2 Commits

Include renames

Author	SHA1	Message	Date
AdityaandClaude Opus 4.7	e1d7db9b7c	DSC as first-class MFA factor + branded helper UI ... - m_user_mfa_factor is now the single 2FA gate. DSC enroll callback writes a factor row (factor_type=DSC), revoke flips disabled_on when the last cert goes. AuthenticationApiResource and TwoFactorAuthenticationFilter drop the direct m_bank_user_dsc check so disabling from the UI actually stops the challenge at login. - SecurityConfig exempts /api/*/dsc/** and /api/*/mfa/factors from the TWOFACTOR_AUTHENTICATED gate. Without this a user with a verified factor can't manage their own factors after they break the device. - MfaFactorType gains a DSC enum value; SelfUserMfaFactorServiceImpl error message lists it. - dsc-helper: CBSnexora-branded header (logo, title, subtitle, accent palette), 8-column cert table (Holder Name, Alias, Organisation, DSC Type, Serial, Issuer, Valid From, Expires), LdapName-based DN parsing, sign+verify proof- of-possession that picks SHA256withRSA / SHA256withECDSA from the key's own algorithm (works on RSA, RSA Signing-only, EC), pattern-matched JNLP age check, dscType JNLP-arg override with KeyUsage fallback. - generate-test-dsc.ps1 produces a realistic self-signed DSC with strong key protection so dev testing sees real CN/O values and a PIN prompt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 18:05:12 +05:30
AdityaandClaude Opus 4.7	8284851f67	Add DSC-based MFA: enrollment, login factor, JWS helper, tenant-scoped serving ... Backend: - m_bank_user_dsc + m_dsc_challenge tables (Liquibase 0292/0293/0294) - DSC enrollment flow: start → JNLP → JWS helper → callback → upsert - DSC login factor: challenge → sign → verify → claim minted TFA token - 2FA gate now also accepts an active DSC mapping (AuthenticationApiResource + TwoFactorAuthenticationFilter), defensively wrapped so a missing DSC table doesn't 500 the auth path - TenantAwareBasicAuthenticationFilter exempts /api/v*/dsc/helper.jar and strips Authorization header for that path so JWS's raw GET works without the user seeing a browser Basic-auth prompt - DSC helper JAR served at /api/v*/dsc/helper.jar from a configurable filesystem path (default ~/.cbsnexora/dsc-helper.jar) Java helper JAR (dsc-helper/): - Standalone Gradle subproject, Java 8 target, fat jar with Gson shaded in - Cross-platform token picker (Windows Cert Store / ePass2003 / eToken / ProxKey / Other) — matches the JNLP arg contract emitted by the backend - Sets Fineract-Platform-TenantId on its callback POST from the JNLP args - JNLP age check now reads cbsnexora-dsc.jnlp (current name) AND SignTender.jnlp (legacy) — picks the youngest, never blocks if none exist Inline KYC upsert in updateClient (mirror of the create-flow path): - ClientKycWritePlatformService.upsertKycInline() — creates or merges KYC fields, bumps status to IN_PROGRESS on real changes; resets PAN verification on PAN edit of a verified record - ClientWritePlatformServiceJpaRepositoryImpl.updateClient() handles the kyc:{} sub-object on PUT /clients/{id}, matching createClient User uniqueness: - m_appuser.email + m_appuser.mobile_no UNIQUE (Liquibase 0295) - Pre-flight assertEmailAndMobileUnique() in create/update with self-exclusion - handleDataIntegrityIssues maps the two new constraints to clean field-scoped error messages (race-condition safety net) Email OTP subject line now: "Your OTP for Login - <AppName> (dd-MM-yy-HH:mm)" where AppName comes from fineract.email.from-name (default "CBSnexora"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:13:19 +05:30