Foo Developer created FINERACT-2717:
---------------------------------------
Summary: Deleting an organisation currency does not check all
tables where it may still be in use.
Key: FINERACT-2717
URL: https://issues.apache.org/jira/browse/FINERACT-2717
Project: Apache Fineract
Issue Type: Bug
Components: Organization
Reporter: Foo Developer
Assignee: Foo Developer
{{CurrencyWritePlatformServiceJpaRepositoryImpl#updateAllowedCurrencies}}
allows removing a currency from the organisation's allowed-currency list.
Before removing a currency it checks whether it's "safe" to do so, but the
check only looks at loan products, savings products, and charges
({{{}LoanProductReadPlatformService#retrieveAllLoanProductsForCurrency{}}},
{{{}SavingsProductReadPlatformService#retrieveAllForCurrency{}}},
{{{}ChargeReadPlatformService#retrieveAllChargesForCurrency{}}}).
It does not check whether the currency is actually in use by real
accounts/transactions — e.g. loans, savings/share accounts, client
transactions, account transfers, cashier transactions, or GL journal entries.
As a result, a currency that is actively used in existing financial data can be
silently removed from the allowed list.
Additionally, the current exception message ({{{}"Cannot remove currency with
identifier X while it is still in use"{}}}) is technical/unfriendly for end
users.
h3. Steps to Reproduce
# Create a loan/savings account (or a journal entry) using currency X.
# Ensure X is not referenced by any loan product, savings product, or charge
directly (only by the account/transaction itself).
# Call {{PUT /organisations/currencies}} (Manage Currencies) with a currency
list that excludes X.
# The call succeeds and removes X, even though it is still referenced by
existing account/transaction data.
h3. Expected Behavior
Removing a currency should be blocked with a clear error whenever it's
referenced anywhere in existing data — not just loan/savings products and
charges.
h3. Actual Behavior
Only product/charge usage is checked; account- and transaction-level usage is
ignored, allowing an in-use currency to be removed.
h3. Proposed Fix
Broaden the in-use check in {{CurrencyWritePlatformServiceJpaRepositoryImpl}}
to also cover {{{}m_loan{}}}, {{{}m_savings_account{}}},
{{{}m_share_account{}}}, {{{}m_client_transaction{}}},
{{{}m_account_transfer_transaction{}}}, {{{}m_cashier_transactions{}}}, and
{{acc_gl_journal_entry}} (in addition to the existing product/charge tables),
and improve the exception message in {{CurrencyInUseException}} to be
user-friendly.
h3. Affected Files
*
{{fineract-core/src/main/java/org/apache/fineract/organisation/monetary/exception/CurrencyInUseException.java}}
*
{{fineract-provider/src/main/java/org/apache/fineract/organisation/monetary/service/CurrencyWritePlatformServiceJpaRepositoryImpl.java}}
*
{{fineract-provider/src/main/java/org/apache/fineract/organisation/monetary/starter/OrganisationMonetaryConfiguration.java}}
h3. Test Plan
Unit test added ({{{}CurrencyWritePlatformServiceJpaRepositoryImplTest{}}})
covering:
* Currency removal succeeds when unused.
* Throws {{CurrencyInUseException}} when still referenced.
* Skips the usage check entirely for currencies that remain in the allowed
list.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
