E11-F3: Blacklist Check Service¶
Epic: E11: Blacklist & Security
Size: S (Small)
Problem / Outcome¶
Real-time blacklist validation during purchase.
Scope¶
In-Scope:
- OIB lookup API
- Returns boolean + message
- Called at checkout and transfers
- Blocked attempt logging
Out-of-Scope:
- Batch checking
Acceptance Criteria¶
- AC1: Given blacklisted OIB, service returns blocked=true with MUP message
- AC2: Given non-blacklisted OIB, service returns blocked=false
- AC3: Blocked attempts logged with user/IP/session details
Data Model Impact¶
ViolationLog table:
- id (UUID, PK)
- oib (VARCHAR(11))
- blacklist_id (UUID, FK)
- action_type (ENUM: purchase_attempt, transfer_attempt)
- match_id (UUID, FK)
- user_id (UUID, FK, nullable)
- session_id (VARCHAR)
- ip_address (VARCHAR)
- user_agent (VARCHAR)
- blocked_at (TIMESTAMP)
API Response:
{
"blocked": boolean,
"message": string (MUP referral message if blocked)
}
Permissions/Roles¶
- Internal service
How to Verify¶
npm test -- --grep "blacklist check"
Expected: Correct response for blacklisted/non-blacklisted.
Dependencies¶
Implementation Tasks¶
See E11: Blacklist ## Doc References Security Tasks
Doc References¶
Last Updated: January 2026