ThevinuJ opened a new pull request, #6698: URL: https://github.com/apache/fineract/pull/6698
## Description Currently, users can post financial transactions to accounts belonging to sibling branches (e.g., a teller in one branch processing a repayment or withdrawal for a client in another branch), bypassing proper office-level isolation. This PR enforces the office-hierarchy check across loan and savings operations, bringing them in line with existing client-level access controls. ### Summary of Changes * **Loans:** Added office hierarchy validation for repayments, disbursals, write-offs, charge-offs, refunds, waivers, adjustments, and loan charges. * **Savings:** Added validation for deposits, withdrawals, reversals, adjustments, holds, account closures, and savings charges. * **Account Transfers:** Updated transfer logic to ensure both source and destination accounts reside within the user's office hierarchy. ### What Remains Unchanged * **Read Operations:** Viewing accounts and reports is intentionally untouched to preserve existing lookups and reporting functionality. * **Scheduled Jobs:** Background processes like interest posting, standing instructions, and overdue charges continue to run unaffected as the system user. ### Testing * Added unit and integration tests covering loan, savings, and transfer workflows. * Verified that users attempting transactions from a sibling branch receive a `403 Forbidden`, while users from the correct office hierarchy succeed. * Tested locally against a Docker setup alongside existing account transfer test suites. ## Checklist - [x] Write the commit message as per [our guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests) - [x] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers. - [x] Create/update [unit or integration tests](https://fineract.apache.org/docs/current/#_testing) for verifying the changes made. - [x] Follow our [coding conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions). - [ ] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes - [x] [This PR must not be a "code dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit). Large changes can be made in a branch, with assistance. Ask for help on the [developer mailing list](https://fineract.apache.org/#contribute). - [x] If merging this PR resolves a JIRA issue, I will mark that issue as resolved and set "Fix Version/s" appropriately. - [x] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
