5 Commits

Include renames

Author	SHA1	Message	Date
Nitesh Yadav	167079c2d7	merege code feature/Backend-DSC-MFA branch	2026-05-12 12:48:43 +05:30
AdityaandClaude Opus 4.7	8284851f67	Add DSC-based MFA: enrollment, login factor, JWS helper, tenant-scoped serving ... Backend: - m_bank_user_dsc + m_dsc_challenge tables (Liquibase 0292/0293/0294) - DSC enrollment flow: start → JNLP → JWS helper → callback → upsert - DSC login factor: challenge → sign → verify → claim minted TFA token - 2FA gate now also accepts an active DSC mapping (AuthenticationApiResource + TwoFactorAuthenticationFilter), defensively wrapped so a missing DSC table doesn't 500 the auth path - TenantAwareBasicAuthenticationFilter exempts /api/v*/dsc/helper.jar and strips Authorization header for that path so JWS's raw GET works without the user seeing a browser Basic-auth prompt - DSC helper JAR served at /api/v*/dsc/helper.jar from a configurable filesystem path (default ~/.cbsnexora/dsc-helper.jar) Java helper JAR (dsc-helper/): - Standalone Gradle subproject, Java 8 target, fat jar with Gson shaded in - Cross-platform token picker (Windows Cert Store / ePass2003 / eToken / ProxKey / Other) — matches the JNLP arg contract emitted by the backend - Sets Fineract-Platform-TenantId on its callback POST from the JNLP args - JNLP age check now reads cbsnexora-dsc.jnlp (current name) AND SignTender.jnlp (legacy) — picks the youngest, never blocks if none exist Inline KYC upsert in updateClient (mirror of the create-flow path): - ClientKycWritePlatformService.upsertKycInline() — creates or merges KYC fields, bumps status to IN_PROGRESS on real changes; resets PAN verification on PAN edit of a verified record - ClientWritePlatformServiceJpaRepositoryImpl.updateClient() handles the kyc:{} sub-object on PUT /clients/{id}, matching createClient User uniqueness: - m_appuser.email + m_appuser.mobile_no UNIQUE (Liquibase 0295) - Pre-flight assertEmailAndMobileUnique() in create/update with self-exclusion - handleDataIntegrityIssues maps the two new constraints to clean field-scoped error messages (race-condition safety net) Email OTP subject line now: "Your OTP for Login - <AppName> (dd-MM-yy-HH:mm)" where AppName comes from fineract.email.from-name (default "CBSnexora"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:13:19 +05:30
AdityaandClaude Opus 4.7	5e3212dc54	Add MFA backend: SMS/email OTP, factor management, OTP audit log ... - Login 2FA via @Primary MfaFactorBackedTwoFactorServiceImpl (replaces legacy) - LincPay SMS OTP and SMTP email OTP with auto-promote to m_user_mfa_factor - Reusable EmailSenderService + EmailTemplateService (CBSnexora branding) - Admin OTP audit viewer (GET /v1/otp-logs) with paging, search, masking - Self-service MFA factor API at /v1/mfa/factors - READ_OTP_LOG permission + OTP Log Auditor role + bankadmin direct grant - JsonAuthenticationEntryPoint suppresses Basic-auth popup for SPA paths - TwoFactorAuthenticationFilter grants TWOFACTOR_AUTHENTICATED when no challenge - Soft-delete + audit columns + deletion audit + version on client tables - CIF number generator (TTYYYYNNNNNN format) - DocumentNotFoundExceptionMapper to silence noisy WARN logs on missing images - Liquibase migrations 0278-0291 (MFA, OTP log, audit/soft-delete, role wiring) Note: application.properties intentionally not committed — contains local DB and Gmail App Password fallbacks. Set SPRING_MAIL_PASSWORD, FINERACT_DEFAULT_TENANTDB_PWD, FINERACT_HIKARI_PASSWORD as env vars in prod. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 13:19:10 +05:30
DeathGun44andAdam Saghy	ca3e980543	FINERACT-2003: Enforce password reset on first login ... :wq	2026-02-19 11:14:17 +00:00
Jose Alberto HernandezandAleksandar Vidakovic	356dd07ca0	FINERACT-1932: Fineract modularization - fineract-security	2026-02-12 14:01:38 +01:00