KRYSTALM7 opened a new pull request, #184:
URL: https://github.com/apache/fineract-loan-origination/pull/184
Fixes #152
## Summary
- Restrict `/api/v1/loan-applications/**` to `ROLE_STAFF` in the staff
filter chain.
- Add class-level staff authorization to `LoanApplicationController` while
retaining stricter method rules.
- Add full-chain security integration coverage for customer, LO, BM,
anonymous access, and every `LoanApplicationController` mapping.
## Before/after evidence
| Caller | Before patch | After patch |
| --- | --- | --- |
| Customer JWT | `GET .../{ref}/staff-detail` → **200** | Staff detail/list
→ **403**; own customer list → **200** |
| Loan officer JWT | — | Login/list/detail/start-review → **200**; approve →
**201** |
| Branch manager JWT | — | Login/list/detail → **200**; approve → **201** |
The before result used a synthetic local customer and test application.
After results were recorded from the running LOS service with locally issued
customer and staff JWTs. Tokens, passwords, applicant IDs, and application
references are not included.
## Cucumber assertions
The two scenarios probing customer access to disbursement and start-review
now assert 403 plus absence of `applicantName`, `nationalId`, `creditScore`,
and `monthlyIncome`. They no longer assert an exception-handler message or an
empty body, so the checks remain valid if another change adds a JSON 403 body.
## Verification
- `./mvnw -q clean verify` — **passed**.
- Manual local flow — **passed**: customer staff detail/list 403 and own
list 200; LO list → detail → start-review → approve succeeded; BM list → detail
→ approve succeeded.
Local LOS setup used an isolated PostgreSQL container on port 5435 and the
Maven Spring Boot runner on port 8082:
```powershell
docker run -d --name fineract-los-152-db -e POSTGRES_DB=los_db -e
POSTGRES_USER=los_user -e POSTGRES_PASSWORD=<redacted> -p 5435:5432
postgres:15-alpine
$env:DB_URL='jdbc:postgresql://localhost:5435/los_db'
$env:DB_USERNAME='los_user'
$env:DB_PASSWORD='<redacted>'
$env:FINERACT_BASE_URL='https://localhost:8443'
$env:FINERACT_USERNAME='mifos'
$env:FINERACT_PASSWORD='<redacted>'
$env:FINERACT_MOCK_ENABLED='true'
$env:JWT_SECRET='<ephemeral>'
.\mvnw.cmd spring-boot:run
```
The throwaway `los152-lo` and `los152-bm` users were created for local
manual verification only and remain in the local Fineract instance. No user
credentials or tokens are part of this PR.
## Risk
Scripts using a customer JWT on `/api/v1/loan-applications/**` will now
receive 403.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
