This microservice is responsible for expose stats for user performing transactions on eCommerce.

Those stats include information about the latest used payment method for a transaction

• PagoPA eCommerce user stats service
  • Api Documentation 📖
  • Technology Stack
  • Start Project Locally 🚀
    • Prerequisites
    • Run docker container
  • Develop Locally 💻
    • Prerequisites
    • Run the project
    • Testing 🧪
      • Unit testing
      • Integration testing
      • Performance testing
  • Dependency management 🔧
    • Dependency lock
    • Dependency verification
  • Contributors 👥
    • Maintainers

See the OpenAPI 3 here.

• Kotlin
• Spring Boot

• docker

The microservice needs a valid .env file in order to be run.

If you want to start the application without too much hassle, you can just copy .env.example with

$ cp .env.example .env

to get a good default configuration.

If you want to customize the application environment, reference this table:

(*): for Mongo connection string options see docs

$ docker compose up --build

• git
• gradle
• jdk-21
• kotlin 1.9

$ export $(grep -v '^#' .env.local | xargs)
$ ./gradlew bootRun

To run the Junit tests:

$ ./gradlew test

TODO

install k6 and then from ./performance-test/src

1. k6 run --env VARS=local.environment.json --env TEST_TYPE=./test-types/load.json main_scenario.js

For support reproducible build this project has the following gradle feature enabled:

• dependency lock
• dependency verification

This feature use the content of gradle.lockfile to check the declared dependencies against the locked one.

If a transitive dependencies have been upgraded the build will fail because of the locked version mismatch.

The following command can be used to upgrade dependency lockfile:

./gradlew dependencies --write-locks 

Running the above command will cause the gradle.lockfile to be updated against the current project dependency configuration

This feature is enabled by adding the gradle ./gradle/verification-metadata.xml configuration file.

Perform checksum comparison against dependency artifact (jar files, zip, ...) and metadata (pom.xml, gradle module metadata, ...) used during build and the ones stored into verification-metadata.xml file raising error during build in case of mismatch.

The following command can be used to recalculate dependency checksum:

./gradlew --write-verification-metadata sha256 clean spotlessApply build --no-build-cache --refresh-dependencies

In the above command the clean, spotlessApply build tasks where chosen to be run in order to discover all transitive dependencies used during build and also the ones used during spotless apply task used to format source code.

The above command will upgrade the verification-metadata.xml adding all the newly discovered dependencies' checksum. Those checksum should be checked against a trusted source to check for corrispondence with the library author published checksum.

/gradlew --write-verification-metadata sha256 command appends all new dependencies to the verification files but does not remove entries for unused dependencies.

This can make this file grow every time a dependency is upgraded.

To detect and remove old dependencies make the following steps:

1. Delete, if present, the gradle/verification-metadata.dryrun.xml
2. Run the gradle write-verification-metadata in dry-mode (this will generate a verification-metadata-dryrun.xml file leaving untouched the original verification file)
3. Compare the verification-metadata file and the verification-metadata.dryrun one checking for differences and removing old unused dependencies

The 1-2 steps can be performed with the following commands

rm -f ./gradle/verification-metadata.dryrun.xml 
./gradlew --write-verification-metadata sha256 clean spotlessApply build --dry-run

The resulting verification-metadata.xml modifications must be reviewed carefully checking the generated dependencies checksum against official websites or other secure sources.

If a dependency is not discovered during the above command execution it will lead to build errors.

You can add those dependencies manually by modifying the verification-metadata.xml file adding the following component:

<verification-metadata>
    <!-- other configurations... -->
    <components>
        <!-- other components -->
        <component group="GROUP_ID" name="ARTIFACT_ID" version="VERSION">
            <artifact name="artifact-full-name.jar">
                <sha256 value="sha value"
                        origin="Description of the source of the checksum value"/>
            </artifact>
            <artifact name="artifact-pom-file.pom">
                <sha256 value="sha value"
                        origin="Description of the source of the checksum value"/>
            </artifact>
        </component>
    </components>
</verification-metadata>

Add those components at the end of the components list and then run the

./gradlew --write-verification-metadata sha256 clean spotlessApply build --no-build-cache --refresh-dependencies

that will reorder the file with the added dependencies checksum in the expected order.

Finally, you can add new dependencies both to gradle.lockfile writing verification metadata running

./gradlew --write-locks --write-verification-metadata sha256 clean spotlessApply build --no-build-cache --refresh-dependencies

For more information read the following article

Made with ❤️ by PagoPA S.p.A.

See CODEOWNERS file