Skip to content

Conversation

@hongwei1
Copy link
Contributor

No description provided.

karmaking and others added 18 commits January 13, 2026 14:45
- Add Http4sCallContextBuilderTest with 454 lines of test coverage
- Test URL extraction including path, query parameters, and path parameters
- Test header extraction and conversion to HTTPParam format
- Test body extraction for POST, PUT, and GET requests
- Test correlation ID generation and extraction from X-Request-ID header
- Test IP address extraction from X-Forwarded-For and direct connection
- Test authentication header extraction for all supported auth types
- Test error handling and edge cases in CallContext building
- Ensure Http4sCallContextBuilder correctly processes http4s Request[IO] objects
- Add comprehensive test suite for ResourceDocMatcher with 545 lines of test coverage
- Test exact path matching for GET, POST, and multi-segment paths
- Test verb and path mismatch scenarios returning None
- Test BANK_ID variable matching and parameter extraction
- Test BANK_ID + ACCOUNT_ID variable matching and extraction
- Test BANK_ID + ACCOUNT_ID + VIEW_ID variable matching and extraction
- Test COUNTERPARTY_ID variable matching and extraction
- Test non-matching request scenarios
- Ensure ResourceDocMatcher correctly identifies and extracts path parameters for all variable types
- Use FeatureSpec with Given-When-Then style for clear test documentation
…and improve validation DSL

- Ensure all responses (errors and successful) have JSON Content-Type
- Replace repeated EitherT patterns with a clean Validation DSL (success/failure)
- Add ValidationContext to accumulate user, bank, account, view, and counterparty entities
- Add detailed comments for authentication, authorization, and entity validation steps
- Simplify middleware logic while preserving original validation order and behavior
This reverts commit 3a264ed.
- Safely extract request headers using `S.request.map(...).openOr(Nil)` instead of `openOrThrowException`
- Add proper error handling for resource-docs endpoint using `ErrorResponseConverter`
- Extract query parameters directly from URI instead of parsing URL string
- Add comprehensive test suite for Http4s700 routes
Move role-based authorization for resource-docs endpoint from endpoint implementation to ResourceDocMiddleware. This ensures consistent authentication handling across all endpoints and removes duplicate authorization logic.

The middleware now checks the `resource_docs_requires_role` property and enforces the `canReadResourceDoc` role when enabled. Tests are updated to verify proper 403 responses with missing role messages.
@sonarqubecloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
4 Security Hotspots

See analysis details on SonarQube Cloud

@simonredfern simonredfern merged commit a81e208 into OpenBankProject:develop Jan 27, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants