rymghosn opened a new pull request, #6255:
URL: https://github.com/apache/fineract/pull/6255
Today, maker-checker enabled actions have two rough edges:
1. A maker can resubmit the same action on the same resource any number of
times while an earlier submission is still AWAITING_APPROVAL, silently
creating multiple redundant pending entries for the same underlying
change.
2. A user who only holds the checker permission for a task (e.g.
DISBURSE_LOAN_CHECKER, but not DISBURSE_LOAN) and who tries to submit that
action directly currently falls through to the generic
NoAuthorizationException ("User has no authority to: ...") — which reads like a
permissions-configuration bug rather than telling the user they should be
approving a pending entry instead of initiating one.
This PR adds two targeted, backwards-compatible checks in
PortfolioCommandSourceWritePlatformServiceImpl#logCommandSource, only for tasks
that
have maker-checker enabled:
- Duplicate pending submission: if the current user has the base
permission (a "maker") but not the task's _CHECKER permission, and a command
already exists with status AWAITING_APPROVAL for the same action name,
entity name and resource id, the new submission is rejected with a new
MakerCheckerDuplicatePendingSubmissionException (HTTP 409) instead of
being queued as another pending entry.
- Checker-only initiation: if the current user lacks the base permission
but holds the task's _CHECKER permission (or is a CHECKER_SUPER_USER),
the request is rejected with a new
MakerCheckerCheckerOnlyInitiationException (HTTP 403) telling them to use the
approval flow instead.
Users who hold both the base and _CHECKER permission for a task, and any
non maker-checker-enabled action, are unaffected. This PR intentionally
does not change approveEntry or introduce any new self-approval semantics
— it only tightens the initiation path.
PR:(https://issues.apache.org/jira/browse/FINERACT-2753)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
