`customer_app` oqimida `allocations` taqiqi (Q62 = A — bugun ochilgan xavfsizlik yuzasi)

finalize-ep-11 yangiladi

Yangilandi: pr_url

qa-ep-11-t05-s08 statusni o'zgartirdi Review → Bajarildi

qa-ep-11-t05-s08 izoh qoldirdi

QA 2-tur (mustaqil, izolyatsiyalangan worktree d920160). BAZA: 4 klass / 50 test / 0 yiqilish (o zim o lchadim, flock ostida, bloklovchi). M2 MUTANT ENDI O LDIRILDI. Guard sharti token origin o rniga so rovdagi varaqa turiga (TYPE_CUSTOMER.equals(account.getCounterpartyType())) bog landi -> 2 test qizardi: backOfficeCreateWithCustomerAccountAndAllocationsStillWorks va driverAppCreateWithCustomerAccountAndAllocationsStillWorks (expected 201 CREATED but was 403 FORBIDDEN). javap -c -p bilan tasdiqlandi: create() bytecode ida CounterpartyAccount.getCounterpartyType() chaqiruvi paydo bo lgan va requireNoAllocationsFromCustomerApp ni gate qilyapti. 1-turdagi bo shliq (ichki kanal + MIJOZ varaqasi + allocations, 8.2 UC2 3(c)) endi qamralgan. M1 (guard tanasi no-op): javap tasdig i - metod tanasi butunlay 0: return. customerAppCreateWithAllocationsIsForbiddenAndWritesNoAllocationRows qizardi. M3 (qo shimcha, mezon 4255 uchun): null/bo sh erta qaytishi olib tashlandi (javap: return opcode yo q) -> customerAppCreateWithoutAllocationsStillCreatesDraftNormally VA customerAppCreateWithEmptyAllocationsListStillCreatesDraftNormally ikkalasi ham qizardi. Ya ni null va [] shoxobchalari alohida qo riqlangan. TESTLAR HAQIQIY (kod o qish bilan): - insertCustomerAccount() haqiqatan MIJOZ varaqasi: insertCustomerWithOwnUser() bilan haqiqiy customers qatori yaratadi, so ng insertCounterpartyAccount("customer", customerId, ccy) -> DB da counterparty_type = customer. Nomi bilan mazmuni mos. - Yangi 2 test faqat status kodini emas, DB ni tekshiradi: countRows("payment_allocations") == 1, ustiga origin (back_office/driver_app) va allocated_amount. - Bo sh ro yxat testi haqiqatan "allocations": [] yuboradi (null emas), 201 + draft + countRows(payment_allocations) == 0. - 138-145 qatordagi tuzatilgan izoh endi haqiqatga mos: AC4255 testi maydonni umuman yubormaydi (null), [] ni esa yangi test qamraydi. CHEGARA TEKSHIRUVLARI (hammasi toza): git diff f3f185d..d920160 = FAQAT test fayli (112+/3-); openapi/ tegilmagan (0cb1339..d920160 bo sh); PaymentService.java ga umuman tegilmagan; origin = resolveOrigin(principal) - token aud dan (customer->customer_app, driver->driver_app, aks holda back_office), so rovdan OLINMAYDI; target_ref_id egalik tekshiruvi qo shilmagan; PUT /payments/{id}/allocations o zgarmagan (f3f185d ishlab chiqarish diffi faqat create() dagi 1 chaqiruv + yangi private metod); yangi migratsiya/ustun yo q; git grep MUTANT d920160 bo sh; .bak/.orig commit da yo q. Worktree o chirildi, asosiy daraxt toza. 5/5 mezon mustaqil tasdiqlandi -> done.

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ Cheklovni olib tashlash (mutatsiya) kamida bitta testni yiqitadi; assertion 403 KODIGA emas, yozilmagan QATORLARGA ham tayanadi

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ `PUT /payments/{id}/allocations` xatti-harakati o'zgarmaydi (`payment.create` bilan qo'riqlangan holicha)

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ `back_office` va `driver_app` oqimlarida `allocations` ISHLAYVERADI — regressiya testi bilan tasdiqlangan

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ O'sha so'rov `allocations` SIZ yuborilganda odatdagidek `draft` yaratiladi — mijozning asosiy oqimi buzilmaydi

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ `aud=customer` tokeni bilan `POST /payments` `allocations` yuborilganda 403 qaytadi va BIRORTA `payment_allocations` qatori yozilmaydi (DB darajasida tasdiqlangan)

coder-ep-11-t05-s08 qabul mezonini belgiladi

✓ `back_office` va `driver_app` oqimlarida `allocations` ISHLAYVERADI — regressiya testi bilan tasdiqlangan

coder-ep-11-t05-s08 yangiladi

Yangilandi: commit_sha

coder-ep-11-t05-s08 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-11-t05-s08 izoh qoldirdi

QA topgan test qamrov teshigi yopildi (M2 mutant). PaymentService.java ga TEGILMADI (guard to'g'ri edi). Faqat test fayliga 3 ta yangi test qo'shildi: (1) backOfficeCreateWithCustomerAccountAndAllocationsStillWorks, (2) driverAppCreateWithCustomerAccountAndAllocationsStillWorks — ikkalasi ham MIJOZ (customer) kontragent varaqasi + allocations bilan ichki kanaldan (§8.2 UC2 3(c)); (3) customerAppCreateWithEmptyAllocationsListStillCreatesDraftNormally — allocations: [] holatini aniq qamraydi, 139-145-qatordagi yolg'on izoh ham tuzatildi. O'z-o'zini tekshirish: guard ni vaqtincha account.getCounterpartyType()ga bog'lab ko'rdim — (1) va (2) testlari 403 bilan QIZARDI, keyin cp bilan tiklandi (grep MUTANT bo'sh). To'liq 4 klass: 50/50 yashil (47->50). Commit d920160, branch feat/EP-11-erpbom-backend.

coder-ep-11-t05-s08 fayllarni qayd etdi

1 ta fayl qayd etildi

qa-ep-11-t05-s08 statusni o'zgartirdi Review → Ishlanyapti

qa-ep-11-t05-s08 izoh qoldirdi

QA: qaytarildi (1 mezon ochiq: 4256). Kod TO'G'RI — kamchilik regressiya TO'RIDA. O'ZIM O'LCHAGAN: 4 klass, 47 test (10+22+5+10), 0 failure — PaymentCreateAllocationsChannelRestriction(5) / PaymentAllocation(10) / PaymentCustomerAppOrigin(10) / PaymentController(22). Coder aytgan 47 raqami TASDIQLANDI. Izolyatsiyalangan worktree'da (f3f185d), asosiy daraxtga tegilmadi. O'TGAN MEZONLAR: - 4254 ✓ 403 + countRows("payment_allocations")==0 HAQIQIY SELECT count(*) (test:160). MUSBAT NAZORAT o'tdi: o'sha helper backOffice/driverApp/PUT testlarida 1 qaytaradi, ya'ni assertion o'lik emas. Chegara: auth_logs deny yozuvi haqiqatan qoladimi — o'zim probe bilan tekshirdim, countDenyAuthLogs(customerUserId,'payment.create')==1, noRollbackFor ishlayapti (403, 500 emas). - 4255 ✓ 201 draft, origin=customer_app, payments=1, allocations=0. - 4257 ✓ diff'da updateAllocations'ga UMUMAN tegilmagan (o'zgargan yagona main fayl = PaymentService.create + yangi private metod), regressiya testi ham bor. - 4258 ✓ M1 mutant (guard tanasi -> `return;`) customerAppCreateWithAllocations...:129 ni yiqitdi (403 kutildi, 201 keldi). javap -c -p bilan bytecode tasdiqlandi: requireNoAllocationsFromCustomerApp Code: `0: return`. ❌ 4256 — OCHIQ (fixture xilma-xilligi teshigi): Mutant M2A: cheklov token `aud` (origin) o'rniga SO'ROVDAN kelgan account_id turiga bog'landi — if (CounterpartyAccountService.TYPE_CUSTOMER.equals(account.getCounterpartyType())) { requireNoAllocationsFromCustomerApp(...); } Natija: 47 testdan 47 TASI YASHIL QOLDI (SURVIVED). javap bilan tasdiqlandi (create() da ldc "customer" + getCounterpartyType() branch). Sabab: backOfficeCreateWithAllocationsStillWorks (test:173) va driverAppCreateWithAllocationsStillWorks (test:203) IKKALASI HAM insertSupplierAccount() ishlatadi — ichki kanal + MIJOZ varaqasi + allocations kombinatsiyasi butun repo'da qamralmagan. Ya'ni bugungi to'r "guard origin'ga bog'langan"ni "guard hisob turiga bog'langan"dan AJRATA OLMAYDI, holbuki ikkinchisi aynan §8.2 UC2 3(c) ni (kassir mijoz to'lovini mijoz buyurtmalariga taqsimlaydi) prodda buzardi va testlar yashil qolardi. Haqiqiy xatti-harakat TO'G'RI (probe: back_office + customer varaqasi + allocations -> 201, payment_allocations=1) — faqat test yo'q. QILINSIN (kichik, ~15 qator): 1) PaymentCreateAllocationsChannelRestrictionControllerIntegrationTest ga back_office (`web` aud) + insertCounterpartyAccount("customer", ...) + allocations -> 201 va countRows("payment_allocations")==1 testi qo'shilsin. Bu M2A ni o'ldiradi. 2) `allocations: []` (BO'SH RO'YXAT) holati alohida test bilan qamralsin — hozir `allocations.isEmpty()` shoxobchasi (PaymentService:1766) HECH BIR test bilan qoplanmagan. Test faylidagi 139-145 qatordagi izoh "pastdagi AC4255 testi aynan shu holatni qamraydi" deydi — bu NOTO'G'RI: AC4255 testi maydonni UMUMAN yubormaydi (null), `[]` yubormaydi. Izoh ham tuzatilsin. (Probe bilan o'lchadim: `[]` -> 201, qoida 42 bilan mos, ya'ni kod to'g'ri — faqat qamrov va izoh yolg'on.) CHEGARA TEKSHIRUVLARI — hammasi TOZA: - git diff 0cb1339 f3f185d -- openapi/ BO'SH ✓ - target_ref_id egalik tekshiruvi QO'SHILMAGAN (variant B qamrovdan tashqarida) ✓ - origin = resolveOrigin(principal) -> principal.audience() (PaymentService:1697-1705), so'rovdan OLINMAYDI ✓ - yangi migratsiya/ustun yo'q (diff = atigi 2 fayl) ✓ - javadoc haqiqatga mos ✓ (@throws va sinf javadoci kod bilan mos) - worktree o'chirildi, `git grep MUTANT f3f185d` bo'sh, asosiy daraxt toza ✓

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ Cheklovni olib tashlash (mutatsiya) kamida bitta testni yiqitadi; assertion 403 KODIGA emas, yozilmagan QATORLARGA ham tayanadi

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ `PUT /payments/{id}/allocations` xatti-harakati o'zgarmaydi (`payment.create` bilan qo'riqlangan holicha)

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ O'sha so'rov `allocations` SIZ yuborilganda odatdagidek `draft` yaratiladi — mijozning asosiy oqimi buzilmaydi

qa-ep-11-t05-s08 qabul mezonini belgiladi

✓ `aud=customer` tokeni bilan `POST /payments` `allocations` yuborilganda 403 qaytadi va BIRORTA `payment_allocations` qatori yozilmaydi (DB darajasida tasdiqlangan)

coder-ep-11-t05-s08 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-11-t05-s08 izoh qoldirdi

Qoida 42a/AC38 amalga oshirildi: PaymentService#create origin=customer_app bo'lsa va allocations bo'sh bo'lmasa yangi requireNoAllocationsFromCustomerApp() 403 (auth_logs deny yozuvi, requirePermission bilan bir xil naqsh) qaytaradi — tekshiruv payments/payment_allocations yozuvidan OLDIN. Kontrakt (openapi) TEGILMADI. Yangi test klassi PaymentCreateAllocationsChannelRestrictionControllerIntegrationTest 5 ta stsenariy: (1) customer+allocations -> 403, payments=0/payment_allocations=0 DB darajasida; (2) customer allocationssiz -> odatdagidek draft; (3) back_office+allocations regressiya; (4) driver_app+allocations regressiya; (5) PUT /payments/{id}/allocations customer_app hujjatda ham o'zgarmagan. Mutatsiya qo'lda tekshirildi: guard ichini if(true) MUTANT qilib qo'yganda test (1) 403 kutib 201 olib qizil chiqdi, keyin original tiklandi (grep MUTANT toza). Barcha 4 ta tegishli test klassi (yangi + PaymentControllerIntegrationTest + PaymentAllocationControllerIntegrationTest + PaymentCustomerAppOriginControllerIntegrationTest) — 47/47 yashil.

coder-ep-11-t05-s08 yangiladi

Yangilandi: branch, commit_sha

coder-ep-11-t05-s08 fayllarni qayd etdi

2 ta fayl qayd etildi

coder-ep-11-t05-s08 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-11-t05-s08 ishga oldi

unknown-agent yaratdi

`customer_app` oqimida `allocations` taqiqi (Q62 = A — bugun ochilgan xavfsizlik yuzasi)