479 Commits

Include renames

Author	SHA1	Message	Date
keshav	a8ca7dd948	feat: implement DIP/MNRL lookups and enhance Sanctions screening workflows ... - Implement DIP/MNRL lookup logs table, filtering, and detail review under reports. - Integrate DIP verification gating on client creation, allowing officers to record PROCEEDED/REJECTED decisions with reasons. - Upgrade Sanctions verification dialog to support comparing Name, DOB, and Nationality particulars. - Add Sanctions disposition recording (FALSE_POSITIVE / CONFIRMED_MATCH) awaiting Principal Officer approval. - Add sanctions-alert-review-dialog for reviewers to assess and escalate/clear flagged names. - Enforce strict screening reset logic on client name changes, preventing bypass of existing blocks. - Update routes and shell menu navigation to include DIP/MNRL Lookups and Sanctions Logs.	2026-08-14 10:46:59 +05:30
nitesh	94b0afff38	Merge branch 'dev' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... # Conflicts: # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml	2026-08-11 12:53:20 +05:30
niteshandClaude Sonnet 5	9dd4f8bedb	feat(shares): real-profit driven dividends with GL-only liability model and member claim workflow ... Reworks the share dividend lifecycle end to end: - Dividend amount now auto-computed from real GL profit x officer-entered percentage instead of manual entry; adds a Dividend Paid report over the existing Dividend Payable ledger. - Declaration posts a real GL entry (Dr Reserve for Dividend / Cr Dividend Payable); approval no longer credits any savings account up front -- every member's entitlement stays a pure "Dividend Payable" liability until claimed, resolved synchronously at approval time (no background job or per-member failure mode). - New maker-checker Dividend Claim Request workflow: a clerk records how a member wants their unclaimed dividend split (overdue loan / savings credit / cash), a manager approves, which executes native repayment/deposit commands and replenishes whichever GL account they actually debited (not a hardcoded assumption) from the Dividend Payable liability. - Unclaimed dividends carry a 3-year window (m_share_dividend_lock) after which a daily job forfeits them straight to profit; a Dividend Dashboard consolidates summary stats, every declaration's status, full lock history, and proactive loan-application for members with overdue EMIs. - Fixes a native negative-share-days bug in ShareProductDividendAssembler and adds overlap-period validation so a product can't have two declarations covering the same days. - Removes the now-unreachable failed/pending-payout tracking that the old per-member job-based model needed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 12:42:45 +05:30
keshav	1107610c08	add KYC document renewal alerts, Aadhaar/PAN exceptions, and AML recurring alerts UI; remove old journal AML marking	2026-08-11 11:34:54 +05:30
nitesh	541c6ab062	Merge branch 'demo' of https://git.lincpay.tech/CBSNexora/cbsnexora-backend into dev ... Resolved two conflicts: - changelog-tenant.xml: both branches independently added Liquibase parts numbered 0438-0446 (dev: Share Withdrawal/Closure governance + KYC exception fields; demo: AML rule tiers/branch seeding/email tracking/family-member children table). Renumbered demo's incoming set to 0447-0455 (files renamed + internal changeSet ids updated to match) so both feature sets keep their own migrations intact. - 0434_seed_aml_transaction_rules.xml: same seed data on both sides, differing only in the disambiguating SQL predicate. Kept dev's `AND aml_check_status IS NOT NULL` (deterministically targets the intended m_client_risk_rule row, per the file's own comment) over demo's `LIMIT 1` (arbitrary, could pick the wrong row). Also dropped two JVM crash-dump log files that got staged by mistake.	2026-08-06 16:49:15 +05:30
Anshul Rathore	b9aa29fb35	feat: commit latest changes on dev	2026-08-06 10:46:22 +05:30
keshav	baf30cff68	kyc exception at client creation time and some tds work	2026-08-05 17:27:56 +05:30
keshav	7773a9e9c6	feat(aml): add API endpoints and services for manual journal entry referrals	2026-08-03 10:49:37 +05:30
keshav	c890faee78	form 91/98 report, min max value update in AML rule and whihc rule apply day, week, month and some more updates	2026-08-02 11:45:54 +05:30
keshav	abc7eb22a2	oss file updated, profitl loss as per the day month and also with date select	2026-08-01 11:54:30 +05:30
keshav	2022dc5241	kyc risk and AML & Compliance Checks automate on client creation	2026-07-31 11:02:31 +05:30
nitesh	02541eed6c	feat(sanctions): expose the loaded list's data-currency date on every screening result ... Screening only ever told a caller whether a name matched and when the check ran — not which dated snapshot of the UN Security Council list it ran against. Added SanctionsEntryRepository.findListLastLoadedOn() (MAX(createdDate) over active entries) and threaded it through SanctionsScreeningResult as listDataAsOf, so the frontend can show "List Data As Of: <date>" alongside "Screened On".	2026-07-30 10:33:33 +05:30
keshav	f45d5890ea	CTR/STR report and Risk Category auto mark on bases of person occupation and anual salary enter	2026-07-29 10:22:27 +05:30
niteshandClaude Sonnet 5	3c58bb231f	fix(clients): pwdCategoryOptions on edit template, minor-age threshold to 18, minor KYC identity-proof bypass ... - ClientData.templateOnTop()/templateWithSavingAccountOptions() never copied pwdCategoryOptions from the template — the Disability Type dropdown was always empty on the edit-mode GET /clients/{id}?template=true call, even though create-time template() had it. - Raise the minor-detection threshold in ClientKycApiResource from age <10 to <18 (legal definition), mirroring the frontend's own rule so the required-documents list served here stays consistent. - ClientKycCommand.validateForInitiate() unconditionally required at least one of PAN/Aadhaar/GSTIN, with no awareness of the Birth Certificate/School ID document-type picker minors actually use — blocking "Save & Next" on the KYC tab for every minor client. Added a skipIdentityDocumentCheck flag, set from client.getIsMinor() at both call sites (initiateKyc/initiateKycInline). - Added Birth Certificate and School ID Card as KYCIdProofType code values — they were already offered as document-type options for minors but never existed in the code-value list that saveKycDocProof() resolves against, so selecting either silently failed to save any identifier/document. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 15:51:08 +05:30
nitesh	0e5671b706	Merge remote-tracking branch 'origin/uate' into uate	2026-07-28 10:55:05 +05:30
niteshandClaude Sonnet 5	67214ec0f8	fix(clients): stale signature bug, CKYC fixes, monthly turnover/annual income, senior citizen/PWD classification ... - Add m_client.signature_id (single-slot pointer, mirrors image_id) plus ClientSignatureIdAdapter/EntitySignatureIdAdapter so re-uploading a signature updates the existing m_document row in place instead of leaving duplicate rows behind that readers picked inconsistently. - Fix CkycBatchBuilderServiceImpl address-proof classification to read the client identifier's actual m_code (KYCAddressProofType vs KYCIdProofType) instead of a hardcoded string set that disagreed with the CKYC tab and silently dropped Aadhaar-as-address-proof identifiers. - Organize the CKYC ZIP into per-artefact-type folders (PHOTO/SIGNATURE/ID_PROOF/ADDRESS_PROOF). - Fix CkycBatchBuilderServiceImpl.createBatch() using the daily batch sequence number as the ZIP document's parent_entity_id instead of the real m_ckyc_batch.id, which 404'd on download whenever the two diverged (i.e. almost always). - Add monthlyTurnover and annualIncome fields alongside the existing annualTurnover/monthlyIncome. - Add isSeniorCitizen, isPwd, and pwdCategory (proper m_code_value-backed PwdCategory code, not a free-text column) to m_client, following the same pattern as occupation/religion/marital status. - Add Diploma as its own Education Level (with diploma-specific DegreeQualification values) and Graduate as a level distinct from Undergraduate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 10:50:16 +05:30
keshav	026d902199	minor change on client	2026-07-28 10:43:06 +05:30
niteshandClaude Sonnet 5	14df914b9a	feat(clients): dual-OTP verified contact changes with customer notification ... Mobile number and email address changes now require OTP verification on both the old and new destination (staff-entered) before the update is accepted, at both client creation and edit time — closing a gap where an unverified wrong number/email could never be corrected later. Every mobile/email/address change also emails the customer at their pre-change address so an unauthorized change is never silent. - New ClientContactOtpService (+Impl) mirrors the existing login OTP services, reusing OtpLog with a CLIENT_CONTACT_CHANGE purpose. - New sibling API resources for edit (/clients/{id}/contact-verification/otp) and create (/clients/contact-verification/otp, no clientId yet). - ClientWritePlatformServiceJpaRepositoryImpl / AddressWritePlatformServiceImpl gate the actual field change on verified OTPs and fire ClientChangeNotificationService afterwards; the notification recipient is always snapshotted before any mutation so a same-request mobile+email change can't accidentally alert the new (unverified-by-its-real-owner) address instead of the old one. - ClientDataValidator validates OTP id format only (ignoreIfNull) — enforcement lives solely in the write-service's diff-gated calls, since edit-client always PUTs the full client object regardless of what changed. - 0420 migration seeds 8 CLIENTKYC action permissions (GenerateAadhaarOtp/VerifyAadhaar/VerifyPan/VerifyCin/VerifyDin/ VerifyGstin/UploadCkyc/CompleteRekyc) that were referenced by existing command handlers but never seeded, causing a 404 for every user including Super User. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-26 14:36:48 +05:30
niteshandClaude Sonnet 5	5dc175c5e1	feat(users): auto-enroll admin-chosen OTP channel as MFA factor at creation ... Admin now picks a mandatory OTP delivery method (Email/Mobile) when creating a user. The channel is enrolled immediately as a verified m_user_mfa_factor row, so the existing 2FA system (MfaFactorBackedTwoFactorServiceImpl + /twofactor) challenges the user for OTP on their very first login - reusing the already-built login-OTP infrastructure instead of a parallel flow. Also adds a versioned, admin-manageable user-agreement (disclaimer) API (/v1/useragreements) with per-user acceptance tracking, checked right after every login, plus a Liquibase cleanup migration and a shared OTP-destination masking utility extracted from the two existing login-OTP services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 16:16:40 +05:30
nitesh	cf60515bf6	Merge remote-tracking branch 'nexora/uate' into merge-uate-into-dev ... # Conflicts: # .gitignore # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml # fineract-savings/src/main/java/org/apache/fineract/portfolio/savings/service/FacilityChargeAutoApplyService.java	2026-07-23 17:36:10 +05:30
Jaanu423andClaude Sonnet 5	ab5666c0f4	feat(ctsclearing): signature-verification gate and full NPCI field capture for inward cheques ... Adds a manual signature-verification step to the inward CTS decision flow: a new VERIFY_SIGNATURE command records the clerk's confirmation, and InwardClearingItem.pass() now refuses to pass a cheque until signatureOk is true — enforced server-side, not just a disabled UI button. Fixes a real bug where ChequeLeaf.leafSerialNo collides across different cheque books/series (by design — serials are only unique per stock lot), which could resolve an inward item to the wrong account. NpciInwardPushService now disambiguates using the drawer account number NPCI already sends alongside the cheque number. Also closes a completeness gap found by auditing the outward-CBS -> NPCI -> inward-CBS pipeline: five fields NPCI sends on every instrument (drawer account number, deposit account number, instrument type/description, drawee bank name, per-check IQA breakdown) were read and discarded instead of persisted — now saved via new columns and exposed on the read API. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-22 12:30:07 +05:30
Jaanu423andClaude Sonnet 5	b433edfdfe	feat(clearing): add CTS/NACH clearing modules with real NPCI integration ... - Inward/outward CTS clearing (capture, validate, settle, dishonour), positive pay, settlement/reconciliation, and NACH clearing modules - Real, separate NPCI clearing-house integration: hybrid RSA+AES envelope crypto, bank self-registration, outward batch submission, and an inward push webhook - Outward clearing is now session-batched: a 2-hourly scheduled job (plus the existing manual "Send Pending Batch" fallback) bundles CAPTURED cheques instead of sending them one at a time - Batch-summary read APIs and date/text filters across inward batches, outward presentments, and outward batches Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-21 15:46:52 +05:30
Jaanu423andClaude Sonnet 5	3bb7fc8050	feat(chequebook): add RETURNED leaf status for dishonoured/bounced cheques ... Adds a maker-checker-gated "return" command on cheque books that flags presented-and-dishonoured leaves as terminal RETURNED (distinct from STOP_PAYMENT/drawer-initiated and LOST/custody-failure), following the same reason/actor/timestamp pattern already used for lost/cancelled/used leaves on m_cheque_leaf. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-15 16:07:04 +05:30
Jaanu423	04d65d857f	feat(chequebook): add cheque book module with Maker-Checker workflow ... Adds cheque series, stock lot/transfer, cheque book issuance, stop-payment/lost/cancel-leaf actions, and pending-request approval APIs with Maker-Checker command handlers and liquibase changelogs.	2026-07-15 11:13:06 +05:30
keshav898966	b064ee6307	existing account saving and current add or remove nominee and digital & account features and also FE & RD nominee add or remove	2026-07-10 18:40:16 +05:30
Jaanu423andClaude Sonnet 4.6	f13a9c6bba	merge(release): merge feature/minor-update into release/share-account-module ... Combines election module + UAT catch-up migrations (0338-0367) with minor-update changes: soft delete for tellers (0338), share linking for current account (0339), terminate flag for savings/current (0340). Resolved changelog conflict by appending minor-update entries after 0367. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-09 13:43:03 +05:30
keshav898966	9980310c9e	table changes on Maker-Checker workflow for Products, with approval-based updates and product locking to prevent concurrent edits	2026-07-06 17:49:39 +05:30
keshav898966	b0bfa386ce	implemented a Maker-Checker workflow for Products, with approval-based updates and product locking to prevent concurrent edits	2026-07-03 15:15:09 +05:30
keshav898966	99c153830c	pending account terminate feature develop	2026-07-01 17:25:04 +05:30
Jaanu423andClaude Sonnet 4.6	fc80869d4b	feat(guarantor): enrich guarantor accounts API with loan health and borrower details ... - Add borrower name, savings account, guaranteed/released/remaining amounts, loan timeline, and overdue info to GuarantorAccountSummaryData - Fix duplicate rows in GuarantorLoanAccountSummaryDataMapper by joining savings account via guarantor funding details instead of client ID - Fix NPE in GuarantorDomainServiceImpl when loan product guarantee details are null Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-24 13:15:25 +05:30
Jaanu423andClaude Sonnet 4.6	a051faba5d	feat(accounts): backend fixes for Modify Application feature (Current/Savings/FD/RD) ... Current Account: - CurrentAccountReadPlatformServiceImpl: add retrieveJointHolders() and retrievePartners() - CurrentAccountWritePlatformServiceImpl: full modifyApplication() - updates all CBS fields, joint holders, partners, nominees, facility config, dates, introducer - Fix cbsAccountType save: parse string account type from 'accountType' JSON field Nominees: - ClientNomineeWritePlatformService: add replaceNomineesForAccount() for atomic replace - Savings/FD/RD modifyApplication: replace nominees on modify FD/RD Read (DepositAccountReadPlatformServiceImpl): - Add isSeniorCitizen, seniorCitizenInterestRate to BASE SQL SELECT - Add setCbsAccountFields() call in FD/RD mappers reading accountStatus, modeOfOperation, introducerClientId, guardianFields, linkedAccountId, isSeniorCitizen from ResultSet - Fix retrieveOne() to also fetch joint holders from m_savings_account_joint_holders - Use explicit LinkedHashMap in joint holder query (camelCase keys for Angular) FD/RD Data Classes: - FixedDepositAccountData: add accountStatus, modeOfOperation, introducerClientId, linkedAccountId, jointHolders, isSeniorCitizen, seniorCitizenInterestRate fields - RecurringDepositAccountData: same fields added - Fix all factory methods (withInterestChartAndRecurringDetails, withClosureTemplateDetails, withTemplateOptions, associationsAndTemplate) to call copyCbsFieldsFrom() - Fix SavingsAccountReadPlatformServiceImpl joint holders: use camelCase keys FD Calculator: - FixedDepositAccountInterestCalculationServiceImpl: add calculateExact() with actual calendar-based calculation matching PostingPeriod engine (exact same as account creation) - Add submittedOnDate, daysInYear, interestPostingPeriodInMonths optional params - Support interestCompoundingPeriodInMonths=0 (daily compounding) in both validator and calc - DepositsApiConstants: add submittedOnDate/dateFormat/locale/daysInYear to allowed params - DepositAccountDataValidator: allow 0 (daily) in interestCompoundingPeriodInMonths Misc: - SavingsProductData: null-check in isCashBased/isAccrualBased methods (NPE fix) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-03 10:32:59 +05:30
Aditya	ae7017ca81	@ ... feat(fundtransfer+imps+mfa): fund transfer module, IMPS switch client, MFA log API - Fund transfer: NEFT/RTGS/IMPS/internal strategies, limit resolution, bulk transfer, verification tokens, suspense GL, recall/approval flow, jobs - IMPS CBS switch client with crypto (JWT/envelope) and transaction domain - MFA log read API (audit of MFA events) - Liquibase migrations 0300-0311 for fund transfer / IMPS tables, permissions, roles, and suspense account - JobName, SecurityConfig, dependencies.gradle wiring Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> @	2026-06-01 12:18:30 +05:30
Jaanu423andClaude Sonnet 4.6	2251fd2259	feat: current account standing instructions - full backend support ... - StandingInstructionData: rename conflicting Lombok getters (getInstructionType, getRecurrenceType, getRecurrenceFrequency, getFromAccountType, getToAccountType, getTransferType) to domain enum methods so Jackson serializes EnumOptionData fields as {id, code, value} objects instead of plain strings - AccountTransfersWritePlatformServiceImpl: add current account transfer support for all 4 missing cases (Current->Savings, Savings->Current, Current->Current, Current->Loan) with performCurrentWithdrawal/performCurrentDeposit helpers - AccountConfiguration: wire CurrentAccountRepository and CurrentAccountTransactionRepository into AccountTransfersWritePlatformService bean - StandingInstructionApiResource: fix getValue() type mismatch after getter rename - ExecuteStandingInstructionsTasklet: update to use renamed enum accessor methods - PortfolioAccountType: add CURRENT(3) type support - DB migration: 0301_add_current_account_to_transfer_details.xml adds from_current_account_id and to_current_account_id columns to transfer details table Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-26 10:55:35 +05:30
Jaanu423andClaude Sonnet 4.6	ea2dfd789d	feat: senior citizen interest rate fix for FD/RD accounts + CBS table renames ... - Apply senior citizen rate override in FixedDepositAccount and RecurringDepositAccount getEffectiveInterestRateAsFraction() so maturity is calculated at correct rate (e.g. 7.5%) instead of chart slab rate on every event: submit, activate, posting, pre-closure, maturity - Override getEffectiveInterestRateAsFractionAccrual() in both FD/RD to keep accrual consistent with maturity calculation — independent of DB nominalAnnualInterestRate value - Add isSeniorCitizen and seniorCitizenInterestRate fields to SavingsAccount entity with JPA mapping and accessor methods; updateNominalAnnualInterestRate() helper added - Extend DepositsApiConstants whitelist and SavingsAccountAssembler.applyCbsFields() to read and persist senior citizen fields from API request as final override step - Add DepositAccountAssembler early-stage rate override for senior citizen accounts - Liquibase migration 2015: add is_senior_citizen and senior_citizen_interest_rate columns to m_savings_account table - Liquibase migration 0300: rename fd_base_interest_rate tables to CBS naming convention - Update CBS copyright header in FdBaseInterestRateEffective and FdBaseInterestRateSlabHistory Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-21 20:57:17 +05:30
Jaanu423andClaude Sonnet 4.6	9f627bde61	feat: accounts list — active-only filter, date range & as-on-date search (backend) ... - SearchParameters: added fromDate, toDate, asOnDate (LocalDate) fields with hasX() helpers - SavingsAccountsApiResource: added status, fromDate, toDate, asOnDate query params - SavingsAccountReadPlatformServiceImpl: resolveStatusEnum(), date filters on activatedon_date, default ORDER BY id DESC - CurrentAccountsApiResource + service: same filters on ca.status_enum and ca.activatedon_date - DepositAccountReadPlatformService (interface): new retrieveAllPaged overload with date/status params - DepositAccountReadPlatformServiceImpl: resolveStatusEnum(), date filters, default ORDER BY id DESC for FD/RD - FixedDepositAccountsApiResource + RecurringDepositAccountsApiResource: pass new params to service Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-21 13:56:31 +05:30
Jaanu423andClaude Sonnet 4.6	ce0fb18eeb	feat: implement full current account transaction write service ... - New CurrentAccountTransactionWritePlatformService interface with deposit, withdrawal, holdAmount, releaseAmount, undoTransaction, reverseTransaction, and adjustTransaction operations - New CurrentAccountTransactionWritePlatformServiceImpl using m_current_account tables directly (not m_savings_account), with GL journal entry posting - Add holdAmount, releaseAmount, reversal factory methods to CurrentAccountTransaction - Wire all 7 current account transaction command handlers to new write service - Fix CurrentAccountTransactionsApiResource template SQL column: currency_multiplesof - Fix account number search in SearchParameters Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-21 11:20:30 +05:30
Aditya	be26ba16c9	Merge remote-tracking branch 'self-hosted/feature/account-charges' into feature/Backend-DSC-MFA ... # Conflicts: # fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml	2026-05-20 13:26:58 +05:30
AdityaandClaude Opus 4.7	8b4351013e	Client uniqueness pre-save check + seed all Indian states & UTs ... Pre-save validator (ClientWritePlatformServiceJpaRepositoryImpl.validateClientUniqueness) rejects duplicate mobile / email / PAN / Aadhaar (masked) / GSTIN before saveAndFlush and before the LincPay KYC API call. Avoids burning vendor credits on identity-duplicate records and gives the UI a clean field-level 403 instead of waiting for the DB constraint. Splits the new repository finders into "create" and "excluding-self" variants so a nullable Long parameter never reaches PostgreSQL's parser (same bigint <> varchar trap that broke the family-member POST earlier). Also seeds the full set of 28 Indian States + 8 UTs as STATE code_values (migration 0297). Previously only MAHARASHTRA / MADHYA_PRADESH / DELHI existed and the names were UPPER_SNAKE_CASE; the postal PIN-lookup service returns "Madhya Pradesh" so any state other than Maharashtra/Delhi silently failed to resolve to m_address.state_province_id. Renames the 3 existing rows in place (preserves their ids/FKs) and inserts the missing 33 with idempotent preConditions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 12:31:54 +05:30
Nitesh YadavandClaude Sonnet 4.6	cc0ccbb461	feat: multi-nominee support, duplicate validation, and FD/RD required fields ... Account Creation Enhancements: - Added multi-nominee support for SB, CA, FD, RD accounts (nominees[] array) - Backend: saveNomineesIfPresent() validates total share <= 100% before saving - Added 'nominees' to parameter whitelists (SavingsAccountConstant, DepositsApiConstants) Duplicate Validation Fixes: - SB/FD/RD: Fixed duplicate externalId error handler to walk full exception cause chain (EclipseLink wraps PSQLException deep) — now matches constraint 'm_savings_account_external_id_key' and returns proper 400 error - CA: Added try-catch around both saveAndFlush calls for duplicate externalId (constraint: ca_unq_external_id) with throwIfDuplicateExternalId() helper - CA: Added duplicate product check — blocks creating same product twice for client - SB/FD/RD: Added JpaSystemException handling via getAllCauseMessages() helper Current Account (CA) Improvements: - CurrentAccount entity: added @UniqueConstraint for external_id (ca_unq_external_id) - CurrentAccountRepository: added countActiveByClientAndProduct() JPQL query - Liquibase 0298: unique constraint on m_current_account.external_id FD/RD Required Field Validation (Backend): - DepositAccountDataValidator: depositPeriod now required for RD (was FD-only) - DepositAccountDataValidator: mandatoryRecommendedDepositAmount now notNull+positive for RD - DepositAccountDataValidator: customerSegment now required (notBlank) for both FD and RD Liquibase Migrations: - 0297: fix unique nominee per account constraint - 0298: unique external_id on m_current_account - 2014: add is_mandatory column to m_savings_account_joint_holders Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-20 08:00:00 +05:30
Nitesh Yadav	4eeee03f24	fixed error nominee add error	2026-05-15 16:09:13 +05:30
Nitesh Yadav	001a79e35e	merge code feature/Backend-DSC-MFA this branch date 15-05-2026	2026-05-15 13:08:15 +05:30
AdityaandClaude Opus 4.7	6558ea6998	DSC-2FA login fix + Individual-only link pickers + Title Case names ... - DSC-as-2FA login: UI's claimAndValidate() now calls a new AuthenticationService.applyTwoFactorToken(token, liveSeconds) instead of validateOTP(). The /v1/login/dsc/{rn}/claim response is already a minted TFAccessToken — POSTing it to /twofactor/validate fails because that path expects an in-memory OTPRequest. applyTwoFactorToken runs only the post-success bookkeeping (interceptor.setTwoFactorAccessToken, setCredentials, Authentication Success alert that drives router.navigate(['/']), and sessionStorage persist of {token, validFrom, validTo}). Fixes the OTPTokenInvalidException users hit after a successful DSC verify+claim. - Individual-only filter for link-client pickers: ClientTextSearch gains a legalFormType field; SearchingClientRepository accepts an Integer legalForm value and adds cb.equal(r.get("legalForm"), ...) to the spec. ClientSearchService.parseLegalForm tolerates INDIVIDUAL/PERSON/1 and NON_INDIVIDUAL/ENTITY/2; unknown = no filter so a typo doesn't blank results. UI: clients.service.ts searchByText gains a 7th optional arg; six link pickers (guardian, nominee, family-member across create flow and post-create tabs) now pass 'INDIVIDUAL'. General client list and signatory picker are intentionally unchanged. - Title-case client names on persistence: ClientWritePlatformServiceJpa RepositoryImpl now runs first/middle/last/full name fields through toTitleCase() on both create and update paths. "aditya kumar vyas", "ADITYA KUMAR VYAS", "Aditya Kumar Vyas" all persist as "Aditya Kumar Vyas". Whitespace-split title case; preserves hyphens/apostrophes inside words without re-capitalising after them so clerks verifying against ID documents see predictable output. - Migration 0296: unique constraint to prevent duplicate nominee per account type (the underlying repository + service changes also persisted in this commit complete the enforcement path). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-15 11:50:04 +05:30
AdityaandClaude Opus 4.7	e1d7db9b7c	DSC as first-class MFA factor + branded helper UI ... - m_user_mfa_factor is now the single 2FA gate. DSC enroll callback writes a factor row (factor_type=DSC), revoke flips disabled_on when the last cert goes. AuthenticationApiResource and TwoFactorAuthenticationFilter drop the direct m_bank_user_dsc check so disabling from the UI actually stops the challenge at login. - SecurityConfig exempts /api/*/dsc/** and /api/*/mfa/factors from the TWOFACTOR_AUTHENTICATED gate. Without this a user with a verified factor can't manage their own factors after they break the device. - MfaFactorType gains a DSC enum value; SelfUserMfaFactorServiceImpl error message lists it. - dsc-helper: CBSnexora-branded header (logo, title, subtitle, accent palette), 8-column cert table (Holder Name, Alias, Organisation, DSC Type, Serial, Issuer, Valid From, Expires), LdapName-based DN parsing, sign+verify proof- of-possession that picks SHA256withRSA / SHA256withECDSA from the key's own algorithm (works on RSA, RSA Signing-only, EC), pattern-matched JNLP age check, dscType JNLP-arg override with KeyUsage fallback. - generate-test-dsc.ps1 produces a realistic self-signed DSC with strong key protection so dev testing sees real CN/O values and a PIN prompt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 18:05:12 +05:30
Nitesh Yadav	167079c2d7	merege code feature/Backend-DSC-MFA branch	2026-05-12 12:48:43 +05:30
AdityaandClaude Opus 4.7	8284851f67	Add DSC-based MFA: enrollment, login factor, JWS helper, tenant-scoped serving ... Backend: - m_bank_user_dsc + m_dsc_challenge tables (Liquibase 0292/0293/0294) - DSC enrollment flow: start → JNLP → JWS helper → callback → upsert - DSC login factor: challenge → sign → verify → claim minted TFA token - 2FA gate now also accepts an active DSC mapping (AuthenticationApiResource + TwoFactorAuthenticationFilter), defensively wrapped so a missing DSC table doesn't 500 the auth path - TenantAwareBasicAuthenticationFilter exempts /api/v*/dsc/helper.jar and strips Authorization header for that path so JWS's raw GET works without the user seeing a browser Basic-auth prompt - DSC helper JAR served at /api/v*/dsc/helper.jar from a configurable filesystem path (default ~/.cbsnexora/dsc-helper.jar) Java helper JAR (dsc-helper/): - Standalone Gradle subproject, Java 8 target, fat jar with Gson shaded in - Cross-platform token picker (Windows Cert Store / ePass2003 / eToken / ProxKey / Other) — matches the JNLP arg contract emitted by the backend - Sets Fineract-Platform-TenantId on its callback POST from the JNLP args - JNLP age check now reads cbsnexora-dsc.jnlp (current name) AND SignTender.jnlp (legacy) — picks the youngest, never blocks if none exist Inline KYC upsert in updateClient (mirror of the create-flow path): - ClientKycWritePlatformService.upsertKycInline() — creates or merges KYC fields, bumps status to IN_PROGRESS on real changes; resets PAN verification on PAN edit of a verified record - ClientWritePlatformServiceJpaRepositoryImpl.updateClient() handles the kyc:{} sub-object on PUT /clients/{id}, matching createClient User uniqueness: - m_appuser.email + m_appuser.mobile_no UNIQUE (Liquibase 0295) - Pre-flight assertEmailAndMobileUnique() in create/update with self-exclusion - handleDataIntegrityIssues maps the two new constraints to clean field-scoped error messages (race-condition safety net) Email OTP subject line now: "Your OTP for Login - <AppName> (dd-MM-yy-HH:mm)" where AppName comes from fineract.email.from-name (default "CBSnexora"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:13:19 +05:30
Nitesh Yadav	6b65bdc8ce	merge feature/update_code and feature/Backend-MFA-Product branch code	2026-05-11 10:44:57 +05:30
AdityaandClaude Opus 4.7	5e3212dc54	Add MFA backend: SMS/email OTP, factor management, OTP audit log ... - Login 2FA via @Primary MfaFactorBackedTwoFactorServiceImpl (replaces legacy) - LincPay SMS OTP and SMTP email OTP with auto-promote to m_user_mfa_factor - Reusable EmailSenderService + EmailTemplateService (CBSnexora branding) - Admin OTP audit viewer (GET /v1/otp-logs) with paging, search, masking - Self-service MFA factor API at /v1/mfa/factors - READ_OTP_LOG permission + OTP Log Auditor role + bankadmin direct grant - JsonAuthenticationEntryPoint suppresses Basic-auth popup for SPA paths - TwoFactorAuthenticationFilter grants TWOFACTOR_AUTHENTICATED when no challenge - Soft-delete + audit columns + deletion audit + version on client tables - CIF number generator (TTYYYYNNNNNN format) - DocumentNotFoundExceptionMapper to silence noisy WARN logs on missing images - Liquibase migrations 0278-0291 (MFA, OTP log, audit/soft-delete, role wiring) Note: application.properties intentionally not committed — contains local DB and Gmail App Password fallbacks. Set SPRING_MAIL_PASSWORD, FINERACT_DEFAULT_TENANTDB_PWD, FINERACT_HIKARI_PASSWORD as env vars in prod. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 13:19:10 +05:30
Nitesh Yadav	fbc6fcdcc1	rd and fd product and account code update	2026-05-08 15:55:22 +05:30
Nitesh Yadav	f1535a40c8	fd account complete mddule	2026-05-07 17:19:34 +05:30
Nitesh Yadav	407d567175	update fd account	2026-05-07 10:56:29 +05:30