fix: preserve correlation ID in withdrawal events and guard uncompiled eligibility (#2040)

* fix: preserve correlation ID in withdrawal status events and guard uncompiled eligibility rules

Pass the existing correlation ID from context into buildWithdrawalStatusEvent
instead of generating a fresh UUID, maintaining distributed trace continuity
across the withdrawal saga.

Return an Internal error in validateProductTypeConstraints when EligibilityCEL
is non-empty but EligibilityProgram is nil, preventing silent bypass of
eligibility checks when the CEL compiler is not configured.

* fix: fall back to new UUID when context has no correlation ID

* fix: seed correlation ID at handler level in ExecuteWithdrawal

Extract correlation ID from context/metadata at the top of the
ExecuteWithdrawal handler and seed it into the context before passing
it to the orchestrator and completePendingWithdrawal. This ensures a
single trace ID flows through the entire request lifecycle instead of
generating a new UUID in completeWithdrawalWithOutbox when the context
value was not set.

---------

Co-authored-by: Ben Coombs <bjcoombs@users.noreply.github.com>

Author: bjcoombs

services/current-account/service/grpc_withdrawal_execute.go

@@ -13,9 +13,11 @@ import (
 	"github.com/meridianhub/meridian/services/current-account/adapters/persistence"
 	"github.com/meridianhub/meridian/services/current-account/domain"
 	caobservability "github.com/meridianhub/meridian/services/current-account/observability"
+	sharedclients "github.com/meridianhub/meridian/shared/pkg/clients"
 	"github.com/meridianhub/meridian/shared/pkg/idempotency"
 	"github.com/meridianhub/meridian/shared/platform/events"
 	"github.com/meridianhub/meridian/shared/platform/events/topics"
+	"github.com/meridianhub/meridian/shared/platform/observability"
 	"github.com/meridianhub/meridian/shared/platform/tenant"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -73,6 +75,13 @@ func (s *Service) ExecuteWithdrawal(ctx context.Context, req *pb.ExecuteWithdraw
 		}()
 	}
 
+	// Extract correlation ID from context/metadata and seed it so all downstream calls share the same trace
+	correlationID := sharedclients.ExtractCorrelationID(ctx)
+	if correlationID == "" {
+		correlationID = uuid.New().String()
+	}
+	ctx = observability.WithCorrelationID(ctx, correlationID)
+
 	// Retrieve and prepare account for withdrawal
 	account, amount, transactionID, opStatus, err := s.prepareAccountForWithdrawal(ctx, accountID, reqAmount)
 	if err != nil {
@@ -314,8 +323,8 @@ func (s *Service) completeWithdrawalWithOutbox(ctx context.Context, withdrawal *
 		return s.completeWithdrawalDirect(ctx, withdrawal)
 	}
 
-	// Create and marshal event payload
-	eventPayload, err := buildWithdrawalStatusEvent(withdrawal, accountID)
+	// Create and marshal event payload (correlation ID is seeded at handler level)
+	eventPayload, err := buildWithdrawalStatusEvent(withdrawal, accountID, observability.GetCorrelationID(ctx))
 	if err != nil {
 		return err
 	}
@@ -365,14 +374,14 @@ func (s *Service) completeWithdrawalDirect(ctx context.Context, withdrawal *doma
 }
 
 // buildWithdrawalStatusEvent creates and marshals a WithdrawalStatusUpdatedEvent.
-func buildWithdrawalStatusEvent(withdrawal *domain.Withdrawal, accountID uuid.UUID) ([]byte, error) {
+func buildWithdrawalStatusEvent(withdrawal *domain.Withdrawal, accountID uuid.UUID, correlationID string) ([]byte, error) {
 	now := time.Now().UTC()
 	event := &eventsv1.WithdrawalStatusUpdatedEvent{
 		EventId:       uuid.New().String(),
 		WithdrawalId:  withdrawal.Reference,
 		AccountId:     accountID.String(),
 		Status:        "COMPLETED",
-		CorrelationId: uuid.New().String(),
+		CorrelationId: correlationID,
 		CausationId:   withdrawal.Reference,
 		Timestamp:     timestamppb.New(now),
 		Version:       int64(withdrawal.Version),

services/current-account/service/validators.go

@@ -151,6 +151,10 @@ func (s *Service) validateProductTypeConstraints(
 	attributes map[string]string,
 	productTypeCode, accountID string,
 ) (string, error) {
+	if cachedType.Definition.EligibilityCEL != "" && cachedType.EligibilityProgram == nil {
+		return "eligibility_not_compiled",
+			status.Errorf(codes.Internal, "eligibility rule is configured but not compiled for product type %s", productTypeCode)
+	}
 	if cachedType.EligibilityProgram != nil {
 		if opStatus, err := s.checkEligibility(ctx, cachedType, partyID, attributes, productTypeCode, accountID); err != nil {
 			return opStatus, err

services/current-account/service/validators_test.go

@@ -12,6 +12,7 @@ import (
 	partyv1 "github.com/meridianhub/meridian/api/proto/meridian/party/v1"
 	quantitypb "github.com/meridianhub/meridian/api/proto/meridian/quantity/v1"
 	"github.com/meridianhub/meridian/services/current-account/domain"
+	"github.com/meridianhub/meridian/services/reference-data/accounttype"
 	"github.com/meridianhub/meridian/services/reference-data/cache"
 	"github.com/meridianhub/meridian/services/reference-data/registry"
 	"github.com/stretchr/testify/assert"
@@ -495,3 +496,30 @@ func (m *getPartyErrorClient) GetParty(_ context.Context, _ string) (*partyv1.Pa
 	return nil, m.err
 }
 func (m *getPartyErrorClient) Close() error { return nil }
+
+// ---------------------------------------------------------------------------
+// validateProductTypeConstraints
+// ---------------------------------------------------------------------------
+
+func TestValidateProductTypeConstraints_EligibilityCELWithNilProgram(t *testing.T) {
+	svc := &Service{
+		logger: validatorsTestLogger(),
+	}
+
+	def := &accounttype.Definition{
+		EligibilityCEL: `party.type == "PERSON"`,
+	}
+	cachedType := &CachedAccountType{
+		Definition:         def,
+		EligibilityProgram: nil,
+	}
+
+	opStatus, err := svc.validateProductTypeConstraints(context.Background(), cachedType, "party-1", nil, "SAVINGS", "test-account")
+	require.Error(t, err)
+
+	st, ok := status.FromError(err)
+	require.True(t, ok, "expected gRPC status error")
+	assert.Equal(t, codes.Internal, st.Code())
+	assert.Contains(t, st.Message(), "eligibility rule is configured but not compiled")
+	assert.Equal(t, "eligibility_not_compiled", opStatus)
+}