FraudCheckClient.java

package com.checkout.paymentgw.payment.client;

import com.checkout.paymentgw.payment.api.dto.PostPaymentRequest;
import io.github.resilience4j.circuitbreaker.annotation.CircuitBreaker;
import io.github.resilience4j.timelimiter.annotation.TimeLimiter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import org.springframework.web.client.RestClient;

import java.util.Map;

/**
 * Calls {@code fraud-check-service}. On failure / timeout this client returns
 * {@link FraudDecision#allow()} so the payment is not blocked by an unavailable
 * dependency. The fallback is a deliberate <strong>business decision</strong>
 * (see ADR-0006) and can be flipped via configuration.
 */
@Component
public class FraudCheckClient {

    private static final Logger LOG = LoggerFactory.getLogger(FraudCheckClient.class);

    private final RestClient http;
    private final boolean failOpen;

    public FraudCheckClient(RestClient.Builder builder,
                            @Value("${payment.fraud-check-base-url}") String baseUrl,
                            @Value("${payment.fraud-fail-open:true}") boolean failOpen) {
        this.http = builder.baseUrl(baseUrl).build();
        this.failOpen = failOpen;
    }

    @CircuitBreaker(name = "fraudCheck", fallbackMethod = "fallback")
    @TimeLimiter(name = "fraudCheck")
    public FraudDecision evaluate(String merchantId, PostPaymentRequest request) {
        Map<?, ?> response = http.post()
                .uri("/internal/screen")
                .header("X-Merchant-Id", merchantId)
                .body(request)
                .retrieve()
                .body(Map.class);
        String decision = response == null ? "ALLOW" : String.valueOf(response.get("decision"));
        return new FraudDecision(decision);
    }

    @SuppressWarnings("unused") // resolved by name by Resilience4j
    public FraudDecision fallback(String merchantId, PostPaymentRequest request, Throwable t) {
        LOG.warn("fraud-check fallback for merchant={} cause={}", merchantId, t.toString());
        return failOpen ? FraudDecision.allow() : FraudDecision.review();
    }
}