Samer-Melhem-FOO opened a new pull request, #6136:
URL: https://github.com/apache/fineract/pull/6136

     AccountTransfersWritePlatformServiceImpl.undo() had two related defects, 
discovered while testing the undo-account-transfer capability added in 
FINERACT-2604 and extended in FINERACT-2613:                                    
                                  
                                                                                
                                                                                
                                                                                
                       
     1. Wrong lookup table. The endpoint's path id was resolved against 
m_account_transfer_details, but 
AccountTransfersReadPlatformServiceImpl.retrieveOne (which backs the transfer 
read/list APIs) queries by m_account_transfer_transaction.id. These are two     
 
     independent, unrelated id sequences that drift apart over time, so a 
caller undoing a transfer they can clearly see via the list/read endpoints 
could get a 404.                                                                
                                  
     2. Over-reversal on recurring transfers. undo() reversed every 
AccountTransferTransaction tied to the resolved AccountTransferDetails record, 
rather than only the single transaction the caller asked to undo. This 
incorrectly reversed every execution of a    
     recurring transfer (e.g. a standing instruction) sharing one details row 
across many runs.                                                               
                                                                                
                         
                                                                                
                                                                                
                                                                                
                       
     This PR fixes undo() to resolve and scope by 
m_account_transfer_transaction id instead, for both the savings-to-loan and 
savings-to-savings paths, so:                                                   
                                                         
     - the id passed to undo matches what the read/list APIs actually expose, 
and                                                                             
                                                                                
                         
     - only the specific transaction requested is reversed, leaving sibling 
executions of a recurring transfer untouched.                                   
                                                                                
                           
                                                                                
                                                                                
                                                                                
                       
     It also adds the missing UNDO_ACCOUNTTRANSFER permission 
(entityName=ACCOUNTTRANSFER, actionName=UNDO) via a new Liquibase changelog 
part — the command handler was already wired to check this permission, but no 
matching m_permission row was ever shipped, so 
     the command failed permission validation before reaching the (buggy) logic 
above.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to