[Web][Backend] EN/TR i18n (consolidated): backend lang preference + error localization + full web translation sweep

backend/src/main/java/com/bounswe2026group1/backend/config/I18nConfig.java

@@ -0,0 +1,48 @@
+package com.bounswe2026group1.backend.config;
+
+import org.springframework.context.MessageSource;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.support.ResourceBundleMessageSource;
+import org.springframework.web.servlet.LocaleResolver;
+import org.springframework.web.servlet.i18n.AcceptHeaderLocaleResolver;
+
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * Wires Spring's message-source + locale-resolver so user-facing error
+ * strings produced by services (e.g. {@code RegisteredUserService}) can be
+ * resolved against the caller's locale.
+ *
+ * Locale resolution: read {@code Accept-Language} header, default to English
+ * when missing or unsupported. Supported list is kept narrow (en, tr) so an
+ * unrecognised header doesn't surprise the user with another fallback.
+ *
+ * Note: an authenticated user's persisted {@code preferredLanguage} (#505)
+ * is currently honoured by clients sending the right {@code Accept-Language}
+ * header. If we ever want server-side resolution against the DB column, this
+ * is the spot to plug in a custom {@code LocaleResolver}.
+ */
+@Configuration
+public class I18nConfig {
+
+    @Bean
+    public MessageSource messageSource() {
+        ResourceBundleMessageSource source = new ResourceBundleMessageSource();
+        source.setBasename("messages");
+        source.setDefaultEncoding("UTF-8");
+        // Fall back through messages_xx -> messages.properties before failing,
+        // so a missing TR key returns the EN string rather than raising.
+        source.setFallbackToSystemLocale(false);
+        return source;
+    }
+
+    @Bean
+    public LocaleResolver localeResolver() {
+        AcceptHeaderLocaleResolver resolver = new AcceptHeaderLocaleResolver();
+        resolver.setSupportedLocales(List.of(Locale.ENGLISH, Locale.forLanguageTag("tr")));
+        resolver.setDefaultLocale(Locale.ENGLISH);
+        return resolver;
+    }
+}

backend/src/main/java/com/bounswe2026group1/backend/controller/RegisteredUserController.java

@@ -168,6 +168,33 @@ public ResponseEntity<Object> updateProfile(@PathVariable Long id,
         }
     }
 
+    @PutMapping("/{id}/profile/language")
+    @Operation(
+            summary = "Update the authenticated user's UI language preference",
+            description = "Sets the caller's preferred language (EN or TR). The path id must match the caller's id."
+    )
+    @ApiResponses({
+            @ApiResponse(responseCode = "200", description = "Updated profile (self-view, includes preferredLanguage)."),
+            @ApiResponse(responseCode = "400", description = "Unknown or blank language value."),
+            @ApiResponse(responseCode = "401", description = "Authentication required."),
+            @ApiResponse(responseCode = "403", description = "Path id does not match the caller."),
+            @ApiResponse(responseCode = "404", description = "No user with that id.")
+    })
+    @SecurityRequirement(name = OpenApiConfig.BEARER_SCHEME)
+    public ResponseEntity<Object> updateLanguage(@PathVariable Long id,
+                                                 @RequestBody @Valid com.bounswe2026group1.backend.dto.UpdateLanguageRequest request) {
+        try {
+            requireOwner(id);
+            return ResponseEntity.ok(registeredUserService.updateLanguage(id, request));
+        } catch (AccessDeniedException e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).body(e.getMessage());
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.badRequest().body(e.getMessage());
+        } catch (NoSuchElementException e) {
+            return ResponseEntity.status(HttpStatus.NOT_FOUND).body(e.getMessage());
+        }
+    }
+
     @PostMapping(value = "/{id}/profile/avatar", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
             summary = "Upload a new avatar for the authenticated user",

backend/src/main/java/com/bounswe2026group1/backend/dto/UpdateLanguageRequest.java

@@ -0,0 +1,19 @@
+package com.bounswe2026group1.backend.dto;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.constraints.NotBlank;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+@Schema(description = "Set the caller's UI language preference.")
+public class UpdateLanguageRequest {
+
+    @Schema(description = "Language code matching the Language enum.",
+            example = "TR", allowableValues = {"EN", "TR"})
+    @NotBlank(message = "Language must not be blank")
+    private String language;
+}

backend/src/main/java/com/bounswe2026group1/backend/dto/UserProfileDTO.java

@@ -62,6 +62,10 @@ public class UserProfileDTO {
             example = "false")
     private boolean leaderboardHidden;
 
+    @Schema(description = "Preferred UI language. Null on public profile lookups; populated on self-views.",
+            example = "EN", allowableValues = {"EN", "TR"}, nullable = true)
+    private String preferredLanguage;
+
     @Data
     @Builder
     @NoArgsConstructor

backend/src/main/java/com/bounswe2026group1/backend/model/Language.java

@@ -0,0 +1,10 @@
+package com.bounswe2026group1.backend.model;
+
+/**
+ * UI language preference persisted on {@link RegisteredUser}. New users
+ * default to {@link #EN}; clients send the wire form as the enum name
+ * ("EN" / "TR") in {@code UpdateLanguageRequest}.
+ */
+public enum Language {
+    EN, TR
+}

backend/src/main/java/com/bounswe2026group1/backend/model/RegisteredUser.java

@@ -121,6 +121,16 @@ public class RegisteredUser {
             columnDefinition = "BOOLEAN DEFAULT FALSE")
     private boolean leaderboardHidden = false;
 
+    /**
+     * UI language preference. Web and mobile read this on login so the
+     * choice survives a fresh session on another device. Declared last to
+     * keep the Lombok all-args constructor backwards-compatible.
+     */
+    @Enumerated(EnumType.STRING)
+    @Column(name = "preferred_language", nullable = false, length = 8,
+            columnDefinition = "VARCHAR(8) DEFAULT 'EN'")
+    private Language preferredLanguage = Language.EN;
+
     @PrePersist
     protected void onCreate() {
         if (this.registeredAt == null) {
@@ -135,5 +145,8 @@ protected void onCreate() {
         if (this.routingConstraints == null) {
             this.routingConstraints = new HashSet<>();
         }
+        if (this.preferredLanguage == null) {
+            this.preferredLanguage = Language.EN;
+        }
     }
 }

backend/src/main/java/com/bounswe2026group1/backend/service/RegisteredUserService.java

@@ -17,6 +17,8 @@
 import com.bounswe2026group1.backend.repository.UserBadgeRepository;
 import com.bounswe2026group1.backend.util.JwtUtil;
 import lombok.RequiredArgsConstructor;
+import org.springframework.context.MessageSource;
+import org.springframework.context.i18n.LocaleContextHolder;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -43,20 +45,26 @@ public class RegisteredUserService {
     private final LeaderboardService leaderboardService;
     private final PasswordEncoder passwordEncoder;
     private final JwtUtil jwtUtil;
+    private final MessageSource messageSource;
 
     // Password strength regex pattern: Minimum 8 characters, at least one uppercase letter, one lowercase letter, one digit and one special character
     private static final String PASSWORD_PATTERN = "^(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=!]).{8,}$";
 
+    /** Resolve an i18n message against the request's locale (see {@link com.bounswe2026group1.backend.config.I18nConfig}). */
+    private String msg(String code, Object... args) {
+        return messageSource.getMessage(code, args, LocaleContextHolder.getLocale());
+    }
+
 
     public RegisterResponse registerUser(RegisterRequest request) {
         // 1. Check Uniqueness
         if (registeredUserRepository.existsByEmail(request.getEmail())) {
-            throw new IllegalArgumentException("Email is already in use.");
+            throw new IllegalArgumentException(msg("error.email.alreadyInUse"));
         }
 
         // 2. Password strength validation
         if (!request.getPassword().matches(PASSWORD_PATTERN)) {
-            throw new IllegalArgumentException("Password must be at least 8 characters long, and include an uppercase letter, a lowercase letter, a digit, and a special character.");
+            throw new IllegalArgumentException(msg("error.password.weak"));
         }
 
         // 3. User Entity Conversion & Password Hashing
@@ -82,11 +90,11 @@ public RegisterResponse registerUser(RegisterRequest request) {
     public LoginResponse loginUser(LoginRequest request) {
         // 1. Find user by email
         RegisteredUser user = registeredUserRepository.findByEmail(request.getEmail())
-                .orElseThrow(() -> new BadCredentialsException("Invalid email or password"));
+                .orElseThrow(() -> new BadCredentialsException(msg("error.auth.invalidCredentials")));
 
         // 2. Check password
         if (!passwordEncoder.matches(request.getPassword(), user.getPassword())) {
-            throw new BadCredentialsException("Invalid email or password");
+            throw new BadCredentialsException(msg("error.auth.invalidCredentials"));
         }
 
         // 3. Generate JWT token
@@ -144,7 +152,7 @@ public List<UserProfileDTO> getAllProfiles() {
      *  Email is omitted in the DTO (privacy) — search results are public. */
     public Page<UserProfileDTO> searchUsers(String query, Pageable pageable) {
         if (query == null || query.isBlank()) {
-            throw new IllegalArgumentException("Search query must not be empty.");
+            throw new IllegalArgumentException(msg("error.search.emptyQuery"));
         }
         String trimmed = query.trim();
         Page<RegisteredUser> page = registeredUserRepository
@@ -225,6 +233,25 @@ public UserProfileDTO setLeaderboardHidden(Long id, boolean hidden) {
         return toProfileDTO(saved, true);
     }
 
+    /**
+     * Owner-only language preference update (#505). Rejects unknown enum
+     * values with {@link IllegalArgumentException} so the controller can
+     * return 400.
+     */
+    public UserProfileDTO updateLanguage(Long id, com.bounswe2026group1.backend.dto.UpdateLanguageRequest request) {
+        com.bounswe2026group1.backend.model.Language lang;
+        try {
+            lang = com.bounswe2026group1.backend.model.Language.valueOf(request.getLanguage().toUpperCase());
+        } catch (IllegalArgumentException | NullPointerException e) {
+            throw new IllegalArgumentException("Unknown language: " + request.getLanguage());
+        }
+        RegisteredUser user = registeredUserRepository.findById(id)
+                .orElseThrow(() -> new NoSuchElementException("User not found with id: " + id));
+        user.setPreferredLanguage(lang);
+        RegisteredUser saved = registeredUserRepository.save(user);
+        return toProfileDTO(saved, true);
+    }
+
     /** All badges currently held by a user — exposed as its own endpoint so
      *  the public profile page can fetch badges without going through the
      *  full profile DTO. */
@@ -284,6 +311,11 @@ private UserProfileDTO buildDTO(RegisteredUser user,
                 .badges(badges)
                 .topBadge(Badge.pickHighestTier(badges))
                 .leaderboardHidden(user.isLeaderboardHidden())
+                // Same privacy gate as email: only surface the language preference
+                // on self-views so it doesn't leak through public lookups.
+                .preferredLanguage(includeEmail && user.getPreferredLanguage() != null
+                        ? user.getPreferredLanguage().name()
+                        : null)
                 .build();
     }
 }

backend/src/main/resources/db/migration/V6__add_preferred_language.sql

@@ -0,0 +1,7 @@
+-- Adds the per-user UI language preference (#505).
+-- Hibernate's ddl-auto=update creates this column on fresh dev databases, but
+-- the Flyway migration is the source of truth for prod/CI databases that
+-- already have the schema baselined.
+
+ALTER TABLE registered_users
+    ADD COLUMN IF NOT EXISTS preferred_language VARCHAR(8) NOT NULL DEFAULT 'EN';

backend/src/main/resources/messages.properties

@@ -0,0 +1,14 @@
+# User-facing error and validation messages. Keep in sync with
+# messages_tr.properties and any other locale files.
+#
+# Resolved via MessageSource at the point an exception is thrown so the
+# caller's locale (Accept-Language header, falling back to the authenticated
+# user's preferredLanguage) controls the rendered language.
+
+error.email.alreadyInUse=Email is already in use.
+error.password.weak=Password must be at least 8 characters long, and include an uppercase letter, a lowercase letter, a digit, and a special character.
+error.auth.invalidCredentials=Invalid email or password
+error.user.notFoundById=User not found with id: {0}
+error.user.notFoundByEmail=User not found with email: {0}
+error.search.emptyQuery=Search query must not be empty.
+error.language.unknown=Unknown language: {0}

backend/src/main/resources/messages_tr.properties

@@ -0,0 +1,10 @@
+# Turkish translations of user-facing error messages.
+# Keep keys in sync with messages_en.properties.
+
+error.email.alreadyInUse=Bu e-posta zaten kullanımda.
+error.password.weak=Şifre en az 8 karakter olmalı ve büyük harf, küçük harf, rakam ve özel karakter içermeli.
+error.auth.invalidCredentials=Geçersiz e-posta veya şifre
+error.user.notFoundById=ID ile kullanıcı bulunamadı: {0}
+error.user.notFoundByEmail=E-posta ile kullanıcı bulunamadı: {0}
+error.search.emptyQuery=Arama sorgusu boş olamaz.
+error.language.unknown=Bilinmeyen dil: {0}

backend/src/test/java/com/bounswe2026group1/backend/service/AdminUserServiceTest.java

@@ -3,6 +3,7 @@
 import com.bounswe2026group1.backend.dto.admin.AdminChangeRoleRequest;
 import com.bounswe2026group1.backend.dto.admin.AdminCreateUserRequest;
 import com.bounswe2026group1.backend.dto.admin.AdminUserResponse;
+import com.bounswe2026group1.backend.model.Language;
 import com.bounswe2026group1.backend.model.RegisteredUser;
 import com.bounswe2026group1.backend.model.UserRole;
 import com.bounswe2026group1.backend.model.UserStatus;
@@ -44,9 +45,9 @@ class AdminUserServiceTest {
     @BeforeEach
     void setUp() {
         adminUser = new RegisteredUser(1L, "Admin", "admin@test.com", "hash", UserRole.ADMIN,
-                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false);
+                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false, Language.EN);
         regularUser = new RegisteredUser(2L, "User", "user@test.com", "hash", UserRole.USER,
-                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false);
+                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false, Language.EN);
     }
 
     // --- listUsers ---
@@ -170,7 +171,7 @@ void changeRole_Fail_SelfDemotion() {
     @Test
     void changeRole_Fail_LastAdmin() {
         RegisteredUser anotherAdmin = new RegisteredUser(3L, "Admin2", "admin2@test.com", "hash", UserRole.ADMIN,
-                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false);
+                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false, Language.EN);
         when(userRepository.findById(3L)).thenReturn(Optional.of(anotherAdmin));
         when(userRepository.countByRole(UserRole.ADMIN)).thenReturn(1L);
 
@@ -190,7 +191,7 @@ void createUser_Success() {
         when(userRepository.existsByEmail("new@test.com")).thenReturn(false);
         when(passwordEncoder.encode(any())).thenReturn("encoded");
         RegisteredUser saved = new RegisteredUser(5L, "New", "new@test.com", "encoded", UserRole.USER,
-                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false);
+                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false, Language.EN);
         when(userRepository.save(any())).thenReturn(saved);
 
         AdminCreateUserRequest req = new AdminCreateUserRequest();
@@ -249,7 +250,7 @@ void deleteUser_Fail_SelfDelete() {
     @Test
     void deleteUser_Fail_LastAdmin() {
         RegisteredUser anotherAdmin = new RegisteredUser(3L, "Admin2", "admin2@test.com", "hash", UserRole.ADMIN,
-                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false);
+                UserStatus.ACTIVE, null, 0, null, null, null, null, null, null, false, Language.EN);
         when(userRepository.findById(3L)).thenReturn(Optional.of(anotherAdmin));
         when(userRepository.countByRole(UserRole.ADMIN)).thenReturn(1L);