Foo Developer created FINERACT-2763:
---------------------------------------
Summary: Checker Users Unable to Approve Pending Maker-Checker
Tasks Without Direct Operational Permissions and Missing Tasks in Checker Inbox
Key: FINERACT-2763
URL: https://issues.apache.org/jira/browse/FINERACT-2763
Project: Apache Fineract
Issue Type: Bug
Components: Organization
Reporter: Foo Developer
Assignee: Foo Developer
Users assigned with Checker approval permissions for maker-checker-enabled
operations are unable to approve/execute pending tasks unless they are also
assigned the corresponding direct operational permissions.
Additionally, some operations can still be executed directly from the
entity/account screen even though no corresponding pending record appears in
the Checker Inbox.
This creates inconsistent maker-checker behavior and bypasses the expected
approval workflow.
The system appears to validate the underlying operational permission instead of
validating the maker-checker approval authority.
This creates an incorrect dependency between:
operational execution permissions
and
maker-checker approval permissions
and breaks the expected segregation of duties in the maker-checker workflow.
Example
Example 1 Loan Disbursement Approval Permission
A Checker user assigned with Loan Disbursement Checker approval authority
cannot approve/disburse a pending request unless the user is also assigned the
direct Disburse operational permission.
Example 2 Direct Action Execution Without Checker Record
Even when maker-checker is enabled, a user can directly access the customer
loan account and execute the Disburse action from the loan account screen.
No corresponding pending task/record appears under: Checker Inbox & Tasks
which bypasses the expected maker-checker approval flow.
Current Behavior
Maker submits a request requiring checker approval.
Request may not appear in Checker Inbox.
Checker user cannot process task without operational permission.
Users may still execute actions directly from entity/account screens.
Maker-checker workflow becomes inconsistent.
Expected Behavior
Permission Handling
Users assigned with Checker approval authority should be able to:
Approve
Reject
Execute pending maker-checker tasks
without requiring direct operational execution permissions.
Maker-Checker Enforcement
When maker-checker is enabled for an operation:
the operation should create a pending checker task
the action should not execute immediately
the pending task must appear in Checker Inbox
direct execution from entity/account screens should not bypass checker workflow
Steps to Reproduce
Scenario 1 — Checker Permission Issue
Create Checker user.
Assign checker approval permission only. (example Disburse Checker)
Do NOT assign operational execution permission. (do not assign normal Disburse
task)
Submit maker-checker-enabled request.
Open task as Checker user.
Scenario 2 — Missing Checker Inbox Record
Enable maker-checker for Loan Disbursement.
Access customer loan account.
Execute Disburse action from loan account screen.
Navigate to Checker Inbox.
Actual Result
Checker user cannot process task without operational permission.
Disbursement/action may execute directly.
No pending task appears in Checker Inbox.
Expected Result
Checker users should process tasks using checker authority only.
All maker-checker-enabled actions should generate pending tasks.
No direct execution should bypass maker-checker workflow.
Checker Inbox should always display pending approval records.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
