OC related + Certificate Trust in Metrics

[simonredfern]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
62 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.5% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR introduces Open Corridor Interface C support (promise evidence intake, per-bank broker registry, settle-pair netting with transactional outbox + publisher), and extends metrics to persist caller-certificate trust mode/detail (including schema migration and filtering), alongside related mTLS/PeerTrust hardening and test updates.

Changes:

• Add Open Corridor promise evidence report-back endpoint, broker registry, settle-pair netting flow, outbox relay, and locked Interface C DTOs / MessageDocs.
• Persist structured certificate trust (direct|forwarded|none + detail) into metrics + archive, with migration + query filtering + API JSON exposure.
• Harden PeerTrust/mTLS edge handling, dev-store protection, and expand/adjust test coverage for the above.

Reviewed changes

Copilot reviewed 47 out of 47 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
release_notes.md	Documents behaviour change: UK OB now uses PSD2-CERT (mTLS) rather than TPP-Signature-Certificate under ONLINE mode.
OPEN_CORRIDOR_SIMPLE_NETTING.md	Design note for bilateral, settle-on-demand netting over TransactionRequest/Transaction model.
OPEN_CORRIDOR_INTERFACE_C_PUBLISH_PLAN.md	Locked wire-contract + build plan; updated to reflect implemented OC work (evidence intake, brokers, outbox, settle).
obp-commons/src/main/scala/com/openbankproject/commons/dto/OpenCorridorInterfaceC.scala	Adds locked Interface C wire DTOs + reply envelope types.
obp-api/src/test/scala/code/metrics/MetricsTest.scala	Updates metrics test calls for new certificate trust fields.
obp-api/src/test/scala/code/api/v7_0_0/Http4s700RoutesTest.scala	Adds extensive v7 route tests for OC promise hold-at-PENDING, evidence intake, broker CRUD, and settle-pair netting/outbox behavior.
obp-api/src/test/scala/code/api/util/PeerTrustTest.scala	Adds tests for structured trust mode/detail and trust-without-TLS carve-out logic.
obp-api/src/test/scala/code/api/util/http4s/CallerCertificateTest.scala	Updates assertions to the structured trust resolution (mode/detail) stored in request attributes.
obp-api/src/test/scala/code/api/util/AgentDelegationTest.scala	Adds regression coverage for agent delegation primitives (CreatedByConsentId persistence; effectiveHumanUserId resolution).
obp-api/src/test/scala/bootstrap/http4s/NginxForwarderTest.scala	Makes nginx harness port dynamic and skips gracefully when host networking isn’t available.
obp-api/src/test/scala/bootstrap/http4s/Http4sMtlsTest.scala	Ensures dev-store digest map covers all checked-in stores and remains in sync.
obp-api/src/main/scala/code/transactionrequests/MappedTransactionRequestProvider.scala	Prevents external bulk-status feed from completing OPEN_CORRIDOR* TRs.
obp-api/src/main/scala/code/scheduler/MetricsArchiveScheduler.scala	Copies new certificate trust fields into archived metric rows.
obp-api/src/main/scala/code/metrics/MetricBatchWriter.scala	Extends metric batch insert to include certificate trust columns.
obp-api/src/main/scala/code/metrics/MappedMetrics.scala	Extends metrics persistence + archive save; adds certificate_trust filtering.
obp-api/src/main/scala/code/metrics/ElasticsearchMetrics.scala	Updates APIMetrics signatures for new fields (ES implementation still TODO).
obp-api/src/main/scala/code/metrics/APIMetrics.scala	Extends APIMetrics/APIMetric interfaces with certificate trust getters/params.
obp-api/src/main/scala/code/bankconnectors/rabbitmq/RabbitMQConnector_vOct2024.scala	Adds locked MessageDocs for OC Interface C messages (credit notification / settlement instruction).
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorSettlement.scala	Implements settle-pair netting, internal settlement TR, promise discharge linkage, and outbox enqueue.
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorPublisher.scala	Adds per-bank RabbitMQ publisher with publish-and-await-reply semantics.
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorProcessor.scala	Adds promise evidence attachment logic (idempotent, append-once, row-locked).
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorOutboxRelay.scala	Adds scheduled relay publishing outbox rows and recording replies with retry/backoff semantics.
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorOutbox.scala	Adds mapper table for transactional outbox row storage and queries.
obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorBankBroker.scala	Adds per-bank broker registry mapper + upsert/delete helpers.
obp-api/src/main/scala/code/bankconnectors/LocalMappedConnector.scala	Implements OC promise hold-at-PENDING logic and fixes empty-routing counterparty lookup.
obp-api/src/main/scala/code/api/v7_0_0/JSONFactory7.0.0.scala	Adds OC request/response JSON case classes; normalizes empty transaction_ids list.
obp-api/src/main/scala/code/api/v7_0_0/Http4s700.scala	Adds OC endpoints: promise evidence intake, broker CRUD, settle-pair; updates OC TR description/response example.
obp-api/src/main/scala/code/api/v6_0_0/JSONFactory6.0.0.scala	Extends v6 metrics JSON with certificate trust fields.
obp-api/src/main/scala/code/api/v6_0_0/Http4s600.scala	Documents new metrics query param certificate_trust.
obp-api/src/main/scala/code/api/util/WriteMetricUtil.scala	Propagates certificate trust fields into metric persistence and event payloads.
obp-api/src/main/scala/code/api/util/PeerTrust.scala	Introduces structured trust resolution (mode/detail) and edge-specific trust-without-TLS behavior.
obp-api/src/main/scala/code/api/util/OBPParam.scala	Adds OBPCertificateTrust query param type.
obp-api/src/main/scala/code/api/util/migration/MigrationOfMetricCertificateTrust.scala	Adds migration to create certificate trust columns on metric/metricarchive.
obp-api/src/main/scala/code/api/util/migration/Migration.scala	Wires the new migration into the migration runner.
obp-api/src/main/scala/code/api/util/http4s/Http4sSupport.scala	Changes request attribute to store full PeerTrust.Resolution and maps into CallContext fields.
obp-api/src/main/scala/code/api/util/http4s/CallerCertificate.scala	Stores structured PeerTrust.Resolution on the request attribute instead of a prose string.
obp-api/src/main/scala/code/api/util/ErrorMessages.scala	Adds Open Corridor error message constants.
obp-api/src/main/scala/code/api/util/APIUtil.scala	Ensures cached SimpleDateFormat instances follow current default timezone; adds certificate_trust parsing in metric params.
obp-api/src/main/scala/code/api/util/ApiSession.scala	Extends CallContext / CallContextLight with certificateTrustDetail.
obp-api/src/main/scala/code/api/util/ApiRole.scala	Adds roles for OC promise attach, broker config, and settle-pair trigger.
obp-api/src/main/scala/code/api/ResourceDocs1_4_0/SwaggerDefinitionsJSON.scala	Updates metrics example to include certificate trust fields.
obp-api/src/main/scala/bootstrap/liftweb/Boot.scala	Schemifies OC broker/outbox tables and starts outbox relay when enabled.
obp-api/src/main/scala/bootstrap/http4s/Http4sServer.scala	Forces PeerTrust config evaluation at boot for early surfacing of misconfig.
obp-api/src/main/scala/bootstrap/http4s/Http4sMtls.scala	Expands dev-store digest guard to cover all checked-in keystores and improves password fallback behavior.
obp-api/src/main/resources/props/sample.props.template	Documents mtls.trust_forwarded_header_without_tls carve-out when OBP is the TLS edge.
docs/MTLS.md	Documents the same mtls.trust_forwarded_header_without_tls carve-out.
docs/MTLS_TOPOLOGIES.md	Adds topology note for the carve-out and observability implications.

Comments suppressed due to low confidence (3)

obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorSettlement.scala:160

• netAbs.toString() can emit values without a 2-decimal scale (e.g. "4"), but Open Corridor amounts are defined/assumed as major units with 2 decimals (see Interface C docs). Format the amount deterministically to 2 decimals before serializing.
  obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorSettlement.scala:236
• obp_settlement_instruction.amount is part of the locked wire contract and is documented as a 2-decimal major-unit string. Using netAbs.toString() can drop trailing zeros; format to a fixed 2-decimal representation to keep the wire shape stable.
  obp-api/src/main/scala/code/bankconnectors/opencorridor/OpenCorridorSettlement.scala:256
• net_amount in the settle response is part of the endpoint contract; using netAbs.toString() can return values without a scale (e.g. "4"). Format to 2 decimals so clients and tests can treat it as a money amount consistently.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.