11 Commits

Include renames

Author	SHA1	Message	Date
niteshandClaude Opus 5.5	f016bde385	feat(cfcfrms): I4C-MHA API integration with holds, intimation, GRM and MRM ... Real NCRP-CFCFRMS integration to the I4C-MHA API Specification 2.0, alongside the existing demo module (new paths under /v1/i4c, /v1/i4c/admin, /v1/i4c/cases). - Inbound token and complaint APIs (Bearer / Basic / body auth, CryptoJS AES, IP allowlist), Section 5 / Section 7 acks, idempotent repeat pushes. - Complaint processing: account and transaction matching, automatic hold of the disputed amount with prospective top-up, onward trace, Section 6 response via an outbox with retry, optional ack callback, API log for the periodic review. - Holds register: 90-day review, maker-checker release (full or partial), freeze / unfreeze, unfreeze-and-release. - Automatic customer intimation (email active, SMS / WhatsApp configurable) with manual recording and history. - GRM grievance register (EDD, GR id, nodal, IO / DGRO / SGRO decisions, deadlines, escalation) and MRM restoration register (assessment, pro-rata, victim request and papers, bank actions, restoration to the victim through a restoration pool, victim-bank cases), documents with SHA-256, statements. - Paged, filterable officer lists with date ranges; local I4C simulator. - Migrations 0610-0613, jobs I4C Dispatch and I4C Hold Review, runbook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 11:43:22 +05:30
niteshandClaude Sonnet 5	5dc175c5e1	feat(users): auto-enroll admin-chosen OTP channel as MFA factor at creation ... Admin now picks a mandatory OTP delivery method (Email/Mobile) when creating a user. The channel is enrolled immediately as a verified m_user_mfa_factor row, so the existing 2FA system (MfaFactorBackedTwoFactorServiceImpl + /twofactor) challenges the user for OTP on their very first login - reusing the already-built login-OTP infrastructure instead of a parallel flow. Also adds a versioned, admin-manageable user-agreement (disclaimer) API (/v1/useragreements) with per-user acceptance tracking, checked right after every login, plus a Liquibase cleanup migration and a shared OTP-destination masking utility extracted from the two existing login-OTP services. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 16:16:40 +05:30
Aditya	28fa6d9615	Merge feature/Backend-DSC-MFA into feature/merge_update_code ... Brings TOTP / Google Authenticator MFA factor (device mapping at /v1/mfa/totp/setup + /verify, login via existing twofactor pipeline), DSC-2FA login UI fix, Individual-only filter on guardian/nominee/family link pickers, Title Case normalization on client names, and migration 0296 unique nominee per account type. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> # Conflicts: # .claude/settings.local.json # fineract-provider/logs/fineract.log	2026-05-15 17:54:49 +05:30
AdityaandClaude Opus 4.7	45a041b023	Add Google Authenticator (TOTP) as MFA factor: device mapping + login ... Backend: - New dependency dev.samstevens.totp:totp:1.7.1 (bundles ZXing for QR PNG). - TotpService: secret/QR/otpauth-URL/verify primitives. SHA1, 6 digits, 30s — the standard combo every consumer authenticator app accepts unconfigured. Issuer label is configurable via FINERACT_MFA_TOTP_ISSUER, defaults to "CBSnexora". - Two-step device mapping driven by TotpEnrollmentService: * POST /v1/mfa/totp/setup — generate secret, upsert m_user_mfa_factor row as factor_type=TOTP/verified=false, return {secret, qrDataUri, otpAuthUrl, issuer, factorId}. Refuses to overwrite an already-verified-and-active factor so an accidental click can't unbind the user's working device. * POST /v1/mfa/totp/verify — body {code}; verify against the stored secret and flip verified=true on success. - Login wiring in MfaFactorBackedTwoFactorServiceImpl: * getDeliveryMethodsForUser surfaces verified TOTP factors as {name:"totp", target:"Google Authenticator"} so the picker offers it alongside SMS/EMAIL. * createNewOTPToken("totp") creates a no-op OTPRequest (no LincPay/SMTP round-trip) carrying the factor id in the token field so validate can look up the secret. * createAccessTokenFromOTP branches on channel — TOTP path verifies code vs factor.secret with totp library (sliding 1-step window) and mints a TFAccessToken with the same lifetime + extended-token logic as OTP. * Defence-in-depth: re-checks at validate time that the factor still belongs to the user, is verified, and not disabled. - TwoFactorConstants.TOTP_DELIVERY_METHOD_NAME = "totp". - SecurityConfig: /api/*/mfa/totp/** is fullyAuthenticated() (exempt from the TFA gate so users can enrol before they can satisfy 2FA). UI changes pending (see chat): add a "Google Authenticator" tile on the MFA Factors settings page that calls /setup → shows QR + secret → calls /verify; extend two-factor-authentication.component.ts iconFor() and copy for the new "totp" delivery method. Existing requestOTP / validateOTP pipeline handles the login flow transparently. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-15 17:41:55 +05:30
Nitesh Yadav	001a79e35e	merge code feature/Backend-DSC-MFA this branch date 15-05-2026	2026-05-15 13:08:15 +05:30
AdityaandClaude Opus 4.7	e1d7db9b7c	DSC as first-class MFA factor + branded helper UI ... - m_user_mfa_factor is now the single 2FA gate. DSC enroll callback writes a factor row (factor_type=DSC), revoke flips disabled_on when the last cert goes. AuthenticationApiResource and TwoFactorAuthenticationFilter drop the direct m_bank_user_dsc check so disabling from the UI actually stops the challenge at login. - SecurityConfig exempts /api/*/dsc/** and /api/*/mfa/factors from the TWOFACTOR_AUTHENTICATED gate. Without this a user with a verified factor can't manage their own factors after they break the device. - MfaFactorType gains a DSC enum value; SelfUserMfaFactorServiceImpl error message lists it. - dsc-helper: CBSnexora-branded header (logo, title, subtitle, accent palette), 8-column cert table (Holder Name, Alias, Organisation, DSC Type, Serial, Issuer, Valid From, Expires), LdapName-based DN parsing, sign+verify proof- of-possession that picks SHA256withRSA / SHA256withECDSA from the key's own algorithm (works on RSA, RSA Signing-only, EC), pattern-matched JNLP age check, dscType JNLP-arg override with KeyUsage fallback. - generate-test-dsc.ps1 produces a realistic self-signed DSC with strong key protection so dev testing sees real CN/O values and a PIN prompt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 18:05:12 +05:30
Nitesh Yadav	167079c2d7	merege code feature/Backend-DSC-MFA branch	2026-05-12 12:48:43 +05:30
AdityaandClaude Opus 4.7	8284851f67	Add DSC-based MFA: enrollment, login factor, JWS helper, tenant-scoped serving ... Backend: - m_bank_user_dsc + m_dsc_challenge tables (Liquibase 0292/0293/0294) - DSC enrollment flow: start → JNLP → JWS helper → callback → upsert - DSC login factor: challenge → sign → verify → claim minted TFA token - 2FA gate now also accepts an active DSC mapping (AuthenticationApiResource + TwoFactorAuthenticationFilter), defensively wrapped so a missing DSC table doesn't 500 the auth path - TenantAwareBasicAuthenticationFilter exempts /api/v*/dsc/helper.jar and strips Authorization header for that path so JWS's raw GET works without the user seeing a browser Basic-auth prompt - DSC helper JAR served at /api/v*/dsc/helper.jar from a configurable filesystem path (default ~/.cbsnexora/dsc-helper.jar) Java helper JAR (dsc-helper/): - Standalone Gradle subproject, Java 8 target, fat jar with Gson shaded in - Cross-platform token picker (Windows Cert Store / ePass2003 / eToken / ProxKey / Other) — matches the JNLP arg contract emitted by the backend - Sets Fineract-Platform-TenantId on its callback POST from the JNLP args - JNLP age check now reads cbsnexora-dsc.jnlp (current name) AND SignTender.jnlp (legacy) — picks the youngest, never blocks if none exist Inline KYC upsert in updateClient (mirror of the create-flow path): - ClientKycWritePlatformService.upsertKycInline() — creates or merges KYC fields, bumps status to IN_PROGRESS on real changes; resets PAN verification on PAN edit of a verified record - ClientWritePlatformServiceJpaRepositoryImpl.updateClient() handles the kyc:{} sub-object on PUT /clients/{id}, matching createClient User uniqueness: - m_appuser.email + m_appuser.mobile_no UNIQUE (Liquibase 0295) - Pre-flight assertEmailAndMobileUnique() in create/update with self-exclusion - handleDataIntegrityIssues maps the two new constraints to clean field-scoped error messages (race-condition safety net) Email OTP subject line now: "Your OTP for Login - <AppName> (dd-MM-yy-HH:mm)" where AppName comes from fineract.email.from-name (default "CBSnexora"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 11:13:19 +05:30
AdityaandClaude Opus 4.7	5e3212dc54	Add MFA backend: SMS/email OTP, factor management, OTP audit log ... - Login 2FA via @Primary MfaFactorBackedTwoFactorServiceImpl (replaces legacy) - LincPay SMS OTP and SMTP email OTP with auto-promote to m_user_mfa_factor - Reusable EmailSenderService + EmailTemplateService (CBSnexora branding) - Admin OTP audit viewer (GET /v1/otp-logs) with paging, search, masking - Self-service MFA factor API at /v1/mfa/factors - READ_OTP_LOG permission + OTP Log Auditor role + bankadmin direct grant - JsonAuthenticationEntryPoint suppresses Basic-auth popup for SPA paths - TwoFactorAuthenticationFilter grants TWOFACTOR_AUTHENTICATED when no challenge - Soft-delete + audit columns + deletion audit + version on client tables - CIF number generator (TTYYYYNNNNNN format) - DocumentNotFoundExceptionMapper to silence noisy WARN logs on missing images - Liquibase migrations 0278-0291 (MFA, OTP log, audit/soft-delete, role wiring) Note: application.properties intentionally not committed — contains local DB and Gmail App Password fallbacks. Set SPRING_MAIL_PASSWORD, FINERACT_DEFAULT_TENANTDB_PWD, FINERACT_HIKARI_PASSWORD as env vars in prod. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-10 13:19:10 +05:30
DeathGun44andAdam Saghy	ca3e980543	FINERACT-2003: Enforce password reset on first login ... :wq	2026-02-19 11:14:17 +00:00
Jose Alberto HernandezandAleksandar Vidakovic	356dd07ca0	FINERACT-1932: Fineract modularization - fineract-security	2026-02-12 14:01:38 +01:00