[FINERACT-1678] Set a limit to the request body list size on Inline Loan COB API

fineract-provider/src/main/java/org/apache/fineract/cob/service/InlineLoanCOBExecutorServiceImpl.java

@@ -45,6 +45,7 @@ import org.apache.fineract.infrastructure.core.config.FineractProperties;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
 import org.apache.fineract.infrastructure.core.exception.PlatformInternalServerException;
+import org.apache.fineract.infrastructure.core.exception.PlatformRequestBodyItemLimitValidationException;
 import org.apache.fineract.infrastructure.core.serialization.GoogleGsonSerializerHelper;
 import org.apache.fineract.infrastructure.core.service.ThreadLocalContextUtil;
 import org.apache.fineract.infrastructure.jobs.domain.CustomJobParameter;
@@ -95,6 +96,7 @@ public class InlineLoanCOBExecutorServiceImpl implements InlineExecutorService<L
     @Transactional(propagation = Propagation.NOT_SUPPORTED)
     public CommandProcessingResult executeInlineJob(JsonCommand command, String jobName) throws LoanAccountLockCannotBeOverruledException {
         List<Long> loanIds = dataParser.parseExecution(command);
+        validateLoanIdsListSize(loanIds);
         execute(loanIds, jobName);
         return new CommandProcessingResultBuilder().withCommandId(command.commandId()).build();
     }
@@ -231,4 +233,12 @@ public class InlineLoanCOBExecutorServiceImpl implements InlineExecutorService<L
     private boolean isBypassUser() {
         return context.getAuthenticatedUserIfPresent().isBypassUser();
     }
+
+    private void validateLoanIdsListSize(List<Long> loanIds) {
+        int inlineLoanCobRequestItemLimit = fineractProperties.getApi().getBodyItemSizeLimit().getInlineLoanCob();
+        if (loanIds.size() > inlineLoanCobRequestItemLimit) {
+            String userMessage = "Size of the loan IDs list cannot be over " + inlineLoanCobRequestItemLimit;
+            throw new PlatformRequestBodyItemLimitValidationException(userMessage);
+        }
+    }
 }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java

@@ -56,6 +56,7 @@ public class FineractProperties {
     private FineractJpaProperties jpa;
 
     private FineractQueryProperties query;
+    private FineractApiProperties api;
 
     @Getter
     @Setter
@@ -265,4 +266,18 @@ public class FineractProperties {
         private int inClauseParameterSizeLimit;
     }
 
+    @Getter
+    @Setter
+    public static class FineractApiProperties {
+
+        private FineractBodyItemSizeLimitProperties bodyItemSizeLimit;
+    }
+
+    @Getter
+    @Setter
+    public static class FineractBodyItemSizeLimitProperties {
+
+        private int inlineLoanCob;
+    }
+
 }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/data/ApiGlobalErrorResponse.java

@@ -21,6 +21,7 @@ package org.apache.fineract.infrastructure.core.data;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.google.gson.Gson;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import javax.ws.rs.core.Response.Status;
 
@@ -176,6 +177,10 @@ public class ApiGlobalErrorResponse {
         return globalErrorResponse;
     }
 
+    public static ApiGlobalErrorResponse badClientRequest(final String globalisationMessageCode, final String defaultUserMessage) {
+        return badClientRequest(globalisationMessageCode, defaultUserMessage, Collections.emptyList());
+    }
+
     public static ApiGlobalErrorResponse serverSideError(final String globalisationMessageCode, final String defaultUserMessage,
             final Object... defaultUserMessageArgs) {
 

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/exception/PlatformRequestBodyItemLimitValidationException.java

@@ -0,0 +1,26 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.core.exception;
+
+public class PlatformRequestBodyItemLimitValidationException extends RuntimeException {
+
+    public PlatformRequestBodyItemLimitValidationException(String message) {
+        super(message);
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/exceptionmapper/PlatformRequestBodyItemLimitValidationExceptionMapper.java

@@ -0,0 +1,46 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.core.exceptionmapper;
+
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.ext.ExceptionMapper;
+import javax.ws.rs.ext.Provider;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.data.ApiGlobalErrorResponse;
+import org.apache.fineract.infrastructure.core.exception.PlatformRequestBodyItemLimitValidationException;
+import org.springframework.context.annotation.Scope;
+import org.springframework.stereotype.Component;
+
+@Provider
+@Component
+@Scope("singleton")
+@Slf4j
+public class PlatformRequestBodyItemLimitValidationExceptionMapper
+        implements ExceptionMapper<PlatformRequestBodyItemLimitValidationException> {
+
+    @Override
+    public Response toResponse(PlatformRequestBodyItemLimitValidationException exception) {
+        String globalisationMessage = "error.msg.validation.request.body.item.limit.validation";
+        log.warn("Exception: {}, Message: {}", exception.getClass().getName(), exception.getMessage());
+        final ApiGlobalErrorResponse badRequestErrorResponse = ApiGlobalErrorResponse.badClientRequest(globalisationMessage,
+                exception.getMessage());
+        return Response.status(Response.Status.BAD_REQUEST).entity(badRequestErrorResponse).type(MediaType.APPLICATION_JSON).build();
+    }
+}

fineract-provider/src/main/java/org/apache/fineract/infrastructure/jobs/api/InlineJobApiResource.java

@@ -45,7 +45,7 @@ import org.springframework.stereotype.Component;
 @Component
 @Tag(name = "Inline Job", description = "")
 @RequiredArgsConstructor
-public class InlineJobResource {
+public class InlineJobApiResource {
 
     private final PortfolioCommandSourceWritePlatformService commandWritePlatformService;
     private final DefaultToApiJsonSerializer<LoanIdsResponseDTO> serializer;
@@ -57,7 +57,8 @@ public class InlineJobResource {
     @Operation(summary = "Starts an inline Job", description = "Starts an inline Job")
     @RequestBody(content = @Content(schema = @Schema(implementation = InlineJobResourceSwagger.InlineJobRequest.class)))
     @ApiResponses({
-            @ApiResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = InlineJobResourceSwagger.InlineJobResponse.class))) })
+            @ApiResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = InlineJobResourceSwagger.InlineJobResponse.class))),
+            @ApiResponse(responseCode = "400", description = "Request body item size validation error") })
     public String executeInlineJob(@PathParam("jobName") @Parameter(description = "jobName") final String jobName,
             @Parameter(hidden = true) final String jsonRequestBody) {
 

fineract-provider/src/main/resources/application.properties

@@ -44,6 +44,8 @@ fineract.mode.batch-manager-enabled=${FINERACT_MODE_BATCH_MANAGER_ENABLED:true}
 
 fineract.query.in-clause-parameter-size-limit=${FINERACT_QUERY_PARAMETER_SIZE:1000}
 
+fineract.api.body-item-size-limit.inline-loan-cob=${FINERACT_API_REQUEST_BODY_SIZE_LIMIT_INLINE_COB:1000}
+
 fineract.correlation.enabled=${FINERACT_LOGGING_HTTP_CORRELATION_ID_ENABLED:false}
 fineract.correlation.header-name=${FINERACT_LOGGING_HTTP_CORRELATION_ID_HEADER_NAME:X-Correlation-ID}