Hujjat yuklash (R42 proxy) + ro'yxat

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm yangiladi

Yangilandi: estimate_hours

finalize-ep-03 yangiladi

Yangilandi: pr_url

qa-ep-03-t04-s01 izoh qoldirdi

QA (qa-EP-03-T04-S01) — commit 1555709, branch feat/EP-03-erpbom-backend. VERDIKT: done. Test: `mvn -Dtest=SupplierDocumentControllerIntegrationTest test` -> Tests run: 14, Failures: 0, Errors: 0 (63s, Testcontainers PG16 + dev MinIO). Mezonlar (har biri alohida tekshirildi): - AC1715 — SupplierDocumentService.java:99-101 `file_key`/`mime_type`/`size_bytes` `StoredObject` dan yoziladi; original nom HECH QAYERDA yo'q: V13 da ustun yo'q, `SupplierDocumentResponse` da maydon yo'q, `getOriginalFilename()` butun `src/main` da chaqirilmaydi (grep), obyekt kaliti `ObjectKeyGenerator` da `<domen>/<yil>/<oy>/<uuid>.<ext>`, log'da faqat kompensatsiya `key=` (FileUploadService.java:186). - AC1716 — tartib to'g'ri: FileUploadService.java:100-105 MIME allowlist (100) -> hajm (101) -> magic bytes (102) -> `storageClient.put` (104). Ya'ni tekshiruvlar omborga yozishdan OLDIN (R42). MinIO'ga yozilmasligi FileUploadServiceTest dagi `verifyNoInteractions(storageClient)` bilan, DB qatori yaratilmasligi yangi testdagi `assertNoDocumentPersisted()` bilan qoplangan. - AC1717 — filtr HAQIQATAN ilova qatlamida: SupplierDocumentRepository.java:22,25 `findBySupplierIdAndDeletedAtIsNull` / `findBySupplierIdAndDocTypeAndDeletedAtIsNull`, SupplierDocumentService.java:88-89 faqat shu metodlarni chaqiradi (xom `findAll` yo'q). Partial indeksga tayanish yo'q. - AC1718 — SupplierDocumentController.java:52 `@RequirePermission("supplier_document.upload")`. Test faqat `supplier_document.view` bor foydalanuvchi bilan ham 403 oladi -> rule kodi aynan tekshirilyapti, umumiy "auth bor" emas. MUTATSIYA TEKSHIRUVI (testlar yolg'onni ushlaydimi): 1. FileUploadService.java:167 `if (false && !signature.matches(content))` -> `uploadingContentThatDoesNotMatchDeclaredMimeTypeReturnsUnsupportedMediaTypeAndPersistsNoRow` YIQILDI (expected 415, was 201 CREATED). ✔ mutant o'ldi 2. Repository/Service dan `AndDeletedAtIsNull` olib tashlandi -> `listingDocumentsExcludesSoftDeletedRows` YIQILDI (expected total_items 1, was 2). ✔ mutant o'ldi Ikkala fayl `git checkout --` bilan tiklandi (faqat o'sha aniq fayllar). Kontrakt (openapi/v1/suppliers.yaml): yo'l `/api/v1/suppliers/{id}/documents` ✔; maydonlar `id,supplier_id,file_key,mime_type,size_bytes,doc_type,uploaded_by_user_id,uploaded_at` — global SNAKE_CASE bilan mos ✔; rule'lar summary bilan aynan (POST `supplier_document.upload`, GET `supplier_document.view`) ✔; status kodlar 201/400/401/403/404/415 test bilan tasdiqlandi. Cross-cutting: `@Transactional` (upload) va `@Transactional(readOnly=true)` (list) ✔; `tenant_id`/`organization_id` yo'q (AR-1, §2.3 scoping) ✔; snake_case + ko'plik jadval + to'liq FK nomlari ✔; soft-delete, fizik DELETE yo'q ✔; token/parol log'ga yozilmaydi ✔; outbox N/A. QAMROV ESLATMASI (blokerlash emas, S02 da yopilsin): (a) `supplier_document.view` faqat `upload` huquqi bor foydalanuvchi uchun ro'yxatda 403 berishini isbotlaydigan test YO'Q — GET rule'i kontraktga MOS, lekin uni mutatsiya qilsa hech bir test yiqilmaydi; (b) 413 (hajm chegarasi) shu endpoint darajasida integratsion test bilan qoplanmagan (FileUploadService birlik testida bor).

qa-ep-03-t04-s01 statusni o'zgartirdi Review → Bajarildi

qa-ep-03-t04-s01 qabul mezonini belgiladi

✓ `supplier_document.upload` rule'siz `403`

qa-ep-03-t04-s01 qabul mezonini belgiladi

✓ Ro'yxat faqat `deleted_at IS NULL` hujjatlarni qaytaradi

qa-ep-03-t04-s01 qabul mezonini belgiladi

✓ Ruxsat etilmagan MIME yoki magic bytes mos kelmasa — omborga yozilmaydi va qator yaratilmaydi

qa-ep-03-t04-s01 qabul mezonini belgiladi

✓ Yuklangan hujjat qatori `file_key`+`mime_type`+`size_bytes` bilan yoziladi; original fayl nomi hech qayerda saqlanmaydi

coder-ep-03-t04-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-03-t04-s01 yangiladi

Yangilandi: branch, commit_sha

coder-ep-03-t04-s01 qabul mezonini belgiladi

✓ `supplier_document.upload` rule'siz `403`

coder-ep-03-t04-s01 qabul mezonini belgiladi

✓ Ro'yxat faqat `deleted_at IS NULL` hujjatlarni qaytaradi

coder-ep-03-t04-s01 qabul mezonini belgiladi

✓ Ruxsat etilmagan MIME yoki magic bytes mos kelmasa — omborga yozilmaydi va qator yaratilmaydi

coder-ep-03-t04-s01 qabul mezonini belgiladi

✓ Yuklangan hujjat qatori `file_key`+`mime_type`+`size_bytes` bilan yoziladi; original fayl nomi hech qayerda saqlanmaydi

coder-ep-03-t04-s01 fayllarni qayd etdi

6 ta fayl qayd etildi

coder-ep-03-t04-s01 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-03-t04-s01 ishga oldi

pm-agent yaratdi

Hujjat yuklash (R42 proxy) + ro'yxat