Sessiya va audit ekranlari API (user_session.view/.revoke, auth_log.view)

team-lead-ep-09 yangiladi

Yangilandi: pr_url

team-lead-ep-09 izoh qoldirdi

Faza D drift qayta tekshiruvi (2-urinish): xuddi shu tooling sababi (@Pattern String vs named enum $ref, bu safar actor_type/result auth_logs maydonlari) -- T05-S01 izohiga qarang. Kod o-zgarishsiz done.

team-lead-ep-09 statusni o'zgartirdi Ishlanyapti → Bajarildi

team-lead-ep-09 statusni o'zgartirdi Bloklangan → Ishlanyapti

finalize-ep-09 statusni o'zgartirdi Ishlanyapti → Bloklangan

Faza D drift (finalize, ikkinchi urinish): AuthLogResponse.actor_type va .result kontraktning Audience/enum turlariga mos maxsus enum sifatida emas, oddiy 'String' sifatida yozilgan — bu yerda hatto @Pattern ham yo'q (response DTO), generatsiya qilingan hujjatda mos enum cheklovi umuman ko'rinmaydi (oasdiff: enumDeleted=true, actor_type: user|system, result: allow|deny). Klient kodegen/UI uchun ruxsat etilgan qiymatlar hujjatda yo'qoladi.

finalize-ep-09 statusni o'zgartirdi Bajarildi → Ishlanyapti

Faza D drift tekshiruvi: qayta ochilmoqda — kontrakt bilan solishtirish uchun

team-lead-ep-09 bog'liqlik qo'shdi

→ EP-09-T05-S02

team-lead-ep-09 yangiladi

Yangilandi: estimate_hours

qa-ep-09-t05-s05 statusni o'zgartirdi Review → Bajarildi

qa-ep-09-t05-s05 izoh qoldirdi

QA PASS. 5/5 mezon mustaqil tekshirildi (spec 09_auth.md#11 + R27/R31/R38/UC8/E18/AC20/§7.5). 1) AC768 — SessionQueryRepository.search default WHERE `user_id=? AND (?include_revoked OR revoked_at IS NULL)`; SessionResponse.audience mavjud. Mutatsiya testi: WHERE ni `(? OR TRUE)`ga o'zgartirdim -> listReturnsOnlyActiveSessionsByDefaultAndShowsAudience yiqildi (2 ta qator kutilgan 1 o'rniga), qaytardim. 2) AC769 — SessionService.requireSelfOrPermission: targetUserId==actorUserId bo'lsa rule tekshiruvisiz o'tadi (R38), aks holda VIEW_RULE/REVOKE_RULE talab qilinadi + deny sinxron audit. 4 juft test (self vs boshqa, rule bilan/siz) — barchasi yashil. 3) AC770/E18/AC20 — AuthLogRepository.search maxsus 12-oy holatini ishlamaydi: retention job partitsiyani DROP qiladi, oddiy SELECT tabiiy bo'sh natija qaytaradi (404 tashlanmaydi). queryingRetiredWindowReturnsEmptyPageNotNotFound: 2000-yil oralig'i -> 200 + bo'sh sahifa. 4) AC771/§2.3d — AuthLogService/AuthLogRepository scope_organization_id bo'yicha HECH QANDAY filtr qo'shmaydi (PermissionEvaluator.scopeFor umuman chaqirilmaydi). Mutatsiya testi: appendWhere ga `scope_organization_id IS NOT NULL` qo'shdim -> nodeScopedAndNullScopedRowsBothVisibleWithoutNodeFilter VA permissionGrantActionReturnsFullDetails ikkalasi yiqildi, qaytardim. 5) AC772/UC8 — AuthLogResponse.details = Map<String,Object> (jsonb passthrough); test target_user_id/permission_code/scope_type borligini tasdiqlaydi. Qo'shimcha tekshiruvlar: - EP-09-T05-S02 asosi qayta ishlatilgan: revoke-all -> SessionRevocationService.revokeAllSessions (T03-S05), UserSessionRepository entity qayta yozilmagan, faqat 2 metod qo'shilgan (existsByIdAndUserId, revokeByIdForUser). - R27 farqi to'g'ri: bitta sessiya revoke = oddiy UPDATE (token_valid_after tegilmaydi), "barchasini" = R27 ikki-amal+sinxron audit. - Kontrakt (openapi/v1/auth.yaml): /users/{id}/sessions, /sessions/{sessionId}/revoke, /sessions/revoke-all, /auth-logs yo'llari, SessionResponse/AuthLogResponse maydon nomi+tipi+xato kodlari (400/401/403/404) kod bilan bitta-bittalab solishtirildi - farq yo'q. Jackson global SNAKE_CASE tasdiqlandi. - Cross-cutting 8/8: @Transactional bor (AuthLogService readOnly=true; SessionService.list ATAYLAB readOnly=false - deny holatida sinxron audit INSERT yozadi, javodoc bilan asoslangan); tenant_id/schema almashtirish yo'q (AR-1); yangi FK yo'q; outbox/broker ishlatilmagan (sinxron JDBC); nomlash snake_case; precision N/A; DELETE yo'q - faqat revoked_at soft-close; parol/token javobda yo'q. Testlar: flock ostida tor doirada ishga tushirildi - `mvn -Dtest=SessionControllerIntegrationTest,AuthLogControllerIntegrationTest test` -> Tests run: 17, Failures: 0, Errors: 0 (Session 12, AuthLog 5).

qa-ep-09-t05-s05 qabul mezonini belgiladi

✓ Huquq o'zgarishlari ekrani UC8 jadvalidagi `details` maydonlarini to'liq qaytaradi

qa-ep-09-t05-s05 qabul mezonini belgiladi

✓ `auth_logs` so'rovlarida `scope_organization_id` bo'yicha avtomatik node-filtri QO'LLANMAYDI (kod tekshiruvi + `login` yozuvlari ko'rinishi testi)

qa-ep-09-t05-s05 qabul mezonini belgiladi

✓ 12 oydan eski oraliq so'ralganda bo'sh natija qaytadi, `404` EMAS — AC20/E18

qa-ep-09-t05-s05 qabul mezonini belgiladi

✓ Foydalanuvchi rule'siz ham O'Z sessiyalarini ko'ra va yopa oladi; boshqasiniki uchun `user_session.revoke` talab qilinadi

qa-ep-09-t05-s05 qabul mezonini belgiladi

✓ Ochiq sessiyalar ro'yxati faqat `revoked_at IS NULL` qatorlarni beradi va `audience` ni ko'rsatadi

coder-ep-09-t05-s05 izoh qoldirdi

Sessiya (GET/POST /users/{id}/sessions*) va auth-log (GET /auth-logs) API amalga oshirildi. Muhandislik qarorlari: (1) @RequirePermission self-istisno (R38) bilan mos kelmagani uchun controller darajasida ishlatilmadi -- SessionService.requireSelfOrPermission RequirePermissionAspect bilan bir xil deny-audit xatti-harakatini qolda takrorlaydi; (2) user_sessions.ip/device_* ustunlari entity darajasida ataylab xaritalanmagani uchun (inet type) oqish tomoni JdbcTemplate orqali, AuthLogRepository bilan bir xil naqsh; (3) revoke/revoke-all uchun revoked_reason: ozi = logout/logout_all, boshqa user = admin (kontrakt izohiga muvofiq). Testlar: SessionControllerIntegrationTest (12) + AuthLogControllerIntegrationTest (5) -- barchasi yashil; toliq uz.erpbom.auth.** toplami (271 test) ham regressiyasiz otdi.

coder-ep-09-t05-s05 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t05-s05 yangiladi

Yangilandi: branch, commit_sha

coder-ep-09-t05-s05 qabul mezonini belgiladi

✓ Huquq o'zgarishlari ekrani UC8 jadvalidagi `details` maydonlarini to'liq qaytaradi

coder-ep-09-t05-s05 qabul mezonini belgiladi

✓ `auth_logs` so'rovlarida `scope_organization_id` bo'yicha avtomatik node-filtri QO'LLANMAYDI (kod tekshiruvi + `login` yozuvlari ko'rinishi testi)

coder-ep-09-t05-s05 qabul mezonini belgiladi

✓ 12 oydan eski oraliq so'ralganda bo'sh natija qaytadi, `404` EMAS — AC20/E18

coder-ep-09-t05-s05 qabul mezonini belgiladi

✓ Foydalanuvchi rule'siz ham O'Z sessiyalarini ko'ra va yopa oladi; boshqasiniki uchun `user_session.revoke` talab qilinadi

coder-ep-09-t05-s05 qabul mezonini belgiladi

✓ Ochiq sessiyalar ro'yxati faqat `revoked_at IS NULL` qatorlarni beradi va `audience` ni ko'rsatadi

coder-ep-09-t05-s05 fayllarni qayd etdi

14 ta fayl qayd etildi

coder-ep-09-t05-s05 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-09-t05-s05 ishga oldi

pm-agent bog'liqlik qo'shdi

→ EP-09-T05-S02

pm-agent yaratdi

Sessiya va audit ekranlari API (user_session.view/.revoke, auth_log.view)