Dinamik Sorgu — Filtre Ekranı Bir Kapıya Dönüşmesin

1
// Every field is optional: the screen sends only what the customer filled in.
2
record TransactionFilter(
3
        Category category,
4
        BigDecimal minAmount,
5
        LocalDate from,
6
        String text,
7
        String counterpartyIban) {
8
}

1
final class TransactionSpecs {
2

3
    private static final ZoneId ISTANBUL = ZoneId.of("Europe/Istanbul");
4

5
    private TransactionSpecs() {
6
    }
7

8
    static Specification<AccountTransaction> matching(String sessionAccount, TransactionFilter f) {
9
        List<Specification<AccountTransaction>> parts = new ArrayList<>();
10
        // Always present, always from the session: never a filter the customer can change.
11
        parts.add((root, query, cb) -> cb.equal(root.get("accountId"), sessionAccount));
12
        if (f.category() != null) {
13
            parts.add((root, query, cb) -> cb.equal(root.get("category"), f.category()));
14
        }
15
        if (f.minAmount() != null) {
16
            parts.add((root, query, cb) -> cb.greaterThanOrEqualTo(root.<BigDecimal>get("amount"), f.minAmount()));
17
        }
18
        if (f.from() != null) {
19
            Instant start = f.from().atStartOfDay(ISTANBUL).toInstant();
20
            parts.add((root, query, cb) -> cb.greaterThanOrEqualTo(root.<Instant>get("createdAt"), start));
21
        }
22
        if (f.text() != null && !f.text().isBlank()) {
23
            String pattern = "%" + f.text().toLowerCase(Locale.ROOT) + "%";   // bound as a parameter, never spliced
24
            parts.add((root, query, cb) -> cb.like(cb.lower(root.get("description")), pattern));
25
        }
26
        if (f.counterpartyIban() != null) {
27
            parts.add((root, query, cb) -> cb.equal(root.get("counterpartyIban"), f.counterpartyIban()));
28
        }
29
        return Specification.allOf(parts);
30
    }
31
}

1
interface TransactionRepository extends JpaRepository<AccountTransaction, Long>, JpaSpecificationExecutor<AccountTransaction> {
2
}
3

4
@Service
5
class TransactionHistory {
6

7
    private static final Map<String, String> SORTABLE = Map.of("tarih", "createdAt", "tutar", "amount");
8
    private final TransactionRepository transactions;
9

10
    TransactionHistory(TransactionRepository transactions) {
11
        this.transactions = transactions;
12
    }
13

14
    Page<AccountTransaction> search(String sessionAccount, TransactionFilter filter, String sortKey, int page) {
15
        String column = SORTABLE.getOrDefault(sortKey, "createdAt");   // ORDER BY cannot be a parameter: allowlist it
16
        Pageable pageable = PageRequest.of(page, 20, Sort.by(Sort.Direction.DESC, column));
17
        return transactions.findAll(TransactionSpecs.matching(sessionAccount, filter), pageable);
18
    }
19
}

1
@DataJpaTest
2
@Testcontainers
3
class TransactionSpecsIT {
4

5
    @Container
6
    @ServiceConnection
7
    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine");
8

9
    @Autowired TransactionRepository transactions;
10

11
    @BeforeEach
12
    void seed() {
13
        transactions.saveAll(List.of(
14
                AccountTransaction.of("TR01", Category.MARKET, "245.90", "Migros"),
15
                AccountTransaction.of("TR02", Category.KIRA, "18000.00", "Ekim kirası")));
16
    }
17

18
    @Test
19
    void anInjectionPayloadIsJustText() {
20
        var filter = new TransactionFilter(null, null, null, "x' OR 1=1 --", null);
21
        assertThat(transactions.findAll(TransactionSpecs.matching("TR01", filter))).isEmpty();
22
    }
23

24
    @Test
25
    void filledFiltersCombineAndStayInsideTheAccount() {
26
        var filter = new TransactionFilter(Category.MARKET, new BigDecimal("100"), null, null, null);
27
        assertThat(transactions.findAll(TransactionSpecs.matching("TR01", filter)))
28
                .extracting(AccountTransaction::getDescription).containsExactly("Migros");
29
    }
30
}