Merge remote-tracking branch 'origin/master' into BFD-4348-prune-older-claim-versions-excluding-part-d

# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.

Author: patrickgmayday

.github/workflows/v3-release-deploy.yml

@@ -388,7 +388,8 @@ jobs:
         idr-pipeline-metrics,
         idr-pipeline-alarms,
         server-ng,
-        server-ng-metrics
+        server-ng-metrics,
+        server-ng-alarms
       git-ref: ${{ github.ref_name }}
       per-service-vars-json: >-
         {

apps/bfd-pipeline-idr/model/base_model.py

@@ -850,13 +850,18 @@ def stale_phase_1_claims_query(
     cutoff_date: datetime,
 ) -> tuple[str, tuple[datetime, datetime]]:
     return (
-        f""" 
+        f"""
+            WITH claims AS (
+                SELECT clm.clm_uniq_id 
+                FROM {header_table} clm
+                WHERE clm.clm_type_cd BETWEEN {PHASE_1_SS_MIN} AND {PHASE_1_SS_MAX}
+                AND clm.clm_src_id IN ('{FISS_CLM_SOURCE}', '{MCS_CLM_SOURCE}', '{VMS_CLM_SOURCE}')
+                AND clm.bfd_updated_ts < %s
+                ORDER BY clm.bfd_updated_ts, clm.clm_uniq_id
+            )
             SELECT clm.clm_uniq_id 
-            FROM {header_table} clm
-            WHERE clm.clm_type_cd BETWEEN {PHASE_1_SS_MIN} AND {PHASE_1_SS_MAX}
-            AND clm.clm_src_id IN ('{FISS_CLM_SOURCE}', '{MCS_CLM_SOURCE}', '{VMS_CLM_SOURCE}')
-            AND clm.bfd_updated_ts < %s
-            AND NOT EXISTS (
+            FROM claims clm
+            WHERE NOT EXISTS (
                 SELECT 1 FROM {item_table} item
                 WHERE clm.clm_uniq_id = item.clm_uniq_id
                 AND item.bfd_updated_ts >= %s

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/Application.java

@@ -83,14 +83,19 @@ public Clock systemClock() {
    * @param configuration app configuration
    * @param auditEventRepository Audit Event Repository
    * @param objectMapper object mapper
+   * @param certPartnersConfiguration certificate configuration
    * @return audit logger
    */
   @Bean
   public AuditLogger auditLogger(
       Configuration configuration,
       AuditEventRepository auditEventRepository,
-      ObjectMapper objectMapper) {
-    return configuration.getAuditLogger(auditEventRepository, objectMapper);
+      ObjectMapper objectMapper,
+      CertPartnersConfiguration certPartnersConfiguration) {
+    return configuration.getAuditLogger(
+        auditEventRepository,
+        objectMapper,
+        certPartnersConfiguration.getPartnerNamesByCertificateAlias());
   }
 
   /**

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/CertPartnersConfiguration.java

@@ -0,0 +1,51 @@
+package gov.cms.bfd.server.ng;
+
+import com.google.gson.Gson;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Collectors;
+import lombok.Data;
+import lombok.Getter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+/** Typed representation of cert partner configuration loaded from properties. */
+@Data
+@Component
+@ConfigurationProperties("bfd.nonsensitive")
+public class CertPartnersConfiguration {
+  private CertPartnerProperties certPartners = new CertPartnerProperties();
+
+  @Getter(lazy = true)
+  private final Map<String, String> partnerNamesByCertificateAlias =
+      getPartnerNamesByCertificateAliasInternal();
+
+  private Map<String, String> getPartnerNamesByCertificateAliasInternal() {
+    return certPartners.getPartnerCertificate().entrySet().stream()
+        .flatMap(
+            entry -> {
+              var partner = new Gson().fromJson(entry.getValue(), Partner.class);
+              return partner.getCertificateAliases().stream()
+                  .filter(Objects::nonNull)
+                  .map(alias -> Map.entry(alias, partner.getName()));
+            })
+        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
+  }
+
+  /** bfd.nonsensitive.cert_partners properties. */
+  @Data
+  private static class CertPartnerProperties {
+    private Map<String, String> partnerCertificate = new HashMap<>();
+  }
+
+  /** Partner certificate configuration from cert_partners properties. */
+  @Data
+  private static class Partner {
+    private String name;
+
+    private List<String> certificateAliases = new ArrayList<>();
+  }
+}

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/Configuration.java

@@ -118,13 +118,17 @@ public DataSourceFactory getDataSourceFactory() {
    *
    * @param auditEventRepository used for logging to DynamoDB
    * @param objectMapper used for serializing patient audit records
+   * @param partnerAliases used for mapping certificate aliases to partner names
    * @return audit logger
    */
   public AuditLogger getAuditLogger(
-      AuditEventRepository auditEventRepository, ObjectMapper objectMapper) {
+      AuditEventRepository auditEventRepository,
+      ObjectMapper objectMapper,
+      Map<String, String> partnerAliases) {
     var logStreamLogger = new LogStreamAuditLogger(objectMapper);
     if (getAuditLoggerType() == AuditLoggerType.DYNAMO_DB) {
-      var dynamoLogger = new DynamoDbAuditLogger(auditEventRepository, objectMapper);
+      var dynamoLogger =
+          new DynamoDbAuditLogger(auditEventRepository, objectMapper, partnerAliases);
 
       return auditRecord -> {
         logStreamLogger.log(auditRecord);

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/audit/AuditEventBase.java

@@ -9,6 +9,7 @@
 import static gov.cms.bfd.server.ng.util.LoggerConstants.FINAL_DETERMINATION;
 import static gov.cms.bfd.server.ng.util.LoggerConstants.MATCHED_BENE_SK;
 import static gov.cms.bfd.server.ng.util.LoggerConstants.MATCH_ALGORITHM_VERSION;
+import static gov.cms.bfd.server.ng.util.LoggerConstants.PARTNER_APP_NAME;
 import static gov.cms.bfd.server.ng.util.LoggerConstants.TIMESTAMP;
 
 import gov.cms.bfd.server.ng.util.SystemUrls;
@@ -41,6 +42,7 @@ public class AuditEventBase {
   private String combinationsEvaluated;
   private String finalDetermination;
   private String matchAlgorithmVersion;
+  private String partnerAppName;
 
   /**
    * Create Audit Table Schema For DynamoDB. We use this rather than @DynamoDbBean. This annotation
@@ -106,6 +108,12 @@ public class AuditEventBase {
                   a.name(MATCH_ALGORITHM_VERSION)
                       .getter(AuditEventBase::getMatchAlgorithmVersion)
                       .setter(AuditEventBase::setMatchAlgorithmVersion))
+          .addAttribute(
+              String.class,
+              a ->
+                  a.name(PARTNER_APP_NAME)
+                      .getter(AuditEventBase::getPartnerAppName)
+                      .setter(AuditEventBase::setPartnerAppName))
           .build();
 
   /**

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/beneficiary/model/PatientMatchAuditRecord.java

@@ -19,4 +19,5 @@ public record PatientMatchAuditRecord(
     String clientId,
     Instant timestamp,
     List<MatchCombinationResult> combinationsEvaluated,
-    Optional<FinalDetermination> finalDetermination) {}
+    Optional<FinalDetermination> finalDetermination,
+    String certAlias) {}

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/log/DynamoDbAuditLogger.java

@@ -6,6 +6,7 @@
 import gov.cms.bfd.server.ng.audit.AuditEventRepository;
 import gov.cms.bfd.server.ng.beneficiary.model.PatientMatchAuditRecord;
 import java.util.HashSet;
+import java.util.Map;
 import lombok.AllArgsConstructor;
 import software.amazon.awssdk.services.dynamodb.model.DynamoDbException;
 
@@ -15,6 +16,7 @@ public class DynamoDbAuditLogger implements AuditLogger {
 
   private final AuditEventRepository auditEventRepository;
   private final ObjectMapper objectMapper;
+  private final Map<String, String> partnerAliases;
 
   @Override
   public void log(PatientMatchAuditRecord auditRecord) {
@@ -30,6 +32,8 @@ public void log(PatientMatchAuditRecord auditRecord) {
         auditEvent.setTimestamp(auditRecord.timestamp().toString());
         auditEvent.setClientId(auditRecord.clientId());
         auditEvent.setClientName(auditRecord.clientName());
+        auditEvent.setPartnerAppName(
+            partnerAliases.getOrDefault(auditRecord.certAlias(), "Unknown"));
         auditEvent.setClientIp(auditRecord.clientIp());
         auditEvent.setCombinationsEvaluated(
             objectMapper.writeValueAsString(auditRecord.combinationsEvaluated()));

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/patient/PatientHandler.java

@@ -105,14 +105,16 @@ public Bundle matchPatient(Optional<PatientMatch> patientMatch) {
     var clientIp = MDC.get(logKey(MDC_PREFIX, CLIENT_IP_KEY));
     var clientName = MDC.get(logKey(MDC_PREFIX, CLIENT_NAME_KEY));
     var clientId = MDC.get(logKey(MDC_PREFIX, CLIENT_ID_KEY));
+    var certAlias = MDC.get(logKey(MDC_PREFIX, CERTIFICATE_ALIAS));
     var auditRecord =
         new PatientMatchAuditRecord(
             clientIp,
             clientName,
             clientId,
             Instant.now(),
             result.combinations(),
-            result.finalDetermination());
+            result.finalDetermination(),
+            certAlias);
     auditLogger.log(auditRecord);
 
     return patientMatchBundle(beneficiary);

apps/bfd-server-ng/src/main/java/gov/cms/bfd/server/ng/util/CertificateUtil.java

@@ -19,7 +19,9 @@ public class CertificateUtil {
   private final Configuration configuration;
   private final Environment environment;
 
-  private static final String LEAF_CERT_HEADER = "X-Amzn-Mtls-Clientcert";
+  /** Header name for the leaf certificate in the request. */
+  public static final String LEAF_CERT_HEADER = "X-Amzn-Mtls-Clientcert";
+
   private static final String CLIENT_CERT_ALIAS_ATTRIBUTE = "CLIENT_CERT_ALIAS";
 
   /**