Improve idempotency handling with deterministic key generation

Introduce deterministic idempotency key generation when a client-provided key is absent.
The key is derived from the request payload combined with a time window to support safe retries.

Author: elnafateh

fineract-core/src/main/java/org/apache/fineract/commands/service/DeterministicIdempotencyKeyGenerator.java

@@ -0,0 +1,49 @@
+package org.apache.fineract.commands.service;
+
+
+import org.apache.fineract.commands.domain.CommandWrapper;
+import org.springframework.stereotype.Component;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.Base64;
+
+@Component
+public class DeterministicIdempotencyKeyGenerator {
+
+    private static final int BUCKET_MINUTES = 2;
+
+    public String generate(CommandWrapper wrapper) {
+        String json = wrapper.getJson();
+
+        String normalizedPayload = normalize(json);
+
+        String bucket = currentTimeBucket();
+
+        String raw = normalizedPayload + "|" + bucket;
+
+        return sha256(raw);
+    }
+
+    private String normalize(String json) {
+        // IMPORTANT: make deterministic (order, spacing, etc.)
+        return json.replaceAll("\\s+", "");
+    }
+
+    private String currentTimeBucket() {
+        long now = System.currentTimeMillis();
+        long bucketMillis = BUCKET_MINUTES * 60 * 1000;
+        long bucket = now / bucketMillis;
+        return String.valueOf(bucket);
+    }
+
+    private String sha256(String input) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            byte[] hash = digest.digest(input.getBytes(StandardCharsets.UTF_8));
+            return Base64.getEncoder().encodeToString(hash);
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to generate idempotency key", e);
+        }
+    }
+}

fineract-core/src/main/java/org/apache/fineract/commands/service/IdempotencyKeyResolver.java

@@ -30,12 +30,28 @@ public class IdempotencyKeyResolver {
 
     private final FineractRequestContextHolder fineractRequestContextHolder;
 
+    private  final DeterministicIdempotencyKeyGenerator deterministicGenerator;
+
     private final IdempotencyKeyGenerator idempotencyKeyGenerator;
 
     public String resolve(CommandWrapper wrapper) {
-        return Optional.ofNullable(wrapper.getIdempotencyKey()).orElseGet(() -> getAttribute().orElseGet(idempotencyKeyGenerator::create));
+
+        // If wrapper already has key → use it
+        if (wrapper.getIdempotencyKey() != null) {
+            return wrapper.getIdempotencyKey();
+        }
+
+        // If request attribute exists (internal retry)
+        Optional<String> attributeKey = getAttribute();
+        if (attributeKey.isPresent()) {
+            return attributeKey.get();
+        }
+
+        // hybrid logic (external retry)
+        return deterministicGenerator.generate(wrapper);
     }
 
+
     private Optional<String> getAttribute() {
         return Optional.ofNullable(fineractRequestContextHolder.getAttribute(SynchronousCommandProcessingService.IDEMPOTENCY_KEY_ATTRIBUTE))
                 .map(String::valueOf);