implemented a Maker-Checker workflow for Products, with approval-based updates and product locking to prevent concurrent edits

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/exception/CurrentProductEditPendingApprovalException.java

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.currentproduct.exception;
+
+import org.apache.fineract.infrastructure.core.exception.AbstractPlatformDomainRuleException;
+
+public class CurrentProductEditPendingApprovalException extends AbstractPlatformDomainRuleException {
+
+    public CurrentProductEditPendingApprovalException(final Long productId) {
+        super("error.msg.currentproduct.edit.pending.approval",
+                "Current product with identifier " + productId + " already has an edit pending approval", productId);
+    }
+}

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/exception/CurrentProductNoPendingEditException.java

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.currentproduct.exception;
+
+import org.apache.fineract.infrastructure.core.exception.AbstractPlatformDomainRuleException;
+
+public class CurrentProductNoPendingEditException extends AbstractPlatformDomainRuleException {
+
+    public CurrentProductNoPendingEditException(final Long productId) {
+        super("error.msg.currentproduct.no.pending.edit",
+                "Current product with identifier " + productId + " has no edit pending approval", productId);
+    }
+}

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/exception/CurrentProductSelfApprovalNotAllowedException.java

@@ -0,0 +1,29 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.portfolio.currentproduct.exception;
+
+import org.apache.fineract.infrastructure.core.exception.AbstractPlatformDomainRuleException;
+
+public class CurrentProductSelfApprovalNotAllowedException extends AbstractPlatformDomainRuleException {
+
+    public CurrentProductSelfApprovalNotAllowedException(final Long productId) {
+        super("error.msg.currentproduct.self.approval.not.allowed",
+                "The maker of the pending edit for current product " + productId + " cannot also approve or reject it", productId);
+    }
+}

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductReadPlatformService.java

@@ -20,6 +20,7 @@ package org.apache.fineract.portfolio.currentproduct.service;
 
 import java.util.Collection;
 import org.apache.fineract.portfolio.savings.data.SavingsProductData;
+import org.apache.fineract.portfolio.savings.data.SavingsProductTempData;
 
 public interface CurrentProductReadPlatformService {
 
@@ -28,4 +29,8 @@ public interface CurrentProductReadPlatformService {
     Collection<SavingsProductData> retrieveAllForLookup();
 
     SavingsProductData retrieveOne(Long productId);
+
+    Collection<SavingsProductTempData> retrieveAllPendingEdits();
+
+    SavingsProductTempData retrievePendingEdit(Long productId);
 }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductReadPlatformServiceImpl.java

@@ -42,7 +42,9 @@ import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilit
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityConfigRepository;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityLimit;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityLimitRepository;
+import org.apache.fineract.portfolio.currentproduct.exception.CurrentProductNoPendingEditException;
 import org.apache.fineract.portfolio.savings.data.SavingsProductData;
+import org.apache.fineract.portfolio.savings.data.SavingsProductTempData;
 import org.apache.fineract.portfolio.savings.exception.SavingsProductNotFoundException;
 import org.apache.fineract.portfolio.savings.service.SavingsEnumerations;
 import org.apache.fineract.portfolio.tax.data.TaxGroupData;
@@ -147,6 +149,55 @@ public class CurrentProductReadPlatformServiceImpl implements CurrentProductRead
         }
     }
 
+    private static final String PENDING_EDIT_SCHEMA = "spt.id as tempId, spt.product_id as savingsProductId, "
+            + "cp.name as savingsProductName, spt.maker_id as makerId, maker.username as makerUsername, "
+            + "spt.checker_id as checkerId, checker.username as checkerUsername, spt.created_on as createdOn, "
+            + "spt.checked_on as checkedOn, spt.status as status, spt.reject_reason as rejectReason, "
+            + "spt.proposed_payload_json as proposedPayloadJson "
+            + "from m_savings_product_temp spt "
+            + "join m_current_product cp on cp.id = spt.product_id "
+            + "join m_appuser maker on maker.id = spt.maker_id "
+            + "left join m_appuser checker on checker.id = spt.checker_id "
+            + "where spt.product_type = 'CURRENT' ";
+
+    private static final RowMapper<SavingsProductTempData> PENDING_EDIT_MAPPER = (rs, rowNum) -> {
+        final SavingsProductTempData data = new SavingsProductTempData();
+        data.setId(rs.getLong("tempId"));
+        data.setSavingsProductId(rs.getLong("savingsProductId"));
+        data.setSavingsProductName(rs.getString("savingsProductName"));
+        data.setMakerId(rs.getLong("makerId"));
+        data.setMakerUsername(rs.getString("makerUsername"));
+        data.setCheckerId(JdbcSupport.getLong(rs, "checkerId"));
+        data.setCheckerUsername(rs.getString("checkerUsername"));
+        data.setCreatedOn(rs.getTimestamp("createdOn") == null ? null : rs.getTimestamp("createdOn").toLocalDateTime());
+        data.setCheckedOn(rs.getTimestamp("checkedOn") == null ? null : rs.getTimestamp("checkedOn").toLocalDateTime());
+        data.setStatus(rs.getString("status"));
+        data.setRejectReason(rs.getString("rejectReason"));
+        final String proposedPayloadJson = rs.getString("proposedPayloadJson");
+        if (proposedPayloadJson != null) {
+            data.setProposedChanges(GSON.fromJson(proposedPayloadJson, new TypeToken<Map<String, Object>>() {}.getType()));
+        }
+        return data;
+    };
+
+    @Override
+    public Collection<SavingsProductTempData> retrieveAllPendingEdits() {
+        this.context.authenticatedUser();
+        final String sql = "select " + PENDING_EDIT_SCHEMA + "and spt.status = 'PENDING' order by spt.created_on desc";
+        return this.jdbcTemplate.query(sql, PENDING_EDIT_MAPPER);
+    }
+
+    @Override
+    public SavingsProductTempData retrievePendingEdit(final Long productId) {
+        this.context.authenticatedUser();
+        final String sql = "select " + PENDING_EDIT_SCHEMA + "and spt.status = 'PENDING' and spt.product_id = ?";
+        try {
+            return this.jdbcTemplate.queryForObject(sql, PENDING_EDIT_MAPPER, new Object[] { productId }); // NOSONAR
+        } catch (final EmptyResultDataAccessException e) {
+            throw new CurrentProductNoPendingEditException(productId);
+        }
+    }
+
     private static final class CurrentProductMapper implements RowMapper<SavingsProductData> {
 
         private final String schemaSql;
@@ -197,7 +248,9 @@ public class CurrentProductReadPlatformServiceImpl implements CurrentProductRead
             sqlBuilder.append("cp.account_closed_zero_balance_in_day_closing as accountClosedZeroBalanceInDayClosing, ");
             sqlBuilder.append("cp.balance_swap_option as balanceSwapOption, cp.msme as msme, cp.auto_debit_facility as autoDebitFacility, ");
             sqlBuilder.append("cp.avg_balance_calc_period as avgBalanceCalcPeriod, cp.valid_for_period as validForPeriod, ");
-            sqlBuilder.append("cp.od_account_closed_zero_balance_in_day_closing as odAccountClosedZeroBalanceInDayClosing ");
+            sqlBuilder.append("cp.od_account_closed_zero_balance_in_day_closing as odAccountClosedZeroBalanceInDayClosing, ");
+            sqlBuilder.append("exists(select 1 from m_savings_product_temp spt where spt.product_id = cp.id "
+                    + "and spt.product_type = 'CURRENT' and spt.status = 'PENDING') as isPendingApproval ");
 
             sqlBuilder.append("from m_current_product cp ");
             sqlBuilder.append("join m_currency curr on curr.code = cp.currency_code ");
@@ -321,6 +374,7 @@ public class CurrentProductReadPlatformServiceImpl implements CurrentProductRead
             productData.setAvgBalanceCalcPeriod(rs.getString("avgBalanceCalcPeriod"));
             productData.setValidForPeriod(rs.getString("validForPeriod"));
             productData.setOdAccountClosedZeroBalanceInDayClosing(rs.getBoolean("odAccountClosedZeroBalanceInDayClosing"));
+            productData.setIsPendingApproval(rs.getBoolean("isPendingApproval"));
 
             return productData;
         }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductWritePlatformService.java

@@ -28,4 +28,21 @@ public interface CurrentProductWritePlatformService {
     CommandProcessingResult update(Long productId, JsonCommand command);
 
     CommandProcessingResult delete(Long productId);
+
+    /**
+     * Submits an edit for approval instead of applying it directly. Fails if a pending edit already exists for this
+     * product (that pending row is itself the lock).
+     */
+    CommandProcessingResult submitEditForApproval(Long productId, JsonCommand command);
+
+    /**
+     * Replays the stored pending edit through the normal update path and marks it approved. Fails if the approving
+     * user is the same user who submitted the edit.
+     */
+    CommandProcessingResult approveEdit(Long productId);
+
+    /**
+     * Discards the pending edit. Fails if the rejecting user is the same user who submitted the edit.
+     */
+    CommandProcessingResult rejectEdit(Long productId, String rejectReason);
 }

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/service/CurrentProductWritePlatformServiceJpaRepositoryImpl.java

@@ -31,6 +31,9 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.apache.fineract.accounting.producttoaccountmapping.service.ProductToGLAccountMappingWritePlatformService;
+import org.apache.fineract.commands.domain.CommandProcessingResultType;
+import org.apache.fineract.commands.domain.CommandSource;
+import org.apache.fineract.commands.domain.CommandSourceRepository;
 import org.apache.fineract.infrastructure.core.api.JsonCommand;
 import org.apache.fineract.infrastructure.core.data.ApiParameterError;
 import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
@@ -38,6 +41,8 @@ import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuild
 import org.apache.fineract.infrastructure.core.data.DataValidatorBuilder;
 import org.apache.fineract.infrastructure.core.exception.ErrorHandler;
 import org.apache.fineract.infrastructure.core.exception.PlatformApiDataValidationException;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
+import org.apache.fineract.infrastructure.core.service.DateUtils;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
 import org.apache.fineract.portfolio.charge.domain.Charge;
 import org.apache.fineract.portfolio.currentproduct.data.CurrentProductDataValidator;
@@ -50,10 +55,16 @@ import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilit
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityLimit;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductFacilityLimitRepository;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductRepository;
+import org.apache.fineract.portfolio.currentproduct.exception.CurrentProductEditPendingApprovalException;
+import org.apache.fineract.portfolio.currentproduct.exception.CurrentProductNoPendingEditException;
+import org.apache.fineract.portfolio.currentproduct.exception.CurrentProductSelfApprovalNotAllowedException;
 import org.apache.fineract.portfolio.savings.DepositsApiConstants;
 import org.apache.fineract.portfolio.savings.DepositAccountType;
+import org.apache.fineract.portfolio.savings.domain.ProductPendingEdit;
+import org.apache.fineract.portfolio.savings.domain.ProductPendingEditRepository;
 import org.apache.fineract.portfolio.savings.exception.SavingsProductNotFoundException;
 import org.apache.fineract.portfolio.tax.domain.TaxGroup;
+import org.apache.fineract.useradministration.domain.AppUser;
 import org.springframework.dao.DataAccessException;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -69,6 +80,9 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
     private final CurrentProductFacilityConfigRepository facilityConfigRepository;
     private final CurrentProductFacilityLimitRepository facilityLimitRepository;
     private final CurrentProductDepositLimitKycRepository depositLimitKycRepository;
+    private final ProductPendingEditRepository productPendingEditRepository;
+    private final FromJsonHelper fromApiJsonHelper;
+    private final CommandSourceRepository commandSourceRepository;
 
     private void handleDataIntegrityIssues(final JsonCommand command, final Throwable realCause, final Exception dae) {
         String msgCode = "error.msg." + DepositsApiConstants.CURRENT_PRODUCT_RESOURCE_NAME;
@@ -251,6 +265,124 @@ public class CurrentProductWritePlatformServiceJpaRepositoryImpl implements Curr
         }
     }
 
+    @Transactional
+    @Override
+    public CommandProcessingResult submitEditForApproval(final Long productId, final JsonCommand command) {
+
+        final AppUser maker = this.context.authenticatedUser();
+        final CurrentProduct product = this.currentProductRepository.findById(productId)
+                .orElseThrow(() -> new SavingsProductNotFoundException(productId));
+
+        if (this.productPendingEditRepository
+                .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_CURRENT, productId, ProductPendingEdit.STATUS_PENDING)
+                .isPresent()) {
+            throw new CurrentProductEditPendingApprovalException(productId);
+        }
+
+        this.fromApiJsonDataValidator.validateForUpdate(command.json(), product);
+
+        final ProductPendingEdit pendingEdit = new ProductPendingEdit(ProductPendingEdit.TYPE_CURRENT, productId, maker, command.json());
+
+        final CommandSource auditEntry = CommandSource.builder() //
+                .actionName("UPDATE") //
+                .entityName("CURRENTPRODUCT") //
+                .resourceGetUrl("/currentproducts/" + productId) //
+                .resourceId(productId) //
+                .commandAsJson(command.json()) //
+                .maker(maker) //
+                .madeOnDate(DateUtils.getAuditOffsetDateTime()) //
+                .status(CommandProcessingResultType.AWAITING_APPROVAL.getValue()) //
+                .idempotencyKey(java.util.UUID.randomUUID().toString()) //
+                .sanitized(false) //
+                .build();
+        this.commandSourceRepository.saveAndFlush(auditEntry);
+        pendingEdit.setCommandSourceId(auditEntry.getId());
+
+        this.productPendingEditRepository.saveAndFlush(pendingEdit);
+
+        return new CommandProcessingResultBuilder() //
+                .withEntityId(product.getId()) //
+                .build();
+    }
+
+    @Transactional
+    @Override
+    public CommandProcessingResult approveEdit(final Long productId) {
+
+        final AppUser checker = this.context.authenticatedUser();
+        final ProductPendingEdit pendingEdit = this.productPendingEditRepository
+                .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_CURRENT, productId, ProductPendingEdit.STATUS_PENDING)
+                .orElseThrow(() -> new CurrentProductNoPendingEditException(productId));
+
+        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+            throw new CurrentProductSelfApprovalNotAllowedException(productId);
+        }
+
+        final JsonCommand replayedCommand = JsonCommand.fromJsonElement(productId,
+                this.fromApiJsonHelper.parse(pendingEdit.getProposedPayloadJson()), this.fromApiJsonHelper);
+        final CommandProcessingResult result = update(productId, replayedCommand);
+
+        pendingEdit.markApproved(checker);
+        this.productPendingEditRepository.saveAndFlush(pendingEdit);
+
+        final CommandSource auditEntry = findOrCreateAuditEntry(pendingEdit, productId);
+        auditEntry.markAsChecked(checker);
+        auditEntry.updateForAudit(result);
+        this.commandSourceRepository.saveAndFlush(auditEntry);
+
+        return result;
+    }
+
+    private CommandSource findOrCreateAuditEntry(final ProductPendingEdit pendingEdit, final Long productId) {
+        if (pendingEdit.getCommandSourceId() != null) {
+            final java.util.Optional<CommandSource> existing = this.commandSourceRepository.findById(pendingEdit.getCommandSourceId());
+            if (existing.isPresent()) {
+                return existing.get();
+            }
+        }
+        final CommandSource auditEntry = CommandSource.builder() //
+                .actionName("UPDATE") //
+                .entityName("CURRENTPRODUCT") //
+                .resourceGetUrl("/currentproducts/" + productId) //
+                .resourceId(productId) //
+                .commandAsJson(pendingEdit.getProposedPayloadJson()) //
+                .maker(pendingEdit.getMaker()) //
+                .madeOnDate(DateUtils.getAuditOffsetDateTime()) //
+                .status(CommandProcessingResultType.AWAITING_APPROVAL.getValue()) //
+                .idempotencyKey(java.util.UUID.randomUUID().toString()) //
+                .sanitized(false) //
+                .build();
+        this.commandSourceRepository.saveAndFlush(auditEntry);
+        pendingEdit.setCommandSourceId(auditEntry.getId());
+        this.productPendingEditRepository.saveAndFlush(pendingEdit);
+        return auditEntry;
+    }
+
+    @Transactional
+    @Override
+    public CommandProcessingResult rejectEdit(final Long productId, final String rejectReason) {
+
+        final AppUser checker = this.context.authenticatedUser();
+        final ProductPendingEdit pendingEdit = this.productPendingEditRepository
+                .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_CURRENT, productId, ProductPendingEdit.STATUS_PENDING)
+                .orElseThrow(() -> new CurrentProductNoPendingEditException(productId));
+
+        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+            throw new CurrentProductSelfApprovalNotAllowedException(productId);
+        }
+
+        pendingEdit.markRejected(checker, rejectReason);
+        this.productPendingEditRepository.saveAndFlush(pendingEdit);
+
+        final CommandSource auditEntry = findOrCreateAuditEntry(pendingEdit, productId);
+        auditEntry.markAsRejected(checker);
+        this.commandSourceRepository.saveAndFlush(auditEntry);
+
+        return new CommandProcessingResultBuilder() //
+                .withEntityId(productId) //
+                .build();
+    }
+
     @Transactional
     @Override
     public CommandProcessingResult delete(final Long productId) {

fineract-current-product/src/main/java/org/apache/fineract/portfolio/currentproduct/starter/CurrentProductConfiguration.java

@@ -19,7 +19,10 @@
 package org.apache.fineract.portfolio.currentproduct.starter;
 
 import org.apache.fineract.accounting.producttoaccountmapping.service.ProductToGLAccountMappingWritePlatformService;
+import org.apache.fineract.commands.domain.CommandSourceRepository;
+import org.apache.fineract.infrastructure.core.serialization.FromJsonHelper;
 import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext;
+import org.apache.fineract.portfolio.savings.domain.ProductPendingEditRepository;
 import org.apache.fineract.portfolio.currentproduct.data.CurrentProductDataValidator;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductAssembler;
 import org.apache.fineract.portfolio.currentproduct.domain.CurrentProductDepositLimitKycRepository;
@@ -56,9 +59,13 @@ public class CurrentProductConfiguration {
             ProductToGLAccountMappingWritePlatformService accountMappingWritePlatformService,
             CurrentProductFacilityConfigRepository currentFacilityConfigRepository,
             CurrentProductFacilityLimitRepository currentFacilityLimitRepository,
-            CurrentProductDepositLimitKycRepository currentDepositLimitKycRepository) {
+            CurrentProductDepositLimitKycRepository currentDepositLimitKycRepository,
+            ProductPendingEditRepository productPendingEditRepository,
+            FromJsonHelper fromApiJsonHelper,
+            CommandSourceRepository commandSourceRepository) {
         return new CurrentProductWritePlatformServiceJpaRepositoryImpl(context, currentProductRepository, currentProductDataValidator,
                 currentProductAssembler, accountMappingWritePlatformService, currentFacilityConfigRepository,
-                currentFacilityLimitRepository, currentDepositLimitKycRepository);
+                currentFacilityLimitRepository, currentDepositLimitKycRepository, productPendingEditRepository, fromApiJsonHelper,
+                commandSourceRepository);
     }
 }