Phase 2 — Backend Modules Phase 2 — Backend Modules Status: ✅ Complete Completion Date: 2026-04-17 Lead: Petter Graff (CodeCraft) Evidence: 20 modules, 22 migrations, 617 tests passing Overview Phase 2 implements 20 backend modules in Kotlin/Ktor, replacing the original Hono/TypeScript prototype. Modules Ported (20) Module Purpose Routes Tests health Health check GET /health 2 auth Phone OTP auth POST /v1/auth/request-otp , POST /v1/auth/verify-otp 12 user User CRUD GET /v1/users/me , PATCH /v1/users/me 8 transactions Transaction history GET /v1/transactions , GET /v1/transactions/{id} 24 recipients Recipient management GET /v1/recipients , POST /v1/recipients , DELETE /v1/recipients/{id} 18 merchants Merchant accounts GET /v1/merchants , POST /v1/merchants/register 10 accounts Linked bank accounts GET /v1/accounts , POST /v1/accounts/link 14 ips NBS IPS integration POST /v1/ips/initiate , GET /v1/ips/status/{id} 22 kyc KYC sessions POST /v1/kyc/start , POST /v1/kyc/upload 16 aml AML flag checks POST /v1/aml/check (internal) 8 disclosure ZZPL disclosure GET /v1/disclosure/statement 4 complaints Complaints handling POST /v1/complaints , GET /v1/complaints/{id} 6 idempotency Idempotency check Middleware (all POST routes) 10 rates Exchange rates GET /v1/rates/{from}/{to} 5 notifications Push/email/SMS POST /v1/notifications/send (internal) 12 audit Audit logging AuditLogger.kt (all sensitive actions) 6 metrics Prometheus metrics GET /metrics 3 webhooks Webhook delivery POST /v1/webhooks/register , POST /v1/webhooks/test 8 cron Scheduled jobs Background tasks (not HTTP) 4 admin Admin panel GET /v1/admin/users , POST /v1/admin/users/{id}/suspend 15 reports Reporting GET /v1/reports/transactions , GET /v1/reports/aml 8 consents User consents GET /v1/consents , POST /v1/consents/accept 6 settings App settings GET /v1/settings , PATCH /v1/settings 4 openapi OpenAPI spec GET /openapi.json 2 withdrawal Withdrawal requests POST /v1/withdrawals , GET /v1/withdrawals/{id} 10 cards Card scaffold GET /v1/cards (stub, Phase 2) 2 disputes Dispute handling POST /v1/disputes , GET /v1/disputes/{id} 8 dataaccess ZZPL data export POST /v1/dataaccess/request , GET /v1/dataaccess/{id} 6 sms SMS sending SmsService.kt (internal, Twilio) 4 flags Feature flags GET /v1/flags 2 Total: 30 modules (20 production, 10 support) Total Tests: 617 (79 test files) Database Migrations (22) Migration Summary V1__init.sql users, phone_verifications, recipients, transactions, nbs_ips_logs, merchants, settings V2__nbs_ips_logs_iso20022.sql Add ISO 20022 fields (xml_request, xml_response) V3__linked_accounts.sql linked_accounts table (bank account linking) V4__transaction_idempotency.sql Add idempotency_key_hash column V5__kyc_sessions.sql kyc_sessions table (document upload, verification status) V6__users_jmbg.sql Add jmbg_encrypted, jmbg_hash columns to users V7__aml_flags.sql aml_flags table (sanctions screening) V8__disclosure_acknowledged.sql Add disclosure_acknowledged_at to users V9__complaints.sql complaints table (user complaints tracking) V10__phone_verifications_max_attempts.sql Add max_attempts column (default 5) V11__audit_log.sql audit_log table (all sensitive actions) V12__data_access_requests.sql data_access_requests table (ZZPL export) V13__recipients_enhanced.sql Add iban, country columns to recipients V14__merchants.sql merchants table enhancements (business_name, pib, qr_hmac_key) V15__exchange_rates.sql exchange_rates table (RSD/EUR/USD) V16__notifications.sql notifications table (push, email, SMS logs) V17__webhook_deliveries.sql webhook_deliveries table (delivery attempts, status) V18__user_consents.sql user_consents table (ZZPL consent tracking) V19__feature_flags.sql feature_flags table (A/B testing, rollout) V20__withdrawal_requests.sql withdrawal_requests table (bank transfer out) V21__cards_scaffold.sql cards table (stub for Phase 2) V22__disputes.sql disputes table (transaction disputes, chargebacks) Total: 22 migrations (570 lines of SQL) Dependency Injection (Koin 4.0.2) File: backend/src/main/kotlin/no/alai/dropsrbija/plugins/DI.kt Pattern: Constructor injection via Koin modules Example: val appModule = module { single { Database.connect(/* HikariCP config */) } single { JwtService(getProperty("JWT_SECRET")) } single { PhoneOtpService(get(), get()) } single { TransactionService(get(), get()) } single { NbsIpsService(get()) } single { AuditLogger(get()) } } fun Application.configureDI() { install(Koin) { slf4jLogger() modules(appModule) } } Services Injected: 28 (all modules) Ktor Plugin Ordering File: backend/src/main/kotlin/no/alai/dropsrbija/Application.kt Order matters (e.g., Database before Routing, Auth before protected routes): fun Application.module() { // 1. Core infrastructure configureEnvGuard() // Fail fast on missing env vars configureDI() // Dependency injection configureDatabase() // PostgreSQL connection // 2. Observability configureOpenTelemetry() // Distributed tracing configureSentry() // Error tracking configureMetrics() // Prometheus metrics // 3. Security configureCORS() // CORS headers configureRateLimit() // Rate limiting (Redis) configureAuthentication() // JWT validation // 4. HTTP configureSerialization() // JSON (kotlinx.serialization) configureStatusPages() // Error handling // 5. Application configureRouting() // All route modules } Test Coverage (52%) JaCoCo Report: Total Coverage: 52% (gate threshold) Unit Tests: 617 passing (79 files) Integration Tests: 11 passing (Testcontainers PostgreSQL) Coverage Gate: ./gradlew jacocoTestCoverageVerification (passes) Why 52% (not 60%)? docker-java issue: Testcontainers hangs on M-series Macs in CI Workaround: Disabled integration tests in CI, unit-only coverage gate Fix pending: docker-java PR (expected Q3 2026) Target: 60% once integration tests re-enabled Decision: D12 (CEO approved 52% gate as temporary) Evidence Matrix Deliverable Evidence Type Status 20 modules File count ( backend/src/main/kotlin/no/alai/dropsrbija/modules/ ) ✅ 30 dirs (20 prod) 22 migrations File count ( backend/src/main/resources/db/migration/ ) ✅ 22 files 617 tests ./gradlew test output ✅ 617 passing 52% coverage JaCoCo report ✅ 52.1% (gate passes) Koin DI DI.kt exists ✅ 28 services injected Plugin ordering Application.kt ✅ Correct order Lead: Petter Graff (CodeCraft) Validation: Angie Jones (Proveo) Commit Range: develop branch