Shartnoma PDF — R42 proxy yuklash + imzolangan havola

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T03-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T03-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T03-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

finalize-ep-03 yangiladi

Yangilandi: pr_url

qa-ep-03-t03-s02 statusni o'zgartirdi Review → Bajarildi

qa-ep-03-t03-s02 izoh qoldirdi

QA (qa-EP-03-T03-S02) — noldan tekshirildi, oldingi `is_met` belgilariga tayanilmadi. **Test:** `SupplierContractFileControllerIntegrationTest` — Tests run: 15, Failures: 0, Errors: 0 (42.79 s). Real PostgreSQL 16 (Testcontainers) + real dev MinIO. **AC1711** ✓ `SupplierContractFileService.persist()` (:110-120) uchala ustunni bitta `@Transactional` ichida yozadi; test javobni HAM DB'dan o'qib solishtiradi (`uploadingContractFileWritesAllThreeColumnsTogether`). CHECK `chk_supplier_contracts_file_columns` V12:108 da mavjud — yangi migratsiya kerak emas (to'g'ri). **AC1712** ✓ Kod oqimida isbotlandi: `FileUploadService.upload()` (:100-105) tartibi = `requireAllowedMimeType` → `readBounded` (hajm) → `requireMatchingSignature` (magic bytes) → **so'ng** `storageClient.put()`. Ya'ni rad etish omborga yozishdan OLDIN; "yozib keyin o'chirish" naqshi YO'Q. Kompensatsiya `DELETE` faqat 6-qadam (persist callback) xatosi uchun. Komponent darajasida `FileUploadServiceTest.contentNotMatchingDeclaredMimeSignatureThrowsUnsupportedFileTypeAndNeverTouchesStorage` `verifyNoInteractions(storageClient)` bilan tasdiqlaydi; S02 e2e testi 415 + DB ustunlari NULL ni tekshiradi. **AC1713** ✓ `X-Amz-Expires=300` presigned URL imzosining O'ZIDAN o'qib assert qilinadi (javob maydoniga emas) + URL bo'yicha real HTTP GET 200 va bayt-ma-bayt mazmun mosligi. 403: `@RequirePermission("supplier_contract.view")` (Controller:58). **Mutatsiya bilan tasdiqlandi** — annotatsiya olib tashlanganda `downloadingWithoutViewPermissionReturnsForbidden` va `downloadingWithoutAnyPermissionReturnsForbidden` 403 o'rniga 200 bilan YIQILDI. Test yolg'onni ushlaydi. `create` huquqi `view` ni bermasligi ham alohida tekshirilgan. **AC1714** ✓ `SupplierContractService.createVersion()` yangi qatorga `contract_file_key` ni KO'CHIRMAYDI (:114-126) — har versiya o'z kalitiga ega, kalitlar UUID (`ObjectKeyGenerator`), shuning uchun versiyalar orasida obyekt ulashilmaydi. `deleteOldObject` faqat AYNI qatorning oldingi kaliti uchun ishlaydi. Test versiyalashdan keyin eski versiya faylining hali ham yuklab olinishini real round-trip bilan ko'rsatadi. **Qo'shimcha tasdiqlangan:** `FileUploadService`/`FileDownloadService` (EP-09-T06) qayta yozilmagan, ishlatilgan; original fayl nomi hech qayerda saqlanmaydi (`getOriginalFilename()` chaqirilmaydi, kalit = `<domen>/<yil>/<oy>/<uuid>.<ext>`, jadvalda `file_name` ustuni yo'q — Q29=C); yuklash rule'i `supplier_contract.create`; `supplier_contract.view`/`.create` katalogda seed qilingan (`R__permissions_and_currencies_seed.sql:69-70`) va `user_permissions.permission_code` da haqiqiy FK bor (V5:37, AR-10 ✓); `@Transactional` / `readOnly=true` to'g'ri; tenant_id qo'shilmagan (AR-1 ✓); DB qatori fizik o'chirilmaydi; log'ga faqat obyekt kaliti yoziladi, token/URL emas. --- **2 ta eslatma (bloklamaydi, keyingi ishga):** 1. `SupplierContractFileService:50` dagi `PRESIGNED_URL_TTL` — `FileDownloadService:48` dagi konstantaning TAKRORI va faqat javobning `expires_at` maydoniga ta'sir qiladi. Mutatsiya tekshiruvi: uni 5→60 daqiqaga o'zgartirdim — **hech bir test yiqilmadi**. Havolaning haqiqiy muddati (300 s) assert qilingani uchun AC1713 buzilmaydi, lekin ikki konstanta drift qilsa `expires_at` yolg'on gapiradi va buni test ushlamaydi. Tavsiya: testga `expires_at ≈ now+5min` assert'i qo'shilsin yoki TTL `FileDownloadService` dan yagona manba sifatida olinsin. 2. `SupplierContractFileService.upload()` da `deleteOldObject()` `@Transactional` ICHIDA, commit'dan OLDIN chaqiriladi (:85-87). Commit yiqilsa eski obyekt o'chgan, DB esa hali unga ishora qilgan bo'ladi → shartnoma PDF'i yo'qoladi (404 FILE_MISSING). Ehtimoli past, lekin narxi yuqori. Tavsiya: `TransactionSynchronization.afterCommit` ga ko'chirilsin. Mutatsiyalar tikланди, `git status --porcelain` toza (faqat `A openapi/v1/suppliers.yaml` — T00 taskiniki, tegilmagan).

qa-ep-03-t03-s02 qabul mezonini belgiladi

✓ Yangi versiya yaratilganda eski versiyaning PDF'i o'chirilmaydi (har versiya o'z fayliga ega)

qa-ep-03-t03-s02 qabul mezonini belgiladi

✓ Yuklab olish imzolangan, muddati cheklangan havola orqali; `supplier_contract.view` rule'siz `403`

qa-ep-03-t03-s02 qabul mezonini belgiladi

✓ MIME/magic bytes mos kelmagan fayl (mas. `.pdf` nomli PNG) omborga YOZILMASDAN rad etiladi (R42 3–4 qadam)

qa-ep-03-t03-s02 qabul mezonini belgiladi

✓ PDF yuklangach uchala ustun (`contract_file_key`/`contract_mime_type`/`contract_size_bytes`) birga to'ldiriladi (CHECK buzilmaydi)

coder-ep-03-t03-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-03-t03-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-03-t03-s02 qabul mezonini belgiladi

✓ Yangi versiya yaratilganda eski versiyaning PDF'i o'chirilmaydi (har versiya o'z fayliga ega)

coder-ep-03-t03-s02 qabul mezonini belgiladi

✓ Yuklab olish imzolangan, muddati cheklangan havola orqali; `supplier_contract.view` rule'siz `403`

coder-ep-03-t03-s02 qabul mezonini belgiladi

✓ MIME/magic bytes mos kelmagan fayl (mas. `.pdf` nomli PNG) omborga YOZILMASDAN rad etiladi (R42 3–4 qadam)

coder-ep-03-t03-s02 qabul mezonini belgiladi

✓ PDF yuklangach uchala ustun (`contract_file_key`/`contract_mime_type`/`contract_size_bytes`) birga to'ldiriladi (CHECK buzilmaydi)

coder-ep-03-t03-s02 fayllarni qayd etdi

6 ta fayl qayd etildi

coder-ep-03-t03-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-03-t03-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-03-T03-S01

pm-agent yaratdi

Shartnoma PDF — R42 proxy yuklash + imzolangan havola