`ProfessionController` — REST + RBAC (`profession.manage`)

finalize-ep-06 yangiladi

Yangilandi: pr_url

qa-ep-06-t02-s02 statusni o'zgartirdi Review → Bajarildi

qa-ep-06-t02-s02 izoh qoldirdi

QA (qa-EP-06-T02-S02) — commit 6504a80. Hamma mezon tekshirildi, test yashil: ProfessionControllerIntegrationTest — Tests run: 12, Failures: 0, Errors: 0. KOD DARAJASIDA (grep emas, javap bytecode): ProfessionController.class constant pool: #79=Luz/erpbom/auth/security/RequirePermission;, #41="profession.manage", #85=Ljakarta/validation/Valid; - list() / get() -> RuntimeVisibleAnnotations FAQAT #64 (GetMapping); RequirePermission YO'Q (SectorController naqshi). - create() -> #79(value=#41) + #80 PostMapping + #81 ResponseStatus(CREATED); @Valid param 0 da. - update() -> #79(value=#41) + #88 PutMapping(/{id}); @Valid param 1 da. - activate()/deactivate() -> #79(value=#41) + PostMapping(/{id}/activate, /{id}/deactivate). YANGI RULE YO'Q: R__permissions_and_currencies_seed.sql da faqat profession.manage (79-qator) va profession.assign (80-qator). profession.view seed'da YO'Q (faqat javadoc/kontrakt izohida matn sifatida). 6504a80 diff'i 2 fayl — migratsiya/seed'ga tegilmagan. 04_employees.md #7 katalogi bilan mos. MUTATSIYA (buzib ko'rildi, yiqildi, git checkout bilan tiklandi — izolyatsiyalangan git worktree'da, parallel agent target/ siga tegmasdan): 1) create() dan @RequirePermission(MANAGE_PERMISSION) olindi -> creatingWithoutManagePermissionReturnsForbiddenAndAudits YIQILDI (expected 403, but was 201). AC2832 testi yolg'onni ushlaydi. 2) update() dan @Valid olindi -> updatingWithoutPickingFlagReturnsValidationError va updatingWithoutDriverFlagReturnsValidationError YIQILDI (expected 400, but was 409). Blok sababi bo'lgan PUT 400 talabi HTTP darajasida haqiqatan qopланган. 3) list() ga @RequirePermission qo'shildi -> listingIsAllowedWithoutManagePermissionAndReturnsCreatedProfession YIQILDI (expected 200, but was 403). AC2833 "GET rule'siz" invariantini himoya qiladi. Uchala holatda ham qolgan testlar yashil qoldi — assert'lar tor va tautologik emas. MEZONLAR: AC2832 ✓ — plainUserToken bilan POST -> 403 FORBIDDEN + countDenyAuthLogs(plainUserId,'profession.manage') = 1 (auth_logs, result='deny'). Yozuv RequirePermissionAspect orqali, sinxron, ForbiddenException'dan OLDIN. AC2833 ✓ — huquqsiz autentifikatsiyalangan user GET /api/v1/professions -> 200, ro'yxatda yaratilgan kasb topildi. AC2834 ✓ — tokensiz GET -> 401. SecurityConfig PUBLIC_PATHS da professions YO'Q, anyRequest().authenticated() qoplaydi. AC2835 ✓ — openapi/v1/employees.yaml bilan drift yo'q: yo'llar (/api/v1/professions, /{id}, /{id}/activate, /{id}/deactivate), status kodlar (POST 201, qolgani 200, 400/401/403/404/409), query paramlar (page,size,sort,active,wage_type,is_picking,is_driver,name), sxema (ProfessionResponse 8 maydon snake_case; ProfessionCreateRequest required=[name,wage_type] + flaglar default false; ProfessionUpdateRequest required=[name,wage_type,is_picking,is_driver] -> DTO'da @NotNull Boolean, primitiv boolean EMAS). ESLATMA (defekt emas): tekshiruv paytida repo'da EP-06-T02-S03 ning yakunlanmagan o'zgarishlari bor edi va src/test/.../RecipeVersionServiceTest.java kompilyatsiyadan o'tmadi (RecipeVersionService konstruktori 11 arg, test 10 arg beradi). Bu S02 ga aloqasiz — S03 agenti tugatganda yopiladi. ProfessionService'ning S03 diff'i faqat qo'shimcha (getWageType/namesByIds), S02 yo'llariga ta'sir qilmaydi.

qa-ep-06-t02-s02 qabul mezonini belgiladi

✓ Kontrakt bilan drift yo'q (yo'l, status kod, sxema)

qa-ep-06-t02-s02 qabul mezonini belgiladi

✓ Autentifikatsiyasiz `GET /professions` → 401

qa-ep-06-t02-s02 qabul mezonini belgiladi

✓ Huquqsiz (lekin autentifikatsiyalangan) foydalanuvchi `GET /professions` dan 200 oladi

qa-ep-06-t02-s02 qabul mezonini belgiladi

✓ `profession.manage` siz `POST /professions` → 403 va `auth_logs` ga `deny` yoziladi (mavjud aspekt orqali)

coder-ep-06-t02-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-06-t02-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-06-t02-s02 qabul mezonini belgiladi

✓ Kontrakt bilan drift yo'q (yo'l, status kod, sxema)

coder-ep-06-t02-s02 qabul mezonini belgiladi

✓ Autentifikatsiyasiz `GET /professions` → 401

coder-ep-06-t02-s02 qabul mezonini belgiladi

✓ Huquqsiz (lekin autentifikatsiyalangan) foydalanuvchi `GET /professions` dan 200 oladi

coder-ep-06-t02-s02 qabul mezonini belgiladi

✓ `profession.manage` siz `POST /professions` → 403 va `auth_logs` ga `deny` yoziladi (mavjud aspekt orqali)

coder-ep-06-t02-s02 fayllarni qayd etdi

2 ta fayl qayd etildi

coder-ep-06-t02-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-06-t02-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-06-T02-S01

pm-agent yaratdi

`ProfessionController` — REST + RBAC (`profession.manage`)