diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..8af972c
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+/gradlew text eol=lf
+*.bat text eol=crlf
+*.jar binary
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c2065bc
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,37 @@
+HELP.md
+.gradle
+build/
+!gradle/wrapper/gradle-wrapper.jar
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+bin/
+!**/src/main/**/bin/
+!**/src/test/**/bin/
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+out/
+!**/src/main/**/out/
+!**/src/test/**/out/
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+
+### VS Code ###
+.vscode/
diff --git a/build.gradle b/build.gradle
new file mode 100644
index 0000000..f465a2b
--- /dev/null
+++ b/build.gradle
@@ -0,0 +1,32 @@
+plugins {
+    id 'java'
+    id 'org.springframework.boot' version '3.5.7'
+    id 'io.spring.dependency-management' version '1.1.7'
+}
+
+group = 'com.example'
+version = '0.0.1-SNAPSHOT'
+description = 'tampopotest'
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(17)
+    }
+}
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    implementation 'org.springframework.boot:spring-boot-starter-jersey'
+    implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'com.fasterxml.jackson.core:jackson-annotations'
+    implementation 'com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-json-provider:2.17.2'
+    testImplementation 'org.springframework.boot:spring-boot-starter-test'
+    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+}
+
+tasks.named('test') {
+    useJUnitPlatform()
+}
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
new file mode 100644
index 0000000..1b33c55
--- /dev/null
+++ b/gradle/wrapper/gradle-wrapper.jar
Binary files differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 0000000..d4081da
--- /dev/null
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
new file mode 100644
index 0000000..23d15a9
--- /dev/null
+++ b/gradlew
@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
diff --git a/gradlew.bat b/gradlew.bat
new file mode 100644
index 0000000..db3a6ac
--- /dev/null
+++ b/gradlew.bat
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
diff --git a/settings.gradle b/settings.gradle
new file mode 100644
index 0000000..49ffbb4
--- /dev/null
+++ b/settings.gradle
@@ -0,0 +1 @@
+rootProject.name = 'tampopotest'
diff --git a/src/Main.java b/src/Main.java
new file mode 100644
index 0000000..930198c
--- /dev/null
+++ b/src/Main.java
@@ -0,0 +1,15 @@
+//TIP To <b>Run</b> code, press <shortcut actionId="Run"/> or
+// click the <icon src="AllIcons.Actions.Execute"/> icon in the gutter.
+public class Main {
+    public static void main(String[] args) {
+        //TIP Press <shortcut actionId="ShowIntentionActions"/> with your caret at the highlighted text
+        // to see how IntelliJ IDEA suggests fixing it.
+        System.out.printf("Hello and welcome!");
+
+        for (int i = 1; i <= 5; i++) {
+            //TIP Press <shortcut actionId="Debug"/> to start debugging your code. We have set one <icon src="AllIcons.Debugger.Db_set_breakpoint"/> breakpoint
+            // for you, but you can always add more by pressing <shortcut actionId="ToggleLineBreakpoint"/>.
+            System.out.println("i = " + i);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/com/example/tampopotest/TampopotestApplication.java b/src/main/java/com/example/tampopotest/TampopotestApplication.java
new file mode 100644
index 0000000..5ce88f8
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/TampopotestApplication.java
@@ -0,0 +1,13 @@
+package com.example.tampopotest;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class TampopotestApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(TampopotestApplication.class, args);
+	}
+
+}
diff --git a/src/main/java/com/example/tampopotest/api/ChatRequestsResource.java b/src/main/java/com/example/tampopotest/api/ChatRequestsResource.java
new file mode 100644
index 0000000..01e8eeb
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/ChatRequestsResource.java
@@ -0,0 +1,65 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.ChatRequest;
+import com.example.tampopotest.store.InMemoryStore.User;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+import java.util.stream.Collectors;
+
+@Path("/chat-requests")
+@Produces(MediaType.APPLICATION_JSON)
+public class ChatRequestsResource {
+
+    @GET
+    public Response list(@QueryParam("token") String token,
+                         @QueryParam("user-id") String userId) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null || userId == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!auth.userId.equals(userId)) return Response.status(Response.Status.FORBIDDEN).build();
+        List<Map<String, Object>> res = InMemoryStore.listChatRequests().stream()
+                .filter(cr -> cr.senderId.equals(userId) || cr.receiverId.equals(userId))
+                .map(cr -> {
+                    Map<String, Object> m = new LinkedHashMap<>();
+                    m.put("chat-request-id", cr.id);
+                    m.put("sender-id", cr.senderId);
+                    m.put("receiver-id", cr.receiverId);
+                    return m;
+                }).collect(Collectors.toList());
+        return Response.ok(res).build();
+    }
+
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response create(@FormParam("token") String token,
+                           @FormParam("sender-id") String senderId,
+                           @FormParam("receiver-id") String receiverId) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (senderId == null || receiverId == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!auth.userId.equals(senderId)) return Response.status(Response.Status.FORBIDDEN).build();
+        if (InMemoryStore.getUser(senderId) == null || InMemoryStore.getUser(receiverId) == null)
+            return Response.status(Response.Status.NOT_FOUND).build();
+        int id = InMemoryStore.createChatRequest(senderId, receiverId);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("chat-request-id", id);
+        return Response.status(204).entity(res).build();
+    }
+
+    @DELETE
+    @Path("/{chat-request-id}")
+    public Response delete(@PathParam("chat-request-id") int id,
+                           @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        ChatRequest cr = InMemoryStore.getChatRequest(id);
+        if (cr == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(cr.senderId.equals(auth.userId) || cr.receiverId.equals(auth.userId)))
+            return Response.status(Response.Status.FORBIDDEN).build();
+        InMemoryStore.deleteChatRequest(id);
+        return Response.status(204).build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/ChatRoomsResource.java b/src/main/java/com/example/tampopotest/api/ChatRoomsResource.java
new file mode 100644
index 0000000..eefa19f
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/ChatRoomsResource.java
@@ -0,0 +1,103 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.ChatRoom;
+import com.example.tampopotest.store.InMemoryStore.User;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+@Path("/chat-rooms")
+@Produces(MediaType.APPLICATION_JSON)
+public class ChatRoomsResource {
+
+    @POST
+    public Response create(@QueryParam("user0-id") String user0,
+                           @QueryParam("user1-id") String user1,
+                           @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        if (user0 == null || user1 == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!(auth.userId.equals(user0) || auth.userId.equals(user1))) return Response.status(Response.Status.FORBIDDEN).build();
+        if (InMemoryStore.getUser(user0) == null || InMemoryStore.getUser(user1) == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Integer existing = InMemoryStore.findRoomIdByUsers(user0, user1);
+        int roomId = existing != null ? existing : InMemoryStore.createRoom(user0, user1);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("room-id", roomId);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    public Response get(@QueryParam("user0-id") String user0,
+                        @QueryParam("user1-id") String user1,
+                        @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        if (user0 == null || user1 == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!(auth.userId.equals(user0) || auth.userId.equals(user1))) return Response.status(Response.Status.FORBIDDEN).build();
+        Integer existing = InMemoryStore.findRoomIdByUsers(user0, user1);
+        if (existing == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("room-id", existing);
+        return Response.ok(res).build();
+    }
+
+    @DELETE
+    public Response delete(@QueryParam("chatroom-id") int roomId,
+                           @QueryParam("user-id") String userId,
+                           @QueryParam("token") String token) {
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.UNAUTHORIZED).build();
+        ChatRoom room = InMemoryStore.getRoom(roomId);
+        if (room == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(room.participants.contains(userId))) return Response.status(Response.Status.FORBIDDEN).build();
+        InMemoryStore.deleteRoom(roomId);
+        return Response.status(204).build();
+    }
+
+    @GET
+    @Path("/{chatroom-id}/{user-id}/")
+    public Response getMessage(@PathParam("chatroom-id") int roomId,
+                               @PathParam("user-id") String userId,
+                               @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.FORBIDDEN).build();
+        ChatRoom room = InMemoryStore.getRoom(roomId);
+        if (room == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!room.participants.contains(auth.userId)) return Response.status(Response.Status.FORBIDDEN).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("message", room.lastMessage == null ? "" : room.lastMessage);
+        return Response.ok(res).build();
+    }
+
+    @PUT
+    @Path("/{chatroom-id}/{user-id}/")
+    public Response addUser(@PathParam("chatroom-id") int roomId,
+                            @PathParam("user-id") String userId,
+                            @QueryParam("token") String token) {
+        // token must be the same user being added
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        ChatRoom room = InMemoryStore.getRoom(roomId);
+        if (room == null) return Response.status(Response.Status.NOT_FOUND).build();
+        room.participants.add(userId);
+        return Response.ok().build();
+    }
+
+    @PUT
+    @Path("/{chatroom-id}/{user-id}/message")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response updateMessage(@PathParam("chatroom-id") int roomId,
+                                  @PathParam("user-id") String userId,
+                                  @FormParam("token") String token,
+                                  @FormParam("message") String message) {
+        if (message == null || token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        ChatRoom room = InMemoryStore.getRoom(roomId);
+        if (room == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!room.participants.contains(userId)) return Response.status(Response.Status.FORBIDDEN).build();
+        room.lastMessage = message;
+        return Response.ok().build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/FriendRequestsResource.java b/src/main/java/com/example/tampopotest/api/FriendRequestsResource.java
new file mode 100644
index 0000000..6f3d84c
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/FriendRequestsResource.java
@@ -0,0 +1,64 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.FriendRequest;
+import com.example.tampopotest.store.InMemoryStore.User;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+import java.util.stream.Collectors;
+
+@Path("/friend-requests")
+@Produces(MediaType.APPLICATION_JSON)
+public class FriendRequestsResource {
+
+    @GET
+    public Response list(@QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        List<Map<String, Object>> res = InMemoryStore.listFriendRequests().stream()
+                .filter(fr -> fr.senderId.equals(auth.userId) || fr.receiverId.equals(auth.userId))
+                .map(fr -> {
+                    Map<String, Object> m = new LinkedHashMap<>();
+                    m.put("friend-request-id", fr.id);
+                    m.put("sender-id", fr.senderId);
+                    m.put("receiver-id", fr.receiverId);
+                    return m;
+                }).collect(Collectors.toList());
+        if (res.isEmpty()) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(res).build();
+    }
+
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response create(@FormParam("token") String token,
+                           @FormParam("sender-id") String senderId,
+                           @FormParam("receiver-id") String receiverId) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (senderId == null || receiverId == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!auth.userId.equals(senderId)) return Response.status(Response.Status.FORBIDDEN).build();
+        if (InMemoryStore.getUser(senderId) == null || InMemoryStore.getUser(receiverId) == null)
+            return Response.status(Response.Status.NOT_FOUND).build();
+        int id = InMemoryStore.createFriendRequest(senderId, receiverId);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("friend-request-id", id);
+        return Response.status(Response.Status.CREATED).entity(res).build();
+    }
+
+    @DELETE
+    @Path("/{friend-request-id}")
+    public Response delete(@PathParam("friend-request-id") int id,
+                           @QueryParam("receiver-token") String receiverToken) {
+        User receiver = InMemoryStore.findUserByToken(receiverToken);
+        if (receiver == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        FriendRequest fr = InMemoryStore.listFriendRequests().stream().filter(f -> f.id == id).findFirst().orElse(null);
+        if (fr == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!receiver.userId.equals(fr.receiverId)) return Response.status(Response.Status.FORBIDDEN).build();
+        boolean ok = InMemoryStore.deleteFriendRequest(id);
+        if (!ok) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok().build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/FriendResource.java b/src/main/java/com/example/tampopotest/api/FriendResource.java
new file mode 100644
index 0000000..b815628
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/FriendResource.java
@@ -0,0 +1,81 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.Pair;
+import com.example.tampopotest.store.InMemoryStore.User;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+
+@Path("/")
+@Produces(MediaType.APPLICATION_JSON)
+public class FriendResource {
+
+    @POST
+    @Path("friends/")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response addPair(@FormParam("token") String token,
+                            @FormParam("user0-id") String user0,
+                            @FormParam("user1-id") String user1) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        if (user0 == null || user1 == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (InMemoryStore.getUser(user0) == null || InMemoryStore.getUser(user1) == null) return Response.status(Response.Status.NOT_FOUND).build();
+        // Only allow if auth matches one of them
+        if (!(auth.userId.equals(user0) || auth.userId.equals(user1))) return Response.status(Response.Status.FORBIDDEN).build();
+        int pid = InMemoryStore.addPair(user0, user1);
+        if (pid == -1) return Response.status(Response.Status.CONFLICT).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("pair-id", pid);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("friends/pairs/{pair-id}/")
+    public Response getPair(@PathParam("pair-id") int pairId,
+                            @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        Pair p = InMemoryStore.getPair(pairId);
+        if (p == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(p.user0.equals(auth.userId) || p.user1.equals(auth.userId))) return Response.status(Response.Status.FORBIDDEN).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("user0-id", p.user0);
+        res.put("user1-id", p.user1);
+        return Response.ok(res).build();
+    }
+
+    @DELETE
+    @Path("friends/pairs/{pair-id}/")
+    public Response deletePair(@PathParam("pair-id") int pairId,
+                               @QueryParam("token") String token) {
+        User auth = InMemoryStore.findUserByToken(token);
+        if (auth == null) return Response.status(Response.Status.UNAUTHORIZED).build();
+        Pair p = InMemoryStore.getPair(pairId);
+        if (p == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(p.user0.equals(auth.userId) || p.user1.equals(auth.userId))) return Response.status(Response.Status.FORBIDDEN).build();
+        boolean ok = InMemoryStore.removePair(pairId);
+        if (!ok) return Response.status(Response.Status.BAD_REQUEST).build();
+        return Response.ok().build();
+    }
+
+    @GET
+    @Path("friends/users/{user-id}")
+    public Response listFriends(@PathParam("user-id") String userId,
+                                @QueryParam("token") String token) {
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Set<Integer> pids = InMemoryStore.getUserPairs(userId);
+        Map<String, Object> res = new LinkedHashMap<>();
+        int i = 1;
+        for (Integer pid : pids) {
+            Pair p = InMemoryStore.getPair(pid);
+            if (p == null) continue;
+            String other = p.user0.equals(userId) ? p.user1 : p.user0;
+            res.put("friend" + i++, other);
+        }
+        if (res.isEmpty()) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(res).build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/UserActivitiesResource.java b/src/main/java/com/example/tampopotest/api/UserActivitiesResource.java
new file mode 100644
index 0000000..95b2e49
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/UserActivitiesResource.java
@@ -0,0 +1,98 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.Activity;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+
+@Path("/users/{user-id}/activities")
+@Produces(MediaType.APPLICATION_JSON)
+public class UserActivitiesResource {
+
+    @GET
+    public Response list(@PathParam("user-id") String userId,
+                         @QueryParam("filter") String filter) {
+        List<Activity> list = InMemoryStore.getActivities(userId);
+        if (list.isEmpty()) return Response.status(Response.Status.NOT_FOUND).build();
+        List<Activity> toReturn = list;
+        if ("LATEST".equalsIgnoreCase(filter) && !list.isEmpty()) {
+            toReturn = Collections.singletonList(list.get(list.size() - 1));
+        }
+        Map<String, Object> res = new LinkedHashMap<>();
+        for (Activity a : toReturn) {
+            Map<String, Object> m = new LinkedHashMap<>();
+            m.put("text", a.text);
+            m.put("updated-time", a.updatedTime);
+            res.put(a.id, m);
+        }
+        return Response.ok(res).build();
+    }
+
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response post(@PathParam("user-id") String userId,
+                         @FormParam("token") String token,
+                         @FormParam("new-activity") String newActivity) {
+        if (token == null || newActivity == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        if (InMemoryStore.getUser(userId) == null) return Response.status(Response.Status.NOT_FOUND).build();
+        String id = InMemoryStore.addActivity(userId, newActivity);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("activity-id", id);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{activity-id}")
+    public Response get(@PathParam("user-id") String userId,
+                        @PathParam("activity-id") String activityId) {
+        Activity a = InMemoryStore.getActivity(userId, activityId);
+        if (a == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("activity-id", a.id);
+        res.put("text", a.text);
+        res.put("updated-time", a.updatedTime);
+        return Response.ok(res).build();
+    }
+
+    @DELETE
+    @Path("/{activity-id}")
+    public Response delete(@PathParam("user-id") String userId,
+                           @PathParam("activity-id") String activityId,
+                           @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        boolean ok = InMemoryStore.deleteActivity(userId, activityId);
+        if (!ok) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok().build();
+    }
+
+    @GET
+    @Path("/{activity-id}/text")
+    public Response getText(@PathParam("user-id") String userId,
+                            @PathParam("activity-id") String activityId) {
+        Activity a = InMemoryStore.getActivity(userId, activityId);
+        if (a == null) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(a.text).build();
+    }
+
+    @GET
+    @Path("/{activity-id}/updated-time")
+    public Response getUpdatedTime(@PathParam("user-id") String userId,
+                                   @PathParam("activity-id") String activityId) {
+        Activity a = InMemoryStore.getActivity(userId, activityId);
+        if (a == null) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(a.updatedTime).build();
+    }
+
+    @GET
+    @Path("/last-updated-time")
+    public Response getLastUpdated(@PathParam("user-id") String userId) {
+        String t = InMemoryStore.getLatestActivityTime(userId);
+        if (t == null) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(t).build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/UserFriendsResource.java b/src/main/java/com/example/tampopotest/api/UserFriendsResource.java
new file mode 100644
index 0000000..d6e9c77
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/UserFriendsResource.java
@@ -0,0 +1,66 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.Pair;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+
+@Path("/users/{user-id}/friends")
+@Produces(MediaType.APPLICATION_JSON)
+public class UserFriendsResource {
+
+    @GET
+    public Response list(@PathParam("user-id") String userId,
+                         @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Set<Integer> pids = InMemoryStore.getUserPairs(userId);
+        if (pids.isEmpty()) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        for (Integer pid : pids) {
+            Pair p = InMemoryStore.getPair(pid);
+            if (p == null) continue;
+            Map<String, Object> item = new LinkedHashMap<>();
+            item.put("user0-id", p.user0);
+            item.put("user1-id", p.user1);
+            res.put("pid" + pid, item);
+        }
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{pair-id}")
+    public Response get(@PathParam("user-id") String userId,
+                        @PathParam("pair-id") String pairId,
+                        @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        int id;
+        try { id = Integer.parseInt(pairId); } catch (Exception e) { return Response.status(Response.Status.BAD_REQUEST).build(); }
+        Pair p = InMemoryStore.getPair(id);
+        if (p == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(p.user0.equals(userId) || p.user1.equals(userId))) return Response.status(Response.Status.FORBIDDEN).build();
+        String other = p.user0.equals(userId) ? p.user1 : p.user0;
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("user-id", other);
+        return Response.ok(res).build();
+    }
+
+    @DELETE
+    @Path("/{pair-id}")
+    public Response delete(@PathParam("user-id") String userId,
+                           @PathParam("pair-id") int pairId,
+                           @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Pair p = InMemoryStore.getPair(pairId);
+        if (p == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!(p.user0.equals(userId) || p.user1.equals(userId))) return Response.status(Response.Status.FORBIDDEN).build();
+        boolean ok = InMemoryStore.removePair(pairId);
+        if (!ok) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok().build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/UserNotificationsResource.java b/src/main/java/com/example/tampopotest/api/UserNotificationsResource.java
new file mode 100644
index 0000000..7cc8353
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/UserNotificationsResource.java
@@ -0,0 +1,84 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.Notification;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+
+@Path("/users/{user-id}/notifications")
+@Produces(MediaType.APPLICATION_JSON)
+public class UserNotificationsResource {
+
+    @GET
+    public Response list(@PathParam("user-id") String userId,
+                         @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        List<Notification> list = InMemoryStore.getNotifications(userId);
+        if (list.isEmpty()) return Response.status(Response.Status.NOT_FOUND).build();
+        List<String> ids = new ArrayList<>();
+        for (Notification n : list) ids.add(n.id);
+        return Response.ok(ids).build();
+    }
+
+    @GET
+    @Path("/{notification-id}")
+    public Response get(@PathParam("user-id") String userId,
+                        @PathParam("notification-id") String nid,
+                        @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Notification n = InMemoryStore.getNotification(userId, nid);
+        if (n == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("from", n.from);
+        res.put("text", n.text);
+        res.put("time", n.time);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{notification-id}/text")
+    public Response getText(@PathParam("user-id") String userId,
+                            @PathParam("notification-id") String nid,
+                            @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Notification n = InMemoryStore.getNotification(userId, nid);
+        if (n == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("text", n.text);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{notification-id}/time")
+    public Response getTime(@PathParam("user-id") String userId,
+                            @PathParam("notification-id") String nid,
+                            @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Notification n = InMemoryStore.getNotification(userId, nid);
+        if (n == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("time", n.time);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{notification-id}/from")
+    public Response getFrom(@PathParam("user-id") String userId,
+                            @PathParam("notification-id") String nid,
+                            @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        Notification n = InMemoryStore.getNotification(userId, nid);
+        if (n == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("from", n.from);
+        return Response.ok(res).build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/api/UsersResource.java b/src/main/java/com/example/tampopotest/api/UsersResource.java
new file mode 100644
index 0000000..4c93adb
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/api/UsersResource.java
@@ -0,0 +1,180 @@
+package com.example.tampopotest.api;
+
+import com.example.tampopotest.store.InMemoryStore;
+import com.example.tampopotest.store.InMemoryStore.User;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.*;
+import java.util.stream.Collectors;
+
+@Path("/users")
+@Produces(MediaType.APPLICATION_JSON)
+public class UsersResource {
+
+    @GET
+    public Response listUsers() {
+        List<String> ids = InMemoryStore.listUsers().stream().map(u -> u.userId).collect(Collectors.toList());
+        return Response.ok(ids).build();
+    }
+
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response createUser(@FormParam("user-id") String userId,
+                               @FormParam("password") String password) {
+        if (userId == null || password == null) {
+            return Response.status(Response.Status.BAD_REQUEST).build();
+        }
+        User u = InMemoryStore.createUser(userId, password);
+        if (u == null) {
+            return Response.status(Response.Status.CONFLICT).build();
+        }
+        String token = InMemoryStore.issueToken(u);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("user-id", u.userId);
+        res.put("token", token);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{user-id}")
+    public Response getUser(@PathParam("user-id") String userId) {
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("name", u.name);
+        res.put("icon", u.icon);
+        return Response.ok(res).build();
+    }
+
+    @DELETE
+    @Path("/{user-id}")
+    public Response deleteUser(@PathParam("user-id") String userId,
+                               @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        boolean ok = InMemoryStore.deleteUser(userId);
+        if (!ok) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok().build();
+    }
+
+    @POST
+    @Path("/{user-id}/login")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response login(@PathParam("user-id") String userId,
+                          @FormParam("password") String password) {
+        if (password == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        if (!Objects.equals(u.password, password)) return Response.status(Response.Status.UNAUTHORIZED).build();
+        String token = InMemoryStore.issueToken(u);
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("token", token);
+        return Response.ok(res).build();
+    }
+
+    @GET
+    @Path("/{user-id}/name")
+    public Response getName(@PathParam("user-id") String userId) {
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(u.name).build();
+    }
+
+    @PUT
+    @Path("/{user-id}/name")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response updateName(@PathParam("user-id") String userId,
+                               @FormParam("token") String token,
+                               @FormParam("new-name") String newName) {
+        if (token == null || newName == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        u.name = newName;
+        return Response.ok(newName).build();
+    }
+
+    @GET
+    @Path("/{user-id}/password")
+    public Response getPassword(@PathParam("user-id") String userId,
+                                @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("password", u.password);
+        return Response.ok(res).build();
+    }
+
+    @PUT
+    @Path("/{user-id}/password")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response updatePassword(@PathParam("user-id") String userId,
+                                   @FormParam("token") String token,
+                                   @FormParam("new-password") String newPassword) {
+        if (token == null || newPassword == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        u.password = newPassword;
+        return Response.ok().build();
+    }
+
+    @GET
+    @Path("/{user-id}/email")
+    public Response getEmail(@PathParam("user-id") String userId,
+                             @QueryParam("token") String token) {
+        if (token == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("email", u.email);
+        return Response.ok(res).build();
+    }
+
+    @PUT
+    @Path("/{user-id}/email")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response updateEmail(@PathParam("user-id") String userId,
+                                @FormParam("token") String token,
+                                @FormParam("new-email") String newEmail) {
+        if (token == null || newEmail == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        // duplicate check
+        boolean dup = InMemoryStore.listUsers().stream().anyMatch(u -> newEmail.equals(u.email) && !u.userId.equals(userId));
+        if (dup) return Response.status(Response.Status.CONFLICT).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        u.email = newEmail;
+        return Response.ok().build();
+    }
+
+    @GET
+    @Path("/{user-id}/icon")
+    public Response getIcon(@PathParam("user-id") String userId) {
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        return Response.ok(u.icon).build();
+    }
+
+    @PUT
+    @Path("/{user-id}/icon")
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response updateIcon(@PathParam("user-id") String userId,
+                               @FormParam("token") String token,
+                               @FormParam("new-icon") String newIcon) {
+        if (token == null || newIcon == null) return Response.status(Response.Status.BAD_REQUEST).build();
+        if (!InMemoryStore.checkToken(userId, token)) return Response.status(Response.Status.FORBIDDEN).build();
+        User u = InMemoryStore.getUser(userId);
+        if (u == null) return Response.status(Response.Status.NOT_FOUND).build();
+        // accept base64 and set a pseudo URL
+        u.icon = "https://example.com/images/" + userId + ".png";
+        Map<String, Object> res = new LinkedHashMap<>();
+        res.put("icon", Integer.toHexString(newIcon.hashCode()).toUpperCase());
+        return Response.ok(res).build();
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/config/JerseyConfig.java b/src/main/java/com/example/tampopotest/config/JerseyConfig.java
new file mode 100644
index 0000000..345c51e
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/config/JerseyConfig.java
@@ -0,0 +1,21 @@
+package com.example.tampopotest.config;
+
+import com.example.tampopotest.api.*;
+import org.glassfish.jersey.server.ResourceConfig;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
+public class JerseyConfig extends ResourceConfig {
+    public JerseyConfig() {
+        register(UsersResource.class);
+        register(UserActivitiesResource.class);
+        register(UserNotificationsResource.class);
+        register(UserFriendsResource.class);
+        register(FriendResource.class);
+        register(FriendRequestsResource.class);
+        register(ChatRequestsResource.class);
+        register(ChatRoomsResource.class);
+        // Enable Jackson for JSON
+        packages("com.fasterxml.jackson.jakarta.rs.json");
+    }
+}
diff --git a/src/main/java/com/example/tampopotest/store/InMemoryStore.java b/src/main/java/com/example/tampopotest/store/InMemoryStore.java
new file mode 100644
index 0000000..91f3cfb
--- /dev/null
+++ b/src/main/java/com/example/tampopotest/store/InMemoryStore.java
@@ -0,0 +1,289 @@
+package com.example.tampopotest.store;
+
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicInteger;
+
+public class InMemoryStore {
+    public static class User {
+        public final String userId;
+        public String password;
+        public String name = "";
+        public String email = "";
+        public String icon = ""; // could be URL or base64
+        public String token; // single token for simplicity
+
+        public User(String userId, String password) {
+            this.userId = userId;
+            this.password = password;
+        }
+    }
+
+    public static class Activity {
+        public final String id;
+        public String text;
+        public String updatedTime; // format yyyy/MM/dd HH:mm
+
+        public Activity(String id, String text, String updatedTime) {
+            this.id = id;
+            this.text = text;
+            this.updatedTime = updatedTime;
+        }
+    }
+
+    public static class Notification {
+        public final String id;
+        public String from;
+        public String text;
+        public String time; // ISO-like string
+
+        public Notification(String id, String from, String text, String time) {
+            this.id = id;
+            this.from = from;
+            this.text = text;
+            this.time = time;
+        }
+    }
+
+    public static class Pair {
+        public final int id;
+        public String user0;
+        public String user1;
+
+        public Pair(int id, String user0, String user1) {
+            this.id = id;
+            this.user0 = user0;
+            this.user1 = user1;
+        }
+    }
+
+    public static class FriendRequest {
+        public final int id;
+        public String senderId;
+        public String receiverId;
+
+        public FriendRequest(int id, String senderId, String receiverId) {
+            this.id = id;
+            this.senderId = senderId;
+            this.receiverId = receiverId;
+        }
+    }
+
+    public static class ChatRequest {
+        public final int id;
+        public String senderId;
+        public String receiverId;
+
+        public ChatRequest(int id, String senderId, String receiverId) {
+            this.id = id;
+            this.senderId = senderId;
+            this.receiverId = receiverId;
+        }
+    }
+
+    public static class ChatRoom {
+        public final int id;
+        public String user0;
+        public String user1;
+        public String lastMessage = "";
+        public Set<String> participants = new HashSet<>();
+
+        public ChatRoom(int id, String user0, String user1) {
+            this.id = id;
+            this.user0 = user0;
+            this.user1 = user1;
+            participants.add(user0);
+            participants.add(user1);
+        }
+    }
+
+    private static final Map<String, User> users = new ConcurrentHashMap<>();
+    private static final Map<String, List<Activity>> activities = new ConcurrentHashMap<>();
+    private static final Map<String, List<Notification>> notifications = new ConcurrentHashMap<>();
+    private static final Map<Integer, Pair> pairs = new ConcurrentHashMap<>();
+    private static final Map<String, Set<Integer>> userPairs = new ConcurrentHashMap<>();
+    private static final Map<Integer, FriendRequest> friendRequests = new ConcurrentHashMap<>();
+    private static final Map<Integer, ChatRequest> chatRequests = new ConcurrentHashMap<>();
+    private static final Map<Integer, ChatRoom> chatRooms = new ConcurrentHashMap<>();
+    private static final Map<String, Integer> chatRoomByUsers = new ConcurrentHashMap<>(); // key sorted user0|user1
+
+    private static final AtomicInteger pairSeq = new AtomicInteger(1);
+    private static final AtomicInteger friendReqSeq = new AtomicInteger(1);
+    private static final AtomicInteger chatReqSeq = new AtomicInteger(1);
+    private static final AtomicInteger roomSeq = new AtomicInteger(1);
+
+    private static final DateTimeFormatter ACTIVITY_FMT = DateTimeFormatter.ofPattern("yyyy/MM/dd HH:mm");
+
+    public static Collection<User> listUsers() { return users.values(); }
+
+    public static synchronized User createUser(String userId, String password) {
+        if (users.containsKey(userId)) return null;
+        User u = new User(userId, password);
+        u.name = userId; // default
+        u.icon = "https://example.com/images/" + userId + ".png";
+        users.put(userId, u);
+        return u;
+    }
+
+    public static User getUser(String userId) { return users.get(userId); }
+
+    public static boolean deleteUser(String userId) {
+        User removed = users.remove(userId);
+        if (removed == null) return false;
+        activities.remove(userId);
+        notifications.remove(userId);
+        Set<Integer> pids = userPairs.remove(userId);
+        if (pids != null) pids.forEach(pairs::remove);
+        return true;
+    }
+
+    public static String issueToken(User u) {
+        u.token = UUID.randomUUID().toString().replace("-", "");
+        return u.token;
+    }
+
+    public static boolean checkToken(String userId, String token) {
+        User u = users.get(userId);
+        return u != null && u.token != null && u.token.equals(token);
+    }
+
+    public static User findUserByToken(String token) {
+        if (token == null) return null;
+        for (User u : users.values()) {
+            if (token.equals(u.token)) return u;
+        }
+        return null;
+    }
+
+    // Activities
+    public static synchronized String addActivity(String userId, String text) {
+        String id = randomShortId();
+        String t = LocalDateTime.now().format(ACTIVITY_FMT);
+        activities.computeIfAbsent(userId, k -> new ArrayList<>()).add(new Activity(id, text, t));
+        return id;
+    }
+
+    public static List<Activity> getActivities(String userId) {
+        return activities.getOrDefault(userId, Collections.emptyList());
+    }
+
+    public static Activity getActivity(String userId, String activityId) {
+        return getActivities(userId).stream().filter(a -> a.id.equals(activityId)).findFirst().orElse(null);
+    }
+
+    public static boolean deleteActivity(String userId, String activityId) {
+        List<Activity> list = activities.get(userId);
+        if (list == null) return false;
+        return list.removeIf(a -> a.id.equals(activityId));
+    }
+
+    public static String getLatestActivityTime(String userId) {
+        return getActivities(userId).stream().reduce((a, b) -> b).map(a -> a.updatedTime).orElse(null);
+    }
+
+    // Notifications
+    public static synchronized String addNotification(String userId, String from, String text) {
+        String id = randomShortId();
+        String time = LocalDateTime.now().toString();
+        notifications.computeIfAbsent(userId, k -> new ArrayList<>()).add(new Notification(id, from, text, time));
+        return id;
+    }
+
+    public static List<Notification> getNotifications(String userId) {
+        return notifications.getOrDefault(userId, Collections.emptyList());
+    }
+
+    public static Notification getNotification(String userId, String nid) {
+        return getNotifications(userId).stream().filter(n -> n.id.equals(nid)).findFirst().orElse(null);
+    }
+
+    // Friends (pairs)
+    public static synchronized int addPair(String user0, String user1) {
+        // prevent duplicates
+        for (Pair p : pairs.values()) {
+            if ((p.user0.equals(user0) && p.user1.equals(user1)) || (p.user0.equals(user1) && p.user1.equals(user0))) {
+                return -1;
+            }
+        }
+        int id = pairSeq.getAndIncrement();
+        Pair p = new Pair(id, user0, user1);
+        pairs.put(id, p);
+        userPairs.computeIfAbsent(user0, k -> new HashSet<>()).add(id);
+        userPairs.computeIfAbsent(user1, k -> new HashSet<>()).add(id);
+        return id;
+    }
+
+    public static Pair getPair(int pairId) { return pairs.get(pairId); }
+
+    public static boolean removePair(int pairId) {
+        Pair p = pairs.remove(pairId);
+        if (p == null) return false;
+        Set<Integer> s0 = userPairs.getOrDefault(p.user0, Collections.emptySet());
+        Set<Integer> s1 = userPairs.getOrDefault(p.user1, Collections.emptySet());
+        s0.remove(pairId);
+        s1.remove(pairId);
+        return true;
+    }
+
+    public static Set<Integer> getUserPairs(String userId) {
+        return userPairs.getOrDefault(userId, Collections.emptySet());
+    }
+
+    // Friend Requests
+    public static int createFriendRequest(String sender, String receiver) {
+        int id = friendReqSeq.getAndIncrement();
+        friendRequests.put(id, new FriendRequest(id, sender, receiver));
+        return id;
+    }
+
+    public static Collection<FriendRequest> listFriendRequests() { return friendRequests.values(); }
+
+    public static boolean deleteFriendRequest(int id) {
+        return friendRequests.remove(id) != null;
+    }
+
+    // Chat Requests
+    public static int createChatRequest(String sender, String receiver) {
+        int id = chatReqSeq.getAndIncrement();
+        chatRequests.put(id, new ChatRequest(id, sender, receiver));
+        return id;
+    }
+
+    public static Collection<ChatRequest> listChatRequests() { return chatRequests.values(); }
+
+    public static boolean deleteChatRequest(int id) { return chatRequests.remove(id) != null; }
+
+    public static ChatRequest getChatRequest(int id) { return chatRequests.get(id); }
+
+    // Chat Rooms
+    public static int createRoom(String user0, String user1) {
+        int id = roomSeq.getAndIncrement();
+        chatRooms.put(id, new ChatRoom(id, user0, user1));
+        chatRoomByUsers.put(key(user0, user1), id);
+        return id;
+    }
+
+    public static ChatRoom getRoom(int id) { return chatRooms.get(id); }
+
+    public static boolean deleteRoom(int id) {
+        ChatRoom r = chatRooms.remove(id);
+        if (r == null) return false;
+        chatRoomByUsers.remove(key(r.user0, r.user1));
+        return true;
+    }
+
+    public static Integer findRoomIdByUsers(String user0, String user1) {
+        return chatRoomByUsers.get(key(user0, user1));
+    }
+
+    private static String key(String a, String b) {
+        if (a.compareTo(b) <= 0) return a + "|" + b;
+        return b + "|" + a;
+    }
+
+    public static String randomShortId() {
+        return UUID.randomUUID().toString().replace("-", "").substring(0, 6);
+    }
+}
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
new file mode 100644
index 0000000..4649332
--- /dev/null
+++ b/src/main/resources/application.properties
@@ -0,0 +1 @@
+spring.application.name=tampopotest
diff --git a/src/test/java/com/example/tampopotest/TampopotestApplicationTests.java b/src/test/java/com/example/tampopotest/TampopotestApplicationTests.java
new file mode 100644
index 0000000..fc47e18
--- /dev/null
+++ b/src/test/java/com/example/tampopotest/TampopotestApplicationTests.java
@@ -0,0 +1,13 @@
+package com.example.tampopotest;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class TampopotestApplicationTests {
+
+	@Test
+	void contextLoads() {
+	}
+
+}