KRYSTALM7 opened a new pull request, #58: URL: https://github.com/apache/fineract-loan-origination/pull/58
## Summary Improves role-based approval workflow enforcement for the Loan Origination System (LOS) by deriving both the workflow stage and assigned officer from the authenticated staff member instead of accepting them from client requests. JIRA: https://issues.apache.org/jira/browse/FINERACT-2442 ## Changes ### Role-based approval workflow - Derive workflow stage from the authenticated staff member's LOS role - Remove `stageName` and `assignedOfficer` from `ApprovalDecisionRequest` - Enforce sequential stage ownership through `ApprovalWorkflowService` - Reject approval attempts when the authenticated staff role does not match the expected workflow stage - Reject authenticated staff members with no mapped LOS workflow role ### Staff role resolution - Add `LosRole` enum - Add `FineractRoleResolver` for mapping Fineract roles to LOS workflow roles - Add `StaffController` (`GET /api/v1/staff/me`) to expose the authenticated staff member's resolved LOS role - Extend `FineractAuthenticationProvider` to populate role-based Spring Security authorities ### Error handling - Add `ApprovalStageMismatchException` - Add `LosRoleNotAssignedException` - Register both exceptions in `GlobalExceptionHandler` - Add corresponding error message constants ### Workflow configuration - Add configurable role-to-stage mapping in `application.yml` - Update `ApprovalWorkflowProperties` to support configurable role mappings - Improve repository queries and workflow validation logic - Extend unit tests for role validation and approval workflow behavior --- ## Checklist - [x] I have read the Apache Fineract Contributing Guidelines. - [x] My pull request is linked to the correct JIRA ticket. - [x] My commit message follows the `FINERACT-<issue-no>: <description>` format. - [x] I have added or updated tests where appropriate. - [x] I have verified that the project builds successfully. ## Method of Testing ### Unit Tests - Approval stage validation - Role mismatch handling - Missing LOS role handling - Duplicate approval prevention - Approval workflow transitions ### Manual Verification - Verified `GET /api/v1/staff/me` returns the authenticated user's resolved LOS role - Verified only the expected workflow role can approve each stage <img width="1564" height="601" alt="Screenshot (1554)" src="https://github.com/user-attachments/assets/53a0012e-ceae-4a5d-b657-727452ac7101"; /> - Verified unauthorized roles receive the expected error response <img width="1571" height="525" alt="Screenshot (1555)" src="https://github.com/user-attachments/assets/fba0d846-da49-4229-8b78-5e039619252f"; /> - Verified approval workflow progresses correctly across configured stages ## Build Commands ```bash ./mvnw clean verify ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
