Merge branch 'main' into feat/tech-hardening-29-14-cors-posture

Author: gpascucci

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/Schedule10DocumentAssembler.java

@@ -382,6 +382,8 @@ private Schedule10CodeLists codeLists(
       long millId, int year, Map<Integer, BecClassification> offerableBec) {
     return new Schedule10CodeLists(
         toCodes(repository.findForestRegions(millId, year)),
+        toCodes(repository.findTsaNumbers(millId, year)),
+        toCodes(repository.findSupplyBlocks(millId, year)),
         toCodes(repository.findRoadLifetimes(millId, year)),
         toCodes(repository.findBallastMethods(millId, year)),
         toCodes(repository.findBallastMaterials(millId, year)),

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/Schedule10Repository.java

@@ -317,6 +317,63 @@ OR REL_SOIL_MOIST_RGM_CLS_CODE IN (
       """)
   List<CodeRow> findRsmrClasses(@Param("millId") long millId, @Param("year") int year);
 
+  /**
+   * TSA numbers effective for the reporting year, PLUS any TSA a stored page already references.
+   *
+   * <p>Legacy sourced this control from {@code LookUpCaches.getTsaNumberCodeCache()}
+   * ({@code RoadConstructionReportType.java:378}). Serving it here keeps the entry constrained to
+   * real TSA numbers: the write path validates only the WIDTH of this leg, so without a bounded list
+   * an arbitrary value would persist and then serve a blank Road Group.
+   *
+   * @param millId the mill, used to find referenced codes
+   * @param year the reporting year
+   * @return code/description pairs, ordered by code
+   */
+  @Query("""
+      SELECT TSA_NUMBER AS code, DESCRIPTION AS description
+        FROM THE.TSA_NUMBER_CODE
+       WHERE ((EFFECTIVE_DATE IS NULL
+            OR EFFECTIVE_DATE <= TO_DATE(:year || '-01-01', 'YYYY-MM-DD'))
+         AND (EXPIRY_DATE IS NULL
+           OR EXPIRY_DATE >= TO_DATE(:year || '-01-01', 'YYYY-MM-DD')))
+          OR TSA_NUMBER IN (
+             SELECT r.TSA_NUMBER
+               FROM THE.ROAD_CONSTRUCTION_REPRT r
+              WHERE r.ILCR_MILL_ID = :millId
+                AND r.REPORT_YEAR = :year
+                AND r.ILCR_CATEGORY_ID = '10')
+       ORDER BY TSA_NUMBER
+      """)
+  List<CodeRow> findTsaNumbers(@Param("millId") long millId, @Param("year") int year);
+
+  /**
+   * Supply block codes effective for the reporting year, PLUS any block a stored page references.
+   *
+   * <p>Legacy narrowed this list to blocks whose code starts with the chosen TSA
+   * ({@code RoadConstructionReportType.java:428-434}); the full list is served and that narrowing is
+   * left to the control, which is where the chosen TSA lives.
+   *
+   * @param millId the mill, used to find referenced codes
+   * @param year the reporting year
+   * @return code/description pairs, ordered by code
+   */
+  @Query("""
+      SELECT TSB_NUMBER_CODE AS code, DESCRIPTION AS description
+        FROM THE.TSB_NUMBER_CODE
+       WHERE ((EFFECTIVE_DATE IS NULL
+            OR EFFECTIVE_DATE <= TO_DATE(:year || '-01-01', 'YYYY-MM-DD'))
+         AND (EXPIRY_DATE IS NULL
+           OR EXPIRY_DATE >= TO_DATE(:year || '-01-01', 'YYYY-MM-DD')))
+          OR TSB_NUMBER_CODE IN (
+             SELECT r.TSB_NUMBER_CODE
+               FROM THE.ROAD_CONSTRUCTION_REPRT r
+              WHERE r.ILCR_MILL_ID = :millId
+                AND r.REPORT_YEAR = :year
+                AND r.ILCR_CATEGORY_ID = '10')
+       ORDER BY TSB_NUMBER_CODE
+      """)
+  List<CodeRow> findSupplyBlocks(@Param("millId") long millId, @Param("year") int year);
+
   /**
    * The BEC classifications a Schedule 10 road detail may reference.
    *

backend/src/main/java/ca/bc/gov/nrs/ilcr/schedule10/dto/Schedule10CodeLists.java

@@ -20,6 +20,8 @@
  * fields, which also eliminates BR-06's runtime filtering of those two lists.
  *
  * @param forestRegions the forest region codes
+ * @param tsaNumbers the TSA numbers offered by the location control
+ * @param supplyBlocks the supply block codes; the control narrows these to the chosen TSA
  * @param roadLifetimes the Road Type codes
  * @param ballastMethods the ballast method codes
  * @param ballastMaterials the ballast material codes
@@ -29,6 +31,8 @@
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public record Schedule10CodeLists(
     List<CodeDescriptionDto> forestRegions,
+    List<CodeDescriptionDto> tsaNumbers,
+    List<CodeDescriptionDto> supplyBlocks,
     List<CodeDescriptionDto> roadLifetimes,
     List<CodeDescriptionDto> ballastMethods,
     List<CodeDescriptionDto> ballastMaterials,

backend/src/test/java/ca/bc/gov/nrs/ilcr/schedule10/Schedule10DocumentIT.java

@@ -1,5 +1,6 @@
 package ca.bc.gov.nrs.ilcr.schedule10;
 
+import static org.hamcrest.Matchers.contains;
 import static org.hamcrest.Matchers.hasItem;
 import static org.hamcrest.Matchers.hasSize;
 import static org.hamcrest.Matchers.is;
@@ -329,6 +330,76 @@ void codeLists_areYearFilteredAndOmitRemovedFields() throws Exception {
         .andExpect(jsonPath("$.codeLists.soilMoistureCodes").doesNotExist());
   }
 
+  @Test
+  @DisplayName("the TSA and supply-block lists are served, year-filtered, and not transposed")
+  void tsaAndSupplyBlockLists_areServedAndYearFiltered() throws Exception {
+    // Both lists shipped with NO coverage at all: deleting either @Query body, or swapping the two
+    // toCodes(...) arguments in the assembler -- they are both List<CodeDescriptionDto>, so it
+    // compiles -- left the suite green. Each assertion below fails under one of those mutations.
+    mockMvc.perform(get(ENDPOINT).param("millId", "710").param("year", "2021")
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isOk())
+        // Present and populated, so deleting a @Query body reds this.
+        .andExpect(jsonPath("$.codeLists.tsaNumbers").isArray())
+        .andExpect(jsonPath("$.codeLists.supplyBlocks").isArray())
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '01')]", hasSize(1)))
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '16')]", hasSize(1)))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '01A')]", hasSize(1)))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '16G')]", hasSize(1)))
+        // The descriptions are what the control DISPLAYS, so they are part of the contract.
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '01')].description",
+            contains("Arrow TSA")))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '01A')].description",
+            contains("Arrow TSA Block A")))
+        // TRANSPOSITION GUARD: a TSA code must never appear in the block list, or the reverse. A
+        // swap of the two assembler arguments compiles and is caught only here.
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '01A')]", hasSize(0)))
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '16G')]", hasSize(0)))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '01')]", hasSize(0)))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '16')]", hasSize(0)))
+        // V20260821 seeds '90','Retired TSA' expiring 2010-12-31 stating it exists "to pin that the
+        // year filter drops a code". Nothing pinned it until now: no stored 2021 page references
+        // '90', so neither leg of the predicate can rescue it.
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '90')]", hasSize(0)));
+  }
+
+  @Test
+  @DisplayName("an expired block a stored page references is rescued by the referenced-union leg")
+  void supplyBlocks_referencedUnionRescuesAnExpiredCode() throws Exception {
+    // The union leg on both queries had NO coverage: it can only rescue a code that HAS a row and
+    // fell outside the date window, and no fixture created that shape until V20260821 was corrected
+    // to seed '16Z' expired (see that file's CORRECTED note). Page 8904 references it, on mill 712.
+    mockMvc.perform(get(ENDPOINT).param("millId", "712").param("year", "2021")
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isOk())
+        // Drop the `OR TSB_NUMBER_CODE IN (...)` leg and this goes to 0.
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '16Z')]", hasSize(1)));
+
+    // Scoped to the MILL and the YEAR: mill 710 references no such block, so the expired code stays
+    // dropped there. Remove the date predicate and this goes to 1.
+    mockMvc.perform(get(ENDPOINT).param("millId", "710").param("year", "2021")
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isOk())
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '16Z')]", hasSize(0)));
+  }
+
+  @Test
+  @DisplayName("a code absent from its table entirely is not served, however many pages reference it")
+  void codeLists_cannotServeACodeWithNoRow() throws Exception {
+    // Page 8903 (mill 712) stores TSA '99' / TSB '99A', neither of which has a row in its code table.
+    // The union leg selects FROM the code table, so it cannot invent one. This is the contract
+    // boundary that makes the FRONTEND synthesise a stored code as its own option (review H2) — pinned
+    // here so nobody "fixes" the client by pointing at a backend guarantee that does not exist.
+    mockMvc.perform(get(ENDPOINT).param("millId", "712").param("year", "2021")
+            .accept(MediaType.APPLICATION_JSON))
+        .andExpect(status().isOk())
+        .andExpect(jsonPath("$.codeLists.tsaNumbers[?(@.code == '99')]", hasSize(0)))
+        .andExpect(jsonPath("$.codeLists.supplyBlocks[?(@.code == '99A')]", hasSize(0)))
+        // The page itself still lists, carrying its stored location verbatim.
+        .andExpect(jsonPath("$.pages[?(@.pageId == 8903)].tsaNumber", contains("99")))
+        .andExpect(jsonPath("$.pages[?(@.pageId == 8903)].tsbNumberCode", contains("99A")));
+  }
+
   @Test
   @DisplayName("BEC is served structurally, gated by the surviving BR-06 xref (deviation (e))")
   void becIsStructuralAndXrefGated() throws Exception {

backend/src/test/resources/db/V20260821__tsa_tsb_code_table_dates_and_seeds.sql

@@ -0,0 +1,61 @@
+-- TSA / TSB code tables: bring the test snapshot up to the delivery shape and seed the Schedule 10
+-- location options.
+--
+-- THE.TSA_NUMBER_CODE and THE.TSB_NUMBER_CODE were created by the Schedule 8 snapshot (V22:92-93) as
+-- code + DESCRIPTION only. Delivery carries the standard code-table quartet -- DESCRIPTION plus
+-- EFFECTIVE_DATE / EXPIRY_DATE / UPDATE_TIMESTAMP -- because both entities extend AbstractILCRCode
+-- and legacy year-filters every code cache on EFFECTIVE_DATE <= 1-Jan-{year} <= EXPIRY_DATE
+-- (LookupCache.java:77-98). Serving these two as Schedule 10 dropdown lists is the first consumer
+-- that reads the dates, so the understatement surfaces here.
+--
+-- Columns are added with DEFAULTs so the rows V22 already seeded are backfilled in place; NOT NULL
+-- then matches delivery, and an insert that skips a date fails here exactly as it would there.
+
+ALTER TABLE THE.TSA_NUMBER_CODE ADD (
+  EFFECTIVE_DATE   DATE DEFAULT DATE '1900-01-01' NOT NULL,
+  EXPIRY_DATE      DATE DEFAULT DATE '9999-12-31' NOT NULL,
+  UPDATE_TIMESTAMP DATE DEFAULT SYSDATE           NOT NULL
+);
+
+ALTER TABLE THE.TSB_NUMBER_CODE ADD (
+  EFFECTIVE_DATE   DATE DEFAULT DATE '1900-01-01' NOT NULL,
+  EXPIRY_DATE      DATE DEFAULT DATE '9999-12-31' NOT NULL,
+  UPDATE_TIMESTAMP DATE DEFAULT SYSDATE           NOT NULL
+);
+
+-- The TSA numbers and supply blocks the Schedule 10 read fixtures store on their pages, so each
+-- stored location resolves to an option in its own dropdown.
+--
+-- '99'/'99A' are deliberately NOT seeded: they are the unmapped-TSA fixtures, and a code with no row
+-- at all is a real delivery state the dropdown has to survive.
+--
+-- CORRECTED 2026-08-20 (code review H5): this block previously left '16Z' unseeded too, on the stated
+-- grounds that doing so kept it "representative of the legacy rows that motivated the referenced-union
+-- leg". That is backwards. The union leg reads
+--   SELECT ... FROM THE.TSB_NUMBER_CODE WHERE <date window> OR TSB_NUMBER_CODE IN (<referenced>)
+-- so it can only rescue a code that HAS a row and fell outside the date window. A code absent from the
+-- table can never be selected by it, however many pages reference it — so the unseeded fixtures
+-- exercised nothing, and the leg had no coverage on either list. '16Z' is now seeded EXPIRED and is
+-- referenced by page 8904 (mill 712), which is the one shape that does exercise it.
+--
+-- A code that is absent ENTIRELY still cannot be served, which is why the FRONTEND synthesises the
+-- stored code as its own option (review H2) rather than relying on the backend for it.
+INSERT INTO THE.TSA_NUMBER_CODE (TSA_NUMBER, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('01', 'Arrow TSA', DATE '1900-01-01', DATE '9999-12-31', SYSDATE);
+INSERT INTO THE.TSA_NUMBER_CODE (TSA_NUMBER, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('16', 'Lakes TSA', DATE '1900-01-01', DATE '9999-12-31', SYSDATE);
+
+-- An expired TSA, to pin that the year filter drops a code no stored page references.
+INSERT INTO THE.TSA_NUMBER_CODE (TSA_NUMBER, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('90', 'Retired TSA', DATE '1900-01-01', DATE '2010-12-31', SYSDATE);
+
+INSERT INTO THE.TSB_NUMBER_CODE (TSB_NUMBER_CODE, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('01A', 'Arrow TSA Block A', DATE '1900-01-01', DATE '9999-12-31', SYSDATE);
+INSERT INTO THE.TSB_NUMBER_CODE (TSB_NUMBER_CODE, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('16G', 'Lakes TSA Block G', DATE '1900-01-01', DATE '9999-12-31', SYSDATE);
+
+-- An EXPIRED block that page 8904 (mill 712) still references: the only fixture that makes the
+-- referenced-union leg falsifiable. Out of the date window, so the date predicate alone drops it; in
+-- the referenced set for mill 712, so the union leg brings it back for that mill and no other.
+INSERT INTO THE.TSB_NUMBER_CODE (TSB_NUMBER_CODE, DESCRIPTION, EFFECTIVE_DATE, EXPIRY_DATE, UPDATE_TIMESTAMP)
+  VALUES ('16Z', 'Lakes TSA Block Z (retired)', DATE '1900-01-01', DATE '2010-12-31', SYSDATE);

frontend/src/components/core/CodeComboBox.tsx

@@ -7,6 +7,16 @@ export interface ComboOption {
   readonly description: string
 }
 
+/**
+ * How typed text is matched against an option's description.
+ *
+ * `substring` is the historical behaviour every caller had before this prop existed and stays the
+ * default, so Schedules 2, 4 and 8 filter exactly as they always have. `prefix` is opt-in for the
+ * controls whose AC specifies it — Schedule 10's BEC Zone (AC5), where typing `SBS` must offer the
+ * `SBS*` zones and not every zone containing those letters.
+ */
+export type ComboMatchMode = 'substring' | 'prefix'
+
 interface CodeComboBoxProps {
   id: string
   titleText: string
@@ -16,6 +26,8 @@ interface CodeComboBoxProps {
   selectedCode: string
   /** Called with the chosen option's code ('' when cleared). */
   onSelect: (code: string) => void
+  /** Defaults to `substring`, the behaviour every pre-existing caller relies on. */
+  matchMode?: ComboMatchMode
   disabled?: boolean
   invalid?: boolean
   invalidText?: string
@@ -34,12 +46,18 @@ const CodeComboBox: FC<CodeComboBoxProps> = ({
   items,
   selectedCode,
   onSelect,
+  matchMode = 'substring',
   disabled,
   invalid,
   invalidText,
   className,
 }) => {
   const selectedItem = items.find((option) => option.code === selectedCode) ?? null
+  const matches = (description: string, typed: string): boolean => {
+    const haystack = description.toLowerCase()
+    const needle = typed.toLowerCase()
+    return matchMode === 'prefix' ? haystack.startsWith(needle) : haystack.includes(needle)
+  }
   return (
     <ComboBox<ComboOption>
       id={id}
@@ -49,14 +67,15 @@ const CodeComboBox: FC<CodeComboBoxProps> = ({
       items={items}
       itemToString={(item) => item?.description ?? ''}
       selectedItem={selectedItem}
-      // Autocomplete: typing filters the list by a case-insensitive match on the description. Show the
-      // whole list when nothing is typed OR when the input still equals the current selection (menu
-      // just opened) — otherwise a selected value would filter the list down to itself and hide the
-      // other options. Explicit so filtering doesn't depend on the Carbon default.
+      // Autocomplete: typing filters the list by a case-insensitive match on the description, of the
+      // kind `matchMode` names. Show the whole list when nothing is typed OR when the input still
+      // equals the current selection (menu just opened) — otherwise a selected value would filter the
+      // list down to itself and hide the other options. Explicit so filtering doesn't depend on the
+      // Carbon default.
       shouldFilterItem={({ item, inputValue }) =>
         !inputValue ||
         inputValue === selectedItem?.description ||
-        (item?.description ?? '').toLowerCase().includes(inputValue.toLowerCase())
+        matches(item?.description ?? '', inputValue)
       }
       disabled={disabled}
       invalid={invalid}