42 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
niteshandClaude Sonnet 5	58187c23d0	fix(migrations): remove fake test-data seeds, backfill lost permissions, merge redundant roles ... Migration-hygiene fixes found while auditing whether a fresh database would end up with the same schema/permissions/roles as this dev database. 1. Remove fake test-data seed migrations 0449_seed_aml_test_alerts.xml and 0459_seed_aml_alerts_awaiting_review.xml unconditionally inserted 3 fictional clients (CLIENT_RAJESH/SONIA/VIKRAM) and 5 fake AML alerts against them on every environment, including production if this migration path ever ran there. 0459's own comment confirms it was written purely to exercise the AML review UI. Deleted both files and their <include> entries; cleaned the same fake rows out of this dev database (3 clients, 5 alerts, plus the now-orphaned databasechangelog bookkeeping rows for the two deleted files). 2. Backfill 3 permissions lost to a migration-number collision Auditing all 2712 changesets applied to this dev database against the current codebase found 18 changeset filenames with no matching file anywhere in git; changelog-tenant.xml itself already documents the root cause (multiple branches independently reusing the same numeric prefix for unrelated migrations, e.g. 0456-0462 twice). Cross-checking each affected table/permission against actual Java usage (@CommandType handlers, domain/API classes, and both permission-insert styles used in this codebase -- Liquibase <insert> columns and raw <sql> literals) showed 15 of the 18 are genuinely dead (reconciliation-batch/settlement- cycle prototype tables, fixed asset/inventory tracking) with zero current code referencing them, so nothing to backfill there. The remaining 3 -- MENU_RECONCILIATION, READ_RECONCILIATION, SIDEBAR_RECONCILIATION -- gate a live module (CashReconciliation / ClearingReconciliation have real API resources and domain classes) but were never seeded by any migration; without them a fresh database can build and expose the reconciliation screens with no way to grant a role access to them. Added 0491_add_reconciliation_menu_permissions.xml. 3. Merge two pairs of redundant roles - "Bank Cashier" (4 fund-transfer permissions, 0 of which overlapped "CASHIER", 0 users assigned) folded into CASHIER. - "AML Officer" (2 permissions, both already present on "Principal Officer", 0 users assigned) folded into Principal Officer. Both migrations copy any missing permissions and move any assigned users onto the surviving role before deleting the redundant one, so they're safe to run against an environment that isn't empty the way this dev database is. Applied the same merge directly to this dev database's m_role / m_role_permission / m_appuser_role rows. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-27 11:27:42 +05:30
niteshandClaude Sonnet 5	72221f704d	feat(deposits,clients): FD Special auto-configuration, interest schedule projection, and minor-age backend mirror ... Three related pieces of backend support for this session's FD Special (monthly interest payout) work, plus one more instance of the same transaction-ordering bug fixed elsewhere this session. 1. FD Special account creation/modification auto-configuration FD Special (fdType=SPECIAL) is a non-cumulative product: interest must post monthly and leave for a linked savings account, and maturity must auto-transfer the principal out -- regardless of whatever compounding/ posting period or maturity instruction the request otherwise carries. Previously none of this was enforced, so a SPECIAL account could be created with e.g. quarterly compounding, or a later "modify application" request could silently unset transferInterestToLinkedAccount / the maturity instruction / the linked account by mere omission of those fields from the payload, while the account kept displaying as "FD Special". - DepositAccountAssembler: on create, forces interestCompoundingPeriodType and interestPostingPeriodType to MONTHLY, transferInterestToSavings to true, transferToSavingsId to the (now required) linked savings account, and accountOnClosureType to TRANSFER_TO_SAVINGS, whenever fdType is SPECIAL. Throws a clear domain error if no linked account was selected. - DepositAccountTermAndPreClosure: new forceMonthlyPayoutToLinkedSavings(), re-applying those same three standing-instruction fields. - DepositApplicationProcessWritePlatformServiceJpaRepositoryImpl: calls the equivalent re-enforcement on every modify-application request for a SPECIAL account, after the linked-account resolution in that same method has settled what account (if any) ends up linked. 2. FD Special projected interest schedule (engine + API) Staff/customers previously only saw a flat rate/12 approximation of monthly interest. Added a real, engine-computed month-by-month schedule: - DepositAccountWritePlatformService(Impl): new retrieveProjectedInterestSchedule(), running the same PostingPeriod engine the real maturity calculation uses (FixedDepositAccount# projectInterestSchedule), side-effect-free (@Transactional(readOnly)), clipping the last period's displayed end-date to maturityDate-1 (the engine otherwise rounds it out to the next calendar boundary even when maturity falls partway through), and flagging each period "paid" by matching real posted-interest transaction dates. - FixedDepositAccountsApiResource: computes and attaches the schedule, plus server-computed totalProjectedInterest/totalValueAtMaturity, to the FD template response for SPECIAL accounts only. - FixedDepositAccountData / DepositsApiConstants: carrier fields and response-parameter whitelist entries for the three new fields. 3. Minor-age threshold: backend now matches the frontend's shared constant Companion to this session's frontend minor-age-threshold change (18 -> 10, see client-age.util.ts). ClientKycApiResource's minor detection (which gates the required-KYC-document list, including whether PAN is mandatory) was still hardcoded to age < 18. Added ClientApiConstants.MINOR_AGE_THRESHOLD (10) and SENIOR_CITIZEN_AGE_ THRESHOLD (60) as the backend's own named constants, and switched the KYC endpoint to use MINOR_AGE_THRESHOLD, so the two sides can't silently disagree on who counts as a minor. 4. SavingsAccountTransactionComparator: same-date tie-break fixes another instance of this session's core reversal bug For a Special FD's interest-transfer sweep, the withdrawal shares the exact transaction_date of the interest posting it pays out. When that posting is reversed and recreated, the new posting transaction gets a higher id than the already-existing withdrawal; the comparator's id-order tiebreaker then sorted the withdrawal before the new posting, which understated the running balance shown between them (e.g. showing Rs.99,901.39 instead of Rs.100,000.00 immediately after the pair). Added an explicit tiebreaker so a same-date, same-createdDate interest posting always sorts before a withdrawal/debit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-26 19:02:17 +05:30
niteshandClaude Sonnet 5	a42a874811	fix(deposits): stop FD Special interest postings from self-correcting after settlement ... FD Special (monthly interest payout) accounts post interest each month and immediately sweep it to a linked savings account. Two independent interest recalculation paths were treating that sweep withdrawal as ordinary account activity and silently reversing + reposting already-settled periods at a slightly different (rounding-drifted) amount — after the original, correct amount had already been transferred out. This left the FD short by the difference every time it happened. Root causes (two separate engines, same underlying bug pattern): 1. SavingsAccountDomainServiceJpa#handleWithdrawal re-triggers a full postInterest()/calculateInterestUsing() after every withdrawal, including the sweep withdrawal itself. At that exact moment the withdrawal's own m_account_transfer_transaction linking row does not exist yet, so the balance-exclusion logic can't recognise it as a transfer leg — it gets treated as a real balance-reducing transaction and corrupts that period's (and any later period's) interest calculation. 2. SavingsAccountInterestPostingServiceImpl (the "Post Interest For Savings" batch job) has its own, separate reverse-and-repost correction loop with the same lack of a "was this period already settled" guard. Fixes, both scoped strictly to FD Special (transfer_interest_to_linked_account = true) so plain savings and recurring deposit behaviour is provably unchanged (the new hooks all default to the prior behaviour unless overridden): - SavingsAccount: new isInterestPostingCorrectionAllowed(...) extension point guarding the postInterest() correction loop; new isPostWithdrawalInterestRecalculationRequired(...) hook checked by handleWithdrawal before it re-recalculates; new refreshBalancesAndSummaryAfterTransfer(...) — the running-balance/summary bookkeeping postInterest() always performs, without re-running the posting/correction loop, so skipping the full recalculation doesn't leave the withdrawal's own running balance and the account summary stale. - FixedDepositAccount: overrides both hooks using the existing interestAlreadyPaidOut(...) date-matched sweep-withdrawal check (already used by postMaturityInterest) so an already-swept period is never recalculated again, from either the withdrawal path or a later job run. - SavingsAccountInterestPostingServiceImpl: mirrors the same guard (isInterestAlreadySweptOut) in its own correction loop for the batch job. Unrelated correctness fixes carried in the same files, applicable to any account type (not FD-Special-specific), found while investigating the above: - SavingsAccountWritePlatformServiceJpaRepositoryImpl: interest-payable GL entries were reading a financial_account_type that never exists in acc_product_mapping, always resolving to account id 0. Now reads the correct getGlAccountIdForInterestOnSavings(). - DepositAccountInterestRateChart#getApplicableInterestRate: missing break in the slab-matching loop meant HashSet's non-deterministic iteration order could pick an arbitrary matching slab instead of the intended one. - SavingsAccountReadPlatformServiceImpl / SavingsAccountData: thread the real transfer_interest_to_linked_account flag into the batch interest engine's per-account data so it can correctly disable interest compounding for FD Special (previously hard-coded false, causing the batch job to compound interest that should reset to zero each period). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-26 18:53:12 +05:30
niteshandClaude Sonnet 5	46f5a1babd	feat(deposits): FD in-place renewal, senior-citizen rate persistence, and Payment action ... WHAT THIS CHANGES ================== Three related FD (Fixed Deposit) features, built incrementally in one session: 1. IN-PLACE RENEWAL -- when an FD matures with "Re-Invest Principal and Interest", the SAME m_savings_account row is now reused across every renewal (account number never changes) instead of closing the account and opening a new one. FixedDepositAccount.renewInPlace() does this by setting start_interest_calculation_date as a pivot: interest for terms before the pivot is never recalculated, only the new term's window is computed from there. A new one-to-many audit table m_fd_renewal_history records one row per term (renewal_no 0,1,2...) with that term's own principal, rate, dates, interest earned, maturity, and status. A companion table m_fd_renewal_chart_slab_history archives each closing term's full rate-by-tenure chart, captured just before renewInPlace overwrites it. 2. SENIOR-CITIZEN RATE -- the CBS Base Interest Rate master (m_cbs_base_interest_rate_slab_history) was the only place that ever stored a senior-citizen premium. It is now also persisted on m_savings_account_interest_rate_slab (new senior_citizen_rate column, nullable, added only to this account-level table -- NOT to the shared InterestRateChartSlabFields embeddable, so the product-level table m_interest_rate_slab is untouched). Applied both at account creation (DepositAccountAssembler now prices a new FD off the active CBS base version when one exists for that FD type, falling back to the product's own chart otherwise) and at renewal (renewInPlace refreshes the chart from the same base version). 3. PAYMENT ACTION -- a new manual command, POST /fixeddepositaccounts/{id}?command=payment, available whether the FD is ACTIVE or MATURED, unlike Close (Matured-only) and Premature Close (Active-only, no reinvest). Offers: Transfer to Savings, Re-Invest Principal and Interest (via renewInPlace), Re-Invest Principal Only (legacy close-and-reopen, now also transfers the leftover interest to a chosen savings account instead of stranding it), and a new closure type PARTIAL_REINVEST (500) -- part of the matured balance renews in place on the same account, the remainder transfers to a savings account picked at request time. Withdraw Deposit is deliberately excluded from this command. New permission PAYMENT_FIXEDDEPOSITACCOUNT plus its CHECKER twin were added in migration 0478. KEY FILES ========= - DepositAccountDomainServiceJpa.java: handleFDAccountPayment (new), renewInPlace call sites, recordInPlaceRenewal, senior-citizen rate matching with unit conversion across days/weeks and months/years families. - FixedDepositAccount.java: renewInPlace, validateRenewalDate, isLockedOnDate, fdAccountNumber/renewalCycleNo chain tracking. - SavingsAccount.java (SHARED with Savings and RD): added findLastTransactionBefore -- the interest-posting opening balance for a pivot-dated account now seeds from the last transaction strictly before the pivot, not the one on it. This fixes a bug where a renewed term could accrue zero interest, or double-subtract a same-day withdrawal, depending on transaction list order. Also widened calculateDateAccountIsLockedUntil to protected so renewInPlace can refresh lock-in on each renewed term. - DepositAccountTransactionDataValidator.java: new validatePayment. validateClosing now explicitly rejects PARTIAL_REINVEST (500) so it can never reach the Close or Premature-Close handlers, which have no branch for it and would otherwise pay the whole balance out in cash. This applies to both FD and RD, since they share validateClosing. - DepositAccountReadPlatformServiceImpl.java: retrieveOneWithClosureTemplate (Close and Premature Close, excludes PARTIAL_REINVEST) split from the new retrieveOneWithPaymentTemplate (Payment, includes it), sharing one private method with a flag. The renewal-history fallback query, for chains that predate m_fd_renewal_history, was rewritten to emit the exact same column shape as the primary query. - New: FixedDepositRenewalHistory plus its repository, FixedDepositRenewalChartSlabHistory plus its repository, PaymentFixedDepositAccountCommandHandler. - Migrations 0471 through 0478 under tenant/parts, each registered once in changelog-tenant.xml. RD AND SAVINGS IMPACT -- READ THIS IF SOMETHING BREAKS THERE ============================================================ RD and plain Savings share several of the touched files. Verified during this work: - handleRDAccountClosure and RecurringDepositAccount.java were not modified. - PARTIAL_REINVEST (500) is now rejected by validateClosing for both FD and RD close and prematureClose commands, and excluded from their template option lists. This was a real regression caught mid-session: the enum value briefly leaked into RD's Close dropdown as a working looking option that actually paid the whole RD balance out in cash. It was found and fixed before this commit. - The SavingsAccount.calculateInterestUsing opening-balance change only affects accounts where start_interest_calculation_date differs from activatedon_date. On the dev DB this was exactly two accounts, both FD test accounts created this session. Before deploying, run: SELECT deposit_type_enum, COUNT(*) FROM m_savings_account WHERE start_interest_calculation_date IS NOT NULL AND start_interest_calculation_date <> activatedon_date GROUP BY deposit_type_enum; Any non-FD rows (100 or 300) there mean a Savings or RD account will get a different, corrected interest amount than before. This is expected to be rare or zero, but confirm before deploy. - DepositAccountAssembler's creation-time base-rate pricing is guarded by depositAccountType.isFixedDeposit, so RD account creation is unaffected. - is_active on InterestRateChart (migration 0474) is read only by FixedDepositProduct.activeChart, which only FD's renewInPlace and reInvest call. RD's applicableChart path is untouched. Migration 0474 also retires (is_active = false) any chart whose end_date is already past. On the dev DB this retired zero rows; check on the target DB before deploy, since there is currently no API to reactivate a retired chart. KNOWN CAVEATS -- NOT YET DONE, FLAGGING RATHER THAN HIDING ============================================================ - Migrations 0471 through 0477, the DDL ones, have never actually executed via Liquibase. They were mirrored by hand directly into the dev DB (ADD COLUMN IF NOT EXISTS, CREATE TABLE IF NOT EXISTS) so testing could proceed without a full rebuild each time. Liquibase will mark them MARK_RAN via preConditions on the dev DB's next real run, but their first genuine execution will be on whatever environment does not already have these columns and tables, such as a fresh QA or production database. Test a migration-from-scratch run before relying on this in production. - This code has not been compiled. Every new or changed method signature, import, and call site was manually cross-checked with grep against real declarations, but that is not a substitute for gradle actually compiling it. Run a full build before deploying and treat any compiler error as expected until confirmed clean. - DepositAccountAssembler pricing every new FD off the active CBS base rate master, instead of the product's own chart, whenever one exists is a real behaviour change affecting all new FD accounts of a type that has a base-rate version, not just senior-citizen ones. Flagging this for explicit product sign-off, not assuming it in this commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-23 16:44:11 +05:30
niteshandClaude Opus 5	20fe11e60d	fix(deposits): correct FD reinvestment on maturity and unblock product edit submission ... Reinvestment on maturity was creating the new deposit with a zero balance, because it sourced the amount from activateWithBalance() -- a guard that deliberately returns zero to stop a manually opened FD from auto-crediting itself. It now carries over what reInvest() actually put on the new account. Both legs of the renewal are also posted as an internal transfer, so the funds move through the transfer-suspense GL instead of appearing to leave and re-enter the cash vault. Reinvested accounts no longer fall back to a 0% rate when no chart slab covers the tenure, and a senior-citizen depositor keeps their premium rate on the renewed term. Adds a reinvestment trail: the new account records which account it came from, and the account view resolves both directions of the link so either side can be traced. Also fixes product edit submission, which failed outright for any product carrying payment-channel GL mappings: the pending-edit mapper read "glAccountId" while the payload carries "fundSourceAccountId" (and "incomeAccountId" for fee/penalty arrays), leaving gl_account_id null and tripping the satellite table's NOT NULL constraint. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 12:57:02 +05:30
niteshandClaude Sonnet 5	eb1aa767f7	fix(deposits): enforce savings-only maturity transfers and fix duplicate GL posting on FD/RD closure ... Adds validation so Transfer-to-Savings can only target a real savings account, with a proper user-facing message instead of the generic validation error. Fixes three duplicate journal-entry bugs uncovered while testing FD/RD maturity: the dormant-accounts job re-posting already-closed accounts (escheat/setSubStatusInactive/setSubStatusDormant), and the maturity-closure flow itself re-deriving accounting for a withdrawal that the account-transfer service had already posted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-20 11:04:23 +05:30
nitesh	8724c54d9b	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... # Conflicts: # fineract-provider/src/main/java/org/apache/fineract/portfolio/mobilelookup/service/MobileLookupServiceImpl.java	2026-08-19 10:50:25 +05:30
nitesh	5c0a482f49	feat(kyc): resolve DIP/MNRL demo verdicts locally, make the check toggleable ... Every mobile-number lookup was calling out to a local mock HTTP service on port 8090 that had to be started separately, so the check failed with a connection error whenever that process wasn't running. Ports the mock's full verdict table (suspected, disconnected, suspected+disconnected, clean) into MobileLookupServiceImpl itself, so the demo/test numbers resolve in-process with no HTTP call. Adds fineract.mobile-lookup.enabled (default off) to skip the real DIP/MNRL call entirely for local work; every number then resolves CLEAN and is stamped LOOKUP_DISABLED_BY_CONFIG in the log so it's never mistaken for a genuine pass. Must be turned back on before UAT/production.	2026-08-19 10:35:48 +05:30
nitesh	0e07e60328	feat(current-accounts): add document upload/list/download/delete endpoints ... /v1/currentaccounts/{id}/documents had no handler at all -- the account's own /v1/currentaccounts resource matches the request path first and has no documents method, so it never fell through to the generic /v1/{entityType}/{entityId}/documents resource that every other entity type relies on. Current accounts got a 404 on every Documents-tab request. Delegates straight to the existing DocumentApiResource so current accounts get identical behaviour to clients, loans, etc.	2026-08-19 10:35:35 +05:30
nitesh	e227e8ae0f	fix(savings): post GL entries for facility-charge collections at edit approval ... Charges collected when a maker-checker Nominee/Digital-Feature edit is approved deducted the account balance and appeared in the passbook, but never posted a journal entry -- collectCharges() saved the charge transaction directly and skipped the accounting bridge entirely, so the GL never balanced against the subledger. Also fixes an unrelated NPE this exposed: collectCharges() used saveAll() instead of saveAllAndFlush(), so the new charge transaction had no id yet when the journal-entry code tried to read it.	2026-08-19 10:35:18 +05:30
nitesh	231919b62b	fix(savings): stop crediting accounts automatically on activation ... Activation for Savings, RD, FD and Current accounts no longer books an opening deposit or enforces a minimum opening balance -- accounts go active at zero balance and a clerk deposits funds afterward as a separate transaction, matching how these branches actually operate. Fixed Deposit and Recurring Deposit have their own override of activateWithBalance() that a prior fix to the shared SavingsAccount base class missed, so they kept auto-depositing after Savings was already fixed. Removing that auto-deposit exposed two follow-on bugs in the FD/RD activation flow, now also fixed: - the opening deposit's journal entries were posted twice (once by the deposit helper, once by the activation command's own posting call) - FD/RD maturity amount was computed from the account's real (now empty) transaction history at activation and never recalculated once a deposit actually landed, so it showed no projected interest until the account was reloaded from a lucky code path	2026-08-19 10:34:54 +05:30
niteshandClaude Sonnet 5	14b2585cf5	feat(loan-origination): add full backend persistence for the sanctioning pipeline ... Adds a lightweight loan-origination-pipeline module (application, stage history, approvals, FI checks and documents) with server-side validation per stage transition, so every field, upload and decision on the Loan Origination screen survives a page refresh instead of living only in the browser. Also fixes two content-store bugs found while wiring document uploads through the generic Fineract document store: the CSV mime/extension whitelist rejected bank-statement uploads outright, and the post-upload mime consistency check rejected any CSV whose byte-content sniffs as text/plain (which is all of them, since CSV has no distinguishing magic bytes). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-17 17:12:43 +05:30
niteshandClaude Sonnet 5	c8833367b9	feat(shares): route dividend cash claims through cashier token disbursement ... Cash claims now mirror the existing clerk-withdrawal token flow: clerk submits with a token, manager approval posts the GL entry, and a cashier redeems the token at Transaction Entry to record physical hand-over -- no direct manager-to-member cash handover, and no double-disbursement. Also fixes GL accounting for the loan/savings legs: instead of reversing the native command's own debit with a second manual entry pair (leaving the fund-source account confusingly appearing twice), that debit leg is now rewritten in place to Dividend Payable. Floors cash claims to whole rupees since notes/coins can't represent paise, with backward-compatible tolerance for claims submitted before the fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-12 10:17:35 +05:30
nitesh	94b0afff38	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... # Conflicts: # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml	2026-08-11 12:53:20 +05:30
niteshandClaude Sonnet 5	9dd4f8bedb	feat(shares): real-profit driven dividends with GL-only liability model and member claim workflow ... Reworks the share dividend lifecycle end to end: - Dividend amount now auto-computed from real GL profit x officer-entered percentage instead of manual entry; adds a Dividend Paid report over the existing Dividend Payable ledger. - Declaration posts a real GL entry (Dr Reserve for Dividend / Cr Dividend Payable); approval no longer credits any savings account up front -- every member's entitlement stays a pure "Dividend Payable" liability until claimed, resolved synchronously at approval time (no background job or per-member failure mode). - New maker-checker Dividend Claim Request workflow: a clerk records how a member wants their unclaimed dividend split (overdue loan / savings credit / cash), a manager approves, which executes native repayment/deposit commands and replenishes whichever GL account they actually debited (not a hardcoded assumption) from the Dividend Payable liability. - Unclaimed dividends carry a 3-year window (m_share_dividend_lock) after which a daily job forfeits them straight to profit; a Dividend Dashboard consolidates summary stats, every declaration's status, full lock history, and proactive loan-application for members with overdue EMIs. - Fixes a native negative-share-days bug in ShareProductDividendAssembler and adds overlap-period validation so a product can't have two declarations covering the same days. - Removes the now-unreachable failed/pending-payout tracking that the old per-member job-based model needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 12:42:45 +05:30
niteshandClaude Sonnet 5	2213308254	fix(shares): skip zero-value redeem transaction on account close ... Closing a share account that already has zero approved shares no longer synthesizes a redeem transaction, so it stops posting a meaningless ₹0.00/₹0.00 GL journal-entry pair. Save/note-capture on close now happen unconditionally instead of being gated on a transaction existing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-06 20:10:57 +05:30
nitesh	c568eb0abf	feat(shares): close share account directly on withdrawal approval ... Replaces the auto-submit-closure-request behavior with an immediate account close, in the same @Transactional approval action, when a redemption brings a share account's holding to zero — no separate "Share Closure Request" maker-checker step is needed since the redemption amount itself already went through this same review. Removes ClerkShareClosureRequestApiResource entirely (the migration for m_clerk_share_closure_request is left in place as a harmless, now-unused table, to avoid a Liquibase checksum churn). Also fixes a genuine Postgres-incompatibility bug this uncovered in validateNoActiveLoanOrGuaranteeBeforeClosure(): `is_active = 1` doesn't type-check against a boolean column on Postgres ("operator does not exist: boolean = integer"), which was silently aborting the whole approval transaction (harmlessly, since it's @Transactional — verified no partial state was ever left behind). Fixed to `is_active = true`, added the missing `type_enum = 1` (customer-type guarantors only, matching the existing Guarantor Check elsewhere in this workflow), and widened both this and the active-loan check to the same loan_status_id set (300, 303, 304, 700) used there too.	2026-08-06 19:29:44 +05:30
nitesh	1426be9531	fix: correct changeset ids after renumbering merged AML/family-member migrations ... Follow-up to the previous merge commit — the internal Liquibase changeSet ids in the 9 renumbered files (0447-0455) still referenced their old 0438-0446 numbers; the rename staged the files before the id update was applied. Ids now match filenames as intended.	2026-08-06 16:50:39 +05:30
nitesh	541c6ab062	Merge branch 'demo' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... Resolved two conflicts: - changelog-tenant.xml: both branches independently added Liquibase parts numbered 0438-0446 (dev: Share Withdrawal/Closure governance + KYC exception fields; demo: AML rule tiers/branch seeding/email tracking/family-member children table). Renumbered demo's incoming set to 0447-0455 (files renamed + internal changeSet ids updated to match) so both feature sets keep their own migrations intact. - 0434_seed_aml_transaction_rules.xml: same seed data on both sides, differing only in the disambiguating SQL predicate. Kept dev's `AND aml_check_status IS NOT NULL` (deterministically targets the intended m_client_risk_rule row, per the file's own comment) over demo's `LIMIT 1` (arbitrary, could pick the wrong row). Also dropped two JVM crash-dump log files that got staged by mistake.	2026-08-06 16:49:15 +05:30
niteshandClaude Sonnet 5	66a6a4766f	feat(shares): add Share Account Closure maker-checker workflow ... New ClerkShareClosureRequestApiResource mirrors the withdrawal resource: clerk submits a closure request only once a share account holds zero shares; a /validate endpoint re-checks shares-held, account status, any active loan/guarantee, and client KYC/AML compliance; approve() executes the real native "close" command. ClerkShareWithdrawalRequestApiResource.approve() now also auto-submits a PENDING closure request (via the same table) whenever a redemption brings the account's share holding to zero, reusing the withdrawal's own maker identity — a manager still has to separately Validate and Approve it, so the closure request is created automatically but never executed without review. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-06 11:44:47 +05:30
nitesh	1a9adaec24	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev	2026-08-05 18:34:33 +05:30
niteshandClaude Sonnet 5	2da5a25e04	feat(shares): add compliance and loan/guarantor/tenure checks to validation ... The /validate endpoint now re-checks live state that matters for a real UCB share redemption: Client KYC verified, Risk Category not High, no open AML alerts, and — since this bank supports loan-against-shares via m_share_account.linked_loan_id — a Loan Check (no active loan secured by these shares), Tenure Check (linked loan's term completed), and Guarantor Check (client not guaranteeing someone else's active loan). Dropped the redundant "status is PENDING" check and replaced raw status_enum codes with human-readable labels throughout. getById() also now returns a client compliance summary so the review screen can show it without running the popup validation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-05 18:33:12 +05:30
niteshandClaude Sonnet 5	f1d68d17fe	feat(shares): add Share Withdrawal maker-checker workflow with GL settlement ... New ClerkShareWithdrawalRequestApiResource backs a clerk-submits/manager- approves flow for share redemption: on submit, validates and persists the clerk-chosen settlement Payment Type (must be non-cash) plus a full audit snapshot of the settlement row; on approve, executes the real "redeemshares" command and, in the same transaction, credits the redemption value to the share account's linked savings account using that stored payment type (with a hardcoded-lookup fallback for pre-existing rows). Adds a /validate endpoint that re-checks live account/GL state (not just the submit-time snapshot) so a manager can verify before approving. Also exposes linked-savings-account data on ShareAccount reads so the frontend can display/validate it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-05 16:56:50 +05:30
niteshandClaude Sonnet 5	7cdc25322e	fix(aml): resolve ambiguous order_position subquery breaking tenant migration/startup ... 0434_seed_aml_transaction_rules.xml resolved source_client_risk_rule_id via `SELECT id FROM m_client_risk_rule WHERE order_position = N`, assuming order_position was unique. It isn't: 0430_seed_aml_compliance_rules.xml seeds its own 221 rows with order_position 1-235, independently of the older 0428_add_client_risk_rules.xml rows, and several values collide (e.g. both insert a row at order_position 10 and 30). Every affected subquery returned more than one row, aborting the whole tenant's Liquibase run and app startup. aml_check_status is populated only on 0430's rows (0428's predate that column and are NULL there), so pairing it with order_position uniquely targets the intended row without touching either seed changeset. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 14:27:08 +05:30
nitesh	a4c3dbb6c4	Merge remote-tracking branch 'origin/dev' into uate	2026-07-31 13:58:55 +05:30
niteshandClaude Sonnet 5	dd8445de06	fix(accounting): resolve Sponsor DD Payable SBI GL account parent by gl_code, update default tenant DB password ... The 0345 changelog hardcoded the "OTHER LIABILITY" parent row's numeric id (22), which only matched the default tenant's auto-increment history and broke the FK insert (and the whole Liquibase run / app startup) on tenants seeded differently, e.g. saga. Now resolves parent_id via a SELECT on gl_code='9' and marks the changeSet runOnChange so it safely re-validates on tenants that already ran the old version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 13:56:04 +05:30
nitesh	9345f2294c	Merge remote-tracking branch 'origin/uate' into uate	2026-07-31 13:54:07 +05:30
niteshandClaude Sonnet 5	190cd92a85	fix(accounting): resolve Sponsor DD Payable SBI GL account parent by gl_code, update default tenant DB password ... The 0345 changelog hardcoded the "OTHER LIABILITY" parent row's numeric id (22), which only matched the default tenant's auto-increment history and broke the FK insert (and the whole Liquibase run / app startup) on tenants seeded differently, e.g. saga. Now resolves parent_id via a SELECT on gl_code='9' and marks the changeSet runOnChange so it safely re-validates on tenants that already ran the old version. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 13:53:27 +05:30
nitesh	b1cfa996b4	feat(clients): fromDate/toDate submittedon_date range filter on GET /clients ... Backs the Client Approval tab's Today/Yesterday quick filters server-side. offset/limit/displayName/orderBy/sortOrder/status already existed on this endpoint; added fromDate/toDate (yyyy-MM-dd, inclusive) alongside them, filtering on c.submittedon_date, following the same ::date-cast convention already used by ClientPendingEditReadPlatformServiceImpl for the equivalent pending-edits filter. Updated the one other caller (SelfClientsApiResource) to pass null/null.	2026-07-30 10:33:48 +05:30
nitesh	02541eed6c	feat(sanctions): expose the loaded list's data-currency date on every screening result ... Screening only ever told a caller whether a name matched and when the check ran — not which dated snapshot of the UN Security Council list it ran against. Added SanctionsEntryRepository.findListLastLoadedOn() (MAX(createdDate) over active entries) and threaded it through SanctionsScreeningResult as listDataAsOf, so the frontend can show "List Data As Of: <date>" alongside "Screened On".	2026-07-30 10:33:33 +05:30
niteshandClaude Sonnet 5	7c15fbb0c7	fix(documentmanagement): close leaked file handles causing Windows re-upload failures; add entity KYC document CodeValues ... FileContentStoreService.upload() opened a FileOutputStream (write) and an InputStream (post-upload MIME check) without closing either. Windows keeps those handles open for the JVM's lifetime, so the next upsert-style delete-then-recreate of the same file (e.g. client signature/photo re-upload) failed with FileSystemException: "being used by another process". Wrapped both in try-with-resources. Also adds every distinct non-individual/constitution KYC document name (HUF, Private/Public Ltd, LLP, Partnership, Trust, Society, Proprietorship, Association, Govt/PSU, Cooperative) as a KYCIdProofType code value. resolveDocumentTypeId() on the frontend matches the picked document name against this list before creating a client_identifier; since these entity document names had no corresponding code value, every non-individual client's KYC document upload silently failed to persist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-29 11:34:18 +05:30
nitesh	6e3f195de0	Merge remote-tracking branch 'origin/uate' into uate	2026-07-29 10:31:58 +05:30
niteshandClaude Sonnet 5	a65d801250	feat(clients): maker-checker for client creation and edits (backend) ... - Client activation now requires a different user than the one who created the client (client.getCreatedBy() vs current user) — no bypass, including CHECKER_SUPER_USER, since a bypass would recreate the exact "role bypasses the hold" loophole this closes. Client creation itself is unaffected (the wizard needs a real client id immediately for photo/KYC/address/family follow-up uploads), only activation is gated. - New maker-checker queue for Client edits, modelled on this codebase's existing m_share_account_pending_edit / chequebook patterns rather than Fineract's native command-approval engine (which any ALL_FUNCTIONS role bypasses unconditionally): - m_client_pending_edit (migrations 0429-0431): stores the maker's raw edit payload plus a point-in-time "before" snapshot (original_json, extracted from the frontend's _originalValues key) so the checker's diff stays accurate even after the edit is approved/rejected, when the live client no longer reflects the pre-edit state. - ClientEditWritePlatformService: submitEditForApproval() stages the edit (refusing a second submission while one's already pending, via a nullable-but-unique pending_lock_key); approveEdit() replays the payload through the existing updateClient() so all of Client's validation/change-detection runs unchanged, just deferred; rejectEdit() discards it. The maker can never approve/reject their own submission. - ClientEditApiResource: /clients/{id}/edit (submit), /clients/edit/pending (paginated + status/clientName/date-range filterable list, mirrors /chequebook/pending-requests), /clients/{id}/edit/approve, /clients/{id}/edit/reject. New permissions (migration 0430): SUBMITEDIT_CLIENT, APPROVEEDIT_CLIENT, REJECTEDIT_CLIENT, APPROVEEDIT_CLIENT_CHECKER (the last one surfaces pending edits in the generic Checker Inbox too). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-29 10:31:10 +05:30
niteshandClaude Sonnet 5	3c58bb231f	fix(clients): pwdCategoryOptions on edit template, minor-age threshold to 18, minor KYC identity-proof bypass ... - ClientData.templateOnTop()/templateWithSavingAccountOptions() never copied pwdCategoryOptions from the template — the Disability Type dropdown was always empty on the edit-mode GET /clients/{id}?template=true call, even though create-time template() had it. - Raise the minor-detection threshold in ClientKycApiResource from age <10 to <18 (legal definition), mirroring the frontend's own rule so the required-documents list served here stays consistent. - ClientKycCommand.validateForInitiate() unconditionally required at least one of PAN/Aadhaar/GSTIN, with no awareness of the Birth Certificate/School ID document-type picker minors actually use — blocking "Save & Next" on the KYC tab for every minor client. Added a skipIdentityDocumentCheck flag, set from client.getIsMinor() at both call sites (initiateKyc/initiateKycInline). - Added Birth Certificate and School ID Card as KYCIdProofType code values — they were already offered as document-type options for minors but never existed in the code-value list that saveKycDocProof() resolves against, so selecting either silently failed to save any identifier/document. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 15:51:08 +05:30
niteshandClaude Sonnet 5	aabda18b69	feat(clients): enforce Mother + Father/Caretaker family members on client activation ... - Add CARETAKER as a new RELATIONSHIP code value (previously missing — a client with no father had no valid way to satisfy the rule below). - Add ClientFamilyMembersWritePlatformService.validateFamilyRequirementsForActivation(), called from activateClient(): requires an active "Mother" family member, plus either "Father" or "Caretaker", for individual clients (non-individual entities are exempt). - Two distinct exceptions (ClientFamilyMemberMotherRequiredException / ClientFamilyMemberFatherOrCaretakerRequiredException) so the two failure reasons surface as separate errors instead of one merged message, mirroring the frontend's separate banners. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 12:37:24 +05:30
nitesh	0e5671b706	Merge remote-tracking branch 'origin/uate' into uate	2026-07-28 10:55:05 +05:30
niteshandClaude Sonnet 5	67214ec0f8	fix(clients): stale signature bug, CKYC fixes, monthly turnover/annual income, senior citizen/PWD classification ... - Add m_client.signature_id (single-slot pointer, mirrors image_id) plus ClientSignatureIdAdapter/EntitySignatureIdAdapter so re-uploading a signature updates the existing m_document row in place instead of leaving duplicate rows behind that readers picked inconsistently. - Fix CkycBatchBuilderServiceImpl address-proof classification to read the client identifier's actual m_code (KYCAddressProofType vs KYCIdProofType) instead of a hardcoded string set that disagreed with the CKYC tab and silently dropped Aadhaar-as-address-proof identifiers. - Organize the CKYC ZIP into per-artefact-type folders (PHOTO/SIGNATURE/ID_PROOF/ADDRESS_PROOF). - Fix CkycBatchBuilderServiceImpl.createBatch() using the daily batch sequence number as the ZIP document's parent_entity_id instead of the real m_ckyc_batch.id, which 404'd on download whenever the two diverged (i.e. almost always). - Add monthlyTurnover and annualIncome fields alongside the existing annualTurnover/monthlyIncome. - Add isSeniorCitizen, isPwd, and pwdCategory (proper m_code_value-backed PwdCategory code, not a free-text column) to m_client, following the same pattern as occupation/religion/marital status. - Add Diploma as its own Education Level (with diploma-specific DegreeQualification values) and Graduate as a level distinct from Undergraduate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 10:50:16 +05:30
nitesh	bc30241950	Merge remote-tracking branch 'origin/uate' into dev	2026-07-27 14:24:16 +05:30
niteshandClaude Sonnet 5	14df914b9a	feat(clients): dual-OTP verified contact changes with customer notification ... Mobile number and email address changes now require OTP verification on both the old and new destination (staff-entered) before the update is accepted, at both client creation and edit time — closing a gap where an unverified wrong number/email could never be corrected later. Every mobile/email/address change also emails the customer at their pre-change address so an unauthorized change is never silent. - New ClientContactOtpService (+Impl) mirrors the existing login OTP services, reusing OtpLog with a CLIENT_CONTACT_CHANGE purpose. - New sibling API resources for edit (/clients/{id}/contact-verification/otp) and create (/clients/contact-verification/otp, no clientId yet). - ClientWritePlatformServiceJpaRepositoryImpl / AddressWritePlatformServiceImpl gate the actual field change on verified OTPs and fire ClientChangeNotificationService afterwards; the notification recipient is always snapshotted before any mutation so a same-request mobile+email change can't accidentally alert the new (unverified-by-its-real-owner) address instead of the old one. - ClientDataValidator validates OTP id format only (ignoreIfNull) — enforcement lives solely in the write-service's diff-gated calls, since edit-client always PUTs the full client object regardless of what changed. - 0420 migration seeds 8 CLIENTKYC action permissions (GenerateAadhaarOtp/VerifyAadhaar/VerifyPan/VerifyCin/VerifyDin/ VerifyGstin/UploadCkyc/CompleteRekyc) that were referenced by existing command handlers but never seeded, causing a 404 for every user including Super User. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-26 14:36:48 +05:30
niteshandClaude Sonnet 5	5dc175c5e1	feat(users): auto-enroll admin-chosen OTP channel as MFA factor at creation ... Admin now picks a mandatory OTP delivery method (Email/Mobile) when creating a user. The channel is enrolled immediately as a verified m_user_mfa_factor row, so the existing 2FA system (MfaFactorBackedTwoFactorServiceImpl + /twofactor) challenges the user for OTP on their very first login - reusing the already-built login-OTP infrastructure instead of a parallel flow. Also adds a versioned, admin-manageable user-agreement (disclaimer) API (/v1/useragreements) with per-user acceptance tracking, checked right after every login, plus a Liquibase cleanup migration and a shared OTP-destination masking utility extracted from the two existing login-OTP services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 16:16:40 +05:30
nitesh	cf60515bf6	Merge remote-tracking branch 'nexora/uate' into merge-uate-into-dev ... # Conflicts: # .gitignore # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml # fineract-savings/src/main/java/org/apache/fineract/portfolio/savings/service/FacilityChargeAutoApplyService.java	2026-07-23 17:36:10 +05:30
niteshandClaude Sonnet 5	a098f8ba75	fix(chequebook): prevent cheque-leaf serial collisions across series at issuance time ... The real root cause behind the leaf-serial collision bug: stock-lot overlap checking was scoped to "within the same series only" (ChequeStockLotRepository.countOverlappingInSeries), on the incorrect assumption that two different cheque designs never share a numeric range. A real bank allocates leaf serials from one bank-wide numbering authority, so this is exactly what let two series end up with overlapping ranges that, once both were issued to the same account, produced an unresolvable serial collision (NpciInwardPushService's drawer-account-number disambiguation can't help when every colliding leaf belongs to the same account). Widened the check to countOverlappingAnySeries — both the maker-submit and checker-approval paths in ChequeBookWritePlatformServiceImpl now reject a stock receipt whose range overlaps ANY existing lot, regardless of series. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 17:24:17 +05:30