fix(fr-036): Java TPH per-subtype CREATE validates present values — review finding #6

The TPH per-subtype create bound the annotation-free union <Base>Dto and called
repository.createWithType with NO validation, so an over-@maxlength (or missing
@required) value on a TPH POST was accepted 201 — while TS/C#/Python validate TPH
create. Fix: the generated per-subtype create now validates each body value
against the subtype's ANNOTATED <Sub>Dto via
validator.validateValue(<Sub>Dto.class, field, dto.<field>()) → 400
{"error":"validation"} before persisting (validateValue applies @NotNull to null,
so an absent @required column 400s too — matching the vanilla create's whole-bean
validate, scoped to the subtype). The bound body stays the union (the shape
createWithType consumes); the validated set is the sibling <Sub>Patch's settable
fields (SpringDtoGenerator.settableFields made public static for that SSOT).

New shared gate fixtures/api-contract-conformance/tph/scenarios/
tph-create-constraint-violation.yaml (over-@maxlength reference on a per-subtype
POST → 400; valid → 201). TS/C#/Python already pass it; Kotlin follows.

Verified: codegen-spring 165/165; TPH generated lane 7/7 (incl. the new scenario);
vanilla generated lane 25/25.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGQ7oSuNcjhsMHWwZzhBwr

Author: dmealing

fixtures/api-contract-conformance/tph/scenarios/tph-create-constraint-violation.yaml

@@ -0,0 +1,51 @@
+name: tph-create-constraint-violation
+description: >
+  FR-036 — the TPH per-subtype CREATE must enforce the subtype's present-value field
+  constraints, exactly as the vanilla POST and the TPH per-subtype PATCH already do.
+  The discriminator base's union DTO is annotation-free (a row of any other subtype
+  stores NULL in a subtype column, so the union carries no @required/@maxLength), so a
+  per-subtype POST must validate the body against the subtype's ANNOTATED <Sub>Dto
+  before persisting — an over-@maxLength column is a 400 {error:"validation"}, not a
+  silent 201. TS/C#/Python already validate TPH create; this scenario gates it cross-port.
+
+  `reference` is a @required @maxLength:80 base column shared by every subtype. A create
+  whose `reference` exceeds 80 chars must be rejected on BOTH subtype segments (the
+  discriminator is injected from the URL, never the body). A well-formed create still
+  succeeds (201) — the guard rejects only violations, never valid bodies.
+requests:
+  # r1 — a valid PriorAuth create still succeeds (positive control: the constraint
+  #      guard must not over-reject a well-formed body).
+  - id: r1
+    method: POST
+    path: /api/auths/priorauth
+    body:
+      reference: "REF-OK"
+      approver: "Dr. Smith"
+    expect:
+      status: 201
+      body:
+        row: { type: "PriorAuth", reference: "REF-OK", approver: "Dr. Smith" }
+  # r2 — an over-@maxLength(80) `reference` on the PriorAuth segment → 400 validation.
+  - id: r2
+    method: POST
+    path: /api/auths/priorauth
+    body:
+      reference: "RXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+      approver: "Dr. Smith"
+    expect:
+      status: 400
+      body:
+        error: "validation"
+  # r3 — the same over-length `reference` on the Bridge segment → 400 validation
+  #      (cross-subtype: every per-subtype create validates against its own <Sub>Dto).
+  #      `quantity` is supplied valid so the rejection is unambiguously the length constraint.
+  - id: r3
+    method: POST
+    path: /api/auths/bridge
+    body:
+      reference: "RXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+      quantity: 3
+    expect:
+      status: 400
+      body:
+        error: "validation"

server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/SpringControllerGenerator.java

@@ -377,7 +377,8 @@ protected void emit(MetaObject entity, Path outRoot) {
      *   <li>the polymorphic collection — {@code GET /} (union list) + {@code GET /{id}} (any subtype);</li>
      *   <li>per subtype {@code <seg>} (the {@code @discriminatorValue} lowercased): {@code GET /<seg>}
      *       (subtype-scoped list), {@code GET /<seg>/{id}} (404 cross-subtype),
-     *       {@code POST /<seg>} (discriminator injected from the URL, never the body),
+     *       {@code POST /<seg>} (discriminator injected from the URL, never the body; body values
+     *       validated against the subtype {@code <Sub>Dto} constraints &rarr; 400 {@code {"error":"validation"}}),
      *       {@code PATCH|PUT /<seg>/{id}} (404 cross-subtype; discriminator immutable),
      *       {@code DELETE /<seg>/{id}} (404 cross-subtype).</li>
      * </ul>
@@ -547,10 +548,28 @@ protected void emitTph(MetaObject base, TphPlan.Plan plan, Path outRoot) {
             src.append("                .orElseGet(this::notFound);\n");
             src.append("    }\n\n");
 
-            // per-subtype create (discriminator injected from URL)
+            // per-subtype create (discriminator injected from URL) — FR-036: validate each body
+            // value against the subtype's ANNOTATED <Sub>Dto constraints BEFORE persisting, emitting
+            // the cross-port {"error":"validation"} envelope on any violation (so an over-@maxLength
+            // or missing-@required column is a 400, not a silent 201). The bound body stays the union
+            // <Base>Dto (the shape repository.createWithType consumes), but the union is annotation-
+            // free — so validation runs PER FIELD against the subtype DTO (the annotated shape), the
+            // exact type the per-subtype PATCH validates against. The validated set is the sibling
+            // <Sub>Patch's settable fields (effective scalars MINUS PK MINUS discriminator): the PK
+            // is auto-generated and the discriminator is injected from the URL, so neither is checked.
+            // validateValue applies @NotNull to a null value, so an absent @required column 400s too —
+            // matching the vanilla create's whole-bean validate, scoped to this subtype.
+            List<MetaField> createValidated =
+                SpringDtoGenerator.settableFields(st.entity(), TphPlan.discriminatorFieldOf(st.entity()));
             src.append("    @PostMapping(\"/").append(seg).append("\")\n");
-            src.append("    public ResponseEntity<").append(dtoName).append("> create").append(suffix)
+            src.append("    public ResponseEntity<?> create").append(suffix)
                .append("(@RequestBody ").append(dtoName).append(" dto) {\n");
+            for (MetaField vf : createValidated) {
+                src.append("        if (!validator.validateValue(").append(subDto).append(".class, \"")
+                   .append(vf.getName()).append("\", dto.").append(vf.getName()).append("()).isEmpty()) {\n");
+                src.append("            return ResponseEntity.badRequest().body(Map.of(\"error\", \"validation\"));\n");
+                src.append("        }\n");
+            }
             src.append("        ").append(dtoName).append(" saved = repository.createWithType(\"").append(disc).append("\", dto);\n");
             src.append("        return ResponseEntity.status(HttpStatus.CREATED).body(saved);\n");
             src.append("    }\n\n");

server/java/codegen-spring/src/main/java/com/metaobjects/generator/spring/SpringDtoGenerator.java

@@ -281,8 +281,14 @@ private static List<MetaField> settableFields(MetaObject entity) {
      * As {@link #settableFields(MetaObject)}, additionally excluding the field named
      * {@code alsoExclude} (or nothing when {@code null}) — the FR-036 TPH per-subtype patch passes
      * the discriminator field name so the immutable discriminator is never a settable member.
+     *
+     * <p>Public so {@link SpringControllerGenerator#emitTph} can validate a TPH per-subtype CREATE
+     * body against exactly the field set the sibling {@code <Sub>Patch} covers (effective scalars
+     * MINUS the primary key MINUS the discriminator), keeping create + patch validation on one
+     * SSOT: the PK is auto-generated and the discriminator is injected from the URL, so neither is
+     * validated from the body.</p>
      */
-    private static List<MetaField> settableFields(MetaObject entity, String alsoExclude) {
+    public static List<MetaField> settableFields(MetaObject entity, String alsoExclude) {
         List<String> pkFields = entity.getIdentities(true).stream()
             .filter(MetaIdentity::isPrimary)
             .findFirst()