Kafolat testlari — AC16/AC21/AC51 (restart, kesh, rate-limit)

team-lead-ep-09 yangiladi

Yangilandi: pr_url

team-lead-ep-09 yangiladi

Yangilandi: estimate_hours

qa-ep-09-t10-s03 izoh qoldirdi

QA tekshiruvi (qa-EP-09-T10-S03), spec: 09_auth.md#12 AC16/AC21/AC51. 1) Test yashil (isolated git worktree @ 10da24f, jonli WIP fayllardan mustaqil): flock ostida `mvn -Dtest=AuthGuaranteeIntegrationTest test` -> Tests run: 7, Failures: 0, Errors: 0 (22.34s). 2) LoginRateLimitService.java tuzatishi (noRollbackFor=AccountLockedException.class, ikkala metodda) MINIMAL va TO'G'RI: faqat annotatsiya qo'shildi, boshqa mantiqqa tegilmagan (git show 10da24f tasdiqladi). Mutatsiya tekshiruvi: annotatsiyani vaqtincha olib tashlab test yurgizdim -> aynan 3 test (sixthLoginAttemptIsLockedEvenWithCorrectPassword, ipLockFromNonExistentUsernames..., cacheClear...ipAndAccountLockStayLocked) qizil bo'ldi, xato aynan claim qilingandek: `expected 423 LOCKED but was 500 INTERNAL_SERVER_ERROR`. Tuzatishni qaytargach hammasi yana yashil. Sabab texnik jihatdan to'g'ri: Spring TransactionInterceptor har proxy chegarasida CHAQIRILGAN metodning o'z noRollbackFor qoidasiga qaraydi (chaqiruvchining emas) -> ichki metod noRollbackFor'siz bo'lsa umumiy tranzaksiyani rollback-only qilib qo'yadi -> tashqi commit'da UnexpectedRollbackException. Scope creep emas: aynan AC21 talab qilgan 423 javobini buzayotgan real bug edi. 3) AC51(a)/(b)/(c): cacheManager.clear() bilan restart simulyatsiyasi - bekor qilingan token 401, faol token 200, ikkala qulf (IP+akkaunt) 423 saqlanadi - real SessionRevocationService/LoginService orqali, mock yo'q. 4) AC16: uch R27 trigger (change-password, logout_all, suspended) alohida testda, HAQIQIY servis yo'llari orqali. Thread.sleep(60000) YO'Q - cacheManager.clear() bilan TTL oynasi deterministik simulyatsiya qilingan. 5) AC21: 6-chi urinish 423+ACCOUNT_LOCKED; IP-bypass yopilgan. 6) Mutatsiya tekshiruvi test darajasida ham (AC51a va AC16 testlaridan bittadan assert'ni ataylab OK ga o'zgartirdim) - ikkalasi ham kutilganidek qizil bo'ldi, keyin asl holatga qaytardim. 7) Kontrakt: 423 + {code:ACCOUNT_LOCKED, message, request_id} - GlobalExceptionHandler va openapi/v1/auth.yaml#AccountLocked bilan mos. Eslatma (bloklovchi emas): ishchi papkada shu paytda boshqa (parallel) task fayllari (MinIO/proxy-upload ishi) uncommitted holatda edi va StorageClient bean yo'qligi sababli AuthGuaranteeIntegrationTest context'ini buzayotgan edi - shuning uchun tekshiruvni git worktree orqali commit 10da24f'da izolyatsiya qilib o'tkazdim (asosiy ishchi papkaga tegilmadi, hech narsa o'zgartirilmadi). Bu EP-09-T10-S03 doirasidagi muammo emas. Barcha 5 mezon (862-866) tasdiqlandi. Status: done.

qa-ep-09-t10-s03 statusni o'zgartirdi Review → Bajarildi

qa-ep-09-t10-s03 qabul mezonini belgiladi

✓ AC21 ikkala o'lchov uchun ham yashil

qa-ep-09-t10-s03 qabul mezonini belgiladi

✓ `logout_all` dan keyin access token ≤60 s ichida rad etiladi (test soat siljitib o'lchaydi) — AC16

qa-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin faol sessiya ishlashda davom etadi — AC51(c)

qa-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin ham qulflangan IP/login `423` oladi — AC51(b)

qa-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin bekor qilingan refresh token bilan `401` olinadi — AC51(a)

coder-ep-09-t10-s03 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-09-t10-s03 yangiladi

Yangilandi: branch, commit_sha

coder-ep-09-t10-s03 izoh qoldirdi

Yangi AuthGuaranteeIntegrationTest (7 test) real HTTP orqali AC16/AC21/AC51(a,b,c)ni birlashtiradi. Yo'lda haqiqiy bug topildi va tuzatildi: LoginRateLimitService.assertIpNotLocked/assertAccountNotLocked ichki @Transactional(readOnly=true) da noRollbackFor=AccountLockedException.class yo'q edi — LoginService.login() tranzaksiyasi ICHIDA (nested, REQUIRED) chaqirilganda, allaqachon qulflangan IP/login bilan 6-chi urinish UnexpectedRollbackException bilan 500 qaytarardi (423 o'rniga). Birlik test (LoginRateLimitServiceTest) buni ko'rmagan, chunki servisni LoginService tranzaksiyasi tashqarisida chaqiradi. Fix: ikkala metodga ham noRollbackFor=AccountLockedException.class qo'shildi (LoginService.login() dagi bilan bir xil ruh). flock ostida -Dtest=AuthGuaranteeIntegrationTest yashil (7/7), butun uz.erpbom.auth.** paketi ham yashil (343/343).

coder-ep-09-t10-s03 qabul mezonini belgiladi

✓ AC21 ikkala o'lchov uchun ham yashil

coder-ep-09-t10-s03 qabul mezonini belgiladi

✓ `logout_all` dan keyin access token ≤60 s ichida rad etiladi (test soat siljitib o'lchaydi) — AC16

coder-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin faol sessiya ishlashda davom etadi — AC51(c)

coder-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin ham qulflangan IP/login `423` oladi — AC51(b)

coder-ep-09-t10-s03 qabul mezonini belgiladi

✓ Kesh tozalangandan keyin bekor qilingan refresh token bilan `401` olinadi — AC51(a)

coder-ep-09-t10-s03 fayllarni qayd etdi

2 ta fayl qayd etildi

coder-ep-09-t10-s03 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-09-t10-s03 ishga oldi

pm-agent yaratdi

Kafolat testlari — AC16/AC21/AC51 (restart, kesh, rate-limit)