fix: Resolve the SonarCloud findings on the gzip code

- RequestBodyReader: do the clamp subtraction in long so the int
  arithmetic cannot be read as a narrowing hazard (S2184). The value is
  unchanged.
- GzipIT: assert with hasSizeLessThan on the array rather than on its
  length field.
- RequestBodyReaderTest: drop a throws IOException the body cannot throw,
  since the gzip call sits inside the assertion lambda.
- RequestPreparationFilterTest: static-import the Mockito DSL, matching
  the convention the rest of the suite already follows.

Author: thced

src/main/java/com/retailsvc/http/internal/RequestBodyReader.java

@@ -36,7 +36,7 @@ public RequestBodyReader(long maxDecompressedBytes) {
           "maxDecompressedBytes must be positive, got " + maxDecompressedBytes);
     }
     this.maxDecompressedBytes = maxDecompressedBytes;
-    this.readLimit = (int) Math.min(maxDecompressedBytes, Integer.MAX_VALUE - 1) + 1;
+    this.readLimit = (int) Math.min(maxDecompressedBytes, Integer.MAX_VALUE - 1L) + 1;
   }
 
   /**

src/test/java/com/retailsvc/http/GzipIT.java

@@ -133,7 +133,7 @@ void largeResponseIsGzippedWhenClientAcceptsGzip() throws Exception {
       assertThat(response.headers().firstValue("Vary"))
           .hasValueSatisfying(vary -> assertThat(vary).contains(ACCEPT_ENCODING));
       assertThat(new String(gunzip(response.body()), UTF_8)).isEqualTo(payload);
-      assertThat(response.body().length).isLessThan(payload.length());
+      assertThat(response.body()).hasSizeLessThan(payload.length());
     }
   }
 

src/test/java/com/retailsvc/http/internal/RequestBodyReaderTest.java

@@ -77,7 +77,7 @@ void unsupportedCodingThrows415() {
   }
 
   @Test
-  void oversizedInflatedBodyThrows413() throws IOException {
+  void oversizedInflatedBodyThrows413() {
     byte[] bomb = new byte[(int) CAP * 4];
 
     assertThatThrownBy(() -> reader.read(exchange(gzip(bomb), "gzip")))

src/test/java/com/retailsvc/http/internal/RequestPreparationFilterTest.java

@@ -4,7 +4,11 @@
 import static java.net.HttpURLConnection.HTTP_UNSUPPORTED_TYPE;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import com.retailsvc.http.BadRequestException;
 import com.retailsvc.http.ExceptionHandler;
@@ -41,7 +45,6 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.zip.GZIPOutputStream;
 import org.junit.jupiter.api.Test;
-import org.mockito.Mockito;
 
 class RequestPreparationFilterTest {
 
@@ -51,10 +54,10 @@ private HttpExchange exchange(String method, String path, byte[] body) {
 
   private HttpExchange exchange(String method, String path, byte[] body, Headers headers) {
     HttpExchange ex = mock(HttpExchange.class);
-    Mockito.when(ex.getRequestMethod()).thenReturn(method);
-    Mockito.when(ex.getRequestURI()).thenReturn(URI.create(path));
-    Mockito.when(ex.getRequestHeaders()).thenReturn(headers);
-    Mockito.when(ex.getRequestBody()).thenReturn(new ByteArrayInputStream(body));
+    when(ex.getRequestMethod()).thenReturn(method);
+    when(ex.getRequestURI()).thenReturn(URI.create(path));
+    when(ex.getRequestHeaders()).thenReturn(headers);
+    when(ex.getRequestBody()).thenReturn(new ByteArrayInputStream(body));
     return ex;
   }
 
@@ -140,21 +143,21 @@ void successPathBindsRequestContextDuringChain() throws Exception {
     AtomicReference<Map<String, String>> seenPathParams = new AtomicReference<>();
 
     Filter.Chain chain = mock(Filter.Chain.class);
-    Mockito.doAnswer(
+    doAnswer(
             inv -> {
               Request req = DispatchHandler.CURRENT.get();
               seenOpId.set(req.operationId());
               seenPathParams.set(req.pathParams());
               return null;
             })
         .when(chain)
-        .doFilter(Mockito.any());
+        .doFilter(any());
 
     f.doFilter(ex, chain);
 
     assertThat(seenOpId.get()).isEqualTo("get-user");
     assertThat(seenPathParams.get()).containsEntry("id", "42");
-    Mockito.verify(chain).doFilter(ex);
+    verify(chain).doFilter(ex);
   }
 
   @Test
@@ -241,7 +244,7 @@ void integerQueryParamIsCoercedFromStringBeforeValidation() throws Exception {
     HttpExchange ex = exchange("GET", "/x?n=42", new byte[0]);
     Filter.Chain chain = mock(Filter.Chain.class);
     f.doFilter(ex, chain);
-    Mockito.verify(chain).doFilter(ex);
+    verify(chain).doFilter(ex);
   }
 
   @Test
@@ -288,7 +291,7 @@ void numberQueryParamIsCoercedFromStringBeforeValidation() throws Exception {
     HttpExchange ex = exchange("GET", "/x?n=1.5", new byte[0]);
     Filter.Chain chain = mock(Filter.Chain.class);
     f.doFilter(ex, chain);
-    Mockito.verify(chain).doFilter(ex);
+    verify(chain).doFilter(ex);
   }
 
   @Test
@@ -337,8 +340,8 @@ void booleanQueryParamCoercesTrueAndFalse() throws Exception {
     HttpExchange falseEx = exchange("GET", "/x?b=false", new byte[0]);
     f.doFilter(trueEx, trueChain);
     f.doFilter(falseEx, falseChain);
-    Mockito.verify(trueChain).doFilter(trueEx);
-    Mockito.verify(falseChain).doFilter(falseEx);
+    verify(trueChain).doFilter(trueEx);
+    verify(falseChain).doFilter(falseEx);
   }
 
   @Test
@@ -383,15 +386,15 @@ void gzipRequestBodyIsInflatedBeforeValidation() throws Exception {
     AtomicReference<byte[]> seenBody = new AtomicReference<>();
     AtomicReference<String> seenEncoding = new AtomicReference<>("still here");
     Filter.Chain chain = mock(Filter.Chain.class);
-    Mockito.doAnswer(
+    doAnswer(
             inv -> {
               Request req = DispatchHandler.CURRENT.get();
               seenBody.set(req.bytes());
               seenEncoding.set(req.header("Content-Encoding").orElse(null));
               return null;
             })
         .when(chain)
-        .doFilter(Mockito.any());
+        .doFilter(any());
 
     f.doFilter(ex, chain);