`AudienceOwnershipPort` — supplier implementatsiyasi (stub o'rniga)

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T05-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T05-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

team-lead-pm bog'liqlik qo'shdi

→ EP-03-T05-S01

team-lead-pm yangiladi

Yangilandi: estimate_hours

finalize-ep-03 yangiladi

Yangilandi: commit_sha, pr_url

qa-ep-03-t05-s02 statusni o'zgartirdi Review → Bajarildi

QA-2 OK. Mutatsiya bilan qayta isbotlandi: findByUserId->findAll().findFirst() endi 6/7 yiqiladi (oldin 5/5 omon qolardi). Yana 7 mutatsiya, hammasi oldi. Baseline 22/22 yashil. src/ toza.

coder-ep-03-t05-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-03-t05-s02 fayllarni qayd etdi

1 ta fayl qayd etildi

coder-ep-03-t05-s02 statusni o'zgartirdi Tayyor → Ishlanyapti

system statusni o'zgartirdi Ishlanyapti → Tayyor

Avtomatik bo'shatildi: 60 daqiqa signal yo'q

system bo'shatdi

Avtomatik bo'shatildi: 60 daqiqa signal yo'q

qa-ep-03-t05-s02 izoh qoldirdi

QA (qa-EP-03-T05-S02) — noldan qayta tekshirildi (oldingi tugamagan QA natijalariga TAYANILMADI; 5 mezon board'da false dan boshlandi). VERDIKT: QAYTARILDI (in_progress). 5/5 mezon IJRO bilan tasdiqlandi va mutatsiya bilan o'ldirildi, LEKIN `/suppliers/me` EGALIK tekshiruvi test bilan qamralmagan — mutatsiya OMON QOLDI. == TESTLAR (baseline, restore'dan keyin ham) == LoginServiceIntegrationTest: Tests run 15, Failures 0, Errors 0 SupplierSelfControllerIntegrationTest: Tests run 5, Failures 0, Errors 0 == MUTATSIYA SINOVI (har biri qaytarildi, git diff HEAD -- src/ BO'SH) == M1 SupplierAudienceOwnershipAdapter.java:56 `default -> false` => `true` O'LDI (2 test): ownershipConditionNotMetReturnsAudienceMismatchWithoutSessionOrCounterChange (403 kutildi, 200 keldi), genericAudienceMismatchAuthLogHasAudienceMismatchReason (auth_logs status '403' kutildi, null keldi). => AC1730 haqiqiy. M2 :54 `existsActiveByUserId` => `existsByUserId` (active sharti olib tashlandi) O'LDI (1 test, aynan to'g'ri test): partnerLinkedToInactiveSupplierGetsAudienceMismatch (403 kutildi, 200 keldi). => AC1728 `active=true` shartini haqiqatan ushlaydi (01_suppliers §5 qoida 2(a)). M3+M4 :53 `AUDIENCE_WEB -> false` va :54 `AUDIENCE_SUPPLIER -> false` O'LDI (5 test): 4 ta web login testi (successfulWebLoginCreatesSessionWith..., invitedUserBecomesActive..., bootstrapOwnerLike..., deviceIdAndDeviceInfo...) => AC1731; partnerLinkedToActiveSupplierLogsInSuccessfullyWithSupplierAudience (200 kutildi, 403 keldi) => AC1727. M6 :54 `AUDIENCE_SUPPLIER -> true` O'LDI (2 test): partnerLinkedToInactiveSupplierGetsAudienceMismatch, partnerWithNoLinkedSupplierAtAllGetsAudienceMismatch => AC1729 haqiqiy. == 🔴 DEFEKT — MUTATSIYA OMON QOLDI == Fayl: src/main/java/uz/erpbom/suppliers/service/SupplierSelfService.java:68 Mutatsiya: `supplierRepository.findByUserId(userId)` => `supplierRepository.findAll().stream().findFirst()` Ya'ni egalik tekshiruvi BUTUNLAY o'chirildi — metod userId ni umuman ishlatmaydi va jadvaldagi BIRINCHI ta'minotchini kimga bo'lsa ham qaytaradi. Natija: SupplierSelfControllerIntegrationTest — Tests run 5, Failures 0, Errors 0 (EXIT=0). Test bu jiddiy xavfsizlik nuqsonini KO'RMADI. SABABI (2 ta bo'shliq, ikkalasi ham src/test/java/uz/erpbom/suppliers/controller/SupplierSelfControllerIntegrationTest.java da): 1) :99-101 va :131-133 — har ikki egalik testida ta'minotchi A BIRINCHI yaratiladi (createSupplier("Alfa...") / createSupplier("Gamma...")), so'ng B; so'rov FAQAT A ning tokeni bilan yuboriladi. A doim jadvaldagi 1-qator bo'lgani uchun buzuq `findFirst()` ham aynan A ni qaytaradi — assertlar farqni sezmaydi. "B ning nomi javobda yo'q" asserti ham shu sababdan omon qoladi. Kerak: B ning tokeni bilan ham so'rov yuborilsin va javobda supplier.id == supplierBId, supplier.name == B ekani tasdiqlansin (yoki A ikkinchi qilib yaratilsin). Hozircha egalik predikati ijro bilan ISBOTLANMAGAN. 2) :152-171 — getMyProfileWithoutLinkedSupplierReturnsForbidden va listMyContractsWithoutLinkedSupplierReturnsForbidden BO'SH suppliers jadvalida ishlaydi (cleanState() hammasini o'chiradi, bu testlar ta'minotchi yaratmaydi). Shuning uchun 403 vakuum tarzda keladi — har qanday buzuq qidiruvda ham o'tadi. Kerak: bog'lanmagan partner testida DB da BOSHQA ta'minotchi(lar) MAVJUD bo'lsin, shundagina 403 FORBIDDEN egalik sababli ekani isbotlanadi. Mezon: topshiriq gate'i — "begona hamkor (boshqa ta'minotchiga bog'langan yoki hech qaysi ta'minotchiga bog'lanmagan partner user) boshqa ta'minotchi ma'lumotini ola olmasligi TEST IJROSIDA ko'rinsin". Bajarilmagan. == SPEC / KONTRAKT MUVOFIQLIGI (bularda muammo YO'Q) == - 01_suppliers §5 qoida 2(a) `active=true` sharti — SupplierRepository.existsActiveByUserId JPQL da bor va M2 bilan tasdiqlandi. - StubAudienceOwnershipPort haqiqatan o'chirilgan (auth/service/ da yo'q); LoginService imzosi/chaqiruvi o'zgarmagan (audienceOwnershipPort.isEligible, LoginService.java:183). - Xato kodlari kontraktga mos: login => 403 AUDIENCE_MISMATCH (common.yaml/09_auth R53); /suppliers/me => 403 FORBIDDEN (openapi/v1/suppliers.yaml:66-69 "AUDIENCE_MISMATCH kodi bu yerda takrorlanmaydi") — test aynan "FORBIDDEN" ni assert qiladi. - SupplierSelfResponse maydonlari kontrakt bilan mos: required [supplier, active_contract] (suppliers.yaml:1242-1247), JSON'da snake_case `active_contract`. - @Transactional(readOnly = true) — SupplierSelfService ikkala o'qish metodida bor. - openapi/ ga TEGILMADI (EP-03-T03 worker'ining staged fayli). == TIKLASH TASDIG'I == Har mutatsiyadan keyin `git checkout -- <aniq fayl>`; yakunda `git diff HEAD -- src/` => BO'SH. `git status --short` => faqat `A openapi/v1/suppliers.yaml` (parallel worker EP-03-T03 ники, tegilmagan). Restore'dan keyin qayta yurgizildi: 15/15 + 5/5 yashil. == KICHIK KUZATUV (bloklamaydi) == AC1730 dagi `customer` audience uchun alohida end-to-end test yo'q (user_type='customer' + audience='customer'). Kod darajasida bu employee/driver bilan AYNAN bitta `default ->` tarmog'i, shuning uchun M1 uni ham qamraydi — defekt deb hisoblanmadi. QILINADIGAN ISH: yuqoridagi 1) va 2) bo'shliqlarini SupplierSelfControllerIntegrationTest da yoping, so'ng qayta review'ga qo'ying. Tekshirish usuli: SupplierSelfService.java:68 ni `findAll().stream().findFirst()` ga o'zgartirganda test YIQILISHI shart.

qa-ep-03-t05-s02 statusni o'zgartirdi Review → Ishlanyapti

qa-ep-03-t05-s02 qabul mezonini belgiladi

✓ `web` audience xatti-harakati o'zgarmagan (EP-09 testlari yashil qoladi)

qa-ep-03-t05-s02 qabul mezonini belgiladi

✓ `employee`/`driver`/`customer` audience'lari hamon `false` qaytaradi (regressiya yo'q — o'z modullari kutilmoqda)

qa-ep-03-t05-s02 qabul mezonini belgiladi

✓ Hech qaysi ta'minotchiga bog'lanmagan `partner` user `403 AUDIENCE_MISMATCH` oladi

qa-ep-03-t05-s02 qabul mezonini belgiladi

✓ `suppliers.active=false` bo'lgan ta'minotchining useri `403 AUDIENCE_MISMATCH` oladi (§12 AC: nofaol ta'minotchi mobil ilovaga kira olmaydi)

qa-ep-03-t05-s02 qabul mezonini belgiladi

✓ Faol ta'minotchiga bog'langan `partner` user `audience='supplier'` bilan MUVAFFAQIYATLI login qiladi (EP-09 dagi doimiy `403 AUDIENCE_MISMATCH` yopildi)

worker-ep-03-t05 qabul mezonini belgiladi

✗ `web` audience xatti-harakati o'zgarmagan (EP-09 testlari yashil qoladi)

worker-ep-03-t05 qabul mezonini belgiladi

✗ `employee`/`driver`/`customer` audience'lari hamon `false` qaytaradi (regressiya yo'q — o'z modullari kutilmoqda)

worker-ep-03-t05 qabul mezonini belgiladi

✗ Hech qaysi ta'minotchiga bog'lanmagan `partner` user `403 AUDIENCE_MISMATCH` oladi

worker-ep-03-t05 qabul mezonini belgiladi

✗ `suppliers.active=false` bo'lgan ta'minotchining useri `403 AUDIENCE_MISMATCH` oladi (§12 AC: nofaol ta'minotchi mobil ilovaga kira olmaydi)

worker-ep-03-t05 qabul mezonini belgiladi

✗ Faol ta'minotchiga bog'langan `partner` user `audience='supplier'` bilan MUVAFFAQIYATLI login qiladi (EP-09 dagi doimiy `403 AUDIENCE_MISMATCH` yopildi)

coder-ep-03-t05-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-03-t05-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-03-t05-s02 izoh qoldirdi

AudienceOwnershipPort haqiqiy: web=true, supplier=EXISTS(suppliers.user_id=:userId AND active=true) (SupplierRepository.existsActiveByUserId), employee/driver/customer=false (stub semantikasi saqlandi). StubAudienceOwnershipPort o.chirildi, o.rniga suppliers.service.SupplierAudienceOwnershipAdapter (yagona bean). GET /suppliers/me va /suppliers/me/contracts qo.shildi (SupplierSelfController/Service, RULE emas EGALIK bilan himoya, @RequirePermission yo.q) - kontraktdagi mavjud endpoint, SupplierContract* fayllariga tegmasdan SupplierContractService.list() orqali qayta ishlatildi. Test: LoginServiceIntegrationTest (+3 yangi: active/inactive/unlinked supplier login) va yangi SupplierSelfControllerIntegrationTest (ikkita supplier + ikkita partner user bilan haqiqiy egalik izolyatsiyasi, begona ma.lumot javobda yo.qligi assert qilingan) - jami 20 test yashil.

coder-ep-03-t05-s02 qabul mezonini belgiladi

✓ `web` audience xatti-harakati o'zgarmagan (EP-09 testlari yashil qoladi)

coder-ep-03-t05-s02 qabul mezonini belgiladi

✓ `employee`/`driver`/`customer` audience'lari hamon `false` qaytaradi (regressiya yo'q — o'z modullari kutilmoqda)

coder-ep-03-t05-s02 qabul mezonini belgiladi

✓ Hech qaysi ta'minotchiga bog'lanmagan `partner` user `403 AUDIENCE_MISMATCH` oladi

coder-ep-03-t05-s02 qabul mezonini belgiladi

✓ `suppliers.active=false` bo'lgan ta'minotchining useri `403 AUDIENCE_MISMATCH` oladi (§12 AC: nofaol ta'minotchi mobil ilovaga kira olmaydi)

coder-ep-03-t05-s02 qabul mezonini belgiladi

✓ Faol ta'minotchiga bog'langan `partner` user `audience='supplier'` bilan MUVAFFAQIYATLI login qiladi (EP-09 dagi doimiy `403 AUDIENCE_MISMATCH` yopildi)

coder-ep-03-t05-s02 fayllarni qayd etdi

9 ta fayl qayd etildi

coder-ep-03-t05-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-03-t05-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-03-T05-S01

pm-agent yaratdi

`AudienceOwnershipPort` — supplier implementatsiyasi (stub o'rniga)