Skip to content

feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment - #631

Merged
david-ruiz-cko merged 4 commits into
masterfrom
feature/INT-1667
Aug 6, 2026
Merged

feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment#631
david-ruiz-cko merged 4 commits into
masterfrom
feature/INT-1667

Conversation

@david-ruiz-cko

@david-ruiz-cko david-ruiz-cko commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request refines how 3DS challenge indicators are modeled and documented in the codebase, clarifying the distinction between payment and session APIs and improving the accuracy of API response models. The main changes involve introducing a dedicated SessionChallengeIndicator enum for session-related endpoints, updating documentation for both enums, and enhancing the field-level documentation for session response classes.

3DS Challenge Indicator Modeling

  • Introduced a new SessionChallengeIndicator enum in sessions to represent all nine possible challenge indicator values for session endpoints, including exemption requests, with detailed documentation for each value. (src/main/java/com/checkout/sessions/SessionChallengeIndicator.java)
  • Updated ChallengeIndicator in common to clarify its use for payment-related endpoints and to deprecate exemption values, which are now only valid for sessions. Improved documentation for each enum value and marked exemptions as deprecated. (src/main/java/com/checkout/common/ChallengeIndicator.java)

Session Response Model Updates

  • Changed the type of the challengeIndicator field in both CreateSessionAcceptedResponse and GetSessionResponse from ChallengeIndicator to SessionChallengeIndicator, ensuring correct deserialization and alignment with API behavior. (src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java, src/main/java/com/checkout/sessions/GetSessionResponse.java) [1] [2]
  • Added comprehensive Javadoc documentation for all fields in CreateSessionAcceptedResponse and GetSessionResponse, clarifying requirements, formats, and default values for each field. [1] [2]

Code Clean-up

  • Removed unnecessary imports of ChallengeIndicator from session-related files to prevent confusion and maintain separation of concerns. (src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java, src/main/java/com/checkout/sessions/GetSessionResponse.java, src/main/java/com/checkout/sessions/SessionRequest.java) [1] [2] [3]

@david-ruiz-cko
david-ruiz-cko requested a review from a team August 3, 2026 10:03
@agent-wall-e

agent-wall-e Bot commented Aug 3, 2026

Copy link
Copy Markdown

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

  • security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionChallengeIndicator.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionRequest.java
  • security_sensitive_path:src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java

Operational gates

  • ✅ jira_ticket (INT-1667)
  • ✅ independent_review

Files analysed: 10

wall-e 2026.06.19-02 · policy 376219bc71e6…

@agent-wall-e

agent-wall-e Bot commented Aug 3, 2026

Copy link
Copy Markdown
🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code Kind Clause Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

  • classifying — this rule contributed to the chosen tier.
  • informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

wall-e 2026.06.19-02 · debug

@agent-wall-e

agent-wall-e Bot commented Aug 3, 2026

Copy link
Copy Markdown

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

  • security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionChallengeIndicator.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionRequest.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionScheme.java

Operational gates

  • ✅ jira_ticket (INT-1667)
  • ✅ independent_review

Files analysed: 17

wall-e 2026.06.19-02 · policy 376219bc71e6…

@agent-wall-e

agent-wall-e Bot commented Aug 3, 2026

Copy link
Copy Markdown
🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code Kind Clause Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionScheme.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionsCardMetadataResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/TransactionType.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/CreateSessionAcceptedResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/GetSessionResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionSchemeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/TransactionTypeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

  • classifying — this rule contributed to the chosen tier.
  • informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

wall-e 2026.06.19-02 · debug

@agent-wall-e

agent-wall-e Bot commented Aug 4, 2026

Copy link
Copy Markdown

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

  • security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionChallengeIndicator.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionRequest.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/SessionScheme.java

Operational gates

  • ✅ jira_ticket (INT-1667)
  • ✅ independent_review

Files analysed: 17

wall-e 2026.06.19-02 · policy 376219bc71e6…

@agent-wall-e

agent-wall-e Bot commented Aug 4, 2026

Copy link
Copy Markdown
🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code Kind Clause Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionScheme.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionsCardMetadataResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/TransactionType.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/CreateSessionAcceptedResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/GetSessionResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionSchemeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/TransactionTypeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

  • classifying — this rule contributed to the chosen tier.
  • informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

wall-e 2026.06.19-02 · debug

@agent-wall-e

agent-wall-e Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

  • security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/Experience.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/ExperienceOutcome.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/ExperienceStatus.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java

Operational gates

  • ✅ jira_ticket (INT-1667)
  • ✅ independent_review

Files analysed: 27

wall-e 2026.06.19-02 · policy 376219bc71e6…

@agent-wall-e

agent-wall-e Bot commented Aug 5, 2026

Copy link
Copy Markdown
🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code Kind Clause Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/Experience.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ExperienceOutcome.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ExperienceStatus.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpa.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaIframe.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaInfo.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaToken.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionPreferredExperiences.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionScheme.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionsCardMetadataResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ThreeDSErrorDetails.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ThreeDSInfo.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/TransactionType.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/CreateSessionAcceptedResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/GetSessionResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionSchemeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/TransactionTypeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

  • classifying — this rule contributed to the chosen tier.
  • informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

wall-e 2026.06.19-02 · debug

@agent-wall-e

agent-wall-e Bot commented Aug 6, 2026

Copy link
Copy Markdown

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

  • security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/Experience.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/ExperienceOutcome.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/ExperienceStatus.java
  • security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java

Operational gates

  • ✅ jira_ticket (INT-1667)
  • ✅ independent_review

Files analysed: 27

wall-e 2026.06.19-02 · policy 376219bc71e6…

@agent-wall-e

agent-wall-e Bot commented Aug 6, 2026

Copy link
Copy Markdown
🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code Kind Clause Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/Experience.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ExperienceOutcome.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ExperienceStatus.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpa.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaIframe.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaInfo.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GoogleSpaToken.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionPreferredExperiences.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionScheme.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionsCardMetadataResponse.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ThreeDSErrorDetails.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/ThreeDSInfo.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/TransactionType.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/CreateSessionAcceptedResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/GetSessionResponseSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionSchemeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/TransactionTypeTest.java classifying §2.1 M4/M5 Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

  • classifying — this rule contributed to the chosen tier.
  • informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

wall-e 2026.06.19-02 · debug

@sonarqubecloud

sonarqubecloud Bot commented Aug 6, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
4.0% Duplication on New Code

See analysis details on SonarQube Cloud

@david-ruiz-cko
david-ruiz-cko merged commit 2048fe2 into master Aug 6, 2026
6 checks passed
@david-ruiz-cko
david-ruiz-cko deleted the feature/INT-1667 branch August 6, 2026 08:13
@armando-rodriguez-cko armando-rodriguez-cko mentioned this pull request Aug 6, 2026
Merged
david-ruiz-cko added a commit that referenced this pull request Aug 6, 2026
@david-ruiz-cko
Release 7.15.0 (#645)
33f0888 
Release 7.15.0 bundles the 3DS challenge indicator alignment plus a broader refresh of the Sessions model (#631), and a dependency/security update (#632).

### 3DS Challenge Indicator Modeling

* Introduced a new `SessionChallengeIndicator` enum in `sessions` to represent all nine possible challenge indicator values for session endpoints, including exemption requests, with detailed documentation for each value. (`src/main/java/com/checkout/sessions/SessionChallengeIndicator.java`)
* Updated `ChallengeIndicator` in `common` to clarify its use for payment-related endpoints and to deprecate exemption values, which are now only valid for sessions. Improved documentation for each enum value and marked exemptions as deprecated. (`src/main/java/com/checkout/common/ChallengeIndicator.java`)
* Changed the type of the `challengeIndicator` field in both `CreateSessionAcceptedResponse` and `GetSessionResponse` from `ChallengeIndicator` to `SessionChallengeIndicator`, ensuring correct deserialization and alignment with API behaviour.
* Removed the now unnecessary imports of `ChallengeIndicator` from `CreateSessionAcceptedResponse`, `GetSessionResponse` and `SessionRequest`.

### Sessions Model Additions

* Added Google SPA support with four new classes: `GoogleSpa`, `GoogleSpaInfo`, `GoogleSpaIframe` and `GoogleSpaToken`. (`src/main/java/com/checkout/sessions/GoogleSpa*.java`)
* Added the preferred experiences model: `SessionPreferredExperiences`, `Experience`, `ExperienceStatus` and `ExperienceOutcome`.
* Added `ThreeDSInfo` and `ThreeDSErrorDetails` to model the 3DS information and error detail objects returned by the session endpoints.
* Added the `SessionScheme` enum with the full set of spec values, replacing loosely typed scheme fields.
* Extended `SessionRequest` with the new fields (Google SPA, preferred experiences, device information) and fixed the `priorTransactionReference` handling.
* Updated `TransactionType` and `SessionsCardMetadataResponse` to match the current spec.

### Documentation

* Added comprehensive Javadoc for every field in `CreateSessionAcceptedResponse`, `GetSessionResponse` and `SessionRequest`, clarifying requirements, formats, patterns and default values.

### Test Coverage

* New serialization suites: `CreateSessionAcceptedResponseSerializationTest`, `GetSessionResponseSerializationTest`, `SessionRequestSerializationTest`.
* New enum conformance suites: `ChallengeIndicatorTest`, `SessionChallengeIndicatorTest`, `SessionSchemeTest`, `TransactionTypeTest`.
* Updated the sessions integration tests (`AbstractSessionsTestIT`, `RequestAndGetSessionsTestIT`) for the new indicator type.

### Security and Dependency Update

Dependency updates:
- sonarqube to 7.3.1.8318
- log4j to `log4j-api:2.25.5`, `log4j-core:2.25.5`, `log4j-slf4j2-impl:2.25.5`

Dependabot configuration:

* Added a `test-deps` group to combine updates for testing-related dependencies (`org.junit*`, `org.mockito*`, `org.apache.logging.log4j*`, `org.hamcrest*`) into single pull requests.
* Increased `open-pull-requests-limit` to 10 for the main package ecosystem.
* Added a `github-actions` ecosystem entry with a weekly update schedule.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@armando-rodriguez-cko armando-rodriguez-cko armando-rodriguez-cko approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@david-ruiz-cko @armando-rodriguez-cko