Access Control & Consent Management

// AccessRequest.java
@Entity
@Table(name = "access_requests")
public class AccessRequest {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @ManyToOne(optional = false)
    @JoinColumn(name = "entity_id")
    private IssuingEntity entity; // Requesting organization
    
    @ManyToOne(optional = false)
    @JoinColumn(name = "person_id")
    private Person person; // Document owner
    
    @Column(name = "purpose", length = 300)
    private String purpose; // Justification for request
    
    @Enumerated(EnumType.STRING)
    @Column(name = "status")
    private AccessRequestStatus status; // PENDIENTE, APROBADA, RECHAZADA, EXPIRADA
    
    @Column(name = "requested_at")
    private LocalDateTime requestedAt;
    
    @Column(name = "decided_at")
    private LocalDateTime decidedAt;
    
    @Column(name = "expires_at")
    private LocalDateTime expiresAt;
    
    @Column(name = "decision_note")
    private String decisionNote;
    
    @OneToMany(mappedBy = "accessRequest", cascade = CascadeType.ALL)
    private List<AccessRequestItem> items;
}

// AccessRequestService.java:326
@Transactional(readOnly = true)
public Resource loadApprovedDocumentResource(Long entityId, Long requestId, 
                                            Long personDocumentId) {
    
    AccessRequest request = accessRequestRepository.findByIdWithDetails(requestId)
        .orElseThrow(() -> new IllegalArgumentException("Solicitud no encontrada"));
    
    // Authorization: entity owns request
    if (!request.getEntity().getId().equals(entityId)) {
        throw new IllegalArgumentException("No autorizado para consultar esta solicitud");
    }
    
    // Status: must be approved
    if (request.getStatus() != AccessRequestStatus.APROBADA) {
        throw new IllegalArgumentException("La solicitud no está aprobada");
    }
    
    // Expiration check
    if (request.getExpiresAt() != null && 
        request.getExpiresAt().isBefore(LocalDateTime.now())) {
        throw new IllegalArgumentException("La solicitud se encuentra expirada");
    }
    
    // Document must be in request items
    boolean requested = request.getItems().stream()
        .anyMatch(i -> i.getPersonDocument().getId().equals(personDocumentId));
    if (!requested) {
        throw new IllegalArgumentException("El documento no pertenece a la solicitud");
    }
    
    // Load document and latest file version
    PersonDocument pd = personDocumentRepository.findByIdWithFiles(personDocumentId)
        .orElseThrow(() -> new IllegalArgumentException("Documento no encontrado"));
    
    FileRecord latest = pd.getFiles().stream()
        .max(Comparator.comparingInt(fr -> fr.getVersion() != null ? fr.getVersion() : 0))
        .orElseThrow(() -> new IllegalArgumentException("El documento no tiene archivos válidos"));
    
    // Validate document exists in Fabric
    FabricDocView matchedDoc = ensureDocumentPresentInFabric(request, pd, latest);
    
    // Load file resource
    Resource resource = fileStorageService.loadAsResource(latest);
    
    // Record access event in Fabric
    recordAuditStrict(request, pd, matchedDoc, "DOC_VIEW_GRANTED", "OK",
                     "Consulta de documento autorizada", "VIEW_DOCUMENT",
                     "ISSUER", String.valueOf(entityId));
    
    return resource;
}

// SignedUrlService.java
@Service
public class SignedUrlService {
    
    @Value("${app.security.signed-urls.secret}")
    private String secret;
    
    @Value("${app.security.signed-urls.ttl-seconds:3600}")
    private int ttlSeconds;
    
    public String generateSignedUrl(String basePath, Map<String, String> params) {
        long expiresAt = System.currentTimeMillis() / 1000 + ttlSeconds;
        params.put("expires", String.valueOf(expiresAt));
        
        String signature = calculateHmacSha256(buildQueryString(params), secret);
        params.put("signature", signature);
        
        return basePath + "?" + buildQueryString(params);
    }
    
    public boolean validateSignedUrl(Map<String, String> params) {
        String providedSignature = params.remove("signature");
        String expiresStr = params.get("expires");
        
        // Check expiration
        long expires = Long.parseLong(expiresStr);
        if (System.currentTimeMillis() / 1000 > expires) {
            return false;
        }
        
        // Verify signature
        String expectedSignature = calculateHmacSha256(buildQueryString(params), secret);
        return MessageDigest.isEqual(
            expectedSignature.getBytes(), 
            providedSignature.getBytes()
        );
    }
}

// AccessRequestService.java:151
request.setExpiresAt(LocalDateTime.now().plusDays(15));

// FabricAuditCliService.java
public record AuditCommand(
    String idType,              // CC, TI, etc.
    String idNumber,            // Person's ID
    String eventType,           // DOC_VIEW_GRANTED, etc.
    Long accessRequestId,       // Request ID
    Long personDocumentId,      // Document ID
    String fabricDocId,         // Fabric ledger reference
    String documentTitle,       // Human-readable title
    Long entityId,              // Requesting entity ID
    String entityName,          // Entity name
    String action,              // VIEW_DOCUMENT, etc.
    String result,              // OK or FAIL
    String reason,              // Explanation or error
    String actorType,           // ISSUER, USER, ADMIN
    String actorId,             // Actor identifier
    String source               // CCDIGITAL_SPRING
) {}

// AccessRequestService.java:643
private Optional<FabricDocView> findMatchingFabricDoc(List<FabricDocView> fabricDocs,
                                                      PersonDocument pd, 
                                                      FileRecord latest) {
    String dbRelativePath = normalizePath(latest.getStoragePath());
    String title = pd.getDocumentDefinition().getTitle();
    
    return fabricDocs.stream()
        .filter(doc -> matchesFilePath(doc.filePath(), dbRelativePath) 
                    || matchesTitle(doc.title(), title))
        .findFirst();
}

private boolean matchesFilePath(String fabricPath, String dbRelativePath) {
    String fabricNorm = normalizePath(fabricPath);
    String dbNorm = normalizePath(dbRelativePath);
    
    return fabricNorm.equals(dbNorm)
        || fabricNorm.endsWith("/" + dbNorm)
        || fabricNorm.endsWith(dbNorm);
}