fix(cashier): prevent duplicate cashier lookup crash + add missing migrations

- DenominationBreakdownWriter: add ORDER BY mc.id DESC LIMIT 1 to all cashier
  lookup queries so multiple cashier records per staff do not crash queryForObject
- CashReportApiResource: same LIMIT 1 fix for cashier-day-status and position endpoints
- 0311: fix m_client and m_savings_account NOT NULL columns (created_by, last_modified_by,
  created_on_utc, last_modified_on_utc, cif_number, is_lien_allowed, etc.)
- 0312: create CASHIER role if missing + grant all 34 cashier permissions (incl FD/RD)
- 0313: add missing m_cash_exchange columns (cashier_id, is_reversed, reversed_by,
  reversed_at, reverse_reason, customer_id_proof)
- 0314: unique constraint on m_cashiers.staff_id to prevent duplicate allocations
- application.properties: restore local postgres password after merge
- ExecuteOverdueAndCurrentStandingInstructionsTest: fix constructor call (5 args)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fineract-provider/src/main/java/org/apache/fineract/portfolio/cashreport/api/CashReportApiResource.java

@@ -207,7 +207,8 @@ public class CashReportApiResource {
         try {
             cashierId = jdbcTemplate.queryForObject(
                     "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id "
-                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? "
+                            + "ORDER BY mc.id DESC LIMIT 1",
                     Long.class, appUserId);
         } catch (Exception e) {
             // Not a cashier user — no restriction applies
@@ -311,7 +312,7 @@ public class CashReportApiResource {
         Long cashierId;
         try {
             cashierId = jdbcTemplate.queryForObject(
-                    "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                    "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? ORDER BY mc.id DESC LIMIT 1",
                     Long.class, appUserId);
         } catch (Exception e) {
             Map<String, Object> empty = new LinkedHashMap<>();

fineract-provider/src/main/java/org/apache/fineract/portfolio/denominationmaster/service/DenominationBreakdownWriter.java

@@ -155,7 +155,8 @@ public class DenominationBreakdownWriter {
             final AppUser user = context.authenticatedUser();
             cashierId = jdbcTemplate.queryForObject(
                     "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id "
-                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? "
+                            + "ORDER BY mc.id DESC LIMIT 1",
                     Long.class, user.getId());
         } catch (Exception e) {
             return; // not a cashier user — skip
@@ -194,7 +195,8 @@ public class DenominationBreakdownWriter {
             final AppUser user = context.authenticatedUser();
             cashierId = jdbcTemplate.queryForObject(
                     "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id "
-                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? "
+                            + "ORDER BY mc.id DESC LIMIT 1",
                     Long.class, user.getId());
         } catch (Exception e) {
             return; // not a cashier user — skip
@@ -234,7 +236,8 @@ public class DenominationBreakdownWriter {
             final AppUser user = context.authenticatedUser();
             cashierId = jdbcTemplate.queryForObject(
                     "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id "
-                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? "
+                            + "ORDER BY mc.id DESC LIMIT 1",
                     Long.class, user.getId());
         } catch (Exception e) {
             return; // not a cashier user — skip
@@ -331,7 +334,8 @@ public class DenominationBreakdownWriter {
             final AppUser user = context.authenticatedUser();
             cashierId = jdbcTemplate.queryForObject(
                     "SELECT mc.id FROM m_cashiers mc JOIN m_staff ms ON ms.id = mc.staff_id "
-                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ?",
+                            + "JOIN m_appuser au ON au.staff_id = ms.id WHERE au.id = ? "
+                            + "ORDER BY mc.id DESC LIMIT 1",
                     Long.class, user.getId());
         } catch (Exception e) {
             return; // not a cashier user — skip stock check

fineract-provider/src/main/resources/application.properties

@@ -407,7 +407,7 @@ server.tomcat.mbeanregistry.enabled=${FINERACT_SERVER_TOMCAT_MBEANREGISTRY_ENABL
 spring.datasource.hikari.driverClassName=${FINERACT_HIKARI_DRIVER_SOURCE_CLASS_NAME:org.postgresql.Driver}
 spring.datasource.hikari.jdbcUrl=${FINERACT_HIKARI_JDBC_URL:jdbc:postgresql://localhost:5432/fineract_tenants}
 spring.datasource.hikari.username=${FINERACT_HIKARI_USERNAME:postgres}
-spring.datasource.hikari.password=${FINERACT_HIKARI_PASSWORD:root}
+spring.datasource.hikari.password=${FINERACT_HIKARI_PASSWORD:313863}
 spring.datasource.hikari.minimumIdle=${FINERACT_HIKARI_MINIMUM_IDLE:3}
 spring.datasource.hikari.maximumPoolSize=${FINERACT_HIKARI_MAXIMUM_POOL_SIZE:10}
 spring.datasource.hikari.idleTimeout=${FINERACT_HIKARI_IDLE_TIMEOUT:60000}

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -339,4 +339,7 @@
     <include file="parts/0309_phase3_jobs_and_recall_permission.xml" relativeToChangelogFile="true"/>
     <include file="parts/0310_fund_transfer_roles_and_token_cleanup_job.xml" relativeToChangelogFile="true"/>
     <include file="parts/0311_create_fund_transfer_suspense_account.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0312_grant_cashier_fd_rd_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0313_alter_cash_exchange_add_columns.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0314_cashier_staff_unique_constraint.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0311_create_fund_transfer_suspense_account.xml

@@ -42,12 +42,18 @@
             INSERT INTO m_client (
                 account_no, external_id, status_enum, office_id, display_name,
                 fullname, is_staff, activation_date, office_joining_date,
-                submittedon_date, legal_form_enum
+                submittedon_date, legal_form_enum,
+                created_on_utc, created_by,
+                last_modified_on_utc, last_modified_by,
+                cif_number
             )
             VALUES (
                 'HOUSE0000001', 'FUNDTRANSFER_SUSPENSE_HOUSE', 300, 1, 'House (Fund Transfer Suspense)',
                 'House (Fund Transfer Suspense)', false, CURRENT_DATE, CURRENT_DATE,
-                CURRENT_DATE, 2
+                CURRENT_DATE, 2,
+                NOW(), 1,
+                NOW(), 1,
+                'CIF_SUSPENSE_HOUSE'
             )
         </sql>
     </changeSet>
@@ -74,7 +80,9 @@
                 withdrawal_fee_for_transfer, allow_overdraft, overdraft_limit,
                 nominal_annual_interest_rate_overdraft, min_overdraft_for_interest_calculation,
                 enforce_min_required_balance, account_balance_derived,
-                version, withhold_tax
+                version, withhold_tax,
+                created_by, last_modified_by, created_on_utc, last_modified_on_utc,
+                is_lien_allowed, nomination_facility, auto_debit_facility, is_senior_citizen
             )
             SELECT
                 'SUSPENSE01', 'FUNDTRANSFER_SUSPENSE',
@@ -89,7 +97,9 @@
                 false, false, NULL,
                 0.000000, 0.000000,
                 false, 0.000000,
-                1, false
+                1, false,
+                1, 1, NOW(), NOW(),
+                false, false, false, false
             FROM m_savings_product sp
             WHERE sp.id = (SELECT MIN(id) FROM m_savings_product)
         </sql>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0312_grant_cashier_fd_rd_permissions.xml

@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Step 1: Create CASHIER role if not exists -->
+    <changeSet id="0312_create_cashier_role" author="fineract">
+        <sql>
+            INSERT INTO m_role (name, description, is_disabled)
+            SELECT 'CASHIER', 'Cashier role with cash module permissions', false
+            WHERE NOT EXISTS (SELECT 1 FROM m_role WHERE name = 'CASHIER');
+        </sql>
+    </changeSet>
+
+    <!-- Step 2: Grant all CASHIER permissions -->
+    <changeSet id="0312_grant_cashier_all_permissions" author="fineract">
+        <sql>
+            INSERT INTO m_role_permission (role_id, permission_id)
+            SELECT r.id, p.id
+            FROM m_role r
+            JOIN m_permission p ON p.code IN (
+                -- Cash module
+                'CREATE_CASHTRANSFER',
+                'READ_CASHTRANSFER',
+                'REVERSE_CASHTRANSFER',
+                'CREATE_CASHSETTLEMENT',
+                'READ_CASHSETTLEMENT',
+                'REVERSE_CASHSETTLEMENT',
+                'CREATE_CASHINTERCASHIER',
+                'READ_CASHINTERCASHIER',
+                'REVERSE_CASHINTERCASHIER',
+                'CREATE_CASHRECONCILIATION',
+                'READ_CASHRECONCILIATION',
+                -- Savings
+                'DEPOSIT_SAVINGSACCOUNT',
+                'WITHDRAWAL_SAVINGSACCOUNT',
+                'READ_SAVINGSACCOUNT',
+                'READ_SAVINGSPRODUCT',
+                'READ_Savings Transactions',
+                -- Current Account
+                'DEPOSIT_CURRENTACCOUNT',
+                'WITHDRAWAL_CURRENTACCOUNT',
+                'READ_CURRENTACCOUNT',
+                'READ_CURRENTPRODUCT',
+                'READ_Client Saving Transactions',
+                -- Fixed Deposit
+                'DEPOSIT_FIXEDDEPOSITACCOUNT',
+                'WITHDRAWAL_FIXEDDEPOSITACCOUNT',
+                'READ_FIXEDDEPOSITACCOUNT',
+                'READ_FIXEDDEPOSITPRODUCT',
+                -- Recurring Deposit
+                'DEPOSIT_RECURRINGDEPOSITACCOUNT',
+                'WITHDRAWAL_RECURRINGDEPOSITACCOUNT',
+                'READ_RECURRINGDEPOSITACCOUNT',
+                'READ_RECURRINGDEPOSITPRODUCT',
+                -- Client
+                'READ_CLIENT',
+                -- Menu
+                'MENU_CASHIER',
+                'MENU_DEPOSITS',
+                'MENU_INSTITUTION',
+                'MENU_TASKS'
+            )
+            WHERE r.name = 'CASHIER'
+              AND NOT EXISTS (
+                SELECT 1 FROM m_role_permission rp
+                WHERE rp.role_id = r.id AND rp.permission_id = p.id
+              );
+        </sql>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0313_alter_cash_exchange_add_columns.xml

@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <changeSet id="0313_cash_exchange_add_cashier_id" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="cashier_id"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="cashier_id" type="BIGINT"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0313_cash_exchange_add_customer_id_proof" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="customer_id_proof"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="customer_id_proof" type="VARCHAR(50)"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0313_cash_exchange_add_is_reversed" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="is_reversed"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="is_reversed" type="BOOLEAN" defaultValueBoolean="false"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0313_cash_exchange_add_reversed_by" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="reversed_by"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="reversed_by" type="BIGINT"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0313_cash_exchange_add_reversed_at" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="reversed_at"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="reversed_at" type="TIMESTAMP"/>
+        </addColumn>
+    </changeSet>
+
+    <changeSet id="0313_cash_exchange_add_reverse_reason" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <not><columnExists tableName="m_cash_exchange" columnName="reverse_reason"/></not>
+        </preConditions>
+        <addColumn tableName="m_cash_exchange">
+            <column name="reverse_reason" type="VARCHAR(500)"/>
+        </addColumn>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0314_cashier_staff_unique_constraint.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!--
+        Adds a unique constraint on m_cashiers.staff_id so one staff member
+        cannot be allocated as a cashier more than once.
+        preCondition: skip if duplicates still exist (manual cleanup needed first).
+    -->
+    <changeSet id="0314_cashier_staff_unique_index" author="fineract">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">
+                SELECT COUNT(*) FROM (
+                    SELECT staff_id FROM m_cashiers GROUP BY staff_id HAVING COUNT(*) > 1
+                ) duplicates
+            </sqlCheck>
+        </preConditions>
+        <createIndex tableName="m_cashiers" indexName="uq_cashiers_staff_id" unique="true">
+            <column name="staff_id"/>
+        </createIndex>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/test/java/org/apache/fineract/portfolio/account/jobs/executestandinginstructions/ExecuteOverdueAndCurrentStandingInstructionsTest.java

@@ -49,14 +49,14 @@ public class ExecuteOverdueAndCurrentStandingInstructionsTest {
 
     @Test
     public void testAcceptPreviousDateAsDue() {
-        ExecuteStandingInstructionsTasklet tasklet = new ExecuteStandingInstructionsTasklet(null, null, null, null);
+        ExecuteStandingInstructionsTasklet tasklet = new ExecuteStandingInstructionsTasklet(null, null, null, null, null);
         boolean isDueForTransfer = tasklet.isDueForTransfer(new StandingInstructionDuesData(previousDate, BigDecimal.ONE));
         assertThat(isDueForTransfer).isTrue().describedAs("Earlier instructions are accepted as due");
     }
 
     @Test
     public void testAcceptCurrentDateAsDue() {
-        ExecuteStandingInstructionsTasklet tasklet = new ExecuteStandingInstructionsTasklet(null, null, null, null);
+        ExecuteStandingInstructionsTasklet tasklet = new ExecuteStandingInstructionsTasklet(null, null, null, null, null);
         boolean isDueForTransfer = tasklet.isDueForTransfer(new StandingInstructionDuesData(currentDate, BigDecimal.ONE));
         assertThat(isDueForTransfer).isTrue().describedAs("Current day instructions are accepted as due");
     }