RBAC maskalash — `employee_salary.view` bo'lmasa maosh javobda YO'Q

finalize-ep-06 yangiladi

Yangilandi: commit_sha, pr_url

finalize-ep-06 statusni o'zgartirdi Ishlanyapti → Bajarildi

finalize-ep-06 statusni o'zgartirdi Bloklangan → Ishlanyapti

finalize-ep-06 statusni o'zgartirdi Ishlanyapti → Bloklangan

FINALIZE EP-06 drift gate (scripts/openapi-diff.sh v1/employees) — verdikt: BLOCKING (exit=1), A toifasida current_salary maydoni "properties.deleted" bo'lib chiqdi: kontrakt e'lon qilgan kalitni springdoc generatsiya qilgan hujjatda TOPMAYDI. Sabab: kalit RBAC bo'yicha shartli qilingan — @JsonIgnore + @JsonAnyGetter naqshi (EmployeeResponse + EmployeePage.items), springdoc @JsonAnyGetter chiqaradigan kalitlarni ko'rmaydi. Xatti-harakat TO'G'RI (huquq bo'lsa kalit real javobda bor), lekin HUJJAT kontraktdan chetda — bu A toifasi va baseline bilan "qabul qilib" bo'lmaydi (write-baseline A ni ataylab yozmaydi). Kerakli tuzatish KODDA (kontrakt daxlsiz): shartli kalitni springdoc'ga ko'rsatish — mas. @Schema bilan e'lon qilingan xossa yoki OpenApiCustomizer/ModelConverter orqali qo'shish. Finalize agenti kodni tuzatmaydi (epic-finalize qoida 1).

finalize-ep-06 statusni o'zgartirdi Bajarildi → Ishlanyapti

finalize EP-06 — drift A toifasi

qa-ep-06-t05-s02 izoh qoldirdi

QA (qa-EP-06-T05-S02) — mustaqil tekshiruv, commit 388b54e, branch feat/EP-06-erpbom-backend. VERDIKT: done. 1) Kontrakt muvofiqligi (employees.yaml ~429-437, ~1588-1598) — javob shakli mos; kontrakt fayli commit'da TEGILMAGAN (git show --stat -- openapi/ bo'sh). Spec 04_employees.md §7: `employee_salary.view` `employee.view`dan ajratilgan — bajarilgan. 2) JSON kaliti AYNAN `current_salary` — tasdiqlandi. EmployeeResponse.java:60 `field.put("current_salary", currentSalary)` — @JsonAnyGetter map kaliti literal yoziladi (global snake_case strategiyasiga bog'liq emas), va testlar xom `objectMapper.readTree(response.getBody())` → `JsonNode.has("current_salary")` bilan aynan shu satrni tekshiradi. AC2888 esa `json.get("current_salary").get("amount")` ni o'qiydi — demak HTTP tanasida `"current_salary":{"amount":...}` haqiqatan bor. DTO'ga deserializatsiya YO'Q — kalit yo'qligi yashirilmagan. 3) Uch holat ajratilgan: (a) huquqsiz → kalit yo'q; (b) huquq bor, maosh yo'q → kalit bor, null; (c) huquq bor, maosh bor → to'liq obyekt. Naqsh VariantOperationNormResponse (T04) bilan bir xil: @JsonIgnore currentSalary/currentSalaryVisible + @JsonAnyGetter shartli kalit. 4) AC2890 markazlashuv — butun kod bazasida `new EmployeeResponse(` FAQAT BITTA joyda: EmployeeService.java:494 (buildResponses). Ko'rinuvchanlik buildResponses:466 da bir marta hisoblanadi. create/update/list/get/toResponse BESHALASI buildResponse orqali shu quvurdan o'tadi — demak activate/suspend/fire (EmployeeController:114/120/126 → employeeService.toResponse) javoblari ham maskalanadi. Controller'da takror yo'q. 5) Fail-closed tasdiqlandi (EmployeeService.java:530-538): authentication == null || !isAuthenticated() || principal instanceof AuthenticatedUser emas → false (kalit ko'rinmaydi), NPE emas, `true` emas. Anonim token ham principal turi bo'yicha yiqiladi. 6) MUTATSIYA TEKSHIRUVI — uchalasi ham USHLANDI (har biri javap bilan bytecode darajasida tasdiqlangan, keyin asliga qaytarilgan, git status --porcelain bo'sh): (a) resolveCurrentSalaryVisible() → har doim true: YIQILDI 2 test — gettingWithViewPermissionButWithoutSalaryPermissionOmitsCurrentSalaryKey (AC2887), listingWithoutSalaryPermissionOmitsCurrentSalaryKeyForEveryItem (AC2890). (b) → har doim false: YIQILDI 3 test — gettingWithSalaryPermissionAndSalarySetReturnsFullValue (AC2888), gettingWithSalaryPermissionButNoSalarySetReturnsNullValue (AC2889), listingWithSalaryPermissionIncludesCurrentSalaryKeyForEveryItem (AC2890). (c) @JsonAnyGetter'dan bayroq tekshiruvi olib tashlandi (kalit har doim qo'shiladi): YIQILDI 2 test — AC2887 va AC2890 ro'yxat testi. Ya'ni testlar soxta emas — har uch yolg'onni ushlaydi. 7) Testlar (flock ostida, mvn clean ISHLATILMADI): EmployeeControllerIntegrationTest — Tests run: 21, Failures: 0, Errors: 0 EmployeeServiceTest — Tests run: 15, Failures: 0, Errors: 0 EmployeeSalaryControllerIntegrationTest — Tests run: 13, Failures: 0, Errors: 0 EmployeeSalaryServiceTest — Tests run: 7, Failures: 0, Errors: 0 Mutatsiyadan keyin asliga qaytarilib qayta yurgizildi — hammasi yashil, bytecode asl holatda (getfield currentSalaryVisible; ifne). 8) Sizib chiqish sweep: EmployeeResponse'ni serializatsiya qiladigan yagona yo'l — EmployeeController. EmployeeSalaryResponse alohida faqat EmployeeSalaryController orqali chiqadi va u @RequirePermission("employee_salary.view") bilan yopiq (S01 zonasi, qayta baholanmadi). Eslatma (defekt EMAS): coder to'g'ri aytgan — Java accessor EmployeeResponse.currentSalary() huquqdan qat'i nazar haqiqiy qiymat qaytaradi, shu sabab EmployeeServiceTest:276/293 kabi servis-darajasidagi assert'lar bu barg uchun dalil emas. Haqiqiy dalil faqat yuqoridagi HTTP + xom JSON testlarida — ular bor va mutatsiyaga chidamli.

qa-ep-06-t05-s02 statusni o'zgartirdi Review → Bajarildi

qa-ep-06-t05-s02 qabul mezonini belgiladi

✓ Ro'yxat javobida ham xuddi shu maskalash amal qiladi (bitta markazlashgan joy, har controller'da takrorlanmagan)

qa-ep-06-t05-s02 qabul mezonini belgiladi

✓ Maoshi belgilanmagan hodimda (huquq BOR) maydon `null` — ya'ni "yo'q maydon" va "null qiymat" farqlanadi

qa-ep-06-t05-s02 qabul mezonini belgiladi

✓ Huquq bilan — maosh maydoni to'liq qaytadi

qa-ep-06-t05-s02 qabul mezonini belgiladi

✓ `employee_salary.view` siz `GET /employees/{id}` javobida maosh maydoni UMUMAN yo'q (JSON kalitning o'zi yo'q)

coder-ep-06-t05-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-06-t05-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-06-t05-s02 qabul mezonini belgiladi

✓ Ro'yxat javobida ham xuddi shu maskalash amal qiladi (bitta markazlashgan joy, har controller'da takrorlanmagan)

coder-ep-06-t05-s02 qabul mezonini belgiladi

✓ Maoshi belgilanmagan hodimda (huquq BOR) maydon `null` — ya'ni "yo'q maydon" va "null qiymat" farqlanadi

coder-ep-06-t05-s02 qabul mezonini belgiladi

✓ Huquq bilan — maosh maydoni to'liq qaytadi

coder-ep-06-t05-s02 qabul mezonini belgiladi

✓ `employee_salary.view` siz `GET /employees/{id}` javobida maosh maydoni UMUMAN yo'q (JSON kalitning o'zi yo'q)

coder-ep-06-t05-s02 fayllarni qayd etdi

3 ta fayl qayd etildi

coder-ep-06-t05-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-06-t05-s02 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-06-T05-S01

pm-agent yaratdi

RBAC maskalash — `employee_salary.view` bo'lmasa maosh javobda YO'Q