimeAccessToken{
+			Token:     "one-time-token",
+			ExpiresAt: time.Now().Add(1 * time.Hour),
+			UserID:    users[0].ID,
+		}
+		if err := tx.Create(&accessToken).Error; err != nil {
+			return err
+		}
+
+		userAuthorizedClient := model.UserAuthorizedOidcClient{
+			Scope:    "openid profile email",
+			UserID:   users[0].ID,
+			ClientID: oidcClients[0].ID,
+		}
+		if err := tx.Create(&userAuthorizedClient).Error; err != nil {
+			return err
+		}
+
+		webauthnCredentials := []model.WebauthnCredential{
+			{
+				Name:            "Passkey 1",
+				CredentialID:    "test-credential-1",
+				PublicKey:       getCborPublicKey("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwcOo5KV169KR67QEHrcYkeXE3CCxv2BgwnSq4VYTQxyLtdmKxegexa8JdwFKhKXa2BMI9xaN15BoL6wSCRFJhg=="),
+				AttestationType: "none",
+				Transport:       model.AuthenticatorTransportList{protocol.Internal},
+				UserID:          users[0].ID,
+			},
+			{
+				Name:            "Passkey 2",
+				CredentialID:    "test-credential-2",
+				PublicKey:       getCborPublicKey("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESq/wR8QbBu3dKnpaw/v0mDxFFDwnJ/L5XHSg2tAmq5x1BpSMmIr3+DxCbybVvGRmWGh8kKhy7SMnK91M6rFHTA=="),
+				AttestationType: "none",
+				Transport:       model.AuthenticatorTransportList{protocol.Internal},
+				UserID:          users[0].ID,
+			},
+		}
+		for _, credential := range webauthnCredentials {
+			if err := tx.Create(&credential).Error; err != nil {
+				return err
+			}
+		}
+
+		webauthnSession := model.WebauthnSession{
+			Challenge:        "challenge",
+			ExpiresAt:        time.Now().Add(1 * time.Hour),
+			UserVerification: "preferred",
+		}
+		if err := tx.Create(&webauthnSession).Error; err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
+
+// resetDatabase resets the database by deleting all rows from each table.
+func resetDatabase() error {
+	err := common.DB.Transaction(func(tx *gorm.DB) error {
+		var tables []string
+		if err := tx.Raw("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name != 'schema_migrations';").Scan(&tables).Error; err != nil {
+			return err
+		}
+
+		for _, table := range tables {
+			if err := tx.Exec("DELETE FROM " + table).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	common.InitDbConfig()
+	return nil
+}
+
+// resetApplicationImages resets the application images by removing existing images and replacing them with the default ones
+func resetApplicationImages() error {
+
+	if err := os.RemoveAll(common.EnvConfig.UploadPath); err != nil {
+		log.Printf("Error removing directory: %v", err)
+		return err
+	}
+
+	if err := utils.CopyDirectory("./images", common.EnvConfig.UploadPath+"/application-images"); err != nil {
+		log.Printf("Error copying directory: %v", err)
+		return err
+	}
+
+	return nil
+}
+
+// getCborPublicKey decodes a Base64 encoded public key and returns the CBOR encoded COSE key
+func getCborPublicKey(base64PublicKey string) []byte {
+	decodedKey, err := base64.StdEncoding.DecodeString(base64PublicKey)
+	if err != nil {
+		log.Fatalf("Failed to decode base64 key: %v", err)
+	}
+
+	pubKey, err := x509.ParsePKIXPublicKey(decodedKey)
+	if err != nil {
+		log.Fatalf("Failed to parse public key: %v", err)
+	}
+
+	ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
+	if !ok {
+		log.Fatalf("Not an ECDSA public key")
+	}
+
+	coseKey := map[int]interface{}{
+		1:  2,                     // Key type: EC2
+		3:  -7,                    // Algorithm: ECDSA with SHA-256
+		-1: 1,                     // Curve: P-256
+		-2: ecdsaPubKey.X.Bytes(), // X coordinate
+		-3: ecdsaPubKey.Y.Bytes(), // Y coordinate
+	}
+
+	cborPublicKey, err := cbor.Marshal(coseKey)
+	if err != nil {
+		log.Fatalf("Failed to encode CBOR: %v", err)
+	}
+
+	return cborPublicKey
+}
--- a/backend/internal/handler/user.go
+++ b/backend/internal/handler/user.go
@@ -0,0 +1,269 @@
+package handler
+
+import (
+	"errors"
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/common/middleware"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"golang.org/x/time/rate"
+	"gorm.io/gorm"
+	"log"
+	"net/http"
+	"time"
+)
+
+func RegisterUserRoutes(group *gin.RouterGroup) {
+	group.GET("/users", middleware.JWTAuth(true), listUsersHandler)
+	group.GET("/users/me", middleware.JWTAuth(false), getCurrentUserHandler)
+	group.GET("/users/:id", middleware.JWTAuth(true), getUserHandler)
+	group.POST("/users", middleware.JWTAuth(true), createUserHandler)
+	group.PUT("/users/:id", middleware.JWTAuth(true), updateUserHandler)
+	group.PUT("/users/me", middleware.JWTAuth(false), updateCurrentUserHandler)
+	group.DELETE("/users/:id", middleware.JWTAuth(true), deleteUserHandler)
+
+	group.POST("/users/:id/one-time-access-token", middleware.JWTAuth(true), createOneTimeAccessTokenHandler)
+	group.POST("/one-time-access-token/:token", middleware.RateLimiter(rate.Every(10*time.Second), 5), exchangeOneTimeAccessTokenHandler)
+	group.POST("/one-time-access-token/setup", getSetupAccessTokenHandler)
+}
+
+func listUsersHandler(c *gin.Context) {
+	var users []model.User
+	searchTerm := c.Query("search")
+
+	query := common.DB.Model(&model.User{})
+
+	if searchTerm != "" {
+		searchPattern := "%" + searchTerm + "%"
+		query = query.Where("email LIKE ? OR first_name LIKE ? OR username LIKE ?", searchPattern, searchPattern, searchPattern)
+	}
+
+	pagination, err := utils.Paginate(c, query, &users)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"data":       users,
+		"pagination": pagination,
+	})
+}
+
+func getUserHandler(c *gin.Context) {
+	var user model.User
+	if err := common.DB.Where("id = ?", c.Param("id")).First(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusNotFound, "User not found")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, user)
+}
+
+func getCurrentUserHandler(c *gin.Context) {
+	var user model.User
+	if err := common.DB.Where("id = ?", c.GetString("userID")).First(&user).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, user)
+
+}
+
+func deleteUserHandler(c *gin.Context) {
+	var user model.User
+	if err := common.DB.Where("id = ?", c.Param("id")).First(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusNotFound, "User not found")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	if err := common.DB.Delete(&user).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func createUserHandler(c *gin.Context) {
+	var user model.User
+	if err := c.ShouldBindJSON(&user); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	if err := common.DB.Create(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			if err := checkDuplicatedFields(user); err != nil {
+				utils.HandlerError(c, http.StatusBadRequest, err.Error())
+				return
+			}
+		} else {
+			utils.UnknownHandlerError(c, err)
+			return
+		}
+	}
+
+	c.JSON(http.StatusCreated, user)
+}
+
+func updateUserHandler(c *gin.Context) {
+	updateUser(c, c.Param("id"))
+}
+
+func updateCurrentUserHandler(c *gin.Context) {
+	updateUser(c, c.GetString("userID"))
+}
+
+func createOneTimeAccessTokenHandler(c *gin.Context) {
+	var input model.OneTimeAccessTokenCreateDto
+	if err := c.ShouldBindJSON(&input); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	randomString, err := utils.GenerateRandomAlphanumericString(16)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	oneTimeAccessToken := model.OneTimeAccessToken{
+		UserID:    input.UserID,
+		ExpiresAt: input.ExpiresAt,
+		Token:     randomString,
+	}
+
+	if err := common.DB.Create(&oneTimeAccessToken).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{"token": oneTimeAccessToken})
+}
+
+func exchangeOneTimeAccessTokenHandler(c *gin.Context) {
+	var oneTimeAccessToken model.OneTimeAccessToken
+	if err := common.DB.Where("token = ? AND expires_at > ?", c.Param("token"), utils.FormatDateForDb(time.Now())).Preload("User").First(&oneTimeAccessToken).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusForbidden, "Token is invalid or expired")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	token, err := common.GenerateAccessToken(oneTimeAccessToken.User)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		log.Println(err)
+		return
+	}
+
+	if err := common.DB.Delete(&oneTimeAccessToken).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.SetCookie("access_token", token, int(time.Hour.Seconds()), "/", "", false, true)
+
+	c.JSON(http.StatusOK, oneTimeAccessToken.User)
+}
+
+// getSetupAccessTokenHandler creates the initial admin user and returns an access token for the user
+// This handler is only available if there are no users in the database
+func getSetupAccessTokenHandler(c *gin.Context) {
+	var userCount int64
+	if err := common.DB.Model(&model.User{}).Count(&userCount).Error; err != nil {
+		log.Fatal("failed to count users", err)
+	}
+
+	// If there are more than one user, we don't need to create the admin user
+	if userCount > 1 {
+		utils.HandlerError(c, http.StatusForbidden, "Setup already completed")
+		return
+	}
+
+	var user = model.User{
+		FirstName: "Admin",
+		LastName:  "Admin",
+		Username:  "admin",
+		Email:     "admin@admin.com",
+		IsAdmin:   true,
+	}
+
+	// Create the initial admin user if it doesn't exist
+	if err := common.DB.Model(&model.User{}).Preload("Credentials").FirstOrCreate(&user).Error; err != nil {
+		log.Fatal("failed to create admin user", err)
+	}
+
+	// If the user already has credentials, the setup is already completed
+	if len(user.Credentials) > 0 {
+		utils.HandlerError(c, http.StatusForbidden, "Setup already completed")
+		return
+	}
+
+	token, err := common.GenerateAccessToken(user)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		log.Println(err)
+		return
+	}
+	c.SetCookie("access_token", token, int(time.Hour.Seconds()), "/", "", false, true)
+	c.JSON(http.StatusOK, user)
+}
+
+func updateUser(c *gin.Context, userID string) {
+	var user model.User
+	if err := common.DB.Where("id = ?", userID).First(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.HandlerError(c, http.StatusNotFound, "User not found")
+			return
+		}
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	var updatedUser model.User
+	if err := c.ShouldBindJSON(&updatedUser); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	if err := common.DB.Model(&user).Updates(&updatedUser).Error; err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			if err := checkDuplicatedFields(user); err != nil {
+				utils.HandlerError(c, http.StatusBadRequest, err.Error())
+				return
+			}
+		} else {
+			utils.UnknownHandlerError(c, err)
+			return
+		}
+	}
+
+	c.JSON(http.StatusOK, updatedUser)
+}
+
+func checkDuplicatedFields(user model.User) error {
+	var existingUser model.User
+
+	if common.DB.Where("id != ? AND email = ?", user.ID, user.Email).First(&existingUser).Error == nil {
+		return errors.New("email is already taken")
+	}
+
+	if common.DB.Where("id != ? AND username = ?", user.ID, user.Username).First(&existingUser).Error == nil {
+		return errors.New("username is already taken")
+	}
+
+	return nil
+}
--- a/backend/internal/handler/webauthn.go
+++ b/backend/internal/handler/webauthn.go
@@ -0,0 +1,255 @@
+package handler
+
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/common/middleware"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"golang.org/x/time/rate"
+	"gorm.io/gorm"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+)
+
+func RegisterRoutes(group *gin.RouterGroup) {
+	group.GET("/webauthn/register/start", middleware.JWTAuth(false), beginRegistrationHandler)
+	group.POST("/webauthn/register/finish", middleware.JWTAuth(false), verifyRegistrationHandler)
+
+	group.GET("/webauthn/login/start", beginLoginHandler)
+	group.POST("/webauthn/login/finish", middleware.RateLimiter(rate.Every(10*time.Second), 5), verifyLoginHandler)
+
+	group.POST("/webauthn/logout", middleware.JWTAuth(false), logoutHandler)
+
+	group.GET("/webauthn/credentials", middleware.JWTAuth(false), listCredentialsHandler)
+	group.PATCH("/webauthn/credentials/:id", middleware.JWTAuth(false), updateCredentialHandler)
+	group.DELETE("/webauthn/credentials/:id", middleware.JWTAuth(false), deleteCredentialHandler)
+}
+
+func beginRegistrationHandler(c *gin.Context) {
+	var user model.User
+	err := common.DB.Preload("Credentials").Find(&user, "id = ?", c.GetString("userID")).Error
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		log.Println(err)
+		return
+	}
+
+	options, session, err := common.WebAuthn.BeginRegistration(&user, webauthn.WithResidentKeyRequirement(protocol.ResidentKeyRequirementRequired), webauthn.WithExclusions(user.WebAuthnCredentialDescriptors()))
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	// Save the webauthn session so we can retrieve it in the verifyRegistrationHandler
+	sessionToStore := &model.WebauthnSession{
+		ExpiresAt:        session.Expires,
+		Challenge:        session.Challenge,
+		UserVerification: string(session.UserVerification),
+	}
+
+	if err = common.DB.Create(&sessionToStore).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.SetCookie("session_id", sessionToStore.ID, int(common.WebAuthn.Config.Timeouts.Registration.Timeout.Seconds()), "/", "", false, true)
+	c.JSON(http.StatusOK, options.Response)
+}
+
+func verifyRegistrationHandler(c *gin.Context) {
+	sessionID, err := c.Cookie("session_id")
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "Session ID missing")
+		return
+	}
+
+	// Retrieve the session that was previously created by the beginRegistrationHandler
+	var storedSession model.WebauthnSession
+	err = common.DB.First(&storedSession, "id = ?", sessionID).Error
+
+	session := webauthn.SessionData{
+		Challenge: storedSession.Challenge,
+		Expires:   storedSession.ExpiresAt,
+		UserID:    []byte(c.GetString("userID")),
+	}
+
+	var user model.User
+	err = common.DB.Find(&user, "id = ?", c.GetString("userID")).Error
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	credential, err := common.WebAuthn.FinishRegistration(&user, session, c.Request)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	credentialToStore := model.WebauthnCredential{
+		Name:            "New Passkey",
+		CredentialID:    string(credential.ID),
+		AttestationType: credential.AttestationType,
+		PublicKey:       credential.PublicKey,
+		Transport:       credential.Transport,
+		UserID:          user.ID,
+	}
+	if err := common.DB.Create(&credentialToStore).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, credentialToStore)
+}
+
+func beginLoginHandler(c *gin.Context) {
+	options, session, err := common.WebAuthn.BeginDiscoverableLogin()
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	// Save the webauthn session so we can retrieve it in the verifyLoginHandler
+	sessionToStore := &model.WebauthnSession{
+		ExpiresAt:        session.Expires,
+		Challenge:        session.Challenge,
+		UserVerification: string(session.UserVerification),
+	}
+
+	if err = common.DB.Create(&sessionToStore).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.SetCookie("session_id", sessionToStore.ID, int(common.WebAuthn.Config.Timeouts.Registration.Timeout.Seconds()), "/", "", false, true)
+	c.JSON(http.StatusOK, options.Response)
+}
+
+func verifyLoginHandler(c *gin.Context) {
+	sessionID, err := c.Cookie("session_id")
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "Session ID missing")
+		return
+	}
+
+	credentialAssertionData, err := protocol.ParseCredentialRequestResponseBody(c.Request.Body)
+	if err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "Invalid body")
+		return
+	}
+
+	// Retrieve the session that was previously created by the beginLoginHandler
+	var storedSession model.WebauthnSession
+	if err := common.DB.First(&storedSession, "id = ?", sessionID).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	session := webauthn.SessionData{
+		Challenge: storedSession.Challenge,
+		Expires:   storedSession.ExpiresAt,
+	}
+
+	var user *model.User
+	_, err = common.WebAuthn.ValidateDiscoverableLogin(func(_, userHandle []byte) (webauthn.User, error) {
+		if err := common.DB.Preload("Credentials").First(&user, "id = ?", string(userHandle)).Error; err != nil {
+			return nil, err
+		}
+		return user, nil
+	}, session, credentialAssertionData)
+
+	if err != nil {
+		if strings.Contains(err.Error(), gorm.ErrRecordNotFound.Error()) {
+			utils.HandlerError(c, http.StatusBadRequest, "no user with this passkey exists")
+		} else {
+			utils.UnknownHandlerError(c, err)
+		}
+		return
+	}
+
+	err = common.DB.Find(&user, "id = ?", c.GetString("userID")).Error
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	token, err := common.GenerateAccessToken(*user)
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.SetCookie("access_token", token, int(time.Hour.Seconds()), "/", "", false, true)
+	c.JSON(http.StatusOK, user)
+}
+
+func listCredentialsHandler(c *gin.Context) {
+	var credentials []model.WebauthnCredential
+	if err := common.DB.Find(&credentials, "user_id = ?", c.GetString("userID")).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, credentials)
+}
+
+func deleteCredentialHandler(c *gin.Context) {
+	var passkeyCount int64
+	if err := common.DB.Model(&model.WebauthnCredential{}).Where("user_id = ?", c.GetString("userID")).Count(&passkeyCount).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	if passkeyCount == 1 {
+		utils.HandlerError(c, http.StatusBadRequest, "You must have at least one passkey")
+		return
+	}
+
+	var credential model.WebauthnCredential
+	if err := common.DB.First(&credential, "id = ? AND user_id = ?", c.Param("id"), c.GetString("userID")).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "Credential not found")
+		return
+	}
+
+	if err := common.DB.Delete(&credential).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func updateCredentialHandler(c *gin.Context) {
+	var credential model.WebauthnCredential
+	if err := common.DB.Where("id = ? AND user_id = ?", c.Param("id"), c.GetString("userID")).First(&credential).Error; err != nil {
+		utils.HandlerError(c, http.StatusNotFound, "Credential not found")
+		return
+	}
+
+	var input struct {
+		Name string `json:"name"`
+	}
+	if err := c.ShouldBindJSON(&input); err != nil {
+		utils.HandlerError(c, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	credential.Name = input.Name
+
+	if err := common.DB.Save(&credential).Error; err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+func logoutHandler(c *gin.Context) {
+	c.SetCookie("access_token", "", 0, "/", "", false, true)
+	c.Status(http.StatusNoContent)
+}
--- a/backend/internal/handler/well_known.go
+++ b/backend/internal/handler/well_known.go
@@ -0,0 +1,39 @@
+package handler
+
+import (
+	"github.com/gin-gonic/gin"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/utils"
+	"net/http"
+)
+
+func RegisterWellKnownRoutes(group *gin.RouterGroup) {
+	group.GET("/.well-known/jwks.json", jwks)
+	group.GET("/.well-known/openid-configuration", openIDConfiguration)
+}
+
+func jwks(c *gin.Context) {
+	jwk, err := common.GetJWK()
+	if err != nil {
+		utils.UnknownHandlerError(c, err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"keys": []interface{}{jwk}})
+}
+
+func openIDConfiguration(c *gin.Context) {
+	appUrl := common.EnvConfig.AppURL
+	config := map[string]interface{}{
+		"issuer":                                appUrl,
+		"authorization_endpoint":                appUrl + "/authorize",
+		"token_endpoint":                        appUrl + "/api/oidc/token",
+		"jwks_uri":                              appUrl + "/.well-known/jwks.json",
+		"scopes_supported":                      []string{"openid", "profile", "email"},
+		"claims_supported":                      []string{"sub", "given_name", "family_name", "email", "preferred_username"},
+		"response_types_supported":              []string{"code", "id_token"},
+		"subject_types_supported":               []string{"public"},
+		"id_token_signing_alg_values_supported": []string{"RS256"},
+	}
+	c.JSON(http.StatusOK, config)
+}
--- a/backend/internal/job/db_cleanup.go
+++ b/backend/internal/job/db_cleanup.go
@@ -0,0 +1,57 @@
+package job
+
+import (
+	"github.com/go-co-op/gocron/v2"
+	"github.com/google/uuid"
+	"golang-rest-api-template/internal/common"
+	"golang-rest-api-template/internal/model"
+	"golang-rest-api-template/internal/utils"
+	"log"
+	"time"
+)
+
+func RegisterJobs() {
+	scheduler, err := gocron.NewScheduler()
+	if err != nil {
+		log.Fatalf("Failed to create a new scheduler: %s", err)
+	}
+
+	registerJob(scheduler, "ClearWebauthnSessions", "0 3 * * *", clearWebauthnSessions)
+	registerJob(scheduler, "ClearOneTimeAccessTokens", "0 3 * * *", clearOneTimeAccessTokens)
+	registerJob(scheduler, "ClearOidcAuthorizationCodes", "0 3 * * *", clearOidcAuthorizationCodes)
+
+	scheduler.Start()
+}
+
+func registerJob(scheduler gocron.Scheduler, name string, interval string, job func() error) {
+
+	_, err := scheduler.NewJob(
+		gocron.CronJob(interval, false),
+		gocron.NewTask(job),
+		gocron.WithEventListeners(
+			gocron.AfterJobRuns(func(jobID uuid.UUID, jobName string) {
+				log.Printf("Job %q run successfully", name)
+			}),
+			gocron.AfterJobRunsWithError(func(jobID uuid.UUID, jobName string, err error) {
+				log.Printf("Job %q failed with error: %v", name, err)
+			}),
+		),
+	)
+
+	if err != nil {
+		log.Fatalf("Failed to register job %q: %v", name, err)
+	}
+}
+
+func clearWebauthnSessions() error {
+	return common.DB.Delete(&model.WebauthnSession{}, "expires_at < ?", utils.FormatDateForDb(time.Now())).Error
+}
+
+func clearOneTimeAccessTokens() error {
+	return common.DB.Debug().Delete(&model.OneTimeAccessToken{}, "expires_at < ?", utils.FormatDateForDb(time.Now())).Error
+}
+
+func clearOidcAuthorizationCodes() error {
+	return common.DB.Delete(&model.OidcAuthorizationCode{}, "expires_at < ?", utils.FormatDateForDb(time.Now())).Error
+
+}
--- a/backend/internal/model/application_configuration.go
+++ b/backend/internal/model/application_configuration.go
@@ -0,0 +1,19 @@
+package model
+
+type ApplicationConfigurationVariable struct {
+	Key        string `gorm:"primaryKey;not null" json:"key"`
+	Type       string `json:"type"`
+	IsPublic   bool   `json:"-"`
+	IsInternal bool   `json:"-"`
+	Value      string `json:"value"`
+}
+
+type ApplicationConfiguration struct {
+	AppName             ApplicationConfigurationVariable
+	BackgroundImageType ApplicationConfigurationVariable
+	LogoImageType       ApplicationConfigurationVariable
+}
+
+type ApplicationConfigurationUpdateDto struct {
+	AppName string `json:"appName" binding:"required"`
+}
--- a/backend/internal/model/base.go
+++ b/backend/internal/model/base.go
@@ -0,0 +1,20 @@
+package model
+
+import (
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+	"time"
+)
+
+// Base contains common columns for all tables.
+type Base struct {
+	ID        string    `gorm:"primaryKey;not null" json:"id"`
+	CreatedAt time.Time `json:"createdAt"`
+}
+
+func (b *Base) BeforeCreate(db *gorm.DB) (err error) {
+	if b.ID == "" {
+		b.ID = uuid.New().String()
+	}
+	return
+}
--- a/backend/internal/model/oidc.go
+++ b/backend/internal/model/oidc.go
@@ -0,0 +1,65 @@
+package model
+
+import (
+	"gorm.io/gorm"
+	"time"
+)
+
+type UserAuthorizedOidcClient struct {
+	Scope  string
+	UserID string `json:"userId" gorm:"primary_key;"`
+
+	ClientID string `json:"clientId" gorm:"primary_key;"`
+	Client   OidcClient
+}
+
+type OidcClient struct {
+	Base
+
+	Name        string  `json:"name"`
+	Secret      string  `json:"-"`
+	CallbackURL string  `json:"callbackURL"`
+	ImageType   *string `json:"-"`
+	HasLogo     bool    `gorm:"-" json:"hasLogo"`
+
+	CreatedByID string
+	CreatedBy   User
+}
+
+func (c *OidcClient) AfterFind(_ *gorm.DB) (err error) {
+	// Compute HasLogo field
+	c.HasLogo = c.ImageType != nil && *c.ImageType != ""
+	return nil
+}
+
+type OidcAuthorizationCode struct {
+	Base
+
+	Code      string
+	Scope     string
+	Nonce     string
+	ExpiresAt time.Time
+
+	UserID string
+	User   User
+
+	ClientID string
+}
+
+type OidcClientCreateDto struct {
+	Name        string `json:"name" binding:"required"`
+	CallbackURL string `json:"callbackURL" binding:"required"`
+}
+
+type AuthorizeNewClientDto struct {
+	ClientID string `json:"clientID" binding:"required"`
+	Scope    string `json:"scope" binding:"required"`
+	Nonce    string `json:"nonce"`
+}
+
+type OidcIdTokenDto struct {
+	GrantType    string `form:"grant_type" binding:"required"`
+	Code         string `form:"code" binding:"required"`
+	ClientID     string `form:"client_id"`
+	ClientSecret string `form:"client_secret"`
+}
--- a/backend/internal/model/user.go
+++ b/backend/internal/model/user.go
@@ -0,0 +1,73 @@
+package model
+
+import (
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+	"time"
+)
+
+type User struct {
+	Base
+
+	Username  string `json:"username"`
+	Email     string `json:"email" `
+	FirstName string `json:"firstName"`
+	LastName  string `json:"lastName"`
+	IsAdmin   bool   `json:"isAdmin"`
+
+	Credentials []WebauthnCredential `json:"-"`
+}
+
+func (u User) WebAuthnID() []byte { return []byte(u.ID) }
+
+func (u User) WebAuthnName() string { return u.Username }
+
+func (u User) WebAuthnDisplayName() string { return u.FirstName + " " + u.LastName }
+
+func (u User) WebAuthnIcon() string { return "" }
+
+func (u User) WebAuthnCredentials() []webauthn.Credential {
+	credentials := make([]webauthn.Credential, len(u.Credentials))
+
+	for i, credential := range u.Credentials {
+		credentials[i] = webauthn.Credential{
+			ID:              []byte(credential.CredentialID),
+			AttestationType: credential.AttestationType,
+			PublicKey:       credential.PublicKey,
+			Transport:       credential.Transport,
+		}
+
+	}
+	return credentials
+}
+
+func (u User) WebAuthnCredentialDescriptors() (descriptors []protocol.CredentialDescriptor) {
+	credentials := u.WebAuthnCredentials()
+
+	descriptors = make([]protocol.CredentialDescriptor, len(credentials))
+
+	for i, credential := range credentials {
+		descriptors[i] = credential.Descriptor()
+	}
+
+	return descriptors
+}
+
+type OneTimeAccessToken struct {
+	Base
+	Token     string    `json:"token"`
+	ExpiresAt time.Time `json:"expiresAt"`
+
+	UserID string `json:"userId"`
+	User   User
+}
+
+type OneTimeAccessTokenCreateDto struct {
+	UserID    string    `json:"userId" binding:"required"`
+	ExpiresAt time.Time `json:"expiresAt" binding:"required"`
+}
+
+type LoginUserDto struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
--- a/backend/internal/model/webauthn.go
+++ b/backend/internal/model/webauthn.go
@@ -0,0 +1,45 @@
+package model
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"errors"
+	"github.com/go-webauthn/webauthn/protocol"
+	"time"
+)
+
+type WebauthnSession struct {
+	Base
+
+	Challenge        string
+	ExpiresAt        time.Time
+	UserVerification string
+}
+
+type WebauthnCredential struct {
+	Base
+
+	Name            string                     `json:"name"`
+	CredentialID    string                     `json:"credentialID"`
+	PublicKey       []byte                     `json:"publicKey"`
+	AttestationType string                     `json:"attestationType"`
+	Transport       AuthenticatorTransportList `json:"-"`
+
+	UserID string
+}
+
+type AuthenticatorTransportList []protocol.AuthenticatorTransport
+
+// Scan and Value methods for GORM to handle the custom type
+func (atl *AuthenticatorTransportList) Scan(value interface{}) error {
+
+	if v, ok := value.([]byte); ok {
+		return json.Unmarshal(v, atl)
+	} else {
+		return errors.New("type assertion to []byte failed")
+	}
+}
+
+func (atl AuthenticatorTransportList) Value() (driver.Value, error) {
+	return json.Marshal(atl)
+}
--- a/backend/internal/utils/file_util.go
+++ b/backend/internal/utils/file_util.go
@@ -0,0 +1,73 @@
+package utils
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func GetFileExtension(filename string) string {
+	splitted := strings.Split(filename, ".")
+	return splitted[len(splitted)-1]
+}
+
+func GetImageMimeType(ext string) string {
+	switch ext {
+	case "jpg", "jpeg":
+		return "image/jpeg"
+	case "png":
+		return "image/png"
+	case "svg":
+		return "image/svg+xml"
+	case "ico":
+		return "image/x-icon"
+	default:
+		return ""
+	}
+}
+
+func CopyDirectory(srcDir, destDir string) error {
+	files, err := os.ReadDir(srcDir)
+	if err != nil {
+		return err
+	}
+
+	for _, file := range files {
+		srcFilePath := filepath.Join(srcDir, file.Name())
+		destFilePath := filepath.Join(destDir, file.Name())
+
+		err := copyFile(srcFilePath, destFilePath)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func copyFile(srcFilePath, destFilePath string) error {
+	srcFile, err := os.Open(srcFilePath)
+	if err != nil {
+		return err
+	}
+	defer srcFile.Close()
+
+	err = os.MkdirAll(filepath.Dir(destFilePath), os.ModePerm)
+	if err != nil {
+		return err
+	}
+
+	destFile, err := os.Create(destFilePath)
+	if err != nil {
+		return err
+	}
+	defer destFile.Close()
+
+	_, err = io.Copy(destFile, srcFile)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
--- a/backend/internal/utils/handler_error_util.go
+++ b/backend/internal/utils/handler_error_util.go
@@ -0,0 +1,19 @@
+package utils
+
+import (
+	"github.com/gin-gonic/gin"
+	"log"
+	"net/http"
+	"strings"
+)
+
+func UnknownHandlerError(c *gin.Context, err error) {
+	log.Println(err)
+	c.JSON(http.StatusInternalServerError, gin.H{"error": "Something went wrong"})
+}
+
+func HandlerError(c *gin.Context, statusCode int, message string) {
+	// Capitalize the first letter of the message
+	message = strings.ToUpper(message[:1]) + message[1:]
+	c.JSON(statusCode, gin.H{"error": message})
+}
--- a/backend/internal/utils/paging_util.go
+++ b/backend/internal/utils/paging_util.go
@@ -0,0 +1,45 @@
+package utils
+
+import (
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+	"strconv"
+)
+
+type PaginationResponse struct {
+	TotalPages  int64 `json:"totalPages"`
+	TotalItems  int64 `json:"totalItems"`
+	CurrentPage int   `json:"currentPage"`
+}
+
+func Paginate(c *gin.Context, db *gorm.DB, result interface{}) (PaginationResponse, error) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+
+	if page < 1 {
+		page = 1
+	}
+
+	if pageSize < 1 {
+		pageSize = 10
+	} else if pageSize > 100 {
+		pageSize = 100
+	}
+
+	offset := (page - 1) * pageSize
+
+	var totalItems int64
+	if err := db.Count(&totalItems).Error; err != nil {
+		return PaginationResponse{}, err
+	}
+
+	if err := db.Offset(offset).Limit(pageSize).Find(result).Error; err != nil {
+		return PaginationResponse{}, err
+	}
+
+	return PaginationResponse{
+		TotalPages:  (totalItems + int64(pageSize) - 1) / int64(pageSize),
+		TotalItems:  totalItems,
+		CurrentPage: page,
+	}, nil
+}
--- a/backend/internal/utils/string_util.go
+++ b/backend/internal/utils/string_util.go
@@ -0,0 +1,43 @@
+package utils
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+	"net/url"
+)
+
+// GenerateRandomAlphanumericString generates a random alphanumeric string of the given length
+func GenerateRandomAlphanumericString(length int) (string, error) {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	const charsetLength = int64(len(charset))
+
+	if length <= 0 {
+		return "", fmt.Errorf("length must be a positive integer")
+	}
+
+	result := make([]byte, length)
+
+	for i := range result {
+		num, err := rand.Int(rand.Reader, big.NewInt(charsetLength))
+		if err != nil {
+			return "", err
+		}
+		result[i] = charset[num.Int64()]
+	}
+
+	return string(result), nil
+}
+
+func GetHostFromURL(rawURL string) string {
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		return ""
+	}
+	return parsedURL.Host
+}
+
+// StringPointer creates a string pointer from a string value
+func StringPointer(s string) *string {
+	return &s
+}
--- a/backend/internal/utils/time_util.go
+++ b/backend/internal/utils/time_util.go
@@ -0,0 +1,8 @@
+package utils
+
+import "time"
+
+func FormatDateForDb(time time.Time) string {
+	const layout = "2006-01-02 15:04:05.000-07:00"
+	return time.Format(layout)
+}
--- a/backend/migrations/20240731203656_init.up.sql
+++ b/backend/migrations/20240731203656_init.up.sql
@@ -0,0 +1,80 @@
+CREATE TABLE users
+(
+    id         TEXT                  NOT NULL PRIMARY KEY,
+    created_at DATETIME,
+    username   TEXT                  NOT NULL UNIQUE,
+    email      TEXT                  NOT NULL UNIQUE,
+    first_name TEXT,
+    last_name  TEXT,
+    is_admin   NUMERIC DEFAULT FALSE NOT NULL
+);
+
+CREATE TABLE oidc_authorization_codes
+(
+    id         TEXT     NOT NULL PRIMARY KEY,
+    created_at DATETIME,
+    code       TEXT     NOT NULL UNIQUE,
+    scope      TEXT     NOT NULL,
+    nonce      TEXT,
+    expires_at DATETIME NOT NULL,
+    user_id    TEXT     NOT NULL REFERENCES users,
+    client_id  TEXT     NOT NULL
+);
+
+CREATE TABLE oidc_clients
+(
+    id            TEXT NOT NULL PRIMARY KEY,
+    created_at    DATETIME,
+    name          TEXT,
+    secret        TEXT,
+    callback_url  TEXT,
+    image_type    TEXT,
+    created_by_id TEXT REFERENCES users
+);
+
+CREATE TABLE one_time_access_tokens
+(
+    id         TEXT     NOT NULL PRIMARY KEY,
+    created_at DATETIME,
+    token      TEXT     NOT NULL UNIQUE,
+    expires_at DATETIME NOT NULL,
+    user_id    TEXT     NOT NULL REFERENCES users
+);
+
+CREATE TABLE user_authorized_oidc_clients
+(
+    scope     TEXT,
+    user_id   TEXT,
+    client_id TEXT REFERENCES oidc_clients,
+    PRIMARY KEY (user_id, client_id)
+);
+
+CREATE TABLE webauthn_credentials
+(
+    id               TEXT NOT NULL PRIMARY KEY,
+    created_at       DATETIME,
+    name             TEXT NOT NULL,
+    credential_id    TEXT NOT NULL UNIQUE,
+    public_key       BLOB NOT NULL,
+    attestation_type TEXT NOT NULL,
+    transport        TEXT NOT NULL,
+    user_id          TEXT REFERENCES users
+);
+
+CREATE TABLE webauthn_sessions
+(
+    id                TEXT     NOT NULL PRIMARY KEY,
+    created_at        DATETIME,
+    challenge         TEXT     NOT NULL UNIQUE,
+    expires_at           DATETIME NOT NULL,
+    user_verification TEXT     NOT NULL
+);
+
+CREATE TABLE application_configuration_variables
+(
+    key         TEXT                  NOT NULL PRIMARY KEY,
+    value       TEXT                  NOT NULL,
+    type        TEXT                  NOT NULL,
+    is_public   NUMERIC DEFAULT FALSE NOT NULL,
+    is_internal NUMERIC DEFAULT FALSE NOT NULL
+);
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,9 @@
+services:
+  pocket-id:
+    image: pocket-id
+    restart: unless-stopped
+    env_file: .env
+    ports:
+      - 3000:80
+    volumes:
+      - "./data:/app/backend/data"
--- a/frontend/.env.example
+++ b/frontend/.env.example
@@ -0,0 +1 @@
+PUBLIC_APP_URL=http://localhost
--- a/frontend/.prettierignore
+++ b/frontend/.prettierignore
@@ -0,0 +1,4 @@
+# Package Managers
+package-lock.json
+pnpm-lock.yaml
+yarn.lock
--- a/frontend/.prettierrc
+++ b/frontend/.prettierrc
@@ -0,0 +1,8 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"trailingComma": "none",
+	"printWidth": 100,
+	"plugins": ["prettier-plugin-svelte", "prettier-plugin-tailwindcss"],
+	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
+}
--- a/frontend/components.json
+++ b/frontend/components.json
@@ -0,0 +1,14 @@
+{
+	"$schema": "https://shadcn-svelte.com/schema.json",
+	"style": "default",
+	"tailwind": {
+		"config": "tailwind.config.ts",
+		"css": "src/app.css",
+		"baseColor": "zinc"
+	},
+	"aliases": {
+		"components": "$lib/components",
+		"utils": "$lib/utils/style"
+	},
+	"typescript": true
+}
--- a/frontend/eslint.config.js
+++ b/frontend/eslint.config.js
@@ -0,0 +1,38 @@
+import js from '@eslint/js';
+import ts from 'typescript-eslint';
+import svelte from 'eslint-plugin-svelte';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+/** @type {import('eslint').Linter.FlatConfig[]} */
+export default [
+	js.configs.recommended,
+	...ts.configs.recommended,
+	...svelte.configs['flat/recommended'],
+	prettier,
+	...svelte.configs['flat/prettier'],
+	{
+		languageOptions: {
+			globals: {
+				...globals.browser,
+				...globals.node
+			}
+		}
+	},
+	{
+		files: ['**/*.svelte'],
+		languageOptions: {
+			parserOptions: {
+				parser: ts.parser
+			}
+		}
+	},
+	{
+		ignores: ['build/', '.svelte-kit/', 'dist/']
+	},
+	{
+		rules: {
+			"@typescript-eslint/no-explicit-any": "off"
+		}
+	}
+];
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -0,0 +1,58 @@
+{
+  "name": "pocket-id-frontend",
+  "version": "0.0.1",
+  "private": true,
+  "scripts": {
+    "dev": "vite dev --port 3000",
+    "build": "vite build",
+    "preview": "vite preview --port 3000",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "lint": "prettier --check . && eslint .",
+    "format": "prettier --write ."
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.46.0",
+    "@sveltejs/adapter-auto": "^3.0.0",
+    "@sveltejs/adapter-node": "^5.2.0",
+    "@sveltejs/kit": "^2.0.0",
+    "@sveltejs/vite-plugin-svelte": "^3.0.0",
+    "@types/eslint": "^8.56.7",
+    "@types/jsonwebtoken": "^9.0.6",
+    "@types/node": "^22.1.0",
+    "autoprefixer": "^10.4.19",
+    "cbor-js": "^0.1.0",
+    "eslint": "^9.0.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-svelte": "^2.36.0",
+    "globals": "^15.0.0",
+    "postcss": "^8.4.38",
+    "prettier": "^3.1.1",
+    "prettier-plugin-svelte": "^3.1.2",
+    "prettier-plugin-tailwindcss": "^0.6.4",
+    "svelte": "^5.0.0-next.1",
+    "svelte-check": "^3.6.0",
+    "tailwindcss": "^3.4.4",
+    "tslib": "^2.4.1",
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.0.0-alpha.20",
+    "vite": "^5.0.3"
+  },
+  "type": "module",
+  "dependencies": {
+    "@simplewebauthn/browser": "^10.0.0",
+    "axios": "^1.7.2",
+    "bits-ui": "^0.21.12",
+    "clsx": "^2.1.1",
+    "crypto": "^1.0.1",
+    "formsnap": "^1.0.1",
+    "jsonwebtoken": "^9.0.2",
+    "lucide-svelte": "^0.399.0",
+    "mode-watcher": "^0.4.1",
+    "svelte-sonner": "^0.3.27",
+    "sveltekit-superforms": "^2.16.1",
+    "tailwind-merge": "^2.3.0",
+    "tailwind-variants": "^0.2.1",
+    "zod": "^3.23.8"
+  }
+}
--- a/frontend/playwright.config.ts
+++ b/frontend/playwright.config.ts
@@ -0,0 +1,30 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * See https://playwright.dev/docs/test-configuration.
+ */
+export default defineConfig({
+	outputDir: './tests/.output',
+	timeout: 10000,
+	testDir: './tests',
+	fullyParallel: false,
+	forbidOnly: !!process.env.CI,
+	retries: process.env.CI ? 1 : 0,
+	workers: 1,
+	reporter: process.env.CI
+		? [['html'], ['github']]
+		: [['line'], ['html', { open: 'never', outputFolder: 'tests/.output' }]],
+	use: {
+		baseURL: 'http://localhost',
+		video: 'retain-on-failure',
+		trace: 'on-first-retry'
+	},
+	projects: [
+		{ name: 'setup', testMatch: /.*\.setup\.ts/ },
+		{
+			name: 'chromium',
+			use: { ...devices['Desktop Chrome'], storageState: 'tests/.auth/user.json' },
+			dependencies: ['setup']
+		}
+	]
+});
--- a/frontend/postcss.config.js
+++ b/frontend/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+	plugins: {
+		tailwindcss: {},
+		autoprefixer: {}
+	}
+};
--- a/frontend/src/app.css
+++ b/frontend/src/app.css
@@ -0,0 +1,112 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+	:root {
+		--background: 0 0% 100%;
+		--foreground: 240 10% 3.9%;
+
+		--muted: 240 4.8% 95.9%;
+		--muted-foreground: 240 3.8% 46.1%;
+
+		--popover: 0 0% 100%;
+		--popover-foreground: 240 10% 3.9%;
+
+		--card: 0 0% 100%;
+		--card-foreground: 240 10% 3.9%;
+
+		--border: 240 5.9% 90%;
+		--input: 240 5.9% 90%;
+
+		--primary: 240 5.9% 10%;
+		--primary-foreground: 0 0% 98%;
+
+		--secondary: 240 4.8% 95.9%;
+		--secondary-foreground: 240 5.9% 10%;
+
+		--accent: 240 4.8% 95.9%;
+		--accent-foreground: 240 5.9% 10%;
+
+		--destructive: 0 72.2% 50.6%;
+		--destructive-foreground: 0 0% 98%;
+
+		--ring: 240 10% 3.9%;
+
+		--radius: 0.5rem;
+	}
+
+	.dark {
+		--background: 240 10% 3.9%;
+		--foreground: 0 0% 98%;
+
+		--muted: 240 3.7% 15.9%;
+		--muted-foreground: 240 5% 64.9%;
+
+		--popover: 240 10% 3.9%;
+		--popover-foreground: 0 0% 98%;
+
+		--card: 240 10% 3.9%;
+		--card-foreground: 0 0% 98%;
+
+		--border: 240 3.7% 15.9%;
+		--input: 240 3.7% 15.9%;
+
+		--primary: 0 0% 98%;
+		--primary-foreground: 240 5.9% 10%;
+
+		--secondary: 240 3.7% 15.9%;
+		--secondary-foreground: 0 0% 98%;
+
+		--accent: 240 3.7% 15.9%;
+		--accent-foreground: 0 0% 98%;
+
+		--destructive: 0 62.8% 30.6%;
+		--destructive-foreground: 0 0% 98%;
+
+		--ring: 240 4.9% 83.9%;
+	}
+}
+
+@layer base {
+	* {
+		@apply border-border;
+	}
+
+	body {
+		@apply bg-background text-foreground;
+	}
+
+	@font-face {
+		font-family: 'Playfair Display';
+		font-weight: 400;
+		src: url('/fonts/PlayfairDisplay-Regular.woff') format('woff');
+	}
+	@font-face {
+		font-family: 'Playfair Display';
+		font-weight: 500;
+		src: url('/fonts/PlayfairDisplay-Medium.woff') format('woff');
+	}
+	@font-face {
+		font-family: 'Playfair Display';
+		font-weight: 600;
+		src: url('/fonts/PlayfairDisplay-SemiBold.woff') format('woff');
+	}
+	@font-face {
+		font-family: 'Playfair Display';
+		font-weight: 700;
+		src: url('/fonts/PlayfairDisplay-Bold.woff') format('woff');
+	}
+}
+@layer components {
+	.application-images-grid {
+		@apply flex flex-wrap justify-between gap-x-5 gap-y-8;
+	}
+
+	@media (max-width: 1127px) {
+		.application-images-grid {
+			justify-content: flex-start;
+			@apply gap-x-20;
+		}
+	}
+}
--- a/frontend/src/app.d.ts
+++ b/frontend/src/app.d.ts
@@ -0,0 +1,16 @@
+// See https://kit.svelte.dev/docs/types#app
+// for information about these interfaces
+declare global {
+	namespace App {
+		interface Error {
+			message: string;
+			status?: number;
+		}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};
--- a/frontend/src/app.html
+++ b/frontend/src/app.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="utf-8" />
+		<link rel="icon" href="/api/application-configuration/favicon" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>
--- a/frontend/src/hooks.server.ts
+++ b/frontend/src/hooks.server.ts
@@ -0,0 +1,61 @@
+import type { Handle, HandleServerError } from '@sveltejs/kit';
+import { AxiosError } from 'axios';
+import jwt from 'jsonwebtoken';
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const accessToken = event.cookies.get('access_token');
+
+	let isSignedIn: boolean = false;
+	let isAdmin: boolean = false;
+
+	if (accessToken) {
+		const jwtPayload = jwt.decode(accessToken, { json: true });
+		if (jwtPayload?.exp && jwtPayload.exp * 1000 > Date.now()) {
+			isSignedIn = true;
+			isAdmin = jwtPayload?.isAdmin || false;
+		}
+	}
+
+	if (event.url.pathname.startsWith('/settings') && !event.url.pathname.startsWith('/login')) {
+		if (!isSignedIn) {
+			return new Response(null, {
+				status: 302,
+				headers: { location: '/login' }
+			});
+		}
+	}
+
+	if (event.url.pathname.startsWith('/login') && isSignedIn) {
+		return new Response(null, {
+			status: 302,
+			headers: { location: '/settings' }
+		});
+	}
+
+	if (event.url.pathname.startsWith('/settings/admin') && !isAdmin) {
+		return new Response(null, {
+			status: 302,
+			headers: { location: '/settings' }
+		});
+	}
+
+	const response = await resolve(event);
+	return response;
+};
+
+export const handleError: HandleServerError = async ({ error, message, status }) => {
+	if (error instanceof AxiosError) {
+		message = error.response?.data.error || message;
+		status = error.response?.status || status;
+		console.error(
+			`Axios error: ${error.request.path} - ${error.response?.data.error ?? error.message}`
+		);
+	} else {
+		console.error(error);
+	}
+
+	return {
+		message,
+		status
+	};
+};
--- a/frontend/src/lib/components/confirm-dialog/confirm-dialog.svelte
+++ b/frontend/src/lib/components/confirm-dialog/confirm-dialog.svelte
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import * as AlertDialog from '$lib/components/ui/alert-dialog';
+	import { confirmDialogStore } from '.';
+	import Button from '../ui/button/button.svelte';
+</script>
+
+<AlertDialog.Root bind:open={$confirmDialogStore.open}>
+	<AlertDialog.Content>
+		<AlertDialog.Header>
+			<AlertDialog.Title>{$confirmDialogStore.title}</AlertDialog.Title>
+			<AlertDialog.Description>
+				{$confirmDialogStore.message}
+			</AlertDialog.Description>
+		</AlertDialog.Header>
+		<AlertDialog.Footer>
+			<AlertDialog.Cancel>Cancel</AlertDialog.Cancel>
+			<AlertDialog.Action asChild>
+				<Button
+					variant={$confirmDialogStore.confirm.destructive ? 'destructive' : 'default'}
+					on:click={() => {
+						$confirmDialogStore.confirm.action();
+						$confirmDialogStore.open = false;
+					}}
+				>
+					{$confirmDialogStore.confirm.label}
+				</Button>
+			</AlertDialog.Action>
+		</AlertDialog.Footer>
+	</AlertDialog.Content>
+</AlertDialog.Root>
--- a/frontend/src/lib/components/confirm-dialog/index.ts
+++ b/frontend/src/lib/components/confirm-dialog/index.ts
@@ -0,0 +1,39 @@
+import { writable } from 'svelte/store';
+import ConfirmDialog from './confirm-dialog.svelte';
+
+export const confirmDialogStore = writable({
+	open: false,
+	title: '',
+	message: '',
+	confirm: {
+		label: 'Confirm',
+		destructive: false,
+		action: () => {}
+	}
+});
+
+function openConfirmDialog({
+	title,
+	message,
+	confirm
+}: {
+	title: string;
+	message: string;
+	confirm: {
+		label?: string;
+		destructive?: boolean;
+		action: () => void;
+	};
+}) {
+	confirmDialogStore.update((val) => ({
+		open: true,
+		title,
+		message,
+		confirm: {
+			...val.confirm,
+			...confirm
+		}
+	}));
+}
+
+export { ConfirmDialog, openConfirmDialog };
--- a/frontend/src/lib/components/error.svelte
+++ b/frontend/src/lib/components/error.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+	import { Button } from '$lib/components/ui/button';
+	import { LucideXCircle } from 'lucide-svelte';
+
+	let { message, showButton = true }: { message: string; showButton?: boolean } = $props();
+</script>
+
+<div class="mt-[20%] flex flex-col items-center">
+	<LucideXCircle class="text-muted-foreground h-12 w-12" />
+	<h1 class="mt-3 text-2xl font-semibold">Something went wrong</h1>
+	<p class="text-muted-foreground">{message}</p>
+	{#if showButton}
+		<Button size="sm" class="mt-5" href="/">Go back to home</Button>
+	{/if}
+</div>
--- a/frontend/src/lib/components/file-input.svelte
+++ b/frontend/src/lib/components/file-input.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { cn } from '$lib/utils/style';
+	import type { HTMLInputAttributes } from 'svelte/elements';
+	import type { VariantProps } from 'tailwind-variants';
+	import type { buttonVariants } from './ui/button';
+
+	let {
+		id,
+		...restProps
+	}: HTMLInputAttributes & {
+		id: string;
+		variant?: VariantProps<typeof buttonVariants>['variant'];
+	} = $props();
+</script>
+
+<button
+	type="button"
+	onclick={() => document.getElementById(id)?.click()}
+	class={cn(restProps.class)}
+>
+	{#if restProps.children}
+		{@render restProps.children()}
+	{:else}
+		Select File
+	{/if}
+</button>
+<input {id} {...restProps} type="file" class="hidden" />
--- a/frontend/src/lib/components/form-input.svelte
+++ b/frontend/src/lib/components/form-input.svelte
@@ -0,0 +1,30 @@
+<script lang="ts">
+	import { Label } from '$lib/components/ui/label';
+	import type { FormInput } from '$lib/utils/form-util';
+	import type { Snippet } from 'svelte';
+	import { Input } from './ui/input';
+
+	let {
+		input = $bindable(),
+		label,
+		children
+	}: {
+		input: FormInput<string | boolean | number>;
+		label: string;
+		children?: Snippet;
+	} = $props();
+
+	const id = label.toLowerCase().replace(/ /g, '-');
+</script>
+
+<div>
+	<Label for={id}>{label}</Label>
+	{#if children}
+		{@render children()}
+	{:else}
+		<Input {id} bind:value={input.value} />
+	{/if}
+	{#if input.error}
+		<p class="text-sm text-red-500">{input.error}</p>
+	{/if}
+</div>
--- a/frontend/src/lib/components/header/header-avatar.svelte
+++ b/frontend/src/lib/components/header/header-avatar.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+	import { goto } from '$app/navigation';
+	import * as Avatar from '$lib/components/ui/avatar';
+	import * as DropdownMenu from '$lib/components/ui/dropdown-menu';
+	import WebAuthnService from '$lib/services/webauthn-service';
+	import userStore from '$lib/stores/user-store';
+	import { LucideLogOut, LucideUser } from 'lucide-svelte';
+
+	const webauthnService = new WebAuthnService();
+
+	let initials = $derived(
+		($userStore!.firstName.charAt(0) + $userStore!.lastName?.charAt(0)).toUpperCase()
+	);
+
+	function logout() {
+		webauthnService.logout();
+		window.location.reload();
+	}
+</script>
+
+<DropdownMenu.Root>
+	<DropdownMenu.Trigger
+		><Avatar.Root>
+			<Avatar.Fallback>{initials}</Avatar.Fallback>
+		</Avatar.Root></DropdownMenu.Trigger
+	>
+	<DropdownMenu.Content class="w-40" align="start">
+		<DropdownMenu.Label class="font-normal">
+			<div class="flex flex-col space-y-1">
+				<p class="text-sm font-medium leading-none">
+					{$userStore?.firstName}
+					{$userStore?.lastName}
+				</p>
+				<p class="text-xs leading-none text-muted-foreground">{$userStore?.email}</p>
+			</div>
+		</DropdownMenu.Label>
+		<DropdownMenu.Separator />
+		<DropdownMenu.Group>
+			<DropdownMenu.Item href="/settings/account"
+				><LucideUser class="mr-2 h-4 w-4" /> My Account</DropdownMenu.Item
+			>
+			<DropdownMenu.Item on:click={logout}
+				><LucideLogOut class="mr-2 h-4 w-4" /> Logout</DropdownMenu.Item
+			>
+		</DropdownMenu.Group>
+	</DropdownMenu.Content>
+</DropdownMenu.Root>
--- a/frontend/src/lib/components/header/header.svelte
+++ b/frontend/src/lib/components/header/header.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+	import { page } from '$app/stores';
+	import applicationConfigurationStore from '$lib/stores/application-configuration-store';
+	import userStore from '$lib/stores/user-store';
+	import Logo from '../logo.svelte';
+	import HeaderAvatar from './header-avatar.svelte';
+
+	let isAuthPage = $derived(
+		!$page.error && ($page.url.pathname.startsWith('/authorize') || $page.url.pathname.startsWith('/login'))
+	);
+</script>
+
+<div class=" w-full {isAuthPage ? 'absolute top-0 z-10 mt-4' : 'border-b'}">
+	<div class="mx-auto flex w-full max-w-[1520px] items-center justify-between px-4 md:px-10">
+		<div class="flex h-16 items-center">
+			{#if !isAuthPage}
+				<Logo class="mr-3 h-10 w-10" />
+				<h1 class="text-lg font-medium" data-testid="application-name">
+					{$applicationConfigurationStore.appName}
+				</h1>
+			{/if}
+		</div>
+		{#if $userStore?.id}
+			<HeaderAvatar />
+		{/if}
+	</div>
+</div>
--- a/frontend/src/lib/components/login-wrapper.svelte
+++ b/frontend/src/lib/components/login-wrapper.svelte
@@ -0,0 +1,42 @@
+<script lang="ts">
+	import { browser } from '$app/environment';
+	import { browserSupportsWebAuthn } from '@simplewebauthn/browser';
+	import type { Snippet } from 'svelte';
+	import * as Card from './ui/card';
+	import WebAuthnUnsupported from './web-authn-unsupported.svelte';
+
+	let {
+		children
+	}: {
+		children: Snippet;
+	} = $props();
+</script>
+
+<div class="hidden h-screen items-center text-center lg:flex">
+	<div class="min-w-[650px] p-16">
+		{#if browser && !browserSupportsWebAuthn()}
+			<WebAuthnUnsupported />
+		{:else}
+			{@render children()}
+		{/if}
+	</div>
+	<img
+		src="/images/sign-in.jpg"
+		class="h-screen w-[calc(100vw-650px)] rounded-l-[60px] object-cover"
+		alt="Login background"
+	/>
+</div>
+
+<div
+	class="flex h-screen items-center justify-center bg-[url('/images/sign-in.jpg')] bg-cover bg-center text-center lg:hidden"
+>
+	<Card.Root class="mx-3">
+		<Card.CardContent class="px-4 py-10 sm:p-10">
+			{#if browser && !browserSupportsWebAuthn()}
+				<WebAuthnUnsupported />
+			{:else}
+				{@render children()}
+			{/if}
+		</Card.CardContent>
+	</Card.Root>
+</div>
--- a/frontend/src/lib/components/logo.svelte
+++ b/frontend/src/lib/components/logo.svelte
@@ -0,0 +1 @@
+<img class={$$restProps.class} src="/api/application-configuration/logo" alt="Logo" />
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-action.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-action.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import { buttonVariants } from "$lib/components/ui/button/index.js";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.ActionProps;
+	type $$Events = AlertDialogPrimitive.ActionEvents;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<AlertDialogPrimitive.Action
+	class={cn(buttonVariants(), className)}
+	{...$$restProps}
+	on:click
+	on:keydown
+	let:builder
+>
+	<slot {builder} />
+</AlertDialogPrimitive.Action>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-cancel.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-cancel.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import { buttonVariants } from "$lib/components/ui/button/index.js";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.CancelProps;
+	type $$Events = AlertDialogPrimitive.CancelEvents;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<AlertDialogPrimitive.Cancel
+	class={cn(buttonVariants({ variant: "outline" }), "mt-2 sm:mt-0", className)}
+	{...$$restProps}
+	on:click
+	on:keydown
+	let:builder
+>
+	<slot {builder} />
+</AlertDialogPrimitive.Cancel>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-content.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-content.svelte
@@ -0,0 +1,28 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import * as AlertDialog from "./index.js";
+	import { cn, flyAndScale } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.ContentProps;
+
+	export let transition: $$Props["transition"] = flyAndScale;
+	export let transitionConfig: $$Props["transitionConfig"] = undefined;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<AlertDialog.Portal>
+	<AlertDialog.Overlay />
+	<AlertDialogPrimitive.Content
+		{transition}
+		{transitionConfig}
+		class={cn(
+			"bg-background fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border p-6 shadow-lg sm:rounded-lg md:w-full",
+			className
+		)}
+		{...$$restProps}
+	>
+		<slot />
+	</AlertDialogPrimitive.Content>
+</AlertDialog.Portal>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-description.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-description.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.DescriptionProps;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<AlertDialogPrimitive.Description
+	class={cn("text-muted-foreground text-sm", className)}
+	{...$$restProps}
+>
+	<slot />
+</AlertDialogPrimitive.Description>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-footer.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-footer.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div
+	class={cn("flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2", className)}
+	{...$$restProps}
+>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-header.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-header.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div class={cn("flex flex-col space-y-2 text-center sm:text-left", className)} {...$$restProps}>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-overlay.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-overlay.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import { fade } from "svelte/transition";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.OverlayProps;
+
+	let className: $$Props["class"] = undefined;
+	export let transition: $$Props["transition"] = fade;
+	export let transitionConfig: $$Props["transitionConfig"] = {
+		duration: 150,
+	};
+	export { className as class };
+</script>
+
+<AlertDialogPrimitive.Overlay
+	{transition}
+	{transitionConfig}
+	class={cn("bg-background/80 fixed inset-0 z-50 backdrop-blur-sm ", className)}
+	{...$$restProps}
+/>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-portal.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-portal.svelte
@@ -0,0 +1,9 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+
+	type $$Props = AlertDialogPrimitive.PortalProps;
+</script>
+
+<AlertDialogPrimitive.Portal {...$$restProps}>
+	<slot />
+</AlertDialogPrimitive.Portal>
--- a/frontend/src/lib/components/ui/alert-dialog/alert-dialog-title.svelte
+++ b/frontend/src/lib/components/ui/alert-dialog/alert-dialog-title.svelte
@@ -0,0 +1,14 @@
+<script lang="ts">
+	import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AlertDialogPrimitive.TitleProps;
+
+	let className: $$Props["class"] = undefined;
+	export let level: $$Props["level"] = "h3";
+	export { className as class };
+</script>
+
+<AlertDialogPrimitive.Title class={cn("text-lg font-semibold", className)} {level} {...$$restProps}>
+	<slot />
+</AlertDialogPrimitive.Title>
--- a/frontend/src/lib/components/ui/alert-dialog/index.ts
+++ b/frontend/src/lib/components/ui/alert-dialog/index.ts
@@ -0,0 +1,40 @@
+import { AlertDialog as AlertDialogPrimitive } from "bits-ui";
+
+import Title from "./alert-dialog-title.svelte";
+import Action from "./alert-dialog-action.svelte";
+import Cancel from "./alert-dialog-cancel.svelte";
+import Portal from "./alert-dialog-portal.svelte";
+import Footer from "./alert-dialog-footer.svelte";
+import Header from "./alert-dialog-header.svelte";
+import Overlay from "./alert-dialog-overlay.svelte";
+import Content from "./alert-dialog-content.svelte";
+import Description from "./alert-dialog-description.svelte";
+
+const Root = AlertDialogPrimitive.Root;
+const Trigger = AlertDialogPrimitive.Trigger;
+
+export {
+	Root,
+	Title,
+	Action,
+	Cancel,
+	Portal,
+	Footer,
+	Header,
+	Trigger,
+	Overlay,
+	Content,
+	Description,
+	//
+	Root as AlertDialog,
+	Title as AlertDialogTitle,
+	Action as AlertDialogAction,
+	Cancel as AlertDialogCancel,
+	Portal as AlertDialogPortal,
+	Footer as AlertDialogFooter,
+	Header as AlertDialogHeader,
+	Trigger as AlertDialogTrigger,
+	Overlay as AlertDialogOverlay,
+	Content as AlertDialogContent,
+	Description as AlertDialogDescription,
+};
--- a/frontend/src/lib/components/ui/avatar/avatar-fallback.svelte
+++ b/frontend/src/lib/components/ui/avatar/avatar-fallback.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+	import { Avatar as AvatarPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AvatarPrimitive.FallbackProps;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<AvatarPrimitive.Fallback
+	class={cn("bg-muted flex h-full w-full items-center justify-center rounded-full", className)}
+	{...$$restProps}
+>
+	<slot />
+</AvatarPrimitive.Fallback>
--- a/frontend/src/lib/components/ui/avatar/avatar-image.svelte
+++ b/frontend/src/lib/components/ui/avatar/avatar-image.svelte
@@ -0,0 +1,18 @@
+<script lang="ts">
+	import { Avatar as AvatarPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AvatarPrimitive.ImageProps;
+
+	let className: $$Props["class"] = undefined;
+	export let src: $$Props["src"] = undefined;
+	export let alt: $$Props["alt"] = undefined;
+	export { className as class };
+</script>
+
+<AvatarPrimitive.Image
+	{src}
+	{alt}
+	class={cn("aspect-square h-full w-full", className)}
+	{...$$restProps}
+/>
--- a/frontend/src/lib/components/ui/avatar/avatar.svelte
+++ b/frontend/src/lib/components/ui/avatar/avatar.svelte
@@ -0,0 +1,18 @@
+<script lang="ts">
+	import { Avatar as AvatarPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = AvatarPrimitive.Props;
+
+	let className: $$Props["class"] = undefined;
+	export let delayMs: $$Props["delayMs"] = undefined;
+	export { className as class };
+</script>
+
+<AvatarPrimitive.Root
+	{delayMs}
+	class={cn("relative flex h-10 w-10 shrink-0 overflow-hidden rounded-full", className)}
+	{...$$restProps}
+>
+	<slot />
+</AvatarPrimitive.Root>
--- a/frontend/src/lib/components/ui/avatar/index.ts
+++ b/frontend/src/lib/components/ui/avatar/index.ts
@@ -0,0 +1,13 @@
+import Root from "./avatar.svelte";
+import Image from "./avatar-image.svelte";
+import Fallback from "./avatar-fallback.svelte";
+
+export {
+	Root,
+	Image,
+	Fallback,
+	//
+	Root as Avatar,
+	Image as AvatarImage,
+	Fallback as AvatarFallback,
+};
--- a/frontend/src/lib/components/ui/badge/badge.svelte
+++ b/frontend/src/lib/components/ui/badge/badge.svelte
@@ -0,0 +1,18 @@
+<script lang="ts">
+	import { type Variant, badgeVariants } from "./index.js";
+	import { cn } from "$lib/utils/style.js";
+
+	let className: string | undefined | null = undefined;
+	export let href: string | undefined = undefined;
+	export let variant: Variant = "default";
+	export { className as class };
+</script>
+
+<svelte:element
+	this={href ? "a" : "span"}
+	{href}
+	class={cn(badgeVariants({ variant, className }))}
+	{...$$restProps}
+>
+	<slot />
+</svelte:element>
--- a/frontend/src/lib/components/ui/badge/index.ts
+++ b/frontend/src/lib/components/ui/badge/index.ts
@@ -0,0 +1,21 @@
+import { type VariantProps, tv } from "tailwind-variants";
+export { default as Badge } from "./badge.svelte";
+
+export const badgeVariants = tv({
+	base: "inline-flex select-none items-center rounded-full border px-2.5 py-0.5 text-xs font-semibold transition-colors focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2",
+	variants: {
+		variant: {
+			default: "border-transparent bg-primary text-primary-foreground hover:bg-primary/80",
+			secondary:
+				"border-transparent bg-secondary text-secondary-foreground hover:bg-secondary/80",
+			destructive:
+				"border-transparent bg-destructive text-destructive-foreground hover:bg-destructive/80",
+			outline: "text-foreground",
+		},
+	},
+	defaultVariants: {
+		variant: "default",
+	},
+});
+
+export type Variant = VariantProps<typeof badgeVariants>["variant"];
--- a/frontend/src/lib/components/ui/button/button.svelte
+++ b/frontend/src/lib/components/ui/button/button.svelte
@@ -0,0 +1,32 @@
+<script lang="ts">
+	import { cn } from '$lib/utils/style.js';
+	import { Button as ButtonPrimitive } from 'bits-ui';
+	import LoaderCircle from 'lucide-svelte/icons/loader-circle';
+	import { type Events, type Props, buttonVariants } from './index.js';
+
+	type $$Props = Props;
+	type $$Events = Events;
+
+	let className: $$Props['class'] = undefined;
+	export let variant: $$Props['variant'] = 'default';
+	export let size: $$Props['size'] = 'default';
+	export let disabled: boolean | undefined | null = false;
+	export let isLoading: $$Props['isLoading'] = false;
+	export let builders: $$Props['builders'] = [];
+	export { className as class };
+</script>
+
+<ButtonPrimitive.Root
+	{builders}
+	disabled={isLoading || disabled}
+	class={cn(buttonVariants({ variant, size, className }))}
+	type="button"
+	{...$$restProps}
+	on:click
+	on:keydown
+>
+	{#if isLoading}
+		<LoaderCircle class="mr-2 h-4 w-4 animate-spin" />
+	{/if}
+	<slot />
+</ButtonPrimitive.Root>
--- a/frontend/src/lib/components/ui/button/index.ts
+++ b/frontend/src/lib/components/ui/button/index.ts
@@ -0,0 +1,50 @@
+import { type VariantProps, tv } from "tailwind-variants";
+import type { Button as ButtonPrimitive } from "bits-ui";
+import Root from "./button.svelte";
+
+const buttonVariants = tv({
+	base: "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+	variants: {
+		variant: {
+			default: "bg-primary text-primary-foreground hover:bg-primary/90",
+			destructive: "bg-destructive text-destructive-foreground hover:bg-destructive/90",
+			outline:
+				"border border-input bg-background hover:bg-accent hover:text-accent-foreground",
+			secondary: "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+			ghost: "hover:bg-accent hover:text-accent-foreground",
+			link: "text-primary underline-offset-4 hover:underline",
+		},
+		size: {
+			default: "h-10 px-4 py-2",
+			sm: "h-9 rounded-md px-3",
+			lg: "h-11 rounded-md px-8",
+			icon: "h-10 w-10",
+		},
+	},
+	defaultVariants: {
+		variant: "default",
+		size: "default",
+	},
+});
+
+type Variant = VariantProps<typeof buttonVariants>["variant"];
+type Size = VariantProps<typeof buttonVariants>["size"];
+
+type Props = ButtonPrimitive.Props & {
+	variant?: Variant;
+	size?: Size;
+	isLoading?: boolean;
+};
+
+type Events = ButtonPrimitive.Events;
+
+export {
+	Root,
+	type Props,
+	type Events,
+	//
+	Root as Button,
+	type Props as ButtonProps,
+	type Events as ButtonEvents,
+	buttonVariants,
+};
--- a/frontend/src/lib/components/ui/card/card-content.svelte
+++ b/frontend/src/lib/components/ui/card/card-content.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div class={cn("p-6 pt-0", className)} {...$$restProps}>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/card/card-description.svelte
+++ b/frontend/src/lib/components/ui/card/card-description.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLParagraphElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<p class={cn("text-sm text-muted-foreground", className)} {...$$restProps}>
+	<slot />
+</p>
--- a/frontend/src/lib/components/ui/card/card-footer.svelte
+++ b/frontend/src/lib/components/ui/card/card-footer.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div class={cn("flex items-center p-6 pt-0", className)} {...$$restProps}>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/card/card-header.svelte
+++ b/frontend/src/lib/components/ui/card/card-header.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div class={cn("flex flex-col space-y-1.5 p-6", className)} {...$$restProps}>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/card/card-title.svelte
+++ b/frontend/src/lib/components/ui/card/card-title.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import type { HeadingLevel } from "./index.js";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLHeadingElement> & {
+		tag?: HeadingLevel;
+	};
+
+	let className: $$Props["class"] = undefined;
+	export let tag: $$Props["tag"] = "h3";
+	export { className as class };
+</script>
+
+<svelte:element
+	this={tag}
+	class={cn("text-xl font-semibold leading-none tracking-tight", className)}
+	{...$$restProps}
+>
+	<slot />
+</svelte:element>
--- a/frontend/src/lib/components/ui/card/card.svelte
+++ b/frontend/src/lib/components/ui/card/card.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn } from "$lib/utils/style.js";
+
+	type $$Props = HTMLAttributes<HTMLDivElement>;
+
+	let className: $$Props["class"] = undefined;
+	export { className as class };
+</script>
+
+<div
+	class={cn("rounded-lg border bg-card text-card-foreground shadow-sm", className)}
+	{...$$restProps}
+>
+	<slot />
+</div>
--- a/frontend/src/lib/components/ui/card/index.ts
+++ b/frontend/src/lib/components/ui/card/index.ts
@@ -0,0 +1,24 @@
+import Root from "./card.svelte";
+import Content from "./card-content.svelte";
+import Description from "./card-description.svelte";
+import Footer from "./card-footer.svelte";
+import Header from "./card-header.svelte";
+import Title from "./card-title.svelte";
+
+export {
+	Root,
+	Content,
+	Description,
+	Footer,
+	Header,
+	Title,
+	//
+	Root as Card,
+	Content as CardContent,
+	Description as CardDescription,
+	Footer as CardFooter,
+	Header as CardHeader,
+	Title as CardTitle,
+};
+
+export type HeadingLevel = "h1" | "h2" | "h3" | "h4" | "h5" | "h6";
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`<img class={$$restProps.class} src="/api/application-configuration/logo" alt="Logo" />`