forked from Shared/esg
s.hajizadeh
61098f1bf4
Introduce plate, chassis, and third-party car endpoints, a wall-clock inquiry deadline with transport-only retries, and ownership-safe no-match errors so another person's identity never leaks. Co-authored-by: Cursor <cursoragent@cursor.com>
40 lines
2.5 KiB
Markdown
40 lines
2.5 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project are documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
|
|
- Car inquiry endpoints:
|
|
- `POST /inquiry/carByPlate` — insurance inquiry by plate (provider passthrough)
|
|
- `POST /inquiry/carByChassis` — insurance inquiry by chassis/VIN
|
|
- `POST /inquiry/thirdPartyCar` — third-party car inquiry with provider-specific policy selection
|
|
- New inquiry types: `CAR_BY_PLATE`, `CAR_BY_CHASSIS`, `THIRD_PARTY_CAR` (legacy `CAR_PLATE` remains, marked deprecated)
|
|
- Shared CentInsur SOAP client and provider support for plate / chassis / national-code car policy lookups
|
|
- Third-party car selection rules: passenger vehicle groups, current Jalali-year overlap, active-policy preference, and plate + national-code merge (including zero-km plates)
|
|
- Provider resilience layer: wall-clock inquiry deadline (`INQUIRY_DEADLINE_MS`, default 90s), transport-only retries, per-attempt timeouts, and an attempt trail
|
|
- `attemptSummary` on inquiry responses — always on failure; on success only when a retry occurred
|
|
- `INQUIRY_DEADLINE_EXCEEDED` error (HTTP 504) with Persian translation
|
|
- Car ownership safety helpers: ownership mismatch is returned as a generic no-match (no owner national code, no conflict map)
|
|
- Generalized `inquiry_result_cache` collection and service (replaces person-only cached-inquiry-result)
|
|
- Unit tests for car privacy, provider resilience, and timeout/deadline behavior
|
|
|
|
### Changed
|
|
|
|
- Retry helper honors an absolute deadline and records per-attempt outcomes
|
|
- Orchestrator initializes a deadline and attempt trail, and does not fall through to another provider on business outcomes (`INQUIRY_NO_MATCH`, `RECORD_NOT_FOUND`, `SHEBA_MISMATCH`, validation)
|
|
- Base provider, Amitis, Moallem, Parsian, and Tejarat No use the shared resilience runner
|
|
- Tejarat No now covers person, Shahkar, real-estate, and the new car inquiry types (OAuth on accounts host, REST on inquiry gateway)
|
|
- General token service supports more resilient auth login/refresh
|
|
- Inquiry logs persist `attemptSummary`
|
|
- Payload masking also covers `nationalId`, `ntnlid`, and `policyOwnerNationalCode`
|
|
- Conflict payloads no longer include another person's national code or identity fields
|
|
|
|
### Security
|
|
|
|
- Car inquiry ownership mismatch is indistinguishable from "no result" so callers cannot discover who a plate or chassis belongs to
|
|
- Public error payloads are checked so another party's national code cannot leak
|