bug: remediate audit control failures on money movement (amount validation, atomic transfer, CSRF, audit log)

[achalc]

Summary

Control test of 7 controls against the code, then remediation of the four that can be fixed safely in one PR. Results, file:line evidence and residual findings are in docs/audit-control-report.md.

Four control failures fixed:

• APP-TXN-01 amount validation — deposit/withdraw/transferAmount accepted any BigDecimal, so a negative transfer debited the recipient. All three now call validateAmount first:

  amount == null || amount <= 0 || amount.scale() > 2 || amount > MAX_TRANSACTION_AMOUNT  -> IllegalArgumentException

  plus a self-transfer guard (from.username.equals(toUsername)), the existing overdraft checks retained, and min/max/step on the amount inputs. BankController.deposit gained the error path the other two endpoints already had.
• APP-TXN-02 atomicity — @Transactional on deposit, withdraw, transferAmount. Previously the transfer's four repository writes auto-committed individually, so a failure after the debit destroyed money.
• APP-SEC-05 CSRF — dropped .csrf(csrf -> csrf.disable()) (Spring Security's CsrfFilter is on by default), added _csrf hidden inputs to every POST form, and made logout a POST form matched by AntPathRequestMatcher("/logout", "POST") instead of a GET link.
• ITGC-LOG-11 audit logging — new AuditLogger emits one structured line per financial event on both the success and failure path:

  event=financial_transaction timestamp=… actor=alice action=TRANSFER amount=250.00 fromAccountId=7 toAccountId=8 outcome=SUCCESS reason=""
  

Not fixed here, written up as residual findings R-1…R-6 with owner and reason: maker-checker/daily limits, the role model for SoD (needs a schema change), committed DB credentials (needs rotation + external secret store), CODEOWNERS/branch protection, the Jenkinsfile checking out a different upstream repo, and ddl-auto=update.

Verification

15 tests, BUILD SUCCESS, against a real MySQL (jdbc:mysql://localhost:3306/bankappdb, root/Test@123, mysql_native_password):

• AccountServiceValidationTest — negative/zero/over-limit amounts and overdraft on deposit, withdraw and transfer all reject with no repository write, and failures are audit-logged.
• TransferAtomicityIntegrationTest — injects a failure on the credit leg via @SpyBean TransactionRepository and asserts both balances and both ledger rows roll back; plus the happy path.
• BankControllerCsrfTest — POST /deposit and /transfer are 403 without a token, redirect with one.

docker run -d --name bankapp-mysql -e MYSQL_ROOT_PASSWORD=Test@123 -e MYSQL_DATABASE=bankappdb \
  -p 3306:3306 mysql:8.0 --default-authentication-plugin=mysql_native_password
./mvnw clean test

No schema-strategy change, no new secrets. mvnw is marked executable (it was committed without the bit).

Link to Devin session: https://app.devin.ai/sessions/40c0f70ecdf84cbda9b95eee5e32a754
Requested by: @achalc

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring