Mijozga login berish / uzish (`customer_account.manage`)

finalize-ep-08 yangiladi

Yangilandi: pr_url

qa-ep-08-t06-s01 statusni o'zgartirdi Review → Bajarildi

qa-ep-08-t06-s01 izoh qoldirdi

QA (qa-EP-08-T06-S01) — QABUL QILINDI. Izolyatsiyalangan git worktree (5b67480), mutatsiya bilan tekshirildi. TESTLAR: CustomerCredentialsControllerTest 18/18 yashil (Testcontainers, real PG16). AC3502 uchun qoshimcha: CustomerCreateTest 11, CustomerQueryTest 20, CustomerToggleActiveTest 16 — jami 65 test, 0 failure. MUTATSIYA (har mezon uchun "bu testni nima qoriqlaydi?"): - M1 yaratilgan user_type customer->partner => grantWithNewAccountFieldsCreatesCustomerUserAndLinks:138 YIQILDI (expected customer, was partner). AC3500 (yaratish). - M2 customer.setUserId(...) olib tashlandi => 4 test YIQILDI (:142 readCustomerUserId, :163 boglash ssenariysi, :181, :228). AC3500 ikkala ssenariyda DB ustuni darajasida tasdiqlandi — javob tanasi emas, customers.user_id oqiladi. - M4 user_type gardi olib tashlandi => grantWithInternalUserReturns409UserNotCustomer:196 va grantWithPartnerUserReturns409UserNotCustomer:210 YIQILDI (201 CREATED). AC3501 hodim/taminotchi shoxobchasi. - M3b customers pre-check + 409 tarjimasi olib tashlandi => grantWithUserAlreadyLinkedToAnotherCustomerReturns409:181 YIQILDI. AC3501 boshqa mijoz shoxobchasi. - M5 log.info("...password={}", request.password()) qoshildi => passwordTextNeverAppearsInNotificationOrLoggingCode:402 YIQILDI. AC3503 grep testi TAUTOLOGIK EMAS. UCHALA JADVAL (customers/employees/suppliers) — kod darajasida: CustomerCredentialsService.java:150 faqat customers ni soraydi (existsByUserId) + uq_customers_user_id indeksi. employees/suppliers SORALMAYDI; himoya TRANZITIV va butun: V4__users_and_currencies.sql:39-40 chk_users_user_type CHECK (internal|partner|customer); EmployeeService.java:389 internal talab qiladi, SupplierCredentialsService.java:150 partner talab qiladi, CustomerCredentialsService.java:146 customer talab qiladi. user_type YARATILGANDAN KEYIN OZGARMAYDI (UserUpdateRequest faqat fullName+phone; setUserType faqat UserService.create:122 va BootstrapOwnerService:106). Demak hodim/taminotchiga bogli user hech qachon user_type=customer bola olmaydi -> 409 USER_NOT_CUSTOMER bilan rad etiladi. AC3501 "rad etiladi" talabi bajarilgan; kontrakt CredentialsConflict ikkala kodni ham hujjatlashtirgan, ustuvorlikni belgilamagan. AC3502: customers.user_id majburiy qiluvchi joy YOQ — butun customers modulida getUserId() tekshiruvi faqat CustomerCredentialsService:75 (CUSTOMER_ALREADY_HAS_CREDENTIALS) va :108 (revoke 404) da; Customer.userId oddiy nullable Long, @NotNull yoq. 47 ta mavjud test (create/query/toggle_active) akkauntsiz mijoz bilan yashil. KONTRAKT: 201/204/400/404/409 va toartala 409 kodi (CUSTOMER_ALREADY_HAS_CREDENTIALS, USER_ALREADY_LINKED, USER_NOT_CUSTOMER, BUSINESS_CONFLICT) aynan mos; javob maydonlari customer_id/user_id/username/user_type/user_status; 400 da fields[].field=user_id. Javobda password maydoni YOQ (test :146). RULE: @RequirePermission("customer_account.manage") — CustomerCredentialsController.java:42 va :52 da HAQIQIY annotatsiya (javadoc :31 alohida); uch segmentli variant kodda yoq; seed R__permissions_and_currencies_seed.sql:105. Runtime isboti: ruxsatsiz token -> 403 (:306, :318), ruxsatli token -> 201/204. CROSS-CUTTING: @Transactional grant/revoke da bor; tenant_id/schema mexanikasi qoshilmagan (AR-1); outbox/notification chiqarilmagan (kontrakt talabi); fizik DELETE yoq (revoke user_id=NULL, users qatori tegilmaydi — test :339); parol logga tushmaydi. KICHIK KUZATUVLAR (bloklamaydi, keyingi ish uchun): (1) CustomerCredentialsService:150 dagi existsByUserId pre-check ni ochirsam butun toplam yashil qoldi (javap bilan tasdiqlandi: bytecode da existsByUserId yoq) — u uq_customers_user_id ustidan ortiqcha himoya, alohida testi yoq; xatti-harakat ozgarmaydi. (2) CustomerCredentialsRequest.phone @Size(max=30), kontraktda maxLength 32 — users.phone varchar(30) ga mos, SupplierCredentialsRequest:45 bilan bir xil qabul qilingan naqsh. (3) boglash ssenariysida user_status assert qilinmagan (yaratishda qilingan) — mezon emas. (4) AC3503 grep testi QATOR darajasida ishlaydi: LoggerFactory.getLogger(x).info(...) yoki kop qatorli chaqiruvni ushlamaydi. Worktree /var/tmp/qa-EP-08-T06-S01 ochirildi, git worktree list toza, asosiy daraxtda MUTANT/.orig qoldiq yoq, git status toza.

qa-ep-08-t06-s01 qabul mezonini belgiladi

✓ Kod hech qayerda parol/login matnini notification yoki log'ga yozmaydi (grep testi)

qa-ep-08-t06-s01 qabul mezonini belgiladi

✓ Akkauntsiz mijoz bilan barcha mavjud oqimlar ishlaydi (AC11)

qa-ep-08-t06-s01 qabul mezonini belgiladi

✓ Boshqa mijozga (yoki hodim/ta'minotchiga) biriktirilgan `user_id` ni qayta biriktirishga urinish rad etiladi

qa-ep-08-t06-s01 qabul mezonini belgiladi

✓ Akkaunt biriktirilgach `customers.user_id` to'ladi va `users.user_type='customer'` bo'ladi

coder-ep-08-t06-s01 yangiladi

Yangilandi: branch, commit_sha

coder-ep-08-t06-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-08-t06-s01 izoh qoldirdi

POST/DELETE /api/v1/customers/{id}/credentials — kontraktga (customers.yaml) aynan mos, EP-03 SupplierCredentials naqshi takrorlandi. Migratsiya kerak emas — customers.user_id + uq_customers_user_id V30da allaqachon bor. Rule customer_account.manage seedda mavjud. 18 test yashil (CustomerCredentialsControllerTest, real Postgres/Testcontainers): yaratish/bog'lash, CUSTOMER_ALREADY_HAS_CREDENTIALS, USER_NOT_CUSTOMER (internal/partner user turlari uchun ham), USER_ALREADY_LINKED (race + pre-check), BUSINESS_CONFLICT (username band), cross-field 400, 404lar, 403 (rule siz), DELETE user qatoriga tegmaydi, AC3503 uchun qator darajasidagi grep-testi. R12(c) (active=false -> user bloklash) bu barga kirmaydi — spec o'zi 'taklif, tasdiq kutilmoqda' deb belgilagan, implement qilinmadi.

coder-ep-08-t06-s01 qabul mezonini belgiladi

✓ Kod hech qayerda parol/login matnini notification yoki log'ga yozmaydi (grep testi)

coder-ep-08-t06-s01 qabul mezonini belgiladi

✓ Akkauntsiz mijoz bilan barcha mavjud oqimlar ishlaydi (AC11)

coder-ep-08-t06-s01 qabul mezonini belgiladi

✓ Boshqa mijozga (yoki hodim/ta'minotchiga) biriktirilgan `user_id` ni qayta biriktirishga urinish rad etiladi

coder-ep-08-t06-s01 qabul mezonini belgiladi

✓ Akkaunt biriktirilgach `customers.user_id` to'ladi va `users.user_type='customer'` bo'ladi

coder-ep-08-t06-s01 fayllarni qayd etdi

6 ta fayl qayd etildi

coder-ep-08-t06-s01 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-08-t06-s01 ishga oldi

pm-agent yaratdi

Mijozga login berish / uzish (`customer_account.manage`)