Skip to content

Conversation

@swatigoel
Copy link

@swatigoel swatigoel commented Jan 21, 2026

Summary by CodeRabbit

Release Notes

  • Chores

    • Project versions bumped to 0.5.0 across all modules.
    • Updated core dependencies to version 0.12.0.
    • Migration to Central Publishing Maven plugin for improved artifact deployment.
  • Bug Fixes

    • Improved credential type validation to accept "VerifiableCredential" in any position within type lists rather than requiring a specific order.
  • Tests

    • Enhanced test coverage with new integration and unit tests for credential issuance, data provider operations, and data transfer objects.

✏️ Tip: You can customize this high-level summary in your review settings.

Piyush7034 and others added 6 commits July 3, 2025 17:17
* [INJICERT-1007] Certify version upgrade (#114)

Signed-off-by: Piyush7034 <[email protected]>

* [MOSIP-41674] central sonatype migration changes (#115)

Signed-off-by: Piyush7034 <[email protected]>

---------

Signed-off-by: Piyush7034 <[email protected]>
Co-authored-by: Praful Rakhade <[email protected]>
* [MOSIP-42464] [MOSIP-41674] central sonatype migration changes

Signed-off-by: Prafulrakhade <[email protected]>

* [MOSIP-42464] [MOSIP-41674] central sonatype migration changes

Signed-off-by: Praful Rakhade <[email protected]>

---------

Signed-off-by: Prafulrakhade <[email protected]>
Signed-off-by: Praful Rakhade <[email protected]>
Co-authored-by: Prafulrakhade <[email protected]>
@swatigoel swatigoel marked this pull request as draft January 21, 2026 09:36
@coderabbitai
Copy link

coderabbitai bot commented Jan 21, 2026

Walkthrough

This pull request migrates artifact publishing infrastructure from Nexus Staging to Maven Central Publishing across multiple modules. It updates project versions from 0.4.0-SNAPSHOT to 0.5.0, replaces the nexus-staging-maven-plugin with central-publishing-maven-plugin, updates repository URLs from oss.sonatype.org to central.sonatype.com, introduces Spring dependency injection for MdocGenerator, adds comprehensive test coverage, and adjusts credential type validation logic from position-based to presence-based checking.

Changes

Cohort / File(s) Summary
GitHub Workflow Configuration
.github/workflows/push-trigger.yml
Swaps OSSRH secret source from OSSRH_SNAPSHOT_URL to OSSRH_CENTRAL_URL across publish steps; no control flow changes.
mock-certify-plugin Build & Dependencies
mock-certify-plugin/pom.xml
Version bump (0.4.0-SNAPSHOT → 0.5.0), nexus-staging-maven-plugin → central-publishing-maven-plugin, repository URLs migrated to central.sonatype.com, certify-core dependency updated (0.11.0-SNAPSHOT → 0.12.0).
mock-certify-plugin Code
mock-certify-plugin/src/main/java/io/mosip/certify/mock/integration/mocks/MdocGenerator.java, mock-certify-plugin/src/main/java/io.mosip.certify.mock.integration/service/MDocMockVCIssuancePlugin.java
MdocGenerator annotated with @Component for Spring injection; MDocMockVCIssuancePlugin uses injected mdocGenerator instead of direct instantiation.
mock-certify-plugin Tests
mock-certify-plugin/src/test/java/io/mosip/certify/mock/integration/service/MDocMockVCIssuancePluginTest.java
New comprehensive test class covering successful VC retrieval, not-implemented paths, individual ID retrieval with flags, decryption error handling, HSM key retrieval, mock data generation, and transaction retrieval via reflection-based testing.
mosip-identity-certify-plugin Build & Dependencies
mosip-identity-certify-plugin/pom.xml
Version bump (0.4.0-SNAPSHOT → 0.5.0), nexus-staging-maven-plugin → central-publishing-maven-plugin, repository URLs migrated to central.sonatype.com, certify-core and certify-integration-api dependencies updated (0.11.0-SNAPSHOT → 0.12.0).
mosip-identity-certify-plugin Tests
mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaAuditPluginImplTest.java, mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaVCIssuancePluginImplTest.java
New test methods validating DTO and wrapper class semantics (getters/setters, all-args constructors, equality, hashCode, toString) for AuditRequest, AuditResponse, IdaVcExchangeRequest, IdaVcExchangeResponse, IdaError, CredentialDefinitionDTO, ClientIdSecretKeyRequest, and IdaResponseWrapper.
postgres-dataprovider-plugin Build & Dependencies
postgres-dataprovider-plugin/pom.xml
Version bump (0.4.0-SNAPSHOT → 0.5.0), nexus-staging-maven-plugin → central-publishing-maven-plugin, repository URLs migrated to central.sonatype.com, certify-core dependency updated (0.11.0-SNAPSHOT → 0.12.0).
postgres-dataprovider-plugin Tests
postgres-dataprovider-plugin/src/test/java/io/mosip/certify/postgresdataprovider/integration/service/PostgresDataProviderPluginTest.java
MockitoException import added; mock behavior changed to throw exception on null query result instead of returning null.
sunbird-rc-certify-integration-impl Build & Dependencies
sunbird-rc-certify-integration-impl/pom.xml
Version bump (0.4.0-SNAPSHOT → 0.5.0), nexus-staging-maven-plugin → central-publishing-maven-plugin, repository URLs migrated to central.sonatype.com, certify-integration-api dependency updated (0.11.0-SNAPSHOT → 0.12.0), test dependencies modified (spring-boot-starter-test → spring-test 6.1.4, junit 4.13.2 added).
sunbird-rc-certify-integration-impl Code & Tests
sunbird-rc-certify-integration-impl/src/main/java/io/mosip/certify/sunbirdrc/integration/service/SunbirdRCVCIssuancePlugin.java, sunbird-rc-certify-integration-impl/src/test/java/io/mosip/certify/sunbirdrc/integration/service/SunbirdRCVCIssuancePluginTest.java
Credential type validation refactored from position-based (first item must be "VerifiableCredential") to presence-based (must contain "VerifiableCredential" anywhere); error message updated accordingly; SpringBootTest annotation removed from test class.
sunbird-rc-esignet-integration-impl Build & Dependencies
sunbird-rc-esignet-integration-impl/pom.xml
Version bump (0.4.0-SNAPSHOT → 0.5.0), nexus-staging-maven-plugin → central-publishing-maven-plugin, repository URLs migrated to central.sonatype.com.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested reviewers

  • ckm007
  • Prafulrakhade

Poem

🐰 Hopping through the artifact chain,
From Nexus staging to Central's domain,
Versions bump up, dependencies align,
Spring components inject, tests divine,
Maven Central awaits, publishing takes flight!

🚥 Pre-merge checks | ✅ 1 | ❌ 2
❌ Failed checks (1 warning, 1 inconclusive)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 4.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check ❓ Inconclusive The PR title is vague and generic, using the phrase '[DRAFT PR] To review missing changes' which does not clearly convey what specific changes are being made. While it mentions '0.5.x', it fails to describe the actual substantive changes across multiple files and modules. Provide a more specific title that describes the primary changes, such as 'Migrate to Central Publishing Maven Plugin and update dependencies to 0.5.0' or 'Update artifact publishing configuration and bump to version 0.5.0'.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Fix all issues with AI agents
In @.github/workflows/push-trigger.yml:
- Around line 45-48: The five publish_to_nexus_* jobs in push-trigger.yml are
using the central repository URL for snapshot builds; update each job's
OSSRH_URL assignment from ${{ secrets.OSSRH_CENTRAL_URL }} to ${{
secrets.OSSRH_SNAPSHOT_URL }} (for the jobs named publish_to_nexus_* referenced
around the OSSRH_USER/OSSRH_SECRET block) so snapshot/development branches
publish to the snapshot endpoint, and confirm OSSRH_SNAPSHOT_URL is present in
the repo/org secrets.

In
`@mock-certify-plugin/src/test/java/io/mosip/certify/mock/integration/service/MDocMockVCIssuancePluginTest.java`:
- Around line 79-87: The test testGetVerifiableCredential_NotImplemented is
hitting a NullPointerException because dto.getFormat() is unstubbed; stub the
mock VCRequestDto (dto) so getFormat() returns a non-MS0_MDOC/other value (e.g.,
a simple string) before calling plugin.getVerifiableCredential(dto, "holderId",
identityDetails) so the code path throws VCIExchangeException as expected;
update the test to mock/stub dto.getFormat() accordingly (reference:
VCRequestDto, dto.getFormat(), testGetVerifiableCredential_NotImplemented,
plugin.getVerifiableCredential, VCIExchangeException).

In
`@mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaAuditPluginImplTest.java`:
- Around line 202-213: The test auditResponse_gettersSetters_allArgsConstructor
is misleading and incomplete: either rename it to reflect the no-args
constructor or actually test the all-args constructor. Update the test to
construct AuditResponse using its all-args constructor (or add a new test for
that constructor), set expected values, and add assertions that verify the
corresponding getters return those values (in addition to existing
equals/hashCode/toString checks) — reference the AuditResponse class and the
test method auditResponse_gettersSetters_allArgsConstructor to locate where to
change.
- Around line 152-153: Remove the stale placeholder comment "Add inside
IdaAuditPluginImplTest" from the test file; locate the comment inside the class
IdaAuditPluginImplTest and delete that leftover instruction so the test class
contains only real test code and comments, and ensure no other autogenerated
placeholder comments remain in the file.

In
`@mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaVCIssuancePluginImplTest.java`:
- Around line 492-509: The ClientIdSecretKeyRequest class is exposing secrets
via its Lombok-generated toString; add the Lombok exclusion on the secret field
by annotating the secretKey field with `@ToString.Exclude` in
ClientIdSecretKeyRequest, and add the import for lombok.ToString (or use the
fully-qualified annotation) so Lombok omits secretKey from toString while
leaving other fields (clientId, appId) unchanged.

In
`@postgres-dataprovider-plugin/src/test/java/io/mosip/certify/postgresdataprovider/integration/service/PostgresDataProviderPluginTest.java`:
- Line 15: In PostgresDataProviderPluginTest replace the use/import of
MockitoException with RuntimeException so the test simulates a real
repository/data-access failure; update the mock that throws MockitoException to
throw new RuntimeException(...) and keep assertions that fetchData() maps
exceptions to DataProviderExchangeException (referencing the
PostgresDataProviderPluginTest class and the fetchData() behavior) to preserve
test intent.
♻️ Duplicate comments (4)
.github/workflows/push-trigger.yml (4)

86-89: Duplicate: verify Central URL compatibility here as well.

Same concern as the earlier publish job: ensure the endpoint and secret are correct for non-release publishing.


127-130: Duplicate: verify Central URL compatibility here as well.

Same concern as the earlier publish job: ensure the endpoint and secret are correct for non-release publishing.


168-171: Duplicate: verify Central URL compatibility here as well.

Same concern as the earlier publish job: ensure the endpoint and secret are correct for non-release publishing.


209-212: Duplicate: verify Central URL compatibility here as well.

Same concern as the earlier publish job: ensure the endpoint and secret are correct for non-release publishing.

🧹 Nitpick comments (5)
mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaAuditPluginImplTest.java (1)

157-161: Consider importing AuditRequest to reduce verbosity.

The fully qualified class name io.mosip.certify.mosipid.integration.dto.AuditRequest is used multiple times. Adding an import would improve readability.

Proposed refactor

Add the import at the top of the file:

import io.mosip.certify.mosipid.integration.dto.AuditRequest;

Then simplify the test:

-        io.mosip.certify.mosipid.integration.dto.AuditRequest req1 = new io.mosip.certify.mosipid.integration.dto.AuditRequest(
+        AuditRequest req1 = new AuditRequest(
                 "eventId", "eventName", "eventType", localDateTime, "hostName", "hostIp",
                 "appId", "appName", "sessionUserId", "sessionUserName", "id", "idType",
                 "createdBy", "moduleName", "moduleId", "desc"
         );
         // ... assertions ...

-        io.mosip.certify.mosipid.integration.dto.AuditRequest req2 = new io.mosip.certify.mosipid.integration.dto.AuditRequest();
+        AuditRequest req2 = new AuditRequest();

Also applies to: 179-179

sunbird-rc-certify-integration-impl/src/main/java/io/mosip/certify/sunbirdrc/integration/service/SunbirdRCVCIssuancePlugin.java (1)

133-139: Avoid mutating the request DTO and remove all VerifiableCredential entries.

vcRequestDto.getType() is mutated in-place. If the list is unmodifiable or reused by the caller, this can break unexpectedly. Also, remove(Object) only removes the first occurrence. Consider a defensive copy plus removeIf.

♻️ Proposed refactor
-        List<String> types = vcRequestDto.getType();
+        List<String> types = new ArrayList<>(vcRequestDto.getType());
         if (types.isEmpty() || !types.contains("VerifiableCredential")) {
             log.error("Invalid request: VerifiableCredential not present in types");
             throw new VCIExchangeException(ErrorConstants.VCI_EXCHANGE_FAILED);
         }
-        types.remove("VerifiableCredential");
+        types.removeIf("VerifiableCredential"::equals);
+        if (types.isEmpty()) {
+            log.error("Invalid request: credential type missing");
+            throw new VCIExchangeException(ErrorConstants.VCI_EXCHANGE_FAILED);
+        }
mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaVCIssuancePluginImplTest.java (1)

45-46: Consider using consistent assertion imports across the test class.

The test class mixes JUnit 4 assertions (org.junit.Assert) with JUnit 5 assertions (org.junit.jupiter.api.Assertions). While both work, it's cleaner to stick with one style. Since the class uses @RunWith(MockitoJUnitRunner.class) (JUnit 4), consider using JUnit 4 assertions throughout for consistency, or migrate the entire class to JUnit 5 with @ExtendWith(MockitoExtension.class).

mock-certify-plugin/src/main/java/io.mosip.certify.mock.integration/service/MDocMockVCIssuancePlugin.java (1)

47-49: Prefer constructor injection for the new dependency.

Field injection works, but constructor injection improves immutability and test setup clarity, especially as dependencies grow.

mock-certify-plugin/src/test/java/io/mosip/certify/mock/integration/service/MDocMockVCIssuancePluginTest.java (1)

119-133: Use KeymanagerConstant.CURRENTKEYALIAS instead of a literal.

This keeps tests aligned with production behavior if the constant ever changes.

♻️ Proposed refactor
@@
-import io.mosip.kernel.keymanagerservice.entity.KeyAlias;
+import io.mosip.kernel.keymanagerservice.entity.KeyAlias;
+import io.mosip.kernel.keymanagerservice.constant.KeymanagerConstant;
@@
-        when(dbHelper.getKeyAliases(anyString(), anyString(), any(LocalDateTime.class)))
-                .thenReturn(Collections.singletonMap("currentKeyAlias", new ArrayList<>()));
+        when(dbHelper.getKeyAliases(anyString(), anyString(), any(LocalDateTime.class)))
+                .thenReturn(Collections.singletonMap(KeymanagerConstant.CURRENTKEYALIAS, new ArrayList<>()));
@@
-        map.put("currentKeyAlias", aliases);
+        map.put(KeymanagerConstant.CURRENTKEYALIAS, aliases);

Comment on lines 45 to 48
OSSRH_USER: ${{ secrets.OSSRH_USER }}
OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }}
OSSRH_URL: ${{ secrets.OSSRH_SNAPSHOT_URL }}
OSSRH_URL: ${{ secrets.OSSRH_CENTRAL_URL }}
OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Read the push-trigger.yml file to understand the context around lines 45-48
cat -n .github/workflows/push-trigger.yml | head -60

Repository: inji/digital-credential-plugins

Length of output: 2618


🏁 Script executed:

# Find and read the maven-publish-to-nexus.yml workflow
find .github -name "*maven*publish*" -o -name "*nexus*" | head -10

Repository: inji/digital-credential-plugins

Length of output: 57


🏁 Script executed:

# Search for OSSRH_CENTRAL_URL and OSSRH_SNAPSHOT_URL references across the repo
rg "OSSRH_(CENTRAL|SNAPSHOT)_URL" --type yaml

Repository: inji/digital-credential-plugins

Length of output: 223


🏁 Script executed:

# Search for secrets definitions and environment variable references
rg "OSSRH_URL" --type yaml -B 2 -A 2

Repository: inji/digital-credential-plugins

Length of output: 223


🏁 Script executed:

# List all workflow files
find .github/workflows -name "*.yml" -o -name "*.yaml" | head -20

Repository: inji/digital-credential-plugins

Length of output: 109


🏁 Script executed:

# Search for OSSRH references without type filter
rg "OSSRH" .github/workflows/ -A 1 -B 1

Repository: inji/digital-credential-plugins

Length of output: 6216


🏁 Script executed:

# Search for snapshot or central URL references
rg "snapshot|central|CENTRAL" .github/workflows/ -i

Repository: inji/digital-credential-plugins

Length of output: 499


🏁 Script executed:

# Check if maven-publish-to-nexus is in this repo or if it's external
ls -la .github/workflows/ | grep -E "nexus|publish"

Repository: inji/digital-credential-plugins

Length of output: 57


🏁 Script executed:

cat -n .github/workflows/push-trigger.yml

Repository: inji/digital-credential-plugins

Length of output: 11372


🏁 Script executed:

# Search for any references to snapshot, staging, or release repositories
rg "snapshot|staging|release|repository" .github/ -i

Repository: inji/digital-credential-plugins

Length of output: 1373


All 5 publish_to_nexus_ jobs use the wrong repository URL for snapshot publishing.*

These jobs explicitly exclude release, prerelease, and publish events and run on branches like develop, 1.*, and MOSIP*—making them snapshot/development builds. Using OSSRH_CENTRAL_URL (Central Publishing) for snapshots is incorrect; snapshot artifacts should target a snapshot repository endpoint instead. This will either fail or publish to the wrong repository at runtime.

Change OSSRH_URL: ${{ secrets.OSSRH_CENTRAL_URL }} to OSSRH_URL: ${{ secrets.OSSRH_SNAPSHOT_URL }} in all 5 publish jobs (lines 47, 88, 129, 170, 211). Also verify that OSSRH_SNAPSHOT_URL is defined in repository or organization secrets.

🤖 Prompt for AI Agents
In @.github/workflows/push-trigger.yml around lines 45 - 48, The five
publish_to_nexus_* jobs in push-trigger.yml are using the central repository URL
for snapshot builds; update each job's OSSRH_URL assignment from ${{
secrets.OSSRH_CENTRAL_URL }} to ${{ secrets.OSSRH_SNAPSHOT_URL }} (for the jobs
named publish_to_nexus_* referenced around the OSSRH_USER/OSSRH_SECRET block) so
snapshot/development branches publish to the snapshot endpoint, and confirm
OSSRH_SNAPSHOT_URL is present in the repo/org secrets.

Comment on lines +79 to +87
@Test(expected = VCIExchangeException.class)
public void testGetVerifiableCredential_NotImplemented() throws Exception {
VCRequestDto dto = mock(VCRequestDto.class);

Map<String, Object> identityDetails = new HashMap<>();
identityDetails.put("accessTokenHash", "tokenHash");

plugin.getVerifiableCredential(dto, "holderId", identityDetails);
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix potential NPE in the “not implemented” test.

dto.getFormat() is unstubbed, so getFormat().equals(...) will throw a NullPointerException instead of VCIExchangeException. Stub it to a non‑MSO_MDOC value to hit the intended branch.

🐛 Proposed fix
@@
     `@Test`(expected = VCIExchangeException.class)
     public void testGetVerifiableCredential_NotImplemented() throws Exception {
         VCRequestDto dto = mock(VCRequestDto.class);
+        when(dto.getFormat()).thenReturn(VCFormats.LDP_VC);
 
         Map<String, Object> identityDetails = new HashMap<>();
         identityDetails.put("accessTokenHash", "tokenHash");
 
         plugin.getVerifiableCredential(dto, "holderId", identityDetails);
     }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@Test(expected = VCIExchangeException.class)
public void testGetVerifiableCredential_NotImplemented() throws Exception {
VCRequestDto dto = mock(VCRequestDto.class);
Map<String, Object> identityDetails = new HashMap<>();
identityDetails.put("accessTokenHash", "tokenHash");
plugin.getVerifiableCredential(dto, "holderId", identityDetails);
}
`@Test`(expected = VCIExchangeException.class)
public void testGetVerifiableCredential_NotImplemented() throws Exception {
VCRequestDto dto = mock(VCRequestDto.class);
when(dto.getFormat()).thenReturn(VCFormats.LDP_VC);
Map<String, Object> identityDetails = new HashMap<>();
identityDetails.put("accessTokenHash", "tokenHash");
plugin.getVerifiableCredential(dto, "holderId", identityDetails);
}
🤖 Prompt for AI Agents
In
`@mock-certify-plugin/src/test/java/io/mosip/certify/mock/integration/service/MDocMockVCIssuancePluginTest.java`
around lines 79 - 87, The test testGetVerifiableCredential_NotImplemented is
hitting a NullPointerException because dto.getFormat() is unstubbed; stub the
mock VCRequestDto (dto) so getFormat() returns a non-MS0_MDOC/other value (e.g.,
a simple string) before calling plugin.getVerifiableCredential(dto, "holderId",
identityDetails) so the code path throws VCIExchangeException as expected;
update the test to mock/stub dto.getFormat() accordingly (reference:
VCRequestDto, dto.getFormat(), testGetVerifiableCredential_NotImplemented,
plugin.getVerifiableCredential, VCIExchangeException).

Comment on lines +152 to +153
// Add inside IdaAuditPluginImplTest

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove stale comment.

This appears to be a leftover instruction from code generation and should be removed.

Proposed fix
-    // Add inside IdaAuditPluginImplTest
-
     `@Test`
     public void auditRequest_gettersSetters_allArgsConstructor() {
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Add inside IdaAuditPluginImplTest
`@Test`
public void auditRequest_gettersSetters_allArgsConstructor() {
🤖 Prompt for AI Agents
In
`@mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaAuditPluginImplTest.java`
around lines 152 - 153, Remove the stale placeholder comment "Add inside
IdaAuditPluginImplTest" from the test file; locate the comment inside the class
IdaAuditPluginImplTest and delete that leftover instruction so the test class
contains only real test code and comments, and ensure no other autogenerated
placeholder comments remain in the file.

Comment on lines +202 to +213
@Test
public void auditResponse_gettersSetters_allArgsConstructor() {
AuditResponse resp1 = new AuditResponse();
resp1.setStatus(true);

AuditResponse resp2 = new AuditResponse();
resp2.setStatus(true);

assertEquals(resp1, resp2);
assertEquals(resp1.hashCode(), resp2.hashCode());
assertEquals(resp1.toString(), resp2.toString());
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Test name is misleading and missing getter verification.

The test method name mentions allArgsConstructor but only uses the no-args constructor. Additionally, the test should verify that the getter returns the expected value.

Proposed fix
     `@Test`
-    public void auditResponse_gettersSetters_allArgsConstructor() {
+    public void auditResponse_gettersSetters() {
         AuditResponse resp1 = new AuditResponse();
         resp1.setStatus(true);
+        assertTrue(resp1.isStatus());
 
         AuditResponse resp2 = new AuditResponse();
         resp2.setStatus(true);
 
         assertEquals(resp1, resp2);
         assertEquals(resp1.hashCode(), resp2.hashCode());
         assertEquals(resp1.toString(), resp2.toString());
     }
🤖 Prompt for AI Agents
In
`@mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaAuditPluginImplTest.java`
around lines 202 - 213, The test auditResponse_gettersSetters_allArgsConstructor
is misleading and incomplete: either rename it to reflect the no-args
constructor or actually test the all-args constructor. Update the test to
construct AuditResponse using its all-args constructor (or add a new test for
that constructor), set expected values, and add assertions that verify the
corresponding getters return those values (in addition to existing
equals/hashCode/toString checks) — reference the AuditResponse class and the
test method auditResponse_gettersSetters_allArgsConstructor to locate where to
change.

Comment on lines +492 to +509
@Test
public void testClientIdSecretKeyRequest() {
// All-args constructor
ClientIdSecretKeyRequest req1 = new ClientIdSecretKeyRequest("client", "secret", "app");
assertEquals("client", req1.getClientId());
assertEquals("secret", req1.getSecretKey());
assertEquals("app", req1.getAppId());

// No-args constructor and setters
ClientIdSecretKeyRequest req2 = new ClientIdSecretKeyRequest();
req2.setClientId("client");
req2.setSecretKey("secret");
req2.setAppId("app");

assertEquals(req1, req2);
assertEquals(req1.hashCode(), req2.hashCode());
assertTrue(req1.toString().contains("client"));
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

fd -e java "ClientIdSecretKeyRequest.java" --exec cat {} \;

Repository: inji/digital-credential-plugins

Length of output: 589


Add @ToString.Exclude annotation to the secretKey field in ClientIdSecretKeyRequest.

The class uses Lombok's @Data annotation but does not exclude the secretKey field from the generated toString() method. This exposes sensitive credential data in the string representation, which can lead to accidental logging of secrets in production. Add @ToString.Exclude to the secretKey field to prevent this.

🤖 Prompt for AI Agents
In
`@mosip-identity-certify-plugin/src/test/java/io/mosip/certify/mosipid/integration/service/IdaVCIssuancePluginImplTest.java`
around lines 492 - 509, The ClientIdSecretKeyRequest class is exposing secrets
via its Lombok-generated toString; add the Lombok exclusion on the secret field
by annotating the secretKey field with `@ToString.Exclude` in
ClientIdSecretKeyRequest, and add the import for lombok.ToString (or use the
fully-qualified annotation) so Lombok omits secretKey from toString while
leaving other fields (clientId, appId) unchanged.

import org.mockito.InjectMocks;
import org.mockito.Mock;
import org.mockito.Mockito;
import org.mockito.exceptions.base.MockitoException;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

find . -type f -name "PostgresDataProviderPluginTest.java" | head -5

Repository: inji/digital-credential-plugins

Length of output: 213


🏁 Script executed:

# Get file path and read relevant sections
FILE_PATH=$(find . -type f -name "PostgresDataProviderPluginTest.java" | head -1)
if [ -n "$FILE_PATH" ]; then
  echo "=== File imports (lines 1-30) ==="
  head -30 "$FILE_PATH"
  echo ""
  echo "=== Lines around 87-88 (80-95) ==="
  sed -n '80,95p' "$FILE_PATH"
fi

Repository: inji/digital-credential-plugins

Length of output: 1952


🏁 Script executed:

# Get total line count
FILE_PATH=$(find . -type f -name "PostgresDataProviderPluginTest.java" | head -1)
if [ -n "$FILE_PATH" ]; then
  wc -l "$FILE_PATH"
fi

Repository: inji/digital-credential-plugins

Length of output: 216


🏁 Script executed:

find . -type f -name "PostgresDataProviderPlugin.java" -not -path "*/test/*" | head -1

Repository: inji/digital-credential-plugins

Length of output: 209


🏁 Script executed:

FILE_PATH=$(find . -type f -name "PostgresDataProviderPlugin.java" -not -path "*/test/*" | head -1)
if [ -n "$FILE_PATH" ]; then
  echo "=== File: $FILE_PATH ==="
  wc -l "$FILE_PATH"
  echo ""
  echo "=== Full file content ==="
  cat -n "$FILE_PATH"
fi

Repository: inji/digital-credential-plugins

Length of output: 2828


Replace MockitoException with a more semantically appropriate exception

MockitoException is intended for Mockito misconfiguration errors, not runtime failures. Since fetchData() catches any Exception and converts it to DataProviderExchangeException, the test works—but using MockitoException obscures intent and doesn't accurately reflect what a real repository failure looks like. Use RuntimeException instead to better represent a data-access error.

Suggested fix
-import org.mockito.exceptions.base.MockitoException;

         Mockito.when(dataProviderRepository.fetchQueryResult("1234567", "test_query"))
-                .thenThrow(new MockitoException("Query execution failed"));
+                .thenThrow(new RuntimeException("Query execution failed"));
🤖 Prompt for AI Agents
In
`@postgres-dataprovider-plugin/src/test/java/io/mosip/certify/postgresdataprovider/integration/service/PostgresDataProviderPluginTest.java`
at line 15, In PostgresDataProviderPluginTest replace the use/import of
MockitoException with RuntimeException so the test simulates a real
repository/data-access failure; update the mock that throws MockitoException to
throw new RuntimeException(...) and keep assertions that fetchData() maps
exceptions to DataProviderExchangeException (referencing the
PostgresDataProviderPluginTest class and the fetchData() behavior) to preserve
test intent.

@swatigoel swatigoel closed this Jan 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants