Add independent MalwareScanner feature

[Schmarvinius]

Add Independent MalwareScannerService Feature

New Feature

✨ Introduces a standalone MalwareScannerService that can be injected from the CAP service catalog to scan arbitrary content for malware, independently of the AttachmentService. This allows consumers to perform on-demand malware scans without going through the attachment upload flow.

Changes

• MalwareScannerService.java (new): Defines the MalwareScannerService interface with a scanContent(InputStream) method and the SCAN_CONTENT event constant, registered under the name MalwareScannerService$Default.
• MalwareScannerServiceImpl.java (new): Implements MalwareScannerService by creating a MalwareScanEventContext, emitting the scan event, and returning the scan result.
• DefaultMalwareScannerServiceHandler.java (new): Default @On event handler for the MalwareScannerService. Delegates to MalwareScanClient to perform the actual scan. Returns NO_SCANNER if no client binding is available, and FAILED on unexpected errors.
• MalwareScanEventContext.java (new): EventContext interface for the SCAN_CONTENT event, carrying the content InputStream and the resulting MalwareScanResultStatus.
• Registration.java: Registers MalwareScannerServiceImpl as a new service and DefaultMalwareScannerServiceHandler as a new event handler during startup.
• RegistrationTest.java: Updated tests to assert that both AttachmentService and MalwareScannerService are registered, and that DefaultMalwareScannerServiceHandler is included among the registered event handlers. Handler counts updated from 8→9 (full setup) and 1→2 (minimal setup).
• MalwareScannerServiceImplTest.java (new): Parameterized tests verifying that scanContent correctly propagates all MalwareScanResultStatus values and passes the content stream through the event context.
• DefaultMalwareScannerServiceHandlerTest.java (new): Unit tests for the handler covering clean, infected, no-scanner, and error/exception scenarios, as well as annotation verification.
• MalwareScanEventContextTest.java (new): Basic test verifying that MalwareScanEventContext fields can be set and read correctly.

• 🔄 Regenerate and Update Summary

---

📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

PR Bot Information

Version: 1.20.11 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• Correlation ID: aab8a0c0-345f-11f1-8614-8f9ec63b6357
• File Content Strategy: Full file content
• LLM: anthropic--claude-4.6-sonnet
• Output Template: Default Template
• Event Trigger: pull_request.opened
• Summary Prompt: Default Prompt

[hyperspace-insights]

The PR introduces a well-structured independent MalwareScannerService with proper interface/implementation separation, event context, and handler registration. The main concerns raised are: (1) missing test coverage for the ENCRYPTED scan result status in the handler tests, (2) the semantics of the DEFAULT_ON ordering constant warrant clarification to ensure user-provided @On handlers can override the default, and (3) the DEFAULT_NAME Javadoc could better document its dual-use role in both registration and lookup.

PR Bot Information

Version: 1.20.11 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• LLM: anthropic--claude-4.6-sonnet
• Correlation ID: aab8a0c0-345f-11f1-8614-8f9ec63b6357
• File Content Strategy: Full file content
• Event Trigger: pull_request.opened

[lisajulia]

Can you explain this a bit further? The issue https://github.wdf.sap.corp/cds-java/home/issues/1500 says that we should provide a cds-feature-malwarescanner plugin. Does this PR now add such a service which could be in a separate cds-feature-malwarescanner plugin?
Thanks!

[Schmarvinius]

Can you explain this a bit further? The issue https://github.wdf.sap.corp/cds-java/home/issues/1500 says that we should provide a cds-feature-malwarescanner plugin. Does this PR now add such a service which could be in a separate cds-feature-malwarescanner plugin? Thanks!

No I already talked with Max about this, and we were both the opinion we don't need an extra plugin just for malware scanning. Therefore, this PR adds a MalwareScannerService just like the AttachmentService, so Users can manually trigger the malware scanner.

[Schmarvinius]

I'll write ITests!

[hyperspace-insights]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Add Independent MalwareScannerService Feature

New Feature

✨ Introduces a standalone MalwareScannerService that can be injected from the CAP service catalog to scan arbitrary content for malware, independently of the AttachmentService. This allows consumers to perform on-demand malware scans without going through the attachment upload flow.

Changes

• MalwareScannerService.java (new): Defines the MalwareScannerService interface with a scanContent(InputStream) method and the EVENT_SCAN_CONTENT constant, registered under the name MalwareScannerService$Default.
• MalwareScannerServiceImpl.java (new): Implements MalwareScannerService by creating a MalwareScanEventContext, emitting the scan event, and returning the scan result.
• DefaultMalwareScannerServiceHandler.java (new): Default @On event handler for the MalwareScannerService. Delegates to MalwareScanClient to perform the actual scan. Returns NO_SCANNER if no client binding is available, and FAILED on unexpected errors.
• MalwareScanEventContext.java (new): EventContext interface for the SCAN_CONTENT event, carrying the content InputStream and the resulting MalwareScanResultStatus.
• Registration.java: Registers MalwareScannerServiceImpl as a new service and DefaultMalwareScannerServiceHandler as a new event handler during startup.
• pipeline.yml: Added environment variable secrets for malware scanner credentials (Basic Auth and mTLS) to support integration testing in the CI pipeline.
• RegistrationTest.java: Updated tests to assert that both AttachmentService and MalwareScannerService are registered, and that DefaultMalwareScannerServiceHandler is included among the registered event handlers. Handler counts updated from 8→9 (full setup) and 1→2 (minimal setup).
• MalwareScannerServiceImplTest.java (new): Parameterized tests verifying that scanContent correctly propagates all MalwareScanResultStatus values and passes the content stream through the event context.
• DefaultMalwareScannerServiceHandlerTest.java (new): Unit tests for the handler covering clean, infected, encrypted, no-scanner, and error/exception scenarios, as well as annotation verification.
• MalwareScanEventContextTest.java (new): Basic test verifying that MalwareScanEventContext fields can be set and read correctly.
• MalwareScannerClientIT.java (new): Integration tests for DefaultMalwareScanClient supporting both Basic Auth and mTLS authentication, testing against a real malware scanner instance when credentials are available via environment variables.

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.20.11 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• Output Template: Default Template
• Correlation ID: e56726d0-3750-11f1-8e9f-1630d2a135a4
• Summary Prompt: Default Prompt
• Event Trigger: pull_request.ready_for_review
• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content

---

💌 Have ideas or want to contribute? Create an issue and share your thoughts with us!
📑 Check out the documentation for more information.
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

Made with ❤️ by Hyperspace.

[hyperspace-insights]

The PR introduces a well-structured MalwareScannerService with proper CAP service/handler wiring, good test coverage, and clean separation of concerns. Three issues were flagged: a potential null return from scanContent that could cause NPEs at call sites, a handler order constant whose formula deserves explicit documentation or verification, and duplicated parameterizable test cases in the handler test that should be consolidated for maintainability.

PR Bot Information

Version: 1.20.11 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content
• Event Trigger: pull_request.ready_for_review
• Correlation ID: e56726d0-3750-11f1-8e9f-1630d2a135a4