Enterprise Improvements

Overview

This roadmap tracks 27 improvements identified across all 9 repositories, ranked by severity. Improvements are grouped into three milestones.

Milestone 1 — Critical Security Fixes

1. Hardcoded Vault AppRole credentials in bootstrap.yml ✅

Files:

• arya-banking-auth-service/bootstrap.yml
• arya-banking-user-service/bootstrap.yml
• arya-banking-admin-service/bootstrap.yml

Fixed: Each service now uses a gitignored vault-credentials.yml file at its project root, imported via spring.config.import: "optional:file:./vault-credentials.yml". The bootstrap.yml contains only placeholder values that are overridden by the local file.

# bootstrap.yml
spring:
  config:
    import: "optional:file:./vault-credentials.yml"
  cloud:
    vault:
      app-role:
        role-id: placeholder
        secret-id: placeholder

# vault-credentials.yml (gitignored — not committed)
spring:
  cloud:
    vault:
      app-role:
        role-id: <actual-role-id>
        secret-id: <actual-secret-id>

2. Hardcoded Keycloak client secret in API Gateway

File: arya-banking-api-gateway/src/main/resources/application.yaml

Current (vulnerable) code:

    registration:
      banking-service-client:
        provider: keycloak
        client-id: banking-service-client
        client-secret: FMrBssX0Lk92Uwep4zQitLIRChUfffGs

Problem: The OAuth2 client secret for the gateway's banking-service-client is in plaintext. This secret is used in the Authorization Code flow and can be extracted from the repo.

3. Hardcoded MongoDB Atlas password

File: arya-banking-common/src/main/resources/application.yaml

Current (vulnerable) code:

spring:
  data:
    mongodb:
      uri: mongodb+srv://admin:ka3k912719@bankingcluster.ayhvgpk.mongodb.net/metadata?retryWrites=true&w=majority&appName=bankingCluster

Problem: The MongoDB Atlas admin password is in plaintext. This gives full database access to anyone with repo access. This connection string is also bundled into the arya-banking-common JAR published to GitHub Packages.

4. Vault unseal keys committed to git

File: arya-banking-infra/scripts/vault/init/keys_raw.json

Content (currently exposed):

{
  "unseal_keys_b64": ["sMgMGskdSogAO7dcFPBeWr35qhCnWuNV8wRgxhIX6cyU", ...],
  "root_token": "hvs.<redacted>"
}

Problem: Five unseal keys and the root token are committed in a JSON file. This compromises the entire Vault instance.

5. SCM URL points to wrong repository

File: arya-banking-auth-service/pom.xml

Current (wrong) code:

<scm>
  <connection>scm:git:https://github.com/Event-Based-Banking-Application/arya-banking-common</connection>
  <developerConnection>scm:git@github.com:Event-Based-Banking-Application/arya-banking-common.git</developerConnection>
  <url>https://github.com/Event-Based-Banking-Application/arya-banking-common</url>
</scm>

Problem: The auth service's pom.xml references arya-banking-common instead of arya-banking-auth-service. This breaks Maven release plugins, automated changelogs, and IDE integrations.

Milestone 2 — Architecture & Reliability

6. Missing Dockerfiles for business microservices

Files: Missing from arya-banking-auth-service/, arya-banking-user-service/, arya-banking-admin-service/

Current state: These three services have no Dockerfile. Only api-gateway, service-registry, and config-server are containerized.

Problem: Without Dockerfiles, these services cannot be deployed in the Docker Compose platform stack. They must be run manually via Maven or IDE, meaning the full system cannot be started with make up.

7. Missing Docker publish CI/CD workflows

Files: Missing .github/workflows/docker-publish.yml from auth-service, user-service, admin-service

Current state: arya-banking-api-gateway has a docker-publish.yml that builds and pushes to Docker Hub on version tags. The business services have none.

Problem: No automated image builds. Every deployment requires manual docker build and docker push.

8. Tests are all empty stubs

Files: All src/test/java/**/*ApplicationTests.java across every service

Current state:

@SpringBootTest
class AryaBankingXxxServiceApplicationTests {
    void contextLoads() {  // Missing @Test, no assertions
    }
}

Problem: Every test class is a stub. Some are missing the @Test annotation so they don't execute. There are zero assertions in the entire codebase.

9. Duplicate Docker Compose definitions

Files:

• arya-banking-infra/compose/kafka.yml
• arya-banking-common/docker-compose.yaml
• arya-banking-auth-service/docker-compose.yaml

Current state: Kafka is defined in 3 places; Keycloak + PostgreSQL appear in both infra/compose/keycloak.yml and auth-service/docker-compose.yaml. Each copy has slightly different configurations and ports. The auth-service compose file uses an invalid version string version: '1.0'.

Problem: Config drift between copies. Developers may start the wrong one and waste time debugging connectivity.

10. Gateway routes use host.docker.internal

File: arya-banking-configs/application.yml

Current code:

spring:
  cloud:
    gateway:
      server:
        webflux:
          routes:
            - id: user-service
              uri: http://host.docker.internal:8086

Problem: host.docker.internal only works on Docker Desktop (Windows/Mac). It fails on Linux hosts and in CI/CD runners. This also bypasses Eureka service discovery. Additionally, spring.cloud.gateway.server.webflux.routes may not be the correct key structure for Spring Cloud Gateway 2025.0.0 — the standard key is spring.cloud.gateway.routes.

11. No circuit breakers on Feign clients

Files:

• arya-banking-auth-service/src/main/java/org/arya/banking/auth/external/UserService.java
• arya-banking-user-service/src/main/java/org/arya/banking/user/external/KeyCloakService.java
• All other @FeignClient declarations across services

Current code:

@FeignClient(name = "ARYA-BANKING-USER-SERVICE", configuration = FeignConfiguration.class)
public interface UserService {
    @PutMapping("/internal/api/security-details/{userId}")
    ResponseEntity<Map<String, String>> updateLoginAttempts(...);
}

Problem: If the downstream service is down or slow, the Feign client blocks the caller thread until timeout. No fallback, no circuit breaker. A single degraded service can cascade failures across the entire system.

12. No Docker publish for platform services

Files: Missing .github/workflows/docker-publish.yml from service-registry, config-server

Current state: These services have Dockerfiles but no CI/CD pipeline to publish images. The api-gateway has one — the platform services don't.

Problem: Images must be built and pushed manually. Version tags on GitHub don't automatically trigger releases.

13. Missing @Test annotation

Files:

• arya-banking-auth-service/src/test/.../AryaBankingAuthServiceApplicationTests.java
• arya-banking-user-service/src/test/.../AryaBankingUserServiceApplicationTests.java

Current code:

@SpringBootTest
class ...Tests {
    void contextLoads() {  // Missing @Test
    }
}

Problem: Without @Test, these methods are never executed by JUnit. Developers get no feedback on whether the application context starts correctly.

Milestone 3 — Code Quality & Observability

14. Sonar exclusions too broad

Files: All pom.xml files

Current config:

<sonar.coverage.exclusions>**/config/**,**/dto/**,**/constants/**,**/mapper/**,
**/repository/**,**/model/**,**/metadat/**, **/exception/**,**/*Application.java</sonar.coverage.exclusions>

Problem: Almost every package is excluded from coverage. Only controller and service implementation classes are measured, giving a false sense of coverage.

15. No distributed tracing

Files: All services — missing micrometer-tracing and Brave dependencies

Current state: No correlation ID is propagated across service boundaries. When a request flows Gateway → Auth Service → User Service, there is no way to trace it across logs.

16. No rate limiting on API Gateway

File: arya-banking-api-gateway

Current state: The gateway has no RequestRateLimiter filter. A malicious client can flood all downstream services.

17. Missing API documentation

Files: arya-banking-auth-service, arya-banking-service-registry, arya-banking-config-server

Current state: Only user-service and admin-service have springdoc-openapi dependency. The other services have no Swagger/OpenAPI documentation.

18. Invalid Docker Compose version string

File: arya-banking-auth-service/docker-compose.yaml

Current code:

version: '1.0'

Problem: Docker Compose doesn't recognize 1.0 as a valid version. Valid values are 3.8, 3.9, etc., or omit the version key entirely (Docker Compose v2 ignores it).

19. Service Registry Dockerfile exposes wrong port

File: arya-banking-service-registry/Dockerfile

Current code:

EXPOSE 8080

Problem: The Eureka server runs on port 8761, but the Dockerfile advertises port 8080. Container metadata is misleading.

20. Config Server Eureka URL typo

File: arya-banking-config-server/src/main/resources/application.yaml

Current code:

eureka:
  client:
    service-url:
      defaultZone: http://localhosat:8761/eureka

Problem: localhosat is a typo of localhost. The Config Server fails to register with Eureka and downstream services can't discover it.

21. No .env.example files

Files: All 9 repos

Current state: No documentation of required environment variables exists in any repo. New developers must read the source code to discover what to set.

22. Placeholder values in add-secrets.sh

Files: All add-secrets.sh across all repos

Current code:

SONAR_TOKEN={ sonar-token }
SONAR_PROJECT_KEY={ project_key }
SONAR_ORG={ sonar-org }

Problem: The script references SonarCloud tokens with unreplaced placeholders. Running it without editing will set invalid values as GitHub secrets.

23. No startup retry for Keycloak initialization

Files:

• arya-banking-auth-service/.../service/KeyCloakManager.java
• arya-banking-admin-service/.../service/KeyCloakManager.java

Current code:

@PostConstruct
public void init() {
    keycloak = KeycloakBuilder.builder()
            .serverUrl(serverUrl)
            .realm(keyCloakRealm)
            .clientId(clientId)
            .clientSecret(clientSecret)
            .grantType(CLIENT_CREDENTIALS)
            .build();
}

Problem: If Keycloak isn't ready when this @PostConstruct fires, the entire service fails to start. No retry mechanism.

24. No README files

Files: All service repos except arya-banking-common

Current state: Only arya-banking-common has a README. 6 service repos have none.

Problem: New contributors have no guidance on purpose, tech stack, how to run, or environment variables.

25. No CONTRIBUTING.md

Files: Root / all repos

Current state: No development setup guide anywhere.

Problem: No documented conventions for branching, PR process, coding standards, or local dev setup.

26. Gateway routes key may be incorrect

File: arya-banking-configs/application.yml

Current code:

spring:
  cloud:
    gateway:
      server:
        webflux:
          routes:

Problem: The server.webflux nesting may not be the correct key structure for Spring Cloud Gateway 2025.0.0. The standard documented key is spring.cloud.gateway.routes. This needs validation against the actual Spring Cloud Gateway 2025.0.0 behavior.

27. Missing LICENSE files

Files: All repos

Current state: pom.xml declares Apache 2.0 but no LICENSE.txt file exists in any repo.

28. Centralize dependency management via a company BOM

Files: All service pom.xml files, arya-banking-common/pom.xml

Current approach: arya-banking-common bundles ~15 dependencies at compile scope (web, MongoDB, Kafka, OAuth2, springdoc, etc.) and every service consumes it as a single dependency, relying on Maven transitive resolution to get everything it needs.

Problems:

1. No classpath isolation — auth-service doesn't use MongoDB or Avro, but gets them transitively from common anyway. Larger artifacts, slower startup, more surface area.
2. Tight coupling — Bumping kafka-avro-serializer in common forces a rebuild of every service, even auth-service which has no Kafka usage.
3. Implicit contracts — Services don't declare their actual dependencies. A new developer can't tell what user-service needs just by reading its POM. If common is later trimmed, services break silently.
4. Version drift — common runs on SB 3.5.3 while services run on 3.5.4. Maven's nearest-wins resolution can produce unpredictable classpath mixes.
5. Hidden runtime risks — commons-io and commons-codec are imported in common's Java source but not declared in its POM. They arrive transitively today via kafka-avro-serializer/spring-kafka; if that chain ever changes, common breaks at runtime with no compile-time warning.
6. Lombok at wrong scope — Lombok is at compile scope in common (line 96-99), leaking into all service runtime classpaths when it should be provided.

Recommended approach: Introduce a arya-banking-bom artifact — a standalone POM that centrally manages all third-party versions. Each service imports the BOM in <dependencyManagement> and declares only what it actually needs. Common is slimmed down to shared domain models, utilities, and event abstractions only, with infrastructure concerns moved to the services that use them.

Quick Stats