MokuLakshithReddy commented on code in PR #149:
URL:
https://github.com/apache/fineract-consumer-facing/pull/149#discussion_r4120531134
##########
consumer/src/main/java/org/apache/fineract/consumer/audit/command/service/AuditCommandServiceImpl.java:
##########
@@ -62,11 +64,22 @@ public AuditCommandServiceImpl(AuditEventCommandRepository
auditEventCommandRepo
AuditPiiScreen auditPiiScreen, ObjectMapper objectMapper,
@Value(MAX_BATCH_SIZE_PROPERTY) int maxBatchSize,
@Value(MAX_DETAILS_BYTES_PROPERTY) int maxDetailsBytes) {
+ this(auditEventCommandRepository, accessPolicyEvaluator,
userClientResolver, auditPiiScreen,
+ objectMapper, null, maxBatchSize, maxDetailsBytes);
+ }
+
+ public AuditCommandServiceImpl(AuditEventCommandRepository
auditEventCommandRepository,
+ AccessPolicyEvaluator accessPolicyEvaluator, UserClientResolver
userClientResolver,
+ AuditPiiScreen auditPiiScreen, ObjectMapper objectMapper,
+ CorrelationIdHolder correlationIdHolder,
+ @Value(MAX_BATCH_SIZE_PROPERTY) int maxBatchSize,
+ @Value(MAX_DETAILS_BYTES_PROPERTY) int maxDetailsBytes) {
Review Comment:
Resolved! Removed the legacy constructor overload and explicitly marked the
full constructor with @Autowired to ensure unambiguous Spring dependency
injection and prevent startup failure.
##########
consumer/src/main/java/org/apache/fineract/consumer/audit/command/service/ServerAuditEventListener.java:
##########
@@ -41,6 +42,11 @@ public class ServerAuditEventListener {
private final AuditEventCommandRepository auditEventCommandRepository;
private final ObjectMapper objectMapper;
+ private final CorrelationIdHolder correlationIdHolder;
+
+ public ServerAuditEventListener(AuditEventCommandRepository
auditEventCommandRepository, ObjectMapper objectMapper) {
+ this(auditEventCommandRepository, objectMapper, null);
+ }
Review Comment:
Resolved! Removed the duplicate 2-argument constructor so only the single
constructor generated by @RequiredArgsConstructor is used by Spring, avoiding
ambiguous constructor selection.
##########
consumer/src/main/java/org/apache/fineract/consumer/audit/command/service/ServerAuditEventListener.java:
##########
@@ -57,8 +63,9 @@ public void
onNonTransactionalEvent(NonTransactionalAuditEvent event) {
private void persist(UUID eventUuid, AuditEventType eventType, Long userId,
boolean unknownPrincipal, String deviceFingerprint, Map<String,
Object> details) {
try {
+ String correlationId = correlationIdHolder != null ?
correlationIdHolder.get() : null;
AuditEvent entity = AuditEvent.forServerEvent(eventUuid,
eventType, eventType.getSeverity(), userId,
- unknownPrincipal, deviceFingerprint, serialize(details));
+ unknownPrincipal, deviceFingerprint, serialize(details),
correlationId);
Review Comment:
Resolved! Added correlationId property to both TransactionalAuditEvent and
NonTransactionalAuditEvent. When events are instantiated on the request thread,
CorrelationIdHolder.getCurrentCorrelationId() is automatically captured into
the event. ServerAuditEventListener now reads and persists the event's captured
correlation ID, ensuring it survives async and post-commit off-thread execution.
##########
consumer/src/main/java/org/apache/fineract/consumer/infrastructure/correlation/filter/CorrelationIdFilter.java:
##########
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.fineract.consumer.infrastructure.correlation.filter;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.UUID;
+import lombok.RequiredArgsConstructor;
+import
org.apache.fineract.consumer.infrastructure.correlation.service.CorrelationIdHolder;
+import org.apache.fineract.consumer.infrastructure.web.data.ConsumerHeaders;
+import org.slf4j.MDC;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+@RequiredArgsConstructor
+public class CorrelationIdFilter extends OncePerRequestFilter {
+
+ private static final String MDC_CORRELATION_ID_KEY = "correlationId";
+
+ private final CorrelationIdHolder correlationIdHolder;
+
+ @Override
+ protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
+ FilterChain filterChain) throws ServletException, IOException {
+ String correlationId =
request.getHeader(ConsumerHeaders.CORRELATION_ID);
+ if (correlationId == null || correlationId.isBlank()) {
+ correlationId = UUID.randomUUID().toString();
Review Comment:
Resolved! Added length and character validation (^[a-zA-Z0-9_.-]{1,64}$) in
CorrelationIdFilter. Any missing, blank, overlong (> 64 chars), or malformed
correlation IDs are automatically replaced with a generated UUID before setting
the holder, response headers, MDC, and downstream requests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
