sebi/effigenix
1
0
Fork 0
mirror of https://github.com/s-frick/effigenix.git synced 2026-03-28 15:49:35 +01:00
Code Issues Releases Activity Actions

fix(inventory): Review-Fixes für US-6.1 InventoryCount

Browse source 
- GlobalExceptionHandler und ErrorResponse nach infrastructure.shared
  extrahieren (war fälschlich in usermanagement)
- CountItem.deviation() prüft UOM-Kompatibilität
- InvalidInventoryCountId Error-Typ für null/blank ID (400 statt 404)
- saveChildren() auf UPSERT (UPDATE→INSERT) mit Orphan-Cleanup umstellen
- logger.trace → logger.warn bei DB-Fehlern
- Stocks ohne Batches in CreateInventoryCount überspringen
- AuthorizationPort Defense in Depth in alle 3 InventoryCount Use Cases
- Kombinierter DB-Index auf (storage_location_id, status)
This commit is contained in:
Sebastian Frick 2026-02-26 19:14:55 +01:00
parent c047ca93de
commit a214002fab
19 changed files with 205 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

23
backend/src/main/java/de/effigenix/application/inventory/CreateInventoryCount.java
View file

@ -4,22 +4,31 @@ import de.effigenix.application.inventory.command.CreateInventoryCountCommand;
import de.effigenix.domain.inventory.*;
import de.effigenix.shared.common.Result;
import de.effigenix.shared.persistence.UnitOfWork;
import de.effigenix.shared.security.ActorId;
import de.effigenix.shared.security.AuthorizationPort;
public class CreateInventoryCount {
private final InventoryCountRepository inventoryCountRepository;
private final StockRepository stockRepository;
private final UnitOfWork unitOfWork;
private final AuthorizationPort authPort;
public CreateInventoryCount(InventoryCountRepository inventoryCountRepository,
StockRepository stockRepository,
UnitOfWork unitOfWork) {
UnitOfWork unitOfWork,
AuthorizationPort authPort) {
this.inventoryCountRepository = inventoryCountRepository;
this.stockRepository = stockRepository;
this.unitOfWork = unitOfWork;
this.authPort = authPort;
}
public Result<InventoryCountError, InventoryCount> execute(CreateInventoryCountCommand cmd) {
public Result<InventoryCountError, InventoryCount> execute(CreateInventoryCountCommand cmd, ActorId actorId) {
if (!authPort.can(actorId, InventoryAction.INVENTORY_COUNT_WRITE)) {
return Result.failure(new InventoryCountError.Unauthorized("Not authorized to create inventory counts"));
}
// 1. Draft aus Command bauen
var draft = new InventoryCountDraft(cmd.storageLocationId(), cmd.countDate(), cmd.initiatedBy());
@ -48,14 +57,16 @@ public class CreateInventoryCount {
{ return Result.failure(new InventoryCountError.RepositoryFailure(err.message())); }
case Result.Success(var stocks) -> {
for (Stock stock : stocks) {
// Gesamtmenge aus Batches berechnen
// Skip stocks without batches – nothing to count
if (stock.batches().isEmpty()) {
continue;
}
var totalAmount = stock.batches().stream()
.map(b -> b.quantity().amount())
.reduce(java.math.BigDecimal.ZERO, java.math.BigDecimal::add);
String unit = stock.batches().isEmpty()
? "KILOGRAM"
: stock.batches().getFirst().quantity().uom().name();
String unit = stock.batches().getFirst().quantity().uom().name();
var itemDraft = new CountItemDraft(
stock.articleId().value(),

15
backend/src/main/java/de/effigenix/application/inventory/GetInventoryCount.java
View file

@ -1,22 +1,31 @@
package de.effigenix.application.inventory;
import de.effigenix.domain.inventory.InventoryAction;
import de.effigenix.domain.inventory.InventoryCount;
import de.effigenix.domain.inventory.InventoryCountError;
import de.effigenix.domain.inventory.InventoryCountId;
import de.effigenix.domain.inventory.InventoryCountRepository;
import de.effigenix.shared.common.Result;
import de.effigenix.shared.security.ActorId;
import de.effigenix.shared.security.AuthorizationPort;
public class GetInventoryCount {
private final InventoryCountRepository inventoryCountRepository;
private final AuthorizationPort authPort;
public GetInventoryCount(InventoryCountRepository inventoryCountRepository) {
public GetInventoryCount(InventoryCountRepository inventoryCountRepository, AuthorizationPort authPort) {
this.inventoryCountRepository = inventoryCountRepository;
this.authPort = authPort;
}
public Result<InventoryCountError, InventoryCount> execute(String inventoryCountId) {
public Result<InventoryCountError, InventoryCount> execute(String inventoryCountId, ActorId actorId) {
if (!authPort.can(actorId, InventoryAction.INVENTORY_COUNT_READ)) {
return Result.failure(new InventoryCountError.Unauthorized("Not authorized to view inventory counts"));
}
if (inventoryCountId == null || inventoryCountId.isBlank()) {
return Result.failure(new InventoryCountError.InventoryCountNotFound(inventoryCountId));
return Result.failure(new InventoryCountError.InvalidInventoryCountId("must not be blank"));
}
return switch (inventoryCountRepository.findById(InventoryCountId.of(inventoryCountId))) {

12
backend/src/main/java/de/effigenix/application/inventory/ListInventoryCounts.java
View file

@ -3,18 +3,26 @@ package de.effigenix.application.inventory;
import de.effigenix.domain.inventory.*;
import de.effigenix.shared.common.RepositoryError;
import de.effigenix.shared.common.Result;
import de.effigenix.shared.security.ActorId;
import de.effigenix.shared.security.AuthorizationPort;
import java.util.List;
public class ListInventoryCounts {
private final InventoryCountRepository inventoryCountRepository;
private final AuthorizationPort authPort;
public ListInventoryCounts(InventoryCountRepository inventoryCountRepository) {
public ListInventoryCounts(InventoryCountRepository inventoryCountRepository, AuthorizationPort authPort) {
this.inventoryCountRepository = inventoryCountRepository;
this.authPort = authPort;
}
public Result<InventoryCountError, List<InventoryCount>> execute(String storageLocationId) {
public Result<InventoryCountError, List<InventoryCount>> execute(String storageLocationId, ActorId actorId) {
if (!authPort.can(actorId, InventoryAction.INVENTORY_COUNT_READ)) {
return Result.failure(new InventoryCountError.Unauthorized("Not authorized to view inventory counts"));
}
if (storageLocationId != null) {
StorageLocationId locId;
try {

8
backend/src/main/java/de/effigenix/domain/inventory/CountItem.java
View file

@ -74,12 +74,18 @@ public class CountItem {
/**
* Computed deviation: actualQuantity - expectedQuantity.
* Returns null if actualQuantity has not been set yet.
* Returns null if actualQuantity has not been set yet or if UOMs are incompatible.
*
* Invariant: actualQuantity and expectedQuantity should always share the same UOM.
* A UOM mismatch indicates a data integrity issue.
*/
public BigDecimal deviation() {
if (actualQuantity == null) {
return null;
}
if (actualQuantity.uom() != expectedQuantity.uom()) {
return null;
}
return actualQuantity.amount().subtract(expectedQuantity.amount());
}

5
backend/src/main/java/de/effigenix/domain/inventory/InventoryCountError.java
View file

@ -65,6 +65,11 @@ public sealed interface InventoryCountError {
@Override public String message() { return "Counter must not be the same person who initiated the count"; }
}
record InvalidInventoryCountId(String reason) implements InventoryCountError {
@Override public String code() { return "INVALID_INVENTORY_COUNT_ID"; }
@Override public String message() { return "Invalid inventory count ID: " + reason; }
}
record InventoryCountNotFound(String id) implements InventoryCountError {
@Override public String code() { return "INVENTORY_COUNT_NOT_FOUND"; }
@Override public String message() { return "Inventory count not found: " + id; }

12
backend/src/main/java/de/effigenix/infrastructure/config/InventoryUseCaseConfiguration.java
View file

@ -159,17 +159,17 @@ public class InventoryUseCaseConfiguration {
// ==================== InventoryCount Use Cases ====================
@Bean
public CreateInventoryCount createInventoryCount(InventoryCountRepository inventoryCountRepository, StockRepository stockRepository, UnitOfWork unitOfWork) {
return new CreateInventoryCount(inventoryCountRepository, stockRepository, unitOfWork);
public CreateInventoryCount createInventoryCount(InventoryCountRepository inventoryCountRepository, StockRepository stockRepository, UnitOfWork unitOfWork, AuthorizationPort authorizationPort) {
return new CreateInventoryCount(inventoryCountRepository, stockRepository, unitOfWork, authorizationPort);
}
@Bean
public GetInventoryCount getInventoryCount(InventoryCountRepository inventoryCountRepository) {
return new GetInventoryCount(inventoryCountRepository);
public GetInventoryCount getInventoryCount(InventoryCountRepository inventoryCountRepository, AuthorizationPort authorizationPort) {
return new GetInventoryCount(inventoryCountRepository, authorizationPort);
}
@Bean
public ListInventoryCounts listInventoryCounts(InventoryCountRepository inventoryCountRepository) {
return new ListInventoryCounts(inventoryCountRepository);
public ListInventoryCounts listInventoryCounts(InventoryCountRepository inventoryCountRepository, AuthorizationPort authorizationPort) {
return new ListInventoryCounts(inventoryCountRepository, authorizationPort);
}
}

66
backend/src/main/java/de/effigenix/infrastructure/inventory/persistence/repository/JdbcInventoryCountRepository.java
View file

@ -45,7 +45,7 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
}
return Result.success(Optional.of(loadChildren(countOpt.get(), id.value())));
} catch (Exception e) {
logger.trace("Database error in findById", e);
logger.warn("Database error in findById", e);
return Result.failure(new RepositoryError.DatabaseError(e.getMessage()));
}
}
@ -58,7 +58,7 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
.list();
return Result.success(loadChildrenForAll(counts));
} catch (Exception e) {
logger.trace("Database error in findAll", e);
logger.warn("Database error in findAll", e);
return Result.failure(new RepositoryError.DatabaseError(e.getMessage()));
}
}
@ -72,7 +72,7 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
.list();
return Result.success(loadChildrenForAll(counts));
} catch (Exception e) {
logger.trace("Database error in findByStorageLocationId", e);
logger.warn("Database error in findByStorageLocationId", e);
return Result.failure(new RepositoryError.DatabaseError(e.getMessage()));
}
}
@ -90,7 +90,7 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
.single();
return Result.success(count > 0);
} catch (Exception e) {
logger.trace("Database error in existsActiveByStorageLocationId", e);
logger.warn("Database error in existsActiveByStorageLocationId", e);
return Result.failure(new RepositoryError.DatabaseError(e.getMessage()));
}
}
@ -122,7 +122,7 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
return Result.success(null);
} catch (Exception e) {
logger.trace("Database error in save", e);
logger.warn("Database error in save", e);
return Result.failure(new RepositoryError.DatabaseError(e.getMessage()));
}
}
@ -142,29 +142,59 @@ public class JdbcInventoryCountRepository implements InventoryCountRepository {
private void saveChildren(InventoryCount count) {
String countId = count.id().value();
// Delete + re-insert count items
jdbc.sql("DELETE FROM count_items WHERE inventory_count_id = :countId")
.param("countId", countId)
.update();
// Remove orphaned items no longer in the aggregate
List<String> currentIds = count.countItems().stream()
.map(item -> item.id().value())
.toList();
if (currentIds.isEmpty()) {
jdbc.sql("DELETE FROM count_items WHERE inventory_count_id = :countId")
.param("countId", countId)
.update();
} else {
jdbc.sql("DELETE FROM count_items WHERE inventory_count_id = :countId AND id NOT IN (:ids)")
.param("countId", countId)
.param("ids", currentIds)
.update();
}
// Upsert each item (UPDATE → INSERT)
for (CountItem item : count.countItems()) {
jdbc.sql("""
INSERT INTO count_items
(id, inventory_count_id, article_id,
expected_quantity_amount, expected_quantity_unit,
actual_quantity_amount, actual_quantity_unit)
VALUES (:id, :countId, :articleId,
:expectedQuantityAmount, :expectedQuantityUnit,
:actualQuantityAmount, :actualQuantityUnit)
int rows = jdbc.sql("""
UPDATE count_items
SET article_id = :articleId,
expected_quantity_amount = :expectedQuantityAmount,
expected_quantity_unit = :expectedQuantityUnit,
actual_quantity_amount = :actualQuantityAmount,
actual_quantity_unit = :actualQuantityUnit
WHERE id = :id
""")
.param("id", item.id().value())
.param("countId", countId)
.param("articleId", item.articleId().value())
.param("expectedQuantityAmount", item.expectedQuantity().amount())
.param("expectedQuantityUnit", item.expectedQuantity().uom().name())
.param("actualQuantityAmount", item.actualQuantity() != null ? item.actualQuantity().amount() : null)
.param("actualQuantityUnit", item.actualQuantity() != null ? item.actualQuantity().uom().name() : null)
.update();
if (rows == 0) {
jdbc.sql("""
INSERT INTO count_items
(id, inventory_count_id, article_id,
expected_quantity_amount, expected_quantity_unit,
actual_quantity_amount, actual_quantity_unit)
VALUES (:id, :countId, :articleId,
:expectedQuantityAmount, :expectedQuantityUnit,
:actualQuantityAmount, :actualQuantityUnit)
""")
.param("id", item.id().value())
.param("countId", countId)
.param("articleId", item.articleId().value())
.param("expectedQuantityAmount", item.expectedQuantity().amount())
.param("expectedQuantityUnit", item.expectedQuantity().uom().name())
.param("actualQuantityAmount", item.actualQuantity() != null ? item.actualQuantity().amount() : null)
.param("actualQuantityUnit", item.actualQuantity() != null ? item.actualQuantity().uom().name() : null)
.update();
}
}
}

15
backend/src/main/java/de/effigenix/infrastructure/inventory/web/controller/InventoryCountController.java
View file

@ -7,6 +7,7 @@ import de.effigenix.application.inventory.command.CreateInventoryCountCommand;
import de.effigenix.domain.inventory.InventoryCountError;
import de.effigenix.infrastructure.inventory.web.dto.CreateInventoryCountRequest;
import de.effigenix.infrastructure.inventory.web.dto.InventoryCountResponse;
import de.effigenix.shared.security.ActorId;
import io.swagger.v3.oas.annotations.security.SecurityRequirement;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.validation.Valid;
@ -48,7 +49,7 @@ public class InventoryCountController {
authentication.getName()
);
var result = createInventoryCount.execute(cmd);
var result = createInventoryCount.execute(cmd, ActorId.of(authentication.getName()));
if (result.isFailure()) {
throw new InventoryCountDomainErrorException(result.unsafeGetError());
@ -60,8 +61,11 @@ public class InventoryCountController {
@GetMapping("/{id}")
@PreAuthorize("hasAuthority('INVENTORY_COUNT_READ')")
public ResponseEntity<InventoryCountResponse> getInventoryCount(@PathVariable String id) {
var result = getInventoryCount.execute(id);
public ResponseEntity<InventoryCountResponse> getInventoryCount(
@PathVariable String id,
Authentication authentication
) {
var result = getInventoryCount.execute(id, ActorId.of(authentication.getName()));
if (result.isFailure()) {
throw new InventoryCountDomainErrorException(result.unsafeGetError());
@ -73,9 +77,10 @@ public class InventoryCountController {
@GetMapping
@PreAuthorize("hasAuthority('INVENTORY_COUNT_READ')")
public ResponseEntity<List<InventoryCountResponse>> listInventoryCounts(
@RequestParam(required = false) String storageLocationId
@RequestParam(required = false) String storageLocationId,
Authentication authentication
) {
var result = listInventoryCounts.execute(storageLocationId);
var result = listInventoryCounts.execute(storageLocationId, ActorId.of(authentication.getName()));
if (result.isFailure()) {
throw new InventoryCountDomainErrorException(result.unsafeGetError());

1
backend/src/main/java/de/effigenix/infrastructure/inventory/web/exception/InventoryErrorHttpStatusMapper.java
View file

@ -69,6 +69,7 @@ public final class InventoryErrorHttpStatusMapper {
case InventoryCountError.InvalidInitiatedBy e -> 400;
case InventoryCountError.InvalidArticleId e -> 400;
case InventoryCountError.InvalidQuantity e -> 400;
case InventoryCountError.InvalidInventoryCountId e -> 400;
case InventoryCountError.Unauthorized e -> 403;
case InventoryCountError.RepositoryFailure e -> 500;
};

2
backend/src/main/java/de/effigenix/infrastructure/security/ApiAccessDeniedHandler.java
View file

@ -1,7 +1,7 @@
package de.effigenix.infrastructure.security;
import com.fasterxml.jackson.databind.ObjectMapper;
import de.effigenix.infrastructure.usermanagement.web.dto.ErrorResponse;
import de.effigenix.infrastructure.shared.web.exception.ErrorResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.slf4j.Logger;

2
backend/src/main/java/de/effigenix/infrastructure/security/ApiAuthenticationEntryPoint.java
View file

@ -1,7 +1,7 @@
package de.effigenix.infrastructure.security;
import com.fasterxml.jackson.databind.ObjectMapper;
import de.effigenix.infrastructure.usermanagement.web.dto.ErrorResponse;
import de.effigenix.infrastructure.shared.web.exception.ErrorResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.slf4j.Logger;

2
backend/src/main/java/de/effigenix/infrastructure/usermanagement/web/dto/ErrorResponse.java → backend/src/main/java/de/effigenix/infrastructure/shared/web/exception/ErrorResponse.java
View file

@ -1,4 +1,4 @@
package de.effigenix.infrastructure.usermanagement.web.dto;
package de.effigenix.infrastructure.shared.web.exception;
import io.swagger.v3.oas.annotations.media.Schema;

50
backend/src/main/java/de/effigenix/infrastructure/usermanagement/web/exception/GlobalExceptionHandler.java → backend/src/main/java/de/effigenix/infrastructure/shared/web/exception/GlobalExceptionHandler.java
View file

@ -1,4 +1,4 @@
package de.effigenix.infrastructure.usermanagement.web.exception;
package de.effigenix.infrastructure.shared.web.exception;
import de.effigenix.domain.inventory.InventoryCountError;
import de.effigenix.domain.inventory.StockMovementError;
@ -30,7 +30,7 @@ import de.effigenix.infrastructure.masterdata.web.exception.MasterDataErrorHttpS
import de.effigenix.infrastructure.usermanagement.web.controller.AuthController;
import de.effigenix.infrastructure.usermanagement.web.controller.RoleController;
import de.effigenix.infrastructure.usermanagement.web.controller.UserController;
import de.effigenix.infrastructure.usermanagement.web.dto.ErrorResponse;
import de.effigenix.infrastructure.usermanagement.web.exception.UserErrorHttpStatusMapper;
import io.sentry.Sentry;
import jakarta.servlet.http.HttpServletRequest;
@ -372,10 +372,6 @@ public class GlobalExceptionHandler {
* Handles validation errors from @Valid annotations.
*
* Returns 400 Bad Request with list of validation errors.
* Example:
* - Username is required
* - Email must be valid
* - Password must be at least 8 characters
*
* @param ex Validation exception
* @param request HTTP request
@ -412,17 +408,6 @@ public class GlobalExceptionHandler {
.body(errorResponse);
}
/**
* Handles authentication errors (e.g., invalid JWT token).
*
* Returns 401 Unauthorized.
* This is typically caught by SecurityConfig's authenticationEntryPoint,
* but included here for completeness.
*
* @param ex Authentication exception
* @param request HTTP request
* @return Error response with 401 status
*/
@ExceptionHandler(AuthenticationException.class)
public ResponseEntity<ErrorResponse> handleAuthenticationError(
AuthenticationException ex,
@ -442,16 +427,6 @@ public class GlobalExceptionHandler {
.body(errorResponse);
}
/**
* Handles authorization errors (missing permissions).
*
* Returns 403 Forbidden.
* Triggered when user lacks required permission for an action.
*
* @param ex Access denied exception
* @param request HTTP request
* @return Error response with 403 status
*/
@ExceptionHandler(AccessDeniedException.class)
public ResponseEntity<ErrorResponse> handleAccessDeniedError(
AccessDeniedException ex,
@ -471,15 +446,6 @@ public class GlobalExceptionHandler {
.body(errorResponse);
}
/**
* Handles illegal arguments (e.g., invalid UUID format).
*
* Returns 400 Bad Request.
*
* @param ex Illegal argument exception
* @param request HTTP request
* @return Error response with 400 status
*/
@ExceptionHandler(IllegalArgumentException.class)
public ResponseEntity<ErrorResponse> handleIllegalArgumentError(
IllegalArgumentException ex,
@ -499,18 +465,6 @@ public class GlobalExceptionHandler {
.body(errorResponse);
}
/**
* Handles unexpected runtime errors.
*
* Returns 500 Internal Server Error.
* Logs full stack trace for debugging.
*
* IMPORTANT: Do not expose internal error details to clients in production!
*
* @param ex Runtime exception
* @param request HTTP request
* @return Error response with 500 status
*/
@ExceptionHandler(RuntimeException.class)
public ResponseEntity<ErrorResponse> handleRuntimeError(
RuntimeException ex,

16
backend/src/main/resources/db/changelog/changes/036-add-inventory-counts-composite-index.xml Normal file
View file

@ -0,0 +1,16 @@
<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd">
<changeSet id="036-add-inventory-counts-composite-index" author="effigenix">
<createIndex indexName="idx_inventory_counts_location_status"
tableName="inventory_counts">
<column name="storage_location_id"/>
<column name="status"/>
</createIndex>
</changeSet>
</databaseChangeLog>

1
backend/src/main/resources/db/changelog/db.changelog-master.xml
View file

@ -41,5 +41,6 @@
<include file="db/changelog/changes/034-create-inventory-counts-schema.xml"/>
<include file="db/changelog/changes/035-seed-inventory-count-permissions.xml"/>
<include file="db/changelog/changes/036-add-inventory-counts-composite-index.xml"/>
</databaseChangeLog>