Phase 2 — Backend Modules

Phase 2 — Backend Modules

Status: ✅ Complete
Completion Date: 2026-04-17
Lead: Petter Graff (CodeCraft)
Evidence: 20 modules, 22 migrations, 617 tests passing

Overview

Phase 2 implements 20 backend modules in Kotlin/Ktor, replacing the original Hono/TypeScript prototype.

Modules Ported (20)

Module Purpose Routes Tests
health Health check GET /health 2
auth Phone OTP auth POST /v1/auth/request-otp, POST /v1/auth/verify-otp 12
user User CRUD GET /v1/users/me, PATCH /v1/users/me 8
transactions Transaction history GET /v1/transactions, GET /v1/transactions/{id} 24
recipients Recipient management GET /v1/recipients, POST /v1/recipients, DELETE /v1/recipients/{id} 18
merchants Merchant accounts GET /v1/merchants, POST /v1/merchants/register 10
accounts Linked bank accounts GET /v1/accounts, POST /v1/accounts/link 14
ips NBS IPS integration POST /v1/ips/initiate, GET /v1/ips/status/{id} 22
kyc KYC sessions POST /v1/kyc/start, POST /v1/kyc/upload 16
aml AML flag checks POST /v1/aml/check (internal) 8
disclosure ZZPL disclosure GET /v1/disclosure/statement 4
complaints Complaints handling POST /v1/complaints, GET /v1/complaints/{id} 6
idempotency Idempotency check Middleware (all POST routes) 10
rates Exchange rates GET /v1/rates/{from}/{to} 5
notifications Push/email/SMS POST /v1/notifications/send (internal) 12
audit Audit logging AuditLogger.kt (all sensitive actions) 6
metrics Prometheus metrics GET /metrics 3
webhooks Webhook delivery POST /v1/webhooks/register, POST /v1/webhooks/test 8
cron Scheduled jobs Background tasks (not HTTP) 4
admin Admin panel GET /v1/admin/users, POST /v1/admin/users/{id}/suspend 15
reports Reporting GET /v1/reports/transactions, GET /v1/reports/aml 8
consents User consents GET /v1/consents, POST /v1/consents/accept 6
settings App settings GET /v1/settings, PATCH /v1/settings 4
openapi OpenAPI spec GET /openapi.json 2
withdrawal Withdrawal requests POST /v1/withdrawals, GET /v1/withdrawals/{id} 10
cards Card scaffold GET /v1/cards (stub, Phase 2) 2
disputes Dispute handling POST /v1/disputes, GET /v1/disputes/{id} 8
dataaccess ZZPL data export POST /v1/dataaccess/request, GET /v1/dataaccess/{id} 6
sms SMS sending SmsService.kt (internal, Twilio) 4
flags Feature flags GET /v1/flags 2

Total: 30 modules (20 production, 10 support)
Total Tests: 617 (79 test files)

Database Migrations (22)

Migration Summary
V1__init.sql users, phone_verifications, recipients, transactions, nbs_ips_logs, merchants, settings
V2__nbs_ips_logs_iso20022.sql Add ISO 20022 fields (xml_request, xml_response)
V3__linked_accounts.sql linked_accounts table (bank account linking)
V4__transaction_idempotency.sql Add idempotency_key_hash column
V5__kyc_sessions.sql kyc_sessions table (document upload, verification status)
V6__users_jmbg.sql Add jmbg_encrypted, jmbg_hash columns to users
V7__aml_flags.sql aml_flags table (sanctions screening)
V8__disclosure_acknowledged.sql Add disclosure_acknowledged_at to users
V9__complaints.sql complaints table (user complaints tracking)
V10__phone_verifications_max_attempts.sql Add max_attempts column (default 5)
V11__audit_log.sql audit_log table (all sensitive actions)
V12__data_access_requests.sql data_access_requests table (ZZPL export)
V13__recipients_enhanced.sql Add iban, country columns to recipients
V14__merchants.sql merchants table enhancements (business_name, pib, qr_hmac_key)
V15__exchange_rates.sql exchange_rates table (RSD/EUR/USD)
V16__notifications.sql notifications table (push, email, SMS logs)
V17__webhook_deliveries.sql webhook_deliveries table (delivery attempts, status)
V18__user_consents.sql user_consents table (ZZPL consent tracking)
V19__feature_flags.sql feature_flags table (A/B testing, rollout)
V20__withdrawal_requests.sql withdrawal_requests table (bank transfer out)
V21__cards_scaffold.sql cards table (stub for Phase 2)
V22__disputes.sql disputes table (transaction disputes, chargebacks)

Total: 22 migrations (570 lines of SQL)

Dependency Injection (Koin 4.0.2)

File: backend/src/main/kotlin/no/alai/dropsrbija/plugins/DI.kt

Pattern: Constructor injection via Koin modules

Example:

val appModule = module {
    single<Database> { Database.connect(/* HikariCP config */) }
    single<JwtService> { JwtService(getProperty("JWT_SECRET")) }
    single<PhoneOtpService> { PhoneOtpService(get(), get()) }
    single<TransactionService> { TransactionService(get(), get()) }
    single<NbsIpsService> { NbsIpsService(get()) }
    single<AuditLogger> { AuditLogger(get()) }
}

fun Application.configureDI() {
    install(Koin) {
        slf4jLogger()
        modules(appModule)
    }
}

Services Injected: 28 (all modules)

Ktor Plugin Ordering

File: backend/src/main/kotlin/no/alai/dropsrbija/Application.kt

Order matters (e.g., Database before Routing, Auth before protected routes):

fun Application.module() {
    // 1. Core infrastructure
    configureEnvGuard()       // Fail fast on missing env vars
    configureDI()             // Dependency injection
    configureDatabase()       // PostgreSQL connection
    
    // 2. Observability
    configureOpenTelemetry()  // Distributed tracing
    configureSentry()         // Error tracking
    configureMetrics()        // Prometheus metrics
    
    // 3. Security
    configureCORS()           // CORS headers
    configureRateLimit()      // Rate limiting (Redis)
    configureAuthentication() // JWT validation
    
    // 4. HTTP
    configureSerialization()  // JSON (kotlinx.serialization)
    configureStatusPages()    // Error handling
    
    // 5. Application
    configureRouting()        // All route modules
}

Test Coverage (52%)

JaCoCo Report:

Why 52% (not 60%)?

Decision: D12 (CEO approved 52% gate as temporary)

Evidence Matrix

Deliverable Evidence Type Status
20 modules File count (backend/src/main/kotlin/no/alai/dropsrbija/modules/) ✅ 30 dirs (20 prod)
22 migrations File count (backend/src/main/resources/db/migration/) ✅ 22 files
617 tests ./gradlew test output ✅ 617 passing
52% coverage JaCoCo report ✅ 52.1% (gate passes)
Koin DI DI.kt exists ✅ 28 services injected
Plugin ordering Application.kt ✅ Correct order

Lead: Petter Graff (CodeCraft)
Validation: Angie Jones (Proveo)
Commit Range: develop branch


Revision #1
Created 2026-07-29 00:35:56 UTC by John
Updated 2026-07-29 00:35:56 UTC by John