feature: migrate Bill Payment (CB00/COBIL00C) to Spring Boot + DB2 + Angular by devin-ai-integration[bot] · Pull Request #183 · COG-GTM/mainframe-modernization-carddemo

devin-ai-integration · 2026-07-21T16:55:29Z

Summary

Migrates the CardDemo online Bill Payment transaction (CB00 / app/cbl/COBIL00C.cbl, map app/bms/COBIL00.bms) from COBOL/CICS/VSAM to a Java Spring Boot backend (JPA + Flyway, IBM DB2 at runtime, H2 in DB2-compatibility mode for hermetic tests) and an Angular 17 screen. Behavior is reproduced 1:1 from COBIL00C — validation order, confirm dispatch, transaction-id sequencing, business constants, and the exact user-facing messages. Parity-harness mode is OFF; correctness is proven via functional-requirement unit tests, an API+DB E2E test, a live DB2 round-trip, and a UI recording.

New code lives under stack/ (nothing in app/ changes); docs under functional/BILLPAY/.

Core logic (`BillPaymentService.process`, mirrors `PROCESS-ENTER-KEY`)

if acctId blank            -> ERROR "Acct ID can NOT be empty..."        (field ACCT_ID)
parse acctId; not numeric  -> ERROR "Account ID NOT found..."
switch confirm:
  Y/y -> confirmYes=true
  N/n -> CLEARED (screen cleared, no data change)
  ""  -> confirmYes=false
  else-> ERROR "Invalid value. Valid values are (Y/N)..."               (field CONFIRM)
account = find(acctId); missing -> ERROR "Account ID NOT found..."
if balance <= 0            -> ERROR "You have nothing to pay..."
if !confirmYes             -> INFO  "Confirm to make a bill payment..."  (shows balance)
# payment path (@Transactional):
card   = cardXref.findByAcct(acctId)
newId  = format16(maxNumericTranId + 1)                 # ENDFILE -> 0000000000000001
insert TRANSACTION{ amt=balance, type='02', cat=2, source='POS TERM',
                    desc='BILL PAYMENT - ONLINE', merchant=999999999/'BILL PAYMENT'/'N/A'/'N/A',
                    card=card, origTs=procTs=now }
account.balance -= amt      # -> 0.00
-> SUCCESS "Payment successful.  Your Transaction ID is <id>."          # note: two spaces

What's included

Schema (db/migration/V1__billpay_schema.sql): ACCOUNT, CARD_XREF (+ index on acct id, mirroring the CXACAIX AIX), TRANSACTION — derived from copybooks CVACT01Y / CVACT03Y / CVTRA05Y. Portable DDL (DB2 + H2).
REST: POST /api/billpay/inquiry (ENTER, confirm blank), POST /api/billpay/pay (ENTER with confirm). Response carries messageType (SUCCESS→green / ERROR|INFO→red), balanceDisplay formatted as COBOL PIC +9999999999.99, transactionId, and fieldInError.
Frontend: 3270-style Bill Payment screen (Acct ID + Confirm, balance, message line, ENTER/F3/F4).
CI: .github/workflows/billpay-ci.yml — backend mvn verify, frontend ng test (headless) + ng build.
Docs: functional/BILLPAY/ stream map, analysis, functional requirements, migration plan, sign-off, independent audit, recording checklist.

Verification

Backend: mvn test → 13 passing (service FR-2..FR-9, E2E API+DB row assertions, balance formatting).
Frontend: ng test → 7 passing; ng build → success.
DB2 round-trip against icr.io/db2_community/db2:11.5.9.0: /pay for account 11 (bal 123.45) returned txn 0000000000000101; DB2 then showed ACCT_CURR_BAL=0.00 and the new TRANSACTION row (type 02, cat 2, amt 123.45, card 4111111111111111, desc BILL PAYMENT - ONLINE).

Notes / out of scope

No stored procedures (analysis confirmed plain JPA leaves).
Sign-on, menu, and other CardDemo transactions remain COBOL (outside this slice).
CICS pseudo-conversation/commarea → stateless REST; screen state lives in the Angular component.

Link to Devin session: https://app.devin.ai/sessions/e72a530052014e97a5ec6a9a37b51c28

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

…Angular Migrate the CardDemo online Bill Payment transaction from COBOL/CICS/VSAM to a Java Spring Boot backend (JPA + Flyway, DB2 with H2 DB2-mode for tests) and an Angular 17 screen, preserving COBIL00C behavior 1:1 (validation order, confirm dispatch, transaction-id sequencing, business constants, and exact messages). - backend: BillPaymentService, REST controller, entities/repos, Flyway schema - frontend: 3270-style Bill Payment screen (ENTER/F3/F4) - tests: 13 backend + 7 frontend; E2E asserts API + persisted DB rows - CI: .github/workflows/billpay-ci.yml - docs: analysis, FR, plan, sign-off, audit, recording checklist Co-Authored-By: Parker Duff <pwjduff@gmail.com>

devin-ai-integration · 2026-07-21T16:55:31Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

devin-ai-integration · 2026-07-21T17:01:27Z

Runtime test results — Bill Payment UI ✅

Drove the migrated Angular UI (localhost:4200) against the Spring Boot backend (localhost:8080, demo seed) through the browser and confirmed persistence via the backend API. All assertions passed.

Confirmed full-balance payment (the money-movement proof):

Account 11 (balance +0000000123.45) → Y + ENTER → GREEN Payment successful. Your Transaction ID is 0000000000000101., balance zeroed to +0000000000.00, inputs cleared. A follow-up API inquiry returns 0.00 and a repeat pay returns You have nothing to pay..., proving the balance was durably committed. Txn id ...101 = seeded max ...100 + 1 (max-plus-one sequencing).

Guard cases (each shows the exact COBOL message in red)

Blank Acct ID → Acct ID can NOT be empty...
Zero-balance acct 12 → You have nothing to pay...
Confirm X → Invalid value. Valid values are (Y/N)...

Automated: backend 13 tests + frontend 7 tests passing; CI green. A real IBM DB2 11.5.9.0 round-trip was also verified earlier (see functional/BILLPAY/BillPay_migration_signoff.md).

Devin session: https://app.devin.ai/sessions/e72a530052014e97a5ec6a9a37b51c28

Co-Authored-By: Parker Duff <pwjduff@gmail.com>

devin-ai-integration

Devin Review found 11 potential issues.

devin-ai-integration · 2026-08-31T13:23:49Z

+        }
+
+        // READ-ACCTDAT-FILE (COBIL00C.cbl:343-372) — read for both Y and blank confirm.
+        Optional<AccountEntity> accountOpt = accountRepository.findById(acctId);


🔴 Concurrent confirmations duplicate payments

Concurrent process calls can read one positive balance without locking it. Both can record the full payment, or one fails with HTTP 500.

Prompt for agents

BillPaymentService.process reads the account with AccountRepository.findById before generating a max-plus-one transaction ID, but neither the account row nor the ID allocation is serialized. Concurrent requests for the same account can both retain the original positive balance. Depending on timing, they either create separate full-balance payment rows or generate the same ID and expose a database exception as HTTP 500. Make payment confirmation atomic per account, for example with a pessimistic account-row lock or an equivalent conditional update, and replace max-plus-one allocation with a concurrency-safe sequence or retry strategy. Add concurrent integration tests for the same account and different accounts.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:50Z

+/** Client for the migrated Bill Payment (CB00 / COBIL00C) REST endpoints. */
+@Injectable({ providedIn: 'root' })
+export class BillPaymentService {
+  private readonly baseUrl = 'http://localhost:8080/api/billpay';


🔴 Production clients call localhost

The production bundle hard-codes baseUrl to localhost. Remote browsers send every payment request to the user's computer instead of the deployed backend.

Prompt for agents

BillPaymentService hard-codes http://localhost:8080, and the Angular project has no environment replacement or runtime configuration. Configure the API origin per environment, or use a same-origin relative /api/billpay URL with a development proxy. Update frontend tests and local-development configuration accordingly.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:51Z

+  onBack(): void {
+    this.messageType = 'INFO';
+    this.message = 'F3=Back: returning to the previous menu (COMEN01C).';


🟡 Back action never navigates

Calling onBack only changes a message. F3 leaves users on Bill Payment instead of returning to the calling screen.

Prompt for agents

BillPaymentComponent.onBack only displays a message, although F3 must return to the calling screen. Integrate this action with the application's actual navigation boundary, preserving the caller when available and falling back to the main menu. Add a component or routing test that verifies the screen is left.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:52Z

+    }
+    this.messageType = r.messageType;
+    this.message = r.message;
+    this.balanceDisplay = r.balanceDisplay || this.balanceDisplay;


🟡 Errors retain an old balance

When balanceDisplay is empty, applyResponse preserves the previous balance. A later account error therefore displays another account's balance.

Suggested change

this.balanceDisplay = r.balanceDisplay || this.balanceDisplay;

this.balanceDisplay = r.balanceDisplay;

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:54Z

+  ngOnInit(): void {
+    this.updateClock();
+    setInterval(() => this.updateClock(), 1000);
+  }


🔍 Clock timers outlive the screen

setInterval is never cleared. Recreating this component accumulates timers that retain destroyed instances and run every second.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:56Z

+    @PostMapping("/inquiry")
+    public BillPaymentResponse inquiry(@RequestBody InquiryRequest request) {
+        BillPaymentResult result = service.inquiry(request.getAcctId());
+        return BillPaymentResponse.from(result);
+    }
+
+    @PostMapping("/pay")
+    public BillPaymentResponse pay(@RequestBody PayRequest request) {
+        BillPaymentResult result = service.process(request.getAcctId(), request.getConfirm());
+        return BillPaymentResponse.from(result);


🔍 Business failures use HTTP 200

Every bill-payment rejection returns HTTP 200 with an error field. API clients and monitoring must inspect each response body to detect failure.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:58Z

+    @PostMapping("/pay")
+    public BillPaymentResponse pay(@RequestBody PayRequest request) {
+        BillPaymentResult result = service.process(request.getAcctId(), request.getConfirm());
+        return BillPaymentResponse.from(result);


🟥 Unauthenticated callers can pay accounts

The inquiry and payment endpoints accept requests without authentication or account authorization. Any caller can inspect and pay a guessed account.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:23:59Z

+    username: ${DB2_USER:db2inst1}
+    password: ${DB2_PASSWORD:carddemo123}


🟥 Default database password is public

Runtime configuration and Docker Compose publish the DB2 administrator password. Any deployment retaining it exposes full database access to repository readers.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:24:00Z

+ */
+@RestController
+@RequestMapping("/api/billpay")
+@CrossOrigin


🟨 Payment API allows every origin

Unrestricted @CrossOrigin lets any website invoke inquiry and payment requests from visitors' browsers. Restrict access to trusted frontend origins.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:24:02Z

+    public BillPaymentResponse pay(@RequestBody PayRequest request) {
+        BillPaymentResult result = service.process(request.getAcctId(), request.getConfirm());


🟨 Account input bypasses field limits

Direct API callers can submit signed or oversized account values beyond the 11-digit contract. Validate request fields at the server boundary.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-31T13:24:08Z

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session

feature: add Bill Payment UI test plan and runtime test report

d6f99e6

Co-Authored-By: Parker Duff <pwjduff@gmail.com>

devin-ai-integration Bot commented Aug 31, 2026

View reviewed changes

	this.balanceDisplay = r.balanceDisplay \|\| this.balanceDisplay;
	this.balanceDisplay = r.balanceDisplay;

		username: ${DB2_USER:db2inst1}
		password: ${DB2_PASSWORD:carddemo123}

		public BillPaymentResponse pay(@RequestBody PayRequest request) {
		BillPaymentResult result = service.process(request.getAcctId(), request.getConfirm());

Uh oh!

Conversation

devin-ai-integration Bot commented Jul 21, 2026 • edited by staging-devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Core logic (BillPaymentService.process, mirrors PROCESS-ENTER-KEY)

What's included

Verification

Notes / out of scope

Devin Review

Uh oh!

devin-ai-integration Bot commented Jul 21, 2026

🤖 Devin AI Engineer

Uh oh!

devin-ai-integration Bot commented Jul 21, 2026

Runtime test results — Bill Payment UI ✅

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

devin-ai-integration Bot commented Jul 21, 2026 •

edited by staging-devin-ai-integration Bot

Loading

Core logic (`BillPaymentService.process`, mirrors `PROCESS-ENTER-KEY`)