Merge branch 'feature/bugfix' into dev-latest

Brings in the backend counterpart of "Enforce same-user maker-checker
restriction".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

# Conflicts:
#	fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml
#	fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml

fineract-core/src/main/java/org/apache/fineract/commands/service/CommandSourceService.java

@@ -137,7 +137,16 @@ public class CommandSourceService {
         String permission = commandSource.getPermissionCode();
         boolean isMakerChecker = configurationDomainService.isMakerCheckerEnabledForTask(permission);
         if (isMakerChecker || result.isRollbackTransaction()) {
-            if (isApprovedByChecker || isSuperUserBypassAllowed(commandSource, user)) {
+            // isApprovedByChecker is only ever true here for a genuine checker approval
+            // (PortfolioCommandSourceWritePlatformServiceImpl.approveEntry(), which has already run
+            // validateMakerCheckerTransaction() and confirmed the approver is not the maker) or a user
+            // editing their own account details (CommandWrapper.isChangeOfOwnUserDetails() - maker-checker
+            // genuinely does not apply there). On the ORIGINAL submission this is always false and `user`
+            // here is always the maker themselves, so there is deliberately no CHECKER_SUPER_USER (or any
+            // other) bypass at this point: holding CHECKER_SUPER_USER lets a user approve someone ELSE's
+            // request without needing the specific <TASK>_CHECKER permission, it must never let a maker
+            // auto-approve their own submission just by holding it.
+            if (isApprovedByChecker) {
                 commandSource.markAsChecked(user);
             } else {
                 if (commandSource.isSanitized()) {
@@ -151,25 +160,6 @@ public class CommandSourceService {
         return result;
     }
 
-    private boolean isSuperUserBypassAllowed(CommandSource commandSource, AppUser user) {
-        if (!user.isCheckerSuperUser()) {
-            return false;
-        }
-        if ("GLACCOUNT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CBSBASEINTERESTRATE".equalsIgnoreCase(commandSource.getEntityName())
-                || "CHARGE".equalsIgnoreCase(commandSource.getEntityName())
-                || "LOANPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SAVINGSPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "CURRENTPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "SHAREPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "FIXEDDEPOSITPRODUCT".equalsIgnoreCase(commandSource.getEntityName())
-                || "USER".equalsIgnoreCase(commandSource.getEntityName())
-                || "ROLE".equalsIgnoreCase(commandSource.getEntityName())) {
-            return false;
-        }
-        return true;
-    }
-
     private void sanitizeJson(@NonNull CommandSource commandSource, Set<String> sanitizeKeys) {
         if (sanitizeKeys == null || sanitizeKeys.isEmpty()) {
             return;

fineract-core/src/main/java/org/apache/fineract/commands/service/PortfolioCommandSourceWritePlatformServiceImpl.java

@@ -48,6 +48,12 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
     private final FromJsonHelper fromApiJsonHelper;
     private final CommandProcessingService processAndLogCommandService;
     private final SchedulerJobRunnerReadService schedulerJobRunnerReadService;
+    // No longer consulted by validateMakerCheckerTransaction() below: the maker-identity rule (a user
+    // can never approve their own submission) is now unconditional and isSameMakerCheckerEnabled() no
+    // longer overrides it. Left injected rather than removed - enable-same-maker-checker is still a
+    // live, independently-configurable global switch (System -> Configurations); deleting this field,
+    // and by extension deciding that switch should stop existing altogether, is a separate decision
+    // from closing this specific self-approval loophole.
     private final ConfigurationDomainService configurationService;
 
     @Override
@@ -123,14 +129,20 @@ public class PortfolioCommandSourceWritePlatformServiceImpl implements Portfolio
         AppUser appUser = this.context.authenticatedUser();
         String permissionCode = commandSource.getPermissionCode();
         appUser.validateHasCheckerPermissionTo(permissionCode);
-        if (!configurationService.isSameMakerCheckerEnabled() && !appUser.isCheckerSuperUser()) {
-            AppUser maker = commandSource.getMaker();
-            if (maker == null) {
-                throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
-            }
-            if (Objects.equals(appUser.getId(), maker.getId())) {
-                throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
-            }
+        // Maker-identity rule: the user who submitted a command may never be the one who approves
+        // (or rejects) it - this is a fixed platform rule, not overridable by CHECKER_SUPER_USER (that
+        // permission still lets its holder action a DIFFERENT user's request without needing the
+        // specific <TASK>_CHECKER permission - see validateHasCheckerPermissionTo() above - it just no
+        // longer lets them action their own) and not overridable by the enable-same-maker-checker
+        // global switch (isSameMakerCheckerEnabled() is deliberately no longer consulted here; that
+        // configuration is left in place and unused for this decision rather than removed, since
+        // deleting a still-configurable global setting is a separate decision from this one).
+        AppUser maker = commandSource.getMaker();
+        if (maker == null) {
+            throw new UnsupportedCommandException(permissionCode, "Maker user is missing.");
+        }
+        if (Objects.equals(appUser.getId(), maker.getId())) {
+            throw new UnsupportedCommandException(permissionCode, "Can not be checked by the same user.");
         }
         return commandSource;
     }