Aman-Mittal opened a new issue, #665:
URL: https://github.com/apache/fineract-backoffice-ui/issues/665
`organization/office-transactions` declares a single permission:
```ts
data: { permissions: 'READ_OFFICETRANSACTION' },
```
The permission guard admits a user holding exactly that, the nav entry is
shown to them, and then Fineract refuses the list:
```
GET /officetransactions -> 403
{"userMessageGlobalisationCode":"error.msg.not.authorized",
"errors":[{"defaultUserMessage":"User has no authority to READ offices",
...}]}
```
Verified with a seeded user holding only `READ_OFFICETRANSACTION`: `GET
/officetransactions` is 403 and `GET /offices` is 403. Adding `READ_OFFICE` to
the same role makes the screen load.
So a user who holds precisely what the route asks for reaches a screen that
can never work. Every other screen's declared permission is sufficient for the
screen to function.
## Options
1. **Declare both codes** with AND semantics. The guard already supports
`permissionsMatchAll`, and this would be its first production use — it exists
in the guard and on no route today. The nav entry would then be hidden from a
user who cannot use the screen, which is the behaviour the rest of the
navigation has.
2. **Leave the route and accept the refusal**, now that the screen reports
it rather than showing an empty table (#660 gave it an error state, so the
refusal is at least visible and distinguished from a load failure).
Option 1 looks right, but it changes who sees a nav entry, so it is a
product decision rather than a bug fix and is deliberately not folded into the
error-state change. `check:route-permissions` would also need to accept an
array here.
## Related platform defect — not a UI issue
While covering this screen it emerged that office transactions **cannot be
created at all** against `apache/fineract:latest`:
```
POST /officetransactions -> 403
ERROR: column "currency_multiplesof" of relation "m_office_transaction" does
not exist
```
Per `CONTRIBUTING.md` that is a platform bug and belongs in the [ASF Jira
project](https://issues.apache.org/jira/projects/FINERACT) for apache/fineract
— Fineract returned a 4xx with a `defaultUserMessage` explaining why — not
here. It is recorded only because it has a consequence for this repository: the
delete action's permission gating on this screen cannot be covered by a backend
e2e spec, since no transaction can be seeded to render a row. That gating is
covered by the directive's unit tests instead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
