Hujjatni ko'rish (imzolangan havola) + soft-delete

finalize-ep-08 yangiladi

Yangilandi: pr_url

qa-ep-08-t04-s02 statusni o'zgartirdi Review → Bajarildi

qa-ep-08-t04-s02 izoh qoldirdi

QA mutatsiya tekshiruvi (izolyatsiyalangan worktree). Baza: 36 tests, 0 failures. M1 repository search()dan `deletedAt IS NULL` (2 joy) olib tashlandi -> 2 yiqildi: listingDocumentsExcludesSoftDeletedRows, deletingDocument...KeepsMinioObject. javap: bytecodeda filtr 0 marta. AC3482 (ro`yxat) qamralgan. M2 getDownloadUrl deleted_atni e`tiborsiz qoldirdi (mijozga tegishlilik saqlandi) -> 1 yiqildi: deletingDocument...KeepsMinioObject. AC3482 (404 havola) qamralgan. M3 delete() oqimiga fizik StorageClient.delete(fileKey) qo`shildi -> 1 yiqildi, aynan MinIO round-trip assertida (test:678, expected 200 but was 404). Test mock verify EMAS - haqiqiy presigned GET bilan obyekt mavjudligini va mazmunini tekshiradi. AC3483 qamralgan. M4 @RequirePermission("customer_document.view") -> "customer.view" -> 6 yiqildi, jumladan downloadingWithOnlyCustomerViewPermissionReturnsForbidden. AC3484 ning "customer.view OCHMAYDI" qismi aynan test bilan qamralgan (customerViewOnlyToken fixture). M5 @RequirePermission butunlay olib tashlandi -> 3 yiqildi: noPerm/uploadOnly/customerViewOnly. javap: annotatsiya metod bytecodeda yo`q. Fixture xilma-xilligi: huquq fixturalari haqiqatan farqli (noPerm / uploadOnly / customerViewOnly / deleter); soft-delete ikki xil yo`l bilan qo`zg`atilgan (to`g`ridan-to`g`ri SQL va API DELETE). Cross-cutting: @Transactional(readOnly=true) o`qishda, @Transactional yozishda; fizik DELETE yo`q; deleted_at soft-delete; presigned URL log`ga yozilmaydi. Kontrakt: FileDownloadResponse {url, expires_at} DTO bilan mos; 403 FORBIDDEN / 404 NOT_FOUND / 204 kodlari testda tasdiqlangan. Mutantlar cp <fayl>.orig bilan tiklandi; grep -rn MUTANT src/ bo`sh; worktree o`chirildi. Tiklashdan keyingi yakuniy yurgizish: 36 tests, 0 failures.

qa-ep-08-t04-s02 qabul mezonini belgiladi

✓ `customer_document.view` huquqisiz havola so'rovi 403; `customer.view` huquqi buni OCHMAYDI

qa-ep-08-t04-s02 qabul mezonini belgiladi

✓ MinIO'dagi obyekt soft-delete'dan keyin ham mavjud (fizik o'chirilmaganini tasdiqlovchi test)

qa-ep-08-t04-s02 qabul mezonini belgiladi

✓ Soft-delete qilingan hujjat ro'yxatda yo'q va havola so'rovi 404 qaytaradi

coder-ep-08-t04-s02 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-08-t04-s02 izoh qoldirdi

Mavjud CustomerDocument* qatlami kengaytirildi (parallel yangi qatlam yaratilmadi). GET .../documents/{documentId}/download -> customer_document.view (upload/customer.view buni bermaydi), 5 daqiqalik presigned havola FileDownloadService orqali. DELETE .../documents/{documentId} -> customer_document.delete, soft-delete (deleted_at), MinIO obyekti FIZIK o'chirilmaydi. CustomerDocumentRepository.findByIdAndCustomerIdAndDeletedAtIsNull qo'shildi (boshqa mijoz hujjatiga yoki soft-delete qilinganiga 404). Test: CustomerDocumentControllerIntegrationTest 23->36 test, hammasi yashil (real Postgres Testcontainers + real dev MinIO). Mutatsiya tekshiruvi (qo'lda kiritib-tiklab): (1) repository dan deletedAt filtri olib tashlansa -> 2 test yiqiladi; (2) DELETE endpoint @RequirePermission delete->upload almashtirilsa -> 5 test yiqiladi; (3) download endpoint view->customer.view almashtirilsa -> 6 test yiqiladi; (4) PRESIGNED_URL_TTL 5->10 daqiqa qilinsa -> yangi expires_at tolerantlik testi yiqiladi (bu testni ATAYLAB qo'shdim, chunki eski X-Amz-Expires tekshiruvi FileDownloadService ning O'Z ichki konstantasini tekshiradi, javobdagi expires_at maydonini emas). Barcha mutantlar cp bilan tiklandi, grep -rn MUTANT src/ bo'sh.

coder-ep-08-t04-s02 yangiladi

Yangilandi: branch, commit_sha

coder-ep-08-t04-s02 fayllarni qayd etdi

5 ta fayl qayd etildi

coder-ep-08-t04-s02 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-08-t04-s02 ishga oldi

pm-agent yaratdi

Hujjatni ko'rish (imzolangan havola) + soft-delete