fix(perc-system): type CookieModule jar and folder locator paths (#3290)

[natechadwick-intsof]

Summary

Clears remaining unchecked/rawtypes suppressions on CookieModule and PSServerFolderProcessor for parent #2299 (slice 5 of #2022).

• CookieModule.loadCookies() now rebuilds a typed ConcurrentHashMap<Cookie, Cookie> via runtime-checked readCookieJar (no @SuppressWarnings("unchecked")). Valid jars still load; non-map / non-Cookie payloads throw IOException (same catch path as other load failures).
• Folder locator paths no longer use a dual-return List<?> helper. PSFolderLocatorPaths collects parent-first / root-last paths with typed List<List<PSLocator>>. Public getFolderLocatorPaths(PSLocator) signature is unchanged.

No HTTP/cookie send-accept behavior change. Security catalogers (#3289) and assembly leftovers (#3291) are out of scope.

Fixes #3290
Parent tracker: #2299
Grandparent: #2022

Operator: Grok: night-issue-prs (model grok-4.5)

Test plan

1. cd system && ../mvnw.cmd clean install (JDK 21) — expect BUILD SUCCESS.
2. Confirm new tests: CookieModuleCookieJarTest (round-trip, empty map, reject HashMap, reject non-Cookie entries).
3. Confirm PSServerFolderProcessorLocatorPathsTest (null args, no parents, two-folder item, first-parent-only ancestor walk).
4. Spot-check: no remaining @SuppressWarnings("unchecked") on CookieModule or getFolderLocatorPaths.

Checklist

• Product documentation — N/A (not product-facing): internal Xlint / generics cleanup; no operator, admin, REST, or UI surface change
• Unit / module tests — behavioral tests for cookie-jar typing and folder path collection; system standalone mvnw clean install green
• WebUI + Playwright — N/A (no WebUI product screen change)
• Build gates — standalone system clean install (no skipTests); C2 reverse-deps N/A (no final / public signature / package-visible API used by other modules)
• Cross-platform — new tests use Path / Files / @TempDir; no hardcoded OS path separators

C3 evidence

• modules_built: system
• build_evidence: cd system && ../mvnw.cmd clean install → BUILD SUCCESS (2026-08-13T02:41:24-04:00). Tests run: 2112, Failures: 0, Errors: 0, Skipped: 241. New: CookieModuleCookieJarTest 4/0/0, PSServerFolderProcessorLocatorPathsTest 5/0/0.
• downstream_checked: none (C2 did not apply: public getFolderLocatorPaths signature unchanged; no type made final/sealed; no protected/package-visible API used by other modules changed)

C5 UI proof

N/A — Java backend Xlint only; no browser surface.

Co-Authored by Grok Build using grok-4.5 with agent main.

[kilo-code-bot]

Code Review Summary

Status: 0 Issues Found | Recommendation: Approve

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Files Reviewed (3 files)

• docs/ai-generated/code-reviews/3290-httpclient-folder-xlint-erlang.md - 0 issues
• system/src/main/java/com/percussion/server/webservices/PSFolderLocatorPaths.java - 0 issues (NPE fixed via parentsOrEmpty)
• system/src/test/java/com/percussion/server/webservices/PSServerFolderProcessorLocatorPathsTest.java - 0 issues (added collect_nullImmediateParents_empty, collect_nullAncestorParents_stopsWalk)

Resolved

• Previous WARNING (collect NPE on null lookup return): fixed by parentsOrEmpty helper that coerces null to List.of() at both collect and appendAncestors call sites. FolderParentLookup @return documents never-null.

---

Fix these issues in Kilo Cloud

Previous Review Summary (commit 7f5def3)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7f5def3)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
system/.../PSFolderLocatorPaths.java	57	collect() does not null-check the return value of parentLookup.getImmediateParents(). If a FolderParentLookup implementation returns null instead of an empty list, immediate.size() on line 58 throws NPE. The production lookup always returns non-null, but the interface contract is undocumented and this is now extracted into a testable class. (Already noted as non-blocking in the Erlang pre-commit review at docs/ai-generated/code-reviews/3290-httpclient-folder-xlint-erlang.md:37.)

SUGGESTION

File	Issue
system/.../PSServerFolderProcessorLocatorPathsTest.java	PSFolderLocatorPaths.collect and appendAncestors both declare throws PSCmsException, and the FolderParentLookup interface declares it, but no test verifies that exceptions thrown by the lookup propagate correctly to the caller. A test with a lookup that throws PSCmsException (at both the initial lookup and during the ancestor walk) would document the contract.

Files Reviewed (6 files)

• system/src/main/java/com/percussion/HTTPClient/CookieModule.java - 0 issues (removed @SuppressWarnings("unchecked"); readCookieJar uses runtime instanceof checks, correct exception handling)
• system/src/main/java/com/percussion/server/webservices/PSFolderLocatorPaths.java - 1 WARNING (NPE on null lookup return)
• system/src/main/java/com/percussion/server/webservices/PSServerFolderProcessor.java - 0 issues (delegates to PSFolderLocatorPaths.collect; lookupImmediateFolderParents always returns non-null)
• system/src/test/java/com/percussion/HTTPClient/CookieModuleCookieJarTest.java - 0 issues (4 tests: round-trip, empty map, reject HashMap, reject non-Cookie entries; uses @TempDir + Path/Files — portable)
• system/src/test/java/com/percussion/server/webservices/PSServerFolderProcessorLocatorPathsTest.java - 1 SUGGESTION (missing PSCmsException propagation test; 5 tests otherwise cover null args, no parents, multi-parent paths, first-parent-only walk)
• docs/ai-generated/code-reviews/3290-httpclient-folder-xlint-erlang.md - 0 issues (pre-commit Erlang review, no action needed)

Positive notes

• @SuppressWarnings("unchecked") fully removed from both CookieModule and PSServerFolderProcessor — verified via grep, no remaining instances.
• Deserialization filter in loadCookies (CWE-502 mitigation, SerializationValidation.buildPackageFilterSpec) is unchanged and still precedes readCookieJar. The runtime instanceof checks add defense-in-depth on top of the filter.
• New PSFolderLocatorPaths is final with private constructor (utility class), FolderParentLookup is a clean @FunctionalInterface, and appendAncestors recursion matches the original code's first-parent-only ancestor walk.
• Cross-platform: new tests use @TempDir Path + Path.resolve() + Files.newOutputStream — no hardcoded separators.
• Copyright headers on new files use Copyright (c) 2026 Intersoft Data Labs, Inc. (per root AGENTS.md).

---

Fix these issues in Kilo Cloud

---

_{Reviewed by step-3.7-flash · Input: 112.2K · Output: 7.6K · Cached: 674.2K}

_{Review guidance: REVIEW.md from base branch main}

[natechadwick-intsof]

qa_deferred_quality — human QA not assigned.

This-run PR #3293 (parent #3290 / #2299) is not a human-QA candidate and does not meet the overnight quality bar.

Candidate

• Not A — backend -Xlint / generics only (CookieModule cookie-jar typing + PSFolderLocatorPaths). No WebUI, Explorer, or user-visible flow.
• Not B — no installer / packaging / upgrade / host-visible behavior.
• Not C — no written acceptance that requires manual UAT after agent Maven proof.

Quality bar (live GitHub)

Gate	Result
Q1 PR open, not draft, MERGEABLE	pass (mergeable=MERGEABLE; mergeStateStatus=BLOCKED for reviews)
Q2 independent review APPROVE	fail — reviews are COMMENTED only (kilo-code-bot,
atechadwick-intsof);
eviewDecision=REVIEW_REQUIRED. No independent APPROVE.
Q3 required checks snapshot	pass — CodeQL / Analyze (java-kotlin) / Kilo Code Review SUCCESS on head f50e12d0
Q4 C1 Maven evidence	pass — cd system && ../mvnw.cmd clean install BUILD SUCCESS in PR body
Q5 C5 UI proof	fail-if-treated-as-UI — no C5 surface commands (correct: not a UI PR; C5 N/A)
Q6 slice	pass for the Xlint leftover
Q7 no overlapping open QA	pass
Q8 cycle verify	pass (status=passed)

Do not assign @vijaya-boddipudi. Tech-debt typing does not warrant a qa task.

Co-Authored by Grok Build using grok-4.5 with agent human-qa-handoff.