KRYSTALM7 opened a new pull request, #54: URL: https://github.com/apache/fineract-loan-origination/pull/54
## Summary Implements end-to-end authentication for both customers and staff, and configures the multi-stage loan approval workflow with role-based routing. Customer identity and credentials are fully owned by LOS. Staff authentication delegates to Fineract core with role extraction for workflow routing. JIRA: [FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442) ## Changes **Customer Authentication** - `POST /api/v1/auth/login` accepts `username`, `password`, `tenantId` - Credentials verified locally against `customer_credentials` table using BCrypt (no Fineract call in this flow) - On success, resolves the customer's `fineractClientId` for row-level data scoping - Issues a 15-minute JWT containing `clientId`, `tenantId`, `correlationId` - `JwtAuthFilter` validates JWT on all `/api/v1/customer/**` requests - Adds `AuthController`, `AdminCustomerController`, `CustomerCredential` entity, `CustomerCredentialRepository` **Staff Authentication and Workflow** - `FineractAuthenticationProvider` — delegates staff credential validation to Fineract - `FineractCredentialValidationService` — proxies Basic Auth to Fineract, extracts role - Three-stage approval workflow: `LOAN_OFFICER` → `CREDIT_COMMITTEE` → `BRANCH_MANAGER` - Dual security filter chains: JWT for customers, Fineract Basic Auth for staff - `FineractRestTemplateConfig` — SSL-tolerant RestTemplate for dev environment - Updated `application.yml` with role-to-stage mapping and final-stage disbursement config --- ## Checklist - [x] I have read the Apache Fineract Contributing Guidelines. - [x] My pull request is linked to the correct JIRA ticket number. - [x] My commit message follows the `FINERACT-<issue-no> - <issue-desc>` format. - [x] I have manually verified the documentation changes. - [x] I have verified that the project builds successfully. ## Method of Testing **Unit Tests** - Valid login flow - Wrong password rejection - Unknown username handling - Expired JWT validation **Manual Verification** - End-to-end verified against local Fineract instance - Staff role routing verified via Postman for all 3 roles (loan_officer, credit_committee, branch_manager) - Customer JWT flow verified against customer portal on `localhost:4200` ## Build Commands ```bash ./mvnw spotless:apply ./mvnw apache-rat:check ./mvnw clean verify ``` ## Notes - Staff passwords are never stored in LOS — all staff auth is delegated to Fineract - SSL hostname verification is disabled for dev only via `FineractRestTemplateConfig`; must be replaced with proper cert in production - Fineract roles required: ID 3 (credit_committee), ID 4 (loan_officer), ID 5 (branch_manager) with permissions assigned as documented in FINERACT-2442 Closes #51 Closes #52 Closes #53 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
