feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment

[david-ruiz-cko]

This pull request refines how 3DS challenge indicators are modeled and documented in the codebase, clarifying the distinction between payment and session APIs and improving the accuracy of API response models. The main changes involve introducing a dedicated SessionChallengeIndicator enum for session-related endpoints, updating documentation for both enums, and enhancing the field-level documentation for session response classes.

3DS Challenge Indicator Modeling

• Introduced a new SessionChallengeIndicator enum in sessions to represent all nine possible challenge indicator values for session endpoints, including exemption requests, with detailed documentation for each value. (src/main/java/com/checkout/sessions/SessionChallengeIndicator.java)
• Updated ChallengeIndicator in common to clarify its use for payment-related endpoints and to deprecate exemption values, which are now only valid for sessions. Improved documentation for each enum value and marked exemptions as deprecated. (src/main/java/com/checkout/common/ChallengeIndicator.java)

Session Response Model Updates

• Changed the type of the challengeIndicator field in both CreateSessionAcceptedResponse and GetSessionResponse from ChallengeIndicator to SessionChallengeIndicator, ensuring correct deserialization and alignment with API behavior. (src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java, src/main/java/com/checkout/sessions/GetSessionResponse.java) [1] [2]
• Added comprehensive Javadoc documentation for all fields in CreateSessionAcceptedResponse and GetSessionResponse, clarifying requirements, formats, and default values for each field. [1] [2]

Code Clean-up

• Removed unnecessary imports of ChallengeIndicator from session-related files to prevent confusion and maintain separation of concerns. (src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java, src/main/java/com/checkout/sessions/GetSessionResponse.java, src/main/java/com/checkout/sessions/SessionRequest.java) [1] [2] [3]

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
• security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java
• security_sensitive_path:src/main/java/com/checkout/sessions/SessionChallengeIndicator.java
• security_sensitive_path:src/main/java/com/checkout/sessions/SessionRequest.java
• security_sensitive_path:src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java

Operational gates

• ✅ jira_ticket (INT-1667)
• ✅ independent_review

Files analysed: 10

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java
• security_sensitive_path:src/main/java/com/checkout/sessions/GetSessionResponse.java
• security_sensitive_path:src/main/java/com/checkout/sessions/SessionChallengeIndicator.java
• security_sensitive_path:src/main/java/com/checkout/sessions/SessionRequest.java
• security_sensitive_path:src/main/java/com/checkout/sessions/SessionScheme.java

Operational gates

• ✅ jira_ticket (INT-1667)
• ✅ independent_review

Files analysed: 17

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — src/main/java/com/checkout/sessions/CreateSessionAcceptedResponse.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/GetSessionResponse.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionChallengeIndicator.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionRequest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionScheme.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/SessionsCardMetadataResponse.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/main/java/com/checkout/sessions/TransactionType.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/AbstractSessionsTestIT.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/CreateSessionAcceptedResponseSerializationTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/GetSessionResponseSerializationTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/RequestAndGetSessionsTestIT.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionChallengeIndicatorTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionRequestSerializationTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/SessionSchemeTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — src/test/java/com/checkout/sessions/TransactionTypeTest.java	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
5.2% Duplication on New Code

See analysis details on SonarQube Cloud