Refactor OffRamp recipient routing — replace hardcoded bank details (STA-246)

[Puneethkumarck]

Summary

PR #248 review identified that OffRampActivityImpl uses hardcoded bank routing that ignores actual recipient data. Three related issues need a comprehensive fix.

Issues to Fix

Major — Hardcoded Bank Routing

1. resolveBankAccount / resolveBankCode ignore recipientId (OffRampActivityImpl.java:84-90)
   • All GBP payouts route to hardcoded "12345678" / "040004" regardless of recipient
   • All non-GBP currencies fall back to hardcoded DE IBAN "DE89370400440532013000"
   • Action: Extend OffRampRequest with recipient banking details (account, sort code/IBAN) or inject a RecipientRepository to look up banking details by recipientId

Major — Silent Currency Fallback

2. Unsupported currencies silently fall back to SEPA/DE (OffRampActivityImpl.java:80-98)
   • resolvePaymentRail, resolveBankAccount, resolveBankCode, resolveAccountType, resolveCountry all default to SEPA/DE for any currency that isn't "GBP"
   • USD, CHF, JPY etc. would silently route to a German IBAN
   • Action: Use exhaustive switch expressions with explicit currency matching. Throw IllegalArgumentException for unsupported currencies

Minor — Fake Hash

3. recipientAccountHash is not actually hashed (OffRampActivityImpl.java:47)
   • "sha256:" + request.recipientId() is string concatenation, not a cryptographic hash
   • If used for compliance/audit, this is misleading
   • Action: Compute actual SHA-256 digest using MessageDigest, encode as hex, prefix with "sha256:"

Acceptance Criteria

• OffRampRequest carries or resolves real recipient banking details
• No hardcoded bank accounts/IBANs/sort codes in activity impl
• Explicit currency validation — unsupported currencies fail fast
• recipientAccountHash uses real SHA-256 digest
• Updated unit tests for all resolver methods
• Existing payment flow tests pass

References

• PR feat(sandbox): first real E2E payment — 16 bugs fixed across 7 services (STA-243) #248 CodeRabbit review comments
• OffRampRequest record: payment-orchestrator/.../domain/workflow/activity/OffRampRequest.java
• OffRampActivityImpl: payment-orchestrator/.../infrastructure/activity/OffRampActivityImpl.java

[github-actions]

This issue has been inactive for 30 days and has been marked as stale. If it is still relevant, please leave a comment or update the issue. It will be automatically closed in 14 days if there is no further activity.

[github-actions]

This issue has been closed automatically after 44 days of inactivity. If you believe this is still relevant, please open a new issue with updated context.