Merge branch 'feature/bugfix' into dev-latest

Brings in the backend counterpart of "Enforce same-user maker-checker
restriction".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

# Conflicts:
#	fineract-provider/src/main/resources/db/changelog/tenant-store/parts/0012_seed_default_platform_api_client.xml
#	fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/CurrentAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -250,7 +250,11 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement elsewhere.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId);
         }
 
@@ -306,7 +310,11 @@ public class CurrentAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findByCurrentAccountIdAndStatus(currentAccountId, CurrentAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new CurrentAccountNoPendingEditException(currentAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see ShareAccountEditWritePlatformServiceJpaRepositoryImpl and
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement elsewhere.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new CurrentAccountEditSelfApprovalNotAllowedException(currentAccountId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/FixedDepositProductWritePlatformServiceJpaRepositoryImpl.java

@@ -260,7 +260,11 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -350,7 +354,11 @@ public class FixedDepositProductWritePlatformServiceJpaRepositoryImpl implements
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_FD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/RecurringDepositProductWritePlatformServiceJpaRepositoryImpl.java

@@ -264,7 +264,11 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -357,7 +361,11 @@ public class RecurringDepositProductWritePlatformServiceJpaRepositoryImpl implem
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_RD, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -203,7 +203,11 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId);
         }
 
@@ -265,7 +269,11 @@ public class SavingsAccountEditWritePlatformServiceJpaRepositoryImpl implements
                 .findBySavingsAccountIdAndStatus(savingsId, SavingsAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsAccountNoPendingEditException(savingsId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsAccountEditSelfApprovalNotAllowedException(savingsId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductWritePlatformServiceJpaRepositoryImpl.java

@@ -420,7 +420,11 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -524,7 +528,11 @@ public class SavingsProductWritePlatformServiceJpaRepositoryImpl implements Savi
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SAVINGS, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new SavingsProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new SavingsProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/shareaccounts/service/ShareAccountEditWritePlatformServiceJpaRepositoryImpl.java

@@ -172,7 +172,12 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh
                 .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request,
+        // it just no longer lets them bypass the hold on their own (matches
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the
+        // equivalent rule for the classic command pipeline).
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId);
         }
 
@@ -214,7 +219,12 @@ public class ShareAccountEditWritePlatformServiceJpaRepositoryImpl implements Sh
                 .findByShareAccountIdAndStatus(shareAccountId, ShareAccountPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareAccountNoPendingEditException(shareAccountId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - that permission still lets them approve someone ELSE's request,
+        // it just no longer lets them bypass the hold on their own (matches
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction(), the
+        // equivalent rule for the classic command pipeline).
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareAccountEditSelfApprovalNotAllowedException(shareAccountId);
         }
 

fineract-provider/src/main/java/org/apache/fineract/portfolio/shareproducts/service/ShareProductWritePlatformServiceJpaRepositoryImpl.java

@@ -882,7 +882,11 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareProductSelfApprovalNotAllowedException(productId);
         }
 
@@ -968,7 +972,11 @@ public class ShareProductWritePlatformServiceJpaRepositoryImpl implements ShareP
                 .findByProductTypeAndProductIdAndStatus(ProductPendingEdit.TYPE_SHARE, productId, ProductPendingEdit.STATUS_PENDING)
                 .orElseThrow(() -> new ShareProductNoPendingEditException(productId));
 
-        if (pendingEdit.getMaker().getId().equals(checker.getId()) && !checker.isCheckerSuperUser()) {
+        // Maker-identity rule: the same user can never approve their own submission, even when they
+        // hold CHECKER_SUPER_USER - see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction() for the
+        // equivalent enforcement in the classic command pipeline.
+        if (pendingEdit.getMaker().getId().equals(checker.getId())) {
             throw new ShareProductSelfApprovalNotAllowedException(productId);
         }
 

fineract-provider/src/main/resources/db/changelog/tenant/final-changelog-tenant.xml

@@ -163,4 +163,5 @@
     <include file="parts/0588_add_premature_closure_reason.xml" relativeToChangelogFile="true"/>
     <include file="parts/0589_savings_interest_posting_report.xml" relativeToChangelogFile="true"/>
     <include file="parts/0590_savings_interest_posting_report_by_branch.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0588_persist_manually_enabled_maker_checker_permissions.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0588_persist_manually_enabled_maker_checker_permissions.xml

@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!-- Converts manually-applied Configure Maker Checker Tasks changes into a repeatable migration.
+         During Admin -> Organization and Admin -> System testing, can_maker_checker was switched on
+         (via System -> Configure Maker Checker Tasks) for the 28 permissions below, directly in the
+         dev database - none of that was ever captured by a migration, so a fresh/other environment
+         restored from this changelog history would come up with every one of them still at its
+         originally-seeded false value. Every code here was independently confirmed, via read-only
+         inspection of both its origin changeset and the live database, to be seeded can_maker_checker
+         = false and currently true in the running dev DB with no existing changeset already covering
+         the flip (the one precedent for this pattern, DELETE_OFFICE, was flipped by changeset
+         0538_enable_maker_checker_for_delete_office and is deliberately left untouched here).
+
+         This changeset only ever moves can_maker_checker from false to true for these exact codes -
+         entity_name, action_name, grouping and every other column are left exactly as their origin
+         changeset defined them (including the pre-existing DELETE_ACCOUNTNUMBERFORMAT entity_name
+         drift, which is out of scope for this change and is not corrected here). No _CHECKER row is
+         touched: those already exist for every code below (added earlier by 0583/0586, or by base
+         Fineract for the stock codes), and can_maker_checker is not a column on a _CHECKER row.
+
+         Grouped by the screen each permission belongs to:
+           - Currency Configuration:            UPDATE_CURRENCY
+           - Manage Funds:                      CREATE_FUND
+           - Working Days:                      UPDATE_WORKINGDAYS
+           - Payment Type:                      CREATE_PAYMENTTYPE, UPDATE_PAYMENTTYPE, DELETE_PAYMENTTYPE
+           - Sponsor Banks:                     CREATE_SPONSORBANK, UPDATE_SPONSORBANK
+           - Branch Profile:                    UPDATE_BRANCHPROFILE
+           - Manage Data Tables:                CREATE_DATATABLE, UPDATE_DATATABLE, DELETE_DATATABLE
+           - Manage Codes:                       CREATE_CODE, UPDATE_CODE, DELETE_CODE,
+                                                 CREATE_CODEVALUE, UPDATE_CODEVALUE, DELETE_CODEVALUE
+           - Manage Reports:                    CREATE_REPORT, UPDATE_REPORT, DELETE_REPORT
+           - Manage Hooks:                      CREATE_HOOK, UPDATE_HOOK, DELETE_HOOK
+           - Account Number Preferences:        CREATE_ACCOUNTNUMBERFORMAT, DELETE_ACCOUNTNUMBERFORMAT
+           - Manage User Agreement:             CREATE_USERAGREEMENT
+           - Manage Jobs (COB Workflow Step Reorder): UPDATE_BATCH_BUSINESS_STEP
+
+         Deliberately NOT included (confirmed still false, or out of scope, and left untouched):
+           - UPDATE_PERMISSION, UPDATE_CONFIGURATION (the Configure Maker Checker Tasks self-lockout
+             exclusion added by PermissionReadPlatformServiceImpl stays in effect; these remain false)
+           - UPDATE_SPONSORDDGLMAPPING, all Entity-to-Entity Mapping, External Services and Manage
+             Survey permissions (confirmed still false - never actually toggled on)
+           - CREATE_ROLE/UPDATE_ROLE/DELETE_ROLE/etc., CREATE_GLACCOUNT, CREATE_CHARGE,
+             CREATE_LOANPRODUCT, CREATE_SAVINGSPRODUCT and other permissions observed to already be
+             true in the live DB but belonging to Accounting/Products/Roles modules, not Admin ->
+             Organization or Admin -> System - out of scope for this change and left as pre-existing
+             drift for a separate decision. -->
+    <changeSet id="0588_persist_manually_enabled_maker_checker_permissions" author="cbs-anshul">
+        <update tableName="m_permission">
+            <column name="can_maker_checker" valueBoolean="true"/>
+            <where>code IN (
+                'UPDATE_CURRENCY',
+                'CREATE_FUND',
+                'UPDATE_WORKINGDAYS',
+                'CREATE_PAYMENTTYPE', 'UPDATE_PAYMENTTYPE', 'DELETE_PAYMENTTYPE',
+                'CREATE_SPONSORBANK', 'UPDATE_SPONSORBANK',
+                'UPDATE_BRANCHPROFILE',
+                'CREATE_DATATABLE', 'UPDATE_DATATABLE', 'DELETE_DATATABLE',
+                'CREATE_CODE', 'UPDATE_CODE', 'DELETE_CODE',
+                'CREATE_CODEVALUE', 'UPDATE_CODEVALUE', 'DELETE_CODEVALUE',
+                'CREATE_REPORT', 'UPDATE_REPORT', 'DELETE_REPORT',
+                'CREATE_HOOK', 'UPDATE_HOOK', 'DELETE_HOOK',
+                'CREATE_ACCOUNTNUMBERFORMAT', 'DELETE_ACCOUNTNUMBERFORMAT',
+                'CREATE_USERAGREEMENT',
+                'UPDATE_BATCH_BUSINESS_STEP'
+            )</where>
+        </update>
+    </changeSet>
+
+</databaseChangeLog>

fineract-provider/src/test/java/org/apache/fineract/commands/service/CommandSourceServiceTest.java

@@ -116,7 +116,11 @@ public class CommandSourceServiceTest {
     }
 
     @Test
-    public void testProcessCommand_NonGLAccount_SuperUser_BypassesMakerChecker() {
+    public void testProcessCommand_NonGLAccount_SuperUser_OwnSubmission_DoesNotBypassMakerChecker() {
+        // A maker who happens to hold CHECKER_SUPER_USER must not auto-approve their own submission -
+        // CHECKER_SUPER_USER only ever lets its holder approve a DIFFERENT user's request (see
+        // PortfolioCommandSourceWritePlatformServiceImpl.validateMakerCheckerTransaction()). This
+        // replaces the old bypass this test used to assert.
         NewCommandSourceHandler handler = Mockito.mock(NewCommandSourceHandler.class);
         JsonCommand jsonCommand = Mockito.mock(JsonCommand.class);
         CommandSource commandSource = Mockito.mock(CommandSource.class);
@@ -125,6 +129,8 @@ public class CommandSourceServiceTest {
         Mockito.when(commandSource.getPermissionCode()).thenReturn("WITHDRAW_SAVINGSACCOUNT");
         Mockito.when(commandSource.getEntityName()).thenReturn("SAVINGSACCOUNT");
         Mockito.when(commandSource.getActionName()).thenReturn("WITHDRAW");
+        Mockito.when(commandSource.getId()).thenReturn(300L);
+        Mockito.when(commandSource.getResourceId()).thenReturn(400L);
         Mockito.when(configurationDomainService.isMakerCheckerEnabledForTask("WITHDRAW_SAVINGSACCOUNT")).thenReturn(true);
         Mockito.when(superUser.isCheckerSuperUser()).thenReturn(true);
 
@@ -132,12 +138,12 @@ public class CommandSourceServiceTest {
                 .withCommandId(1L).build();
         Mockito.when(handler.processCommand(jsonCommand)).thenReturn(dummyResult);
 
-        org.apache.fineract.infrastructure.core.data.CommandProcessingResult result = underTest.processCommand(handler, jsonCommand,
-                commandSource, superUser, false);
+        Assertions.assertThrows(org.apache.fineract.commands.exception.RollbackTransactionNotApprovedException.class, () -> {
+            underTest.processCommand(handler, jsonCommand, commandSource, superUser, false);
+        });
 
-        Assertions.assertNotNull(result);
-        Mockito.verify(commandSource).markAsChecked(superUser);
-        Mockito.verify(commandSource, Mockito.never()).markAsAwaitingApproval();
+        Mockito.verify(commandSource).markAsAwaitingApproval();
+        Mockito.verify(commandSource, Mockito.never()).markAsChecked(any());
     }
 
     @Test