Merge remote-tracking branch 'origin/main' into feat/tech-hardening-29-12-checkstatusresponse-naming

Author: gpascucci

backend/openshift.deploy.yml

@@ -137,6 +137,11 @@ objects:
                   value: "true"
                 - name: ILCR_DATASOURCE_ENABLED
                   value: ${ILCR_DATASOURCE_ENABLED}
+                # Story 29.2 — point the Jasper report virtualizer's swap file at the dedicated
+                # DISK-backed ephemeral volume below, NOT java.io.tmpdir (/tmp here is a Memory-backed
+                # emptyDir, so spilling there would stay in RAM and defeat the heap relief).
+                - name: ILCR_REPORTING_SWAP_DIR
+                  value: /var/tmp/report-swap
                 - name: ORACLEDB_HOST
                   valueFrom:
                     secretKeyRef:
@@ -182,9 +187,13 @@ objects:
                 requests:
                   cpu: ${CPU_REQUEST}
                   memory: ${MEMORY_REQUEST}
-                  ephemeral-storage: "200Mi"
+                  ephemeral-storage: "256Mi"
                 limits:
                   memory: ${MEMORY_LIMIT}
+                  # Bound total ephemeral (node) storage: base image scratch + the 512Mi report-swap
+                  # volume below (Story 29.2). A print that would exceed this is evicted — a bounded,
+                  # observable failure — rather than filling node disk.
+                  ephemeral-storage: "1Gi"
               securityContext:
                 allowPrivilegeEscalation: false
                 runAsNonRoot: true
@@ -196,6 +205,8 @@ objects:
               volumeMounts:
                 - name: tmp
                   mountPath: /tmp
+                - name: report-swap
+                  mountPath: /var/tmp/report-swap
                 - name: api-cert
                   mountPath: /cert
               startupProbe:
@@ -221,6 +232,15 @@ objects:
               emptyDir:
                 medium: Memory
                 sizeLimit: 256Mi
+            # Story 29.2 — dedicated DISK-backed ephemeral volume for the Jasper report swap file.
+            # Deliberately NOT medium: Memory (unlike /tmp above): spilling large report page objects
+            # here relieves the JVM heap onto node ephemeral storage instead of RAM, which is the whole
+            # point of the virtualizer. Bounded by sizeLimit so a runaway print is evicted (a bounded,
+            # observable failure) rather than silently consuming node disk. Writable despite the
+            # read-only root filesystem because it is a mounted volume.
+            - name: report-swap
+              emptyDir:
+                sizeLimit: 512Mi
             # Oracle keystore written by the init container, read by the app
             - name: api-cert
               persistentVolumeClaim:

backend/src/main/java/ca/bc/gov/nrs/ilcr/configuration/SecurityConfiguration.java

@@ -36,6 +36,18 @@ public SecurityFilterChain securityFilterChain(
     ) throws Exception {
         http
                 .csrf(AbstractHttpConfigurer::disable)
+                // No .cors(...) is configured, and that omission is a DELIBERATE, documented decision
+                // (Story 29.14) — not an oversight. The browser talks to ONE origin: the Caddy edge
+                // (frontend/Caddyfile) serves the SPA and reverse-proxies /api* to this backend, so the
+                // SPA calls the API same-origin and no cross-origin browser request ever reaches it.
+                // Combined with the stateless bearer-JWT model — no ambient cookie the browser would
+                // attach cross-site, the same reasoning as the CSRF note above — the SAFE default for
+                // this threat model is NO CORS. There is deliberately no allowedOrigins("*")/
+                // allowCredentials surface here to get wrong. If the SPA is ever served from a DIFFERENT
+                // origin, terminate CORS at the gateway/Caddy route (preferred); only if the gateway
+                // cannot own it, add a tightly-scoped CorsConfigurationSource (named origin(s), explicit
+                // methods/headers, credentials only if actually needed) wired via http.cors(...) HERE —
+                // never a permissive wildcard, and never "*" combined with credentials.
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .exceptionHandling(exceptions -> exceptions
                         .authenticationEntryPoint((request, response, exception) ->

backend/src/main/java/ca/bc/gov/nrs/ilcr/reporting/PrintService.java

@@ -9,6 +9,7 @@
 import java.util.List;
 import java.util.function.Predicate;
 import net.sf.jasperreports.engine.JasperPrint;
+import net.sf.jasperreports.engine.fill.JRSwapFileVirtualizer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -37,26 +38,29 @@ public class PrintService {
 
   private final ReportService reportService;
   private final MillContextService millContextService;
+  private final ReportVirtualizerFactory virtualizerFactory;
 
-  public PrintService(ReportService reportService, MillContextService millContextService) {
+  public PrintService(ReportService reportService, MillContextService millContextService,
+      ReportVirtualizerFactory virtualizerFactory) {
     this.reportService = reportService;
     this.millContextService = millContextService;
+    this.virtualizerFactory = virtualizerFactory;
   }
 
   /**
    * Render the combined Print Schedules PDF for the validated context and selection.
    *
    * @param context the validated (millId, year) pair
    * @param request the print selection (schedule flags + "all" + print options)
-   * @return the combined, bookmarked PDF bytes
+   * @return the filled report, ready to stream to the response (the caller closes it after export)
    * @throws ScheduleNotFoundException 404 — no selected in-scope schedule has any data (ERR-005)
    */
   // Deliberately NOT @Transactional: this is six independent read-only reads, each *Service.getScheduleN
   // managing its own transaction and the Schedule 9 fill borrowing (and releasing) its own connection. A
   // method-wide readOnly transaction would pin ONE pooled connection for the whole render while the
   // Schedule 9 fill grabs a SECOND — two connections per /print on a maximum-pool-size of 5, so a handful
   // of concurrent prints would exhaust the pool and block until the 30s timeout.
-  public byte[] render(MillYearContext context, PrintRequest request) {
+  public RenderedReport render(MillYearContext context, PrintRequest request) {
     PrintOptions options =
         new PrintOptions(request.printScheduleInformation(), request.printComments());
     Predicate<ScheduleKey> selected = selectionOf(request);
@@ -65,6 +69,7 @@ public byte[] render(MillYearContext context, PrintRequest request) {
       // The ONLY requested content is the deferred Mill Information report — no in-scope schedule
       // and no content option. That yields no PDF for a reason unrelated to missing schedule data,
       // so surface the honest "not yet available" rather than the misleading "Schedule not found.".
+      // Thrown before a virtualizer is created, so nothing to clean up.
       log.info("Mill-information-report-only selection for mill {} year {} — report not yet available",
           context.millId(), context.year());
       throw new MillInformationReportUnavailableException();
@@ -74,33 +79,48 @@ public byte[] render(MillYearContext context, PrintRequest request) {
     // instead of re-querying it for each of the five bean sections.
     String millTitleBlock = millContextService.resolveMillTitleBlock(context.millId());
 
-    List<JasperPrint> sections = new ArrayList<>();
-    for (ScheduleKey key : ScheduleKey.values()) {
-      if (!selected.test(key)) {
-        continue;
+    // One virtualizer for the whole combined fill (Story 29.2): every section's page objects spill to
+    // the SAME swap file, so an "all schedules" print never pins the full section graph on the heap.
+    JRSwapFileVirtualizer virtualizer = virtualizerFactory.create();
+    boolean ownershipTransferred = false;
+    try {
+      List<JasperPrint> sections = new ArrayList<>();
+      for (ScheduleKey key : ScheduleKey.values()) {
+        if (!selected.test(key)) {
+          continue;
+        }
+        // BR-08: pass the section's bookmark title so its template renders the top-level PDF outline
+        // anchor. Every rendered schedule gets exactly one bookmark, including a single-schedule print.
+        JasperPrint print = reportService.fillSection(
+            key, context.millId(), context.year(), options, millTitleBlock, key.bookmarkTitle(),
+            virtualizer);
+        if (print == null) {
+          // BR-09 skip-empty: a selected schedule with no data contributes nothing and never aborts.
+          log.info("Skipping {} for mill {} year {} — no data",
+              key, context.millId(), context.year());
+          continue;
+        }
+        sections.add(print);
       }
-      // BR-08: pass the section's bookmark title so its template renders the top-level PDF outline
-      // anchor. Every rendered schedule gets exactly one bookmark, including a single-schedule print.
-      JasperPrint print = reportService.fillSection(
-          key, context.millId(), context.year(), options, millTitleBlock, key.bookmarkTitle());
-      if (print == null) {
-        // BR-09 skip-empty: a selected schedule with no data contributes nothing and never aborts.
-        log.info("Skipping {} for mill {} year {} — no data",
-            key, context.millId(), context.year());
-        continue;
-      }
-      sections.add(print);
-    }
 
-    logUnimplementedSelections(request);
+      logUnimplementedSelections(request);
 
-    if (sections.isEmpty()) {
-      // All-empty (S11): no selected content produced any section → no PDF, 404 ERR-005.
-      throw new ScheduleNotFoundException();
+      if (sections.isEmpty()) {
+        // All-empty (S11): no selected content produced any section → no PDF, 404 ERR-005.
+        throw new ScheduleNotFoundException();
+      }
+      log.info("Combining {} section(s) into one PDF for mill {} year {}",
+          sections.size(), context.millId(), context.year());
+      RenderedReport report = new RenderedReport(sections, virtualizer);
+      ownershipTransferred = true;
+      return report;
+    } finally {
+      // All-empty (404) or a fill failure produces no PDF, so clean the swap file here; otherwise
+      // ownership passes to the RenderedReport, which the streaming caller closes after export.
+      if (!ownershipTransferred) {
+        virtualizer.cleanup();
+      }
     }
-    log.info("Combining {} section(s) into one PDF for mill {} year {}",
-        sections.size(), context.millId(), context.year());
-    return reportService.exportPdf(sections);
   }
 
   /**

backend/src/main/java/ca/bc/gov/nrs/ilcr/reporting/RenderedReport.java

@@ -0,0 +1,72 @@
+package ca.bc.gov.nrs.ilcr.reporting;
+
+import java.io.OutputStream;
+import java.util.List;
+import net.sf.jasperreports.engine.JRException;
+import net.sf.jasperreports.engine.JasperPrint;
+import net.sf.jasperreports.engine.fill.JRSwapFileVirtualizer;
+import net.sf.jasperreports.export.SimpleExporterInput;
+import net.sf.jasperreports.export.SimpleOutputStreamExporterOutput;
+import net.sf.jasperreports.pdf.JRPdfExporter;
+
+/**
+ * One filled report ready to export (Story 29.2): the filled sections plus the {@link
+ * JRSwapFileVirtualizer} their fill spilled to. {@link #writeTo(OutputStream)} exports the sections
+ * straight to a caller-supplied stream — the servlet output stream — so the PDF is never accumulated
+ * as a {@code byte[]} on the heap; {@link #close()} disposes the virtualizer's swap file.
+ *
+ * <p>AutoCloseable so the streaming caller (the controller's {@code StreamingResponseBody}) cleans up
+ * on BOTH success and failure: a render that throws mid-export must not leak a swap file. The fill
+ * that produced these sections has already happened (and may have thrown the empty-schedule 404)
+ * BEFORE this holder exists, so streaming and virtualization stay pure transport/memory concerns and
+ * never move a business outcome after the response is committed.
+ */
+class RenderedReport implements AutoCloseable {
+
+  private final List<JasperPrint> sections;
+  private final JRSwapFileVirtualizer virtualizer;
+
+  RenderedReport(List<JasperPrint> sections, JRSwapFileVirtualizer virtualizer) {
+    this.sections = sections;
+    this.virtualizer = virtualizer;
+  }
+
+  /**
+   * Export the filled sections to ONE PDF written directly to {@code out} (BR-08). Each section's
+   * top-level bookmark is an in-template outline ANCHOR keyed to its {@code bookmarkTitle} fill
+   * parameter, NOT JasperReports' batch-mode document bookmarks: the latter only emit a bookmark
+   * when the export batch holds MORE THAN ONE JasperPrint (JRPdfExporter gates {@code
+   * addBookmark(getName())} on {@code items.size() > 1}), so a single-schedule {@code /print} would
+   * silently get an empty outline. The anchor renders one bookmark per section for a single-section
+   * PDF just as for a combined one; the caller gates it by passing a null bookmark title (the
+   * standalone Schedule 9 path) to suppress the anchor.
+   *
+   * <p>Streams rather than buffers: the exporter output wraps {@code out} directly, so a big "all
+   * schedules" print never pins the whole PDF as a {@code byte[]} on the JVM heap. {@link
+   * SimpleOutputStreamExporterOutput} does not own {@code out} (it did not open it), so it leaves the
+   * servlet stream for the container to close.
+   */
+  void writeTo(OutputStream out) {
+    JRPdfExporter exporter = new JRPdfExporter();
+    exporter.setExporterInput(SimpleExporterInput.getInstance(sections));
+    exporter.setExporterOutput(new SimpleOutputStreamExporterOutput(out));
+    try {
+      exporter.exportReport();
+    } catch (JRException e) {
+      throw new ReportGenerationException("Failed to export the combined report to PDF", e);
+    }
+  }
+
+  /**
+   * Dispose the virtualizer, deleting its swap file. The streaming caller wraps this in
+   * try-with-resources, so it runs on both the success and error paths and a swap file is never
+   * leaked. The virtualizer owns its swap file (swapOwner=true in {@link ReportVirtualizerFactory}),
+   * so {@code cleanup()} removes the on-disk file, not just the in-memory page cache.
+   */
+  @Override
+  public void close() {
+    if (virtualizer != null) {
+      virtualizer.cleanup();
+    }
+  }
+}

backend/src/main/java/ca/bc/gov/nrs/ilcr/reporting/ReportController.java

@@ -4,13 +4,16 @@
 import ca.bc.gov.nrs.ilcr.millcontext.MillContextService.MillYearContext;
 import ca.bc.gov.nrs.ilcr.reporting.api.PrintRequest;
 import ca.bc.gov.nrs.ilcr.reporting.api.ReportApi;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBody;
 
 /**
  * Print Schedule PDF endpoints (Epic 20). Authorizes by naming the action (AD-7) — {@code
@@ -28,6 +31,8 @@
 @ConditionalOnProperty(name = "ilcr.datasource.enabled", havingValue = "true")
 public class ReportController implements ReportApi {
 
+  private static final Logger log = LoggerFactory.getLogger(ReportController.class);
+
   private final MillContextService millContextService;
   private final ReportService reportService;
   private final PrintService printService;
@@ -43,29 +48,56 @@ public ReportController(
 
   @Override
   @PreAuthorize("@permissions.hasPermission(authentication, 'VIEW_SCHEDULE')")
-  public ResponseEntity<byte[]> getSchedule9Pdf(
+  public ResponseEntity<StreamingResponseBody> getSchedule9Pdf(
       String millId, String year, Authentication authentication) {
     MillYearContext context = millContextService.validateMillYearActive(millId, year);
-    byte[] pdf = reportService.renderSchedule9Pdf(context.millId(), context.year());
+    // Fill synchronously (may throw the empty-schedule 404) BEFORE the response is built; only the
+    // export streams, so a rejected render still produces a problem+json error, never a half-written PDF.
+    RenderedReport report = reportService.renderSchedule9(context.millId(), context.year());
     String filename = "schedule9_" + context.millId() + "_" + context.year() + ".pdf";
-    return ResponseEntity.ok()
-        .contentType(MediaType.APPLICATION_PDF)
-        .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + filename + "\"")
-        .body(pdf);
+    return pdfResponse(filename, context.millId(), context.year(), report);
   }
 
   @Override
   @PreAuthorize("@permissions.hasPermission(authentication, 'VIEW_SCHEDULE')")
-  public ResponseEntity<byte[]> printSchedules(
+  public ResponseEntity<StreamingResponseBody> printSchedules(
       String millId, String year, PrintRequest request, Authentication authentication) {
     // Guard order: mill/year context first (400/404/409), THEN the selection ladder before any fill.
     MillYearContext context = millContextService.validateMillYearActive(millId, year);
     validateSelection(request);
-    byte[] pdf = printService.render(context, request);
+    RenderedReport report = printService.render(context, request);
+    return pdfResponse("schedules_print.pdf", context.millId(), context.year(), report);
+  }
+
+  /**
+   * Stream a filled report as an {@code application/pdf} attachment. The {@link StreamingResponseBody}
+   * exports directly to the servlet output stream (no full-PDF {@code byte[]} on the heap, Story 29.2)
+   * and try-with-resources closes the {@link RenderedReport} on both success and failure, so the
+   * virtualizer's swap file is never leaked. The status + headers are set on the ResponseEntity here,
+   * before any byte is written, so the attachment filename and content type are always applied.
+   *
+   * <p>An export failure surfaces DIFFERENTLY from the pre-fill guards: by the time bytes are written
+   * the 200 + {@code application/pdf} headers are already committed, so no {@code @ExceptionHandler}
+   * can turn it into a {@code problem+json} — the client just gets a truncated PDF. It is therefore
+   * logged at ERROR with the mill/year (the only server-side signal ops can correlate with a user's
+   * "the PDF won't open") before being rethrown so the container aborts the response. The async render
+   * runs under {@code spring.mvc.async.request-timeout}; a timeout produces the same truncated shape.
+   */
+  private static ResponseEntity<StreamingResponseBody> pdfResponse(
+      String filename, long millId, int year, RenderedReport report) {
+    StreamingResponseBody body = out -> {
+      try (report) {
+        report.writeTo(out);
+      } catch (RuntimeException e) {
+        log.error("Report export failed after the response was committed for mill {} year {} ({}) — "
+            + "the client received a truncated PDF", millId, year, filename, e);
+        throw e;
+      }
+    };
     return ResponseEntity.ok()
         .contentType(MediaType.APPLICATION_PDF)
-        .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"schedules_print.pdf\"")
-        .body(pdf);
+        .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + filename + "\"")
+        .body(body);
   }
 
   /**