Commonalities 8.0.0 alignment and fix validation warnings

[GillesInnov35]

Commonalities 8.0.0 alignment and fix validation warnings

What type of PR is this?

Add one of the following kinds:

• enhancement/feature

What this PR does / why we need it:

align specifications with Commonalities 8.0.0 (include common artifacts reference) and fix validation warnings

Which issue(s) this PR fixes:

Fixes #56 and #51

Special notes for reviewers:

Changelog input

 release-note

Additional documentation

This section can be blank.

docs

[camara-validation]

CAMARA Validation — PASS (with warnings)

0 errors, 2 warnings, 19 hints | Profile: standard

View full results

[ToshiWakayama-KDDI]

Thanks very much, @GillesInnov35 .

I have one quick question for clarification.

Between L.260 and L.366, maxLength has been added to each of the response parameters. I was wondering what the rationale is behind this. While adding maxLength to request parameters for security reasons makes perfect sense, doing the same for response parameters doesn't seem to have the same security justification.

Could you please clarify the intent, or point me to any related issues or discussions I should refer to?

Many thanks,
Toshi

[ToshiWakayama-KDDI]

Hi @GillesInnov35 , Hi @fernandopradocabrillo ,
Can we proceed with this PR, as the M3 deadline has passed.

Thanks,

[ToshiWakayama-KDDI]

Hi @GillesInnov35 , @fernandopradocabrillo ,
Regarding adding maxLength to the response parameters, I have reviewed API Design Guide, Commonalities past discussions, OWASP API Security Top 10 (2023) and so on, and now I understand it is needed. So my question above is cleared. I will approve this PR now.

Thanks,

[ToshiWakayama-KDDI]

LGTM. Thanks, @GillesInnov35 .

[GillesInnov35]

thanks @ToshiWakayama-KDDI . @fernandopradocabrillo coudl you take a look at this PR and approve if OK. Many thanks

[ToshiWakayama-KDDI]

Thanks, @GillesInnov35 . LGTM.

[ToshiWakayama-KDDI]

Thanks, @GillesInnov35 .
So you have just changed maxLength of idDocumentExpiryDate and birthdate from 16 to 10, which is fine with me.

I think I commented for either of kyc-match, kyc-fill-in, or Age Verification that we should wait for the Commonalities update (patch) regarding maxLength of date format, however, now I think we don't have to wait.

I will re-approve this PR right now. Thanks.

[ToshiWakayama-KDDI]

Oh, @GillesInnov35 , you are doing with Issue #80 kyc-match as well. I think I should wait for a while.

[PedroDiez]

Main comments:

• For Errors 400, 403, 404, 422 need to keep local references (using the ones from local copy of CAMARA_common.yaml, makes some error codes not designed to appear)

• Suggest to use the same approach for Iso3166 alpha-2 fields as in KYC-Match

[PedroDiez]

To be aligned makes sense to use the same approach as KYC-Match
camaraproject/KnowYourCustomerMatch#81