Merge remote-tracking branch 'Hongwei/develop-obp' into develop-obp

# Conflicts:
#	obp-api/src/main/scala/code/api/v6_0_0/Http4s600.scala

Author: hongwei1

obp-api/src/main/scala/code/api/util/RateLimitingUtil.scala

@@ -265,7 +265,7 @@ object RateLimitingUtil extends MdcLoggable {
   }
 
   private def incrementConsumerCounters(consumerKey: String, period: LimitCallPeriod, limit: Long): (Long, Long) = {
-    if (useConsumerLimits) {
+    if (useConsumerLimits && limit > 0) {
       incrementCounter(createUniqueKey(consumerKey, period), period)
     } else {
       (-1, -1)

obp-api/src/main/scala/code/api/v1_4_0/JSONFactory1_4_0.scala

@@ -539,7 +539,7 @@ object JSONFactory1_4_0 extends MdcLoggable{
     jsonRequestBodyFieldsI18n:String,
     jsonResponseBodyFieldsI18n:String
   ): ResourceDocJson = {
-    val cacheKey = LOCALISED_RESOURCE_DOC_PREFIX + s"operationId:${operationId}-locale:$locale- isVersion4OrHigher:$isVersion4OrHigher- includeTechnology:$includeTechnology".intern()
+    val cacheKey = LOCALISED_RESOURCE_DOC_PREFIX + s"operationId:${operationId}-locale:$locale- isVersion4OrHigher:$isVersion4OrHigher- includeTechnology:$includeTechnology-specifiedUrl:${resourceDocUpdatedTags.specifiedUrl.getOrElse("")}".intern()
     Caching.memoizeSyncWithImMemory(Some(cacheKey))(CREATE_LOCALISED_RESOURCE_DOC_JSON_TTL.seconds) {
       val fieldsDescription =
         if (resourceDocUpdatedTags.tags.toString.contains("Dynamic-Entity")

obp-api/src/main/scala/code/api/v6_0_0/Http4s600.scala

@@ -13,6 +13,7 @@ import code.api.util.http4s.{ErrorResponseConverter, RequestScopeConnection, Res
 import code.api.util.http4s.Http4sRequestAttributes.{EndpointHelpers, RequestOps}
 import code.api.util.newstyle.ViewNewStyle
 import code.api.v2_0_0.JSONFactory200
+import code.api.v5_0_0.Http4s500
 import code.api.v5_1_0.{Http4s510, JSONFactory510}
 import code.api.v6_0_0.JSONFactory600.ScannedApiVersionJsonV600
 import code.accountattribute.AccountAttributeX
@@ -80,12 +81,11 @@ import scala.concurrent.Future
  * v6.0.0 http4s endpoints — Phase 1 in progress.
  *
  * Wire-in into `Http4sApp.baseServices` is performed alongside this object.
- * The v600→v510 bridge (`v600ToV510Bridge`) is intentionally NOT appended to
- * `allRoutes`: unmigrated v6 paths must fall through the http4s chain to the
- * Lift fallback, which still serves the v6 Lift handlers. Adding the bridge
- * would let v6 *overrides* be hijacked into v5.1 handlers (CLAUDE.md →
- * "Bridge-cascade hijack"). The bridge val is kept here so it can be enabled
- * later if the team decides to short-circuit Lift for v6 originals.
+ * The v600→v500 bridge (`v600ToV500Bridge`) rewrites unhandled v6.0.0 paths
+ * to v5.0.0 and delegates to Http4s500.wrappedRoutesV500Services, which has a
+ * working cascade chain (v5.0.0 → v4.0.0 → v3.1.0 → v3.0.0). The bridge
+ * skips v5.1.0 because Http4s510's own bridge to v5.0.0 is disabled due to
+ * MetricTest / VRPConsentRequestTest regressions.
  */
 object Http4s600 {
 
@@ -1790,6 +1790,7 @@ object Http4s600 {
           .orElse(getConnectorTraces(req))
           .orElse(getDynamicEntityDiagnostics(req))
           .orElse(cleanupOrphanedDynamicEntityRecords(req))
+          .orElse(createWebUiProps(req))
           .orElse(createOrUpdateWebUiProps(req))
           .orElse(deleteWebUiProps(req))
           .orElse(createCustomViewManagement(req))
@@ -2249,6 +2250,36 @@ object Http4s600 {
       Some(canCleanupOrphanedDynamicEntityRecords :: Nil),
       http4sPartialFunction = Some(cleanupOrphanedDynamicEntityRecords))
 
+    // POST /obp/v6.0.0/management/webui_props
+    lazy val createWebUiProps: HttpRoutes[IO] = HttpRoutes.of[IO] {
+      case req @ POST -> `prefixPath` / "management" / "webui_props" =>
+        EndpointHelpers.withUserAndBodyCreated[WebUiPropsCommons, Any](req) { (user, postedData, cc) =>
+          for {
+            _ <- NewStyle.function.hasEntitlement("", user.userId, canCreateWebUiProps, Some(cc))
+            _ <- NewStyle.function.tryons(
+              s"""$InvalidWebUiProps name must be start with webui_, but current post name is: ${postedData.name} """,
+              400, Some(cc)) { require(postedData.name.startsWith("webui_")) }
+            webUiProps <- Future(MappedWebUiPropsProvider.createOrUpdate(postedData)) map {
+              unboxFullOrFail(_, Some(cc))
+            }
+          } yield (webUiProps: WebUiPropsCommons)
+        }
+    }
+
+    resourceDocs += ResourceDoc(
+      null, implementedInApiVersion, nameOf(createWebUiProps), "POST",
+      "/management/webui_props",
+      "Create WebUiProps",
+      s"""Create a WebUiProps.
+         |
+         |${APIUtil.userAuthenticationMessage(true)}
+         |""",
+      WebUiPropsCommons("webui_api_explorer_url", "https://apiexplorer.openbankproject.com"),
+      WebUiPropsCommons("webui_api_explorer_url", "https://apiexplorer.openbankproject.com", Some("web-ui-props-id")),
+      List($AuthenticatedUserIsRequired, UserHasMissingRoles, InvalidJsonFormat, UnknownError),
+      List(apiTagWebUiProps), Some(List(canCreateWebUiProps)),
+      http4sPartialFunction = Some(createWebUiProps))
+
     // PUT /obp/v6.0.0/management/webui_props/WEBUI_PROP_NAME
     lazy val createOrUpdateWebUiProps: HttpRoutes[IO] = HttpRoutes.of[IO] {
       case req @ PUT -> `prefixPath` / "management" / "webui_props" / webUiPropName =>
@@ -8474,15 +8505,18 @@ object Http4s600 {
     val allRoutesWithMiddleware: HttpRoutes[IO] =
       ResourceDocMiddleware.apply(resourceDocs)(allRoutes)
 
-    // ─── path-rewriting bridge: /obp/v6.0.0/… → /obp/v5.1.0/… ─────────────
+    // ─── path-rewriting bridge: /obp/v6.0.0/… → /obp/v5.0.0/… ─────────────
+    // Targets v5.0.0 (not v5.1.0) because Http4s510's bridge to v5.0.0 is
+    // disabled (MetricTest / VRPConsentRequestTest regressions). Http4s500 has
+    // its own working cascade: v5.0.0 → v4.0.0 → v3.1.0 → v3.0.0.
     // NOT appended to allRoutes — see object-level scaladoc.
-    val v600ToV510Bridge: HttpRoutes[IO] = Kleisli[HttpF, Request[IO], Response[IO]] { req =>
+    val v600ToV500Bridge: HttpRoutes[IO] = Kleisli[HttpF, Request[IO], Response[IO]] { req =>
       val rawPath = req.uri.path.renderString
       if (rawPath.startsWith("/obp/v6.0.0/")) {
-        val rewritten = rawPath.replaceFirst("/obp/v6\\.0\\.0/", "/obp/v5.1.0/")
+        val rewritten = rawPath.replaceFirst("/obp/v6\\.0\\.0/", "/obp/v5.0.0/")
         val newUri = req.uri.withPath(Uri.Path.unsafeFromString(rewritten))
         val rewrittenReq = req.withUri(newUri)
-        Http4s510.wrappedRoutesV510Services.run(rewrittenReq)
+        Http4s500.wrappedRoutesV500Services.run(rewrittenReq)
       } else {
         OptionT.none[IO, Response[IO]]
       }
@@ -8501,5 +8535,8 @@ object Http4s600 {
   // A `lazy val` defers the read until first access (from Http4sApp after Boot
   // completes), by which time Impl6 is fully initialised.
   lazy val wrappedRoutesV600Services: HttpRoutes[IO] =
-    Implementations6_0_0.allRoutesWithMiddleware
+    Kleisli[HttpF, Request[IO], Response[IO]] { req =>
+      Implementations6_0_0.allRoutesWithMiddleware.run(req)
+        .orElse(Implementations6_0_0.v600ToV500Bridge.run(req))
+    }
 }

obp-api/src/main/scala/code/api/v7_0_0/Http4s700.scala

@@ -48,6 +48,7 @@ import net.liftweb.json.{Extraction, Formats}
 import net.liftweb.mapper.{By, Descending, MaxRows, OrderBy}
 import org.http4s._
 import org.http4s.dsl.io._
+import org.typelevel.ci.CIString
 
 import scala.collection.JavaConverters._
 import scala.collection.mutable.ArrayBuffer
@@ -3583,8 +3584,25 @@ object Http4s700 {
       ResourceDocMiddleware.apply(resourceDocs)(IdempotencyMiddleware(allRoutes))
   }
 
-  // Routes with ResourceDocMiddleware - provides automatic validation based on ResourceDoc metadata
-  // Authentication is automatic based on $AuthenticatedUserIsRequired in ResourceDoc errorResponseBodies
-  // This matches Lift's wrappedWithAuthCheck behavior
-  val wrappedRoutesV700Services: HttpRoutes[IO] = Implementations7_0_0.allRoutesWithMiddleware
+  // ─── path-rewriting bridge: /obp/v7.0.0/… → /obp/v6.0.0/… ─────────────
+  // Catches v7.0.0 paths not handled by Http4s700's own endpoints and forwards
+  // them to Http4s600 (which has all 243 v6.0.0 endpoints). This replaces the
+  // old Lift-bridge rewrite, which failed because OBPAPI6_0_0.routes = Nil.
+  private val v700ToV600Bridge: HttpRoutes[IO] = Kleisli[HttpF, Request[IO], Response[IO]] { req =>
+    val rawPath = req.uri.path.renderString
+    if (rawPath.startsWith("/obp/v7.0.0/")) {
+      val rewritten = rawPath.replaceFirst("/obp/v7\\.0\\.0/", "/obp/v6.0.0/")
+      val newUri = req.uri.withPath(Uri.Path.unsafeFromString(rewritten))
+      code.api.v6_0_0.Http4s600.wrappedRoutesV600Services.run(req.withUri(newUri))
+        .map(_.putHeaders(Header.Raw(CIString("X-OBP-Version-Served"), "v6.0.0")))
+    } else {
+      OptionT.none[IO, Response[IO]]
+    }
+  }
+
+  lazy val wrappedRoutesV700Services: HttpRoutes[IO] =
+    Kleisli[HttpF, Request[IO], Response[IO]] { req =>
+      Implementations7_0_0.allRoutesWithMiddleware.run(req)
+        .orElse(v700ToV600Bridge.run(req))
+    }
 }

obp-api/src/test/scala/code/api/ResourceDocs1_4_0/ResourceDocsTechnologyTest.scala

@@ -20,8 +20,15 @@ class ResourceDocsTechnologyTest extends ServerSetup with PropsReset {
       response.code should equal(200)
       (response.body \ "resource_docs") match {
         case JArray(docs) =>
-          val technology = docs.head \ "implemented_by" \ "technology"
-          technology should equal(JString(Constant.TECHNOLOGY_LIFTWEB))
+          // At least one doc should have a technology field (http4s or liftweb).
+          // v5.0.0 has no technology field at all; v6.0.0 exposes it for all docs.
+          val hasTechnology = docs.exists { doc =>
+            (doc \ "implemented_by" \ "technology") match {
+              case JString(t) => t == Constant.TECHNOLOGY_HTTP4S || t == Constant.TECHNOLOGY_LIFTWEB
+              case _          => false
+            }
+          }
+          hasTechnology should be(true)
         case _ =>
           fail("Expected resource_docs field to be an array")
       }

obp-api/src/test/scala/code/api/ResourceDocs1_4_0/ResourceDocsTest.scala

@@ -105,7 +105,7 @@ class ResourceDocsTest extends ResourceDocsV140ServerSetup with PropsReset with
       And("We should get  200 and the response can be extract to case classes")
       val responseDocs = responseGetObp.body.extract[ResourceDocsJson]
       responseGetObp.code should equal(200)
-      responseDocs.resource_docs.head.implemented_by.technology shouldBe Some(Constant.TECHNOLOGY_LIFTWEB)
+      responseDocs.resource_docs.head.implemented_by.technology should (equal(Some(Constant.TECHNOLOGY_LIFTWEB)) or equal(Some(Constant.TECHNOLOGY_HTTP4S)))
       //This should not throw any exceptions
       responseDocs.resource_docs.take(3).foreach(doc => stringToNodeSeq(doc.description))
     }

obp-api/src/test/scala/code/api/v6_0_0/AbacRuleTests.scala

@@ -17,6 +17,10 @@ class AbacRuleTests extends V600ServerSetup with DefaultUsers {
 
   override def beforeAll(): Unit = {
     super.beforeAll()
+    // Force creation of multiple users so the statistical permissiveness check
+    // has a meaningful sample (>1 user). Without this, a rule matching only
+    // resourceUser1's email looks "100% permissive" in an otherwise empty DB.
+    val _ = (resourceUser1, resourceUser2, resourceUser3, resourceUser4)
   }
 
   override def afterAll(): Unit = {