feat(compliance): expose the kyc rest api with oauth2 security - #278
Merged
Conversation
Turn the compliance module into an OAuth2 resource server and expose the
KYC session lifecycle over HTTP: POST /v1/kyc/sessions starts a session
and GET /v1/kyc/sessions/{id} reads it, guarded by compliance:write and
compliance:read scopes. Errors follow RFC 7807, ids cross the wire as
prefixed-ULID strings via a hand mapper, and the service ships the
standard health, prometheus and structured-logging baseline. The
Idempotency-Key handling is split into a follow-up.
Closes #275
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the KYC vertical of E-04 Compliance (#275, the web layer split from #265).
What
KycController: POST /v1/kyc/sessions (compliance:write, 201 + Location) and GET /{id} (compliance:read); thin methods, value-class id crosses the wire as a prefixed-ULID string via a handKycApiMapper.SecurityConfig: OAuth2 resource server; GET /v1/kyc/** = compliance:read, mutating = compliance:write; public = swagger/api-docs + actuator health + prometheus; stateless, csrf disabled.GlobalExceptionHandler+ProblemType: not-found -> 404, illegal transition / optimistic-lock -> 409, validation / unreadable / bad id -> 400, fallback -> 500.build.gradle.kts: data-JPA -> full web (web/security/oauth2/actuator/validation/springdoc/micrometer/otel + observability).application.yml: oauth2 issuer-uri, management health/info/prometheus, structured logging + PII masking (keeps the Liquibase change-log).@WebMvcTest(201/401/403/200/404/400 scope cases, mock service + JwtDecoder) + a@SpringBootTestcontext IT (Testcontainers + fakeKycProvider+ mock JwtDecoder +@DynamicPropertySource) asserting the OpenAPI doc and an end-to-end POST+GET round-trip through Postgres.Notes
@DynamicPropertySource+ a fake provider bean (the orchestrator@Serviceneeds one).Gate chain
All local gates green; the context IT runs on CI.
Closes #275