[slominskir-coding-agent]

A second signoff change for the same group and component within one second currently violates GROUP_SIGNOFF_HISTORY_AK1 and rolls back. Allow each event to be recorded using its existing sequence-generated history ID, and preserve the old lookup columns with a nonunique index.

Remove the one-second workaround from MaskingRequestIT and add a regression that rapidly masks, unmasks, and masks a new component, then checks that all three events appear separately and in order in the signoff activity report.

Fixes #50

Upgrade existing databases

Fresh databases get the updated schema from container/oracle/initdb.d/02_ddl.sql. Existing databases need the following SQL in the application PDB before using the fix:

ALTER TABLE SRM_OWNER.GROUP_SIGNOFF_HISTORY
    DROP CONSTRAINT GROUP_SIGNOFF_HISTORY_AK1;

CREATE INDEX SRM_OWNER.GROUP_SIGNOFF_HISTORY_IN1
    ON SRM_OWNER.GROUP_SIGNOFF_HISTORY
       (GROUP_ID, SYSTEM_ID, COMPONENT_ID, MODIFIED_DATE);

The primary key on GROUP_SIGNOFF_HISTORY_ID remains in place. The upgrade was exercised against a disposable database initialized from the original schema.

Validation

• ./gradlew build passed (compilation, formatting checks, and 90 unit tests).
• Demonstrated the new regression failing against the original constraint: HTTP 400 with ConstraintViolationException; the app log records ORA-00001 on GROUP_SIGNOFF_HISTORY_AK1. The same test passed after applying the upgrade SQL.
• Rebuilt the working-tree app image, recreated the isolated Oracle database from the updated initialization scripts, restarted the app, and ran the complete ./gradlew integrationTest suite successfully (60 tests, no skips). The mask acceptance test passes without its former delay.
• Checked the HTTP entry page and the filtered signoff activity report in headless Chromium. Rapid mask/unmask changes render as separate history rows in the expected order, with no browser page errors. Queried Oracle to confirm all four history rows (creation and three mask changes) for each of the five responsible groups share the same whole-second timestamp and retain distinct history IDs.
• Inspected the rebuilt app and database logs: no Oracle constraint errors or unexpected application errors; the authorization tests produce their expected denied-access EJB errors. All schema objects are valid.

The VM's default ports were occupied. With user approval, checks used Compose project srm-issue50, a temporary port override, SRM_URL=https://localhost:28443/srm, KEYCLOAK_URL=http://localhost:28081/auth, and MAILHOG_URL=http://localhost:28025. Docker dependency downloads required a host-network build (docker buildx build --network host --allow network.host --load -t srm-issue50-srm .), followed by Compose startup from that image. The local logbook endpoint was disabled.

Decisions

Use the existing history ID as the event identity and replace timestamp uniqueness with a nonunique index. Increasing timestamp precision would still make event identity depend on clock resolution and would require changing both date columns and their producers. The user approved isolated services on unused ports; existing services were left running.

Prepared-by: OpenAI Codex:GPT-6