code-review

name	code-review
description	Use when reviewing a KimPay change or PR - applies a payment-gateway-specific checklist covering correctness, security, concurrency, and module hygiene.

Code Review

Review KimPay changes against correctness, security, and architecture. Be specific; cite file:line. Prioritize findings (Critical / Important / Nit).

What to review (in priority order)

1. Money correctness (Critical)

• BigDecimal for all amounts; no float; explicit scale/rounding.
• Refunds cannot exceed remaining; balances cannot go negative.
• State transitions guarded; no direct status mutation.

2. Concurrency (Critical)

• Wallet/idempotency mutations protected by Redisson lock and DB pessimistic lock.
• Locks released in finally; bounded wait/lease; InterruptedException re-interrupts.
• Idempotency enforced with a DB unique constraint as source of truth.

3. Security (Critical)

• Endpoint authenticated and owner-scoped.
• No PAN/secret/private-key/PII in logs or error responses.
• Secrets hashed (BCrypt) or encrypted; nothing sensitive in source/config defaults.
• Input validated at the boundary; error envelope leaks nothing internal.

4. Architecture & hygiene (Important)

• Correct module placement; dependency direction not violated.
• Optional-infra fallbacks via @Configuration @Bean, not conditional @Component.
• Constructor injection; records for DTOs; new ErrorCodes in the enum.
• Prod Flyway migration present and matching the entity mapping.

5. Tests (Important)

• New behavior has tests at the right level; concurrency/security/failure paths covered.
• Full suite green; no flaky/time-dependent assertions.

Output

For each finding: severity, file:line, the problem, and a concrete fix. End with an explicit verdict: Approve, Approve with nits, or Request changes.