Hujjatni ko'rish (imzolangan havola) + soft-delete

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T04-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T04-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T04-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

finalize-ep-03 yangiladi

Yangilandi: pr_url

qa-ep-03-t04-s02 statusni o'zgartirdi Review → Bajarildi

qa-ep-03-t04-s02 izoh qoldirdi

QA (qa-EP-03-T04-S02) — commit 30010ed, branch feat/EP-03-erpbom-backend. VERDIKT: done. TESTLAR: SupplierDocumentControllerIntegrationTest — 27 test, 0 failure, 0 error (S01 regressiyasi ham yashil). Real PostgreSQL 16 (Testcontainers) + real dev MinIO 127.0.0.1:9000. MUTATSIYA TEKSHIRUVI (assert'lar haqiqiyligi isbotlandi): - M1 SupplierDocumentService.java:50 PRESIGNED_URL_TTL 5->30 min => 27/0 fail. OMON QOLDI (pastda 2-eslatma). - M2 FileDownloadService.java:48 PRESIGNED_URL_TTL 5->30 min => downloadUrlEncodesFiveMinuteExpiryInTheSignedUrlItself YIQILDI: expected "300" but was "1800". AC1720 assert'i tautologik EMAS — qiymat FileDownloadService -> MinIO SDK -> SigV4 imzosigacha boradi, X-Amz-Expires imzoning bir qismi. - M3 delete() da soft o'rniga supplierDocumentRepository.delete(document) => deletingDocumentSoftDeletesRow... YIQILDI (test:473, qator DB'da yo'q). AC1721 deleted_at qismi tekshirilgan. - M5 delete() ga MinIO obyektini o'chirish qo'shildi => o'sha test YIQILDI (test:494, mustaqil presigned round-trip 200 o'rniga 404). AC1721 "MinIO obyekti saqlanadi" qismi haqiqiy round-trip bilan tekshirilgan. - M6a controller:79 download rule'i view->upload => downloadingWithOnlyUploadPermissionReturnsForbidden YIQILDI (403 o'rniga 200). AC1719 haqiqiy upload-huquqli token bilan isbotlangan, bo'sh huquq to'plami bilan emas. - M6b controller:89 delete rule'i delete->view => 5 test YIQILDI, jumladan deletingWithoutDeletePermissionReturnsForbidden (403 o'rniga 204). AC1722 tekshirilgan. Hamma mutatsiya `git checkout` bilan tiklandi; uch fayl baytma-bayt asl holida (git diff bo'sh). MEZONLAR: AC1719 ✓ (controller:79 supplier_document.view, upload-only token 403) · AC1720 ✓ (X-Amz-Expires=300 imzolangan URL'da) · AC1721 ✓ (deleted_at to'ladi, qator saqlanadi, MinIO obyekti round-trip bilan tirik, ro'yxat va download 404) · AC1722 ✓ (controller:89 supplier_document.delete; upload+view yetarli emas). CROSS-CUTTING: @Transactional(readOnly=true) download'da, @Transactional delete'da · fizik DELETE yo'q · deleted_at soft-delete · snake_case, jadval ko'plikda · tenant_id qo'shilmagan · URL/token log qilinmaydi · kontrakt mos: DELETE->204, FileDownloadResponse {url, expires_at} snake_case, FILE_MISSING->404. 2 TA QAYD (mezonlarni buzmaydi, bloklamaydi): 1) KONTRAKT SHAKLI / CROSS-CUTTING QAMROV TESHIGI — auth_logs object_type. openapi/v1/suppliers.yaml:690 getSupplierDocumentUrl tavsifi rad etilgan so'rov auth_logs ga result='deny' VA object_type='document' bilan yozilishini talab qiladi. RequirePermissionAspect.java:52-58 deny'ni yozadi (result='deny', action, error_code), lekin .objectType(...) HECH QACHON to'ldirilmaydi — butun kod bazasida bironta endpoint ham (AuditLogEntry.java:48 da maydon bor, UserService.java:145 / OrganizationService.java:125 kabi servislar uni to'ldiradi, aspekt esa yo'q). Coder'ning da'vosi TASDIQLANDI. Bu S02 mezonlaridan (1719-1722) BIRONTASINI ham buzmaydi — mezonlar 403 natijasi haqida, audit qatorining object_type ustuni haqida emas. Umumiy aspektga tegish cross-cutting o'zgarish, alohida ish sifatida ko'tarilishi kerak (09_auth epic'i yoki yangi barg). 2) TTL konstantasi IKKI JOYDA — SupplierDocumentService.java:50 (faqat javobdagi expires_at maydonini hisoblaydi) va FileDownloadService.java:48 (URL'ning haqiqiy amal muddati). M1 mutatsiyasi ko'rsatdiki, birinchisini 30 daqiqaga o'zgartirsa BIRORTA test yiqilmaydi — expires_at qiymati hech qayerda assert qilinmagan (faqat hasNonNull). Hozir ikkalasi ham 5 daqiqa, xatti-harakat TO'G'RI va AC1720 bajarilgan (link'ning yaroqsiz bo'lishini FileDownloadService boshqaradi, u esa M2 bilan qopланgan). Tavsiya (bloklamaydi): konstantani yagona manbaga keltirish yoki expires_at ~ now+5min assert'ini qo'shish, aks holda kelajakda ikki qiymat ajralib, API noto'g'ri muddat e'lon qilishi mumkin. ESLATMA: tekshiruv davomida ayni repo/branchda ishlayotgan EP-03-T02 worker'i bilan build poygasi bo'ldi (ularning SupplierQueryTest.java testCompile'ni buzdi; keyin target/classes ga eskirgan .class yozilib bitta yugurish soxta 5 failure berdi). Majburiy qayta kompilyatsiya (-Dmaven.compiler.useIncrementalCompilation=false) bilan yakuniy natija 27/0/0. Ularning fayllariga TEGILMADI.

qa-ep-03-t04-s02 qabul mezonini belgiladi

✓ `supplier_document.delete` rule'siz `403`

qa-ep-03-t04-s02 qabul mezonini belgiladi

✓ Soft-delete dan keyin hujjat ro'yxatda ko'rinmaydi, qator va MinIO obyekti saqlanadi

qa-ep-03-t04-s02 qabul mezonini belgiladi

✓ Havola muddati tugagach yaroqsiz bo'ladi

qa-ep-03-t04-s02 qabul mezonini belgiladi

✓ `supplier_document.view` rule'siz havola olinmaydi (`403`) — `upload` rule'i bu huquqni BERMAYDI

coder-ep-03-t04-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-03-t04-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-03-t04-s02 qabul mezonini belgiladi

✓ `supplier_document.delete` rule'siz `403`

coder-ep-03-t04-s02 qabul mezonini belgiladi

✓ Soft-delete dan keyin hujjat ro'yxatda ko'rinmaydi, qator va MinIO obyekti saqlanadi

coder-ep-03-t04-s02 qabul mezonini belgiladi

✓ Havola muddati tugagach yaroqsiz bo'ladi

coder-ep-03-t04-s02 qabul mezonini belgiladi

✓ `supplier_document.view` rule'siz havola olinmaydi (`403`) — `upload` rule'i bu huquqni BERMAYDI

coder-ep-03-t04-s02 fayllarni qayd etdi

5 ta fayl qayd etildi

coder-ep-03-t04-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-03-t04-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-03-T04-S01

pm-agent yaratdi

Hujjatni ko'rish (imzolangan havola) + soft-delete