CBS-Mobile-App/docs/OpenProject_WorkPackages.md

OpenProject work packages: CBS Mobile App (Apna Sahakari Bank)

Create these in OpenProject in this order: the EPIC first, then each FEATURE as a child of the EPIC, then each TASK or BUG as a child of its FEATURE. In the work package table, right-click a row and choose Create new child.

For every work package, set:

• Assignee: Abin Toppo (unless noted)
• Client bank name: Apna Sahakari Bank Ltd.

Copy the Subject into the subject field and the text under Description into the description field.

Status meanings

Status	Meaning
Developed	Works on the live CBS API, or needs no backend. Move to Closed after QA.
In progress	The endpoint exists but the app is not fully connected to it yet.
On hold	Screen is built, but the backend endpoint does not exist yet.
New	Screen exists, but its action is a placeholder. Not built yet.

---

EPIC: Mobile App – Apna Sahakari Bank (Customer App)

• Parent: #537819 Core Banking System (CBS) Regulatory & Operational Enhancements
• Start date: 26-05-2026
• Status: In progress
• Attachment: docs/Application Features_API_Status.pdf

Description

React Native mobile banking app for Apna Sahakari Bank Ltd. (org 107295), running on the CBS mobile banking backend (http://mobile-banking-backend.lincpay/api/v1).

The app has 63 features. Up to 13-10-2026, 41 were switched on for Apna Bank customers. On 14-10-2026 every feature was switched on, including the field-agent app, Cards and Loans. The earlier set of switches is saved in src/features/featureConfig.stage-2026-10-14.ts, so the app can go back to it. The features that call the live CBS API now include Positive Pay and the mini statement. The rest use demo data, run only on the phone, or wait for backend endpoints.

Repository: git.lincpay.tech/CBSNexora/CBS-Mobile-App, branch Apnabank. Full feature list with API status: see the attached "Application Features_API_Status.pdf".

---

FEATURE 1: App foundation

• Status: Developed

Description

The base of the app that every screen uses: project setup, feature switches, API client, security and branding. All items here are complete.

TASK 1.1: Project setup and app structure

• Status: Developed · Finish date: 26-05-2026

Description

React Native 0.83 app with TypeScript (strict mode), Redux Toolkit / RTK Query for data, and React Navigation 7 for screens. The code is split into 17 modules (auth, home, payments, services, profile, and so on) with about 100 screens. One app holds both the customer app and the agent app; the user's role at sign-in decides which one opens.

TASK 1.2: Feature switch engine

• Status: Developed

Description

Every module, screen, tab and button can be switched on or off, per bank. The switches are nested: turning off a parent turns off everything under it. An unknown or misconfigured switch counts as off, so a mistake hides a feature rather than showing it. A switched-off screen is not registered at all, so it cannot be opened by a link either. The app is ready to read the bank's live switches from /features/config (see Task 10.5).

TASK 1.3: API client and CBS error handling

• Status: Developed

Description

A shared API client for all CBS calls. It adds the session token to each request, reads the CBS response format (success, data, errorCode), and turns every failure into a clear message for the customer. All 31 backend error codes plus network and timeout errors have their own title and text, covered by unit tests. If the server says the session is no longer valid, the customer is signed out.

TASK 1.4: Device binding, PIN encryption and session timeout

• Status: Developed · Finish date: 25-09-2026

Description

• The phone gets a device ID on first launch, stored in the secure Keychain. The customer's profile is bound to this device.
• MPIN and TPIN are never sent in plain text. They are encrypted with the server's RSA public key (RSA-OAEP, SHA-256) from /crypto/public-key. The key is fetched fresh before every encryption.
• Session timeout follows the server's rules: sign-out after 5 minutes idle (with a warning 1 minute before), at the absolute session expiry, and a re-lock when the app comes back after 30 seconds in the background.
• Logging out clears all customer data from the app.

TASK 1.5: Apna Bank branding and configuration

• Status: Developed · Finish date: 29-09-2026

Description

The app is set to org 107295 (Apna Sahakari Bank Ltd.). Added the bank logo on the sign-in screen and updated the colour palette. The agent app is switched off for this bank.

---

FEATURE 2: Sign-in & registration

• Status: Developed

Description

How a customer registers the phone, signs in with MPIN or biometrics, resets a forgotten MPIN, and logs out. All 5 items are live on the CBS API.

TASK 2.1: Device registration

• Status: Developed

Description

A new customer registers this phone for mobile banking. The app looks up the customer with the CBS, verifies the OTP sent to the registered mobile number, and asks the customer to create a 4-digit MPIN. The MPIN cannot be a run of digits (like 1234 or 4321) or the last 4 digits of the mobile number. The customer cannot go back from the Create MPIN screen, because the setup token works only once.

Endpoints: /registration, /registration/verify-otp, /registration/mpin

TASK 2.2: MPIN sign-in

• Status: Developed · Finish date: 25-09-2026

Description

The customer signs in with their MPIN, which is sent encrypted. The app asks for the MPIN on every launch and checks the session with the server. Too many wrong attempts lock the MPIN, and the customer is told to visit the branch. A SIM icon is shown beside the mobile number on the sign-in screen.

Endpoints: /auth/login, /auth/me, /crypto/public-key

TASK 2.3: Biometric sign-in

• Status: Developed

Description

The customer can turn on fingerprint or face sign-in from the sign-in screen or from Profile. The MPIN is then kept in the phone's secure Keychain, behind the phone's own biometric prompt. A successful fingerprint or face check unlocks it and signs in through /auth/login.

TASK 2.4: Forgot MPIN

• Status: Developed · Finish date: 29-09-2026

Description

Reset from the sign-in screen when the customer has forgotten the MPIN. Step 1: the CBS checks the customer and sends an OTP. Step 2: the OTP is exchanged for a one-time reset token. Step 3: the customer sets a new MPIN, which is sent encrypted. This signs out every other open session. There is no separate resend-OTP endpoint; resending starts step 1 again.

Endpoints: /mpin-reset/initiate, /mpin-reset/verify-otp, /mpin-reset/confirm

TASK 2.5: Log out

• Status: Developed

Description

Log out button in Profile. Ends the session on the server and clears all customer data from the app.

Endpoint: /auth/logout

---

FEATURE 3: Accounts

• Status: In progress

Description

The customer's accounts, balances, statements, transfer history and KYC. 4 items are live, MMID is partly live, and 3 screens wait for backend endpoints.

TASK 3.1: Accounts on Home

• Status: Developed

Description

The Home screen shows every account on the customer's profile as a carousel, with a button to show or hide balances.

Endpoint: /accounts

TASK 3.2: Account details and live balance

• Status: Developed · Finish date: 21-09-2026

Description

Account details screen with the live balance, read from the bank on every visit and never cached. Works for savings and current accounts. Fixed and recurring deposits are hidden here because they have their own screen (Task 5.1).

Endpoints: /accounts, /accounts/balance

TASK 3.3: Account statement and mini statement

• Status: In progress

Description

Built on the backend's Statement & Mini Statement guide v1.0 (14-10-2026).

• Mini statement: the latest 10 transactions of the selected account, each marked debit or credit. The Home screen's recent transactions read from it too.
• Statement PDF: the customer picks a From and To date and downloads the statement as a PDF. The PDF is password-protected: the first 4 letters of the name in capitals, then the date of birth as DDMM. The screen tells the customer this.

Opens from Home, Services and Profile.

Endpoints: /accounts/mini-statement, /accounts/statement/export

Comment (add under Activity)

In progress, 14-10-2026.

Done:

• App moved to the 14-10-2026 guide. The old page-by-page /accounts/statement list was removed by the backend, so the app no longer uses it.
• Mini statement checked on the phone against mobile-banking-backend.lincpay: account …0019 shows 10 transactions, account …0021 shows 7.

Remaining:

• The PDF download returns STATEMENT_PROFILE_INCOMPLETE (422) for the test user 6267095464, because the backend has no verified date of birth for them. The backend team must add it (guide section 13). Then test the download and the PDF password.
• Ask the backend team whether the password uses the title. The name on record is "Mr. Sanjay Mehta", so it starts with either MRSA or SANJ.

TASK 3.4: Fund transfer history

• Status: Developed · Finish date: 29-09-2026

Description

A list of the customer's IMPS transfers, opened from the clock button on Home. Filters by status, transfer mode and date range; loads 10 at a time. Tapping a transfer opens its detail. A transfer with status "pending" can be refreshed to get its final result.

Endpoints: /fund-transfer-history, /fund-transfer-history/{id}

TASK 3.5: MMID

• Status: In progress

Description

Viewing the customer's MMIDs works on the live API (from Home and Payments). Requesting a new MMID and cancelling one only show a message on screen, because the backend has no endpoints for them yet.

Endpoint (live): /accounts/mmid Needed from backend: generate MMID, cancel MMID

TASK 3.6: e-Passbook

• Status: On hold

Description

The passbook screen is built but shows demo rows, not the customer's real transactions. Next step: decide whether to feed it from /accounts/statement or from a dedicated passbook endpoint.

TASK 3.7: Re-KYC

• Status: On hold

Description

The Update KYC form is built. Submitting it is simulated, because there is no KYC update endpoint yet.

Needed from backend: KYC update endpoint

TASK 3.8: Video KYC

• Status: On hold

Description

The screen for booking a video KYC slot is built. Booking is simulated, because there is no backend or video-KYC service connected yet.

Needed from backend: video KYC slot booking

---

FEATURE 4: Payments (IMPS)

• Status: Developed

Description

Beneficiaries, IMPS transfers to an account or a mobile number, and the Transaction PIN (TPIN) that authorises them. 4 items are live. Transfer between own accounts waits for a backend endpoint.

TASK 4.1: Beneficiaries

• Status: Developed

Description

List of saved beneficiaries, and adding a new one. Before saving, the app runs an IMPS name check so the customer can see the account holder's name. Also opens from Profile. The backend has no endpoint to delete a beneficiary.

Endpoints: /beneficiaries, /beneficiaries/validate

TASK 4.2: IMPS transfer to account (P2A)

• Status: Developed · Finish date: 25-09-2026

Description

Transfer to any bank account using account number and IFSC. Step 1 (initiate) checks the payee's name and sends an OTP; no money moves yet. Step 2 (verify OTP) sends the payment. The customer authorises the transfer with their TPIN. The result screen shows success, failure, or "pending" when the bank has not confirmed the result yet.

Endpoints: /fund-transfers/initiate, /fund-transfers/{id}/verify-otp

TASK 4.3: IMPS transfer to mobile (P2P)

• Status: Developed · Finish date: 25-09-2026

Description

Transfer using the payee's mobile number and MMID. Same two steps and OTP as Task 4.2. The form currently does not block on the mobile number or MMID format.

Endpoints: /fund-transfers/initiate, /fund-transfers/{id}/verify-otp

TASK 4.4: TPIN creation and TPIN-authorised transfers

• Status: Developed · Finish date: 29-09-2026

Description

The customer creates a 4-digit Transaction PIN (TPIN) that authorises every fund transfer. The TPIN cannot be a run of digits or the last 4 digits of the mobile number. It is created from Services, or automatically from the transfer screen when the server says no TPIN is set.

Flow: enter current MPIN, then enter the OTP, then set the new TPIN (sent encrypted). Transfers now send the encrypted TPIN, and a wrong TPIN shows a clear error. Changing an existing TPIN is not built yet.

Endpoints: /tpin/create/initiate, /tpin/create/verify-otp, /tpin/create/confirm

Note: the attached PDF (dated 28-09-2026) still lists TPIN as "Not connected". It went live on 29-09-2026.

TASK 4.5: Transfer between own accounts

• Status: On hold

Description

The screen for moving money between the customer's own accounts is built. The transfer is simulated, because the CBS has no endpoint for it yet.

Needed from backend: own-account / internal transfer endpoint

---

FEATURE 5: Deposits

• Status: Developed

Description

Viewing the customer's fixed and recurring deposits, and a maturity calculator. Opening a new FD or RD is not offered yet.

TASK 5.1: View fixed and recurring deposits

• Status: Developed

Description

Overview of the customer's FDs and RDs, and a details screen for each deposit with its terms.

Endpoints: /accounts, /accounts/deposits/detail

TASK 5.2: Deposit calculator

• Status: Developed

Description

FD and RD maturity calculator. Works on the phone with no backend call. The calculation is covered by unit tests.

---

FEATURE 6: Cheque services

• Status: In progress

Description

Cheque book request, stop payment, Positive Pay, cheque book tracking and fate of cheque. 3 items are live, tracking still needs to be connected, and fate of cheque waits for a backend endpoint.

TASK 6.1: Cheque book request

• Status: Developed

Description

The customer sees the charges first, then requests a cheque book. The serial number range comes back straight away.

Endpoints: /cheque-book/charges, /cheque-book (POST)

TASK 6.2: Stop cheque payment

• Status: Developed

Description

The customer enters the cheque, the app shows its details from the bank to confirm, and then stops it. Works only for cheques registered under Positive Pay.

Endpoints: /check/verify, /check/stop-payment

TASK 6.3: Positive Pay

• Status: Developed · Finish date: 14-10-2026

Description

The customer registers a cheque with the bank before handing it over, so the bank can match it when it is presented. The app was moved to the new Positive Pay API on 12-10-2026. This API identifies accounts by account number.

• Turn on Positive Pay: the app checks whether the account already has it. If not, the customer turns it on with an OTP sent to the registered mobile number. The OTP can be resent.
• Register a cheque: account, 6-digit cheque number, cheque date, amount and payee name. The backend sends it to the bank. A submission that fails is saved too, with status Failed.
• Saved cheques: every cheque the customer has registered, across all their accounts, newest first.
• Cheque detail, with a Stop payment button while the cheque's status is Submitted.
• Stop payment in Services now lists Positive Pay cheques and stops them through this API. It replaces /check/verify and /check/stop-payment (Task 6.2).

Endpoints: /pps/enrollment/accounts, /pps/enrollment/initiate, /pps/enrollment/verify-otp, /pps/enrollment/resend-otp, /pps/cheques (GET, POST), /pps/cheques/{chequeId}, /pps/cheques/{chequeId}/stop-payment

Comment (add under Activity)

Developed, 14-10-2026.

Done:

• App moved to the 12-10-2026 Positive Pay API. Accounts are identified by account number; accountId is no longer used. Re-checked against the 13-10-2026 guide: no change needed.
• Screens built and connected to the API: turn on Positive Pay (OTP and resend), register a cheque, saved cheques, cheque detail and stop payment.
• Full flow passed on the phone against mobile-banking-backend.lincpay with the guide's test user (6267095464, account …0019): Positive Pay turned on with OTP, cheque 000157 submitted and then stopped (status Canceled, ref CBS-PPS-000001), cheque 000158 submitted and left as Submitted (ref CBS-PPS-000002). Screenshots of every step: docs/screenshots/positive-pay.

Notes for QA:

• Cheque numbers 000157 and 000158 are already used on …0019. Use other numbers from the simulator range 000001–000200.
• Account …0021 does not have Positive Pay turned on yet.
• The second backend (192.168.6.138:8079) has not been tested. Check which version it runs before testing against it.
• If the backend returns ACCOUNT_NOT_FOUND for an account the customer owns, the backend's stored account number hash for it is wrong. Report this to the backend team; it is not an app bug.

TASK 6.4: Cheque book tracking

• Status: In progress

Description

The delivery status screen is built but still shows a fixed sample list. The live cheque book list endpoint already exists; the screen needs to be connected to it.

Endpoint to connect: /cheque-book (GET)

TASK 6.5: Fate of cheque

• Status: On hold

Description

The screen to check the status of an issued cheque is built. The lookup is simulated, because the CBS has no endpoint for it yet.

Needed from backend: fate of cheque endpoint

---

FEATURE 7: Services hub

• Status: In progress

Description

The Services tab: branch locator, security awareness, financial protection schemes, and support tiles. TPIN and cheque services also open from here; they are tracked under Feature 4 (Payments) and Feature 6 (Cheque services).

TASK 7.1: Branch locator

• Status: On hold

Description

Map of nearby branches using the phone's location, with directions. The screen works, but it shows a sample branch list.

Needed from backend: branch list endpoint

TASK 7.2: Security awareness

• Status: Developed

Description

Safe-banking articles the customer can read and bookmark. The articles come with the app; no backend is needed.

TASK 7.3: Financial protection schemes

• Status: On hold

Description

Screens for government protection schemes, enrolment, DEAF claims and DICGC information. All of them show sample deposits and enrolments. This module uses its own demo service with a fixed test OTP (123456), which must be replaced when real endpoints are available.

Needed from backend: schemes, enrolment, DEAF claim endpoints

TASK 7.4: Support chat and Help center

• Status: New

Description

The Support chat and Help center tiles on the Services hub only show a "coming soon" message. Not built yet.

---

FEATURE 8: Search & notifications

• Status: Developed

Description

Search across the app and the in-app notification inbox. Both work on the phone; notifications will need a backend endpoint for server-sent alerts.

TASK 8.1: Global search

• Status: Developed · Finish date: 02-06-2026

Description

Search from the Home search icon across app features and the customer's accounts. The feature list is on the phone; accounts come from /accounts.

TASK 8.2: In-app and push notifications

• Status: Developed · Finish date: 02-06-2026

Description

Notification list with unread badge, mark as read and swipe to delete, plus phone notifications in the foreground and background. Notifications are created on the phone only. Transaction alerts from the server need a notifications endpoint.

---

FEATURE 9: Profile & security

• Status: In progress

Description

The Profile tab and Security Center. Reset MPIN, settings and legal pages work. Profile data and linked accounts use sample data, and several security actions are placeholders.

TASK 9.1: Reset MPIN from Security Center

• Status: Developed · Finish date: 29-09-2026

Description

Profile > Security Center > Reset MPIN. Same three-step OTP flow as Forgot MPIN (Task 2.4). The customer is signed out afterwards.

Endpoints: /mpin-reset/initiate, /mpin-reset/verify-otp, /mpin-reset/confirm

TASK 9.2: App settings

• Status: Developed

Description

Language, notification preferences and privacy settings. Saved on the phone.

TASK 9.3: Legal and About

• Status: Developed

Description

Terms and conditions, privacy policy and app version. The text comes with the app.

TASK 9.4: View and edit profile

• Status: On hold

Description

The profile header and edit screen are built but show sample data, not the customer's real profile.

Needed from backend: customer profile endpoint

TASK 9.5: Linked bank accounts

• Status: On hold

Description

The screen to see, add and remove linked accounts is built but uses sample data.

Needed from backend: linked accounts endpoint

TASK 9.6: Change MPIN

• Status: New

Description

Change PIN in Profile, also opened from the MPIN tile in Services. It is only a placeholder now: it accepts only 1234 and calls no API. Needs a change-MPIN endpoint and a real flow (see Bug 10.2).

TASK 9.7: Change password

• Status: New

Description

Change the web login password. The screen shows "success" without calling any API. Needs a change-password endpoint.

TASK 9.8: Two-factor and Hide balance switches

• Status: New

Description

The two switches in the Security Center are on screen but do nothing yet.

TASK 9.9: Devices and log out everywhere

• Status: New

Description

The Security Center section for signed-in devices shows fixed messages and makes no backend call. Needs endpoints to list devices and to end all sessions.

TASK 9.10: Help and support

• Status: New

Description

Call, email and complaint form. The phone number and email are sample values, and the complaint reference number is made up on the phone. Needs the bank's real contact details and a complaints endpoint.

---

FEATURE 10: Release readiness

• Status: New

Description

Items that must be fixed before the app goes to Apna Bank customers: test values left in the code, placeholder screens, live feature switches, HTTPS, and the list of backend endpoints still needed.

BUG 10.1: Payer account hardcoded to a test account

• Priority: High · Status: New

Description

Every IMPS transfer is sent from the test account 002002000100019 instead of the account the customer picks (src/modules/payments/services/paymentsApi.ts, line 34). This was added for testing and must be removed before release.

BUG 10.2: Change MPIN placeholder accepts only 1234

• Priority: High · Status: New

Description

The Change MPIN screen accepts only "1234" as the current MPIN and calls no API, but it is switched on for customers. Hide it until the real change-MPIN flow is built (Task 9.6).

BUG 10.3: Change password and complaint form show fake results

• Priority: Normal · Status: New

Description

Change password shows success without calling an API. The complaint form in Help and support shows a made-up reference number and sample phone and email. Customers could believe these actions worked. Hide them or connect them before release.

BUG 10.4: Beneficiary delete switch on without a screen or endpoint

• Priority: Low · Status: New

Description

The beneficiary delete switch is on, but no screen offers delete and the backend has no delete endpoint. Turn the switch off, or build it once the endpoint exists.

TASK 10.5: Read the bank's live feature switches

• Status: New

Description

useMockServer is still true in src/config/env.ts, so the app uses its built-in on/off defaults instead of the bank's live settings from /features/config. Turn it off once every live feature is confirmed to work without demo data, and check which screens still depend on it.

TASK 10.6: Move the API connection to HTTPS

• Status: New

Description

The app calls http://mobile-banking-backend.lincpay over plain HTTP. This name resolves only on the office network or VPN. A release build needs a public HTTPS address, and the Android network security config and iOS Info.plist need updating to match.

TASK 10.7: Backend endpoints needed by the mobile app

• Assignee: backend lead · Status: New
• Blocks: Task 4.5, Task 3.5, Task 3.7, Task 3.8, Task 3.6, Task 6.5, Task 7.1, Task 7.3, Task 8.2, Task 9.4, Task 9.5, Task 9.6, Task 9.7, Task 9.9, Task 9.10, Bug 10.4

Description

These screens are built in the app but wait for backend endpoints:

• Own-account / internal transfer (Task 4.5)
• MMID generate and cancel (Task 3.5)
• Re-KYC update (Task 3.7)
• Video KYC slot booking (Task 3.8)
• e-Passbook ledger, or confirm /accounts/statement can be used (Task 3.6)
• Fate of cheque (Task 6.5)
• Branch list (Task 7.1)
• Financial protection schemes, enrolment and DEAF claim (Task 7.3)
• Notifications (Task 8.2)
• Customer profile (Task 9.4)
• Linked accounts (Task 9.5)
• Change MPIN (Task 9.6)
• Change password (Task 9.7)
• Devices and log out everywhere (Task 9.9)
• Complaints (Task 9.10)
• Beneficiary delete (Bug 10.4)
• Loans: products, eligibility, application, tracking, EMI payment, foreclosure (Feature 13)
• Verified date of birth for the test user 6267095464, so the statement PDF can be tested (Task 3.3)

After creating this task, open its Relations tab and add a "Blocks" relation to each task listed above.

---

Optional: built but switched off

Create these only if the team wants to track them. Put each one directly under the EPIC as a FEATURE with status On hold. They need no child tasks for now.

FEATURE 11: Agent app (parked)

• Status: On hold

Description

Field-agent app in the same code: dashboard and route plan, customers (list, create, edit, instalment history), daily collections with receipts, loan requests and account opening, commission, and agent profile. 18 screens, all on demo data. Switched on 14-10-2026, with the Agent login tab.

FEATURE 12: Cards

• Status: On hold

Description

Card list and details, card controls (freeze, online, international, contactless, ATM, limits, block), credit card application and physical card request. Built on demo data. Switched on 14-10-2026; screenshots of every screen: docs/screenshots/cards.

FEATURE 13: Loans

• Status: On hold

Description

Loan products, eligibility check, EMI calculator, application and tracking, documents, active loan details, EMI payment, foreclosure and history.

Switched on 14-10-2026. The backend has no /loans endpoints yet, so every loan screen shows demo data (LOANS_USE_DEMO_DATA in src/modules/loan/services/loanApi.ts). Set that switch to false once the endpoints exist. Screenshots of every screen: docs/screenshots/loans.

FEATURE 14: Insurance

• Status: On hold

Description

Insurance plans, buying, plan comparison, premium calculator, policies, renewals, documents and claims. Built on demo data; the whole module is switched off.

FEATURE 15: Other payment, deposit and service options

• Status: On hold

Description

Built but switched off because they are not in Apna Bank's target screen set: NEFT and RTGS transfers, UPI and scan to pay, opening a new FD or RD, certificates (balance, interest, tax), and service requests (standing instructions, Form 15G/15H, nomination).