KRYSTALM7 opened a new pull request, #79:
URL: https://github.com/apache/fineract-loan-origination/pull/79
## Summary
Three gaps addressed in this PR — one security/auth feature and two
UX fixes identified during staff dashboard testing:
1. Staff had no dedicated login flow. The existing `/auth/login` endpoint
was customer-only (BCrypt against customer_credentials). Staff needed
Fineract-delegated authentication with role-mapped JWT issuance for LOS
workflow access.
2. The APPLICANT column in staff list/dashboard views showed `—` for all
rows despite applicant data being available on the detail page — a query
projection gap in the list endpoint.
3. The staff dashboard defaulted to showing ALL applications, including
those in stages the current user cannot act on, creating noise and false
urgency for approvers.
---
## Changes
### Backend — Staff Authentication
- Added `POST /api/v1/auth/staff/login` endpoint in `AuthController`.Accepts
username, password, and tenantId. Validates credentials against Fineract
(source of truth for staff identity). Maps Fineract role objects (`[{id, name,
description}]`) to `LosRole`
via `los.workflow.role-mapping` config. Returns a signed staff JWT on
success.
- Enhanced `JwtService.generateStaffToken()` — staff tokens carry
`userType=STAFF` and `losRole` claims in addition to standard tenantId.
Customer tokens carry `userType=CUSTOMER` for explicitdifferentiation. Both
types maintain tenantId for isolation.
- Created `StaffPrincipal` for staff users, carrying `losRole` for
downstream role resolution in `StageResolutionService`.
- Updated `JwtAuthFilter` to handle both `CUSTOMER` and `STAFF` token types
— extracts `userType` claim, constructs the appropriate principal
(`CustomerPrincipal` with clientId or `StaffPrincipal` with losRole), and adds
MDC context (userType, losRole, clientId) for structured log correlation.
- Fixed `FineractAuthResponse` roles field deserialization — Fineract
returns roles as `[{id, name, description}]` objects, not strings. Changed from
`List<String>` to `List<FineractRole>` with a nested record class.
- Fixed `application.yml` YAML indentation — `role-mapping` and`
final-stage` were siblings of `workflow` instead of children, causing the role
mapping to silently fall back to empty and producing 403 on every staff login
attempt.
### Backend — Applicant Name and Detail View
- Added `applicantName` and `fineractClientId` to `LoanApplicationResponse`
DTO, populated from the joined
`ApplicantProfile` where available.
- Added `fineractClientId` column to `loan_application` entity with Flyway
migration `V8__add_fineract_client_id.sql`.
- Created `StaffApplicationDetailResponse` carrying full approval stage
history, returned by the `/staff-detail` endpoint.
- Updated `/staff-detail` to fetch and return approval stages in
chronological order for the approval history timeline.
### Frontend
- Added staff login page routing to `POST /api/v1/auth/staff/login`.Stores
returned JWT and resolved `losRole` for route guard use.Sends
`X-Fineract-Platform-TenantId` header derived from login response, with
`'default'` as fallback.
- Updated `StaffApplicationSummary` model to include `applicantName` and
`fineractClientId`.
- Updated staff dashboard and application list tables to render applicant
column as: `applicantName ?? 'Client #' + fineractClientId ?? '—'` Gracefully
handles applications with no profile attached yet.
- Changed default dashboard filter from `'all'` to `'pending'` in
`staff-dashboard.component.ts`. The `All` tab remains
available as an explicit opt-in.
---
JIRA: [FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442)
## Testing
```bash
# Compile
.\mvnw.cmd clean compile -DskipTests
```
---
## Checklist
- [x] `.\mvnw.cmd clean compile -DskipTests` passes
- [x] `.\mvnw.cmd apache-rat:check` passes
- [x] `.\mvnw.cmd spotless:apply` run before final commit
- [x] Security headers verified against both filter chains
- [x] Mock service profile restrictions confirmed in local dev run
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
