34 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
nitesh	0e07e60328	feat(current-accounts): add document upload/list/download/delete endpoints ... /v1/currentaccounts/{id}/documents had no handler at all -- the account's own /v1/currentaccounts resource matches the request path first and has no documents method, so it never fell through to the generic /v1/{entityType}/{entityId}/documents resource that every other entity type relies on. Current accounts got a 404 on every Documents-tab request. Delegates straight to the existing DocumentApiResource so current accounts get identical behaviour to clients, loans, etc.	2026-08-19 10:35:35 +05:30
nitesh	e227e8ae0f	fix(savings): post GL entries for facility-charge collections at edit approval ... Charges collected when a maker-checker Nominee/Digital-Feature edit is approved deducted the account balance and appeared in the passbook, but never posted a journal entry -- collectCharges() saved the charge transaction directly and skipped the accounting bridge entirely, so the GL never balanced against the subledger. Also fixes an unrelated NPE this exposed: collectCharges() used saveAll() instead of saveAllAndFlush(), so the new charge transaction had no id yet when the journal-entry code tried to read it.	2026-08-19 10:35:18 +05:30
nitesh	231919b62b	fix(savings): stop crediting accounts automatically on activation ... Activation for Savings, RD, FD and Current accounts no longer books an opening deposit or enforces a minimum opening balance -- accounts go active at zero balance and a clerk deposits funds afterward as a separate transaction, matching how these branches actually operate. Fixed Deposit and Recurring Deposit have their own override of activateWithBalance() that a prior fix to the shared SavingsAccount base class missed, so they kept auto-depositing after Savings was already fixed. Removing that auto-deposit exposed two follow-on bugs in the FD/RD activation flow, now also fixed: - the opening deposit's journal entries were posted twice (once by the deposit helper, once by the activation command's own posting call) - FD/RD maturity amount was computed from the account's real (now empty) transaction history at activation and never recalculated once a deposit actually landed, so it showed no projected interest until the account was reloaded from a lucky code path	2026-08-19 10:34:54 +05:30
niteshandClaude Sonnet 5	14b2585cf5	feat(loan-origination): add full backend persistence for the sanctioning pipeline ... Adds a lightweight loan-origination-pipeline module (application, stage history, approvals, FI checks and documents) with server-side validation per stage transition, so every field, upload and decision on the Loan Origination screen survives a page refresh instead of living only in the browser. Also fixes two content-store bugs found while wiring document uploads through the generic Fineract document store: the CSV mime/extension whitelist rejected bank-statement uploads outright, and the post-upload mime consistency check rejected any CSV whose byte-content sniffs as text/plain (which is all of them, since CSV has no distinguishing magic bytes). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 17:12:43 +05:30
niteshandClaude Sonnet 5	c8833367b9	feat(shares): route dividend cash claims through cashier token disbursement ... Cash claims now mirror the existing clerk-withdrawal token flow: clerk submits with a token, manager approval posts the GL entry, and a cashier redeems the token at Transaction Entry to record physical hand-over -- no direct manager-to-member cash handover, and no double-disbursement. Also fixes GL accounting for the loan/savings legs: instead of reversing the native command's own debit with a second manual entry pair (leaving the fund-source account confusingly appearing twice), that debit leg is now rewritten in place to Dividend Payable. Floors cash claims to whole rupees since notes/coins can't represent paise, with backward-compatible tolerance for claims submitted before the fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 10:17:35 +05:30
nitesh	94b0afff38	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... # Conflicts: # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml	2026-08-11 12:53:20 +05:30
niteshandClaude Sonnet 5	9dd4f8bedb	feat(shares): real-profit driven dividends with GL-only liability model and member claim workflow ... Reworks the share dividend lifecycle end to end: - Dividend amount now auto-computed from real GL profit x officer-entered percentage instead of manual entry; adds a Dividend Paid report over the existing Dividend Payable ledger. - Declaration posts a real GL entry (Dr Reserve for Dividend / Cr Dividend Payable); approval no longer credits any savings account up front -- every member's entitlement stays a pure "Dividend Payable" liability until claimed, resolved synchronously at approval time (no background job or per-member failure mode). - New maker-checker Dividend Claim Request workflow: a clerk records how a member wants their unclaimed dividend split (overdue loan / savings credit / cash), a manager approves, which executes native repayment/deposit commands and replenishes whichever GL account they actually debited (not a hardcoded assumption) from the Dividend Payable liability. - Unclaimed dividends carry a 3-year window (m_share_dividend_lock) after which a daily job forfeits them straight to profit; a Dividend Dashboard consolidates summary stats, every declaration's status, full lock history, and proactive loan-application for members with overdue EMIs. - Fixes a native negative-share-days bug in ShareProductDividendAssembler and adds overlap-period validation so a product can't have two declarations covering the same days. - Removes the now-unreachable failed/pending-payout tracking that the old per-member job-based model needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 12:42:45 +05:30
niteshandClaude Sonnet 5	2213308254	fix(shares): skip zero-value redeem transaction on account close ... Closing a share account that already has zero approved shares no longer synthesizes a redeem transaction, so it stops posting a meaningless ₹0.00/₹0.00 GL journal-entry pair. Save/note-capture on close now happen unconditionally instead of being gated on a transaction existing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-06 20:10:57 +05:30
nitesh	c568eb0abf	feat(shares): close share account directly on withdrawal approval ... Replaces the auto-submit-closure-request behavior with an immediate account close, in the same @Transactional approval action, when a redemption brings a share account's holding to zero — no separate "Share Closure Request" maker-checker step is needed since the redemption amount itself already went through this same review. Removes ClerkShareClosureRequestApiResource entirely (the migration for m_clerk_share_closure_request is left in place as a harmless, now-unused table, to avoid a Liquibase checksum churn). Also fixes a genuine Postgres-incompatibility bug this uncovered in validateNoActiveLoanOrGuaranteeBeforeClosure(): `is_active = 1` doesn't type-check against a boolean column on Postgres ("operator does not exist: boolean = integer"), which was silently aborting the whole approval transaction (harmlessly, since it's @Transactional — verified no partial state was ever left behind). Fixed to `is_active = true`, added the missing `type_enum = 1` (customer-type guarantors only, matching the existing Guarantor Check elsewhere in this workflow), and widened both this and the active-loan check to the same loan_status_id set (300, 303, 304, 700) used there too.	2026-08-06 19:29:44 +05:30
nitesh	1426be9531	fix: correct changeset ids after renumbering merged AML/family-member migrations ... Follow-up to the previous merge commit — the internal Liquibase changeSet ids in the 9 renumbered files (0447-0455) still referenced their old 0438-0446 numbers; the rename staged the files before the id update was applied. Ids now match filenames as intended.	2026-08-06 16:50:39 +05:30
nitesh	541c6ab062	Merge branch 'demo' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... Resolved two conflicts: - changelog-tenant.xml: both branches independently added Liquibase parts numbered 0438-0446 (dev: Share Withdrawal/Closure governance + KYC exception fields; demo: AML rule tiers/branch seeding/email tracking/family-member children table). Renumbered demo's incoming set to 0447-0455 (files renamed + internal changeSet ids updated to match) so both feature sets keep their own migrations intact. - 0434_seed_aml_transaction_rules.xml: same seed data on both sides, differing only in the disambiguating SQL predicate. Kept dev's `AND aml_check_status IS NOT NULL` (deterministically targets the intended m_client_risk_rule row, per the file's own comment) over demo's `LIMIT 1` (arbitrary, could pick the wrong row). Also dropped two JVM crash-dump log files that got staged by mistake.	2026-08-06 16:49:15 +05:30
niteshandClaude Sonnet 5	66a6a4766f	feat(shares): add Share Account Closure maker-checker workflow ... New ClerkShareClosureRequestApiResource mirrors the withdrawal resource: clerk submits a closure request only once a share account holds zero shares; a /validate endpoint re-checks shares-held, account status, any active loan/guarantee, and client KYC/AML compliance; approve() executes the real native "close" command. ClerkShareWithdrawalRequestApiResource.approve() now also auto-submits a PENDING closure request (via the same table) whenever a redemption brings the account's share holding to zero, reusing the withdrawal's own maker identity — a manager still has to separately Validate and Approve it, so the closure request is created automatically but never executed without review. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-06 11:44:47 +05:30
nitesh	1a9adaec24	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev	2026-08-05 18:34:33 +05:30
niteshandClaude Sonnet 5	2da5a25e04	feat(shares): add compliance and loan/guarantor/tenure checks to validation ... The /validate endpoint now re-checks live state that matters for a real UCB share redemption: Client KYC verified, Risk Category not High, no open AML alerts, and — since this bank supports loan-against-shares via m_share_account.linked_loan_id — a Loan Check (no active loan secured by these shares), Tenure Check (linked loan's term completed), and Guarantor Check (client not guaranteeing someone else's active loan). Dropped the redundant "status is PENDING" check and replaced raw status_enum codes with human-readable labels throughout. getById() also now returns a client compliance summary so the review screen can show it without running the popup validation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-05 18:33:12 +05:30
niteshandClaude Sonnet 5	f1d68d17fe	feat(shares): add Share Withdrawal maker-checker workflow with GL settlement ... New ClerkShareWithdrawalRequestApiResource backs a clerk-submits/manager- approves flow for share redemption: on submit, validates and persists the clerk-chosen settlement Payment Type (must be non-cash) plus a full audit snapshot of the settlement row; on approve, executes the real "redeemshares" command and, in the same transaction, credits the redemption value to the share account's linked savings account using that stored payment type (with a hardcoded-lookup fallback for pre-existing rows). Adds a /validate endpoint that re-checks live account/GL state (not just the submit-time snapshot) so a manager can verify before approving. Also exposes linked-savings-account data on ShareAccount reads so the frontend can display/validate it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-05 16:56:50 +05:30
niteshandClaude Sonnet 5	7cdc25322e	fix(aml): resolve ambiguous order_position subquery breaking tenant migration/startup ... 0434_seed_aml_transaction_rules.xml resolved source_client_risk_rule_id via `SELECT id FROM m_client_risk_rule WHERE order_position = N`, assuming order_position was unique. It isn't: 0430_seed_aml_compliance_rules.xml seeds its own 221 rows with order_position 1-235, independently of the older 0428_add_client_risk_rules.xml rows, and several values collide (e.g. both insert a row at order_position 10 and 30). Every affected subquery returned more than one row, aborting the whole tenant's Liquibase run and app startup. aml_check_status is populated only on 0430's rows (0428's predate that column and are NULL there), so pairing it with order_position uniquely targets the intended row without touching either seed changeset. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 14:27:08 +05:30
nitesh	a4c3dbb6c4	Merge remote-tracking branch 'origin/dev' into uate	2026-07-31 13:58:55 +05:30
niteshandClaude Sonnet 5	dd8445de06	fix(accounting): resolve Sponsor DD Payable SBI GL account parent by gl_code, update default tenant DB password ... The 0345 changelog hardcoded the "OTHER LIABILITY" parent row's numeric id (22), which only matched the default tenant's auto-increment history and broke the FK insert (and the whole Liquibase run / app startup) on tenants seeded differently, e.g. saga. Now resolves parent_id via a SELECT on gl_code='9' and marks the changeSet runOnChange so it safely re-validates on tenants that already ran the old version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 13:56:04 +05:30
nitesh	9345f2294c	Merge remote-tracking branch 'origin/uate' into uate	2026-07-31 13:54:07 +05:30
niteshandClaude Sonnet 5	190cd92a85	fix(accounting): resolve Sponsor DD Payable SBI GL account parent by gl_code, update default tenant DB password ... The 0345 changelog hardcoded the "OTHER LIABILITY" parent row's numeric id (22), which only matched the default tenant's auto-increment history and broke the FK insert (and the whole Liquibase run / app startup) on tenants seeded differently, e.g. saga. Now resolves parent_id via a SELECT on gl_code='9' and marks the changeSet runOnChange so it safely re-validates on tenants that already ran the old version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 13:53:27 +05:30
nitesh	b1cfa996b4	feat(clients): fromDate/toDate submittedon_date range filter on GET /clients ... Backs the Client Approval tab's Today/Yesterday quick filters server-side. offset/limit/displayName/orderBy/sortOrder/status already existed on this endpoint; added fromDate/toDate (yyyy-MM-dd, inclusive) alongside them, filtering on c.submittedon_date, following the same ::date-cast convention already used by ClientPendingEditReadPlatformServiceImpl for the equivalent pending-edits filter. Updated the one other caller (SelfClientsApiResource) to pass null/null.	2026-07-30 10:33:48 +05:30
nitesh	02541eed6c	feat(sanctions): expose the loaded list's data-currency date on every screening result ... Screening only ever told a caller whether a name matched and when the check ran — not which dated snapshot of the UN Security Council list it ran against. Added SanctionsEntryRepository.findListLastLoadedOn() (MAX(createdDate) over active entries) and threaded it through SanctionsScreeningResult as listDataAsOf, so the frontend can show "List Data As Of: <date>" alongside "Screened On".	2026-07-30 10:33:33 +05:30
niteshandClaude Sonnet 5	7c15fbb0c7	fix(documentmanagement): close leaked file handles causing Windows re-upload failures; add entity KYC document CodeValues ... FileContentStoreService.upload() opened a FileOutputStream (write) and an InputStream (post-upload MIME check) without closing either. Windows keeps those handles open for the JVM's lifetime, so the next upsert-style delete-then-recreate of the same file (e.g. client signature/photo re-upload) failed with FileSystemException: "being used by another process". Wrapped both in try-with-resources. Also adds every distinct non-individual/constitution KYC document name (HUF, Private/Public Ltd, LLP, Partnership, Trust, Society, Proprietorship, Association, Govt/PSU, Cooperative) as a KYCIdProofType code value. resolveDocumentTypeId() on the frontend matches the picked document name against this list before creating a client_identifier; since these entity document names had no corresponding code value, every non-individual client's KYC document upload silently failed to persist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-29 11:34:18 +05:30
nitesh	6e3f195de0	Merge remote-tracking branch 'origin/uate' into uate	2026-07-29 10:31:58 +05:30
niteshandClaude Sonnet 5	a65d801250	feat(clients): maker-checker for client creation and edits (backend) ... - Client activation now requires a different user than the one who created the client (client.getCreatedBy() vs current user) — no bypass, including CHECKER_SUPER_USER, since a bypass would recreate the exact "role bypasses the hold" loophole this closes. Client creation itself is unaffected (the wizard needs a real client id immediately for photo/KYC/address/family follow-up uploads), only activation is gated. - New maker-checker queue for Client edits, modelled on this codebase's existing m_share_account_pending_edit / chequebook patterns rather than Fineract's native command-approval engine (which any ALL_FUNCTIONS role bypasses unconditionally): - m_client_pending_edit (migrations 0429-0431): stores the maker's raw edit payload plus a point-in-time "before" snapshot (original_json, extracted from the frontend's _originalValues key) so the checker's diff stays accurate even after the edit is approved/rejected, when the live client no longer reflects the pre-edit state. - ClientEditWritePlatformService: submitEditForApproval() stages the edit (refusing a second submission while one's already pending, via a nullable-but-unique pending_lock_key); approveEdit() replays the payload through the existing updateClient() so all of Client's validation/change-detection runs unchanged, just deferred; rejectEdit() discards it. The maker can never approve/reject their own submission. - ClientEditApiResource: /clients/{id}/edit (submit), /clients/edit/pending (paginated + status/clientName/date-range filterable list, mirrors /chequebook/pending-requests), /clients/{id}/edit/approve, /clients/{id}/edit/reject. New permissions (migration 0430): SUBMITEDIT_CLIENT, APPROVEEDIT_CLIENT, REJECTEDIT_CLIENT, APPROVEEDIT_CLIENT_CHECKER (the last one surfaces pending edits in the generic Checker Inbox too). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-29 10:31:10 +05:30
niteshandClaude Sonnet 5	3c58bb231f	fix(clients): pwdCategoryOptions on edit template, minor-age threshold to 18, minor KYC identity-proof bypass ... - ClientData.templateOnTop()/templateWithSavingAccountOptions() never copied pwdCategoryOptions from the template — the Disability Type dropdown was always empty on the edit-mode GET /clients/{id}?template=true call, even though create-time template() had it. - Raise the minor-detection threshold in ClientKycApiResource from age <10 to <18 (legal definition), mirroring the frontend's own rule so the required-documents list served here stays consistent. - ClientKycCommand.validateForInitiate() unconditionally required at least one of PAN/Aadhaar/GSTIN, with no awareness of the Birth Certificate/School ID document-type picker minors actually use — blocking "Save & Next" on the KYC tab for every minor client. Added a skipIdentityDocumentCheck flag, set from client.getIsMinor() at both call sites (initiateKyc/initiateKycInline). - Added Birth Certificate and School ID Card as KYCIdProofType code values — they were already offered as document-type options for minors but never existed in the code-value list that saveKycDocProof() resolves against, so selecting either silently failed to save any identifier/document. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 15:51:08 +05:30
niteshandClaude Sonnet 5	aabda18b69	feat(clients): enforce Mother + Father/Caretaker family members on client activation ... - Add CARETAKER as a new RELATIONSHIP code value (previously missing — a client with no father had no valid way to satisfy the rule below). - Add ClientFamilyMembersWritePlatformService.validateFamilyRequirementsForActivation(), called from activateClient(): requires an active "Mother" family member, plus either "Father" or "Caretaker", for individual clients (non-individual entities are exempt). - Two distinct exceptions (ClientFamilyMemberMotherRequiredException / ClientFamilyMemberFatherOrCaretakerRequiredException) so the two failure reasons surface as separate errors instead of one merged message, mirroring the frontend's separate banners. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 12:37:24 +05:30
nitesh	0e5671b706	Merge remote-tracking branch 'origin/uate' into uate	2026-07-28 10:55:05 +05:30
niteshandClaude Sonnet 5	67214ec0f8	fix(clients): stale signature bug, CKYC fixes, monthly turnover/annual income, senior citizen/PWD classification ... - Add m_client.signature_id (single-slot pointer, mirrors image_id) plus ClientSignatureIdAdapter/EntitySignatureIdAdapter so re-uploading a signature updates the existing m_document row in place instead of leaving duplicate rows behind that readers picked inconsistently. - Fix CkycBatchBuilderServiceImpl address-proof classification to read the client identifier's actual m_code (KYCAddressProofType vs KYCIdProofType) instead of a hardcoded string set that disagreed with the CKYC tab and silently dropped Aadhaar-as-address-proof identifiers. - Organize the CKYC ZIP into per-artefact-type folders (PHOTO/SIGNATURE/ID_PROOF/ADDRESS_PROOF). - Fix CkycBatchBuilderServiceImpl.createBatch() using the daily batch sequence number as the ZIP document's parent_entity_id instead of the real m_ckyc_batch.id, which 404'd on download whenever the two diverged (i.e. almost always). - Add monthlyTurnover and annualIncome fields alongside the existing annualTurnover/monthlyIncome. - Add isSeniorCitizen, isPwd, and pwdCategory (proper m_code_value-backed PwdCategory code, not a free-text column) to m_client, following the same pattern as occupation/religion/marital status. - Add Diploma as its own Education Level (with diploma-specific DegreeQualification values) and Graduate as a level distinct from Undergraduate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 10:50:16 +05:30
nitesh	bc30241950	Merge remote-tracking branch 'origin/uate' into dev	2026-07-27 14:24:16 +05:30
niteshandClaude Sonnet 5	14df914b9a	feat(clients): dual-OTP verified contact changes with customer notification ... Mobile number and email address changes now require OTP verification on both the old and new destination (staff-entered) before the update is accepted, at both client creation and edit time — closing a gap where an unverified wrong number/email could never be corrected later. Every mobile/email/address change also emails the customer at their pre-change address so an unauthorized change is never silent. - New ClientContactOtpService (+Impl) mirrors the existing login OTP services, reusing OtpLog with a CLIENT_CONTACT_CHANGE purpose. - New sibling API resources for edit (/clients/{id}/contact-verification/otp) and create (/clients/contact-verification/otp, no clientId yet). - ClientWritePlatformServiceJpaRepositoryImpl / AddressWritePlatformServiceImpl gate the actual field change on verified OTPs and fire ClientChangeNotificationService afterwards; the notification recipient is always snapshotted before any mutation so a same-request mobile+email change can't accidentally alert the new (unverified-by-its-real-owner) address instead of the old one. - ClientDataValidator validates OTP id format only (ignoreIfNull) — enforcement lives solely in the write-service's diff-gated calls, since edit-client always PUTs the full client object regardless of what changed. - 0420 migration seeds 8 CLIENTKYC action permissions (GenerateAadhaarOtp/VerifyAadhaar/VerifyPan/VerifyCin/VerifyDin/ VerifyGstin/UploadCkyc/CompleteRekyc) that were referenced by existing command handlers but never seeded, causing a 404 for every user including Super User. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-26 14:36:48 +05:30
niteshandClaude Sonnet 5	5dc175c5e1	feat(users): auto-enroll admin-chosen OTP channel as MFA factor at creation ... Admin now picks a mandatory OTP delivery method (Email/Mobile) when creating a user. The channel is enrolled immediately as a verified m_user_mfa_factor row, so the existing 2FA system (MfaFactorBackedTwoFactorServiceImpl + /twofactor) challenges the user for OTP on their very first login - reusing the already-built login-OTP infrastructure instead of a parallel flow. Also adds a versioned, admin-manageable user-agreement (disclaimer) API (/v1/useragreements) with per-user acceptance tracking, checked right after every login, plus a Liquibase cleanup migration and a shared OTP-destination masking utility extracted from the two existing login-OTP services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 16:16:40 +05:30
nitesh	cf60515bf6	Merge remote-tracking branch 'nexora/uate' into merge-uate-into-dev ... # Conflicts: # .gitignore # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml # fineract-savings/src/main/java/org/apache/fineract/portfolio/savings/service/FacilityChargeAutoApplyService.java	2026-07-23 17:36:10 +05:30
niteshandClaude Sonnet 5	a098f8ba75	fix(chequebook): prevent cheque-leaf serial collisions across series at issuance time ... The real root cause behind the leaf-serial collision bug: stock-lot overlap checking was scoped to "within the same series only" (ChequeStockLotRepository.countOverlappingInSeries), on the incorrect assumption that two different cheque designs never share a numeric range. A real bank allocates leaf serials from one bank-wide numbering authority, so this is exactly what let two series end up with overlapping ranges that, once both were issued to the same account, produced an unresolvable serial collision (NpciInwardPushService's drawer-account-number disambiguation can't help when every colliding leaf belongs to the same account). Widened the check to countOverlappingAnySeries — both the maker-submit and checker-approval paths in ChequeBookWritePlatformServiceImpl now reject a stock receipt whose range overlaps ANY existing lot, regardless of series. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 17:24:17 +05:30