[
https://issues.apache.org/jira/browse/FINERACT-2763?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Foo Developer updated FINERACT-2763:
------------------------------------
External issue URL: https://github.com/apache/fineract/pull/6284
> Checker Users Unable to Approve Pending Maker-Checker Tasks Without Direct
> Operational Permissions and Missing Tasks in Checker Inbox
> -------------------------------------------------------------------------------------------------------------------------------------
>
> Key: FINERACT-2763
> URL: https://issues.apache.org/jira/browse/FINERACT-2763
> Project: Apache Fineract
> Issue Type: Bug
> Components: Organization
> Reporter: Foo Developer
> Assignee: Foo Developer
> Priority: Major
> Labels: beginner, beginner-friendly
>
> Users assigned with Checker approval permissions for maker-checker-enabled
> operations are unable to approve/execute pending tasks unless they are also
> assigned the corresponding direct operational permissions.
> Additionally, some operations can still be executed directly from the
> entity/account screen even though no corresponding pending record appears in
> the Checker Inbox.
> This creates inconsistent maker-checker behavior and bypasses the expected
> approval workflow.
> The system appears to validate the underlying operational permission instead
> of validating the maker-checker approval authority.
> This creates an incorrect dependency between:
> operational execution permissions
> and
> maker-checker approval permissions
> and breaks the expected segregation of duties in the maker-checker workflow.
> Example
> Example 1 Loan Disbursement Approval Permission
> A Checker user assigned with Loan Disbursement Checker approval authority
> cannot approve/disburse a pending request unless the user is also assigned
> the direct Disburse operational permission.
> Example 2 Direct Action Execution Without Checker Record
> Even when maker-checker is enabled, a user can directly access the customer
> loan account and execute the Disburse action from the loan account screen.
> No corresponding pending task/record appears under: Checker Inbox & Tasks
> which bypasses the expected maker-checker approval flow.
> Current Behavior
> Maker submits a request requiring checker approval.
> Request may not appear in Checker Inbox.
> Checker user cannot process task without operational permission.
> Users may still execute actions directly from entity/account screens.
> Maker-checker workflow becomes inconsistent.
> Expected Behavior
> Permission Handling
> Users assigned with Checker approval authority should be able to:
> Approve
> Reject
> Execute pending maker-checker tasks
> without requiring direct operational execution permissions.
> Maker-Checker Enforcement
> When maker-checker is enabled for an operation:
> the operation should create a pending checker task
> the action should not execute immediately
> the pending task must appear in Checker Inbox
> direct execution from entity/account screens should not bypass checker
> workflow
>
> Steps to Reproduce
> Scenario 1 — Checker Permission Issue
> Create Checker user.
> Assign checker approval permission only. (example Disburse Checker)
> Do NOT assign operational execution permission. (do not assign normal
> Disburse task)
> Submit maker-checker-enabled request.
> Open task as Checker user.
> Scenario 2 — Missing Checker Inbox Record
> Enable maker-checker for Loan Disbursement.
> Access customer loan account.
> Execute Disburse action from loan account screen.
> Navigate to Checker Inbox.
> Actual Result
> Checker user cannot process task without operational permission.
> Disbursement/action may execute directly.
> No pending task appears in Checker Inbox.
> Expected Result
> Checker users should process tasks using checker authority only.
> All maker-checker-enabled actions should generate pending tasks.
> No direct execution should bypass maker-checker workflow.
> Checker Inbox should always display pending approval records.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
