Skip to content

fix: no role checks #305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
v1tt0ri0Alt wants to merge 4 commits into
base: develop
Choose a base branch
from
+113 −48
Draft

fix: no role checks #305

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3b85588
Commented role checks for promotions
v1tt0ri0Alt Dec 11, 2025
d3433be
modified the check for 15% for both L1 and L2
v1tt0ri0Alt Dec 11, 2025
e453e73
prevent L3 promotion from bypassing 15% transaction elaboration check
v1tt0ri0Alt Dec 11, 2025
ca81603
added tests for coverage
v1tt0ri0Alt Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 17 additions & 20 deletions src/main/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
import java.util.Locale;
import java.util.Set;

import static it.gov.pagopa.idpay.transactions.utils.ExceptionConstants.ExceptionCode.REWARD_BATCH_NOT_FOUND;
//import static it.gov.pagopa.idpay.transactions.utils.ExceptionConstants.ExceptionCode.REWARD_BATCH_NOT_FOUND;

Check warning on line 39 in src/main/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImpl.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This block of commented-out lines of code should be removed. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsOC2e-vdfbJeZ_GnUO&open=AZsOC2e-vdfbJeZ_GnUO&pullRequest=305
import static it.gov.pagopa.idpay.transactions.utils.ExceptionConstants.ExceptionMessage.ERROR_MESSAGE_NOT_FOUND_REWARD_BATCH_SENT;

@Service
Expand Down Expand Up @@ -604,15 +604,7 @@

RewardBatchAssignee assignee = batch.getAssigneeLevel();

if (assignee == RewardBatchAssignee.L1) {

if (!"operator1".equals(organizationRole)) {
return Mono.error(new ResponseStatusException(
HttpStatus.FORBIDDEN,
ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L1_PROMOTION
));
}

if (assignee == RewardBatchAssignee.L1 || assignee == RewardBatchAssignee.L2 || assignee == RewardBatchAssignee.L3) {
long total = batch.getNumberOfTransactions();
long elaborated = batch.getNumberOfTransactionsElaborated();

Expand All @@ -622,24 +614,29 @@
ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT
));
}
}

if (assignee == RewardBatchAssignee.L1) {
// if (!"operator1".equals(organizationRole)) {

Check warning on line 620 in src/main/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImpl.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This block of commented-out lines of code should be removed. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsOC2e-vdfbJeZ_GnUP&open=AZsOC2e-vdfbJeZ_GnUP&pullRequest=305
// return Mono.error(new ResponseStatusException(
// HttpStatus.FORBIDDEN,
// ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L1_PROMOTION
// ));
// }

batch.setAssigneeLevel(RewardBatchAssignee.L2);
return rewardBatchRepository.save(batch).then();
}

if (assignee == RewardBatchAssignee.L2) {

if (!"operator2".equals(organizationRole)) {
return Mono.error(new ResponseStatusException(
HttpStatus.FORBIDDEN,
ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L2_PROMOTION
));
}

// if (!"operator2".equals(organizationRole)) {

Check warning on line 631 in src/main/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImpl.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This block of commented-out lines of code should be removed. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsOC2e-vdfbJeZ_GnUQ&open=AZsOC2e-vdfbJeZ_GnUQ&pullRequest=305
// return Mono.error(new ResponseStatusException(
// HttpStatus.FORBIDDEN,
// ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L2_PROMOTION
// ));
// }
batch.setAssigneeLevel(RewardBatchAssignee.L3);
return rewardBatchRepository.save(batch).then();
}

return Mono.error(new ResponseStatusException(
HttpStatus.BAD_REQUEST,
ExceptionConstants.ExceptionCode.INVALID_BATCH_STATE_FOR_PROMOTION
Expand Down
124 changes: 96 additions & 28 deletions src/test/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1653,8 +1653,11 @@
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L2)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(20L)
.build();


when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));
when(rewardBatchRepository.save(any())).thenAnswer(invocation -> Mono.just(invocation.getArgument(0)));

Expand All @@ -1665,72 +1668,130 @@
assertEquals(RewardBatchAssignee.L3, batch.getAssigneeLevel());
}

// @Test
// void validateRewardBatch_RoleNotAllowed_L1() {

Check warning on line 1672 in src/test/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImplTest.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This block of commented-out lines of code should be removed. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsOC2bUvdfbJeZ_GnUM&open=AZsOC2bUvdfbJeZ_GnUM&pullRequest=305
// RewardBatch batch = RewardBatch.builder()
// .id(REWARD_BATCH_ID_1)
// .assigneeLevel(RewardBatchAssignee.L1)
// .numberOfTransactions(100L)
// .numberOfTransactionsElaborated(20L)
// .build();
//
// when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));
//
// StepVerifier.create(rewardBatchService.validateRewardBatch("wrongRole", INITIATIVE_ID, REWARD_BATCH_ID_1))
// .expectErrorSatisfies(ex -> {
// assertInstanceOf(ResponseStatusException.class, ex);
// assertEquals(HttpStatus.FORBIDDEN, ((ResponseStatusException) ex).getStatusCode());
// assertEquals(ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L1_PROMOTION,
// ((ResponseStatusException) ex).getReason());
// })
// .verify();
// }

@Test
void validateRewardBatch_RoleNotAllowed_L1() {
void validateRewardBatch_LessThan15Percent() {
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L1)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(20L)
.numberOfTransactionsElaborated(10L)
.build();

when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));

StepVerifier.create(rewardBatchService.validateRewardBatch("wrongRole", INITIATIVE_ID, REWARD_BATCH_ID_1))
StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.FORBIDDEN, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L1_PROMOTION,
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT,
((ResponseStatusException) ex).getReason());
})
.verify();
}

// @Test
// void validateRewardBatch_RoleNotAllowed_L2() {

Check warning on line 1714 in src/test/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImplTest.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This block of commented-out lines of code should be removed. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsOC2bUvdfbJeZ_GnUN&open=AZsOC2bUvdfbJeZ_GnUN&pullRequest=305
// RewardBatch batch = RewardBatch.builder()
// .id(REWARD_BATCH_ID_1)
// .assigneeLevel(RewardBatchAssignee.L2)
// .build();
//
// when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));
//
// StepVerifier.create(rewardBatchService.validateRewardBatch("wrongRole", INITIATIVE_ID, REWARD_BATCH_ID_1))
// .expectErrorSatisfies(ex -> {
// assertInstanceOf(ResponseStatusException.class, ex);
// assertEquals(HttpStatus.FORBIDDEN, ((ResponseStatusException) ex).getStatusCode());
// assertEquals(ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L2_PROMOTION,
// ((ResponseStatusException) ex).getReason());
// })
// .verify();
// }

@Test
void validateRewardBatch_LessThan15Percent() {
void validateRewardBatch_InvalidState() {
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L1)
.assigneeLevel(RewardBatchAssignee.L3)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(10L)
.numberOfTransactionsElaborated(20L)
.build();

when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));

StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
StepVerifier.create(rewardBatchService.validateRewardBatch("operator3", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT,
assertEquals(ExceptionConstants.ExceptionCode.INVALID_BATCH_STATE_FOR_PROMOTION,
((ResponseStatusException) ex).getReason());
})
.verify();
}

@Test
void validateRewardBatch_NotFound() {
when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.empty());

StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.NOT_FOUND, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.REWARD_BATCH_NOT_FOUND,
((ResponseStatusException) ex).getReason());
})
.verify();
}

@Test
void validateRewardBatch_RoleNotAllowed_L2() {
void validateRewardBatch_TotalZero() {
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L2)
.assigneeLevel(RewardBatchAssignee.L1)
.numberOfTransactions(0L)
.numberOfTransactionsElaborated(0L)
.build();

when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));

StepVerifier.create(rewardBatchService.validateRewardBatch("wrongRole", INITIATIVE_ID, REWARD_BATCH_ID_1))
StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.FORBIDDEN, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.ROLE_NOT_ALLOWED_FOR_L2_PROMOTION,
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT,
((ResponseStatusException) ex).getReason());
})
.verify();
}

@Test
void validateRewardBatch_InvalidState() {
void validateRewardBatch_L3_ElaborationCheck() {
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L3)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(10L)
.build();

when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));
Expand All @@ -1739,42 +1800,49 @@
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.INVALID_BATCH_STATE_FOR_PROMOTION,
assertEquals(ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT,
((ResponseStatusException) ex).getReason());
})
.verify();
}

@Test
void validateRewardBatch_NotFound() {
when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.empty());
void validateRewardBatch_L3ValidElaboration() {

Check warning on line 1810 in src/test/java/it/gov/pagopa/idpay/transactions/service/RewardBatchServiceImplTest.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Update this method so that its implementation is not identical to "validateRewardBatch_InvalidState" on line 1733. 


See more on https://sonarcloud.io/project/issues?id=pagopa_idpay-transactions&issues=AZsONVuVmFVxrVg-dI6I&open=AZsONVuVmFVxrVg-dI6I&pullRequest=305
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L3)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(20L)
.build();

StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));

StepVerifier.create(rewardBatchService.validateRewardBatch("operator3", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.NOT_FOUND, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.REWARD_BATCH_NOT_FOUND,
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.INVALID_BATCH_STATE_FOR_PROMOTION,
((ResponseStatusException) ex).getReason());
})
.verify();
}

@Test
void validateRewardBatch_TotalZero() {
void validateRewardBatch_AssigneeNotL1L2L3() {
RewardBatch batch = RewardBatch.builder()
.id(REWARD_BATCH_ID_1)
.assigneeLevel(RewardBatchAssignee.L1)
.numberOfTransactions(0L)
.numberOfTransactionsElaborated(0L)
.assigneeLevel(null)
.numberOfTransactions(100L)
.numberOfTransactionsElaborated(20L)
.build();

when(rewardBatchRepository.findById(REWARD_BATCH_ID_1)).thenReturn(Mono.just(batch));

StepVerifier.create(rewardBatchService.validateRewardBatch("operator1", INITIATIVE_ID, REWARD_BATCH_ID_1))
StepVerifier.create(rewardBatchService.validateRewardBatch("operatorX", INITIATIVE_ID, REWARD_BATCH_ID_1))
.expectErrorSatisfies(ex -> {
assertInstanceOf(ResponseStatusException.class, ex);
assertEquals(HttpStatus.BAD_REQUEST, ((ResponseStatusException) ex).getStatusCode());
assertEquals(ExceptionConstants.ExceptionCode.BATCH_NOT_ELABORATED_15_PERCENT,
assertEquals(ExceptionConstants.ExceptionCode.INVALID_BATCH_STATE_FOR_PROMOTION,
((ResponseStatusException) ex).getReason());
})
.verify();
Expand Down
Loading