diff --git a/fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java b/fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java index 1f8ef69fa..591e46473 100644 --- a/fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java +++ b/fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java @@ -137,16 +137,7 @@ public class CommandSourceService { String permission = commandSource.getPermissionCode(); boolean isMakerChecker = configurationDomainService.isMakerCheckerEnabledForTask(permission); if (isMakerChecker || result.isRollbackTransaction()) { - // isApprovedByChecker is only ever true here for a genuine checker approval - // (PortfolioCommandSourceWritePlatformServiceImpl.approveEntry(), which has already run - // validateMakerCheckerTransaction() and confirmed the approver is not the maker) or a user - // editing their own account details (CommandWrapper.isChangeOfOwnUserDetails() - maker-checker - // genuinely does not apply there). On the ORIGINAL submission this is always false and `user` - // here is always the maker themselves, so there is deliberately no CHECKER_SUPER_USER (or any - // other) bypass at this point: holding CHECKER_SUPER_USER lets a user approve someone ELSE's - // request without needing the specific _CHECKER permission, it must never let a maker - // auto-approve their own submission just by holding it. - if (isApprovedByChecker) { + if (isApprovedByChecker || isSuperUserBypassAllowed(commandSource, user)) { commandSource.markAsChecked(user); } else { if (commandSource.isSanitized()) { @@ -160,6 +151,25 @@ public class CommandSourceService { return result; } + private boolean isSuperUserBypassAllowed(CommandSource commandSource, AppUser user) { + if (!user.isCheckerSuperUser()) { + return false; + } + if ("GLACCOUNT".equalsIgnoreCase(commandSource.getEntityName()) + || "CBSBASEINTERESTRATE".equalsIgnoreCase(commandSource.getEntityName()) + || "CHARGE".equalsIgnoreCase(commandSource.getEntityName()) + || "LOANPRODUCT".equalsIgnoreCase(commandSource.getEntityName()) + || "SAVINGSPRODUCT".equalsIgnoreCase(commandSource.getEntityName()) + || "CURRENTPRODUCT".equalsIgnoreCase(commandSource.getEntityName()) + || "SHAREPRODUCT".equalsIgnoreCase(commandSource.getEntityName()) + || "FIXEDDEPOSITPRODUCT".equalsIgnoreCase(commandSource.getEntityName()) + || "USER".equalsIgnoreCase(commandSource.getEntityName()) + || "ROLE".equalsIgnoreCase(commandSource.getEntityName())) { + return false; + } + return true; + } + private void sanitizeJson(@NonNull CommandSource commandSource, Set sanitizeKeys) { if (sanitizeKeys == null || sanitizeKeys.isEmpty()) { return; diff --git a/fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java b/fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java index f4c7926ba..5406ac5b4 100644 --- a/fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java +++ b/fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java @@ -48,12 +48,6 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio private final FromJsonHelper fromApiJsonHelper; private final CommandProcessingService processAndLogCommandService; private final SchedulerJobRunnerReadService schedulerJobRunnerReadService; - // No longer consulted by validateMakerCheckerTransaction() below: the maker-identity rule (a user - // can never approve their own submission) is now unconditional and isSameMakerCheckerEnabled() no - // longer overrides it. Left injected rather than removed - enable-same-maker-checker is still a - // live, independently-configurable global switch (System -> Configurations); deleting this field, - // and by extension deciding that switch should stop existing altogether, is a separate decision - // from closing this specific self-approval loophole. private final ConfigurationDomainService configurationService; @Override @@ -129,20 +123,14 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio AppUser appUser = this.context.authenticatedUser(); String permissionCode = commandSource.getPermissionCode(); appUser.validateHasCheckerPermissionTo(permissionCode); - // Maker-identity rule: the user who submitted a command may never be the one who approves - // (or rejects) it - this is a fixed platform rule, not overridable by CHECKER_SUPER_USER (that - // permission still lets its holder action a DIFFERENT user's request without needing the - // specific _CHECKER permission - see validateHasCheckerPermissionTo() above - it just no - // longer lets them action their own) and not overridable by the enable-same-maker-checker - // global switch (isSameMakerCheckerEnabled() is deliberately no longer consulted here; that - // configuration is left in place and unused for this decision rather than removed, since - // deleting a still-configurable global setting is a separate decision from this one). - AppUser maker = commandSource.getMaker(); - if (maker == null) { - throw new UnsupportedCommandException(permissionCode, "Maker user is missing."); - } - if (Objects.equals(appUser.getId(), maker.getId())) { - throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user."); + if (!configurationService.isSameMakerCheckerEnabled() && !appUser.isCheckerSuperUser()) { + AppUser maker = commandSource.getMaker(); + if (maker == null) { + throw new UnsupportedCommandException(permissionCode, "Maker user is missing."); + } + if (Objects.equals(appUser.getId(), maker.getId())) { + throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user."); + } } return commandSource; } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java index cbb1c1bc8..d0f945f84 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java @@ -250,11 +250,7 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement elsewhere. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId); } @@ -310,11 +306,7 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement elsewhere. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java index 9cd21255f..053998bf9 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java @@ -260,11 +260,7 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } @@ -354,11 +350,7 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java index 5fda9a977..3abffe3ad 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java @@ -264,11 +264,7 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } @@ -361,11 +357,7 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java index 8d617f6f4..ca4b88631 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java @@ -203,11 +203,7 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId); } @@ -269,11 +265,7 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java index 0f94f146a..54d4f96b7 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java @@ -420,11 +420,7 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } @@ -528,11 +524,7 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new SavingsProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new SavingsProductSelfApprovalNotAllowedException(productId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java index 7eecc2e66..77d7290c9 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java @@ -172,12 +172,7 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request, - // it just no longer lets them bypass the hold on their own (matches - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the - // equivalent rule for the classic command pipeline). - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId); } @@ -219,12 +214,7 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING) .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request, - // it just no longer lets them bypass the hold on their own (matches - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the - // equivalent rule for the classic command pipeline). - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId); } diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java index a135ebead..b2ce9c6b8 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java @@ -882,11 +882,7 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new ShareProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new ShareProductSelfApprovalNotAllowedException(productId); } @@ -972,11 +968,7 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING) .orElseThrow(() -> new ShareProductNoPendingEditException(productId)); - // Maker-identity rule: the same user can never approve their own submission, even when they - // hold CHECKER_SUPER_USER - see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the - // equivalent enforcement in the classic command pipeline. - if (pendingEdit.getMaker().getId().equals(checker.getId())) { + if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) { throw new ShareProductSelfApprovalNotAllowedException(productId); } diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml b/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml index a5a0a33c8..0f961c93b 100644 --- a/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml +++ b/fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml @@ -163,7 +163,6 @@ - diff --git a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0588_persist_manually_enabled_maker_checker_permissions.xml b/fineract-provider/src/main/resources/db/changelog/tenant/parts/0588_persist_manually_enabled_maker_checker_permissions.xml deleted file mode 100644 index bbee551d9..000000000 --- a/fineract-provider/src/main/resources/db/changelog/tenant/parts/0588_persist_manually_enabled_maker_checker_permissions.xml +++ /dev/null @@ -1,73 +0,0 @@ - - - - - - - - code IN ( - 'UPDATE_CURRENCY', - 'CREATE_FUND', - 'UPDATE_WORKINGDAYS', - 'CREATE_PAYMENTTYPE', 'UPDATE_PAYMENTTYPE', 'DELETE_PAYMENTTYPE', - 'CREATE_SPONSORBANK', 'UPDATE_SPONSORBANK', - 'UPDATE_BRANCHPROFILE', - 'CREATE_DATATABLE', 'UPDATE_DATATABLE', 'DELETE_DATATABLE', - 'CREATE_CODE', 'UPDATE_CODE', 'DELETE_CODE', - 'CREATE_CODEVALUE', 'UPDATE_CODEVALUE', 'DELETE_CODEVALUE', - 'CREATE_REPORT', 'UPDATE_REPORT', 'DELETE_REPORT', - 'CREATE_HOOK', 'UPDATE_HOOK', 'DELETE_HOOK', - 'CREATE_ACCOUNTNUMBERFORMAT', 'DELETE_ACCOUNTNUMBERFORMAT', - 'CREATE_USERAGREEMENT', - 'UPDATE_BATCH_BUSINESS_STEP' - ) - - - - diff --git a/fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java b/fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java index ee634c61c..c4db9dadf 100644 --- a/fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java +++ b/fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java @@ -116,11 +116,7 @@ public class CommandSourceServiceTest { } @Test - public void testProcessCommand_NonGLAccount_SuperUser_OwnSubmission_DoesNotBypassMakerChecker() { - // A maker who happens to hold CHECKER_SUPER_USER must not auto-approve their own submission - - // CHECKER_SUPER_USER only ever lets its holder approve a DIFFERENT user's request (see - // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction()). This - // replaces the old bypass this test used to assert. + public void testProcessCommand_NonGLAccount_SuperUser_BypassesMakerChecker() { NewCommandSourceHandler handler = Mockito.mock(NewCommandSourceHandler.class); JsonCommand jsonCommand = Mockito.mock(JsonCommand.class); CommandSource commandSource = Mockito.mock(CommandSource.class); @@ -129,8 +125,6 @@ public class CommandSourceServiceTest { Mockito.when(commandSource.getPermissionCode()).thenReturn("WITHDRAW_SAVINGSACCOUNT"); Mockito.when(commandSource.getEntityName()).thenReturn("SAVINGSACCOUNT"); Mockito.when(commandSource.getActionName()).thenReturn("WITHDRAW"); - Mockito.when(commandSource.getId()).thenReturn(300L); - Mockito.when(commandSource.getResourceId()).thenReturn(400L); Mockito.when(configurationDomainService.isMakerCheckerEnabledForTask("WITHDRAW_SAVINGSACCOUNT")).thenReturn(true); Mockito.when(superUser.isCheckerSuperUser()).thenReturn(true); @@ -138,12 +132,12 @@ public class CommandSourceServiceTest { .withCommandId(1L).build(); Mockito.when(handler.processCommand(jsonCommand)).thenReturn(dummyResult); - Assertions.assertThrows(org.apache.fineract.commands.exception.RollbackTransactionNotApprovedException.class, () -> { - underTest.processCommand(handler, jsonCommand, commandSource, superUser, false); - }); + org.apache.fineract.infrastructure.core.data.CommandProcessingResult result = underTest.processCommand(handler, jsonCommand, + commandSource, superUser, false); - Mockito.verify(commandSource).markAsAwaitingApproval(); - Mockito.verify(commandSource, Mockito.never()).markAsChecked(any()); + Assertions.assertNotNull(result); + Mockito.verify(commandSource).markAsChecked(superUser); + Mockito.verify(commandSource, Mockito.never()).markAsAwaitingApproval(); } @Test