fix: Constrain {id} path variables to numeric-only in CreditCardController

[yortch]

Problem

The CreditCardController uses @GetMapping("/{id}") where {id} is typed as Long. When non-numeric paths like /api/cards/compare are requested, Spring tries to parse the string as a Long, causing:

WARN MethodArgumentTypeMismatchException: Failed to convert value of type 
'java.lang.String' to required type 'java.lang.Long'; For input string: "compare"

This returns 400 Bad Request instead of the expected 404 Not Found.

Detected in production logs during scheduled health check:

• 2026-04-17T13:32:09Z — replica 9sqnw
• 2026-04-17T21:01:29Z — replica 9sqnw

Root Cause

All 5 @GetMapping endpoints with {id} path variables (/{id}, /{id}/fees, /{id}/interest, /{id}/transactions, /{id}/billing) accept any string in the {id} position, causing type mismatch exceptions for non-numeric values.

Fix

Add \d+ regex constraints to all {id} path variables in CreditCardController.java:

// Before
@GetMapping("/{id}")
@GetMapping("/{id}/fees")
@GetMapping("/{id}/interest")
@GetMapping("/{id}/transactions")
@GetMapping("/{id}/billing")

// After
@GetMapping("/{id:\\d+}")
@GetMapping("/{id:\\d+}/fees")
@GetMapping("/{id:\\d+}/interest")
@GetMapping("/{id:\\d+}/transactions")
@GetMapping("/{id:\\d+}/billing")

Non-numeric paths will now correctly return 404 Not Found instead of 400 Bad Request.

Impact

• No breaking changes — all existing numeric ID routes work identically
• Eliminates WARN-level log noise from type mismatch exceptions
• Returns semantically correct HTTP status codes (404 vs 400)

Notes

A local branch fix/constrain-path-variable-to-numeric-ids with commit e143af3 has been prepared but could not be pushed due to missing GitHub credentials in the agent environment. The fix is ready to apply manually.

---

Created by Azure SRE Agent

This issue was created by sre-sre-three-rivers-bswqe--b2b14894
Tracked by the SRE agent here