Storage wrapper — MinIO klient va obyekt kaliti (R43)

team-lead-ep-09 yangiladi

Yangilandi: pr_url

team-lead-ep-09 yangiladi

Yangilandi: estimate_hours

qa-ep-09-t06-s01-r2 statusni o'zgartirdi Review → Bajarildi

qa-ep-09-t06-s01-r2 izoh qoldirdi

QA round 2 (AC784 re-check) — DONE. StorageConfig.bucketPolicyGuardRunner: real @Bean ApplicationRunner, @Conditional(StorageConfiguredCondition.class) — bir xil shart bilan MinioClient/StorageClient bilan. BucketPolicyGuard.verifyNotPubliclyReadable() ga to'g'ridan-to'g'ri delegatsiya qiladi (StorageConfig.java:86-91). StorageConfigBootstrapTest — TAUTOLOGIK EMAS, mustaqil tekshirildi: real Testcontainers Postgres + qo'lda SpringApplication.run(ErpbomBackendApplication) bilan boot qiladi (mock MinioClient @Primary, refresh oldidan registerBean orqali). 3 senariy: (1) PUBLIC policy -> app.run() haqiqatan Throwable otadi, sabab zanjirida BucketPolicyGuard IllegalStateException("...OCHIQ...") bor (surefire XML dan tasdiqlandi) -> fail-fast ISHLAYDI; (2) PRIVATE -> muvaffaqiyatli ko'tariladi; (3) endpoint bo'sh -> MinioClient/runner bean umuman yo'q, live MinIO chaqirilmaydi. verify(mockMinioClient).getBucketPolicy(...) runner haqiqatan chaqirilganini isbotlaydi. Spec ambiguity qarori (fail-fast vs log/warn) BAHOLANDI: 09_auth.md#2.8.3 "TAQIQLANADI" + kirish belgisi (doc bo'ylab hard-constraint semantikasi) + item description'ning o'zi ("bootstrap tekshiruvi bilan qotiriladi") + mavjud R54/BootstrapOwnerRunner'dagi bir xil falsafa — fail-fast tanlovi spec bilan ZID EMAS, asosli qaror. Bu blocking spec bo'shlig'i emas, PM ga qaytarilmaydi. StorageConfiguredCondition regressiya tekshiruvi: ErpbomBackendApplicationTests (standart mvn test, erpbom.storage.endpoint bo'sh) alohida yurgizildi -> 3/3 yashil, MinioClient/StorageClient/bucketPolicyGuardRunner bean'lari yaratilmaydi, context buzilmagan. TEST (foreground): flock /var/tmp/erpbom-db.lock -c mvn -Dtest=StorageConfigTest,BucketPolicyGuardTest,MinioStorageClientTest,ObjectKeyGeneratorTest,StorageConfigBootstrapTest test -> 52/52 YASHIL (StorageConfigBootstrapTest 3/3, ~26s). MUTATSIYA TEKSHIRUVI: BucketPolicyGuard.java:56 shartni teskarisiga aylantirdim (grantsPublicReadAccess natijasini invert qildim). Natija: 4 test qizil (BucketPolicyGuardTest 2 ta, StorageConfigBootstrapTest 2 ta — applicationFailsToStartWhenBucketPolicyIsPublic VA applicationStartsSuccessfullyWhenBucketPolicyIsPrivate ikkalasi ham kutilganidek buzildi). git checkout -- bilan qaytardim, qayta 52/52 yashil tasdiqlandi. AC783/785/786 qayta tasdiqlandi (bu commit ularga tegmagan, regressiya yo'q). Git doirasi: git show --stat 8cc5ed5 — faqat BucketPolicyGuard.java, StorageConfig.java, StorageConfigBootstrapTest.java (yangi), StorageConfigTest.java. T05/T08 fayllariga (UserController, SessionQueryRepository, openapi/v1/) tegilmagan — toza. Hamma 4 mezon tasdiqlandi -> status: done.

qa-ep-09-t06-s01-r2 qabul mezonini belgiladi

✓ Wrapper `mime_type` va `size_bytes` ni qaytaradi (qayta o'lchov yo'q)

qa-ep-09-t06-s01-r2 qabul mezonini belgiladi

✓ Kalit yasash faqat wrapper orqali — kodda qo'lda satr birlashtirish yo'q (kod tekshiruvi)

qa-ep-09-t06-s01-r2 qabul mezonini belgiladi

✓ Bucket anonim o'qishga ochiq emas (integratsiya testi anonim `GET` bilan tekshiradi)

qa-ep-09-t06-s01-r2 qabul mezonini belgiladi

✓ Kalit `<domen>/<yil>/<oy>/<uuid>.<ext>` formatida yasaladi va foydalanuvchi bergan nom ishtirok etmaydi

unknown-agent statusni o'zgartirdi Ishlanyapti → Review

unknown-agent qabul mezonini belgiladi

✓ Bucket anonim o'qishga ochiq emas (integratsiya testi anonim `GET` bilan tekshiradi)

unknown-agent izoh qoldirdi

AC784 yopildi: BucketPolicyGuard StorageConfig ichida bucketPolicyGuardRunner (ApplicationRunner) bean sifatida ulandi, StorageConfiguredCondition bilan qo'riqlangan (faqat erpbom.storage.endpoint sozlanganda mavjud — MinioClient/StorageClient bilan bir xil shart, standart `mvn test` MinIO'siz buzilmaydi). Spec izohi (fail-fast vs faqat log/warn): 09_auth.md §2.8.3 "Public read TAQIQLANADI" deb yozadi, lekin tekshiruv muvaffaqiyatsiz bo'lganda ilova ko'tarilishi rad etilishi shartmi yoki faqat log/warn bilan davom etishi kerakmi — aniq belgilanmagan. Bu — spec bo'shlig'i (boshqa mezonlar bajarilgani uchun blocked qilinmadi). Qaror: FAIL-FAST tanlandi — R54/BootstrapOwnerRunner (AC50 c/E26) bilan bir xil falsafa ("xavfsizlik shartini buzgan holatda ilova umuman ko'tarilmasin"), va "TAQIQLANADI" so'zi imkonsiz semantikasi bilan izchil. Sabab StorageConfig.bucketPolicyGuardRunner javodocida ham yozilgan. Test: StorageConfigTest'ga (a) wiring tekshiruvi (endpoint bo'sh/to'ldirilganda bean bor/yo'q) va (b) BucketPolicyGuard'ga to'g'ri delegatsiya qiluvchi sof unit test (mock MinioClient, Spring kontekstisiz) qo'shildi. Yangi StorageConfigBootstrapTest (Testcontainers PostgreSQL + qo'lda SpringApplication boot + mock MinioClient @Primary bean sifatida contex refresh'dan oldin ro'yxatdan o'tkazilgan) — 3 stsenariy: (1) bucket policy PUBLIC → ilova fail-fast bilan ko'tarilmaydi (IllegalStateException sabab zanjirida), (2) PRIVATE → muvaffaqiyatli ko'tariladi, (3) erpbom.storage.endpoint umuman sozlanmagan → MinioClient/runner kontekstda yo'q, live MinIO'ga hech qanday chaqiruv yo'q. Sabab: ApplicationContextRunner ApplicationRunner bean'larini avtomatik chaqirmaydi (QA topilmasi), shuning uchun haqiqiy ishga tushirishni faqat to'liq SpringApplication boot isbotlay oladi. flock /var/tmp/erpbom-db.lock -c "mvn -Dtest=StorageConfigTest,BucketPolicyGuardTest,MinioStorageClientTest,ObjectKeyGeneratorTest,StorageConfigBootstrapTest test" — 52/52 test yashil (StorageConfigBootstrapTest: 3/3, ~27s Testcontainers bilan). commit 8cc5ed5, branch feat/EP-09-erpbom-backend.

unknown-agent yangiladi

Yangilandi: commit_sha

unknown-agent fayllarni qayd etdi

4 ta fayl qayd etildi

qa-ep-09-t06-s01-retry izoh qoldirdi

QA (retry, foreground testlar): 47/47 test yashil (ObjectKeyGeneratorTest 20, BucketPolicyGuardTest 14, MinioStorageClientTest 9, StorageConfigTest 4) — `flock ... mvn -Dtest=... test`, natija shu chaqiruvda olindi. Mutatsiya tekshiruvi: ObjectKeyGenerator.generate() da UUID.randomUUID() ni sobit satrga almashtirdim -> 2 ta test (generatesKeyInDomainYearMonthUuidExtensionFormat, usesRandomUuidAsFileNameNotOriginalName) kutilganidek qizil bo'ldi, keyin `git checkout --` bilan qaytardim. Git tekshiruvi: ac650ec/dc2ec3e faqat src/main/java/uz/erpbom/common/storage/** + src/test/.../storage/** + application.yml ni o'zgartiradi — T05/T08 fayllariga (UserController, UserService, UserPermissionRepository) tegilmagan. AC783/785/786 mustaqil tasdiqlandi (kod + test): kalit formati, wrapper-only generatsiya (boshqa hech qayerda ObjectKeyGenerator.generate() chaqirilmaydi/qo'lda satr yig'ilmaydi), StoredObject(mime_type,sizeBytes) qayta o'lchovsiz qaytadi. AC784 — HALI QAYTARILADI (qaytar sababi quyida). Coderning asosi ("bootstrap'ga ulasam standart mvn test MinIO'siz yiqilardi") NOTO'G'RI: StorageConfig'dagi MinioClient/StorageClient bean'lari xuddi shu StorageConfiguredCondition bilan qo'riqlanadi va `erpbom.storage.endpoint` bo'sh bo'lganda (aynan standart mvn test holati — ErpbomBackendApplicationTests hech qanday erpbom.storage.* property bermaydi, application.yml default'i ${MINIO_ENDPOINT:} bo'sh) bean'lar UMUMAN yaratilmaydi (StorageConfigTest.beansAreAbsentWhenEndpointPropertyIsEntirelyUnset buni isbotlaydi). Demak xuddi shu Condition bilan qo'riqlangan BucketPolicyGuard bean + uni chaqiruvchi ApplicationRunner ham standart test kontekstida UMUMAN ishga tushmaydi — texnik to'siq yo'q. Aniq talab qilinayotgan tuzatish (StorageConfig.java ichida): 1) `BucketPolicyGuard` uchun `@Bean @Conditional(StorageConfiguredCondition.class)` metod qo'sh (paketga ochiq bo'lishi kifoya, hozirgi package-private konstruktor bilan mos). 2) Shu Condition bilan qo'riqlangan `ApplicationRunner` (yoki alohida `@Component` + `InitializingBean`) qo'sh, u boot paytida `bucketPolicyGuard.verifyNotPubliclyReadable()` ni chaqirsin — bucket ochiq bo'lsa ilova ko'tarilmasin (spec: "Bucket public read TAQIQLANADI — konfiguratsiya/bootstrap tekshiruvi bilan qotiriladi", item description). 3) `StorageConfigTest`ga qo'shimcha holat: endpoint berilganda BucketPolicyGuard/ApplicationRunner bean mavjudligini, endpoint bo'sh bo'lganda mavjud emasligini tekshir (bean darajasida, live MinIO shart emas — xuddi hozirgi StorageConfigTest naqshi bilan). Bu spec bo'shlig'i EMAS — texnik jihatdan amalga oshirish mumkin va §2.8.3 talabi aniq ("Public read TAQIQLANADI ... bootstrap tekshiruvi bilan qotiriladi"). Shuning uchun `blocked` emas, `in_progress`.

qa-ep-09-t06-s01-retry qabul mezonini belgiladi

✓ Wrapper `mime_type` va `size_bytes` ni qaytaradi (qayta o'lchov yo'q)

qa-ep-09-t06-s01-retry qabul mezonini belgiladi

✓ Kalit yasash faqat wrapper orqali — kodda qo'lda satr birlashtirish yo'q (kod tekshiruvi)

qa-ep-09-t06-s01-retry qabul mezonini belgiladi

✓ Kalit `<domen>/<yil>/<oy>/<uuid>.<ext>` formatida yasaladi va foydalanuvchi bergan nom ishtirok etmaydi

qa-ep-09-t06-s01 statusni o'zgartirdi Review → Ishlanyapti

qa-ep-09-t06-s01 izoh qoldirdi

QA natijasi (qa-EP-09-T06-S01): TEST: flock ostida ObjectKeyGeneratorTest(20) + MinioStorageClientTest(9) + StorageConfigTest(4) + BucketPolicyGuardTest(14) = 47/47 YASHIL (exit 0). MUTATSIYA TEKSHIRUVI (2 ta, ikkalasi ham tutildi, keyin git checkout bilan asl holiga qaytarildi): 1. ObjectKeyGenerator.java:60 — UUID.randomUUID() -> qattiq kodlangan UUID.fromString("00000000-...-000000000000") -> usesRandomUuidAsFileNameNotOriginalName testi FAIL (kutilgan). 2. MinioStorageClient.java:42 — keyGenerator.generate(domain,...) -> generate("mutated_domain",...) -> 2 test FAIL: key formati regex mos kelmadi va invalid-domain testi throw kutgan joyda ko'tarmadi (kutilgan). Ikkalasi ham revert qilindi, keyin qayta 47/47 yashil tasdiqlandi. MEZONLAR (mustaqil qayta tekshirilgan, coder is_met:true belgisiga ishonilmadi): - AC783 (kalit formati, uuid, user-nom yo'q) — ObjectKeyGenerator.generate() `<domen>/<yil>/<oy>/<uuid>.<ext>` beradi, ObjectKeyGeneratorTest 20/20 tasdiqlaydi (t_ prefiks yo'qligi, UUID random, extension normalize). is_met=true qoldi. - AC785 (kalit faqat wrapper orqali) — repo bo'ylab grep: file_key/contract_file_key uchun qo'lda satr birlashtirish yo'q, chaqiruvchi hali yo'q (bu subtaskda endpoint yo'q — S02/S03da qo'shiladi). is_met=true qoldi. - AC786 (mime_type/size_bytes qayta o'lchanmaydi) — MinioStorageClient.put(): return new StoredObject(key, contentType, size) — chaqiruvchi bergan qiymatning aynan o'zi, MinIO'dan stat/HEAD so'ralmaydi. is_met=true qoldi. AC784 (bucket anonim o'qishga ochiq emas — QAYTARILDI, is_met=false qoldi): Coder'ning "BucketPolicyGuard'ni bootstrap tekshiruviga ulash mumkin emas, chunki bu standart mvn test'ni jonli MinIO'ga bog'liq qilib qo'yardi" degan asosi TEKSHIRILDI VA RAD ETILDI: 1. StorageConfigTest.beansAreCreatedWhenEndpointIsConfigured allaqachon erpbom.storage.endpoint=http://localhost:9000 bilan MinioClient/StorageClient bean'larini ApplicationContextRunner ichida yaratadi va MUVAFFAQIYATLI o'tadi — chunki MinioClient.builder().build() LAZY, tarmoqqa ulanmaydi. 2. ApplicationContextRunner (StorageConfigTest ishlatgan mexanizm) ApplicationRunner/CommandLineRunner bean'larini UMUMAN chaqirmaydi — faqat context.refresh() qiladi, SpringApplication.run() yo'q. Runner faqat @SpringBootTest (SpringApplication asosida) yoki haqiqiy ilova ishga tushganda chaqiriladi. 3. Repoda bu naqsh ALLAQACHON bor va sinovdan o'tgan: BootstrapOwnerRunner (ApplicationRunner, auth/config/) + BootstrapOwnerRunnerIntegrationTest (@SpringBootTest + Testcontainers) — aynan shu yondashuv bilan yozilgan. 4. grep -rl "erpbom.storage.endpoint" src/test/ — FAQAT StorageConfigTest (ApplicationContextRunner, runner chaqirmaydi). Boshqa hech qanday @SpringBootTest bu propertyni sozlamaydi -> ular uchun MinioClient/StorageClient/BucketPolicyGuard bean umuman yaratilmaydi -> hech qanday jonli MinIO talab qilinmaydi. XULOSA: BucketPolicyGuard'ni StorageConfig ichida, xuddi shu StorageConfiguredCondition bilan qo'riqlangan ApplicationRunner sifatida ulash TEXNIK JIHATDAN MUMKIN va standart mvn test'ni buzmaydi. Bu — spec bo'shlig'i EMAS, ish tugallanmagan. TALAB (qaytarish sababi, aniq): - StorageConfig.java ichiga (yoki alohida BucketPolicyStartupRunner klassiga, storage paketida) BucketPolicyGuard'ni bean qilib ro'yxatga oling: @Bean @Conditional(StorageConfiguredCondition.class) BucketPolicyGuard bucketPolicyGuard(MinioClient, StorageProperties, ObjectMapper). - Shu bean'ni ApplicationRunner ichida chaqiring (BootstrapOwnerRunner namunasi bo'yicha): @Component @Conditional(StorageConfiguredCondition.class) class BucketPolicyStartupCheck implements ApplicationRunner { ... guard.verifyNotPubliclyReadable(); } — yoki shu natijani beradigan boshqa StorageConfig ichidagi yechim, lekin MUHIM: faqat StorageConfiguredCondition true bo'lganda ishlasin. - Buni StorageConfigTest'ga o'xshash ApplicationContextRunner testi bilan tasdiqlang (masalan: endpoint sozlansa BucketPolicyGuard bean mavjud, sozlanmasa yo'q) — ApplicationRunner.run()ni ApplicationContextRunner chaqirmasligi sababli, buning o'zi jonli MinIO talab qilmaydi. - AC784 uchun is_met=true faqat shu ulanish qo'shilgandan keyin qo'yiladi. CROSS-CUTTING: mavzu bu subtask uchun tegishli emas (REST endpoint yo'q). Git log tekshirildi: dc2ec3e va ac650ec faqat storage/ paketidagi fayllarga tegadi, T05/T08 fayllari (UserController.java va h.k.) bu commit'larga tushmagan — toza.

qa-ep-09-t06-s01 qabul mezonini belgiladi

✓ Wrapper `mime_type` va `size_bytes` ni qaytaradi (qayta o'lchov yo'q)

qa-ep-09-t06-s01 qabul mezonini belgiladi

✓ Kalit yasash faqat wrapper orqali — kodda qo'lda satr birlashtirish yo'q (kod tekshiruvi)

qa-ep-09-t06-s01 qabul mezonini belgiladi

✓ Kalit `<domen>/<yil>/<oy>/<uuid>.<ext>` formatida yasaladi va foydalanuvchi bergan nom ishtirok etmaydi

coder-ep-09-t06-s01 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t06-s01 yangiladi

Yangilandi: branch, commit_sha

coder-ep-09-t06-s01 izoh qoldirdi

AC784 (bucket anonim o'qishga ochiq emas) TO'LIQ yopilmadi — sabab va nima qilindi: (1) BucketPolicyGuard qo'shildi (common/storage), MinIO getBucketPolicy natijasini (AWS S3 policy JSON) tahlil qilib '*' Principal + Allow grantini aniqlaydi, 14 ta mock-testli birlik test bilan qoplangan. (2) Lokal dev MinIO'da qo'lda tekshirdim: deploy/docker-compose.yml dagi minio-init (`mc mb --ignore-existing local/erpbom`) hech qanday policy o'rnatmaydi -> getBucketPolicy bo'sh qator qaytaradi -> MinIO buni sukut bo'yicha PRIVATE deb hisoblaydi (guard buni ham 'ochiq emas' deb to'g'ri aniqlaydi). (3) Guard'ni StorageConfig bean tsikliga (masalan @PostConstruct) ATAYLAB ULAMADIM: bu chaqiruv jonli tarmoq so'rovi (MinIO getBucketPolicy) bo'lib, uni avtomatik ishga tushirish erpbom.storage.endpoint sozlangan HAR qanday kontekstni (demak har qanday kelajakdagi test/boot holatini ham) jonli MinIO'ga bog'liq qilib qo'yardi — bu esa ushbu subtaskka berilgan aniq ko'rsatmaga ('asosiy mvn test MinIO'siz yiqilmasin', tekshirilgan: MinioClient.builder().build() bo'sh/yaroqsiz konfiguratsiyada yiqiladi) zid bo'lardi. (4) Kriteriyaning parenthetical qismi ('integratsiya testi anonim GET bilan tekshiradi') — LIVE MinIO talab qiladigan integratsiya testi; buni ham ataylab yozmadim (task ko'rsatmasi: shunday testlar kerak emas / @Disabled bo'lishi kerak). TAKLIF: bu tekshiruvni S02 (proxy upload) yoki S03 (presigned GET) subtask'ida, ular allaqachon live-MinIO integratsiya test infratuzilmasini talab qilganda, yakunlab qo'yish — yoki alohida bootstrap/ops tekshiruvi sifatida BucketPolicyGuard'ni chaqirish. Men buni blocked qilmadim, chunki asosiy wrapper (AC783/785/786) to'liq va test bilan yopilgan; QA/PM shu qarorni ko'rib chiqib kerak bo'lsa qo'shimcha ish (follow-up subtask yoki shu itemni qayta ochish) so'rasin.

coder-ep-09-t06-s01 qabul mezonini belgiladi

✓ Wrapper `mime_type` va `size_bytes` ni qaytaradi (qayta o'lchov yo'q)

coder-ep-09-t06-s01 qabul mezonini belgiladi

✓ Kalit yasash faqat wrapper orqali — kodda qo'lda satr birlashtirish yo'q (kod tekshiruvi)

coder-ep-09-t06-s01 qabul mezonini belgiladi

✓ Kalit `<domen>/<yil>/<oy>/<uuid>.<ext>` formatida yasaladi va foydalanuvchi bergan nom ishtirok etmaydi

coder-ep-09-t06-s01 fayllarni qayd etdi

16 ta fayl qayd etildi

coder-ep-09-t06-s01 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-09-t06-s01 ishga oldi

pm-agent yaratdi

Storage wrapper — MinIO klient va obyekt kaliti (R43)