FINERACT-2676: Fix named PPI survey score overview

fineract-provider/src/main/java/org/apache/fineract/infrastructure/survey/api/SurveyApiResource.java

@@ -123,7 +123,7 @@ public String getClientSurveyOverview(@PathParam("surveyName") final String surv
 
         this.context.authenticatedUser().validateHasReadPermission(SurveyApiConstants.SURVEY_RESOURCE_NAME);
 
-        List<ClientScoresOverview> scores = this.readSurveyService.retrieveClientSurveyScoreOverview(clientId);
+        List<ClientScoresOverview> scores = this.readSurveyService.retrieveClientSurveyScoreOverview(surveyName, clientId);
 
         return this.toApiJsonClientScoreOverviewSerializer.serialize(scores);
     }

fineract-provider/src/main/java/org/apache/fineract/infrastructure/survey/service/ReadSurveyServiceImpl.java

@@ -114,22 +114,27 @@ public SurveyDataTableData retrieveSurvey(String surveyName) {
 
     @Override
     public List<ClientScoresOverview> retrieveClientSurveyScoreOverview(String surveyName, Long clientId) {
+        sqlValidator.validate(surveyName);
+        final String registeredSurveyName = retrievePermittedSurveyName(surveyName);
+        if (registeredSurveyName == null) {
+            return List.of();
+        }
 
-        final String sql = "SELECT  tz.id, lkh.name, lkh.code, poverty_line, tz.date, tz.score FROM ? tz"
+        final String sql = "SELECT  tz.id, lkh.name, lkh.code, poverty_line, tz.date, tz.score FROM " + registeredSurveyName + " tz"
                 + " JOIN ppi_likelihoods_ppi lkp on lkp.ppi_name = ? AND enabled = ? "
                 + " JOIN ppi_scores sc on score_from  <= tz.score AND score_to >=tz.score"
                 + " JOIN ppi_poverty_line pvl on pvl.likelihood_ppi_id = lkp.id AND pvl.score_id = sc.id"
                 + " JOIN ppi_likelihoods lkh on lkh.id = lkp.likelihood_id " + " WHERE  client_id = ? ";
 
         final SqlRowSet rs = this.jdbcTemplate.queryForRowSet(sql,
-                new Object[] { surveyName, surveyName, LikelihoodStatus.ENABLED, clientId });
+                new Object[] { registeredSurveyName, LikelihoodStatus.ENABLED, clientId });
 
         List<ClientScoresOverview> scoresOverviews = new ArrayList<>();
 
         while (rs.next()) {
             scoresOverviews.add(new ClientScoresOverview().setLikelihoodCode(rs.getString("code")).setLikelihoodName(rs.getString("name"))
                     .setScore(rs.getLong("score")).setPovertyLine(rs.getDouble("poverty_line")).setDate(rs.getDate("date").toLocalDate())
-                    .setId(rs.getLong("id")).setSurveyName(surveyName));
+                    .setId(rs.getLong("id")).setSurveyName(registeredSurveyName));
         }
         return scoresOverviews;
     }
@@ -170,16 +175,31 @@ public List<ClientScoresOverview> retrieveClientSurveyScoreOverview(Long clientI
     }
 
     private String retrieveAllSurveyNameSQL() {
+        return retrieveAllSurveyNameSQL("");
+    }
+
+    private String retrieveAllSurveyNameSQL(String andClause) {
         // PERMITTED datatables
         return "select cf.name from x_registered_table " + " join c_configuration cf on x_registered_table.registered_table_name = cf.name "
                 + " where exists" + " (select 'f'" + " from m_appuser_role ur " + " join m_role r on r.id = ur.role_id"
                 + " left join m_role_permission rp on rp.role_id = r.id" + " left join m_permission p on p.id = rp.permission_id"
                 + " where ur.appuser_id = " + this.context.authenticatedUser().getId()
                 + " and (p.code in ('ALL_FUNCTIONS', 'ALL_FUNCTIONS_READ') or p.code = concat('READ_', registered_table_name))) "
-                + " and x_registered_table.category = " + DataTableApiConstant.CATEGORY_PPI
+                + " and x_registered_table.category = " + DataTableApiConstant.CATEGORY_PPI + andClause
                 + " order by application_table_name, registered_table_name";
     }
 
+    private String retrievePermittedSurveyName(String surveyName) {
+        final String sql = retrieveAllSurveyNameSQL(" and x_registered_table.registered_table_name = ?");
+        final SqlRowSet rs = this.jdbcTemplate.queryForRowSet(sql, surveyName);
+        if (rs.next()) {
+            final String registeredSurveyName = rs.getString("name");
+            sqlValidator.validate(registeredSurveyName);
+            return registeredSurveyName;
+        }
+        return null;
+    }
+
     @Override
     public GenericResultsetData retrieveSurveyEntry(String surveyName, Long clientId, Long entryId) {
 

fineract-provider/src/test/java/org/apache/fineract/infrastructure/survey/api/SurveyApiResourceTest.java

@@ -0,0 +1,80 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.survey.api;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import org.apache.fineract.commands.service.PortfolioCommandSourceWritePlatformService;
+import org.apache.fineract.infrastructure.core.serialization.DefaultToApiJsonSerializer;
+import org.apache.fineract.infrastructure.dataqueries.service.GenericDataService;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.infrastructure.survey.data.ClientScoresOverview;
+import org.apache.fineract.infrastructure.survey.data.SurveyData;
+import org.apache.fineract.infrastructure.survey.service.ReadSurveyService;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class SurveyApiResourceTest {
+
+    private static final String SURVEY_NAME = "ppi_kenya_2026";
+    private static final Long CLIENT_ID = 11L;
+
+    @Mock
+    private DefaultToApiJsonSerializer<SurveyData> toApiJsonSerializer;
+    @Mock
+    private DefaultToApiJsonSerializer<ClientScoresOverview> toApiJsonClientScoreOverviewSerializer;
+    @Mock
+    private PlatformSecurityContext context;
+    @Mock
+    private ReadSurveyService readSurveyService;
+    @Mock
+    private PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
+    @Mock
+    private GenericDataService genericDataService;
+    @Mock
+    private AppUser appUser;
+
+    private SurveyApiResource underTest;
+
+    @BeforeEach
+    void setUp() {
+        when(context.authenticatedUser()).thenReturn(appUser);
+        underTest = new SurveyApiResource(toApiJsonSerializer, toApiJsonClientScoreOverviewSerializer, context, readSurveyService,
+                commandsSourceWritePlatformService, genericDataService);
+    }
+
+    @Test
+    void getClientSurveyOverviewRetrievesScoresForRequestedSurvey() {
+        List<ClientScoresOverview> scores = List.of();
+        when(readSurveyService.retrieveClientSurveyScoreOverview(SURVEY_NAME, CLIENT_ID)).thenReturn(scores);
+        when(toApiJsonClientScoreOverviewSerializer.serialize(scores)).thenReturn("[]");
+
+        underTest.getClientSurveyOverview(SURVEY_NAME, CLIENT_ID);
+
+        verify(appUser).validateHasReadPermission(SurveyApiConstants.SURVEY_RESOURCE_NAME);
+        verify(readSurveyService).retrieveClientSurveyScoreOverview(SURVEY_NAME, CLIENT_ID);
+    }
+}

fineract-provider/src/test/java/org/apache/fineract/infrastructure/survey/service/ReadSurveyServiceImplTest.java

@@ -0,0 +1,117 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.survey.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import org.apache.fineract.infrastructure.dataqueries.service.DatatableReadService;
+import org.apache.fineract.infrastructure.dataqueries.service.GenericDataService;
+import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.infrastructure.security.service.SqlValidator;
+import org.apache.fineract.infrastructure.survey.data.ClientScoresOverview;
+import org.apache.fineract.infrastructure.survey.data.LikelihoodStatus;
+import org.apache.fineract.useradministration.domain.AppUser;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.support.rowset.SqlRowSet;
+
+@ExtendWith(MockitoExtension.class)
+@MockitoSettings(strictness = Strictness.LENIENT)
+class ReadSurveyServiceImplTest {
+
+    private static final Long USER_ID = 7L;
+    private static final Long CLIENT_ID = 11L;
+    private static final String SURVEY_NAME = "ppi_kenya_2026";
+
+    @Mock
+    private PlatformSecurityContext context;
+    @Mock
+    private JdbcTemplate jdbcTemplate;
+    @Mock
+    private SqlValidator sqlValidator;
+    @Mock
+    private GenericDataService genericDataService;
+    @Mock
+    private DatatableReadService datatableReadService;
+    @Mock
+    private AppUser appUser;
+
+    private ReadSurveyServiceImpl underTest;
+
+    @BeforeEach
+    void setUp() {
+        when(context.authenticatedUser()).thenReturn(appUser);
+        when(appUser.getId()).thenReturn(USER_ID);
+        underTest = new ReadSurveyServiceImpl(context, jdbcTemplate, sqlValidator, genericDataService, datatableReadService);
+    }
+
+    @Test
+    void retrieveClientSurveyScoreOverviewUsesRegisteredSurveyNameAsSqlIdentifier() {
+        SqlRowSet surveyNames = Mockito.mock(SqlRowSet.class);
+        when(surveyNames.next()).thenReturn(true);
+        when(surveyNames.getString("name")).thenReturn(SURVEY_NAME);
+
+        SqlRowSet scoreRows = Mockito.mock(SqlRowSet.class);
+        when(scoreRows.next()).thenReturn(false);
+
+        when(jdbcTemplate.queryForRowSet(anyString(), any(Object[].class))).thenReturn(surveyNames, scoreRows);
+
+        List<ClientScoresOverview> result = underTest.retrieveClientSurveyScoreOverview(SURVEY_NAME, CLIENT_ID);
+
+        assertThat(result).isEmpty();
+
+        ArgumentCaptor<String> sqlCaptor = ArgumentCaptor.forClass(String.class);
+        ArgumentCaptor<Object[]> paramsCaptor = ArgumentCaptor.forClass(Object[].class);
+        verify(jdbcTemplate, times(2)).queryForRowSet(sqlCaptor.capture(), paramsCaptor.capture());
+
+        String scoreSql = sqlCaptor.getAllValues().get(1);
+        Object[] scoreParams = paramsCaptor.getAllValues().get(1);
+
+        assertThat(scoreSql).contains("FROM " + SURVEY_NAME + " tz");
+        assertThat(scoreSql).doesNotContain("FROM ? tz");
+        assertThat(scoreParams).containsExactly(SURVEY_NAME, LikelihoodStatus.ENABLED, CLIENT_ID);
+        verify(sqlValidator, times(2)).validate(SURVEY_NAME);
+    }
+
+    @Test
+    void retrieveClientSurveyScoreOverviewReturnsEmptyListWhenSurveyIsNotPermitted() {
+        SqlRowSet surveyNames = Mockito.mock(SqlRowSet.class);
+        when(surveyNames.next()).thenReturn(false);
+        when(jdbcTemplate.queryForRowSet(anyString(), any(Object[].class))).thenReturn(surveyNames);
+
+        List<ClientScoresOverview> result = underTest.retrieveClientSurveyScoreOverview(SURVEY_NAME, CLIENT_ID);
+
+        assertThat(result).isEmpty();
+        verify(jdbcTemplate, times(1)).queryForRowSet(anyString(), any(Object[].class));
+    }
+}