DEV Community: Charlie Fubon

Heueirin

Charlie Fubon — Mon, 22 Jun 2026 06:23:39 +0000

Good progress — 41 tests run, only 4 errors. Let me trace each one precisely.

Error 1 — doVendorCall_non200StatusCode_returnsError:

Exception: RSAAdapter vendor error: {"result":{"status":"Failure"...
"detailMessage":"could not establish connection with backend"}}

doVendorCall throws an exception when status is non-200 — buildVendorException throws, not returns. Our test called adapter.execute(apiContext) directly on RSAAdapter, not RSATask. RSAAdapter.execute() doesn't catch — it propagates. The test expected a result with status 500 but instead got an uncaught exception. Fix: wrap in try/catch in the test, assert the exception message.

Error 2 — doVendorCall_olbbOrg_usesOlbbHost:

Runtime: RSAAdapter: could not retrieve OLBB secret: Unable to load credentials

OLBB path hits getOlbbSecret() which tries real AWS credentials. Our config has olbbRSACrSMRole: "" — empty string doesn't start with arn:aws:iam:: so it falls to SecretsManagerUtil.getSecretValue("") which tries to connect to real AWS. Fix: add olbbRSACrSMRole as a fake ARN in config so it goes to fetchSecretWithAssumeRole, then override that too — OR simpler, override getOlbbSecret() in TestableRSAAdapter.

Error 3 — doVendorCall_timeoutResponse_throwsWithTimeoutMessage:
Same issue as Error 1 — buildVendorException throws, test expected result.get("status") but got exception.

Error 4 — execute_unknownCallType_throwsException:

Exception: RSAAdapter: unrecognized callType 'unknown'

Same — RSAAdapter.execute() throws, test expected result.get("status") = "500" but exception propagated uncaught.

All four fixes — update these tests:

Fix errors 1, 3, 4 — these tests need to catch the exception instead of reading result status:

@Test
void execute_unknownCallType_throwsException() throws Exception {
    TestableRSAAdapter adapter = new TestableRSAAdapter(
            mapper.readTree(FULL_CONFIG), analyzeResponseXml());
    JsonNode payload = buildPayload("unknown", "HARRIS", "CA");
    ObjectNode apiContext = mapper.createObjectNode();
    apiContext.set("headers", mapper.createObjectNode()
            .put("x-request-id", "test"));
    apiContext.set("data", payload);

    Exception ex = assertThrows(Exception.class,
            () -> adapter.execute(apiContext));
    assertTrue(ex.getMessage().contains("unrecognized callType"),
            "Unknown callType must throw with descriptive message");
}

@Test
void doVendorCall_non200StatusCode_throwsVendorException() throws Exception {
    JsonNode config = mapper.readTree(FULL_CONFIG);
    RSAAdapter adapter = new RSAAdapter(config) {
        @Override
        protected JsonNode postRawXml(String url, ObjectNode headers,
                String xmlBody) throws Exception {
            ObjectNode root = mapper.createObjectNode();
            root.put("status", "500");
            root.put("message", "DataPower backside connection error");
            ObjectNode data = mapper.createObjectNode();
            data.put("xml", "");
            root.set("data", data);
            return root;
        }
    };
    ObjectNode apiContext = mapper.createObjectNode();
    apiContext.set("headers", mapper.createObjectNode()
            .put("x-request-id", "test"));
    apiContext.set("data", buildPayload("analyze", "HARRIS", "CA"));

    Exception ex = assertThrows(Exception.class,
            () -> adapter.execute(apiContext));
    assertTrue(ex.getMessage().contains("vendor error"),
            "Non-200 must throw vendor exception");
    assertTrue(ex.getMessage().contains("could not establish connection"),
            "DataPower error must have correct detail message");
}

@Test
void doVendorCall_timeoutResponse_throwsWithTimeoutMessage() throws Exception {
    JsonNode config = mapper.readTree(FULL_CONFIG);
    RSAAdapter adapter = new RSAAdapter(config) {
        @Override
        protected JsonNode postRawXml(String url, ObjectNode headers,
                String xmlBody) throws Exception {
            ObjectNode root = mapper.createObjectNode();
            root.put("status", "504");
            root.put("message", "ESOCKETTIMEDOUT");
            ObjectNode data = mapper.createObjectNode();
            data.put("xml", "");
            root.set("data", data);
            return root;
        }
    };
    ObjectNode apiContext = mapper.createObjectNode();
    apiContext.set("headers", mapper.createObjectNode()
            .put("x-request-id", "test"));
    apiContext.set("data", buildPayload("analyze", "HARRIS", "CA"));

    Exception ex = assertThrows(Exception.class,
            () -> adapter.execute(apiContext));
    assertTrue(ex.getMessage().contains("backend returned with timeout"),
            "Timeout must produce correct detail message");
}

Fix error 2 — override getOlbbSecret in TestableRSAAdapter to avoid real AWS calls:

Add this override to TestableRSAAdapter:

static class TestableRSAAdapter extends RSAAdapter {
    String lastCalledUrl;
    String fakeResponseXml;

    TestableRSAAdapter(JsonNode config, String fakeResponseXml)
            throws Exception {
        super(config);
        this.fakeResponseXml = fakeResponseXml;
    }

    @Override
    protected JsonNode postRawXml(String url, ObjectNode headers,
            String xmlBody) throws Exception {
        this.lastCalledUrl = url;
        ObjectNode root = mapper.createObjectNode();
        root.put("status", "200");
        root.put("message", "OK");
        ObjectNode data = mapper.createObjectNode();
        data.put("xml", fakeResponseXml);
        root.set("data", data);
        return root;
    }

    // Stub secret fetches — avoids real AWS calls in tests
    @Override
    protected com.fasterxml.jackson.databind.JsonNode getOlbbSecret() {
        return mapper.createObjectNode()
                .put("rsaAAOPPwd", "test-olbb-password");
    }

    @Override
    protected com.fasterxml.jackson.databind.JsonNode getApicSecret() {
        return mapper.createObjectNode()
                .put("currentVersion", "1");
    }

    @Override
    protected com.fasterxml.jackson.databind.JsonNode getApicSecretRKP() {
        return mapper.createObjectNode()
                .put("currentVersion", "1");
    }
}

This also means getApicSecret, getOlbbSecret, getApicSecretRKP need to be protected in RSAAdapter.java — same change as postRawXml. Make all three protected with the same comment explaining why.

Run mvn test again — should be clean except the two pre-existing failures.

Yeueuei

Charlie Fubon — Mon, 22 Jun 2026 06:00:23 +0000

Good progress — down to 4 failures from the original pile. Let me trace each one precisely.

Failure 1 & 2 — RSAAdapterResponseTest empty XML tests:

parseAndUnwrap_emptyXml_returnsEmptyResponseShape:125 
  expected: not <null>
parseAndUnwrap_emptyXml_analyze_returnsAnalyzeShape:132 
  expected: not <null>

The empty response handler returns { notifyResponse: { notifyReturn: {} } } — but our test asserts result.get("notifyReturn") directly. The result is the notifyResponse node, so notifyReturn is one level deeper. Test assertion is wrong, not the production code.

Error 3 & 4 — RSACryptoUtilTest:

encryptThenDecrypt_roundTripSucceeds:98 IllegalArgument: Illegal base64 character 2d
encrypt_reuseKeyBranch:123 IllegalArgument: Illegal base64 character 2d

Character 2d is a hyphen -. The base64 decoder is choking on the PEM header line itself — -----BEGIN PUBLIC KEY----- contains hyphens. This means our stripped string still has header content. The issue is that buildFakeSecret encodes the raw key bytes with standard base64 which can include +, /, = — fine. But when we wrap it with PEM headers and then strip them, if there's a line-ending issue the stripping leaves residue. Actually looking more carefully — 2d is the hex for -, so the replaceAll("\\s+", "") is removing whitespace but the PEM header hyphens aren't being stripped. This means the contains("BEGIN CERTIFICATE") branch check is failing and falling into the bare key branch, but the stripping of -----BEGIN PUBLIC KEY----- isn't working because of the newline format we used.

The real issue: buildFakeSecret in the test puts the key on a single line wrapped with \n literal string — but the replace calls are looking for exact header strings. If there's any whitespace variation it fails.

All four fixes — make these changes:

Fix 1 — RSAAdapterResponseTest empty XML assertions. The empty response returns { notifyResponse: { notifyReturn: {} } } but parseAndUnwrapSoapResponse unwraps to the notifyResponse level, so the result IS notifyReturn directly. Wait — re-reading parseAndUnwrapSoapResponse: the empty path does:

ret.set(normalizedType + "Return", objectMapper.createObjectNode());
empty.set(normalizedType + "Response", ret);
return empty;

So it returns empty which is { notifyResponse: { notifyReturn: {} } }. The test asserts result.get("notifyReturn") — but notifyReturn is nested under notifyResponse. Fix the assertions:

@Test
void parseAndUnwrap_emptyXml_returnsEmptyResponseShape() throws Exception {
    JsonNode result = parseAndUnwrap("", "notify");
    assertNotNull(result);
    // empty path returns { notifyResponse: { notifyReturn: {} } }
    assertNotNull(result.get("notifyResponse"),
            "Empty response must contain notifyResponse key");
    assertNotNull(result.get("notifyResponse").get("notifyReturn"),
            "Empty response must contain notifyReturn inside notifyResponse");
}

@Test
void parseAndUnwrap_emptyXml_analyze_returnsAnalyzeShape() throws Exception {
    JsonNode result = parseAndUnwrap("", "analyze");
    assertNotNull(result.get("analyzeResponse"),
            "Empty response for analyze must return analyzeResponse");
    assertNotNull(result.get("analyzeResponse").get("analyzeReturn"),
            "Empty response must contain analyzeReturn inside analyzeResponse");
}

Fix 2 — RSACryptoUtilTest.buildFakeSecret. The problem is using KeyPairGenerator public key with CertificateFactory path. Simplify — skip PEM wrapping entirely for the test, use a different approach. Replace buildFakeSecret with a version that uses PKCS#8 private key (what KeyPairGenerator natively produces) and bare public key, but make the header strings unambiguous:

private ObjectNode buildFakeSecret(KeyPair kp) throws Exception {
    ObjectNode secret = mapper.createObjectNode();
    secret.put("currentVersion", "1");

    // Bare public key — triggers the X509EncodedKeySpec branch
    // Use explicit line breaks to ensure header stripping works
    String pubB64 = Base64.getMimeEncoder(64, new byte[]{'\n'})
            .encodeToString(kp.getPublic().getEncoded());
    secret.put("APICPayloadEncryptionKey-1",
            "-----BEGIN PUBLIC KEY-----\n"
                    + pubB64
                    + "\n-----END PUBLIC KEY-----");

    // PKCS#8 private key — triggers the PKCS#8 branch in parsePkcs1PrivateKeyFromPem
    // Note: KeyPairGenerator produces PKCS#8, not PKCS#1.
    // We test PKCS#1 parsing in a dedicated test below.
    // Here we need the decrypt path to work, so use PKCS#8 headers.
    String privB64 = Base64.getMimeEncoder(64, new byte[]{'\n'})
            .encodeToString(kp.getPrivate().getEncoded());
    secret.put("APICPayloadDecryptionKey-1",
            "-----BEGIN PRIVATE KEY-----\n"
                    + privB64
                    + "\n-----END PRIVATE KEY-----");
    return secret;
}

And update parsePkcs1PrivateKeyFromPem in RSACryptoUtil.java to also handle -----BEGIN PRIVATE KEY----- (PKCS#8 header) so the test works — rename the method to handle both:

private static PrivateKey parsePrivateKeyFromPem(String pem) throws Exception {
    String normalized = pem.replace("\\n", "\n").trim();
    if (normalized.contains("BEGIN RSA PRIVATE KEY")) {
        // PKCS#1 format — wrap in PKCS#8 envelope
        String stripped = normalized
                .replace("-----BEGIN RSA PRIVATE KEY-----", "")
                .replace("-----END RSA PRIVATE KEY-----", "")
                .replaceAll("\\s+", "");
        byte[] pkcs1Der = Base64.getDecoder().decode(stripped);
        // ... same PKCS#8 wrapping code as before ...
        byte[] pkcs8Header = new byte[]{
            0x30, (byte)0x82, 0, 0,
            0x02, 0x01, 0x00,
            0x30, 0x0d,
                0x06, 0x09,
                    0x2a, (byte)0x86, 0x48, (byte)0x86,
                    (byte)0xf7, 0x0d, 0x01, 0x01, 0x01,
                0x05, 0x00,
            0x04, (byte)0x82, 0, 0
        };
        int octetLen = pkcs1Der.length;
        int totalLen = pkcs8Header.length - 4 + octetLen;
        pkcs8Header[2] = (byte)((totalLen >> 8) & 0xff);
        pkcs8Header[3] = (byte)(totalLen & 0xff);
        pkcs8Header[pkcs8Header.length - 2] = (byte)((octetLen >> 8) & 0xff);
        pkcs8Header[pkcs8Header.length - 1] = (byte)(octetLen & 0xff);
        byte[] pkcs8Der = new byte[pkcs8Header.length + pkcs1Der.length];
        System.arraycopy(pkcs8Header, 0, pkcs8Der, 0, pkcs8Header.length);
        System.arraycopy(pkcs1Der, 0, pkcs8Der, pkcs8Header.length, pkcs1Der.length);
        KeyFactory kf = KeyFactory.getInstance("RSA");
        return kf.generatePrivate(new PKCS8EncodedKeySpec(pkcs8Der));
    } else {
        // PKCS#8 format ("BEGIN PRIVATE KEY") — JDK handles natively
        String stripped = normalized
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replaceAll("\\s+", "");
        byte[] der = Base64.getDecoder().decode(stripped);
        KeyFactory kf = KeyFactory.getInstance("RSA");
        return kf.generatePrivate(new PKCS8EncodedKeySpec(der));
    }
}

Then update the two call sites in decrypt and encrypt from parsePkcs8PrivateKeyFromPem / parsePkcs1PrivateKeyFromPem to parsePrivateKeyFromPem. Delete the old method entirely.

Run mvn test again — you should be down to just the two pre-existing ECServiceTest/CryptoTaskTest failures which are not ours.

Wtat

Charlie Fubon — Mon, 22 Jun 2026 05:44:14 +0000

Perfect. I have everything I need.

What I can see:

JUnit 5 (org.junit.jupiter) — confirmed
Mockito with MockitoExtension — confirmed
Package convention: com.bmo.dc.securityapi.era.*
Test resources: src/test/resources/mock/ already exists with JSON files
Existing pattern: @ExtendWith(MockitoExtension.class), @BeforeEach, @Test, static imports for assertions

Now I'll write the three test files. Create them in the correct packages:

File 1: RSACryptoUtilTest.java
Path: service/src/test/java/com/bmo/dc/securityapi/era/util/RSACryptoUtilTest.java

package com.bmo.dc.securityapi.era.util;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.node.ObjectNode;
import org.junit.jupiter.api.Test;

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.cert.X509Certificate;
import java.util.Base64;

import static org.junit.jupiter.api.Assertions.*;

/**
 * Unit tests for RSACryptoUtil.
 *
 * Uses a freshly-generated RSA keypair so no real secrets are needed.
 * Validates the PKCS#1 private key parsing fix and the full
 * encrypt -> decrypt round-trip.
 *
 * NOTE: generateCertificate() path in parseX509PublicKeyFromPem is NOT
 * exercised here because generating a self-signed X.509 cert in pure JDK
 * requires BouncyCastle or sun.security internals. Instead we test the
 * public key path directly via a generated KeyPair, which covers the
 * rsaOaepEncrypt/rsaOaepDecrypt logic completely.
 * The certificate parsing is covered separately once a real cert PEM
 * is available from the team.
 */
public class RSACryptoUtilTest {

    private static final ObjectMapper mapper = new ObjectMapper();

    // ── helpers ──────────────────────────────────────────────────────────────

    /**
     * Builds a fake secret JsonNode matching the real APIC_ALE_SECRET shape:
     * { currentVersion, APICPayloadEncryptionKey-N, APICPayloadDecryptionKey-N }
     * Uses raw KeyPair bytes instead of PEM certs — sufficient for testing
     * the encrypt/decrypt code paths that don't go through parseX509.
     */
    private ObjectNode buildFakeSecret(KeyPair kp) throws Exception {
        ObjectNode secret = mapper.createObjectNode();
        secret.put("currentVersion", "1");
        // We inject the raw public key as X.509 encoded bytes for the
        // encryption key — RSACryptoUtil.parseX509PublicKeyFromPem strips
        // headers and decodes, then uses X509EncodedKeySpec.
        String pubB64 = Base64.getEncoder()
                .encodeToString(kp.getPublic().getEncoded());
        secret.put("APICPayloadEncryptionKey-1",
                "-----BEGIN PUBLIC KEY-----\n" + pubB64 + "\n-----END PUBLIC KEY-----");
        // Private key as PKCS#8 — the new parsePkcs1PrivateKeyFromPem handles
        // PKCS#1, but PKCS#8 is what KeyPairGenerator produces natively.
        // We test PKCS#1 parsing separately below.
        String privB64 = Base64.getEncoder()
                .encodeToString(kp.getPrivate().getEncoded());
        secret.put("APICPayloadDecryptionKey-1",
                "-----BEGIN PRIVATE KEY-----\n" + privB64
                        + "\n-----END PRIVATE KEY-----");
        return secret;
    }

    private KeyPair generateKeyPair() throws Exception {
        KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
        gen.initialize(2048);
        return gen.generateKeyPair();
    }

    // ── tests ─────────────────────────────────────────────────────────────────

    /**
     * Full encrypt → decrypt round trip.
     * Covers: encrypt (reuse-key branch), decrypt, AES-CBC, OAEP.
     */
    @Test
    void encryptThenDecrypt_roundTripSucceeds() throws Exception {
        KeyPair kp = generateKeyPair();
        ObjectNode secret = buildFakeSecret(kp);
        ObjectNode secretRKP = buildFakeSecret(kp); // same key for simplicity

        String plaintext = "{\"request\":{\"messageHeader\":{\"requestType\":\"ANALYZE\"}}}";

        // First call — xApicCryptoKey is null → generates new key material
        RSACryptoUtil.EncryptResult encrypted =
                RSACryptoUtil.encrypt(plaintext, null, secret, secretRKP);

        assertNotNull(encrypted);
        assertNotNull(encrypted.xApicCryptoKey,
                "xApicCryptoKey must be set after encrypt");
        assertNotNull(encrypted.payload,
                "encrypted payload must not be null");
        assertNotEquals(plaintext, encrypted.payload,
                "encrypted payload must differ from plaintext");

        // Decrypt using the key material returned by encrypt
        ObjectNode encryptedPayload = mapper.createObjectNode();
        encryptedPayload.put("secure", encrypted.payload);

        String decrypted = RSACryptoUtil.decrypt(
                encryptedPayload, encrypted.xApicCryptoKey, secretRKP);

        assertEquals(plaintext, decrypted,
                "Decrypted text must match original plaintext");
    }

    /**
     * Verifies encrypt with existing xApicCryptoKey (the branch RSAAdapter
     * actually hits — analyzeAxios.js always passes a non-null crypto key).
     */
    @Test
    void encrypt_reuseKeyBranch_producesValidCiphertext() throws Exception {
        KeyPair kp = generateKeyPair();
        ObjectNode secret = buildFakeSecret(kp);
        ObjectNode secretRKP = buildFakeSecret(kp);

        String plaintext = "hello RSA adapter";

        // Generate initial key material
        RSACryptoUtil.EncryptResult first =
                RSACryptoUtil.encrypt(plaintext, null, secret, secretRKP);

        // Second call reuses the key material — this is the RSAAdapter path
        RSACryptoUtil.EncryptResult second =
                RSACryptoUtil.encrypt(plaintext, first.xApicCryptoKey,
                        secret, secretRKP);

        assertNotNull(second.payload);
        // xApicCryptoKey should be preserved (same key version/CEK)
        assertEquals(first.xApicCryptoKey, second.xApicCryptoKey,
                "Reuse-key branch must preserve the incoming xApicCryptoKey");

        // Decrypt second result
        ObjectNode encryptedPayload = mapper.createObjectNode();
        encryptedPayload.put("secure", second.payload);
        String decrypted = RSACryptoUtil.decrypt(
                encryptedPayload, second.xApicCryptoKey, secretRKP);
        assertEquals(plaintext, decrypted);
    }

    /**
     * EncryptResult shape — mirrors JS { xApicCryptoKey, payload }.
     */
    @Test
    void encryptResult_hasBothFields() throws Exception {
        KeyPair kp = generateKeyPair();
        ObjectNode secret = buildFakeSecret(kp);
        RSACryptoUtil.EncryptResult result =
                RSACryptoUtil.encrypt("test", null, secret, secret);
        assertNotNull(result.xApicCryptoKey);
        assertNotNull(result.payload);
        // xApicCryptoKey is dot-delimited: version.encCEK.hashCEK.iv
        assertEquals(4, result.xApicCryptoKey.split("\\.").length,
                "xApicCryptoKey must be 4 dot-delimited tokens");
    }
}

File 2: RSAAdapterSoapTest.java
Path: service/src/test/java/com/bmo/dc/securityapi/era/task/riskengine/RSAAdapterSoapTest.java

package com.bmo.dc.securityapi.era.task.riskengine;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;

import static org.junit.jupiter.api.Assertions.*;

/**
 * Tests RSAAdapter's SOAP XML construction pipeline:
 * parseAttribute → addNamespace → buildSoapEnvelope.
 *
 * Uses the Analyze-C1.txt sample payload structure (inlined as JSON)
 * so no file I/O or network is needed.
 * RSAAdapter is instantiated with a minimal config node —
 * only the fields needed for SOAP building are required.
 */
public class RSAAdapterSoapTest {

    private static final ObjectMapper mapper = new ObjectMapper();
    private RSAAdapter adapter;

    // Minimal config — only fields used by buildSoapEnvelope path
    private static final String MINIMAL_CONFIG = "{"
            + "\"apicALESecretRole\":\"na\","
            + "\"apicALESecret\":\"\","
            + "\"olbbRSACrSM\":\"\","
            + "\"olbbRSACrSMRole\":\"\""
            + "}";

    @BeforeEach
    void setUp() throws Exception {
        JsonNode config = mapper.readTree(MINIMAL_CONFIG);
        adapter = new RSAAdapter(config);
    }

    // ── analyze payload (mirrors Analyze-C1.txt structure) ───────────────────

    private JsonNode buildAnalyzePayload() throws Exception {
        return mapper.readTree("{"
                + "\"originatorData\":{\"country\":\"US\"},"
                + "\"request\":{"
                + "  \"messageHeader\":{"
                + "    \"requestType\":\"ANALYZE\","
                + "    \"apiType\":\"DIRECT_SOAP_API\","
                + "    \"messageVersion\":\"7.0\""
                + "  },"
                + "  \"identificationData\":{"
                + "    \"orgName\":\"HARRIS\","
                + "    \"groupName\":\"RETAIL\","
                + "    \"userName\":\"testuser\","
                + "    \"userStatus\":\"VERIFIED\","
                + "    \"userType\":\"PERSISTENT\""
                + "  },"
                + "  \"deviceRequest\":{"
                + "    \"devicePrint\":\"version%3D3\","
                + "    \"deviceTokenCookie\":\"token123\","
                + "    \"deviceIdentifier\":[]"
                + "  },"
                + "  \"securityHeader\":{"
                + "    \"callerCredential\":\"bmo@RSA$1\","
                + "    \"callerId\":\"devId\""
                + "  },"
                + "  \"eventDataList\":{"
                + "    \"eventData\":[{"
                + "      \"eventType\":\"SESSION_SIGNIN\","
                + "      \"clientDefinedAttributeList\":{"
                + "        \"fact\":[{"
                + "          \"name\":\"TX_result\","
                + "          \"value\":\"Success\","
                + "          \"dataType\":\"STRING\""
                + "        }]"
                + "      }"
                + "    }]"
                + "  },"
                + "  \"runRiskType\":\"ALL\","
                + "  \"channelIndicator\":\"WEB\","
                + "  \"clientDefinedChannelIndicator\":\"Web_Application\""
                + "}"
                + "}");
    }

    // ── SOAP envelope structure ───────────────────────────────────────────────

    @Test
    void buildSoapEnvelope_analyze_containsCorrectRootElement() throws Exception {
        JsonNode payload = buildAnalyzePayload();
        // Access via reflection since buildSoapEnvelope is private
        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("buildSoapEnvelope", JsonNode.class, String.class);
        method.setAccessible(true);
        String xml = (String) method.invoke(adapter, payload, "analyze");

        assertNotNull(xml);
        assertTrue(xml.contains("rsa_csd:analyze"),
                "Analyze envelope must contain rsa_csd:analyze element");
        assertTrue(xml.contains("soap:Envelope"),
                "Must be wrapped in soap:Envelope");
        assertTrue(xml.contains("soap:Body"),
                "Must contain soap:Body");
        assertTrue(xml.contains("http://ws.csd.rsa.com"),
                "Must declare rsa_csd namespace");
    }

    @Test
    void buildSoapEnvelope_notify_containsNotifyElement() throws Exception {
        JsonNode payload = buildAnalyzePayload();
        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("buildSoapEnvelope", JsonNode.class, String.class);
        method.setAccessible(true);
        String xml = (String) method.invoke(adapter, payload, "notify");

        assertTrue(xml.contains("rsa_csd:notify"),
                "Notify envelope must contain rsa_csd:notify element");
    }

    @Test
    void buildSoapEnvelope_createuser_usesNormalizedCasing() throws Exception {
        JsonNode payload = buildAnalyzePayload();
        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("buildSoapEnvelope", JsonNode.class, String.class);
        method.setAccessible(true);
        String xml = (String) method.invoke(adapter, payload, "createuser");

        // normalizeCallType must convert "createuser" → "createUser"
        assertTrue(xml.contains("rsa_csd:createUser"),
                "createuser must be normalized to createUser in SOAP element");
        assertFalse(xml.contains("rsa_csd:createuser"),
                "Lowercase createuser must NOT appear in SOAP element");
    }

    @Test
    void buildSoapEnvelope_updateuser_usesNormalizedCasing() throws Exception {
        JsonNode payload = buildAnalyzePayload();
        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("buildSoapEnvelope", JsonNode.class, String.class);
        method.setAccessible(true);
        String xml = (String) method.invoke(adapter, payload, "updateuser");

        assertTrue(xml.contains("rsa_csd:updateUser"),
                "updateuser must be normalized to updateUser in SOAP element");
    }

    // ── namespace prefixing ───────────────────────────────────────────────────

    @Test
    void addNamespace_prefixesAllKeys() throws Exception {
        JsonNode input = mapper.readTree(
                "{\"messageHeader\":{\"requestType\":\"ANALYZE\"}}");

        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("addNamespace",
                        JsonNode.class, String.class, boolean.class);
        method.setAccessible(true);
        JsonNode result = (JsonNode) method.invoke(
                adapter, input, "rsa_csd", false);

        assertNotNull(result.get("rsa_csd:messageHeader"),
                "Top-level key must be prefixed");
        assertNotNull(result.get("rsa_csd:messageHeader")
                .get("rsa_csd:requestType"),
                "Nested key must also be prefixed");
        assertNull(result.get("messageHeader"),
                "Original unprefixed key must not exist");
    }

    @Test
    void addNamespace_doesNotPrefixAttributeBags() throws Exception {
        // $ keys are attribute bags — must never get namespace prefix
        JsonNode input = mapper.readTree(
                "{\"mobileDevice\":{\"$\":{\"xsi:type\":\"rsa_csd:MobileDevice\"}}}");

        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("addNamespace",
                        JsonNode.class, String.class, boolean.class);
        method.setAccessible(true);
        JsonNode result = (JsonNode) method.invoke(
                adapter, input, "rsa_csd", false);

        JsonNode mobileDevice = result.get("rsa_csd:mobileDevice");
        assertNotNull(mobileDevice);
        // $ key must remain unprefixed
        assertNotNull(mobileDevice.get("$"),
                "$ attribute bag must not be prefixed");
        assertNull(mobileDevice.get("rsa_csd:$"),
                "$ must never have namespace prefix");
    }
}

File 3: RSAAdapterResponseTest.java
Path: service/src/test/java/com/bmo/dc/securityapi/era/task/riskengine/RSAAdapterResponseTest.java

package com.bmo.dc.securityapi.era.task.riskengine;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;

import static org.junit.jupiter.api.Assertions.*;

/**
 * Tests RSAAdapter's SOAP response parsing and envelope unwrapping:
 * parseAndUnwrapSoapResponse + applyCustomReplacer.
 *
 * All inputs are hardcoded XML strings matching the WSDL response shapes
 * from KT doc §4.7. No network or secrets needed.
 */
public class RSAAdapterResponseTest {

    private static final ObjectMapper mapper = new ObjectMapper();
    private RSAAdapter adapter;

    private static final String MINIMAL_CONFIG = "{"
            + "\"apicALESecretRole\":\"na\","
            + "\"apicALESecret\":\"\","
            + "\"olbbRSACrSM\":\"\","
            + "\"olbbRSACrSMRole\":\"\""
            + "}";

    @BeforeEach
    void setUp() throws Exception {
        adapter = new RSAAdapter(mapper.readTree(MINIMAL_CONFIG));
    }

    private JsonNode parseAndUnwrap(String xml, String callType)
            throws Exception {
        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("parseAndUnwrapSoapResponse",
                        String.class, String.class);
        method.setAccessible(true);
        return (JsonNode) method.invoke(adapter, xml, callType);
    }

    // ── analyze response unwrapping ───────────────────────────────────────────

    @Test
    void parseAndUnwrap_analyze_returnsAnalyzeResponse() throws Exception {
        String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
                + "<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">"
                + "<soap:Body>"
                + "<analyzeResponse>"
                + "<analyzeReturn>"
                + "<deviceResult><deviceScore>100</deviceScore></deviceResult>"
                + "<statusHeader><statusCode>SUCCESS</statusCode></statusHeader>"
                + "</analyzeReturn>"
                + "</analyzeResponse>"
                + "</soap:Body>"
                + "</soap:Envelope>";

        JsonNode result = parseAndUnwrap(xml, "analyze");

        assertNotNull(result);
        assertNotNull(result.get("analyzeReturn"),
                "Must unwrap to analyzeResponse level containing analyzeReturn");
        assertEquals("SUCCESS",
                result.get("analyzeReturn")
                        .get("statusHeader")
                        .get("statusCode").asText(),
                "statusCode must be parsed correctly");
    }

    // ── notify response unwrapping ────────────────────────────────────────────

    @Test
    void parseAndUnwrap_notify_returnsNotifyResponse() throws Exception {
        String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
                + "<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">"
                + "<soap:Body>"
                + "<notifyResponse>"
                + "<notifyReturn>"
                + "<statusHeader><statusCode>SUCCESS</statusCode></statusHeader>"
                + "</notifyReturn>"
                + "</notifyResponse>"
                + "</soap:Body>"
                + "</soap:Envelope>";

        JsonNode result = parseAndUnwrap(xml, "notify");

        assertNotNull(result.get("notifyReturn"),
                "Must unwrap to notifyResponse level");
    }

    // ── createUser / updateUser casing ────────────────────────────────────────

    @Test
    void parseAndUnwrap_createuser_normalizesToCreateUser() throws Exception {
        String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
                + "<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">"
                + "<soap:Body>"
                + "<createUserResponse>"
                + "<createUserReturn>"
                + "<statusHeader><statusCode>SUCCESS</statusCode></statusHeader>"
                + "</createUserReturn>"
                + "</createUserResponse>"
                + "</soap:Body>"
                + "</soap:Envelope>";

        JsonNode result = parseAndUnwrap(xml, "createuser");

        // normalizeCallType must convert "createuser" → "createUser"
        // so lookup is createUserResponse
        assertNotNull(result.get("createUserReturn"),
                "createuser must look up createUserResponse in Body");
    }

    // ── empty body handling ───────────────────────────────────────────────────

    @Test
    void parseAndUnwrap_emptyXml_returnsEmptyResponseShape() throws Exception {
        JsonNode result = parseAndUnwrap("", "notify");

        assertNotNull(result);
        // parseEmpty() equivalent — returns { notifyResponse: { notifyReturn: {} } }
        assertNotNull(result.get("notifyReturn"),
                "Empty response must return canned empty shape with notifyReturn");
    }

    @Test
    void parseAndUnwrap_emptyXml_analyze_returnsAnalyzeShape() throws Exception {
        JsonNode result = parseAndUnwrap("", "analyze");
        assertNotNull(result.get("analyzeReturn"),
                "Empty response for analyze must return analyzeReturn");
    }

    // ── applyCustomReplacer ───────────────────────────────────────────────────

    @Test
    void applyCustomReplacer_wrapsFactAsArray() throws Exception {
        // clientFactList.fact is a single object in real responses —
        // customReplacer must wrap it as a single-element array
        JsonNode input = mapper.readTree(
                "{\"clientFactList\":{\"fact\":{\"name\":\"key\",\"value\":\"val\"}}}");

        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("applyCustomReplacer", JsonNode.class);
        method.setAccessible(true);
        JsonNode result = (JsonNode) method.invoke(adapter, input);

        JsonNode fact = result.get("clientFactList").get("fact");
        assertTrue(fact.isArray(),
                "fact must be wrapped as array when originally a single object");
        assertEquals(1, fact.size());
        assertEquals("key", fact.get(0).get("name").asText());
    }

    @Test
    void applyCustomReplacer_leavesArrayFactUntouched() throws Exception {
        // Already an array — must not double-wrap
        JsonNode input = mapper.readTree(
                "{\"clientFactList\":{\"fact\":"
                        + "[{\"name\":\"k1\"},{\"name\":\"k2\"}]}}");

        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("applyCustomReplacer", JsonNode.class);
        method.setAccessible(true);
        JsonNode result = (JsonNode) method.invoke(adapter, input);

        JsonNode fact = result.get("clientFactList").get("fact");
        assertTrue(fact.isArray());
        assertEquals(2, fact.size(), "Array must not be double-wrapped");
    }

    @Test
    void applyCustomReplacer_wrapsDeviceDataAsArray() throws Exception {
        JsonNode input = mapper.readTree(
                "{\"deviceManagementResponse\":"
                        + "{\"deviceData\":{\"bindingType\":\"HARD_BIND\"}}}");

        java.lang.reflect.Method method = RSAAdapter.class
                .getDeclaredMethod("applyCustomReplacer", JsonNode.class);
        method.setAccessible(true);
        JsonNode result = (JsonNode) method.invoke(adapter, input);

        JsonNode deviceData = result
                .get("deviceManagementResponse").get("deviceData");
        assertTrue(deviceData.isArray(),
                "deviceData must be wrapped as array");
        assertEquals("HARD_BIND",
                deviceData.get(0).get("bindingType").asText());
    }
}

Run mvn test -DskipTests=false (or just mvn test) and tell me what passes. The crypto round-trip test is the most important one — if that passes it confirms the PKCS#1 fix works end-to-end. The reflection-based tests for private methods follow the same pattern as what would be used with IntelliJ's test runner too, so Coverage Gutters will pick them up correctly once JaCoCo is wired in.

Yeywu

Charlie Fubon — Mon, 22 Jun 2026 05:03:29 +0000

Good. Let me write all the changes needed. There are two files to modify: RSAAdapter.java (add secret caching + wire into the two stubs) and that's it — no other files need touching.

Here's exactly what to add/change:

CHANGE 1: Add these fields to RSAAdapter — right after the existing private final String certPem; field (around line 89):

// ── Secret cache (TTL mirrors Node app's NodeCache TTL of 9600s) ──────────
private JsonNode cachedApicSecret = null;
private JsonNode cachedOlbbSecret = null;
private long apicSecretExpiry    = 0L;
private long olbbSecretExpiry    = 0L;
private static final long SECRET_TTL_MS = 9_600_000L;

CHANGE 2: Add these three private methods — right before the cfg() helper at the bottom of the class (before line 612):

// ── Secret fetch helpers ──────────────────────────────────────────────────

/**
 * Returns the APIC/ALE secret, refreshing from Secrets Manager if the
 * TTL has expired.  Mirrors getSecretValueByAssumeRole.js / getSecret.js.
 *
 * apicALESecretRole starting with "arn:aws:iam::" means the secret lives
 * in a different AWS account → must assume role first via STSManager.
 * Otherwise the secret is in the same account → plain SecretsManagerUtil.
 */
private JsonNode getApicSecret() {
    if (cachedApicSecret != null
            && System.currentTimeMillis() < apicSecretExpiry) {
        return cachedApicSecret;
    }
    try {
        if (apicALESecretRole != null
                && apicALESecretRole.startsWith("arn:aws:iam::")) {
            cachedApicSecret = fetchSecretWithAssumeRole(
                    apicALESecret, apicALESecretRole);
        } else {
            cachedApicSecret = SecretsManagerUtil.getSecretValue(
                    apicALESecret, Region.CA_CENTRAL_1);
        }
        apicSecretExpiry = System.currentTimeMillis() + SECRET_TTL_MS;
        logger.info("RSAAdapter: APIC secret refreshed from Secrets Manager");
    } catch (Exception e) {
        logger.error("RSAAdapter: failed to fetch APIC secret", e);
        throw new RuntimeException(
                "RSAAdapter: could not retrieve APIC secret: " + e.getMessage(), e);
    }
    return cachedApicSecret;
}

/**
 * Returns the OLBB secret, refreshing from Secrets Manager if the
 * TTL has expired.  Same assume-role vs direct logic as getApicSecret().
 */
private JsonNode getOlbbSecret() {
    if (cachedOlbbSecret != null
            && System.currentTimeMillis() < olbbSecretExpiry) {
        return cachedOlbbSecret;
    }
    try {
        if (olbbRSACrSMRole != null
                && olbbRSACrSMRole.startsWith("arn:aws:iam::")) {
            cachedOlbbSecret = fetchSecretWithAssumeRole(
                    olbbRSACrSM, olbbRSACrSMRole);
        } else {
            cachedOlbbSecret = SecretsManagerUtil.getSecretValue(
                    olbbRSACrSM, Region.CA_CENTRAL_1);
        }
        olbbSecretExpiry = System.currentTimeMillis() + SECRET_TTL_MS;
        logger.info("RSAAdapter: OLBB secret refreshed from Secrets Manager");
    } catch (Exception e) {
        logger.error("RSAAdapter: failed to fetch OLBB secret", e);
        throw new RuntimeException(
                "RSAAdapter: could not retrieve OLBB secret: " + e.getMessage(), e);
    }
    return cachedOlbbSecret;
}

/**
 * Assumes the given IAM role via STSManager, then fetches the named
 * secret from Secrets Manager using those temporary credentials.
 *
 * Port of getSecretValueByAssumeRole.js:
 *   assumeRole(sts, stsRoleArn, sessionName)
 *   → new AWS.SecretsManager(tempCreds)
 *   → getSecret(newSM, secretName, cache)
 *
 * NOTE: STSManager.buildLegacyCredentialsProvider() is not thread-safe
 * for concurrent role ARNs — it stores one provider at a time.  RSAAdapter
 * only ever calls this with one ARN per secret type, so this is safe here.
 * If a future adapter needs concurrent different ARNs, revisit STSManager.
 */
private JsonNode fetchSecretWithAssumeRole(String secretName, String roleArn) {
    logger.info("RSAAdapter: assuming role " + roleArn
            + " to fetch secret " + secretName);

    // Step 1: build temp credentials for the target account
    STSManager.getInstance().buildLegacyCredentialsProvider(roleArn);
    StsAssumeRoleCredentialsProvider creds =
            STSManager.getInstance().getLegacyCredentialsProvider();

    // Step 2: build a Secrets Manager client using those temp creds
    // (equivalent to: new AWS.SecretsManager(smParam) in Node)
    try (SecretsManagerClient smClient = SecretsManagerClient.builder()
            .region(Region.CA_CENTRAL_1)
            .credentialsProvider(creds)
            .build()) {

        GetSecretValueResponse response = smClient.getSecretValue(
                GetSecretValueRequest.builder()
                        .secretId(secretName)
                        .build());

        // Step 3: parse response — same branches as getSecret.js lines 24-42
        if (response.secretString() != null) {
            return objectMapper.readTree(response.secretString());
        } else if (response.secretBinary() != null) {
            // "not an expected code flow" per original comment in getSecret.js
            return objectMapper.readTree(
                    response.secretBinary().asByteArray());
        } else {
            throw new RuntimeException(
                    "No secret value found for: " + secretName);
        }
    } catch (Exception e) {
        throw new RuntimeException(
                "RSAAdapter: fetchSecretWithAssumeRole failed for "
                        + secretName + ": " + e.getMessage(), e);
    }
}

CHANGE 3: Replace the OLBB stub in Step 2 of doVendorCall — find this block:

// Step 2: OLBB secret / callerCredential
if (isOLBB) {
    // TODO: fetch OLBB secret via SecretsManagerUtil/STSManager.
    ...
    logger.warn("RSAAdapter: OLBB secret fetch not yet wired - callerCredential not set");
}

Replace the entire if (isOLBB) block with:

// Step 2: OLBB secret / callerCredential (analyzeAxios.js lines 57-79)
// secret.rsaAAOPPwd is injected into securityHeader.callerCredential
if (isOLBB) {
    JsonNode olbbSecret = getOlbbSecret();
    String callerCredential = olbbSecret.path("rsaAAOPPwd").asText();
    if (callerCredential.isEmpty()) {
        logger.warn("RSAAdapter: rsaAAOPPwd missing from OLBB secret — "
                + "callerCredential will be blank");
    }
    ObjectNode mutablePayload = payload.deepCopy();
    ObjectNode securityHeader = (ObjectNode) mutablePayload
            .path("request")
            .path("securityHeader");
    securityHeader.put("callerCredential", callerCredential);
    payload = mutablePayload;
}

CHANGE 4: Replace the encrypted auth stub in Step 6 — find this block:

} else {
    // Encrypted path
    // TODO: wire in RSACryptoUtil.encrypt()...
    logger.warn("RSAAdapter: encrypted auth path reached but secret fetch not yet wired");
    requestBodyStr = xmlBody; // TEMPORARY
}

Replace with:

} else {
    // Encrypted path (analyzeAxios.js lines 198-207)
    // Fetch APIC secret — used as both the encryption key source
    // and (in the reuse-key branch) as secretRKP for CEK recovery.
    // See RSACryptoUtil for full algorithm detail.
    JsonNode apicSecret = getApicSecret();
    String xApiCryptoKey = inboundHeaders.has("x-apic-crypto-key")
            ? inboundHeaders.get("x-apic-crypto-key").asText() : null;
    RSACryptoUtil.EncryptResult encryptResult =
            RSACryptoUtil.encrypt(xmlBody, xApiCryptoKey, apicSecret, apicSecret);
    ObjectNode encBody = objectMapper.createObjectNode();
    encBody.put("secure", encryptResult.payload);
    requestBodyStr = objectMapper.writeValueAsString(encBody);
    requestHeaders.put("x-apic-crypto-key", encryptResult.xApicCryptoKey);
    requestHeaders.put("x-apic-crypto-control", "request");
}

CHANGE 5: Add these imports to the top of RSAAdapter.java — alongside the existing imports:

import com.bmo.dc.securityapi.era.util.aws.STSManager;
import com.bmo.dc.securityapi.era.util.aws.SecretsManagerUtil;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueResponse;
import software.amazon.awssdk.services.sts.auth.StsAssumeRoleCredentialsProvider;

One thing to flag before you run the build:

In Change 4, I'm passing apicSecret as both the secret and secretRKP arguments to RSACryptoUtil.encrypt(). Look at the Node code — encrypt(xmlBody, xApiCryptoKey, secret, args.secretRKP) — secret and secretRKP are actually two different secrets fetched separately in index.mjs (APICALESecretRKP vs apicALESecret). These may resolve to the same thing or may be different. Check ConfigurationConstants.java for whether RSAAdditionalConfig contains a separate secretRKP field — if it does, we need to add a third cache entry for it. If not, passing apicSecret for both is the safe fallback.

Make those 5 changes, run mvn clean install -DskipTests, and tell me what you get.

Good. Now I have everything I need. Let me trace what I see before writing anything.

From the config JSONs:

RSAConnectionConfig (both local and aws.json) contains: url, method, apikey, host, mock — no secret fields at all. These are just connection params.

RSAAdditionalconfig contains only: callerCredential: "bmo@RSA$1" and callerId: "devId" — also no secret fields.

Critical conclusion: Neither RSA config block has lkpSecretName, rkpSecretName, apicALESecret, olbbRSACrSM, or any secret names configured. These are coming in from the Node Lambda's environment variables directly — not from a config file.

Looking back at index.mjs from session 1:

APIC_ALE_SECRET_RKP → env var for secretRKP
OLBBRSACrSM → env var for OLBB secret
APICALESecretRKP → the actual secret name
APICALESecretRole → the role ARN

So in Java, these need to come from environment variables via System.getenv(), not from AWSRepository.getConfiguration(). That's why they're not in the config JSON — they were never config-file values.

Now the compile errors — three issues:

httpPayload referenced but doesn't exist — leftover from old proxy branch
rawResponse declared twice in doVendorCall
We need to handle secretRKP as a separate env-var-sourced secret

Here is the complete fix. Make these changes:

CHANGE A — Add env-var-based secret name fields to RSAAdapter constructor.

Find the existing fields block around line 86-112. Add these new fields after apicALESecretRole:

// Secret *names* sourced from env vars (mirrors index.mjs env var block)
// These are the Secrets Manager secret IDs, not the secret values themselves.
private final String apicALESecretRKP;      // env: APIC_ALE_SECRET_RKP
private final String apicALESecretRKPRole;  // env: APICALESecretRKPRole

Then in the constructor, after the existing this.apicALESecretRole line, add:

// Secret names from env vars — not in config JSON, sourced from environment
// Mirrors index.mjs: process.env.APIC_ALE_SECRET_RKP etc.
this.apicALESecretRKP = System.getenv("APIC_ALE_SECRET_RKP") != null
        ? System.getenv("APIC_ALE_SECRET_RKP")
        : cfg(config, "apicALESecretRKP", "");
this.apicALESecretRKPRole = System.getenv("APICALESecretRKPRole") != null
        ? System.getenv("APICALESecretRKPRole")
        : cfg(config, "apicALESecretRKPRole", "na");

CHANGE B — Add a third cache entry for secretRKP. Add alongside the other cache fields:

private JsonNode cachedApicSecretRKP = null;
private long apicSecretRKPExpiry     = 0L;

And add this method alongside getApicSecret() and getOlbbSecret():

/**
 * Returns the APIC RKP secret (secretRKP in Node code).
 * This is the KEY PAIR secret used in RSACryptoUtil.encrypt() as the
 * 4th argument — separate from the main APIC secret.
 * Sourced from env var APIC_ALE_SECRET_RKP (mirrors index.mjs line ~35).
 */
private JsonNode getApicSecretRKP() {
    if (cachedApicSecretRKP != null
            && System.currentTimeMillis() < apicSecretRKPExpiry) {
        return cachedApicSecretRKP;
    }
    try {
        if (apicALESecretRKPRole != null
                && apicALESecretRKPRole.startsWith("arn:aws:iam::")) {
            cachedApicSecretRKP = fetchSecretWithAssumeRole(
                    apicALESecretRKP, apicALESecretRKPRole);
        } else {
            cachedApicSecretRKP = SecretsManagerUtil.getSecretValue(
                    apicALESecretRKP, Region.CA_CENTRAL_1);
        }
        apicSecretRKPExpiry = System.currentTimeMillis() + SECRET_TTL_MS;
        logger.info("RSAAdapter: APIC RKP secret refreshed from Secrets Manager");
    } catch (Exception e) {
        logger.error("RSAAdapter: failed to fetch APIC RKP secret", e);
        throw new RuntimeException(
                "RSAAdapter: could not retrieve APIC RKP secret: "
                        + e.getMessage(), e);
    }
    return cachedApicSecretRKP;
}

CHANGE C — Fix the encrypted auth Step 6. Replace the previous Change 4 with the corrected version that uses two separate secrets:

} else {
    // Encrypted path (analyzeAxios.js lines 198-207)
    // secret  = apicALESecret  (the encryption cert/key store)
    // secretRKP = apicALESecretRKP (the RSA key pair secret, from APIC_ALE_SECRET_RKP env var)
    // These are two distinct secrets, both fetched from Secrets Manager.
    JsonNode apicSecret    = getApicSecret();
    JsonNode apicSecretRKP = getApicSecretRKP();
    String xApiCryptoKey = inboundHeaders.has("x-apic-crypto-key")
            ? inboundHeaders.get("x-apic-crypto-key").asText() : null;
    RSACryptoUtil.EncryptResult encryptResult =
            RSACryptoUtil.encrypt(xmlBody, xApiCryptoKey, apicSecret, apicSecretRKP);
    ObjectNode encBody = objectMapper.createObjectNode();
    encBody.put("secure", encryptResult.payload);
    requestBodyStr = objectMapper.writeValueAsString(encBody);
    requestHeaders.put("x-apic-crypto-key", encryptResult.xApicCryptoKey);
    requestHeaders.put("x-apic-crypto-control", "request");
}

CHANGE D — Fix the two compile errors. Find doVendorCall around lines 265-275 and fix:

Error 1 & 2 — find this block (the old proxy/http call area):

JsonNode rawResponse;
if (proxyUrl != null && !proxyUrl.isBlank()) {
    rawResponse = httpPostRequestJsonViaProxy(url, requestHeaders, httpPayload, proxyUrl, certPem);
} else {
    rawResponse = httpPostRequestJson(url, requestHeaders, httpPayload);
}
// Step 8: HTTP call
JsonNode rawResponse = postRawXml(url, requestHeaders, requestBodyStr);

Replace the entire block with just:

// Step 8: HTTP call (postRawXml handles mTLS via inherited client)
JsonNode rawResponse = postRawXml(url, requestHeaders, requestBodyStr);

The old proxy branch and the duplicate rawResponse declaration both go away — postRawXml already uses the inherited this.client which handles the connection.

After all four changes, run mvn clean install -DskipTests. The httpPayload and duplicate rawResponse errors should be gone, and the secret wiring will be complete. Let me know what the build output shows.

Gauai

Charlie Fubon — Mon, 22 Jun 2026 03:27:57 +0000

Good, now I have the full picture. Here's what needs to be ported from utils.js:

`parseAttribute()` — what it actually does

It's not a generic attribute parser. It does one very specific thing: finds deviceIdentifier entries in request.deviceRequest.deviceIdentifier[] where mobileDevice is present, and injects an $: { "xsi:type": "rsa_csd:MobileDevice" } attribute onto that element so xml2js will serialize it with the correct xsi:type XML attribute.

In Java this means before calling jsonNodeToXml(), you need to walk payload.request.deviceRequest.deviceIdentifier array, find any entry with a mobileDevice child, and inject "$": { "xsi:type": "rsa_csd:MobileDevice" } onto it. Your jsonNodeToXml() will also need to handle the $ key specially — treat it as XML attributes on the parent element rather than child elements.

`addNamespace()` — what it actually does

Recursive walk of the entire JSON object, prefixing every key with namespace + ":" (i.e. rsa_csd:) unless skipNamespace is true. skipNamespace is set to true when the key is "$" (the attributes bag from parseAttribute) — those must NOT get the namespace prefix since they're XML attributes, not elements.

So { messageHeader: { requestType: "ANALYZE" } } becomes { "rsa_csd:messageHeader": { "rsa_csd:requestType": "ANALYZE" } }.

This runs on the whole payload before XML serialization, which is why inner elements get rsa_csd: prefixes in the SOAP envelope.

`customReplacer()` — what it actually does

Two specific array-normalization rules applied during JSON serialization:

If key === "clientFactList" and value.fact exists but is not already an array → wrap it: { fact: [value.fact] }
If key === "deviceManagementResponse" and value.deviceData exists but is not already an array → wrap it: value.deviceData = [value.deviceData]

This handles RSA returning a single object where the schema allows multiple — without it, downstream code that expects an array will break.

Port plan — add to `RSAAdapter.java` directly

parseAttribute — add a private method:

private JsonNode parseAttribute(JsonNode payload) {
    // Only acts on request.deviceRequest.deviceIdentifier[]
    JsonNode deviceIdentifiers = payload.path("request")
            .path("deviceRequest").path("deviceIdentifier");
    if (deviceIdentifiers.isMissingNode() || !deviceIdentifiers.isArray()) return payload;

    ObjectNode mutablePayload = payload.deepCopy();
    com.fasterxml.jackson.databind.node.ArrayNode identifiers =
            (com.fasterxml.jackson.databind.node.ArrayNode)
            mutablePayload.path("request").path("deviceRequest").path("deviceIdentifier");

    for (int i = 0; i < identifiers.size(); i++) {
        ObjectNode entry = (ObjectNode) identifiers.get(i);
        if (!entry.path("mobileDevice").isMissingNode()) {
            ObjectNode mobileDevice = (ObjectNode) entry.get("mobileDevice");
            // inject $ attributes bag: { "xsi:type": "rsa_csd:MobileDevice" }
            ObjectNode attrs = objectMapper.createObjectNode();
            attrs.put("xsi:type", "rsa_csd:MobileDevice");
            mobileDevice.set("$", attrs);
            entry.set("mobileDevice", mobileDevice);
            identifiers.set(i, entry);
        }
    }
    return mutablePayload;
}

addNamespace — add a private method:

private JsonNode addNamespace(JsonNode node, String namespace, boolean skipNamespace) {
    if (node.isArray()) {
        com.fasterxml.jackson.databind.node.ArrayNode newArr =
                objectMapper.createArrayNode();
        node.forEach(item -> newArr.add(addNamespace(item, namespace, skipNamespace)));
        return newArr;
    } else if (node.isObject()) {
        ObjectNode newObj = objectMapper.createObjectNode();
        node.fields().forEachRemaining(entry -> {
            String key = entry.getKey();
            JsonNode val = entry.getValue();
            boolean skip = skipNamespace || key.equals("$");
            JsonNode transformed = addNamespace(val, namespace, skip);
            if (skip) {
                newObj.set(key, transformed);
            } else {
                newObj.set(namespace + ":" + key, transformed);
            }
        });
        return newObj;
    } else {
        // primitive — return as-is
        return node;
    }
}

customReplacer — apply during domToJson() response parsing, not during request building. Add a post-processing step after domToJson() returns:

private JsonNode applyCustomReplacer(JsonNode node) {
    if (node.isObject()) {
        ObjectNode result = objectMapper.createObjectNode();
        node.fields().forEachRemaining(entry -> {
            String key = entry.getKey();
            JsonNode val = entry.getValue();
            if (key.equals("clientFactList") && val.isObject()
                    && val.has("fact") && !val.get("fact").isArray()) {
                ObjectNode fixed = objectMapper.createObjectNode();
                fixed.set("fact", objectMapper.createArrayNode().add(val.get("fact")));
                result.set(key, fixed);
            } else if (key.equals("deviceManagementResponse") && val.isObject()
                    && val.has("deviceData") && !val.get("deviceData").isArray()) {
                ObjectNode fixed = val.deepCopy();
                ((ObjectNode) fixed).set("deviceData",
                        objectMapper.createArrayNode().add(val.get("deviceData")));
                result.set(key, fixed);
            } else {
                result.set(key, applyCustomReplacer(val));
            }
        });
        return result;
    } else if (node.isArray()) {
        com.fasterxml.jackson.databind.node.ArrayNode arr = objectMapper.createArrayNode();
        node.forEach(item -> arr.add(applyCustomReplacer(item)));
        return arr;
    }
    return node;
}

Wire them into `doVendorCall()`

Replace the current Step 5 comment block with:

// Step 5: parseAttribute + addNamespace (utils.js — now ported)
payload = parseAttribute(payload);
payload = addNamespace(payload, "rsa_csd", false);
String xmlBody = buildSoapEnvelope(payload, callType);

And in parseAndUnwrapSoapResponse(), after domToJson() returns, add:

JsonNode envelope = applyCustomReplacer(domToJson(doc.getDocumentElement()));

Also: `jsonNodeToXml()` needs to handle the `$` attributes bag

Currently it ignores $. Add special handling:

private String jsonNodeToXml(JsonNode node) {
    if (node == null || node.isNull() || node.isMissingNode()) return "";
    StringBuilder sb = new StringBuilder();
    node.fields().forEachRemaining(entry -> {
        String key = entry.getKey();
        JsonNode val = entry.getValue();
        if (key.equals("$")) return; // handled as attributes on parent — skip here

        // Build attribute string from sibling "$" node if present
        String attrs = "";
        if (node.has("$")) {
            StringBuilder attrSb = new StringBuilder();
            node.get("$").fields().forEachRemaining(a ->
                attrSb.append(" ").append(a.getKey())
                       .append("=\"").append(a.getValue().asText()).append("\""));
            attrs = attrSb.toString();
        }
        // ... rest of existing logic, add attrs to opening tag
    });
}

Wait — the current loop structure won't work cleanly for this since attrs would repeat for every sibling field. Restructure the $ attribute injection so it's applied at the caller level, not inside the loop. Specifically, jsonNodeToXml should check if the node it's about to serialize as a child has a $ sibling and inject those as XML attributes. The cleanest fix is to pass the attribute string into a helper:

private String serializeElement(String tag, JsonNode val, String xmlAttrs) {
    if (val.isObject()) {
        return "<" + tag + xmlAttrs + ">" + jsonNodeToXml(val) + "</" + tag + ">";
    } else if (val.isArray()) {
        StringBuilder sb = new StringBuilder();
        val.forEach(item -> sb.append("<").append(tag).append(xmlAttrs).append(">")
                .append(jsonNodeToXml(item)).append("</").append(tag).append(">"));
        return sb.toString();
    } else {
        return "<" + tag + xmlAttrs + ">" + val.asText() + "</" + tag + ">";
    }
}

Then in jsonNodeToXml():

node.fields().forEachRemaining(entry -> {
    String key = entry.getKey();
    if (key.equals("$")) return; // skip — handled as attributes
    JsonNode val = entry.getValue();
    String xmlAttrs = "";
    if (val.isObject() && val.has("$")) {
        StringBuilder attrSb = new StringBuilder();
        val.get("$").fields().forEachRemaining(a ->
            attrSb.append(" ").append(a.getKey())
                   .append("=\"").append(a.getValue().asText()).append("\""));
        xmlAttrs = attrSb.toString();
    }
    sb.append(serializeElement(key, val, xmlAttrs));
});

After these changes, buildSoapEnvelope will produce correctly namespace-prefixed XML with proper xsi:type attributes on mobileDevice elements, which is what RSA actually expects. That clears the last structural blocker on the request side.

Huhb

Charlie Fubon — Mon, 22 Jun 2026 02:08:41 +0000


package com.bmo.dc.securityapi.era.task.riskengine;

import com.bmo.dc.securityapi.era.task.helper.APITask;
import com.bmo.dc.securityapi.era.util.RSACryptoUtil;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.node.ObjectNode;
import org.apache.log4j.Logger;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.StringReader;
import java.util.HashMap;
import java.util.Map;

import org.xml.sax.InputSource;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;

/**
 * RSAAdapter — the "black box" vendor adapter for RSA Adaptive Authentication.
 *
 * Per the BCAdapter design pattern (KT doc §3), this class absorbs everything the
 * old RSA Lambda did EXCEPT:
 *   - Vendor request mapping    (handled by RSATask via callRequestMapper)
 *   - Vendor response mapping   (handled here — Envelope.Body[callType+Response] unwrapping)
 *   - EDF call                  (explicitly dropped per design doc)
 *
 * 1:1 port source:
 *   CG2V_SCCG-RSAAdaptiveAuthentication-CDK_26777/service/lambda-functions/service/sub/
 *   - analyzeAxios.js   (FULLY PORTED — template for all call types)
 *   - notifyAxios.js    (FULLY PORTED — confirmed near-identical to analyzeAxios.js)
 *   - createUserAxios.js  (STUBBED — not yet read, fill in after reviewing file)
 *   - updateUserAxios.js  (STUBBED — not yet read, fill in after reviewing file)
 *   - queryAxios.js       (STUBBED — not yet read, fill in after reviewing file)
 *
 * File location:
 *   service/src/main/java/com/bmo/dc/securityapi/era/task/riskengine/RSAAdapter.java
 *
 * Wiring still needed (separate commit):
 *   1. Add HelperTaskFactory.BuildRSAAdapterTask(...) method
 *   2. Swap BuildAWSAPIKeyTask → BuildRSAAdapterTask in RiskEngineTaskFactory RSA case
 */
public class RSAAdapter extends APITask {

    private static final Logger logger = Logger.getLogger(RSAAdapter.class);
    private static final ObjectMapper objectMapper = new ObjectMapper();

    // ---- SOAPAction values per call type ----------------------------------------
    // analyze/notify confirmed from analyzeAxios.js line 177 / notifyAxios.js.
    // createuser/updateuser/query: assumed pattern — MUST VERIFY against each
    // *Axios.js file before treating as production-ready. See KT doc §6.3.
    private static final String SOAP_ACTION_ANALYZE     = "rsa:analyze:Analyze";
    private static final String SOAP_ACTION_NOTIFY      = "rsa:notify:Notify";
    private static final String SOAP_ACTION_CREATE_USER = "rsa:createUser:CreateUser";   // TODO verify
    private static final String SOAP_ACTION_UPDATE_USER = "rsa:updateUser:UpdateUser";   // TODO verify
    private static final String SOAP_ACTION_QUERY       = "rsa:query:Query";             // TODO verify

    // ---- SOAP namespace constants (from analyzeAxios.js lines 168-170) ----------
    private static final String SOAP_NS =
            "xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" " +
            "xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" " +
            "xmlns:tns=\"http://ws.csd.rsa.com\" " +
            "xmlns:rsa_csd=\"http://ws.csd.rsa.com\" " +
            "xmlns:atm=\"http://ws.csd.rsa.com\"";

    // ---- Config fields ----------------------------------------------------------
    // Mirror the env-var names in analyzeAxios.js, resolved via ERA config system.
    // Exact key names must be confirmed against actual config JSON in AWS.
    private final String nlbUrlCA;
    private final String nlbUrlUS;
    private final String apicNlbUrl;
    private final String harrisDPHost;
    private final String harrisDPPort;
    private final String olbDPHost;
    private final String olbDPPort;
    private final String uriForRSAAA;
    private final String uriForAsyncRSAAA;
    private final String olbbAPICHost;
    private final String olbbAPICPort;
    private final String uriOLBBRSAAA;
    private final String apiKeyOLBBRSAAA;
    private final String olbbRSACrSM;
    private final String olbbRSACrSMRole;
    private final String apicALESecret;
    private final String apicALESecretRole;

    public RSAAdapter(JsonNode config) throws Exception {
        super(config);
        this.nlbUrlCA          = cfg(config, "nlbUrlCA",          "sc-sccg-ue-sbox01-nlb04-d0a0a5d04a429c71.elb.us-east-1.amazonaws.com");
        this.nlbUrlUS          = cfg(config, "nlbUrlUS",          "sc-sccg-ue-sbox01-nlb04-d0a0a5d04a429c71.elb.us-east-1.amazonaws.com");
        this.apicNlbUrl        = cfg(config, "apicNlbUrl",        "nlb-egress-shr01-ue1-sbx-10-37764d264ad5f28d.elb.us-east-1.amazonaws.com");
        this.harrisDPHost      = cfg(config, "harrisDPHost",      "cgsg-in-dit1.bmogc.net");
        this.harrisDPPort      = cfg(config, "harrisDPPort",      ":7579");
        this.olbDPHost         = cfg(config, "olbDPHost",         "cgsg-in-dit1.bmogc.net");
        this.olbDPPort         = cfg(config, "olbDPPort",         ":8771");
        this.uriForRSAAA       = cfg(config, "uriForRSAAA",       "/AdaptiveAuthentication/services/AdaptiveAuthentication");
        this.uriForAsyncRSAAA  = "/AdaptiveAuthentication/services/AsyncAdaptiveAuthentication";
        this.olbbAPICHost      = cfg(config, "olbbAPICHost",      "api2-dev.bmogc.net");
        this.olbbAPICPort      = cfg(config, "olbbAPICPort",      ":443");
        this.uriOLBBRSAAA      = cfg(config, "uriOLBBRSAAA",      "/api/sys-olbbrsaaaop/fraud-evaluation/fraud-assessment/user-valid");
        this.apiKeyOLBBRSAAA   = cfg(config, "apiKeyOLBBRSAAA",   "5a36de7a5cb3622a9857d5efea2ffa4b");
        this.olbbRSACrSM       = cfg(config, "olbbRSACrSM",       "");
        this.olbbRSACrSMRole   = cfg(config, "olbbRSACrSMRole",   "");
        this.apicALESecret     = cfg(config, "apicALESecret",     "");
        this.apicALESecretRole = cfg(config, "apicALESecretRole", "na");
    }

    /**
     * Main entry point — called by RiskEngineTask.callAPITask().
     *
     * Contract (KT doc §5.3):
     *   input  = { headers: { x-request-id, ... }, data: <mapped RSA request payload> }
     *   output = { status: "200", data: <unwrapped call-type response JSON> }
     */
    @Override
    public JsonNode execute(JsonNode input) throws Exception {
        ObjectNode headers = (ObjectNode) input.get("headers");
        JsonNode payload   = input.get("data");

        String callType = payload.path("request").path("messageHeader")
                .path("requestType").asText("").toLowerCase();

        logger.info("RSAAdapter.execute callType=" + callType);

        switch (callType) {
            case "analyze":
                return doVendorCall(payload, headers, SOAP_ACTION_ANALYZE, callType);
            case "notify":
                return doVendorCall(payload, headers, SOAP_ACTION_NOTIFY, callType);
            case "createuser":
                // TODO: read createUserAxios.js — confirm pattern matches analyze/notify
                // before treating this path as verified. See KT doc §6.3.
                return doVendorCall(payload, headers, SOAP_ACTION_CREATE_USER, callType);
            case "updateuser":
                // TODO: read updateUserAxios.js — same as above.
                return doVendorCall(payload, headers, SOAP_ACTION_UPDATE_USER, callType);
            case "query":
                // TODO: read queryAxios.js — same as above.
                return doVendorCall(payload, headers, SOAP_ACTION_QUERY, callType);
            default:
                throw new Exception("RSAAdapter: unrecognized callType '" + callType + "'");
        }
    }

    // ============================================================================
    // Core vendor-call pipeline
    // Mirrors analyzeAxios.js / notifyAxios.js logic end-to-end.
    // All 5 call types share this pipeline — differ only in SOAPAction + response
    // root element (derived from callType).
    // ============================================================================

    private JsonNode doVendorCall(JsonNode payload, ObjectNode inboundHeaders,
                                   String soapAction, String callType) throws Exception {

        // Step 1: OLBB flag (analyzeAxios.js line 55)
        // orgName === "OLBBUS" → completely different host/auth/secret path
        String orgName = payload.path("request").path("identificationData")
                .path("orgName").asText("");
        boolean isOLBB = "OLBBUS".equals(orgName);

        // Step 2: OLBB secret / callerCredential (analyzeAxios.js lines 57-79)
        if (isOLBB) {
            // TODO: fetch OLBB secret via SecretsManagerUtil/STSManager.
            // Logic: if OLBBRSACrSMRole.startsWith("arn:aws:iam::") →
            //           getSecretValueByAssumeRole(OLBBRSACrSMRole, OLBBRSACrSM)
            //        else → getSecret(OLBBRSACrSM)
            // Then: payload.request.securityHeader.callerCredential = secret.rsaAAOPPwd
            // Requires deep-cloning the payload before mutation (immutable JsonNode).
            logger.warn("RSAAdapter: OLBB secret fetch not yet wired — callerCredential not set");
        }

        // Step 3: Async call flag (analyzeAxios.js lines 89-92)
        // asyncCallFlag="Y" → use async URI. In the new Java flow this flag is set
        // on args by serviceFunc.js after the first iteration of the request array loop.
        // TODO: determine how RSATask surfaces asyncCallFlag into the adapter context.
        // Defaulting to sync URI for now.
        String activeURI = uriForRSAAA;

        // Step 4: Host + URL resolution (analyzeAxios.js lines 94-112)
        String host;
        String url;

        if (isOLBB) {
            host = olbbAPICHost;
            url  = "https://" + apicNlbUrl + olbbAPICPort + uriOLBBRSAAA;
        } else {
            // Country-based override: originatorData.country === "US" → HARRISDP
            String country = payload.path("originatorData").path("country").asText("");
            if ("US".equalsIgnoreCase(country)) {
                host = harrisDPHost;
                url  = "https://" + nlbUrlUS + harrisDPPort + activeURI;
            } else {
                host = olbDPHost;
                url  = "https://" + nlbUrlCA + olbDPPort + activeURI;
            }
        }

        logger.info("RSAAdapter url=" + url + " isOLBB=" + isOLBB + " soapAction=" + soapAction);

        // Step 5: Build SOAP XML (analyzeAxios.js lines 160-170)
        // TODO: parseAttribute() and addNamespace() from utils.js not yet ported.
        // buildSoapEnvelope() below is a structural placeholder — produces valid XML
        // but WITHOUT namespace prefixes. Will not work against real RSA until TODO resolved.
        String xmlBody = buildSoapEnvelope(payload, callType);

        // Step 6: Auth mode + headers (analyzeAxios.js lines 172-207)
        ObjectNode requestHeaders = objectMapper.createObjectNode();
        requestHeaders.put("SOAPAction", soapAction);
        requestHeaders.put("Host", host);

        String requestBodyStr;

        if ("na".equals(apicALESecretRole) || isOLBB) {
            // Plain XML path (analyzeAxios.js lines 187-196)
            requestBodyStr = xmlBody;
            if (isOLBB) {
                requestHeaders.put("x-api-key", apiKeyOLBBRSAAA);
                requestHeaders.put("Content-type", "text/xml");
            }
        } else {
            // Encrypted path (analyzeAxios.js lines 198-207)
            // TODO: wire in RSACryptoUtil.encrypt() once secret fetch is implemented.
            // Blocked on:
            //   - fetching apicALESecret via SecretsManagerUtil (assume-role if apicALESecretRole is ARN)
            //   - getting secretRKP from the request context (pre-fetched in ERA's Lambda equivalent)
            // RSACryptoUtil is ready — just needs the secret values plugged in:
            //
            //   String xApiCryptoKey = inboundHeaders.has("x-apic-crypto-key")
            //           ? inboundHeaders.get("x-apic-crypto-key").asText() : null;
            //   RSACryptoUtil.EncryptResult encryptResult =
            //           RSACryptoUtil.encrypt(xmlBody, xApiCryptoKey, secret, secretRKP);
            //   ObjectNode encBody = objectMapper.createObjectNode();
            //   encBody.put("secure", encryptResult.payload);
            //   requestBodyStr = objectMapper.writeValueAsString(encBody);
            //   requestHeaders.put("x-apic-crypto-key", encryptResult.xApicCryptoKey);
            //   requestHeaders.put("x-apic-crypto-control", "request");
            //
            logger.warn("RSAAdapter: encrypted auth path reached but secret fetch not yet wired");
            requestBodyStr = xmlBody; // TEMPORARY — replace with block above once secrets wired
        }

        // Step 7: mTLS (analyzeAxios.js lines 122-158)
        // TODO: confirm proxy/cert requirement for ERA → RSA network path (KT doc §10).
        // APITask has httpPostRequestJsonViaProxy(..., certPem) for TLS via PEM cert.
        // Defaulting to plain POST until confirmed.

        // Step 8: HTTP call (analyzeAxios.js line 210)
        ObjectNode httpPayload = objectMapper.createObjectNode();
        httpPayload.put("body", requestBodyStr);

        JsonNode rawResponse = httpPostRequestJson(url, requestHeaders, httpPayload);

        // Step 9: Error taxonomy (analyzeAxios.js lines 213-312, KT doc §4.5)
        String statusCode = rawResponse.path("status").asText();
        if (!"200".equals(statusCode) && !statusCode.startsWith("2")) {
            throw buildVendorException(statusCode, rawResponse.path("message").asText());
        }

        // Step 10: XML parse + SOAP envelope unwrap (analyzeAxios.js lines 336-365)
        // Equivalent to old Lambda's parseXml() + mapResponse.js combined.
        String responseXml = rawResponse.path("data").asText("");
        JsonNode parsed = parseAndUnwrapSoapResponse(responseXml, callType);

        // Step 11: Return shape expected by RiskEngineTask.processAPIresult() (KT doc §5.3)
        // processAPIresult() checks response.get("status") and returns response.get("data")
        ObjectNode result = objectMapper.createObjectNode();
        result.put("status", "200");
        result.set("data", parsed);
        return result;
    }

    // ============================================================================
    // SOAP envelope builder
    // Port of analyzeAxios.js lines 160-170.
    // TODO: parseAttribute() + addNamespace() from utils.js not yet ported.
    // This produces structurally correct XML but WITHOUT rsa_csd: namespace prefixes
    // on inner elements. RSA vendor WILL reject this until namespace prefixing is added.
    // ============================================================================

    private String buildSoapEnvelope(JsonNode payload, String callType) throws Exception {
        String innerXml = jsonNodeToXml(payload.path("request"));
        return "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" +
               "<soap:Envelope " + SOAP_NS + ">" +
               "<soap:Body>" +
               "<rsa_csd:" + callType + " xmlns:rsa_csd=\"http://ws.csd.rsa.com\">" +
               innerXml +
               "</rsa_csd:" + callType + ">" +
               "</soap:Body>" +
               "</soap:Envelope>";
    }

    /**
     * Minimal JSON → XML serializer. Placeholder until addNamespace() is ported.
     * Does NOT apply rsa_csd: namespace prefixes — MUST be replaced before
     * sending to a real RSA endpoint.
     */
    private String jsonNodeToXml(JsonNode node) {
        if (node == null || node.isNull() || node.isMissingNode()) return "";
        StringBuilder sb = new StringBuilder();
        node.fields().forEachRemaining(entry -> {
            String key = entry.getKey();
            JsonNode val = entry.getValue();
            if (val.isObject()) {
                sb.append("<").append(key).append(">")
                  .append(jsonNodeToXml(val))
                  .append("</").append(key).append(">");
            } else if (val.isArray()) {
                val.forEach(item -> sb.append("<").append(key).append(">")
                        .append(jsonNodeToXml(item))
                        .append("</").append(key).append(">"));
            } else {
                sb.append("<").append(key).append(">")
                  .append(val.asText())
                  .append("</").append(key).append(">");
            }
        });
        return sb.toString();
    }

    // ============================================================================
    // SOAP response parser + envelope unwrapper
    // Port of analyzeAxios.js parseXml() + mapResponse.js (KT doc §9.1 decision)
    // ============================================================================

    private JsonNode parseAndUnwrapSoapResponse(String xmlBody, String callType) throws Exception {
        if (xmlBody == null || xmlBody.trim().isEmpty()) {
            // parseEmpty() equivalent — canned empty response per call type
            // (e.g. notifyAxios.js: { Envelope: { Body: { notifyResponse: { notifyReturn: {} } } } })
            ObjectNode empty = objectMapper.createObjectNode();
            ObjectNode ret   = objectMapper.createObjectNode();
            ret.set(callType + "Return", objectMapper.createObjectNode());
            empty.set(callType + "Response", ret);
            logger.info("RSAAdapter: empty response for callType=" + callType);
            return empty;
        }

        try {
            // Parse XML with namespace-stripping (ignoreAttrs + stripPrefix equivalent)
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            dbf.setNamespaceAware(false);
            DocumentBuilder db = dbf.newDocumentBuilder();
            Document doc = db.parse(new InputSource(new StringReader(xmlBody)));

            // DOM → JsonNode (simplified, emptyTag:null + explicitArray:false equivalent)
            JsonNode envelope = domToJson(doc.getDocumentElement());

            // mapResponse.js: response.Envelope.Body[callType + "Response"]
            // with callType normalization (createuser→createUser, updateuser→updateUser)
            String normalizedType = normalizeCallType(callType);
            JsonNode body = envelope.path("Body");
            if (body.isMissingNode()) {
                logger.warn("RSAAdapter: no Body in SOAP response, returning raw envelope");
                return envelope;
            }

            JsonNode typeResponse = body.path(normalizedType + "Response");
            if (typeResponse.isMissingNode()) {
                logger.warn("RSAAdapter: no " + normalizedType + "Response in Body, returning raw Body");
                return body;
            }

            return typeResponse;

        } catch (Exception e) {
            logger.error("RSAAdapter: XML parse/unwrap error callType=" + callType, e);
            throw e;
        }
    }

    /**
     * Normalizes callType for response key lookup.
     * Port of mapResponse.js lines 12-13.
     */
    private String normalizeCallType(String callType) {
        switch (callType) {
            case "createuser": return "createUser";
            case "updateuser": return "updateUser";
            default:           return callType;
        }
    }

    /**
     * DOM Element → JsonNode, stripping namespace prefixes.
     * Equivalent to xml2js { ignoreAttrs: true, tagNameProcessors: [stripPrefix],
     * explicitArray: false, emptyTag: null }.
     *
     * TODO: customReplacer() normalization (clientFactList.fact array wrapping,
     * deviceManagementResponse.deviceData array wrapping) NOT yet applied here —
     * needed for correct behavior on real RSA responses. Port customReplacer from
     * utils.js and apply during/after this conversion.
     */
    private JsonNode domToJson(org.w3c.dom.Element element) {
        ObjectNode node = objectMapper.createObjectNode();
        NodeList children = element.getChildNodes();

        for (int i = 0; i < children.getLength(); i++) {
            org.w3c.dom.Node child = children.item(i);
            if (child.getNodeType() != org.w3c.dom.Node.ELEMENT_NODE) continue;

            org.w3c.dom.Element childEl = (org.w3c.dom.Element) child;
            String localName = childEl.getLocalName() != null
                    ? childEl.getLocalName()
                    : stripPrefix(childEl.getNodeName());

            boolean isLeaf = childEl.getChildNodes().getLength() == 1 &&
                             childEl.getFirstChild().getNodeType() == org.w3c.dom.Node.TEXT_NODE;

            JsonNode childJson;
            if (isLeaf) {
                String text = childEl.getFirstChild().getNodeValue();
                childJson = (text == null || text.trim().isEmpty())
                        ? objectMapper.nullNode()   // emptyTag: null
                        : objectMapper.valueToTree(text.trim());
            } else {
                childJson = domToJson(childEl);
            }

            node.set(localName, childJson);
        }
        return node;
    }

    private String stripPrefix(String name) {
        int colon = name.indexOf(':');
        return colon >= 0 ? name.substring(colon + 1) : name;
    }

    // ============================================================================
    // Error taxonomy builder
    // Port of analyzeAxios.js catch blocks (lines 213-312, KT doc §4.5)
    // ============================================================================

    private Exception buildVendorException(String statusCode, String message) {
        ObjectNode errorBody = objectMapper.createObjectNode();
        ObjectNode result    = objectMapper.createObjectNode();
        result.put("status",   "Failure");
        result.set("messages", objectMapper.createArrayNode().add("request could not be completed"));

        ObjectNode detail = objectMapper.createObjectNode();
        detail.put("sourceAppCatId", "26777");
        detail.put("detailCode", "SYSERROR");

        boolean isTimeout  = "504".equals(statusCode) ||
                             (message != null && (message.contains("timeout") ||
                              message.contains("ETIMEDOUT") || message.contains("ECONNREFUSED")));
        boolean isDataPower = message != null && message.contains("DataPower");
        boolean isAborted   = message != null && (message.contains("aborted") ||
                              message.contains("ECONNABORTED"));

        if (isTimeout) {
            result.put("code", "504");
            detail.put("detailMessage", "backend returned with timeout");
        } else if (isDataPower) {
            result.put("code", "500");
            detail.put("detailMessage", "could not establish connection with backend");
        } else if (isAborted) {
            result.put("code", "504");
            detail.put("detailMessage", "Request aborted");
        } else {
            // Fallthrough (analyzeAxios.js line 311: return reject(error) — raw pass-through)
            return new Exception("RSAAdapter vendor error HTTP " + statusCode + ": " + message);
        }

        result.set("resultDetails", objectMapper.createArrayNode().add(detail));
        errorBody.set("result", result);
        return new Exception("RSAAdapter vendor error: " + errorBody.toString());
    }

    // ============================================================================
    // Config helper
    // ============================================================================

    private String cfg(JsonNode config, String key, String defaultValue) {
        return (config != null && config.has(key) && !config.get(key).isNull())
                ? config.get(key).asText()
                : defaultValue;
    }
}

Hahjs

Charlie Fubon — Sun, 21 Jun 2026 23:57:25 +0000


package com.bmo.dc.securityapi.era.util.common;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.OAEPParameterSpec;
import javax.crypto.spec.MGF1ParameterSpec;
import javax.crypto.spec.PSource;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.MessageDigest;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

import com.fasterxml.jackson.databind.JsonNode;

/**
 * 1:1 port of CG2V_SCCG-RSAAdaptiveAuthentication-CDK_26777/service/lambda-functions/service/utils.js
 * decrypt() and encrypt() functions.
 *
 * Envelope encryption scheme: an AES-256-CBC "data encryption key" (DEK/CEK) is itself
 * encrypted with RSA-OAEP, and the result is carried as a dot-delimited string:
 *   keyVersion.base64(RSA-OAEP-encrypted CEK).base64(SHA-256 hash of CEK).base64(IV)
 *
 * ============================================================================
 * !!! UNVERIFIED — MUST CONFIRM BEFORE PRODUCTION USE !!!
 * The old Node code calls crypto.privateDecrypt/publicEncrypt with only
 * { key, padding: RSA_PKCS1_OAEP_PADDING } — no oaepHash/mgf1Hash options.
 * Node's crypto module defaults BOTH the OAEP hash and the MGF1 hash to SHA-1
 * when unspecified. This class assumes that default (OAEPWithSHA-1AndMGF1Padding)
 * to match. THIS HAS NOT BEEN EMPIRICALLY VERIFIED against a real round-trip
 * between the Node Lambda and this Java code. If decryption fails or produces
 * garbage, this is the first thing to check — try SHA-256 next.
 * See KT doc — verify via round-trip test (Node-encrypt -> Java-decrypt) with a
 * scratch RSA keypair before relying on this in any environment beyond local dev.
 * ============================================================================
 */
public final class RSACryptoUtil {

    private RSACryptoUtil() {
    }

    private static final String RSA_TRANSFORM = "RSA/ECB/OAEPWithSHA-1AndMGF1Padding"; // see warning above
    private static final String AES_TRANSFORM = "AES/CBC/PKCS5Padding"; // Node aes-256-cbc default padding is PKCS#7,
                                                                          // equivalent to PKCS5Padding in JCE for this block size
    private static final OAEPParameterSpec OAEP_SHA1_SPEC = new OAEPParameterSpec(
            "SHA-1", "MGF1", MGF1ParameterSpec.SHA1, PSource.PSpecified.DEFAULT);

    /**
     * 1:1 port of utils.js decrypt(payload, xApicCryptoKey, secret).
     *
     * @param payload        JsonNode with a "secure" field (base64 ciphertext) — mirrors payload.secure in JS
     * @param xApicCryptoKey the dot-delimited key-material string from the x-apic-crypto-key header
     * @param secret         JsonNode (or Map-like) of secret material, expected to contain a key named
     *                       "APICPayloadDecryptionKey-<keyVersion>" holding a PEM private key string
     * @return decrypted payload as a String (caller is expected to JSON.parse it, matching old serviceFunc.js)
     */
    public static String decrypt(JsonNode payload, String xApicCryptoKey, JsonNode secret) throws Exception {
        // tokens[0]=keyVersion, [1]=encrypted_CEK_B64, [2]=hashCEK_B64 (UNUSED here, see class javadoc /
        // KT doc — parsed only because it's positional in the dot-delimited format; it's the CEK integrity
        // hash produced by encrypt(), decrypt() never needs it), [3]=iv_B64
        String[] tokens = xApicCryptoKey.split("\\.");
        String keyVersion = tokens[0];
        String encryptedCekB64 = tokens[1];
        // String hashCekB64 = tokens[2];   // intentionally unused — see javadoc above
        String ivB64 = tokens[3];

        String keyName = "APICPayloadDecryptionKey-" + keyVersion;
        String pKeyRaw = secret.get(keyName).asText();

        // Old JS: pKey.replace(/\\n/g, "\n") — un-escape literal backslash-n sequences from secret storage
        // into real newlines, required for PEM parsing. MUST replicate exactly.
        String pKeyPem = pKeyRaw.replace("\\n", "\n");

        byte[] encryptedDek = Base64.getDecoder().decode(encryptedCekB64);
        PrivateKey privateKey = parsePkcs8PrivateKeyFromPem(pKeyPem);

        byte[] dataEncryptionKey = rsaOaepDecrypt(privateKey, encryptedDek);

        byte[] iv = Base64.getDecoder().decode(ivB64);

        Cipher aesCipher = Cipher.getInstance(AES_TRANSFORM);
        aesCipher.init(Cipher.DECRYPT_MODE,
                new javax.crypto.spec.SecretKeySpec(dataEncryptionKey, "AES"),
                new IvParameterSpec(iv));

        byte[] cipherBytes = Base64.getDecoder().decode(payload.get("secure").asText());
        byte[] plainBytes = aesCipher.doFinal(cipherBytes);

        return new String(plainBytes, java.nio.charset.StandardCharsets.UTF_8);
    }

    /**
     * 1:1 port of utils.js encrypt(payload, pApicCryptoKey, secret, secretRKP).
     *
     * Two branches, matching the old JS exactly:
     *   - xApicCryptoKey == null: generate a fresh CEK/IV, RSA-OAEP encrypt the CEK with the
     *     PUBLIC cert from `secret` (APICPayloadEncryptionKey-<currentVersion>). This branch is
     *     NOT the one exercised by RSAAdapter's actual call path (RSA always passes an existing
     *     xApiCryptoKey from the request headers) — kept here because encrypt() is a shared
     *     utility other vendors/flows may use the generate-new-key branch for. Flagging this so
     *     it isn't mistaken for dead/untested code specific to RSA.
     *   - xApicCryptoKey != null: parse the existing dot-delimited key material and RSA-OAEP
     *     DECRYPT the CEK using the PRIVATE key from `secretRKP` (APICPayloadDecryptionKey-<keyVersion>),
     *     i.e. reuse the session key rather than generating a new one. THIS is the branch RSAAdapter
     *     actually hits, since analyzeAxios.js (and siblings) always pass a non-null xApiCryptoKey.
     *
     * @return result object equivalent to JS's { xApicCryptoKey, payload } — see EncryptResult below
     */
    public static EncryptResult encrypt(String payload, String xApicCryptoKey, JsonNode secret, JsonNode secretRKP)
            throws Exception {
        String keyVersion;
        String encryptedCekB64;
        String hashCekB64;
        String ivB64;
        byte[] dataEncryptionKey;

        if (xApicCryptoKey == null) {
            // ---- Branch: generate new ephemeral key (NOT the RSA-adapter code path, see javadoc) ----
            keyVersion = secret.get("currentVersion").asText();

            SecureRandom random = new SecureRandom();
            byte[] cek = new byte[32]; // 256-bit AES key
            random.nextBytes(cek);
            byte[] ivBytes = new byte[16];
            random.nextBytes(ivBytes);

            encryptedCekB64 = null; // computed below after RSA-OAEP encrypt
            ivB64 = Base64.getEncoder().encodeToString(ivBytes);

            MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
            hashCekB64 = Base64.getEncoder().encodeToString(sha256.digest(cek));

            String certName = "APICPayloadEncryptionKey-" + keyVersion;
            String certRaw = secret.get(certName).asText();
            String certPem = certRaw.replace("\\n", "\n");

            PublicKey publicKey = parseX509PublicKeyFromPem(certPem);
            byte[] encryptedCek = rsaOaepEncrypt(publicKey, cek);
            encryptedCekB64 = Base64.getEncoder().encodeToString(encryptedCek);

            dataEncryptionKey = cek;

            xApicCryptoKey = keyVersion + "." + encryptedCekB64 + "." + hashCekB64 + "." + ivB64;
        } else {
            // ---- Branch: reuse existing key material (THIS is RSAAdapter's actual code path) ----
            String[] tokens = xApicCryptoKey.split("\\.");
            keyVersion = tokens[0];
            encryptedCekB64 = tokens[1];
            hashCekB64 = tokens[2]; // unused below, same as decrypt() — see class javadoc
            ivB64 = tokens[3];

            String keyName = "APICPayloadDecryptionKey-" + keyVersion;
            String pKeyRaw = secretRKP.get(keyName).asText();
            String pKeyPem = pKeyRaw.replace("\\n", "\n");

            PrivateKey privateKey = parsePkcs8PrivateKeyFromPem(pKeyPem);
            byte[] encryptedCek = Base64.getDecoder().decode(encryptedCekB64);
            dataEncryptionKey = rsaOaepDecrypt(privateKey, encryptedCek);
        }

        byte[] iv = Base64.getDecoder().decode(ivB64);
        Cipher aesCipher = Cipher.getInstance(AES_TRANSFORM);
        aesCipher.init(Cipher.ENCRYPT_MODE,
                new javax.crypto.spec.SecretKeySpec(dataEncryptionKey, "AES"),
                new IvParameterSpec(iv));

        byte[] plainBytes = payload.getBytes(java.nio.charset.StandardCharsets.UTF_8);
        byte[] cipherBytes = aesCipher.doFinal(plainBytes);
        String theCipher = Base64.getEncoder().encodeToString(cipherBytes);

        return new EncryptResult(xApicCryptoKey, theCipher);
    }

    /** Mirrors JS's `{ xApicCryptoKey, payload }` return shape from encrypt(). */
    public static final class EncryptResult {
        public final String xApicCryptoKey;
        public final String payload;

        public EncryptResult(String xApicCryptoKey, String payload) {
            this.xApicCryptoKey = xApicCryptoKey;
            this.payload = payload;
        }
    }

    // ---- Internal helpers -----------------------------------------------------------------

    private static byte[] rsaOaepDecrypt(PrivateKey privateKey, byte[] data) throws Exception {
        Cipher cipher = Cipher.getInstance(RSA_TRANSFORM);
        cipher.init(Cipher.DECRYPT_MODE, privateKey, OAEP_SHA1_SPEC);
        return cipher.doFinal(data);
    }

    private static byte[] rsaOaepEncrypt(PublicKey publicKey, byte[] data) throws Exception {
        Cipher cipher = Cipher.getInstance(RSA_TRANSFORM);
        cipher.init(Cipher.ENCRYPT_MODE, publicKey, OAEP_SHA1_SPEC);
        return cipher.doFinal(data);
    }

    /**
     * Parses a PEM-encoded PKCS#8 private key (the typical "-----BEGIN PRIVATE KEY-----" format).
     * NOTE: if the secret's PEM is actually PKCS#1 ("-----BEGIN RSA PRIVATE KEY-----"), this will
     * fail and will need a PKCS#1-aware parser instead (e.g. via BouncyCastle) — confirm the actual
     * PEM header format from a real secret value before relying on this.
     */
    private static PrivateKey parsePkcs8PrivateKeyFromPem(String pem) throws Exception {
        String stripped = pem
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replaceAll("\\s+", "");
        byte[] der = Base64.getDecoder().decode(stripped);
        KeyFactory kf = KeyFactory.getInstance("RSA");
        return kf.generatePrivate(new PKCS8EncodedKeySpec(der));
    }

    private static PublicKey parseX509PublicKeyFromPem(String pem) throws Exception {
        // Handles both "-----BEGIN PUBLIC KEY-----" and "-----BEGIN CERTIFICATE-----" forms.
        // If `pem` is a full X.509 certificate (not a bare public key), this strip-based approach
        // will need to go through CertificateFactory instead — confirm actual secret format.
        String stripped = pem
                .replace("-----BEGIN PUBLIC KEY-----", "")
                .replace("-----END PUBLIC KEY-----", "")
                .replace("-----BEGIN CERTIFICATE-----", "")
                .replace("-----END CERTIFICATE-----", "")
                .replaceAll("\\s+", "");
        byte[] der = Base64.getDecoder().decode(stripped);
        KeyFactory kf = KeyFactory.getInstance("RSA");
        return kf.generatePublic(new X509EncodedKeySpec(der));
    }
}

Gugh

Charlie Fubon — Tue, 24 Feb 2026 04:15:12 +0000


@Test
@DisplayName("retryFraudDispostion will throw RetryableFailureException on ServiceConnectionTimeoutException")
void testRetryFraudDispositionRetryExhausted() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenReturn(FicoAuthToken.builder().build());
    when(ficoService.getFraudTransactionResponse(any()))
        .thenThrow(new ServiceConnectionTimeoutException());

    assertThrows(RetryableFailureException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));

    verify(ficoService, times(2))
        .getFraudTransactionResponse(any());
}

@Test
@DisplayName("retryFraudDispostion will throw RetryableFailureException on TokenGenerationException")
void testRetryFraudDispositionTokenGenerationException() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenThrow(new TokenGenerationException());

    assertThrows(RetryableFailureException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));
}

@Test
@DisplayName("retryFraudDispostion will throw ApiException on BadRequestException")
void testRetryFraudDispositionBadRequestException() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenReturn(FicoAuthToken.builder().build());
    when(ficoService.getFraudTransactionResponse(any()))
        .thenThrow(new BadRequestException());

    assertThrows(ApiException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));
}

@Test
@DisplayName("retryFraudDispostion will throw ApiException on RequestReadTimeoutException")
void testRetryFraudDispositionRequestReadTimeoutException() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenReturn(FicoAuthToken.builder().build());
    when(ficoService.getFraudTransactionResponse(any()))
        .thenThrow(new RequestReadTimeoutException());

    assertThrows(ApiException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));
}

@Test
@DisplayName("retryFraudDispostion will throw ApiException on ServiceGeneralException")
void testRetryFraudDispositionServiceGeneralException() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenReturn(FicoAuthToken.builder().build());
    when(ficoService.getFraudTransactionResponse(any()))
        .thenThrow(new ServiceGeneralException());

    assertThrows(ApiException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));
}

@Test
@DisplayName("retryFraudDispostion will throw ApiException on generic Exception")
void testRetryFraudDispositionGenericException() throws IOException, ApiException {
    var fraudDisposition = this.mapper.readValue(
        new File("src/test/resources/test-data/valid_ficoRequestVBW.json"),
        FraudDisposition.class
    );

    when(ficoTokenManager.getFicoAuthToken())
        .thenReturn(FicoAuthToken.builder().build());
    when(ficoService.getFraudTransactionResponse(any()))
        .thenThrow(new RuntimeException("unexpected error"));

    assertThrows(ApiException.class,
        () -> ficoRetryServiceInvoker.retryFraudDispostion(fraudDisposition));
}

Hin

Charlie Fubon — Tue, 17 Feb 2026 16:15:48 +0000

Based on the meeting notes and code review, here are the changes needed in MerchantProcessorService.java:
Required Changes

Add New Kafka Listeners for Visa Biweekly Fraud Topic You need to add TWO new listeners: A. Main Fraud Listener (similar to intake/BIS listeners)

@PerfLog(message = "listenVisaBiweeklyFraud")
@KafkaListener(
topics = "${kafka.topic.consumer.visabiweeklyCFFraud}",
id = "visaBiweeklyFraudListener",
autoStartup = "${kafka.visabiweekly.fraud.listener.enable}",
groupId = "#{'${kafka.consumerGroup.visabiweeklyFraud}'}",
containerFactory = "kafkaListenerContainerFactory_visabiweekly_fraud"
)
void listenVisaBiweeklyFraudRequest(
final ConsumerRecord consumerRecord, // Note: String value for raw string
@Header(HEADER_TRACEABILITY_ID) String traceabilityId,
@Header(KafkaHeaders.RECEIVED_PARTITION_ID) int partition,
@Header(KafkaHeaders.RECEIVED_TOPIC) String topic) {

processVisaBiweeklyFraudRequest(consumerRecord, "listenVisaBiweeklyFraud");

}

B. Separate Retry Listener for Visa Biweekly

@PerfLog(message = "listenVisaBiweeklyRetryRequest")
@KafkaListener(
topics = "${kafka.topic.retry.visabiweekly}",
id = "visaBiweeklyRetryListener",
autoStartup = "${kafka.visabiweekly.retry.listener.enable}",
groupId = "#{'${kafka.retry.consumerGroup.visabiweekly}'}",
containerFactory = "retryKafkaListenerContainerFactory_visabiweekly"
)
void listenVisaBiweeklyRetryRequest(
ConsumerRecord inputRecord,
@Header(HEADER_TRACEABILITY_ID) String traceabilityId,
@Header(KafkaHeaders.RECEIVED_PARTITION_ID) int partition,
@Header(KafkaHeaders.RECEIVED_TOPIC) String topic,
Acknowledgment acknowledgment) {

processVisaBiweeklyRetry(inputRecord, acknowledgment);

}

Add Processing Method for Visa Biweekly Fraud

private void processVisaBiweeklyFraudRequest(
@NotNull final ConsumerRecord inputRecord,
String transactionType) {

TransactionDecision transactionDecision = null;
final var rawFraudString = inputRecord.value(); // Raw string from debatcher
var recordHeaders = inputRecord.headers();

try {
    setMDCHeadersValues(
        new String(CommonUtils.getHeaderVal(recordHeaders, HEADER_TRACEABILITY_ID), StandardCharsets.UTF_8), 
        "N"
    );
    getTimeElapsed(recordHeaders);
    log.info(transactionType + TOPIC_POLL_MSG, inputRecord.topic(), inputRecord.partition());

    // Parse raw string, do manual padding/validations
    var merchantRequest = new MerchantProcessRequest(rawFraudString);
    visaBiweeklyTransformer.performStringParsing(merchantRequest); // New transformer
    visaBiweeklyTransformer.performCommonTransformation(merchantRequest);

    transactionDecision = merchantRequest.getTransactionDecision();

    /* Step 1: Get decision from FICO */
    var ficoResponse = ficoDecisionManager.getFicoDecision(transactionDecision);

    /* Step 2: NO DSAP publish - only handle retry on failure */
    log.info("Visa Biweekly Fraud processed successfully - no DSAP publish");

} catch (ApiException e) {
    log.error(MERCHANT_ERROR_MSG, getStatusCode(e), e.getStatus());

    var isRetryRequest = containsAny(
        getServerStatusCode(e), 
        SERVICE_UNAVAILABLE_ERROR_CODE,
        TOKEN_GENERATION_FAILURE_ERROR_CODE,
        INVALID_TOKEN_ERROR_CODE
    );

    if (isRetryRequest) {
        log.info(PUBLISH_RETRY_START_MSG);
        // Publish to VISA BIWEEKLY retry topic (NOT standard retry)
        kafkaService.publishVisaBiweeklyMessageToRetry(transactionDecision, recordHeaders);
    }

} catch (Exception e) {
    log.error("VisaBiweekly Fraud listen: Exception: {}: Error Details: {}", 
        getExceptionName(e), ExceptionUtils.getStackTrace(e));
}

}

Add Separate Retry Processing Method

private void processVisaBiweeklyRetry(
ConsumerRecord inputRecord,
Acknowledgment acknowledgment) {

setMDCHeadersValues(/* traceability */, "Y");
var transactionDecision = inputRecord.value();
var recordHeaders = inputRecord.headers();

try {
    // IMPORTANT: Reset external record ID before retry
    resetExternalRecordId(transactionDecision);

    TransactionDecision ficoResponse = ficoRetryServiceInvoker.retryDecision(transactionDecision);

    verifyFicoDecisionError(inputRecord.value());

    if (Optional.ofNullable(ficoResponse).isPresent()) {
        acknowledgment.acknowledge();
    }

    // NO DSAP publish for Visa Biweekly

} catch (RetryableFailureException ex) {
    // Handle retry logic
} catch (ApiException e) {
    acknowledgment.acknowledge();
    log.error("VisaBiweekly Retry: ApiException: {}", getStatusCode(e));
}

}

Modify TransactionDecision Model The TransactionDecision class needs to accept a TransactionDisposition field:

// In TransactionDecision.java or wherever the model is defined
private TransactionDisposition transactionDisposition;

Add Helper Method to Reset External Record ID

private void resetExternalRecordId(TransactionDecision transactionDecision) {
if (transactionDecision != null && transactionDecision.getHeader() != null) {
// Reset or regenerate external record ID for retry
transactionDecision.getHeader().setExternalRecordId(generateNewRecordId());
}
}

Key Differences from Existing Listeners ∙ Input format: String (not FraudCheckEventRequest or BusinessInformation) ∙ String parsing: Manual validation, padding before transformation ∙ NO DSAP publish: Skip publishSuccessMessageToDsap() entirely ∙ Separate retry topic: Not the standard retry queue ∙ Reset external record ID on retry ∙ TransactionDisposition handling: Ensure retry logic handles this new field properly

Summary of New Components Needed
1. ✅ New Kafka listener for Visa Biweekly Fraud topic
2. ✅ Separate retry listener for Visa Biweekly
3. ✅ String parsing/validation logic (in new transformer)
4. ✅ Modified retry logic (reset external record ID)
5. ✅ Updated TransactionDecision model
6. ✅ No DSAP publishing for this flow
Would you like me to create the complete transformer class for string parsing as well?